Privacy & Cookies Policy

Introduction

This website (“Site”) is controlled and operated by McArthurGlen UK Limited (referred to in this Privacy Policy as "McArthurGlen", "we", "us" or "our").

McArthurGlen develops and manages designer outlet centres across the UK and Europe.  We work with our other Group Companies to provide services at these centres and to facilitate and enhance your experience at these centres and on this Site.

This Privacy Policy ("Policy") explains what personal information we and our Group Companies collect and record about you and what we do with that information, including when you visit this Site. It set outs a description of your data protection rights, including your right to object to some of the processing which we carry out. This Policy also explains what personal information we collect and record on our in-centre computers and devices and in certain cases offline, and what we do with that information. Annexed to this Policy is additional information that relates specifically to the personal information we collect and record when you use WiFi provided by us and via our Group Companies (“WiFi Annex”).  Please read this Policy carefully.

For the purposes of this Policy: References in this Policy to “you" or “your” are references to individuals whose personal data is processed by us, including anyone who uses our Site, purchases products from our Site or uses the WiFi provided by us. “Group Company” means our parent company and any subsidiaries of our parent company, including us. This includes our subsidiary management companies operating in each of our locations. A list of these Group Companies and their locations can be found at the end of this Policy. We may change this list from time to time; "Centre Owner" means an owner of one of the designer outlet centres which we manage (“Centre”).

For the purposes of this Privacy & Cookies Policy the controller of personal data is generally McArthurGlen UK Limited, and our contact details are set out in the Contact section at the end of this Privacy Policy. If the data controller is another Group Company, this will be explicitly stated at the point where the data is collected or, respectively, where you have been referred to this Policy.

We do not knowingly collect personal information from children under 16 years of age.  If you are under 16 years old, please do not provide any personal information to us.

Information we collect

We collect, receive, store and process the following information about you:

  • information that you provide via the Site, including information you provide when you register with the Site (e.g. name, address, telephone numbers, email address and date of birth), join our McArthurGlen Club (our club where you can sign up to keep up to date with our latest news, events and offers), purchase a gift card, book parking, enter into competitions or complete surveys, participate in a contest or promotion, or join or post comments on our social media sites;
  • information that you provide to us for the purpose of subscribing to direct marketing;
  • information about your computer and about your visits to and use of this Site, such as Internet Protocol (IP) addresses, date and time that you visited the Site, the type of Internet browser and computer operating system, referral source, length of visit, page views and website navigation paths;
  • information relating to any purchases you make via our Site (e.g. gift cards) or any other transactions that you enter into through our Site (including your name, address, telephone number, email address, card details and transaction history);
  • information that you provide to us for the purpose of Click and Reserve via our Site;
  • information contained in or relating to any communications that you send to us or send through our Site (including the communication content and meta data associated with the communication);
  • information we obtain from private social media companies (see also Social Media below) including from outside the European Union, about your interests and preferences;
  • information as set out in the 'Cookies and similar technologies' section below;
  • information collected through transactions or interactions offline or on our in-centre computers or devices, including information you provide when signing up to our McArthurGlen Club, when purchasing gift cards, when completing surveys, entering into competitions and when using in-centre computers and devices;
  • information collected by our systems during your visits to our Centres, such as CCTV footage or ANPR data; and
  • information described in the WiFi Annex.

We do not attempt to collect special categories of personal data about you, or data relating to criminal offences or convictions. Special category data includes personal data relating to health, race or ethnic origin, religious or political beliefs, political opinions, sex life or sexual orientation, trade union membership and biometric data.  However, it is possible that we will on occasion process special categories of personal data about you, where you expressly provide it or when this is inferred from data you provide to us, e.g. where you include it in the personalised message you write when purchasing a gift card.

We may collect, use and share aggregated data such as statistical data for any purpose. Aggregated data may be derived from your personal data but does not directly or indirectly reveal your identity. For example, we may anonymise and aggregate your usage data to calculate the percentage of users accessing a specific Site feature.

