PRIVACY POLICY

WHO ARE WE?

We are Lion Yard Shopping Centre. ST Tibbs Way. Cambridge. CB2 3ET. We represent a number of Affiliated Businesses which you can see in our shopping centre (Affiliated Businesses).

We want to reach out to our customers and hear what they’re saying – whether it’s by giving us feedback or comments, agreeing to receive our newsletter or services or taking part in our competitions or competitions we’re running on behalf of our Affiliated Businesses- we’re thrilled you’re joining the conversation.

You can use our online services to benefit from our services (such as wifi), take part in campaigns which we might run from time to time, complete a survey, join our mailing list to receive our ezine and emails so we can tell you about what’s happening and/or to benefit from deals and discounts from Affiliated Businesses.

1. WHAT IS THIS NOTICE?

When you interact with us, you may give us Personal Data about you. Personal Data means data which can be used to identify an individual. The individual who can be identified from the Personal Data is known as the Data Subject.

In respect of any such Personal Data, we are acting as a Controller (which means we are the business responsible for making the decision to collect the Personal Data in the first place and deciding what to collect and how to use it). We use a company called Velocity Worldwide UK Ltd (Velocity) to help us to connect with our customers and run some of our marketing services. This means that they may handle Personal Data as a Processor (they are acting on our behalf and authorised to use the Personal Data in accordance with our instructions).

This notice deals with our marketing activity and sets out what Personal Data we collect from you when you interact with our marketing agency and what we do with it.

If you have any questions relating to how we use Personal Data about you, please contact us at the address above or by email at info@lionyard.co.uk.

1. WHAT INFORMATION DO WE COLLECT AND STORE?

We may collect and process the following data about you, some of which may include Personal Data:

1. INFORMATION WHICH YOU PROVIDE US WITH WHEN YOU USE INTERACT WITH US ONLINE: for example if you use our services (such as wifi), take part in campaigns which we might run from time to time, complete a survey, join our mailing list to receive our ezine and emails so we can tell you about events, and you can benefit from deals and discounts from Affiliated Businesses). This may include:

• your name, address and phone number
• where you come from
• your gender
• online contact information
• financial details (if you want to decide to take advantage of any discounted goods or services offered as part of our campaigns)
• any opinions or preferences which you express (including your likes and dislikes)
• details about your location

1. TRANSACTIONAL DATA: that is, information which we might collect if you use a voucher, loyalty card, discount code or take part in a promotion which we are running. This will help us to learn about:

• your shopping preferences, interests, hobbies and habits
• your health, well-being and lifestyle choices

1. TRAFFIC DATA: that is, information about which websites you access or offers you click on when you’re using our services.
2. LOCATION DATA: we may collect information about your location from time to time if you have provided us with certain information. For example, we may use the following technologies to recognise you when you come into our shopping centre:

• i-beacons, which enable us to communicate with your device using Bluetooth
• wi-fi, which enables us to communicate with your device

1. HOW DO WE USE THE DATA WE COLLECT ABOUT YOU AND WHAT’S OUR LEGAL BASIS?

We may use the data we collect about you in the following ways:

1. CREATING A PROFILE FOR BEHAVIOUR MARKETING: to create an account profile in order to help us remember you so you can easily use our services in the future and to make sure we send relevant information about campaigns we’re running and other events or discounts for Affiliated Businesses (including surveys and information about goods and services which we think you’ll like and which seem to tie in with your interests). To do this, we may need to undertake analysis of your purchase habits and preferences. Once an account has been set up, profiling is an automated process which enables us to learn things about you. We set up the account on the basis of your consent. You may ask us to delete your account at any time and we will promptly comply. You may set up a new account at any time.
2. SEND YOU MARKETING COMMUNICATIONS: contacting you by email, SMS, push notifications in our app, social media (and potentially by other communication channels which may become available in the future) to provide you with competitions, deals and information about products and events). We are relying on you signifying your consent to us. You are entitled to withdraw your consent to all marketing or marketing via particular channels at any time and we will promptly comply with your request. 
3. TO PROVIDE SERVICES: for example, if you have set up an account to enable you to use wifi or to take part in a campaign, benefit from a discount, take part in a competition, we may use your Personal Data in order to make that happen. For certain campaigns and competitions, this may include transferring Personal Data related to you to the Affiliated Business providing the prize or whose goods or services are being promoted. If a transfer of this nature is required, we will publish the name of Affiliated Business and let you know that the transfer is required before we do so. In this case, we are relying on the fact that such use of your Personal Data is required in order to fulfil our contractual obligations to you. You may let us know at any time if you want to pull out of a competition or stop receiving our services and we will promptly comply with your request. Please note however, that we are not responsible for how Affiliated Businesses may use your Personal Data once we’ve transferred the data to them. If you have any concerns, you must contact the Affiliated Business directly.
4. INTERNAL BUSINESS REQUIREMENTS: we may use your Personal Data in accordance with our internal business requirements. For example, we may need to retain back-up copies of data to make sure we have adequate safeguards in place to prevent loss of the data we hold; we may need to use your data to resolve disputes. In this instance, we are relying on the fact that such use is essential to protect a legitimate interest to enable us to run our business successfully. Any copies of the data held will be held securely and no further use shall be made of such data save as set out herein. We believe that such use would be generally anticipated by data subjects and is highly unlikely to cause any damage to or be considered by data subjects to be invasive of their privacy. 
5. STATISTICAL ANALYSIS: we may collect and use aggregate data, for internal market research, statistical analysis and data mining purposes and we may transfer this data at will to third parties. This data will be pseudonymised and you will not be identifiable from it.
6. WILL PERSONAL DATA ABOUT YOU BE DISCLOSED TO ANYONE ELSE?
7. We will not pass Personal Data about you to third parties for marketing purposes unless you have expressly consented to it.
8. We may disclose your Personal Data to third parties for the following purposes:

