HAMMERSON – COMMERCIAL OCCUPIER & LICENSEE PRIVACY NOTICE
Introduction.
Hammerson (as defined below) is committed to protecting your personal data. This privacy notice (the “Notice”) details how we use personal information about our commercial occupiers and licensees, including prospective and former commercial occupiers or licensees, and where applicable, guarantors or referees and keep it secure when administering and managing occupation, tenancies or licences at our UK owned and operated Destinations being: Brent Cross (London), Bullring & Grand Central (Birmingham), Cabot Circus and Broadmead (Bristol), Eastgate (Leeds), The Oracle (Reading), Martineau Galleries, Westquay (Southampton), Bishopsgate Goodsyard and Shoreditch High Street.
About us and how to contact us.
This Notice explains how Hammerson UK Properties Limited (“Hammerson”), a company incorporated and registered in England and Wales (company number 00298351) which has its registered office at Marble Arch House, 66 Seymour Street, London, W1H 5BX, collects, uses, and manages your personal data in compliance with applicable data protection law.
If you have any questions relating to this Notice or would like to exercise your legal rights set out in this Notice, please contact our data protection officer by email to [email protected].
How we collect and use your personal data.
We either collect information from you directly for example, when you enquire, make or manage a booking or when you enter into a tenancy agreement with us. Where we do not receive information from you directly, we may either generate it ourselves, or collect it from other sources, such as Companies House, the Electoral Roll, third party background or credit check providers.
We may collect and use all or any of the following personal information when administering and/or managing our relationship:
Commercial Occupiers: we collect personal identifiers, such as name, address, title, contact details including e-mail address, telephone number, any communications or correspondence with you and/or your representatives, bank account or other payment details, and do so to administer and manage our relationship with you. This includes dealing with applications for tenancies, assignments or underlettings, checking the suitability of occupiers, assignees or undertenants, along with any guarantors, arranging lettings, property management (including dealing with fit out and repairs), rent collection, dealing with any complaints, maintaining our accounts and records, tenancy terminations and administering tenancy deposits. We may also use this information where it is in our legitimate interests to do so, such as to communicate with you or to promote selected locations and offers that we believe may be of interest to you, to support marketing research activities and to improve our offerings.
Hammerson Space: when you fill in an online booking form, or make a booking for a space at our Destinations or by communicating with us via our online booking system, currently known as Hammerson Space, we may collect personal identifiers such as name, address, title, contact details including e-mail address and telephone number, business name, any communications you may have with us (including reporting problems with our site), your bank account or other payment details provided to us, your username (account ID) and password and your preferences as to the method in which you wish to correspond with us to administer and manage your booking/licence with us. We may also use this information where it is in our legitimate interests to do so, such as to send you surveys or supporting marketing research activities to you in other ways for our legitimate interest, for the purpose of improving our services and understand our customers better (unless you have objected to receive such communications) and processing your responses, to promote selected locations and offers that we believe you may be interested in.
Newsletters and marketing information: when you consent to subscribe to marketing newsletters and marketing information from us we will collect your name, surname, and email address, as well as any preferences you have set in relation to receiving marketing information for our observance. If you do not wish to receive such marketing e-mails, please let us know by e-mailing us at [email protected].
Credit and Financial Information: we may collect certain financial data when conducting UK credit checks and/or international financial integrity checks, such as an assessment of your financial standing, a copy of any county court judgements, bankruptcies, individual voluntary arrangements, decrees and sequestration orders. It is within our legitimate interests to carry out such checks from time to time to form part of a broader assessment of your suitability at our Destinations, and in certain instances, we carry out these checks when required to comply with our legal and regulatory requirements.
Anti-money laundering (AML) checks: when administering AML checks, we may collect from our commercial occupiers personal identifiers, such as name, date of birth, contact details and directorships held, special category data, such as residency status and political affiliations, financial data, such as bank account details, tax information and credit history, criminal offence data such as criminal convictions disclosed and fraud indicators and any other personal information that you choose to disclose to us. We administer AML checks in accordance with the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (the ‘Regulations’) which require us to carry out AML checks on commercial occupiers which meet the criteria set out in the Regulations and is necessary for compliance with our legal obligations under the Regulations. We may also share your personal information with the regulator where we are under a legal obligation to do so.
In addition, we may also administer AML checks and use your personal information for auditing purposes, to monitor and report our compliance with AML and other legal obligations. It is within our legitimate interests to carry out such checks from time to time to ensure that we are meeting our legal obligations.
