Privacy Policy

Bullring & Grand Central (we) are committed to protecting any personal data you provide to us, including information you provide or we collect when you use our digital channels and their features. We believe it is important for you to know what personal data we collect and how we use it. This policy (together with our terms and conditions and any other documents referred to in it) explains the personal data we process, what it is used for and the legal basis upon which we process this information. It also explains legal rights you may have to control that processing. About us and how to contact us Bullring & Grand Central are part of the Hammerson Group, and both Bullring & Grand Central and other Hammerson group companies, including Hammerson Group Management Limited are data controllers in respect of your data. Our contact address is, Marble Arch House, 66 Seymour Street, London, W1H 5BX. If you have any specific issues relating to this privacy policy, would like a list of Hammerson group companies who may process your data, or any wider privacy issues relating to us, please get in touch via our Contact Us page or by sending an email to dataprotectionofficer@hammerson.com. What personal data do we process We process the personal data set out below, provided to us by either you or your device when accessing our website. There is no obligation on you to provide the information listed below; however, if you do not, we may be unable to engage with you, open an account for you, send you the materials you have requested or allow you to enter competitions or redeem offers if we do not have the necessary information to do so. The type of data that we process about you includes: Information you have given to us by filling in forms or by signing in using your Facebook, Twitter or Apple accounts, or by communicating with us, including name, address, title, contact details including email address and mobile telephone number, date of birth, details of any offer or competitions you have signed up for, any communications you may have with us (including reporting problems with our site), preferences as to any methods and types of marketing information you have consented to receive, your username (account ID) and password when opening an account. Information we collect from or observe about you when you use our services, including: (a) Device and Website Use Information – When you install one of our mobile applications or use a computer, tablet, smart phone or other device to access our websites, we may collect information about the device and how you use it. This information may include the type of device, your operating system, your browser (for example, whether you used Internet Explorer, Firefox, Safari, Chrome or another browser), your internet service provider, your domain name, your internet protocol (IP) address, your device identifier (or UDID), the date and time that you accessed our service, the website that referred you to our website, the web pages you requested, the date and time of those requests, and the subject of the ads you click or scroll over. To collect this information, we use cookies, beacons and similar technologies. (b) Images of you collected from CCTV cameras in operation at Bullring & Grand Central. How we use it Sending marketing messages or otherwise engaging with you We use your data to · send you marketing information by various channels including email, SMS, mail or telephone, or push messages if you use our app, including sending notices of new products, special offers and other marketing materials to enhance and support your relationship with Bullring & Grand Central. We will use this data in accordance with any preferences you have selected, either on the basis of consent (where requested) or of legitimate interests where you have not objected to receiving such information. We may also use your data for our own legitimate interests, which include: · sending you surveys or supporting Marketing Research activities to you in other ways to help us improve our services and understand our customers better; · allowing you to participate in interactive features of our service, when you choose to do so; · ensuring that content from our digital channels is presented in the most effective manner for you and for your computer/smart phone and/or tablet; · allowing us to investigate and respond to any issues or correspondence received; · administering your online account and any promotion or competition which you have entered; · notifying you about changes to our services. We believe that these interests are justified as it is completely optional for you to register, participate or otherwise provide us with Personal Data in the above situations. You will be able to object to this processing at any time. For more information, please see Your rights below. Geolocation and Device and Website Use We use Device and Website Use information to improve the effectiveness and operation of the Bullring & Grand Central website, to improve our existing services and develop new services and to inform and direct our marketing strategy. In addition, anonymised statistical data may also be shared with retailers or used by us to develop new promotions that may interest our customers. We will also use this information for system administration and to report aggregate information to our retailers. This is anonymised statistical data about our users' browsing actions and patterns and to help us to improve our site and to deliver a better and more personalised service. They enable us: · To estimate our audience size and usage pattern. · To store information about your preferences, and so allow us to customise our site according to your individual interests. · To speed up your searches; and · To recognise you when you return to our site. For more information, please see our Cookie Policy. CCTV images Where we consider that, on balance, it is appropriate for us do so, we will process CCTV footage for the following legitimate interests: · keeping our staff, visitors and property safe and secure; · ensuring compliance with health and safety procedures; · detecting and preventing crime; and · assisting law enforcement agencies in the apprehension, investigation and prosecution of offenders.

· gathering retail analytics in order to improve the operational and commercial management of the centre

