This Privacy Notice (“Privacy Notice” or “Notice”) was last updated on 30 April 2024.
This Notice describes the types of personal information (“Information”) collected on our websites and mobile applications (“Online Services”) and in our centres (“Centres”). It explains:
It should be read in conjunction with our other privacy notices:
- Safeguarding and Security Privacy Notice, which explains how we collect and use Data in our shopping centres for security and safeguarding purpose; and
- https://www.westfield.com/en-gb/privacy-notice, which explains how we collect and use Data on our websites and in the context of the provision of our newsletter and our ‘Loyalty Program’ (including the access to your ‘Loyalty Account’ within the website and app).
Data Controllers
The data controllers of the data we collect from you are:
(each a “Data Controller” and together referred to as the “Data Controllers”).
Data Privacy Team
Westfield’s Data Privacy Team may be contacted by email at dpo@urw.com or via post at Westfield Europe Limited, 4th Floor, 1 Ariel Way, London, W12 7SL.
2. HOW DO WE COLLECT AND USE YOUR INFORMATION?
Online Services
Information you give to us: When you subscribe to or book any of the following services online, you will be requested to provide the following information to us directly for the purposes set out below:
Creating a Smart Parking account: If you create a Smart Parking account we will collect your email address, vehicle registration numbers and payment card details. The lawful basis for the processing of this information is to provide you with a contract of service that you have requested. If you have any queries about your Smart Parking account please contact help@urw.com or dpo@urw.com.
Creating a Westfield Club account: : If you create a Westfield Club account we will collect your first name, surname, and email address details. The lawful basis for the processing of this information is to provide you with a contract of service that you have requested. Find out more about how we process your data for Westfield Club account purposes. If you have any queries about your Westfield Club account please contact help@urw.com or dpo@urw.com.
Marketing and competitions: When you create an account, enter a competition or register for an event you may be asked if Westfield can also use your Information for marketing purposes. The lawful basis for these marketing communications is your consent. If you do provide consent, you can subsequently unsubscribe from these communications by: following the unsubscribe link on the email; from your online Westfield account if you have one; or completing the My Rights form.
Information we collect automatically from your device: We may collect Information when you use our Online Services. For example, information about your use of our Online Services, including the time and duration of your visit, the referring URL, your Internet Protocol (IP) address, the type of device you use and its operating system, advertising identifiers, and other device identifiers. The lawful basis for the processing of this Information is for the legitimate interests of Westfield.
Cookies and similar technologies: Westfield and its partners use cookies and similar technologies when you use our Online Services. For more information on our use of cookies, including how to manage your cookie preferences, see our Cookie Policy.
Advertising. Westfield uses the Information you provide us to help us tailor and show advertisements to you. We may partner with third parties to help us display relevant advertising and to manage our advertising across multiple channels. Our third-party partners may use cookies and non-cookie based technologies in order to help us show you advertising based upon your browsing activities and interests.
If you apply for a job with us: If you apply for a job at Westfield through our recruitment website you will be provided with a detailed privacy notice for recruitment and selection as part of the application process.
3. Collection of Information in our Centres
Concierge Services: If you use our Concierge services and other facilities in our Centres, we will collect the Information necessary to provide you with the products or services you have requested. The lawful basis for the collection of this data is for the performance of a contract that we are entering into with you at your request.
Management of our Centres: In the course of running our centres, we may collect Information on incidents and accidents that occur, as well as using CCTV and other security measures for your and our protection. Click here to view our centre safeguarding and security privacy notice for further information on how we use your personal data for these purposes, your rights, and how long we retain the information. This notices also includes information on exclusion orders. We also use licence plate recognition systems in our car parks for operational purposes (such as monitoring car park usage) and to provide services that help you to find your car.
Westfield free Wi-Fi: If you use the free Wi-Fi networks in our centres, we will collect Information from you in order to log you on to the network, including your name and email address (which you must submit on the Wi-Fi service registration form) and your traffic data and connection data necessary for the provision of the Wi-Fi service (such as in particular: IP address, MAC address, routing data, duration, time or volume of a communication or protocol used). We may also collect Information relating to the duration of visits and the identity of the device that connects to the Wi-Fi. The lawful basis for the processing of the Information is that it is necessary for entering into a contract for the provision of a service you have requested (the Wi-Fi service terms of use). Please note that we have no control over third-party websites that you visit and/or use through the Wi-Fi service. The websites of these third parties may install cookies or other files on your device, or collect and process your personal data. We have no control over the processing of any personal data by these third-party sites, which remain solely responsible for their own processing. We therefore invite you to consult the general terms and conditions of use and the respective privacy policies of these third-party sites beforehand to find out how your personal data may be collected and processed.
Location and Wi Fi analytics: We may, with your consent, use Wi-Fi and other technology to help us analyse how visitors travel through our centres, and to provide useful information such as the proportion of repeat visitors to our centres. This technology works by collecting a unique identifier, called a MAC Address, from your mobile device. This is collected by the Wi-Fi signal that your device transmits. The MAC address is ‘hashed’ (a process that obscures the original MAC address) shortly after collection. We do not combine this information with any other information that may identify you. As a data controller, we share your personal data with: our subcontractors acting on behalf and according to our instructions (such as OPENevents, Wi-Fi service providers, Unibail Management S.A.S. to coordinate the sending of the aforementioned information), any competent authority or legal entity to respond to legal or regulatory requests, injunctions, court orders or legal proceedings, if necessary to comply with applicable laws, any transferee (where personal data form part of the sale or transfer of all or part of our assets to another company) and our insurances, lawyers, or other external advisors and the courts to enforce our rights and/or defend us.