Sanctions checks: we administer sanctions screenings to ensure we do not conduct business with individuals or entities included in any sanctions lists. We therefore may collect primary name, other names, date of birth, place of birth, nationality and any other personal information documented within a sanctions list relating to you, a direct third party of yours, as well as your associates, beneficial owners and your extended supply chain when administering sanctions screening in compliance with our legal obligations. We may also use your personal information for auditing purposes, to monitor and report our compliance with sanctions screening requirements. It is within our legitimate interests to carry out such checks from time to time to ensure that we are meeting our legal obligations.
Compliance with legal obligations imposed on us: we may also process the above-mentioned information or categories of information to allow us to comply with any requests you are lawfully entitled to make, including under data protection laws and to allow us to keep records that we are legally required to retain, including evidence of consents provided, or to evidence our compliance with any legal obligations we are subject to.
Other information we obtain
Hammerson Space: When using our online services, we automatically collect certain data from you, such as the dates and times of when you have logged into our online booking system, when you have made/managed bookings, details of any premises requirements you have and do so to deliver this service to you and for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
Furthermore, the Hammerson Space online booking system uses essential cookies to ensure that the website operates correctly, and which, if not used, would result in our booking system not operating correctly. In addition, by logging in to the Hammerson Space online booking system, you will be asked to consent to the installation of additional cookies on your device so that we can gather information to allow us to improve the operation of the booking system and the services we provide using the website. For more information, please see our Cookie Policy: https://space.hammersonengage.com/cookie-policy. If you wish to withdraw your consent to allow us to use these additional cookies you can do so by disabling the function or blocking the cookies on your device or browser. However, if you select this setting you may be unable to access certain parts of our site, or it may impact on the usability of the Hammerson Space online booking system.
How long will we hold your information
We retain the personal information we collect for as long as necessary for the purposes described in this Notice.
To determine the appropriate period for holding your personal data, we consider the applicable legal requirements, the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes we process your personal data for, and whether we can achieve those purposes through other means.
Sharing your personal data
We share your personal data with carefully selected third party partners, which include suppliers, contractors, and professional advisors, who help us to administer and manage our tenancy or licence with you and the digital platforms from which we operate them.
We also share your personal data with our group companies and affiliates who may process data on our behalf to enable us to conduct our usual business practices.
We may share your personal data, where necessary, with prospective purchaser(s) or purchaser of any part of our business, on the basis of our legitimate interests and the interests of our purchaser, so that they can appropriately value the business and assess any risks and continue doing business with you after the acquisition.
We may also disclose your personal data, where disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or comply with the law, including valid legal requests from the Police, or other government agencies or departments such as HMRC.
Where your personal data is held
We may store or process your personal data outside the United Kingdom (UK) or European Economic Area (EEA). Whenever we transfer your personal data out of the UK or EEA to countries which have laws that do not provide the same level of data protection as UK and EU law, we always ensure that a similar degree of protection is afforded to it by ensuring that appropriate safeguards are implemented, such as the use of standard contractual terms approved for use in the UK and EU respectively, which give the transferred personal data the same protection as it has in the UK and EU.
Your data protection rights
Under data protection law, you have the following rights in relation to the personal data we are processing about you. The rights available to you depend on our reason for processing your information.
Right to be informed: You have the right to be provided with concise, transparent and easily understandable information about how we collect and process your personal data. This Notice sets out this information.
Right of access: You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process.
Right to rectification: You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.
Right to erasure: You have the right to ask us to erase your personal information in certain circumstances, for example where you request erasure and there is no other legal justification for the use of your information.
Right to restriction of processing: You have the right to ask us to restrict the processing of your information in certain circumstances, for example where you have requested an update to your personal data.
Right to data portability: This only applies to personal data you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated.
Right to object and/or to withdraw consent: You have the right to ask us to stop processing your personal data, and we will do so, unless we can demonstrate compelling legitimate grounds for the processing; or the need to use your personal data in connection with any legal claims. If you have provided your consent to process your personal data and that is our legal basis for processing, you have the right to withdraw that consent at any time.
Right to not be subject to a decision based solely on automated processing: You have the right not to be subject to a decision when it is based on automatic processing, including profiling, if it produces a legal effect or similarly significantly affects you. This right is not applicable if profiling is necessary for the performance of a contract between you and us.
If you wish to make a request, please email [email protected]. We may require additional information to either confirm your identity before we can process your request and/or to assist us in responding to your request.
Right to complain to a data protection supervisory authority
If you have a concern about any aspect of our data protection practices, including the way we are processing your personal data, you have the right to report it to the supervisory authority in the United Kingdom (the Information Commissioner’s Office (ICO) - www.ico.org.uk) or any other competent supervisory authority in the country of residence.
Modifications of this policy
We may revise this Notice from time to time. If we make any changes to this Notice that may materially impact you or our processing of your personal data, we will notify you by email (sent to the email address specified in your correspondence with us) or by means of a notice on our website prior to the change becoming effective.
Date issued: 20 December 2024