McArthurGlen

McArthurGlen takes the privacy of your personal data seriously. We understand that by providing your personal data – whether through use of our website, mobile apps, including the McArthurGlen Club app ("apps"), or other digital services, visiting our Centres (including in relation to data collected through CCTV) or logging into our WiFi – you are entrusting us with your information. 

We have developed this Privacy Notice to give you full transparency about the information we collect from you online, why we collect it and how we use it. This Privacy Notice also explains what personal information we collect and record at our Centres - on our in-Centre computers and devices and in certain cases offline- and what we do with that information. We also need to ensure that you understand the rights you have over your personal data, including your rights of access to that data and how you can correct it and erase it. These rights are described below.

Annexed to this Privacy Notice is additional information that relates specifically to the personal information we collect and record when you use WiFi provided by us (“WiFi Annex”).

Please note that there is additional information in the jurisdiction-specific information section at the end of this Privacy Notice. If you use our services when located in one of the jurisdictions named in that section, then any information in the section relating to your jurisdiction takes precedence over any conflicting information in the other parts of this Privacy Notice. If you are in the European Economic Area ("EEA"), the GDPR applies to the processing of your personal data. If you are in the UK, the UK GDPR applies to your personal data.

In this Privacy Notice:

"Centre" has the meaning given in paragraph 1 of the Introduction above;

"Centre Owner" means an owner of one of Centres which we manage ;

"controller" is a legal term and refers to the company that makes decisions about how and why your personal data is processed and is therefore responsible for ensuring that the processing is done in accordance with relevant data protection laws;

“Group Company” means McArthurGlen UK Limited, McArthurGlen UK Limited's parent company or any direct or indirect subsidiaries of the parent company (and 'Group Companies' is interpreted accordingly). Our Group Companies include the subsidiary management companies operating in each of our locations. A list of these Group Companies, their locations and contact details can be found at the end of this Privacy Notice. We may change this list from time to time;

"McArthurGlen", "we", "us" or "our" has the meaning given in paragraph 2 of the Introduction above.

"personal data" (also referred to in this Privacy Notice as "personal information") means any information that relates to you from which you can be directly or indirectly identified;

"process" means any activity relating to personal data, including collection, use, sharing, storage and transmission; and

"special categories of personal data" are personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, the processing of genetic data, biometric data for the purpose of uniquely identifying you, data concerning health or data concerning your sex life or sexual orientation.

References to “you" or “your” in this Privacy Notice are references to individuals whose personal data is processed by us, including anyone who uses our website, apps or other digital services, visits our Centres, signs up for our services or uses the WiFi provided by us.

We do not knowingly collect personal information from children under 16 years of age. Please do not provide us with personal information if you are under the age of 16, and do not sign up for any technology services at our centres, including the WiFi.

We collect, receive, store and process the following information about you:

• information that you provide via the website or our apps, including information you provide when you register with or use the website or apps (e.g. name, address, telephone numbers, email address, preferred centre, interests and date of birth), join our Privilege Club (our exclusive club where you can sign up to keep up-to-date with our latest news, events and offers) or the replacement for Privilege Club, known as McArthurGlen Club, purchase or use a gift card, book parking, enter into competitions or complete surveys, participate in a contest or promotion, or join or post comments on our social media sites;
• information that you provide to us for the purpose of subscribing to direct marketing;
• information about your computer or mobile device and about your visits to, and use of, our website or our apps, such as Internet Protocol (IP) addresses, geolocation, date and time that you visited the website or apps, the type of Internet browser and computer operating system, referral source, length of visit, page views and website or app navigation paths;
• information relating to any purchases you make via our website or apps (e.g. gift cards) or any other transactions that you enter into through our website or apps (including your name, address, telephone number, email address, card details and transaction history);
• information processed for anti-money laundering and sanctions compliance purposes;
• due diligence information including copies of identification documents;
• (in limited circumstances) information obtained through public sources such as government lists of sanctioned entities / persons;
• (in limited circumstances) information related to your health (e.g. if you become unwell or have an accident at one of our Centres);
• (in limited circumstances) information related to criminal convictions or offences (e.g. if there is any theft or other criminal activity at one of our Centres);
• information that you provide to us for the purpose of Click and Reserve via our website;
• information contained in, or relating to, any communications that you send to us or send through our website or apps (including the communication content and metadata associated with the communication);
• information we obtain from private social media companies (see also 'Social Media' below), including from outside the UK or EEA, about your interests and preferences;
• information as set out in our Cookies Notice;
• information collected through transactions or interactions offline or on our in-Centre computers or devices
• information about which brands you have visited if you use one of our apps to scan a QR code in-store or you are logged into McArthurGlen Club when you do so;
• information collected by our systems during your visits to our Centres, such as CCTV footage, photo, video and/or audio recordings, body-worn video camera footage and/or automatic number plate recognition (ANPR) data;
• information about which emails from us you open;
• information about your postal code when you register with us (e.g. for McArthurGlen Club) so that we know how far you travel to our Centres and your likelihood of visiting a particular Centre; and
• information described in the WiFi Annex.

If it is mandatory for you to provide personal information, we will make this clear at the time and will also explain what will happen if you do not provide the information.

We may collect, use and share aggregated, anonymised data such as statistical data for the purpose of assessing and improving our business and services. Such data may be derived from your personal data but does not reveal your identity. For example, we may anonymise and aggregate your usage data to calculate the percentage of users accessing a specific website feature. 

Please see our Cookies Notice HERE for details of how we use cookies and similar technologies.

We use your personal information for the purposes set out in the table below. In this table any reference to “our legitimate interests” will be replaced with “reasonable and legitimate purposes as permitted by law” in respect of Canada only.

Please also see the section below "Legal bases for processing your information" for an explanation of the lawful bases relied upon to process your personal data, as well as the section entitled "Special categories of personal data" for information about the additional lawful bases for our use of such data.

 See the following provisions of GDPR/UK GDPR (as applicable) for reference to lawful bases:

We will also inform you from time to time of other products and/or services we offer which we consider may be of interest to you by email, phone, SMS or post, where permitted by applicable law (which may require that we obtain your consent).

As well as unsubscribing within communications, you may email us at any time at dataprotection@mcarthurglen.com to indicate that you do not want to receive direct marketing communications from us. We will make commercially reasonable efforts to implement your unsubscribe / opt-out requests promptly, but you may still receive communications from us that were already underway before we process your request and update our systems.

We also use personal information we obtain from social media sites online including Facebook, Instagram, X, YouTube and TripAdvisor for our (and our businesses’) research and analytics purpose. Where appropriate, and in line with their own policies, we may match information from these sites to better understand and improve our customers' experience. This includes posts or other information made public or made available to us where you use hashtags or tags relating to us, our business, the Centre Owners, the Centres and our industry. Information from these sites may include information which has been held outside the UK and European Union.

We are required by data protection law to have a lawful basis or reason for processing your personal data, which we explain in this section.

We process your personal information with your consent when you agree that we may place certain types of cookies, when you agree to receiving certain direct marketing or on other occasions where we ask you for consent. Where we process personal information based on consent, you can withdraw your consent at any time (without affecting the lawfulness of processing based on consent before its withdrawal).

We process your personal information when we are required to do so by law, including in response to requests by government or law enforcement authorities conducting an investigation or court orders.

We process your personal information when it is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract. This applies in any case where we provide or deliver products and services to you pursuant to a contract, such as when you have signed up for Privilege Club or its replacement, known as McArthurGlen Club, or when you purchase a gift card, process your registration on the website or enter into a competition. If you do not provide the personal information that we need in order to provide or deliver the service, we will not be able to provide or deliver services to you.

