We will collect personal information about you from a variety of sources, including information we collect from you directly (e.g. when you contact us) and information we collect about you from other sources, described below.
Note that we may be required by law to collect certain personal information about you, or as a consequence of any contractual relationship we have with you. Failure to provide this information may prevent or delay the fulfilment of our obligations. We will inform you at the time your information is collected whether certain data is compulsory and the consequences of the failure to provide such data.

1. When you visit our websites the web server collects some basic information such as your browser type, MAC or IP address, internet service provider’s domain name, which pages you accessed on the site, and when. Details of cookies that we use on our websites can be found in our Cookies Notice.
   
   

2. Where you sign up for a newsletter, fill out a feedback form, complete a “contact us” form or enter a competition or promotion we collect personal information such as your email address, name, contact number, postcode and date of birth and for student events, we ask you to indicate that.
   Not all fields are mandatory and provision of the information in the non mandatory fields is optional, but if you provide less information this may limit your use of our online services.
   Where you enter into a competition or promotion we may share your details with the retailers from time to time at the property to which the competition relates. This will be made clear to you at the time you sign up to the competition or promotion.
   
   

3. Where you register online or place an order for a gift card we, or a third party service provider on our behalf, collect your name email address, billing and delivery address, phone number and credit or debit card details. These details may be shared with others, such as those providing merchant acquiring services and card issuers, but only where this is necessary to take a payment. In some circumstances these entities will be data controllers in respect of these details.
   
   

4. When we send emails to you we review whether these have been opened and whether you have clicked on any links within these.
   
   

5. When visiting some of our centres or other buildings we collect information from your mobile device and identify its location. This occurs whether or not you have used the Wi-Fi at the centre or other building. To opt out of the collection of your MAC or IP address and location turn off your device’s Wi-Fi and Bluetooth capabilities.
   
   

6. You may be asked to complete a survey or questionnaire either directly at our centres or other buildings or via email, SMS or post and in doing so we may ask for details such as your age, gender and postcode. The information captured is for research purposes and so we can understand the type of visitors coming to our centres and other buildings.
   
   

7. We occasionally stream videos on social media, such as Facebook live, and take and display photos of members of the public using and enjoying our centres and other buildings. Where we do so, we inform members of the public of this possibility through the signs placed around the centre or building.
   
   

8. We operate CCTV at our office buildings for the purposes of safety, crime prevention and prosecution and in order to pursue claims under our policies of insurance or insurance policies relating to an asset we manage. At some of our office buildings we also operate Body Worn Cameras for the purposes of safety, crime prevention and prosecution. We may also share our CCTV and Body Worn Camera footage with the companies that rent space in our office buildings to assist them with their own security and crime prevention management.
   
   

9. Where we own a building, we capture personal data within the system which controls access to our buildings. This comprises personal data of people who work in a building and those who visit it and includes name, occupation, employer and contact details. In relation to access control and visitor data where the data relates to us, we consider ourselves to be the data controller. Where the personal data relates to our tenants’ staff, contractors or visitors, our tenants may also be data controllers depending on the circumstances.
   
   

10. Where we do not own a building but we provide property management services for the building owner and/or we provide access control system services for the building owner we capture personal data within the access control system. This comprises personal data of people who work in a building and those who visit it and includes name, occupation, employer and contact details. The data controller in these situations will be the building owner or the tenants of the building owner and we are a data processor.
    
    

11. Where we own a building or we provide property management services for a building owner we collect data on accidents in order to comply with health and safety legislation.
    
    

12. Where you are a tenant living at one of our buildings you provide us with personal data such as references and financial information, identity documentation, your contact details and the contact details of your next of kin, bank account details and information relevant to health and safety matters at the building (such as any difficulty you may have in using the stairs in the event of a fire). This is so that we can assess your suitability to be a tenant, allow you to pay the sums due under your lease and manage our buildings.
    
    

13. Where you are a commercial tenant of at one of our centres or other buildings you provide us with personal data such as financial and business information, contact details and bank account details. This is so that we can assess your suitability to be a tenant, allow you to pay the sums due under your lease and manage our buildings.
    
    

14. Where you work for a tenant of one of our centres or other buildings, we may be provided with your contact details by your employer if we need to liaise about estate management matters.
    
    

15. Where we provide property management services for a third-party landlord (who is not us) we can be provided with personal data on tenants and their employees where this is necessary for us to carry out these services. We are not the data controller in these circumstances and are a data processor for the third party landlord.
    
