U.S. RESIDENTS Privacy Notice : If you are a resident of the United States of America (U.S.), please refer to the U.S. Privacy Notice available here.

Non U.S. RESIDENTS Privacy Note : Please refer to the Privacy Notice available here.  

Privacy Notice

The date this Privacy Notice was last revised was October, 23^th, 2024.

This Privacy Notice explains how the Data Controllers (as defined below) [referred to in this Privacy Notice as the Data Controllers, we, us or our] collect and process your personal data in the context of the provision of our newsletter and our Loyalty Program (including the access to your Loyalty Account within the Website and App), together referred to as the “Services”.

Please note that specific privacy notice(s) may additionally apply to you, depending on the services provided in the Shopping Centre you visit and related processing of your personal data. Such policies will be duly communicated to you where relevant (for example, regarding the management of CCTV systems, WiFi or customers’ feedback).  

In this Privacy Notice, you will find the following information:

1/ Identity of the Data Controllers

2/ How do we collect your personal data

3/ Details about the processing of your personal data

4/ How do we share your personal data

5/ How do we keep your personal data secure

6/ Do we transfer your personal data outside the EEA and the UK

7/ Your rights in relation to your personal data

8/ Transfer in case of change of ownership

9/ Cookies and tracking technologies management

10/Update of this Privacy Notice

Definitions

-        App: the mobile application of the Shopping Centres and the “Westfield-APP shopping” application.

-        Loyalty Account: personal account that has to be created in accordance with the Terms and Conditions so as to benefit from the Loyalty Program.

-        Loyalty Card: physical card or virtual card (available within your Loyalty Account on the App and/or the Website) that displays your loyalty identification number and is required to benefit from Our offers or services.

-        Loyalty Program: Our loyalty program which is available in all Shopping Centres located in the European Union (EU) (except Carrousel du Louvre, les Ateliers Gaîté, located in France Palais Vest, Forum Steglitz, Gera Arcaden, Düsseldorf Arcaden, Schönhauser Allee Arcaden, Wilma Shoppen, Breuningerland Ludwigsburg, Neukölln Arcaden, Breuningerland Sindelfingen located in Germany) and all Shopping Centres located in the United Kingdom (UK).

-        Preferred Shopping Centre(s): the Shopping Centre(s) of your choice. You can add or remove any Shopping Centre at any time through your Loyalty Account, at your entire discretion.

-        Shopping Centres: Our shopping centres located in the EU, in the UK and in the USA. You will find the entire list and related contact details here.

-        Website : the website available at the address www.westfield.com and all subdomains.

1/ Identity of the Data Controllers

1.1 - General principles

The data controllers of your personal data, acting as joint data controllers and hereinafter referred to together as “Data Controllers” or “we”, are:

-        Unibail Management, Simplified joint stock company with a capital of 20 000 000€, Having its registered office at 7 place du Chancelier Adenauer 75016 Paris, Registered within the Paris Register under number 414 878 389

(the “Group Data Controller”); and

-        The local entity(ies) responsible for the Unibail-Rodamco-Westfield Preferred Shopping Centre(s) that you have selected and/or which issues the newsletters you have chosen to subscribe to, as applicable,

(the “Local Data Controller(s)” as identified here).

Please note that when you choose to extend your benefit of the Loyalty Program to a new Preferred Shopping Centre and/or when you subscribe to an additional newsletter, to the extent this new Preferred Shopping Centre or newsletter is operated by other entity(ies) of the Unibail-Rodamco-Westfield group, the relevant local entity(ies) will become Local Data Controller(s) and will process your personal data in accordance with this Privacy Notice to provide you with the Services you requested.

For sake of clarity, please note that so long as you are part of the Loyalty Program, there will always be a Local Data Controller as at least one Preferred Shopping Centre needs to be selected. Upon registration to the Loyalty Program, it will be the Local Data Controller from your country of registration and, as applicable, the additional Local Data Controller of your Preferred Shopping Centre.

You may contact the Group Data Controller and the Local Data Controllers by using the contact details specified in article 7.6 below.