We also process your personal information when it is necessary for the purposes of a legitimate interest pursued by us or a third party (when these interests are not overridden by your data protection rights). These legitimate interests include the administration and running of our business, marketing our products and services to our customers, servicing our existing customers, protecting our business and assets and improving our services to current and potential customers. Further details of our legitimate interests are included in the table above.

We are required to have an additional lawful basis when we process special categories of personal data and comply with requirements as set out in data protection law when we process criminal conviction or offence data. We do not collect special categories of personal data or criminal conviction or offence data about you, other than in limited circumstances described below:

On occasion, we may collect data relating to injuries or illnesses occurring in our Centres or other premises. We may also process health data where it is necessary for reasons of substantial public interest  (Art 9(2)(g) GDPR/UK GDPR) and to establish, exercise or defend legal claims (Art 9(2)(f) UK GDPR/GDPR). We may also request your explicit consent to process such data (Art 9(2)(a) GDPR/UK GDPR). Very rarely, we may process such data where it is necessary to protect your life (Art 9(2)(c) GDPR/UK GDPR).

It is also possible that we will on occasion process special categories of personal data about you, where you expressly provide it or when this is inferred from data you provide to us, e.g. where you include it in the personalised message you write when purchasing a gift card. Please avoid providing us with any special categories of personal information, such as that related to health, race, ethnicity or religion, other than when it is strictly required or requested by us in accordance with this Privacy Notice. 

We will process criminal conviction or offence data in limited circumstances, such as for the prevention or detection of unlawful acts or for the purposes of legal claims (Art 10 GDPR/UK GDPR in conjunction with the conditions set out in local law). The processing of criminal data will be carried out in compliance with the applicable UK, European and/or local legislation on public security and terrorism prevention.

We disclose or transfer personal information to other parties as follows:

• to our Group Companies (including subsidiary management companies), Centre Owners, investors and joint venture partners;
• to third party service providers that perform functions on our behalf in relation to the Site and apps or our Centres and for the purposes set out in this Policy (for example, website hosting, social media analysis providers (e.g. Google), marketing email service providers, data analysts and website developers);
• our lawyers, accountants and other professional advisers;
• our insurers, claims and loss adjusters and auditors;
• other insurance companies to support their legitimate interests, or those of their clients;
• to brand partners (stores) in order to fulfil Click and Reserve orders;
• media agencies and their advertising partners in order to run targeted marketing campaigns as described above;
• to regulators, law enforcement agencies and government authorities, and to other third parties when compelled to do so by government and law enforcement authorities or otherwise as required by law, including but not limited to in response to court orders and subpoenas;
• We also disclose user information when we have reason to believe that someone is causing injury to or interference with our rights or property, other users of our website or apps, or other third parties and to detect, prevent and respond to such activity. We may therefore share CCTV, body-worn camera footage, photo, video and/or audio recordings and/or automatic number plate recognition (ANPR) data with law enforcement agencies, government or local authorities, tenants, our other Centres and local crime reduction partnerships and initiatives.  Additionally, we cooperate with law enforcement inquiries and other third parties to enforce laws, intellectual property rights and other rights;
• to sellers or buyers as part of a sale or merger of our business or assets;
• to an applicable Centre Owner, a Group Company or to buyers as part of a sale or merger of a Centre Owner or Centre. In addition, if McArthurGlen UK Limited or one of our Group Companies ceases the role as a manager of a Centre, we will need to transfer your personal data to the Centre Owner or the replacement manager to ensure the continuity of our products and services; and
• as described in the WiFi Annex.

In addition, subject to your consent where required by law, we share your personal information with carefully selected third parties so that they can send you information about special promotions and offers.

To enhance your shopping experience, our website and apps may include links to other websites. Those websites will have their own privacy policies that you may wish to review. We have no control over, or responsibility for, the data processing carried out by these linked websites.

We also share information about visitors to this website or apps in an anonymous or aggregate form with third parties including advertisers, business partners and sponsors, to understand customer trends and patterns and manage and improve our business relationships.