Use of your information

We use your personal information for the following purposes:

  • to administer our Site, business and the Centres;
  • to enable your use of the products and services available on our Site or otherwise made available offline or on our in-centre computers and devices;
  • to provide and administer our McArthurGlen Club;
  • to manage and run competitions or offers;
  • to confirm orders and fulfil orders placed on our Site;
  • to respond to your questions or requests for additional information and communicate with you about the Site and the Centres;
  • to provide you with information that you have specifically requested or that we have asked if you would like to receive;
  • for internal research and analysis so that we can see how our Site and the Centres’ and/or our Group Companies' products and services are being used, understand how we can improve our Site and the Centres’ and/or our Group Companies' products and services and decide our and our Group Companies’ marketing strategies;
  • to deal with enquiries and complaints made by or about you relating to us, our Site and the Centres;
  • to keep our Site and systems secure and prevent fraud;
  • where relevant, to meet legal, regulatory and compliance requirements;
  • where relevant, for the establishment, exercise or defence of legal claims;
  • in order to carry out tasks or achieve objectives in our legitimate commercial interests;
  • to monitor and analyse the use of any account to prevent, investigate and/or report security incidents or crime;
  • verify compliance with the terms and conditions governing the use of our Site and in-centre computers and devices;
  • to protect the rights, property, or safety of us, Group Companies, our customers, Centre Owners or others;
  • to understand your interests and preferences so we can tailor the content, offers and promotions we surface on our Site to better match your interests and preferences – see also our Cookie Policy
  • to understand and identify the features of our customer base for insight purposes and in order to better target our advertising (e.g. reaching out to a similar demographic on social media);
  • to send customer satisfaction surveys to you; and
  • for the purposes described in the WiFi Annex.

We will also inform you from time to time of other products and/or services we offer which we consider may be of interest to you by email / phone / SMS / post, where permitted by applicable law (which may require that we obtain your consent). As well as unsubscribing within communications, you may email us at any time at preferences@mcarthurglen.com to indicate that you do not want to receive direct marketing communications from us.

We may combine information we collect about you through transactions or interactions offline or on our in-centre terminals or our email and SMS communications with the customer profile we hold about you in order to tailor our subsequent communications and communication channels to better match your interests and preferences and provide you with a better customer experience.

Social media

We also use personal information we obtain from social media sites online including, Facebook, Instagram, Twitter, YouTube and TripAdvisor for our (and our businesses’) research and analytics purpose. Where appropriate, and in line with their own policies, we may match information from these sites to better understand, and improve, our customers' experience. This includes posts or other information made public or made available to us where you use hashtags or tags relating to us, our Group Companies, our business, the Centre Owners, the Centres and our industry. Information from these sites may include information which has been held outside the European Union.

Sharing your information

We disclose or transfer personal information to other parties as follows:

  • to any Group Company for the purposes identified in this Policy, including those uses set out above (a list of our Group Companies and their locations can be found at the end of this Policy);
  • to third party service providers that perform functions on our behalf in relation to the Site and the purposes set out in this Policy (for example, website hosting, social media analysis providers, marketing email service providers, data analysts website developers);
  • to brand partners (stores) in order to fulfil Click and Reserve orders;
  • media agencies and their advertising partners in order to run targeted marketing campaigns as described above;
  • if we are under a duty to disclose or share your personal information in order to comply with any legal obligation, or in order to enforce or apply our terms and conditions or other agreements or to protect the rights, property, or safety of McArthurGlen, the Group Companies, our customers, or others;
  • to government authorities, and to other third parties when compelled to do so by government and law enforcement authorities or otherwise as required or permitted by law, including but not limited to in response to court orders and subpoenas. We also disclose user information when we have reason to believe that someone is causing injury to or interference with our rights or property, other users of our site, or anyone else that could be harmed by such activities. Additionally, we cooperate with law enforcement inquiries and other third parties to enforce laws, intellectual property rights and other rights;
  • to sellers or buyers as part of a sale or merger of our business or assets;
  • in compliance with and to the extent permitted by data protection regulation, to an applicable Centre Owner or one of its group companies or to buyers as part of a sale or merger of a Centre Owner or Centre. In addition, if we or one of our Group Companies ceases the role as a manager of a designer outlet centre, we will need to transfer your personal data to the Centre Owner or the replacement manager to ensure the continuity of our, or our relevant Group Company's products and services; and
  • as described in the WiFi Annex.

In addition, with your consent where required by law, we share your personal information with carefully selected third parties so that they can send you information about special promotions and offers.

To enhance your shopping experience, our Site may include links to other websites. Those websites will have their own privacy policies that you may wish to review. We have no control over, or responsibility for, the data processing carried out by these linked websites.

We also share information about visitors to this Site in an anonymous or aggregate form with third parties including advertisers, business partners, and sponsors, to understand customer trends and patterns and manage and improve our business relationships.