    

16. When using our BL App, you provide us personal data when registering an account. You may also provide us with a photograph as part of your account details. For example, the App will allow you to upload a profile image from a device. When an image is uploaded, the App will process personal information about the images that have been uploaded to the App. You are also able to provide your consent to marketing and notifications. You can also request to delete your account if you no longer wish to have an account with us. This can be completed by selecting ‘Delete Account’ in app. This will deactivate your account before triggering an account deletion request with a member of the App services team. Your account and any personal data associated with it, will be deleted as soon as possible in line with the volume of other requests.
    
    

17. When signing up to an event via the BL App, you provide us with contact details, including your mobile number, that enable the delivery of your tickets or other method of entry to the event.
    
    

18. When purchasing products from our designated vendors available through the BL App, you will provide your contact and delivery details to us. Payment for the products and/or services are processed directly with the payment provider. If you have requested your account to be deleted, your personal details associated with your account will be deleted, however, any data that has been processed as part of a transaction made in App, will be retained in line with the appropriate transaction retention periods.

19. When using the BL App for building access, the email provided to register for the App will be further processed in order to facilitate access control.
    
    

20. When raising a Vicinitee helpdesk request, you will provide us with personal data such as your name, and email address, which will allow the helpdesk request to be processed. The personal data and the helpdesk request will be shared with the BL App to allow regular updates regarding the helpdesk request.
    
    

21. When registering for the community forum, either directly or via the BL App your name and email address are collected to create your account. You can optionally provide a photograph, your particular interests topics within the forum, your date of birth, ethnicity information, your job title, employer and department.
    
    

22. When providing you operational notifications in relation to the campus and its buildings via the particular version of the BL App you are using.
    
    

23. Where enabled and in line with your marketing preferences, your device ID will be collected to provide push notifications for marketing / promotional materials.
    
    

24. When utilising our Free WiFi service available at some of our retail and campus sites, you will be asked to connect and accept Terms of Service as provided by the service operator. We also collect a session identifier that ensures your WiFi connection works throughout the asset. This is deleted every 24 hours.
    
    

25. When purchasing a residential asset from British Land, such as an apartment at our Canada Water development, we will collect personal data to effect the sale and to conduct our Know Your Customer (KYC) checks and any other legally required checks. Such checks may require us to collect personal ID documents such as passport, driving license and other documents proving address. The data collected will therefore include your full name, current address, email address, telephone numbers, data of birth and country of birth and residential address. We will also need to collect personal data to understand the source of funds used for a transaction.
    
    

26. When taking a lease of commercial premises from us or transacting with us to buy or sell commercial property we will conduct our KYC checks for anti-money laundering purposes. Such checks may require us to collect Personal ID documents such as passport, driving license or other photographic ID documents to ascertain the identity and address of beneficial owners and/or officers of a company. We may also need to collect personal data to understand the source of funds used for a transaction.

1. If you use one of the Wi-Fi networks in our centres or other buildings, the Wi-Fi provider will collect personal information about you, such as your name, email address and postcode, which is required in order for you to log onto the Wi-Fi network. This is then shared with us. In some cases, the Wi-Fi provider makes the provision of your email address and your consent to receive marketing communications a mandatory field and you cannot access the Wi-Fi without providing this. We will however give you the opportunity to unsubscribe from all marketing communications from us in each email that we send to you.
   
   

2. If you access one of the Wi-Fi networks in our centres or other buildings using your social media, such as Twitter or Facebook, or other online accounts, we are also provided with the data that is shared by your social media/online provider. Information on what personal data is being shared should be available to you from your own social media/online provider.
   
   

3. Through your use of the Wi-Fi networks in our centres or other buildings data is also collected and shared with us which shows how often, how long and from which centre/building you are accessing the Wi-Fi and your movements within a centre/building and your browsing history.
   
   

4. Third party car park operators which are not part of British Land operate CCTV and ANPR (Automatic Number Plate Recognition) cameras at some of the car parks at our properties. There are signs at the locations where this is used showing that it is in operation at that car park. Our car park operators can obtain the name and address of an individual from the Driver and Vehicle Licensing Agency (DVLA) for parking enforcement purposes. In most cases our car park operators are controllers of your number plate data when they use it to manage the terms and conditions of use of car parks at our sites including using it to apply parking charges for cars which outstay their allotted time. When car park operators are controllers for these purposes we are not responsible for the way in which our car park operators use your ANPR data. Please see their privacy notices for further information on how they handle your personal information.
   
   

5. Number plate data is shared with us which shows frequency and duration of visits to a centre or other building in order to understand more about our customers and where they are coming from. This in turn helps us to better tailor our centres and other buildings to appeal to our customers and to manage our estate. We never use this information to identify the name or address of an individual.
   
