Village Privacy Notice
- Introduction
- Who we are and how to contact us
- How we collect your personal data
- The types of personal data and information we collect
- Why we collect your personal data and how we use it
- Sharing your personal data
- Children
- How long we keep your personal data for
- Confidentiality and security of your personal data
- How to access your information and your other rights
- Changes to this Notice
Introduction
BICESTER VILLAGE is committed to protecting your personal data. It’s your information, and we respect that. This Privacy Notice (the “Notice”) provides detailed information on when and why we collect your personal data, how we use it and how we keep it secure. This Notice also describes your right to request that we delete, update, transfer or provide you with access to your personal data.
This Privacy Notice relates to your visit to BICESTER VILLAGE, including services you use and other data we collect during your stay. Other Privacy Notices may also apply to our use of your personal data – for example when you engage with Privilege, use our Websites or the Bicester Village App.
Who we are and how to contact us
This Notice explains how Bicester Village, 50 Pingle Drive, Bicester, Oxon, OX26 6WD (and its affiliated companies) collect, use and manage your personal data. In most instances, we are the controller of your personal data described in this Notice – we have explained in this Notice where this differs.
If you have any questions about this Notice or want to exercise your rights set out in this Notice, please contact us by email at Enquiry@BicesterVillage.com
Please see Who Are We for the entities listed are the owners and operators of retail outlet Bicester Villages (Bicester Villages) within the Bicester Village Shopping Collection brand. References in this Notice to “we”, “us” or “our” are to the entities listed. Each of the listed entities are joint data controllers and are committed to protecting your privacy.
As joint data controllers, we have arrangements between us to ensure that we handle your personal data properly and in accordance with data protection law. These arrangements reflect our respective roles and responsibilities in relation to you and your personal data, and consider which entity is in the best position to fulfil our services and obligations. This arrangement between us does not affect your rights under data protection law. For more information on these arrangements, feel free to contact us using the address above.
How we collect your personal data
Generally, as a guest in Bicester Village, we collect your information when you decide to use the services and facilities we offer. This could include using our Bicester Village wi-fi, equipment loan, our personal shopper or other services, participation in photo or film shoots, the purchase of gift cards, recording of airmiles or other loyalty scheme points, entering prize draws and competitions or engaging with our Community Teams.
We will also collect your personal data through our surveillance technologies which are in place to provide a safer environment for our guests.
We collect information in a number of ways which are listed below:
o When you connect to and use our wi-fi services. This data includes your device MAC address (a unique device identifier), the type of device you are using and when you re-connect to the service. If you provide your email address we will use it to contact you about our Privilege program.
o When you participate in photo or film shoots. We will always obtain your explicit consent when you choose to be part of our campaigns. Signage is always provided in locations where photoshoots are occurring to assist you in avoiding these locations should you wish to.
o When you use equipment belonging to us including umbrellas, wheelchairs, mobility scooters, pushchairs or dog-strollers or when you use our valet parking, childcare, dog kennel, phone charging and left luggage facilities. This may include taking payment information or proof of identity.
o When you ask us to record your purchases against loyalty schemes (such as airlines or membership clubs) to facilitate point allocation or when we assist you with queries about those schemes.
o When you use our personal shopper services we will ask you to provide details of your name, contact details, date of birth, brand and style preferences, clothes and shoe sizes and other information to assist us in facilitating and personalising your experience.
o When you purchase gift cards we may need to collect identification information to comply with anti-money laundering requirements, including proof of identity. If you purchase a gift card for another person and ask us to deliver it to them, we will collect the recipient’s name, postal address and email address.
o When you ask us to arrange home delivery of items you have purchased in the Bicester Village we will collect the delivery address details. Note that we use a third party to provide this service.
o When you post information to publicly available social media sites, we may ask for your permission to share your posts with our social community.
o When you enter any event, prize draws or competitions run by Bicester Village. Note that prize draws and competitions will be subject to separate terms and conditions which will be made available to you.
o When we administer services such as lost property. If you are collecting lost property we may ask you to prove your identity or for proof of ownership.
o When you engage with our Community Teams.