We take reasonable steps to protect your personal information as you visit and use the website and our apps and to protect such information from loss, misuse, unauthorised access, disclosure, alteration or destruction.

Unfortunately, no data transmission can be guaranteed to be 100% secure and we recommend that you follow reasonable precautions, e.g. when using public WiFi networks to transmit data.

We transfer personal information to countries outside the UK and EEA to our Group Companies and to third parties, including to countries which have different data protection standards to those which apply in the UK and EEA.

Where service providers process your personal information in countries deemed adequate by (as applicable) the European Commission or the UK, we rely on the European Commission's or the UK's adequacy decision to protect your personal information.

For transfers to Group Companies and service providers outside the EEA or UK where there is no adequacy decision in place, we use EU Standard Contractual Clauses, UK Standard Contractual Clauses (as applicable) or rely on (data protection authority approved) corporate rules that are in place to protect your personal information. You have a right to ask us for a copy of the Standard Contractual Clauses or a copy of the other safeguards used by contacting us as set out below.

We retain personal information for as long as necessary for the purposes for which it was collected and as permitted or required by law.

In general, we will only retain your personal data so long as the original purpose for which that personal data was collected still applies although we may retain it longer if necessary for legal reasons such as retaining data to deal with any disputes or for regulatory reasons such as tax and accounting purposes. We will only ever retain your personal data for a limited period of time, for example where we retain your personal data for customer relationship management purposes, this is generally retained for three years from the date of your last interaction with us.

Subject to certain conditions, you may ask us for a copy of your information and, where applicable, to correct it, erase it or to transfer it to you or other organisations at your request. You also have rights to object to some processing and, where we have asked for your consent to process your personal information, to withdraw this consent. Where you withdraw your consent, this does not affect the lawfulness of the processing of your personal data which was carried out before the withdrawal of your consent.

You also have the right to restrict the way in which we process your personal data in some situations which means you may limit the way in which we use your personal data. Where we process your personal information because we have a legitimate interest in doing so or for direct marketing purposes (as explained above), you also have a right to object to this. These rights may be limited in some situations – for example, where we can demonstrate that we have a legal requirement to process your personal information.

You have the right to make a request to exercise these rights to the relevant controller entity (i.e. McArthurGlen UK Limited and/or another relevant Group Company, as applicable). Please contact us at dataprotection@mcarthurglen.com  if you wish to make a request exercising your rights. This is the email for all rights requests to the McArthurGlen group. Alternatively, you can contact the relevant McArthurGlen group entity directly (see the contact details below). Where we act as joint controllers, you can contact any of the relevant Group Companies to exercise your data protection rights at dataprotection@mcarthurglen.com

When making the request, please provide your full name and address and/or email address in exactly the form in which they were originally provided to us to avoid any possible confusion with a different individual. We may ask you for further information to verify your identity.

If you have any concerns about our use of your personal information, you can make a complaint to us at dataprotection@mcarthurglen.com. We hope that we can satisfy queries you may have about the way we process your personal information. You also have the right to complain to your relevant data protection authority. The data protection authorities in the jurisdictions in which we operate have been listed below:

We reserve the right to modify this Privacy Notice at any time. Changes to this Privacy Notice will be posted on the website. We recommend that you review this Privacy Notice frequently.

If you have any queries, comments or requests in relation to your personal information or this Privacy Notice, you can email us at dataprotection@mcarthurglen.com or contact us by post at Data Protection Officer, McArthurGlen UK Limited, Nations House, 103 Wigmore Street, London, W1U 1QS, United Kingdom.

If you are using our website, apps, or other digital services when you are located in the EU/EEA, you may also contact our EU representative using the same email: dataprotection@mcarthurglen.com.