   

6. Our footfall operators use detectors to count the volumes of customers using our centres and other buildings by entrance and time of day.
   
   

7. We use social media such as Facebook, either ourselves or through third party advertising agencies, to carry out digital advertising on the profiles of users who we think may be interested in our advertising campaigns based on events of ours that they have attended, what marketing communications they have subscribed to and which parts of our website they have visited or users who are in a similar demographic to such persons. Information on how advertising is shown to you should be available from your own social media provider.
   
   

8. Where our mobile pass is enabled through the use of the BL App, your mobile device operating system provider requires Location Services data to be enabled. Your location data is not collected or processed by British Land and is required only by your device operating provider.
   
   

9. When accessing other geo-location based services, such as weather, transport information or parking services, your mobile device operating system provider requires Location Services data to be enabled. Your location data is not collected or processed by British Land and is required only by your device operating provider.
   
   

10. When carrying out KYC checks we use software to search for adverse media.

We use your personal information to:

1. provide and personalise our services;
   
   

2. deal with your enquiries and requests;
   
   

3. comply with legal obligations to which we are subject and cooperate with regulators and law enforcement bodies;
   
   

4. contact you with marketing and offers relating to products and services offered by us and/or other members of our group (unless you have opted out of marketing, or we are otherwise prevented by law from doing so);
   
   

5. personalise the marketing messages and offers we send you to make them more relevant and interesting;
   
   

6. to contact you for research purposes, where you have consented to us doing so, in order to understand what you think of our sites and how we can improve them;
   
   

7. maintain the quality of our websites and to analyse the use of our websites in order to help guide improvements;
   
   

8. to better design and optimise our properties to improve the experience of our consumers;
   
   

9. allow you to pay for parking services;
   
   

10. provide you with access passes to our buildings where this technology is enabled;
    
    

11. drive our insights, research and data analytics programme. This is used for research, analysis, testing, monitoring, risk management and administrative purposes and to develop our business, inform business decision making and support the purposes identified elsewhere in this section by collecting statistics, traffic patterns, information on the movement around our centres and other buildings, demographics, customer satisfaction, geographic catchment, shopper analysis, retail mix, centre and building performance including footfall and identifying shopping trends; and
    
    

12. we contract with third parties which in certain circumstances will be controllers of your personal data and responsible for managing it properly and in others will be processors who deal with your personal data in accordance with our instructions. Whether a third party supplier (who is not us) is a processor or controller of your personal data depends on the facts and where we appoint a third party processor of your personal data we will put a framework around what we expect them to do with it and how they manage it. We have identified in paragraphs 1.1(c) (payments), 1.1(i) and (j) (access control) and 1.2(d) (number plate data) certain cases where third parties are controllers of your personal data.
    
    

13. We use your name and email address to register your account on the community forum
    
    

14. We aggregate your access data to analyse the usage of the community forum.
    
    

15. If you have consented to provide your ethnicity data, we aggregate this to analyse diversity of our offering in line with our diversity programme. You can withdraw the use of your data at any time by updating your profile within the forum.
    
    

16. For investigating and protecting the integrity and security of the WiFi Service. Where required by applicable law, we may disclose any information as necessary to: (a) satisfy any law, regulation, court order, legal process or lawful governmental or police request; (b) if Company believes that doing so may protect your safety or the safety of others; (c) to operate the Service properly; (d) to enforce the Terms of Service; and/or (e) to protect Company legal rights.
    
    

17. To send operational push notifications to your device when using the BL App detailing instructions on how to unsubscribe from marketing or promotional material, services updates to the App or other service based communications as necessary.
    
    

18. To send marketing / promotional push notifications to your device when using the BL App where you have provided your consent to receive such notifications.
    
    

19. To fulfil our legal obligations to carry out anti-money laundering checks.

We must have a legal basis to process your personal information. In most cases the legal basis will be one of the following:

1. Contract - to fulfil our contractual obligations to you, for example to fulfil the terms of a competition or promotion that you have entered or to provide you with information you have requested;
   
   

2. Legal obligation - to comply with our legal obligations to you, for example health and safety obligations while you are on our premises, or to a third party (e.g. the police), or to carry out anti-money laundering checks
   
   

3. Legitimate Interest - For example to understand how you use our services and our centres and other buildings and to enable us to derive knowledge from that which in turn enables us to develop new services and further tailor our centres and other buildings to appeal to a wide variety of persons. When we process personal information to meet our legitimate interests, we put in place robust safeguards to ensure that your privacy is protected and to ensure that our legitimate interests are not overridden by your interests or fundamental rights and freedoms; and
   
   

4. Consent - We may obtain your consent to collect and use certain types of personal information when we are required to do so by law (for example, in relation to our direct marketing activities, cookies or when we process special category data). If we ask for your consent to process your personal information, you may withdraw your consent at any time by contacting us using the details at the end of this privacy notice.

