Privacy and Cookies Policy

At McArthurGlen, we take the privacy of your data seriously. We understand that by providing your personal information - whether through our website, using our WiFi or at our outlet centres – you are entrusting us with your information.

We have developed this policy to give you full transparency about the information we collect from you, why we collect it and how we use it. We also need to ensure that you understand the rights you have over your personal data, including your rights of access to that data, how you can correct it and, if necessary, how you can erase it. Please click here for preferred center cookies

Please note that there is additional information in the Jurisdiction specific information section at the end of this Policy. If you are from one of the jurisdictions named in that section, then any information in the section relating to your jurisdiction supersedes any conflicting information in the other parts of this Policy. If you are in the EEA, the GDPR applies to the processing of your personal data. If you are in the UK, the UK GDPR applies to your personal data.

If you wish to learn more about the data we hold, including your rights, please click on the sections below:

Policy Introduction

This website (“Site”) is controlled and operated by McArthurGlen UK Limited (referred to in this Privacy Policy as "McArthurGlen", "we", "us" or "our").

McArthurGlen develops and manages designer outlet centres across the UK, Europe and Canada. We work with our other Group Companies to provide services at these centres and to facilitate and enhance your experience at these centres and on this Site.

This Privacy Policy ("Policy") explains what personal information we and our Group Companies collect and record about you and what we do with that information, including when you visit this Site. It sets out a description of your data protection rights, including your right to object to some of the processing which we carry out. This Policy also explains what personal information we collect and record on our in-centre computers and devices and in certain cases offline, and what we do with that information. Annexed to this Policy is additional information that relates specifically to the personal information we collect and record when you use WiFi provided by us and via our Group Companies (“WiFi Annex”). Please read this Policy carefully.

For the purposes of this Policy: References in this Policy to “you" or “your” are references to individuals whose Personal data is processed by us, including anyone who uses our Site, visits our Centres, signs up for our services or uses the WiFi provided by us. “Group Company” means our parent company and any subsidiaries of our parent company, including us. This includes our subsidiary management companies operating in each of our locations. A list of these Group Companies and their locations can be found at the end of this Policy. We may change this list from time to time. "Centre Owner" means an owner of one of the designer outlet centres which we manage (“Centre”).

For the purposes of this Policy the controller of personal data is McArthurGlen UK Limited, and our contact details are set out at the end of this Policy.

For children and parents

We do not knowingly collect personal information from children under 16 years of age. Please do not provide us with personal information if you are under the age of 16, and do not sign up for any technology services at our centres, including the WiFi.

The information we collect

We collect, receive, store and process the following information about you:

information that you provide via the Site or our mobile apps, including the McArthurGlen Club app ("apps"), including information you provide when you register with or use the Site or apps (e.g. name, address, telephone numbers, email address, preferred centre, interests and date of birth), join our Privilege Club (our exclusive club where you can sign up to keep up to date with our latest news, events and offers) or the replacement for Privilege Club, known as McArthurGlen Club, purchase a gift card, book parking, enter into competitions or complete surveys, participate in a contest or promotion, or join or post comments on our social media sites;
information that you provide to us for the purpose of subscribing to direct marketing;
information about your computer or mobile device and about your visits to and use of this Site or our apps, such as Internet Protocol (IP) addresses, geolocation, date and time that you visited the Site or apps, the type of Internet browser and computer operating system, referral source, length of visit, page views and website or app navigation paths;
information relating to any purchases you make via our Site or apps (e.g. gift cards) or any other transactions that you enter into through our Site or apps (including your name, address, telephone number, email address, card details and transaction history);
information that you provide to us for the purpose of Click and Reserve via our Site;
information contained in or relating to any communications that you send to us or send through our Site or apps (including the communication content and meta data associated with the communication);
information we obtain from private social media companies (see also Social Media below) including from outside the European Union, about your interests and preferences;
information as set out in the 'Cookies and similar technologies' section below;
information collected through transactions or interactions offline or on our in-centre computers or devices, including information you provide when signing up to our Privilege Club or the replacement for Privilege Club, known as McArthurGlen Club, when purchasing gift cards, when completing surveys, entering into competitions and when using in-centre computers and devices;
information about which brands you have visited if you use one of our apps to scan a QR code in-store or you are logged into McArthurGlen Club when you do so;
information collected by our systems during your visits to our Centres, such as CCTV footage, audio recordings, body worn video camera footage and/or automatic number plate recognition (ANPR) data;
information about which e-mails from us you open;
information about your postal code when you register with us (e.g. for McArthurGlen Club) so that we know how far you travel to our Centres and your likelihood of visiting a particular Centre; and
information described in the WiFi Annex.