The types of personal data and information we collect
We only collect the information that is necessary to carry out our business and to provide the particular service or facility you’ve requested.
Information we obtain from you
Here are some examples of information we collect about you when you interact with us – which data is collected depends on the services or facilities you use:
o Title
o Name and Surname
o Email address
o Date of Birth
o Contact phone number(s)
o Your home country
o The method of transport you use to visit our Village
o Purchase information
o Interactions with us
o Payment details
o Delivery address(s)
o Proof of identity
o Billing address
o Attendance at events
o Appointment booking and information given during appointment
o Alternations and repair requests
o Information about accidents and incidents
o Details of children when using our childcare facilities
We may be unable to provide services and facilities to you if you do not provide the personal information we require to deliver them.
If you’d like more information about which specific personal data is collected for each service or facility you use, please contact us using the details in Who Are We or how to contact us above.
Other Information we obtain:
Surveillance Technology
We use surveillance technologies such as CCTV (Closed Circuit Television), ANPR (Automatic Number Plate Recognition), Head Count Technology and Body Worn Video.
These technologies may automatically capture your image data and vehicle registration data when you enter or as you are walking around our Bicester Villages. We collect information about the number of visitors in our Bicester Villages which helps us to understand visitor journeys and implement enhanced guest safety measures.
Social Media
Your information may be shared with us by independent organisations when there is a lawful basis to do so. You should check their Privacy Policy when you provide your information to them, to understand fully how they will process and safeguard your data. These independent organisations may include services like Instagram, Facebook, WhatsApp or Twitter. Depending on the sharing preferences you have set in those platforms, you may give us permission to access your personal data from those accounts or services.
WI-Fi Services
When you connect to and use our wi-fi services. This data includes your device MAC address (a unique device identifier), the type of device you are using and when you re-connect to the service. If you provide your email address we will use it to contact you about our Privilege program.
Why we collect your personal data and how we use it
At Bicester Village we like to get to know our guests – after all, this is how we find new ways to provide you with an extraordinary experience. We use information about you in a number of ways, including providing services and facilities that you have requested and offering you a personalised experience.
Our use of your personal data must comply with applicable data protection law and establish at least one specific lawful reason for the processing. Examples of these lawful reasons include our use of your personal data being necessary for the purchase of services or use of facilities, or for compliance with a legal obligation.
Whenever we process your personal data we will have a lawful reason to use it in such a way to ensure that we provide the very best services and facilities to all of our guests. These include:
To carry out our business and to provide a service or carry out a contract with you: Fulfilment of services and facilities you have chosen to use.
Where we have your consent:
When you ask us to inform your loyalty scheme membership (e.g. airmiles) of your spend in our Bicester Village we provide them with details of your transactions and membership number. Note that we act on behalf of your loyalty scheme provider as a data processor to provide this service.
When you purchase gift cards we may share your personal data with our gift card platform provider. We do not collect or share information about the purchases you make using our gift cards.
If we rely on your consent as our lawful basis for processing your data, you are able to withdraw your consent to our processing of your personal data at any time. Please see How to access your information and your other rights for further information.
Where we have justifiable reason (legitimate interest):
o Events. We share your personal data with any applicable third party hosting the event.
o Respond to guest enquiries raised in the Bicester Village, online, by phone or via social media.
o Invite you to provide feedback about our facilities and services in the form of online or in-Bicester Village surveys. We use this information to help us provide and design exceptional services and experiences.
o Analyse aggregated guest information with other interactions guests may have with Bicester Village and other Bicester Villages within the Bicester Bicester Village Shopping Collection in order to continually improve the services and experiences we offer.
o Use of our Bicester Village Wi-Fi; automatic re-connection when you return to the Bicester Village.
o The use of CCTV recording equipment in and around our premises for monitoring and security purposes. We may share where necessary CCTV footage with the Police. This is very strictly controlled.
o To detect and reduce fraud and theft.