You have certain rights regarding your personal information, subject to local law. Your rights under UK GDPR are

• access your personal information

• rectify the information we hold about you

• erase your personal information

• restrict our use of your personal information

• object to our use of your personal information

• receive your personal information in a usable electronic format and transmit it to a third party (right to data portability)

• lodge a complaint with your local data protection authority.

In order to exercise those rights, you need to submit a Data Subject Rights request (DSR) To make this straight forward for you and to help us respond to that request quickly and accurately, please use the following link below:

Submit my Data Subject Rights Request

(Please note that the form will open up in a new window).

Third parties are able to request personal data for law enforcement purposes, insurance claims or other purposes as defined under the regulation. If you are a third party requesting personal data, please use the following form to submit your request:

Third Party Personal Data Request

(Please note that the form will open up in a new window).

We make automated decisions about you based on your personal information in the following circumstances:

• to select personalized offers, discounts or recommendations to send you based on your browsing history; and

• to personalise the marketing messages we send you to make them more relevant and interesting.

These types of decisions will not have legal or similar effects for you, but you can still contact us for further information.

We may share your personal information with third parties under the following circumstances:

• Service providers and business partners. We may share your personal information with our service providers and business partners that perform marketing services and other business operations for us. For example, we may partner with other companies to process secure payments, verify personal ID and run sanctions screening, fulfil orders, optimize our services, send newsletters and marketing emails, support email and messaging services and analyse information.
  
  

• British Land group companies. We work closely with other businesses and companies that fall under the British Land group family. We may share certain information about you with other British Land group companies for marketing purposes, internal reporting and in order to carry out the purposes listed in this notice. A list of companies within the British Land group is published annually in our most recent Annual Report and Accounts. These are available on our website: www.britishland.com.
  
  

• Law enforcement agency, court, regulator, government authority, insurer or other third party. We may share your personal information with these parties where we believe this is necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights or the rights of any third party or to put in place insurance for our centres and other buildings.
  
  

• Asset purchasers and joint venture partners. We may share your personal information with any third party that purchases one or more of our properties or the companies with which we might jointly own a property.
  
  

• We may share non-personally identifiable information with third parties such as partners, customers, tenants and suppliers, for example to show trends on the use of our centres and other buildings.

Because we operate as part of a large business, the recipients referred to above may be located outside the jurisdiction in which you are located (or in which we provide the services). See the section on "International Data Transfer" below for more information.

We implement technical and organisational measures to ensure a level of security appropriate to the risk to the personal information we process. These measures are aimed at ensuring the on-going integrity and confidentiality of personal information. We evaluate these measures on a regular basis to ensure the security of the processing.

We will keep your personal information for as long as we have a relationship with you. Once our relationship with you has come to an end, we will retain your personal information for a period of time that enables us to

• Maintain business records for analysis and/or audit purposes or risk management purposes;
  
  

• Comply with our business record retention requirements;
  
  

• Defend or bring any existing or potential legal claims; and
  
  

• Deal with any complaints regarding the services.

We will delete your personal information when it is no longer required for these purposes. If there is any information that we are unable, for technical reasons, to delete entirely from our systems, we will put in place appropriate measures to prevent any further processing or use of the data.

Your personal information may be transferred to, stored, and processed in a country that is not regarded as ensuring an adequate level of protection for personal data under European Union law / by the European Commission. Where this is the case we have put in place appropriate safeguards (such as contractual commitments) in accordance with applicable legal requirements to ensure that your data is adequately protected. For more information on the appropriate safeguards in place, please contact us at the details below.

The British Land Company PLC is the controller responsible for the personal information we collect and process (save in circumstances where we specify otherwise).

If you have questions or concerns regarding the way in which your personal information has been used, or would like to contact our Data Protection Officer, please contact [email protected].

We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy. If, however, you believe that we have not been able to assist with your complaint or concern, you have the right to make a complaint to the data protection authority of the United Kingdom using their website https://ico.org.uk/.

You may request a copy of this privacy notice from us using the contact details set out above. We may modify or update this privacy notice from time to time.

Version 13.0 – 16 November 2023