This Privacy Notice may vary from time to time so please check it regularly.

Thistles Shopping Centre (“we”, “us” or “our”) are committed to protecting the privacy of our visitors.

This policy explains how we will use any personal information we collect about you when you.

This Notice describes the types of information collected, how that information is used and disclosed, and how you can access, modify, or delete your information.

The Data Controller is

The Centre is managed by Savills (UK) Limited (registered in England with number 2605138) whose registered office is at 33 Margaret Street, London, W1G 0JD

 

HOW DO WE COLLECT INFORMATION ABOUT YOU?

1            MARKETING AND CUSTOMER SERVICES

1.1        Competitions

Entering into a competition or promotion hosted by us or our third parties: You may provide us with personal data when you subscribe to these services either online or through a physical form.

1.2        Feedback

Providing feedback to us through our online surveys where you may provide your contact details and subscribe to receiving marketing information.  We use a third-party provider Qualtrics for this.  You can also provide us feedback through writing to or emailing the centre with any comments, complaints or suggestions. See section 1.7 for more information

1.3        Website Usage

We may also collect information from you automatically when you access and use our Online Services, including the time and duration of your visit, the referring URL, your Internet Protocol (IP) or MAC address, the type of device you use and its operating system. As with most websites, we also operate cookies on ours and further details can be found in the section on cookies.   We also use a third party google analytics to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way which does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website. If we do want to collect personally identifiable information through our website, we will be up front about this. We will make it clear when we collect personal information and will explain what we intend to do with it.

1.4        Events

When enrolling for an event: we may collect your name and contact details if you wish to participate in an event that is organised at one of our centres. This data may be captured on a third-party booking system.

Promotional Photography: we may take photographs of you when you attend one of our events. Signs will be displayed during the event to advise you when and where photographs are being taken, and if you have concerns or do not wish to be photographed please raise these with a member of our staff.

1.5        Social Media

Interaction with social media: depending on the Privacy setting you have applied in your Social Media accounts and based on the content that you choose to share, when you interact with our Social Media presence, we will have access to your user generated content, such as posts, comments, pages, profiles and images. Also depending on the Privacy setting you have applied in your Social Media accounts and based on the content that you choose to share, we may have access to contact details, personal information (such as age, gender, employer, education, location and habits and preferences).  We also use a platform Sprout Social if you send us a private or direct message via social media the message will be stored by Sprout Social for three months. It will not be shared with any other organisations.

1.6        Car Parking

We may collect your license plate to administer our car parking fees, and your credit card details will be collected if you choose this payment method. You may also subscribe to frequent visitor schemes or staff parking benefits where we will also receive your contact details to register you for the service.  Our payment providers for Car parking are third parties.

1.7        Miscellaneous Forms

There are miscellaneous forms at site which can also record your personal information – for example WIFI login, lost property, accident reporting forms etc.

In all of the above instances, we will only provide you with email marketing where you have consented, and you can withdraw this consent at any time by clicking the unsubscribe link within the emails you receive.  Where we send you information electronically, we review whether the communication has been opened and whether you have clicked on any links in the communication. This is because we want to make sure that our communications are useful for you.

To help us to connect with our customers and run some of our marketing activities, we use a marketing agency. Currently we use a company called Jones Lang LaSalle Limited and Jones Lang LaSalle Resources Limited (Bewonder*) (our Marketing Agent). This means that they may handle the Personal Data as a Processor (they are acting on our behalf and authorised to use the Personal Data in accordance with our instructions). We also work with other companies that carry out certain activities on our behalf, such as the wi-fi operator which helps us to provide our wi-fi service.

Bewonder* may have access to your personal details to develop email marketing campaigns, to provide customer insight through the analysis of data and to collect personal data on our behalf.

If you have any questions or concerns about how we are using Personal Data about you or if you would otherwise like to contact our Data Protection Officer, please send an email to digital.support@bewonder.co.uk

 

FOR WHAT PURPOSE IS IT COLLECTED

The personal information gathered through Marketing is for our legitimate business interests, this includes to:

Tailor our online services to you so the content you see is relevant to you. For example, we may request your date of birth, gender and some basic interests (such as ‘shopping’ and ‘fashion’) so that we can provide you with content that we think you will be interested in.

Collect data obtained through our interaction with customers for research, analysis, testing, monitoring, risk management and administrative purposes including the optimisation of service delivery at our properties and to improve the customer experience.