We require all third party service providers to respect the security of your personal data and to treat it in accordance with the law, maintaining minimum standards of confidentiality. We do not allow our third-party service providers who process your personal data on our behalf (data processors) to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

If you would like a list of the third parties with whom we share personal information, please contact Savannah Christensen, Data Protection Officer, compliance.officer@mcarthurglen.com.

Cookies and similar technologies

We are committed to ensuring that your privacy is protected. We aim to be as open and transparent as possible around the information we collect when you visit our Site, including through the use of "cookies".

This section explains what cookies are and how we use them. It also explains the different types of cookies we use, and how you can change or delete them. We hope that this helps you understand and feel more confident about our use of cookies. If you have any further queries, please contact Savannah Christensen, Data Protection Officer, compliance.officer@mcarthurglen.com.

What are Cookies?

Cookies are small pieces of information sent by a web server and stored on the user's computer or other device by the web browser while browsing a website, which allow the server to remember user input, other user-specific information, and/or to uniquely identify the computer or other device when visiting each page.

We also use other tracking technologies, which are similar to cookies.  This can include pixel tags and tracking URLs.  All these technologies are together referred to in this Cookie Policy as “Cookies”.

How do we use Cookies?

 

The types of Cookies that we use on our Site, and the purposes for which they are used, are set out below.  Note that the Cookies we use are subject to change and that we endeavour to keep our Cookie list up to date.

 

  • Strictly necessary cookies: These cookies are essential in order to enable you to move around our Site and use its features, such as accessing secure areas of our Site. Without these cookies, any services on our Site you wish to access cannot be provided.

 

  • Analytical/performance cookies: These cookies collect information about how you and other visitors use our Site, for instance which pages you go to most often, and if you get error messages from web pages. We use data from these cookies to help test designs and to ensure a consistent look and feel is maintained on your visit to the Site. All information these cookies collect is aggregated. It is only used to improve how a website works.

 

We use Google Analytics, for example, to anonymously track website usage and activity. Google Analytics is a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses “cookies”, which are text files placed on your computer, to help the website analyse how users use the site. The information generated by the cookie about your use of the website (including your IP address) will be transmitted to and stored by Google on servers in the United States. In case of activation of the IP anonymization, Google will truncate/anonymize the last octet of the IP address for Member States of the European Union as well as for other parties to the Agreement on the European Economic Area. Only in exceptional cases, the full IP address is sent to and shortened by Google servers in the USA. On behalf of the website provider Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage to the website provider. Google will not associate your IP address with any other data held by Google. You may refuse the use of cookies by selecting the appropriate settings on your browser. However, please note that if you do this, you may not be able to use the full functionality of this website. Furthermore you can prevent Google’s collection and use of data (cookies and IP address) by downloading and installing the browser plug-in available under https://tools.google.com/dlpage/gaoptout?hl=en-GB.

 

You can refuse the use of Google Analytics by clicking on the following link. An opt-out cookie will be set on the computer, which prevents the future collection of your data when visiting this Site. <a href=“javascript:gaOptout()“>Disable Google Analytics</a>.

 

Further information concerning the terms and conditions of use and data privacy can be found at http://www.google.com/analytics/terms/gb.html or at https://www.google.de/intl/en_uk/policies/. Please note that on this website, Google Analytics code is supplemented by “anonymizeIp” to ensure an anonymized collection of IP addresses (so called IP-masking).

 

  • Functionality cookies: These cookies allow our Site to remember choices you make (such as your user name, language or the region you are in) and provide enhanced, more personal features. These cookies can also be used to remember changes you have made to text size, fonts and other parts of web pages that you can customise. They may also be used to provide services you have asked for such as watching a video or commenting. Additionally, these cookies can be used to allow an optional service to function such as offering a live chat session. The information these cookies collect may be anonymised and they cannot track your browsing activity on other websites.

 

  • Targeting cookies: These cookies are used to deliver adverts more relevant to you and your interests. They are also used to limit the number of times you see an advertisement as well as help measure the effectiveness of the advertising campaign. They are usually placed by advertising networks with the website operator’s permission. They remember that you have visited a website and this information is shared with other organisations such as advertisers. Quite often targeting or advertising cookies will be linked to site functionality provided by the other organisation.

 

  • Social media cookies: These cookies allow you to share what you’ve been doing on our Site on social media such as Facebook and Twitter. These cookies are not within our control. Please refer to the respective privacy policies for how their cookies work.

 

  • Pixel tags: Also known as a clear GIF or web beacon. These are invisible tags placed on certain pages of our Site but not on your computer. When you access these pages, pixel tags generate a generic notice of that visit. They usually work in conjunction with cookies, registering when a particular device visits a particular page. If you turn off cookies, the pixel tag will simply detect an anonymous website visit.