Value Retail will process personal data for the purposes of its legitimate business interests as described above. We have conducted an assessment to ensure that the rights and freedoms of data subjects do not outweigh our legitimate interests. For further information about that assessment, including to exercise your right to challenge our decision, please contact us using the details within Who Are We and how to contact us.
In exceptional cases, personal data and other information may also be processed for the purposes of crime detection and personal safety.
Sharing your personal data
We use third party partners to help us deliver some of our services and to manage our technology platforms. In providing those services, your personal data will, where applicable, be used by the service provider on our behalf.
We check any third party that we use to ensure that they can provide sufficient guarantees regarding the confidentiality and security of your personal data. We have written contracts with them which provide assurances regarding the protections that they give to your personal data and their compliance with our data security standards and any relevant international transfer requirements.
We may use third party providers to support the provision of services including:
o valet parking services;
o to process payments made using debit and credit cards. Bicester Village does not store any payment card numbers once your transaction has been completed;
o to provide wi-fi services;
o shopping packages, including bus trips;
o home delivery services;
o to contact you with important information relating to your booking or purchase, such as confirming your order and letting you know about important changes.
Please review Third Parties data processors and controllers, for more information about our service providers and locations where your personal data may be transferred.
We may also use consultants and professional advisors to assist us from time to time. Please contact us if you’d like to know more about this.
Children
BICESTER VILLAGE does not knowingly collect personal data from children under the age of sixteen (16). If you are under the age of sixteen (16) we may be unable to provide you with our services.
Parents or legal guardians may provide explicit consent for children to participate in photographic or film shoots.
In circumstances where you use our childcare services we will collect the information necessary to provide a safe environment for your child and to comply with our legal obligations. Particular care is taken with regard to the security of the information we collect to facilitate childcare services.
How long we keep your personal data for
We keep your personal data in line with our retention schedules. We only retain information for as long as it is required.
We apply careful analysis to make sure we only hold your personal data for as long as it is needed for legal reasons or identified business purposes.
Where possible, we anonymise personal data so that we can continue to use it for analytical purposes.
Confidentiality and security of your personal data
We are committed to keeping your personal data secure throughout its lifecycle and we will take appropriate precautions to protect it from loss, misuse or alteration. We do not sell your personal data for any purpose.
We have implemented information security policies, rules and technical measures to protect your personal data from:
o unauthorised access;
o improper use or disclosure;
o unauthorised modification; and
o unlawful destruction or accidental loss.
All of our employees and the third party partners with whom we share your personal are obliged to respect the confidentiality of the personal data of all users of our services.
How to access your information and your other rights
You have the following rights in relation to the personal data are processing about you:
Right to be informed of the personal data we are processing about you
You have the right to be provided with clear, transparent and easily understandable information about how we collect and use your personal data. This is why we’re providing you with the information in this Notice.
Right of access to the personal data we are processing about you
If you ask us, we’ll confirm whether we’re processing your personal data and, if so, provide you with a copy of that personal data (along with certain other details). If you require additional copies, we may need to charge a reasonable fee.
Right to correct the personal data we are processing about you
If the personal data we hold about you is inaccurate or incomplete, you’re entitled to have it corrected. If we’ve shared your personal data with others, we’ll let them know about the changes where possible. If you ask us, where possible and lawful to do so, we’ll also tell you who we’ve shared your personal data with so that you can contact them directly.
Right to delete information the personal data we are processing about you
This is also known as ‘the right to be forgotten’. You can ask us to delete or remove your personal data in some circumstances such as where we no longer need it or if you withdraw your consent (where applicable). If we’ve shared your personal data with others, we’ll let them know about the deletion request where possible. If you ask us, where it is possible and lawful for us to do so, we’ll also tell you who we’ve shared your personal data with so that you can contact them directly.
Right to restrict the processing of personal data
You can ask us to ‘block’ or suppress the processing of your personal data in certain circumstances such as where you contest the accuracy of that personal data or you object to us processing it. We will still be able to store your personal data. We’ll tell you before we lift any restriction. If we’ve shared your personal data with others, we’ll let them know about the restriction where it is possible for us to do so. If you ask us, where it is possible and lawful for us to do so, we’ll also tell you who we’ve shared your personal data with so that you can contact them directly.