We do not attempt to collect special categories of personal data about you, or data relating to criminal offences or convictions. Special category data includes personal data relating to health, race or ethnic origin, religious or political beliefs, political opinions, sex life or sexual orientation, trade union membership and biometric data for the purpose of uniquely identifying you. However, it is possible that we will on occasion process special categories of personal data about you, where you expressly provide it or when this is inferred from data you provide to us, e.g. where you include it in the personalised message you write when purchasing a gift card. Please do not provide us with any special category information to us such as that related to health, race, ethnicity or religion.

We may collect, use and share aggregated data such as statistical data for any purpose. Aggregated data may be derived from your personal data but does not reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing a specific Site feature.

Use of your information

We use your personal information for the purposes set out in the table below. In this table any reference to “our legitimate interests” will be replaced with “reasonable and legitimate purposes as permitted by law” in respect of Canada only.

Purpose	Lawful basis
to administer our Site and apps, business and the Centres;	Our legitimate interests
to enable your use of the products and services available on our Site and apps or otherwise made available offline or on our in-centre computers and devices;	Our legitimate interests
to provide and administer our Privilege Club or the replacement for Privilege Club, known as McArthurGlen Club, including to personalise and improve the service you receive through these programmes (e.g. birthday offers, promotions at your local Centre);	Our legitimate interests and the performance of a contract
to manage and run advertisement campaigns, competitions or offers;	Consent and our legitimate interests
to confirm orders and fulfil orders placed on our Site or apps;	Performance of a contract
to respond to your questions or requests for additional information and communicate with you about the Site or apps and the Centres;	Our legitimate interests
to provide you with information that you have specifically requested or that we have asked if you would like to receive;	Our legitimate interests and the performance of a contract
for internal research and analysis so that we can see how our Site, apps and the Centres’ and/or our Group Companies' products and services are being used, understand how we can improve our Site or apps and the Centres’ and/or our Group Companies' products and services and decide our and our Group Companies’ marketing strategies;	Our legitimate interests
to deal with enquiries and complaints made by or about you relating to us, our Site or apps and the Centres;	Our legitimate interests
to keep our Site, apps and systems secure and prevent fraud;	Our legitimate interests and compliance with a legal obligation
where relevant, to meet legal, regulatory and compliance requirements;	Compliance with a legal obligation
where relevant, for the establishment, exercise or defence of legal claims;	Our legitimate interests and compliance with a legal obligation
in order to carry out tasks or achieve objectives in our legitimate commercial interests	Our legitimate interests
to monitor and analyse the use of any account to prevent, investigate and/or report security incidents or crime;	Our legitimate interests and compliance with a legal obligation
verify compliance with the terms and conditions governing the use of our Site, apps and in-centre computers and devices;	Our legitimate interests
to protect the rights, property, or safety of us (including our employees and contractors), Group Companies, our customers, Centre Owners or others and including the prevention and detection of crime;	Our legitimate interests and compliance with a legal obligation
to understand your interests and preferences so we can tailor the content, offers and promotions we surface on our Site or apps to better match your interests and preferences – see also our Cookie Policy;	Consent and our legitimate interests
to understand and identify the features of our customer base for insight purposes (including from social media sources) and in order to better target our advertising, also referred to as "profiling", (e.g. reaching out to a similar demographic on social media);	Consent and our legitimate interests
to send customer satisfaction surveys to you; and	Consent and our legitimate interests
for the purposes described in the WiFi Annex.	Please see table in the WiFi Annex for relevant lawful bases

We will also inform you from time to time of other products and/or services we offer which we consider may be of interest to you by email / phone / SMS / post, where permitted by applicable law (which may require that we obtain your consent). As well as unsubscribing within communications, you may email us at any time at dataprotection@mcarthurglen.com to indicate that you do not want to receive direct marketing communications from us.