1.2 - Roles of the Data Controllers

The Group Data Controller has concluded several data processing agreements and service agreements with service providers to provide you with the technical opportunity to register you to the Loyalty Program or download and use the Website and App.

The Group Data Controller will also handle the preparation of some communication, coordinated at group level, that will be sent either by Local Data Controllers or the Group Data Controller. Furthermore, the Group Data Controller will negotiate with third parties special offers which will be accessible for Loyalty Program members.

The Group Data Controller will process your personal data in order to, as applicable depending on your choices:

-         If you register to the Loyalty Program:

o   Manage your registration to the Loyalty Program;

o   Analyse your use of the Services within the Shopping Centre(s) as further detailed in article 3 below to provide you with customised offers and events you might be interested in;

o   Send you communications about the Westfield brand or about the Loyalty Program.

-         If you subscribe to the Newsletter, in order to send you such newsletter.

The Local Data Controller(s) will also process your personal data, only in accordance with your choices:

-        If you register to the Loyalty Program, in order to send you communications to inform you about specific offers and events of your Preferred Shopping Centre(s) and to provide you with offers and with a Service that you request (subject to availability and other specific conditions that may apply).

-        If you subscribe to the newsletter, to send you such newsletter.

2/ How do we collect your personal data

We collect personal data about you through the following means:

- directly from you; and/or

- from your use of the Services:

                a) When you use the Loyalty Card, including the virtual one, if scanned during your visit, we collect information related to the type of Service your Loyalty Card was used for (example: events, birthday present) and therefore your presence within our Shopping Centre.

                b) When you use our App as an authenticated user, upon your consent, we collect information about your geolocation to provide you with the relevant Services. Please see article 3 for further details.

                c) When you use the Website and accept the use of non-essential cookies, we collect the cookies you have accepted. You will find all details about cookies here.

For further details about how we collect your personal data, see the table below.

3/ Details about the processing of your personal data

3.1 - You will find in the table below all information in relation with:

-         Why we are processing your personal data (Purpose)

-         Which personal data are involved (Personal data involved)

-         On which legal basis we are processing your personal data (Legal basis)

-         How long we are storing your personal data (Retention period)

NEWSLETTER

LOYALTY PROGRAM

SOCIAL WALL

WEB PUSH

APPLICABLE TO ALL PROCESSING ACTIVITIES

* If you wish to obtain further details regarding our legitimate interests, please contact us by sending a request using the contact details specified in article 7.6.

3.3 Geolocation in our Shopping Centres

General principle

Subject to your consent given in the App, information related to your location within our Shopping Centre may be collected and processed by us while you are authenticated on our App for the purposes of providing you with location related services.

Geolocation will only take place if you have activated the additional services/specific function in the settings of your downloaded App on your mobile device. You could deactivate those additional services at any time in the settings.

Please note that when given, your consent will be effective immediately for any further connections on our App and for any further visits in our Shopping Centre within 12 months from first connection, unless you withdraw your consent.

To take part in certain challenges, you may be asked to activate geolocation on your mobile device. If this is the case, this request will be linked to the specific nature of the challenge in which you are taking part (for example, to count the number of steps taken in our centres). In any event, the activation of geolocation will not be automatic and will require your specific agreement.

How to manage your geolocation preferences on your mobile device

In order to be located within the Shopping Centre, you will be required to activate the Bluetooth feature on your mobile device.

If you only want to check out the map, the activation of the Bluetooth feature is not required.

Please note that we will not locate you outside our Shopping Centre. The location option is carried out by the Bluetooth beacons which are installed in the common areas of the Shopping Centre only.

You may disable the geolocation of your mobile device through your mobile settings at any time.

4/ How do we share your personal data?

In accordance with your choices, each Data Controller has access to your personal data (see article 1 above).