Right to portability of your personal data
You have the right, in certain circumstances, to obtain the personal data you’ve provided us with (in a structured, commonly used and machine readable format) and to reuse it elsewhere or to ask us to transfer it to a third party of your choice.
Right to object to the personal data we are processing
You can ask us to stop processing your personal data, and we will do so, if we are:
o Relying on our own legitimate interests to process your personal data, except if we can demonstrate compelling legal grounds for the processing; or
o Processing your personal data for direct marketing.
Rights in relation to automated decision making and profiling using your personal data
You have the right not to be subject to a decision when it’s based on automatic processing, including profiling, if it produces a legal effect or similarly significantly affects you. This right is not applicable if profiling is necessary for entering into, or the performance of, a contract between you and us.
Right to withdraw your consent to processing of your personal data
If you have provided your consent to process your personal data and that is our legal basis for processing, you have the right to withdraw that consent at any time (although if you do so, it does not mean that anything we have done with your personal data with your consent up to that point is unlawful). This includes your right to withdraw consent to us using your personal data for marketing purposes.
Right to complain to a data protection supervisory authority
If you have a concern about any aspect of our data protection practices, including the way we are processing your personal data, you can report it to the your local data protection Supervisory Authority. Their contact details are contained in the table below.
|
COUNTRY |
SUPERVISORY AUTHORITY |
WEBSITE |
||
|
United Kingdom |
The Information Commissioners’ Office (ICO) |
|||
|
Ireland |
The Data Protection Commissioner (DPC) |
|||
|
France |
Commission Nationale de l’Informatique et des Libertés (CNIL) |
|
||
|
Italy |
Garante per la protezione dei dati personali (Garante) |
|||
|
Spain |
Agencia Española de Protección de Datos (AEPD) |
|||
|
Belgium |
Gegevensbeschermingsautoriteit (GBA) |
|||
|
Germany |
Data protection for private sector organisations is overseen by regional data protection authorities. Value Retail operates in two regions within Germany and therefore, falls under the jurisdiction of two supervisory authorities. |
|||
|
Bavaria |
Bayerisches Landesamt für Datenschutzaufsicht BayLDA) |
|||
|
Baden-Württemberg |
Der Landesbeauftragte für den Datenschutz Baden-Württemberg |
https://www.baden-wuerttemberg.datenschutz.de/
|
||
Changes to this Privacy Notice
We may make changes to this Privacy Notice from time to time. This Notice was updated on 29/01/2019
To ensure that you are always aware of how we use your personal data we will update this Notice from time to time to reflect any changes to our use of your personal data or when we add new services or facilities. We may also update this Notice to comply with changes in applicable law or regulatory requirements. If we make substantial changes to the way we process your personal data we will let you know if this is possible and practical.