We may combine information we collect about you through transactions or interactions offline or on our in-centre terminals or our email and SMS communications with the customer profile we hold about you in order to tailor our subsequent communications and communication channels to better match your interests and preferences and provide you with a better customer experience.

Social Media

We also use personal information we obtain from social media sites online including, Facebook, Instagram, Twitter, YouTube and TripAdvisor for our (and our businesses’) research and analytics purpose. Where appropriate, and in line with their own policies, we may match information from these sites to better understand, and improve, our customers' experience. This includes posts or other information made public or made available to us where you use hashtags or tags relating to us, our Group Companies, our business, the Centre Owners, the Centres and our industry. Information from these sites may include information which has been held outside the European Union.

Information Sharing

We disclose or transfer personal information to other parties as follows:

to any Group Company for the purposes identified in this Policy, including those uses set out above (a list of our Group Companies and their locations can be found at the end of this Policy);
to third party service providers that perform functions on our behalf in relation to the Site and apps or our Centres and for the purposes set out in this Policy (for example, website hosting, social media analysis providers, marketing email service providers, data analysts and website developers);
to brand partners (stores) in order to fulfil Click and Reserve orders;
media agencies and their advertising partners in order to run targeted marketing campaigns as described above;
if we are under a duty to disclose or share your personal information in order to comply with any legal obligation;
in order to enforce or apply our terms and conditions or other agreements or to protect the rights, property, or safety of McArthurGlen, the Group Companies, our customers, or others;
to government authorities, and to other third parties when compelled to do so by government and law enforcement authorities or otherwise as required or permitted by law, including but not limited to in response to court orders and subpoenas. We also disclose user information when we have reason to believe that someone is causing injury to or interference with our rights or property, other users of our site, or anyone else that could be harmed by such activities. Additionally, we cooperate with law enforcement inquiries and other third parties to enforce laws, intellectual property rights and other rights;
to sellers or buyers as part of a sale or merger of our business or assets;
in compliance with and to the extent permitted by GDPR, to an applicable Centre Owner or one of its group companies or to buyers as part of a sale or merger of a Centre Owner or Centre. In addition, if we or one of our Group Companies ceases the role as a manager of a designer outlet centre, we will need to transfer your personal data to the Centre Owner or the replacement manager to ensure the continuity of our, or our relevant Group Company's products and services; and
as described in the WiFi Annex.

In addition, with your consent where required by law, we share your personal information with carefully selected third parties so that they can send you information about special promotions and offers.

To enhance your shopping experience, our Site may include links to other websites. Those websites will have their own privacy policies that you may wish to review. We have no control over, or responsibility for, the data processing carried out by these linked websites.

We also share information about visitors to this Site and our apps in an anonymous or aggregate form with third parties including advertisers, business partners, and sponsors, to understand customer trends and patterns and manage and improve our business relationships.

We require all third party service providers to respect the security of your personal data and to treat it in accordance with the law, maintaining minimum standards of confidentiality. We do not allow our third-party service providers who process your personal data on our behalf (data processors) to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

If you would like a list of the third parties with whom we share personal information, please contact dataprotection@mcarthurglen.com.

Securing your Information

We take reasonable steps to protect your personal information as you visit and use the Site and our apps and to protect such information from loss, misuse, unauthorised access, disclosure, alteration or destruction. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality. Unfortunately, no data transmission can be guaranteed to be 100% secure and we recommend that you follow reasonable precautions e.g. when using public WiFi networks to transmit data.

Transferring your information

You understand and acknowledge that by using this Site and our apps, we collect and use personal information in the UK, in the European Economic Area (“EEA”) and in Canada. We transfer personal information to countries outside the UK and EEA to our Group Companies and to third parties, including to countries which have different data protection standards to those which apply in the EEA. Our Group Company locations are set out in the 'Our Group Companies' section below. Our service providers include locations in Australia and Canada.

Where service providers process your personal information in countries (or if the service providers themselves are) deemed adequate by the European Commission or the UK (depending on which one is relevant), we rely on the European Commission's or the UK's decision to protect your personal information.