Introduction

This WiFi Annex to the Privacy Notice relates to your use of a WiFi service (the “WiFi Service”) at our Centres which is provided by or on behalf of McArthurGlen UK Limited (referred to in this WiFi Annex as "McArthurGlen", "we", "us" or "our") . This WiFi Annex, in addition to the Privacy Notice, explains in further detail how we use your personal information we collect and generate when you use the WiFi Service. 

For the purposes of this WiFi Annex, “Group Company” has the same meaning as set out in the Privacy Notice.

Information we collect

We collect, receive, store and process the following information about you:

• information that you provide when registering for the WiFi Service (e.g. name, address, telephone numbers, email address and date of birth);
• your device details and MAC address (see below for further information about MAC addresses);
• details about when and where you connect to the WiFi Service, including your venue location and the WiFi access point(s) where you are using the WiFi service. This data will be collected automatically by the wireless access point unless your phone/device is switched off or you have switched off WiFi on your phone/device; and
• your communications with us in connection with the WiFi Service.

If it is mandatory for you to provide personal information, we will make this clear at the time and will also explain what will happen if you do not provide the information.

We will collect your personal information from you and from your use of the WiFi Service, from our WiFi providers and from social media providers if you register using a social media account.

A MAC address is a unique identifier for your device that tells us the make of a device, e.g. Samsung or Apple, but it does not tell us your name or phone number, or allow us to access any data held on your device. If your WiFi settings on your mobile device are turned on when you visit one of our locations (including the parking area but no further) then we automatically collect the MAC address from your device. We explain how we use MAC addresses in the next section.

Use of your information

In addition to the purposes described in the Privacy Notice, in respect of the WiFi Service we use your personal information for the purposes set out in the table below. In this table any reference to “our legitimate interests” will be replaced with “reasonable and legitimate purposes as permitted by law” in respect of Canada only.

See the following provisions of GDPR/UK GDPR (as applicable) for reference to lawful bases:

We use MAC addresses to determine your distance from WiFi sensors located across the locations you are visiting. We use this information to create reports on the movement of visitors to our locations. We also use this information, for example, to optimise the layout of our locations, design marketing promotions, change staffing hours, or measure the impact of a campaign. You can opt-out of having your location data collected at any time by visiting http://optout.mcarthurglen.com. With your consent, we use your location data for the purpose of selecting and sending you marketing offers and alerts which might interest you during or after your visit to a location.

Sharing your information

In addition to the disclosures described in the Privacy Notice, we disclose or transfer personal information to third party service analytics and reporting service providers that perform functions on our behalf in relation to the WiFi Service and the purposes set out in this WiFi Annex and the Privacy Notice.

Transferring your information

For details, please refer to the 'Transferring your information' section of the Privacy Notice.

Legal basis for processing

This information is further to the 'Use of your information' section in this WiFi Annex. We process your personal information when we are required to do this by law, including in response to requests by government or law enforcement authorities conducting an investigation or court orders.

We process your personal information when it is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract (for example, when we provide or deliver services to you pursuant to a contract). If you do not provide the personal information that we need in order to provide or deliver the WiFi Service, we will not be able to provide or deliver the WiFi Service to you.

We process your personal information when it is necessary for the purposes of a legitimate interest pursued by us or a third party (when these interests are not overridden by your data protection rights). These legitimate interests include the administration and running of our business, marketing to current and potential customers, servicing our existing customers, and improving our services to current and potential customers.

Where we process personal information based on consent, you can withdraw your consent at any time. Where you withdraw your consent, this does not affect the lawfulness of the processing of your personal data which was carried out before the withdrawal of your consent.

Retention

We retain personal data that you provide when registering for the WiFi Service, your device details and MAC address for two years from the date of your last engagement or contact with us (unless stated otherwise in the 'Jurisdiction specific information' section), at which point your personal data will be anonymised so that it does not identify you or make you identifiable.

Your rights

For details, please refer to the ‘Your rights’ section of the Privacy Notice.

Contact

Our Data Protection Officer can be contacted at dataprotection@mcarthurglen.com.