In addition, we may share your personal data with:

·        our processors acting on our behalf and upon our instructions as listed here;

·        any competent authority or legal entity to answer to legal or regulatory requests, court orders, subpoena or legal process, if necessary to comply with applicable laws;

·        any transferee, when personal data is transferred as part of the sale or otherwise transfer of all or part of our assets to another company;

·        with our insurers, lawyers, other advisers and courts when enforcing claims and/or defending our position

·        partners publishing Services on Our Site and/or Our App to which you have subscribed. These services are governed by the terms of use of the partners in question and your personal data is processed in accordance with their Privacy Policy.

5/ How do we keep your personal data secure?

We take the security of all the personal data we process very seriously and we are committed to protecting your personal data. We have therefore implemented appropriate technical and organizational security measures, and have chosen our providers accordingly.

We have entered into specific data processing agreements with each of our service providers that qualify as a processor and have checked their general technical and organizational measures. The service providers are only authorized to process your personal data, as data processor, in compliance with the provision of this Privacy Notice, only on our behalf and according to our instructions. We cannot control all the risks related to the use of the Internet, and data security also relies on everyone's vigilance and good use of these technologies, therefore we invite you to remain highly vigilant on potential inherent risks while using Internet services.

6/ When do we transfer your personal data outside the European Economic Area and the United Kingdom?

6.1 Transfer to the Local Data Controller

Depending on your usage of the Services, in particular if you subscribe to the newsletter of a Shopping Centre located in the USA and/or if you select a Preferred Shopping Centre located in the USA, your personal data may be transferred, in the conditions explained in article 1, to the Local Data Controller in the USA, a country whose legislation has not been recognized by the European Commission or the UK Secretary of State as providing an adequate level of protection for personal data.

In that respect, we have implemented between our companies the relevant Standard Contractual Clauses adopted by the European Commission (as amended by the UK Addendum issued by the UK Information Commissioner, where relevant) to secure such transfer.

6.2 Transfer to our service providers

We use third party service providers that help us provide the Services to you and process your personal data on our behalf. Such third party service providers will always be subject to security and confidentiality obligations consistent with this Privacy Notice and the applicable law.

Note that some of our third party service providers that may process your personal data are located outside the EEA and the UK in countries whose legislation has not been recognized by the European Commission or the UK Secretary of State as providing an adequate level of protection for personal data. Therefore, we have implemented with such providers the appropriate safeguards to ensure that your personal data benefits from an adequate level of protection when accessed and processed from such countries, i.e., we have entered into the relevant Standard Contractual Clauses adopted by the European Commission (as amended by the UK Addendum issued by the UK Information Commissioner, where relevant) or, where applicable, our providers rely on Binding Corporate Rules approved by the relevant authority.  

6.3 General information about data transfers

If you need further information on international data transfers, please contact us through the contact details specified in article 7.7  below.

 Information on the Standard Contractual Clauses can be found here.

Information on the Binding Corporate Rules can be found here.

7/ Your rights in relation to your personal data

7.1 Pursuant to applicable laws you have various rights in relation to the processing of your personal data, depending on the relevant situation:

• Right to access to your personal data: You have the right to request confirmation that we process your personal data and, in this case, to receive a copy of it;
• Right to rectification of your personal data: If the personal data we are processing are inaccurate, you have the right to request the rectification of your personal data;
• Right to erasure of your personal data: You have the right to request the erasure of some or all of your personal data;
• Right to object to the processing of your personal data: You have the right to object to the processing of your personal data. This means that you can ask us to stop the processing of your personal data until we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims. If we process your personal data for direct marketing purposes and you object to that use, we will stop the processing of your data for such purposes;
• Right to restriction of the processing of your personal data: You have the right to request the restriction of processing of your personal data, in particular if you dispute the accuracy, lawfulness or our need to process your personal data. In such case and if applicable, we will then process the personal data only for the establishment, exercise or defence of legal claims or, where necessary, for protection of another natural or legal person, or other limited reason dictated by applicable laws;
• Right to data portability: You have the right to receive a copy of your personal data provided to us, in an interoperable format or, where appropriate and technically feasible, you may also ask for the transmission of such data directly to another data controller;
• Only for French citizens: You have the right to give instructions regarding the further processing of your personal data after your death.