For transfers to Group Companies and service providers outside the EEA or UK where there is no adequacy decision in place, we use EU standard contractual clauses, UK standard contractual clauses or rely on (data protection authority approved) corporate rules that are in place to protect your personal information. You have a right to ask us for a copy of the standard contractual clauses or a copy of the other methods used (by contacting us as set out below).

Retaining your Data

We retain personal information for as long as necessary for the purposes for which it was collected (including as permitted or required by law). For example, the personal information used to send you direct marketing is retained for as long as we can lawfully market to you. Where we no longer have grounds to market to you (e.g. because you opt-out) or the details we hold are no longer up-to-date (e.g. the email address we hold is invalid), or as otherwise required by law, we will delete personal information we hold about you from our marketing data base but retain some information on a 'suppression list' on an ongoing basis so we can manage your preferences going forward.

Personal information collected for the purposes of our competitions or prize draws, or for the processing of gift cards, is deleted when it is no longer needed.

In general, we will only retain your personal data so long as the original purpose for which that personal data was collected still applies although we may retain it longer if necessary for legal reasons such as retaining data to deal with any disputes or for regulatory reasons such as tax and accounting purposes. For more details on specific retention periods relating to your personal data please contact dataprotection@mcarthurglen.com.

Legal basis for processing your information

The information below is further to the table at section Use of your information. We process your personal information with your consent when you agree that we may place certain types of Cookies, when you agree to receiving direct marketing or on other occasions where we ask you for consent, for the purpose which we explain at that time. Where we do process personal information based on consent, your consent is revocable at any time (without affecting the lawfulness of processing based on consent before its withdrawal).

We process your personal information when we are required to do so by law, including in response to requests by government or law enforcement authorities conducting an investigation or court orders.

We process your personal information when it is necessary for the performance of a contract to which you are the party or in order to take steps at your request prior to entering into a contract. This applies in any case where we provide or deliver products and services to you pursuant to a contract, such as when you have signed up for Privilege Club or its replacement, known as McArthurGlen Club, or when you purchase a gift card, process your registration on the Site or enter into a competition. If you do not provide the personal information that we need in order to provide or deliver the service, we will not be able to provide or deliver services to you.

We also process your personal information when it is necessary for the purposes of a legitimate interest pursued by us or a third party (when these interests are not overridden by your data protection rights). These legitimate interests include the administration and running of our business, marketing to current and potential customers, servicing our existing customers, and improving our services to current and potential customers.

Your Rights

You may ask us for a copy of your information and, where applicable, to correct it, erase it or to transfer it to other organisations at your request. You also have rights to object to some processing and, where we have asked for your consent to process your personal information, to withdraw this consent. Where you withdraw your consent, this does not affect the lawfulness of the processing of your personal data which was carried out before the withdrawal of your consent.

You have the right to restrict the way in which we process your personal data in some situations which means you may limit the way in which we use your personal data. Where we process your personal information because we have a legitimate interest in doing so (as explained above), you also have a right to object to this. These rights may be limited in some situations – for example, where we can demonstrate that we have a legal requirement to process your personal information.

We hope that we can satisfy queries you may have about the way we process your personal information. However, if you have unresolved concerns you also have the right to complain to data protection authorities. The data protection authorities in the jurisdictions in which we operate have been listed below. You can bring the complaint in your country of residence, place of work or where an alleged infringement of data protection law occurred.

Country	Data Protection Authority
Austria	The Austrian Data Protection Authority
Canada	Office of the Information and Privacy Commissioner for B.C.
France	Commission Nationale de l’Informatique et des Libertés
Germany	Datenschutzbehörde
Italy	Garante per la Protezione dei Dati Personali (GPDP)
Spain	Agencia Española de Protección de Datos
Netherlands	The Dutch Data Protection Authority (“Autoriteit Persoonsgegevens”)
United Kingdom	The Information Commissioner's Office

If you receive an e-mail from the Site and you would prefer not to receive such communications in the future, you can choose to unsubscribe (opt-out) by following the instructions in the e-mail or send an e-mail to dataprotection@mcarthurglen.com. mailto:Dataprotection@mcarthurglen.comWe will make commercially reasonable efforts to implement your opt-out requests promptly, but you may still receive communications from us that was already underway before we process your request and update our systems.