We frequently ask for post code during our customer interactions to help us better understand our customers. We share this data with third parties without any personal identifiers to assist with our insight and analysis.

For the events, car parking, hiring services, competitions and promotions, the legal basis is also to form a contract with you to provide these services and promotions.

DATA MINIMISATION AND RETENTION

We will only collect the minimum amount of personal information necessary and will only keep your information for as long as you remain engaged with our marketing campaigns. Where you have not engaged with our marketing material for over a year, we will take steps to remove your information from our marketing database. Where you unsubscribe from our marketing, we will add your email address to our suppression list and delete any additional information that we hold about you.

Where you have provided your details in relation to a competition, we will delete your personal data when the competition has finished (unless you have consented to your information being used for marketing purposes).

For any contractual purpose, your personal data will be held for as long as is required to deliver the services requested.

 

 

 

  1. SECURITY

HOW DO WE COLLECT INFORMATION FROM YOU?

As part of our security operation, we will also be collecting personal images relating to visitors and customers to our property from CCTV and ANPR (Automatic Number Plate Recognition) systems.

We use third party service partners to provide security services, but the information recorded through these technologies is held on systems we control. The data we collect may be shared with the police for the prevention and detection of crime, or between our other sites to share intelligence.   ANPR data can be shared with third parties for the purposes of enforcement.

Personal data is also collected from visitors to our property. Access control data is held within our systems and the visitor management data may be held on third party systems.

In relation to access control and visitor data, where the data relates to our employees, contractors or visitors, we consider ourselves to be the Controller. However, personal data relating to our occupier’s staff, contractors and employees, we consider our occupiers to be the Data Controller.

In relation to third parties, we ensure that they will also safeguard your data – please see Protection of Your Information below.

FOR WHAT PURPOSE IS IT COLLECTED

CCTV and Visitor and Access control data is collated to pursue our legitimate interests to protect the property in question, to protect the vital interests of our visitors, tenants and customers, to assist with the prevention and detection of crime and to provide our contracted service to our tenants.

ANPR is collected to fulfil a contract between ourselves and our users of our parking facilities, including enforcement action.

DATA MINIMISATION AND RETENTION

For CCTV this data will generally not be held for longer than 31 days unless an incident or suspected incident has occurred.

ANPR data is held for 12 months unless an incident or suspected incident has occurred.

Access Control Systems: Access cards and the personal data associated with them are deleted on requests from our occupiers. Cards which are not used for three months are deactivated. Any passes which have remained inactive for twelve months will have all data relating to the card permanently deleted.

Visitor Management Systems: All data is deleted where a visitor has not returned to the site within six months.

 

  1. ACCIDENT AND INCIDENT REPORTING

HOW DO WE COLLECT INFORMATION FROM YOU?

When an incident occurs at one of our properties, we are required to document the particulars of an incident which may include witness statements, CCTV footage, photographs and written reports. This information may include special categories of data depending on the nature of the incident. A third-party system is used to log details relating to these incidents and physical paperwork may also be stored on site.

The data may be shared with third parties such as insurance providers and legal advisors in order to defend a claim, government or other competent organisations who are required to report on incidents by law or the police to investigate a crime.

FOR WHAT PURPOSE IS IT COLLECTED

This information is collected to ensure that we comply with our legal responsibilities in relation to Health and Safety investigation and reporting, and also in relation to any future legal claims. The information can also be used to prevent and detect crime, or to protect the vital interests of individuals. Where health information is collected we may also need this for our substantial public interest for Insurance processing.

DATA MINIMISATION AND RETENTION

All personal data (CCTV, Witness Statements, Photographs and written reports) relating to the incident is held for six years, unless there are reasons to retain it for longer, such as an ongoing HSE investigation, a suspected pattern of fraud, or because an injury has been sustained by a child.

  1. OTHER USES

In addition to the purposes already described, we may use information collected to perform other important business operations, for example: to understand usage patterns (such as foot traffic) within our properties; to develop, provide, improve and personalise products and services; and, to provide customer service/support.  We may undertake additional research, analysis, and surveys, both online and in our centres. The lawful basis for this use of Information is for our legitimate business interests.