• to Affiliated Businesses which are taking part in a campaign, discount or event we are running and to which you’ve signed up. We will always make it clear to you before we transfer your Personal Data to such businesses.
• to our licensors, employees and third parties who are contracted to provide services to us to help our business. Any employees and/or data processors (including Velocity) contracted by us will be subject to strict contractual requirements only to use your personal data in accordance with our instructions.
• if we are under a duty to disclose or share your Personal Data in order to comply with any legal obligation, or in order to enforce or apply our terms of use and other agreements or to protect the operation of our website, or the rights, property, or safety of us, our customers, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

1. We may disclose aggregate data to third parties for analysis and market research purposes. Any data so disclosed will not contain Personal Data.
2. WHAT SECURITY PROCEDURES DO WE HAVE IN PLACE?

It is our policy to ensure that all Personal Data held by us is handled correctly and appropriately according to the nature of the information, the risk associated with mishandling the data, including the damage that could be caused to an individual as a result of loss, corruption and/or accidental disclosure of any such data, and in accordance with any applicable legal requirements.

[We undertake regular security and risk reviews and we monitor all of the controls that we have in place to ensure the security, accuracy and integrity of the Personal Data we hold. We also endeavour to ensure that such data is only accessed by authorised personnel for a legitimate purpose (in accordance with our privacy notice).

We have a set of formal procedures that must be adhered to within our organisation to ensure that security standards are maintained, and that data privacy is respected.]

1. WHERE DO WE STORE THE PERSONAL DATA WE COLLECT?

We only use servers in the EU (and Britain). Our current host servers are provided by Amazon Web Services, whose servers are based in Dublin.

1. FOR HOW LONG DO WE STORE PERSONAL DATA ABOUT YOU?

• We will retain Personal Data about you for as long as you have an account with us and for a period of 1 year thereafter.
• We may retain information relating to your transactions for a period of 6 years after the transaction. This means that we can rely on the data if there is ever a dispute between you and us about a transaction. It also is important for us for tax purposes.
• We only retain location data for a period of 1 year.

9. WHAT RIGHTS DO YOU HAVE IN RESPECT OF ANY PERSONAL DATA WE HOLD ABOUT YOU?

Data Subjects have the following rights in respect of the Personal Data we hold about them.

• ACCESS: the right to request a copy of such Personal Data, as well as confirmation of:
• the purposes of the processing
• the categories of personal data concerned
• the recipients to whom the personal data has/will be disclosed
• for how long we intend to store the Personal Data
• if we did not collect the data directly from the Data Subject, information about the source
• RECTIFICATION: the right to require us to correct such Personal Data which is inaccurate or incomplete.
• TO BE FORGOTTEN: the right to request that such Personal Data is erased from our records. We will promptly respond to any such request and comply with the same provided that we don’t have a separately legitimate right to retain the data. An example of this might be if we are in a dispute with the Data Subject and need to retain the data to defend our case.
• RESTRICTION OF PROCESSING: the right to ask us to restrict the processing we carry out in respect of the Personal Data. You might want to do this, for instance, if you think the data we hold is inaccurate and you would like us to restrict our processing until we have investigated this concern and updated if necessary.
• PORTABILITY: the right to have the Personal Data transferred to another organisation. This right only applies where the Personal Data has been obtained from the Data Subject directly and will only apply to the extent that the Personal Data is processed by automated means. Owing to our process of gathering and processing Personal Data, we don’t anticipate that this will apply to much (if any) of the Personal Data we hold.
• DIRECT MARKETING: the right to object for any reason where processing is carried out for direct marketing purposes (including profiling in connection with that purpose);
• LEGITIMATE INTERESTS: the right to object (on the grounds of the Data Subject’s particular situation) to processing being carried out on the basis of legitimate interest, unless we can demonstrate compelling legitimate grounds which override the interests, rights and freedoms of the Data Subject or if the processing is carried out for the establishment, exercise or defence of a legal claim.
• AUTOMATED DECISION-MAKING: the right not to be subject to a decision based solely on automated processing (including profiling) which produces legal effects (or other similar significant effects) on the Data Subject.

We may need to ask you for further information and identification to help us to comply with this request.

1. WHO DO YOU COMPLAIN TO IF YOU’RE NOT HAPPY WITH HOW WE PROCESS YOUR PERSONAL DATA?

If you have any questions or concerns about how we are using Personal Data about you, please contact our Data Protection Officer immediately at our registered address (see clause 1.1 above) or by email to info@lionyard.co.uk

If you wish to make a complaint about how we have handled Personal Data about you, you may lodge a complaint with the Information Commissioner’s Office by following this link: https://ico.org.uk/concerns/.

Last updated: 03-05-2019