To protect your privacy and security we will take reasonable steps to verify your identity when dealing with requests.

Our Group Companies

Name of entity	Country
Outlet Services Holdco Limited	Jersey
McArthurGlen Management Gesellschaft m.b.H.	Austria
McArthurGlen Management Vancouver Limited	Canada
MG-RB Europe SAS	France
McArthurGlen Service GmbH	Germany
McArthurGlen Management Greece Designer Outlet EPE	Greece
MGR Management & Retail Srl	Italy
McArthurGlen Management Spain SLU	Spain
MGE-RB (Roermond) Management Co B.V.	Netherlands
MGE-RB (Rosada) Management Co B.V.	Netherlands
McArthurGlen UK Ltd	United Kingdom

Wifi Policy

Introduction

This Annex to the Privacy Policy (“Policy”) relates to your use of a WiFi service (the “WiFi Service”) which is provided by or on behalf of McArthurGlen UK Limited (referred to in this WiFi Annex as "McArthurGlen", "we", "us" or "our") from our venues when you have applied to access or accessed the WiFi Service. This Annex, in addition to the Policy, explains in further detail how we use your personal information we collect and generate when you use the WiFi Service.

For the purposes of this Annex, “Group Company” has the same meaning as set out in the Policy.

Information we collect

We collect, receive, store and process the following information about you:

information that you provide when registering for the WiFi Service (e.g. name, address, telephone numbers, email address and date of birth);
your device details and MAC address (see below for further information about MAC addresses);
details about when and where you connect to the WiFi Service including your venue location and the WiFi access point(s) where you are using the WiFi service. This data will be collected automatically by the wireless access point unless your phone/device is switched off or you have switched off WiFi on your phone/device; and
your communications with us in connection with the WiFi Service.

We will collect your personal information from you and from your use of the WiFi Service, from our WiFi providers and from social media providers if you register using a social media account.

A MAC address unique identifier for your device that tells us the make of a device e.g. Samsung or Apple, but it does not tell us your name or phone number, or allow us to access any data held on your device. If your WiFi settings on your mobile device are turned on when you visit one of our locations (including the parking area but no further) then we automatically collect the MAC address from your device. We explain how we use MAC addresses in the next section.

Use of your information

In addition to the purposes described in the Policy, in respect of WiFi we use your personal information for the purposes set out in the table below. In this table any reference to “our legitimate interests” will be replaced with “reasonable and legitimate purposes as permitted by law” in respect of Canada only.

Purpose	Lawful basis
to provide the WiFi service to you and to enable you to connect to the WiFi Service efficiently on return visits;	Our legitimate interests and the performance of a contract
to respond to your questions, requests for additional information, enquiries or complaints about the WiFi Service;	Our legitimate interests
to communicate information about the WiFi Service to you, including changes to the WiFi Service;	Our legitimate interests
to keep our WiFi Service secure and prevent fraud;	Our legitimate interests and compliance with a legal obligation
to monitor and analyse the use of the WiFi Services to prevent, investigate and/or report security incidents or crime;	Our legitimate interests and compliance with a legal obligation
to verify compliance with the terms and conditions governing the use of the WiFi Service; and	Our legitimate interests
for research and analytics of use of the WiFi Service to identify general consumer trends, to understand better customer, consumer and social behaviours and to improve our products and services. We provide aggregated statistics about our sales, customers, traffic patterns to third parties for analytics purposes but these statistics will not include any information that is likely to identify you as an individual.	Our legitimate interests

We use MAC addresses to determine your distance from WiFi sensors located across the location you are visiting. We aggregate this information to create reports on the movement of visitors to our locations. We use this information, for example, to optimise the layout of our locations, design marketing promotions, change staffing hours, or measure the impact of a campaign. You can opt out of having your location data collected at any time by visiting http://optout.mcarthurglen.com. With your consent, we use your location data for the purpose of selecting and sending you marketing offers and alerts which might interest you during your visit to a location.