 

  • Tracking URLs: These are used to determine from which referring website the Site is accessed.

 

We require your consent for the use of Cookies that are not strictly necessary. You can give your consent by clicking allow on the cookie banner displayed on the landing page of our website. Please note that we track your consent using a technical Cookie; therefore, in the event you delete any Cookies stored on your devices you will see the Cookie banner once again.

 

If you do not want to allow Cookies at all, or only want to allow use of certain Cookies, please refer to your browser settings. You can also use your browser settings to withdraw your consent to our use of Cookies at any time and delete Cookies that have already been set. Please note that by deleting our cookies or disabling future Cookies you may not be able to access certain areas or features of our Site.

 

To find out more about Cookies please visit: www.allaboutcookies.org or see www.youronlinechoices.eu which contains further information about behavioural advertising and online privacy.

Security

We take reasonable steps to protect your personal information as you visit and use the Site and to protect such information from loss, misuse, unauthorised access, disclosure, alteration or destruction. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality. Unfortunately no data transmission can be guaranteed to be 100% secure. As a result we cannot warrant the security of any information you provide to us via the public internet infrastructure and we advise you take reasonable precautions in submitting personal data to us, such as selecting an email provider that supports transport encryption. However, we have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

International data transfers

You understand and acknowledge that by using this Site, we collect and use personal information in the UK.  The same applies in other situations where we collect and use personal data. However, where another Group Company is identified as the data controller, the location will instead be the country Our Group Company locations are set out in the 'Our Group Companies' section below.

We transfer personal information to countries outside the original country to our Group Companies and to third parties in the United Kingdom, the European Economic Area (“EEA”) and beyond, including to countries which have different data protection standards to those which apply in the UK and EEA. Our service providers include locations in Australia and Canada.

Where service providers process your personal information in countries deemed adequate by the European Commission (such as Canada or Jersey), we rely on the European Commission's decision to protect your personal information. As a result of the UK's exit from the European Union in future we may also take account of decisions of the UK government that a particular country provides adequate protection for the receipt of personal data.

For transfers to Group Companies and service providers outside the UK or EEA, where the country to which the data is transferred has not received an adequacy decision, we use standard contractual clauses approved by the European Commission to protect your personal information, a service provider's (EU data protection authority approved) corporate rules that are in place to protect your personal information  or any other valid data transfer tool or derogation that is compliant under data protection laws. You have a right to ask us for a copy of the standard contractual clauses (by contacting us as set out below).

Retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for. We may retain your personal data for a longer period in the event of a complaint to us.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

We conduct regular data cleansing and updating exercises to ensure that the data that we hold is accurate, and that we are not holding data for too long.

In relation to marketing, we retain personal information used to send you direct marketing for as long as we can lawfully market to you. Where we no longer have grounds to market to you (e.g. because you opt-out) or the details we hold are no longer up-to-date (e.g. the email address we hold is invalid) we will delete personal information we hold about you from our marketing database but retain some information on a 'suppression list' on an ongoing basis so we can manage your preferences going forward.

Personal information captured for competition purposes, or for the processing of gift cards, is cleansed regularly.

If we anonymise your personal data for statistical purposes so that it can no longer be associated with you, we may use this information indefinitely without further notice to you.

In relation to Cookies, the two types of cookies we use are known as session cookies and persistent cookies:

  • A session cookie is used each time you visit our Site to give you a session ID. We use this type of cookie to link your actions on our Site and each session cookie will only last for a browser session, at the end of which it will expire. Each browser session starts when you open your browser window and finishes when you close your browser window. After your visit to our Site all session cookies are deleted and each time you visit our website you will have a different session ID.
  • A persistent cookie allows the preferences or actions of the user across a site (or across different sites) to be remembered. It has a longer lifetime than a session cookie and lasts for the period of time specified in the cookie (this will vary from cookie to cookie). This type of cookie will not be deleted when you close your browser window and will be stored on your computer or other device. It will be activated every time you visit a website which created that particular persistent cookie.

To identify which Cookies from the ones we use are retained only for the session and which are persistent ones, please consult our full list of cookies here.

Legal basis for processing

In this section, “GDPR” means the United Kingdom Data Protection Regulation as tailored by the Data Protection Act (DPA) 2018. In situations where a Group Entity in the European Economic Area is identified as the controller, “GDPR” means Regulation (EU) 2016/679.