Other uses of your information
In addition to the purposes already described, Westfield uses Information collected to perform essential business operations, for example: to understand usage patterns (such as foot traffic) within our centres; to develop, provide, improve and personalise Westfield products and services; and, to provide customer service/support. We may undertake additional research, analysis, and surveys, both online and in our centres. The lawful basis for this use of Information is for the legitimate business interests of Westfield.
4. HOW DO WE SHARE YOUR INFORMATION?
Service Providers. We may share your personal data with the following third parties for further processing:
A list of third parties who we transfer your personal data for this sort of processing is here:
OPENevents
15, avenue de l'Europe
86170
Neuville de Poitou, France
BrainTree
247 Tottenham Court Road
Floor 1
London, UK W1T 7QX
Hub PARKING TECHNOLOGY
(a business unit of the FAAC Group a trading style of FAAC (UK) Limited)
10 Hatch Industrial Park, Greywell Road
Mapledurwell
Basingstoke RG24 7NG
Networks Merchants Limited
4th Floor All Saints’ Street
Bristol BS1 2LZ
Salesforce.com EMEA Limited
Floor 26 Salesforce Tower
110 Bishopsgate
London UK EC2N 4AY
Spreedly
116 West Main Street
Durham, NC 27701-3232
United States
Onetrust
London (Co-Headquarters)
Cannon Green, 27 Bush Lane
London EC4R 0AA
CMX Engage (Cisco Systems)
9-11 New Square
Bedfont Lakes
Feltham
Middlesex
TW14 8HA
Critizr
4 Avenue des Saules
Lille
59000
Managed by Westfield, LLC
Hosting - Google – Big Query / Data Flow / GA
Gordon House, Barrow Street
Dublin, D04 E5W5, Dublin
Hosting - Amazon – AWS
Burlington Plaza, Burlington Rd
Dublin 4, Ireland
Hosting – Monitoring/Logging New Relic, Sumologic
Aviation House
125 Kingsway
London, WC2B 6NH
New Relic
Strand Bridge House, 138-142 The Strand
London, England WC2R 1HL
Disclosure for Legal Reasons. We may disclose Information when we believe, in good faith, that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or comply with the law, including valid legal requests from the Police, or other government agencies.
Change of Ownership. If Westfield is involved in a merger, acquisition, dissolution, or sale of all or a portion of its assets, we reserve the right to transfer your Information. You will be notified via email or by notification on our website of any change in ownership.
5. USE OF CHILDREN'S INFORMATION
Westfield does not knowingly collect Information from children under the age of 16, but it may be collected from parents/guardians with their consent. Examples include the Kids Club services within our centres, and competitions that involve children’s participation.
If you have reason to believe that a child under the age of 16 has provided personal information to Westfield, please complete the My Rights form and we will delete that Information from our databases.
6. HOW LONG DO WE KEEP YOUR INFORMATION?
Westfield retains the Information we collect only for as long as necessary to provide the products and services you have requested, or for other essential purposes such as complying with legal obligations, resolving disputes, and enforcing our agreements. We retain certain categories of data for the following periods:
We provide further information in specific privacy notices on:
7. HOW DO WE KEEP YOUR INFORMATION SECURE?
The security of your Information is important to us. While we follow generally accepted security standards to safeguard the Information submitted to us, it is not possible to guarantee the security or integrity of Information on the internet. Therefore, we encourage you to take precautions to protect your Information, including protecting your passwords, using secure networks to access the internet, and logging out of online services when you are away from your device.
8. WHEN DO WE TRANSFER YOUR INFORMATION OVERSEAS?
We may transfer Information overseas in the following situations:
9. YOUR RIGHTS IN RELATION TO YOUR INFORMATION
Westfield adheres to all applicable data protection laws. In particular:
Westfield’s products and services may contain links or references to other websites or companies not operated or controlled by Westfield. The policies and procedures described here do not apply to those third parties. Links or advertisements do not imply that Westfield endorses or has reviewed such third parties or their privacy practices. Visit those third parties’ websites or contact them directly for information on their privacy notices.
We may update this Notice to reflect changes to our information practices and where updates are required by law. If we make any material changes we will notify you by email (sent to the email address specified in your account) or by means of a notice on our website prior to the change becoming effective. We encourage you to periodically review this page for the latest information on our privacy practices. Your continued use of Westfield products or services after any changes or revisions to this Notice shall indicate your agreement with the revised terms.
If you have questions or complaints regarding our privacy practices or this Notice please contact our Data Privacy Team:
Via email (dpo@urw.com) or by post to: Data Privacy Team, Unibail-Rodamco-Westfield, 4th Floor, 1 Ariel Way, London, W12 7SL.
If you would like to exercise your privacy rights please complete the My Rights form.