7.2 Withdrawal of your consent(s) When the legal basis of the processing is your consent, as detailed in the table displayed in article 3.1 above (column “Legal basis”), you may withdraw your given consent(s) at any time without having to give any reason.

If you do so, we will stop any further processing based on this consent. Please note that the withdrawal of your consent does not affect the lawfulness of any processing based on consent before its withdrawal.

7.3 Unsubscribing to marketing communication

If you do not want to receive marketing communication, you can ask us to stop sending them as follows:

> send an e-mail through the contact details specified in article 7.6 below; or

> directly change the setting in your Loyalty Account, if any; or

> click on the unsubscribing link available in all our communication.

7.4 Managing your Preferred Shopping Centre(s)

You can manage at any time your list of Preferred Shopping Centre(s) through your Loyalty Account.

The communications sent by your Preferred Shopping Centre(s) will follow your communication settings preferences (whether you want to receive only information about the Loyalty Program, or commercial communications or no communication at all).

Please note that if you remove a Shopping Centre from your list of Preferred Shopping Centre(s):

- you will stop receiving communication from it, no matter what your communication preferences settings are;

- you are automatically unsubscribed from the challenges offered in the Shopping Center concerned.

7.5 Deletion of your Loyalty Account

If you want to delete your Loyalty Account, you can either:

               > delete it directly in the setting of your Loyalty Account; or,

> send an e-mail through the contact details specified in article 7.6 below.

If you have subscribed to the services offered by our donation platform GEEV, the deletion of your Loyalty Account will automatically result in the deletion of your GEEV account. If you wish to continue using the services offered by GEEV, you will need to create a new account via the service provider's website.

7.6 Exercise of your Rights

If you wish to exercise any of your rights, please enter your request via the following link:  MyRights  

or obtain all relevant information, please contact, either:

> your Local Data Controllers: contact details of each Local Data Controller are specified here; or

> the Group Data Controller (including its data protection officer) at the following address: data.protection@urw.com or via post at 7 place du Chancelier Adenauer, 75116 PARIS, France.

To ensure an effective exercise of your rights, please note that you can send your request to any of the above mentioned contact details for any of your questions and demands in relation to the processing carried out by any of the Data Controllers (Local Data Controllers and Group Data Controller).

In your request, please try to make clear: (i) what personal data is concerned; and (ii) which of your rights you would like to enforce.

You can also exercise certain of your rights directly through your Loyalty Account.

In order to avoid infringing third party rights, we reserve the right, in case of reasonable doubt, to proceed to prior verification of your identity in asking you:

-         identifying questions such as for example your Loyalty Card number, or birth date;

-         an ID Document if a reasonable doubt is persistent after the first step described above.

We will respond to your request within 1 month after receipt. That period may be extended by 2 further months where necessary, taking into account the complexity and number of your request. We will in any event inform you within 1 month after receipt of your request if we decide to extend the period to respond, together with the reasons for such extension.

 7.7 Complaints

You have the right to lodge a complaint with the competent data protection authority in the country of your habitual residence, place of work or place of an alleged infringement if you consider that the way we process your personal data infringes applicable data protection laws.

8/ Transfer in case of change of ownership

If Unibail-Rodamco-Westfield group is involved in a merger, acquisition, dissolution, or sale of all or part of the Shopping Centre, or its operating or managing company or owner, when you are registered as a Loyalty Program member or when you have subscribed to a newsletter, we reserve the right to transfer your personal data. If such change requires notification or consent under applicable law, you will be notified or given the opportunity to consent.

9/ COOKIES AND TRACKING TECHNOLOGIES MANAGEMENT

When you visit our Website or our App (referred to as “Site” in this Privacy Notice), we or our partners may use cookies and similar technologies to collect information about your use of the Service.

What are cookies and tracking technologies?

Depending on how you are accessing the Service the tracking technologies used are different.