We process your personal information with your consent (Article 6(1)(a) of the GDPR) when you agree that we may place non-essential Cookies, when you agree to receiving direct marketing or on other occasions where we ask you for consent, for the purpose which we explain at that time. Where we do process personal information based on consent, your consent is revocable at any time (without affecting the lawfulness of processing based on consent before its withdrawal).

We process your personal information when we are required to do this by law (Article 6(1)(c) of the GDPR), including in response to requests by government or law enforcement authorities conducting an investigation or court orders.

We process your personal information when it is necessary for the performance of a contract to which you are the party or in order to take steps at your request prior to entering into a contract (Article 6(1)(b) of the GDPR). This applies in any case where we provide or deliver products and services to you pursuant to a contract, such as when you purchase a gift card, process your registration on the Site or enter into a competition. If you do not provide the personal information that we need in order to provide or deliver the service, we will not be able to provide or deliver services to you.

We also process your personal information when it is necessary for the purposes of a legitimate interest pursued by us or a third party (Article 6(1)(f) of the GDPR) (when these interests are not overridden by your data protection rights) -  for example, to send customer satisfaction surveys to you.

 

Your rights

You may ask us for a copy of your information and, where applicable, to correct it, erase it or to transfer it to other organisations at your request. You also have rights to restrict or object to some processing and, where we have asked for your consent to process your personal information, to withdraw this consent. Where we process your personal information because we have a legitimate interest in doing so (as explained above), you also have a right to object to this. These rights may be limited in some situations – for example, where we can demonstrate that we have a legal requirement to process your personal information or overriding legitimate grounds to retain your information.

We hope that we can satisfy queries you may have about the way we process your personal information. However, if you have unresolved concerns you also have the right to complain to data protection authorities (see contact details below). You can bring the complaint in your member state of residence, place of work or where an alleged infringement of data protection law occurred.

To protect your privacy and security we will take reasonable steps to verify your identity when dealing with requests.

If you receive an e-mail from the Site and you would prefer not to receive such communications in the future, you can choose to unsubscribe (opt-out) by following the instructions in the e-mail or send an e-mail to Dataprotection@mcarthurglen.com. We will make commercially reasonable efforts to implement your opt-out requests promptly, but you may still receive communications from us that was already underway before we process your request and update our systems.

In relation to France, if you do not wish to be contacted by phone, you can register on the Bloctel opt-out list (for more information, please click here +[http://bloctel.gouv.fr]). You also have a right to set down instructions on the management of your personal information after death.

Contact

If you have any queries, comments or requests in relation to your personal information or this Policy, you can email us at Dataprotection@mcarthurglen.com or contact us by post at: Data Protection Officer, McArthurGlen UK Limited, Nations House, 3rd Floor, 103 Wigmore Street, London, W1U 1WH, United Kingdom.

In addition, you can contact our Data Protection Officer at Savannah Christensen compliance.officer@mcarthurglen.com.

You are also entitled to lodge a complaint with the UK Information Commissioner's Office using any of the below contact methods:

Telephone: 0303 123 11113

Website: https://ico.org.uk/concerns/

Post: Information Commissioner's Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

If you live or work outside the UK or you have a complaint concerning our activities outside of the UK, you may prefer to lodge a complaint with a different supervisory authority.  A list of relevant authorities in the EEA and the European Free Trade Area can be accessed here.

Changes to this Policy

We reserve the right to modify this Policy at any time. Changes to this Policy will be posted on the Site. You should review this Policy frequently.

Our Group Companies

Name of entity

Country

Outlet Services Holdco Limited

Jersey

McArthurGlen Management Gesellschaft m.b.H.

Austria

McArthurGlen Management (Belgium) S.P.R.L

Belgium

McArthurGlen Management Vancouver Limited

Canada

MG-RB Europe SAS

France

McArthurGlen Service GmbH

Germany

McArthurGlen Management Greece Designer Outlet EPE       

Greece

MGR Management & Retail Srl

Italy

McArthurGlen Management Spain SLU

Spain

MGE-RB (Roermond) Management Co B.V.        

Netherlands

MGE-RB (Rosada) Management Co B.V.      

Netherlands

McArthurGlen UK Ltd

United Kingdom

WiFi Annex

Introduction

This Annex to the Privacy & Cookies Policy (“Policy”) relates to your use of a WiFi service (the “WiFi Service”) which is provided by or on behalf of McArthurGlen UK Limited (referred to in this WiFi Annex as "McArthurGlen", "we", "us" or "our") from our venues when you have applied to access or accessed the WiFi Service. This Annex, in addition to the Policy, explains in further detail how we use your personal information we collect and generate when you use the WiFi Service. 