Sharing your information

In addition to the disclosures described in the Policy, we disclose or transfer personal information to third party service providers that perform functions on our behalf in relation to the WiFi Services and the purposes set out in this Annex and the Policy. Third party providers of analytics and reporting services include AM Networks Ltd, 77a Cheap Street, Sherborne, Dorset, DT9 3BA; Skyfii Group Pty Ltd, Darlinghurst, New South Wales 2010, Australia; and Aislelabs Inc, 210-43 Hanna Ave, Toronto ON, M6K 1X1, Canada.

If you would like a list of the third parties with whom we share personal information, please contact dataprotection@mcarthurglen.com.

Transfers

See the 'Transfers' section of the Policy.

Retention

We retain information that you provide when registering for the WiFi Service and your device details and MAC address for two years from collection unless stated otherwise in Jurisdiction Specific Information.

Legal basis for processing

This information is further to the section Use of your information in this Wifi Annex. We process your personal information when we are required to do this by law, including in response to requests by government or law enforcement authorities conducting an investigation or court orders.

If it is mandatory for you to provide personal information, we will make this clear at the time and will also explain what will happen if you do not provide the information.

We process your personal information when it is necessary for the performance of a contract to which you are the party or in order to take steps at your request prior to entering into a contract (for example, when we provide or deliver services to you pursuant to a contract). If you do not provide the personal information that we need in order to provide or deliver the WiFi Service, we will not be able to provide or deliver WiFi Services to you.

We process your personal information when it is necessary for the purposes of a legitimate interest pursued by us or a third party (when these interests are not overridden by your data protection rights). These legitimate interests include the administration and running of our business, marketing to current and potential customers, servicing our existing customers, and improving our services to current and potential customers.

Where we do process personal information based on consent, your consent is revocable at any time. Where you withdraw your consent, this does not affect the lawfulness of the processing of your personal data which was carried out before the withdrawal of your consent.

Your rights

See the ‘Your rights’ section of the Policy.

Contact

Our Data Protection Officer can be contacted via dataprotection@mcarthurglen.com.

Changes to this Policy

We reserve the right to modify this Annex at any time. Changes to this Annex will be posted on the Site or on WiFi Service log-in or registration pages, and we will email you with updates if we have your email address. We recommend that you review this Policy frequently.

France specific information

We will not hold your personal data on an indefinite 'suppression list'.
We will not retain your personal data after 3 years from the date of our last interaction.
If you do not wish to be contacted by phone, you can register on the Bloctel opt-out list (for more information, please click here. You also have a right to set down instructions on the management of your personal information after death.
We retain information that you provide when registering for the WiFi Service and your device details and MAC address for two years from collection.

Germany specific information

Where you have given your consent, we also use personal information we obtain from social media sites online including, Facebook, Instagram, Twitter, YouTube and TripAdvisor for our (and our businesses’) research and analytics purpose. Where appropriate, and in line with their own policies, we may match information from these sites to better understand, and improve, our customers' experience. This includes posts or other information made public or made available to us where you use hashtags or tags relating to us, our Group Companies, our business, the Centre Owners, the Centres and our industry. Information from these sites may include information which has been held outside the European Union.

Netherlands specific information

To the extent that we process your personal data for marketing purposes, we will collect and rely on your consent as a lawful basis.
Where we collect personal data and MAC address to track your location through our WiFi sensors, we will collect and rely on your consent as a lawful basis.
We will only retain your personal data and MAC address used to track your location for up to 24 hours from the last point at which your device has connected to our Wifi network.

Spain specific information

If you do not wish to be contacted by phone, you can register on the Lista Robinson opt-out list (for more information, please click here). If you are registered we will not send marketing communications to you unless you have given your consent to receive marketing communications.

Italy specific information

For transfers to Group Companies and service providers outside the EEA or UK where there is no adequacy decision in place, we use the EU Standard Contractual Clauses to ensure that your Personal Data is adequately protected. If none of these criteria is met, MG may still transfer Personal Data outside the EEA if you explicitly consent or the transfer is legally necessary. You have the right to ask us for a copy of the standard contractual clauses or a copy of the other methods used (by contacting us as set out in this Policy).
You may withdraw your consent in the same manner which you gave consent.