On the Website, we are using cookies and similar technologies (such as Pixel, web beacons…). Cookies are small text files which are placed on your browser when you visit a website. Cookies are widely used to make websites work, to recognize your device and remember information about your visit (e.g., your preferred language, font size, other preferences, and information about your activity). Pixels (also known as web beacons) are code embedded in a service that sends information about a browser or device to a server. Pixels provide similar functionality to cookies but are not always browser-based. When you access a service that contains a pixel, the pixel may permit us or a third party to drop or read cookies on your browser or collect other information about your browser or device.

On the App, we rely on non browser-based technologies such as Software Development Kits (SDKs). SDKs are pieces of code released by third parties that provide certain functionality.  App technologies are used for purposes similar to cookies and pixels and may permit us or a third party to collect information from your browser or device.

(The tracking technologies will together be referred to as “Cookies and Technologies” or “Cookies” in this Privacy Notice)

Our Use of cookies?

We may place different types of Cookies for the following purposes:

·        Strictly necessary.

These Cookies and Technologies are necessary for the Site to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these Cookies and Technologies, but some parts of the Site will not then work.

·        Performance.

These Cookies and Technologies allow us to count visits and traffic sources so we can measure and improve the performance of the Site. They help us to know which pages are the most and least popular and see how visitors move around the Site.

·        Functional.

These Cookies and Technologies enable the Site to provide enhanced functionality and personalization. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these Cookies, then some or all of these services may not function properly.

·        Targeting cookies.

These Cookies and Technologies may be set through the Site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. If you do not allow these Cookies and Technologies, you will experience less targeted advertising.

·        « Social media » cookies.

These Cookies and Technologies are set by a range of social media services that we have added to the Site. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these Cookies you may not be able to use or see these services.

Your choices regarding Cookies and Technologies?

By using the Site, you can consent to the use of the above-mentioned Cookies. Your choices are retained for a maximum period of 6 (six) months. You have several ways to manage your choices regarding Cookies:

Our Cookies and Technologies management tool

The Cookies and Technologies management module available on the Site allows you to control the use that we and our partners make of the Cookies.  You can choose at any time to accept, refuse, or set them all according to your choices by clicking on the appropriate button in the cookies management module, except for Cookies strictly necessary for the use of the website that you cannot deactivate.

Under Californian law, Californian residents have the right to opt-out of the "sale" or "share" of their personal information to third parties. A “sale” is broadly defined to include a disclosure for something of value, and a “share” is broadly defined to include a disclosure for cross-context behavioral advertising. Click “Decline all” to opt-out of sales or shares of your personal information through tracking technologies on the Website

The choices offered to you by your browser software

In addition, most browsers allow you to manage your cookies preferences on websites by changing your browser settings.

You may set your browser to:

- Automatically reject or accept all cookies

- Refuse or accept first party cookies and/ or third party cookies

- Receive a notification before any cookies are saved, giving you the chance to decide whether to accept it.

Your browser's "Help" function should tell you how to do this.

Alternatively, you can follow the links below that provide instructions for managing cookies settings in commonly used browsers on websites:

·        Chrome (https://support.google.com/chrome/answer/95647?hl=en )

·        Internet Explorer (http://windows.microsoft.com/en-US/windows-vista/Block-or-allow-cookies )

·        Mozilla Firefox (https://support.mozilla.org/en-US/kb/clear-cookies-and-site-data-firefox)

·        Safari (https://support.apple.com/fr-fr/guide/safari/sfri11471/mac )

In addition, if you do not want : - Google Analytics to be used in your browser, you can:

·        Install the Google Analytics browser add-on available for download at https://tools.google.com/dlpage/gaoptout

·        Use the ad settings

·        Use the mobile ad settings

·        Opt out through the Network Advertising initiative consumer opt-out system accessible at the following link: http://optout.networkadvertising.org/#!/

In addition, you can use another online service enabling you to manage advertisement cookies placed on your computer or mobile phone: http://www.youronlinechoices.com/

10/ Update of this Privacy Notice

We may revise or update this Privacy Notice from time to time. Any change to this Privacy Notice will become effective upon online publication.

If such change requires your notification or consent under applicable law with respect to any processing contemplated in the updated version of the Privacy Notice, you will be notified or given the opportunity to consent as to whether or not we may use your personal data in a different manner.