This may include sharing footage with the police or other law enforcement agencies, or our insurers where necessary in relation to a claim, as well as any other third parties in connection with legal proceedings or emergency situations. Data processed where it is necessary for compliance with a legal obligation imposed on us We will process your personal data to allow us to comply with any requests you are lawfully entitled to make, including under data protection laws, to ensure that age inappropriate content is not provided to individuals under 18, and to allow us to keep records that we are legally required to retain, including evidence of consents provided, or to evidence our compliance with legal obligations. How long will we hold your information We will normally retain your personal data is for a period of up to 7 years from the latter of: · when you unsubscribe from receiving marketing from us (if later); unless we are legally required to retain the information for longer. However, we may delete your data sooner if we have no purpose to retain it. We will retain your details if you have unsubscribed from marketing to ensure that we respect your withdrawal of consent on an ongoing basis. Who will we share your personal information with? We will share your personal data within the Hammerson group of companies (including our subsidiaries, our ultimate holding company and its subsidiaries (if applicable)), for the purposes outlined above, including for our own internal business management and the provision of efficient centralised services within our group, where this occurs, they will comply with a privacy notice comparable to this one, unless they provide you with an alternative privacy notice. For further details of the Hammerson group of companies, please visit: https://www.hammerson.com/property/. We also use third party service providers acting on our instructions to support our provision of the website, Bullring & Grand CentralPLUS or our services to you, who are specifically contracted to process personal data on our behalf. We may share your personal data, where necessary, with prospective purchaser(s) or purchaser of any part of our business, on the basis of our legitimate interests and the interests of our purchaser, so that they can appropriately value the business and assess any risks and continue doing business with you after the acquisition. We will also share your personal data where: (a) you have provided prior explicit consent; (b) where we are required by law, including any court order; (c) where necessary to protect you, the Bullring & Grand Central, its customers or the wider public.

Where will your personal data be held

We may store or process your personal data outside the European Economic Area (EEA) or other countries approved by the European Commission as providing appropriate safeguards for personal data, when we use service providers located in those countries. If this is the case, we will put in place appropriate safeguards to protect your personal data and ensure that it is compliant with all appropriate legal requirements. If you require further information in respect of the countries where your personal data is processed and/or copies of any documents setting out the appropriate safeguards we have implemented to protect it, please contact us. Children’s Privacy

Where people under the age of 13 download our App or use our services they are required to confirm that they have their parent’s consent. Parents should supervise the online activities of their children, and consider the use of tools available from online services and software providers that help provide child-friendly Internet environments. If any of our products or services are targeted directly at children, we will provide you with additional information about how their data will be used in the context of that service. If the user’s age has been provided it is used to ensure that products inappropriate for those under 18 are not promoted to any user aged under 18. Other Sites Our digital channels may contain links to other sites on the Web. These other sites are not covered by this privacy policy and although we are committed to protecting your Personal Data, we cannot control and do not accept any responsibility or liability for the privacy practices, cookies or content of such other websites. We encourage you to read the privacy statements of each and every website that collects your Personal Data. You are solely responsible for maintaining the secrecy of your passwords and other account information, and we cannot take responsibility for any damage arising from any disclosure of your password or access to your email account by other parties. Your rights

Customer Data Deletion Process Users may request deletion of their account and data at any time by contacting us at dataprotectionofficer@hammerson.com stating Data Deletion in the subject line. Please ensure the email address you have used to register your account is included in the message. Your data and customer account will be deleted within 30 days and you will be notified by email.

If you wish to withdraw your consent to receive marketing materials, this can be done by:- • emailing us at dataprotectionofficer@hammerson.com • updating your preferences on your online account; or • by clicking on the unsubscribe link on any emails we have sent.

If you withdraw your consent, this will not affect our rights to have sent you marketing material prior to your withdrawal, but we will not send any further marketing. Whilst we will endeavour to ensure that you do not receive any further marketing material immediately, there may be a slight delay for any changes to take effect. Please note that your information will not be deleted but will be retained in a suppression list to ensure that we do not inadvertently send further marketing communications once you have withdrawn your consent to receive them. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you log on to our site. If you do not wish us to process your Device and Website Use information, you may prevent this by disabling the function or blocking the cookies on your device or browser. However, if you select this setting you may be unable to access certain parts of our site, or it may impact on the usability of our website. For further information on how to do this, please visit http://www.allaboutcookies.org/. You are also entitled to request that we:- · provide you with a copy of any personal data we hold about you, · provide you with a copy of any of your personal data, provided by you, that we hold in an electronic format, in a structured, commonly used, machine-readable format; · have any incorrect personal data corrected or completed ( you can also update your records using your profile on your online account); · delete any personal data that we no longer need for the above purposes, where you have withdrawn your consent and there are no other grounds to process that information, where the personal data has been unlawfully processed or where we are required by law to delete it; and · restrict the processing of your personal data whilst we confirm whether any data needs correcting following your request, the processing is unlawful and you do not want us to delete this personal data; where we no longer need to process the personal data, but you require the information to establish, exercise or defend legal claims. In these circumstances we will only process your personal data for purposes for which you have consented, or for the establishment, exercise or defence of legal claims or the protection of the rights of another person; and/or · object to our processing of your personal data, where we process it under the legitimate interests grounds and we are unable to show a compelling legitimate interest that overrides your interests, rights and freedoms, or for the purposes of defending, exercising or defending legal claims If you wish to make such a request, please use either our Contact Us page or email dataprotectionofficer@hammerson.com We may require additional information to either confirm your identity before we can process your request and/or to assist us in responding to your request. If you are unhappy with the outcome of your request or with our processing of your personal data, you are entitled to lodge a complaint with the Information Commissioner’s Office (ICO), whose website is www.ico.org.uk. Modifications of this policy We may revise this Privacy Policy from time to time. If we make any changes to this privacy policy that may materially impact on you or our processing of your personal data, we will notify you by email (sent to the email address specified in your account) or by means of a notice on our website prior to the change becoming effective. Date of last change 21 August 2018. Any questions, comments and requests regarding this privacy policy are welcomed and should be addressed via our Contact Us page or directly by email to dataprotectionofficer@hammerson.com