 

  1. OTHER THIRD-PARTY TRANSFERS NOT DETAILED PREVIOUSLY

We may pass on or allow access to your information:

to our suppliers, contractors and professional advisors where this is necessary for them to provide services and facilities to us, for example:

to pay for parking services;

to our Joint Venture partners;

to any purchaser of all or part of our business or any of our properties to which the Online Service relates;

to sell, make ready for sale or dispose of our business in whole or in part including to any potential buyer or their advisers;

where we are required to do so by law, court order or other legal process;

where, acting in good faith, we believe disclosure is necessary to assist in the investigation or reporting of suspected illegal or other wrongful activity.  This may include exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction;

to protect and defend our rights or property;

to deal with any misuse of any of our Services; or

in order to enforce or apply our terms and conditions and other agreements with third parties.

to our group companies and affiliates or third-party data processers who may process data on our behalf to enable us to carry out our usual business practices.

personal data relating to an insurance claim, including sensitive data, may be transferred to our reinsurance business based within Savills.

 

  1. PROTECTION OF YOUR INFORMATION

We have in place administrative, technical and physical measures designed to guard against and minimise the risk of loss, misuse or unauthorised processing or disclosure of the personal information that we hold. We place similar obligations on our third parties and risk assess their security based on the sensitivity of the personal data that they hold.

If we transfer your personal information outside of the EEA, it will continue to be subject to one or more appropriate safeguards set out in the law. These might be the use of model contracts in a form approved by regulators, or having our suppliers sign up to an independent privacy scheme approved by regulators (like the US ‘Privacy Shield’ scheme).

  1. LINKS TO OTHER WEBSITES

This Privacy Notice only applies to the websites provided by us. If you link to another service and/or website from here, you should remember to read and understand that service and/or website’s privacy and cookies policy as well. We are not responsible for any use of your information that is made by other services and/or websites. Links or advertisements do not imply that we endorse or have reviewed such third parties or their privacy practices.

 

  1. CHILD DATA

We do not collect Information from children under the age of 16, but it may be collected from parents/guardians with their consent.  Examples include the Wolf Pack Kids Clubs and competitions that involve children’s participation. We will not market directly to children. If you are under 16 and have inadvertently subscribed, please notify us at informationdesk@stirling-thistles.co.uk

 

 

 

 

 

  1. YOUR RIGHTS

You have the right to opt out of receiving any marketing information which we send you.  There will be an unsubscribe option on all correspondence or you can email  informationdesk@stirling-thistles.co.uk

Your duty to inform us of changes

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us.

Your rights in connection with personal information

Under certain circumstances, by law you have the following rights:

  • Request Access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it. If possible, you should specify the type of information you would like to see to ensure that our disclosure is meeting your expectations. Disclosure should not impact the rights and freedoms of other people, e.g. privacy and confidentiality rights of others.
  • Request Correction, subject to certain conditions, you can request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.  You also have a responsibility to help us to keep your personal information accurate and up to date. We encourage you to notify us of any changes regarding your personal data as soon as they occur, including changes to your contact details. This right only applies to your own personal data. When exercising this right, please be as specific as possible.
  •    Request Erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it.  We may not be in a position to erase your personal data, if for example, we need it to (i) comply with a legal obligation, or (ii) exercise or defend legal claims.  You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
  • Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
  •  Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
  • Request the transfer of your personal information to another party.  If you exercise this right, you should specify the type of information you would like to receive (and where we should send it) where possible to ensure that our disclosure is meeting your expectations.  This right only applies if the processing is based on your consent or on our contract with you and when the processing is carried out by automated means (i.e. not for paper records). It covers only the personal data that has been provided to us by you.

Where our processing of your personal data is based on your consent you have the right to withdraw your consent at any time.   If you do decide to withdraw your consent we will stop processing your data for that purpose, unless there is another lawful basis we can rely on – in which case, we will let you know.  If you withdraw your consent, this will only take effect for future processing.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please email informationdesk@stirling-thistles.co.uk

You will not have to pay a fee to access your personal information (or to exercise any of the other rights); however, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

You can also contact the Information Commissioner’s Office via https://ico.org.uk  for information, advice or to make a complaint.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

 

  1. CHANGES TO THE PRIVACY POLICY

This policy was last updated March 2021. If it is necessary for us to alter the terms of the privacy policy, we will post the revised policy in this website

 

  1. HOW YOU CAN CONTACT US

If you have any questions about this privacy policy, please contact us at  informationdesk@stirling-thistles.co.uk