Changes to this WiFi Annex

We reserve the right to modify this WiFi Annex at any time. Changes to this WiFi Annex will be posted on the website or on the WiFi Service log-in or registration pages. We recommend that you review this WiFi Annex and the Privacy Notice frequently.

France specific information

• We will not hold your personal data on an indefinite 'suppression list'/direct marketing "do not contact" list.
• In general, we will not retain your personal data after three years from the date of our last interaction.
• We retain information that you provide when registering for the WiFi Service, your device details and MAC address, as well as any data relating to criminal offences, as required by French law.
• Body-worn cameras are not used at our Centres in France.

Germany specific information

• Where you have given your consent, we also use personal information we obtain from social media sites online including Facebook, Instagram, X, YouTube and TripAdvisor for our (and our businesses’) research and analytics purpose. Where appropriate, and in line with their own policies, we may match information from these sites to better understand, and improve, our customers' experience. This includes posts or other information made public or made available to us where you use hashtags or tags relating to us, our business, the Centre Owners, the Centres and our industry. Information from these sites may include information which has been held outside the UK and European Union.
• No audio recordings are made in connection with CCTV and body-worn camera footage.

Netherlands specific information

• To the extent that we process your personal data for marketing purposes, we will collect and rely on your consent as a lawful basis.
• Where we collect personal data and MAC address to track your location through our WiFi sensors, we will collect and rely on your consent as a lawful basis.
• We will only retain your personal data and MAC address used to track your location, as well as other tracking information, as permitted by Dutch law.
• We retain information that you provide when registering for the WiFi Service and your device details and MAC address as permitted by Dutch law.
  
  

Spain specific information

• If you do not wish to be contacted by email or any other means, you can register on the Lista Robinson opt-out list (for more information, please click here). If you are registered, we will not send marketing communications to you unless you have given your consent to receive marketing communications.

Italy specific information

• You may withdraw your consent:.

• by clicking on "unsubscribe link" within emails received;
• by emailing us at dataprotection@mcarthurglen.com
• if you are a loyalty club member, by accessing in your preference Centre website and via the app.

Austria specific information

Notwithstanding any other provision of the WiFi Annex, the following provisions apply for the WiFi Service operated in Austria:

• Master data (Stammdaten), traffic data (Verkehrsdaten), location data (Standortdaten) and content data (Inhaltsdaten) as defined by Section 160 (3) Austrian Telecommunications Act (“TKG 2021”) are only collected or processed by McArthurGlen in its capacity as the provider of the WiFi Service in accordance with Section 165 (1) TKG 2021 for the purposes of providing the WiFi Service.
• The aforementioned data categories will only be transmitted if this is necessary for the provision of the WiFi Service by McArthurGlen. The processing of this data categories for other purposes, in particular for advertising purposes and other transmissions, will only take place with your consent.
• Master data (Stammdaten) will be deleted by us at the latest after termination of the contractual relationship with you. This does not apply if this data is still required in order to charge or collect fees, process complaints or fulfil other legal obligations.
• Traffic data (Verkehrsdaten) will not be stored or transmitted by us, except if this is expressly required by law, and will be deleted or anonymized immediately after the connection is terminated.
• Location data (Standortdaten) that are no traffic data, are not stored by us except in anonymized form or in case of your consent until you revoke your consent. Content data (Inhaltsdaten) are generally not stored by us. If short-term storage is necessary for technical reasons, we will delete it immediately as soon as the reason no longer applies.

Canada Specific Information

• By accessing our Website, Apps and/ or Centre, you accept and agree to be bound by the terms of this Privacy Notice.
• In the event you unsubscribe from certain communications, or you email us to indicate that you do not want to receive certain emails from us, such as marketing emails, we will implement your unsubscribe/ opt-out requests without delay and no later than 10 business days after you submit your request.
• For Quebec residents accessing the Website or our Apps, please note that your information may be transferred outside of Quebec.