For the purposes of this Annex, “Group Company” has the same meaning as set out in the Policy.

Information we collect

We collect, receive, store and process the following information about you:

  • information that you provide when registering for the WiFi Service (e.g. name, address, telephone numbers, email address and date of birth);
  • your device details and MAC address (see below for further information about MAC addresses);
  • details about when and where you connect to the WiFi Service including your venue location and the WiFi access point(s) where you are using the WiFi service. This data will be collected automatically by the wireless access point unless your phone/device is switched off or you have switched off WiFi on your phone/device; and
  • your communications with us in connection with the WiFi Service.

We will collect your personal information from you and from your use of the WiFi Service, from our WiFi providers and from social media providers if you register using a social media account.

A MAC address unique identifier for your device that tells us the make of a device e.g. Samsung or Apple, but it does not tell us your name or phone number, or allow us to access any data held on your device.  If your WiFi settings on your mobile device are turned on when you visit one of our locations (including the parking area but no further) then we automatically collect the MAC address from your device. We explain how we use MAC addresses in the next section.

 

Use of your information

In addition to the purposes described in the Policy, we use your personal information for the following purposes:

  • to provide the WiFi service to you and to enable you to connect to the WiFi Service efficiently on return visits;
  • to respond to your questions, requests for additional information, enquiries or complains about the WiFi Service;
  • to communicate information about the WiFi Service to you, including changes to the WiFi Service;
  • to keep our WiFi Service secure and prevent fraud;
  • to monitor and analyse the use of the WiFi Services to prevent, investigate and/or report security incidents or crime;
  • to verify compliance with the terms and conditions governing the use of the WiFi Service; and
  • for research and analytics of use of the WiFi Service to identify general consumer trends, to understand better customer, consumer and social behaviours and to improve our products and services. We provide aggregated statistics about our sales, customers, traffic patterns to third parties for analytics purposes but these statistics will not include any information that is likely to identify you as an individual.

We use MAC addresses to determine your distance from WiFi sensors located across the location you are visiting.  We aggregate this information to create reports on the movement of visitors to our locations.  We use this information, for example, to optimise the layout of our locations, design marketing promotions, change staffing hours, or measure the impact of a campaign. You can opt out of having your location data collected at any time by visiting http://optout.mcarthurglen.com. With your consent, we use your location data for the purpose of selecting and sending you marketing offers and alerts which might interest you during your visit to a location.

Sharing your information

In addition to the disclosures described in the Policy, we disclose or transfer personal information to third party service providers that perform functions on our behalf in relation to the WiFi Services and the purposes set out in this Annex and the Policy. Third party providers of analytics and reporting services include AM Networks Ltd, 77a Cheap Street, Sherborne, Dorset, DT9 3BA; Skyfii Group Pty Ltd, Darlinghurst, New South Wales 2010, Australia; and Aislelabs Inc, 210-43 Hanna Ave, Toronto ON, M6K 1X1, Canada.

If you would like a list of the third parties with whom we share personal information, please contact Savannah Christensen, Data Protection Officer, compliance.officer@mcarthurglen.com.

Transfers

See the 'Transfers' section of the Policy.

Retention

We retain information that you provide when registering for the WiFi Service and your device details and MAC address for two years from collection.

Legal basis for processing

We process your personal information when we are required to do this by law, including in response to requests by government or law enforcement authorities conducting an investigation or court orders.

If it is mandatory for you to provide personal information, we will make this clear at the time and will also explain what will happen if you do not provide the information.

We process your personal information when it is necessary for the performance of a contract to which you are the party or in order to take steps at your request prior to entering into a contract (for example, when we provide or deliver services to you pursuant to a contract). If you do not provide the personal information that we need in order to provide or deliver the WiFi Service, we will not be able to provide or deliver WiFi Services to you.

We process your personal information when it is necessary for the purposes of a legitimate interest pursued by us or a third party (when these interests are not overridden by your data protection rights).

Where we do process personal information based on consent, your consent is revocable at any time.

Your rights

See the ‘Your rights’ section of the Policy.

Contact

The contact details of our Data Protection Officer are as follows:

Savannah Christensen, Data Protection Officer, compliance.officer@mcarthurglen.com

Changes to this Policy

We reserve the right to modify this Annex at any time. Changes to this Annex will be posted on the Site or on WiFi Service log-in or registration pages. You should review this Policy frequently.