Who Are We
DATA CONTROLLERS |
VILLAGE |
DATA PROTECTION OFFICER |
|
Value Retail Maasmechelen Tourists Outlets CVA |
Maasmechelen Village, Zetellaan 100, 3630 Maasmechelen, Belgium |
|
|
Value Retail Management Belgium NV |
Maasmechelen Village, Zetellaan 100, 3630 Maasmechelen, Belgium |
|
|
Value Retail Management (Bicester Village) Limited |
Bicester Village, 50 Pingle Dr, Bicester OX26 6WD |
|
|
VR Services SNC |
La Vallée Village, 3 Cours de la Garonne, 77700 Serris, France |
|
|
Value Retail Management France SARL |
La Vallée Village, 3 Cours de la Garonne, 77700 Serris, France |
|
|
Value Retail Management Germany GMBH |
Wertheim Village, Almosenberg, 97877 Wertheim, Germany Ingolstadt Village, Otto-Hahn-Straße 1, 85055 Ingolstadt, Germany |
Dr. Felix Wittern Fieldfisher (Germany) LLP, Am Sandtorkai 68, 20457 Hamburg, Germany. |
|
Value Retail Management (Kildare Village) Limited |
Kildare Village. Greyabbey, Nurney Road, Co. Kildare, Ireland |
|
|
Kildare Retail Services Limited |
Kildare Village, Greyabbey, Nurney Road, Co. Kildare, Ireland |
|
|
Value Retail Management Italy Srl |
Fidenza Village, Via Federico Fellini, 1, 43036 Fidenza PR, Italy |
|
|
Value Retail Management Spain, SL |
La Roca Village, s/n, 08430 Santa Agnès de Malanyanes, Barcelona, Spain Las Rozas Village, Calle Juan Ramón Jiménez, 3, 28232 Las Rozas, Madrid, Spain |
|
|
Value Retail Plc |
Group function providing administrative support 50 Pingle Dr, Bicester OX26 6WD |
|
Third Party Data Controllers and Processors
|
THIRD PARTY |
WHY DO WE SHARE YOUR PERSONAL DATA WITH THEM? |
HOW IS YOU PERSONAL DATA USED AND WHY? |
|
Air Courier |
Air Courier are the data controller and operator of Home Delivery service. |
Air Courier will collect, view and store your data to ensure accurate, secure and timely deliveries. Your data may be shared with Air Courier approved suppliers to ensure the best service. To view the Air Courier privacy policy, please visit www.AirCourier.co.uk |
|
Cash and Traffic Management Ltd (Trading as CTM) |
CTM are the data controller and operator of Valet services and body camera equipment. |
Your details are collected, viewed and stored to ensure delivery of the service. This data may be shared with Law Enforcement Agencies and our Insurance companies relating to crime prevention, criminal activity, incident management and legal claims. To view the CTM privacy policy, please visit www.CTM.uk.com |
|
O.C.S. Group Ltd |
OCS Group Ltd are the data processor, providing village security services, including Lost Property, Automatic Number Plate Recognition (ANPR), Closed Circuit TV (CCTV)) monitoring, Visitor Logs, Emergency Contact Lists, Barring Orders, 1st Aid & Incidents. |
OSC Group will collect, view, and store your data to perform their security services. This data may be shared with Law Enforcement Agencies and our Insurance companies relating to crime prevention, criminal activity, incident management and legal claims. To view the OCS privacy policy, please visit www.ocs.com/uk |
|
Ark Workplace Risk Ltd (Trading as Ark) |
Ark are the data controller for accident and first aid records, using Quooda secure platform for reporting logs |
Ark provide secure cloud based system to store your personal data in relation to accident and first aid report logs. This data may be shared with Law Enforcement Agencies and our Insurance companies relating to crime prevention, criminal activity, incident management and legal claims. To view the OCS privacy policy, please visit www.arkworkplacerisk.co.uk |
|
MITIE Group Plc |
MITIE are the data processor for Closed Circuit TV (CCTV) and Access control |
MITIE may view your data during system maintenance. This data may be shared with Law Enforcement Agencies and our Insurance companies relating to crime prevention, criminal activity, incident management and legal claims. To view the MITIE privacy policy, please visit www.mitie.com |
|
ACOS Medical |
ACOS are the data controller providing emergency medical assistance |
ACOS will collect, view and store your data to ensure appropriate medical care. This data may be shared with Law Enforcement Agencies and our Insurance companies relating to crime prevention, criminal activity, incident management and legal claims. To view the ACOS medical privacy policy, please visit www.acosmedical.com |
|
Chargemaster Plc (Trading as Chargemaster Ltd) |
Chargemaster are the data controller for car charge service. |
Chargemaster will collect, view and store the data you provide to ensure delivery of the service. To view the Chargemaster privacy policy, please visit www.chargemasterplc.com |
|
ChargeBox |
ChargeBox are the data controller for secure mobile device charge stations. |
ChargeBox will use the information you have provided in relation to missing or damaged device in a ChargeBox unit, to ensure they can respond to your query accordingly and will store the data to support queries. To view the ChargeBox privacy policy, please visit www.chargebox.com |
|
Technology Means Business (Trading as TMB) |
We use TMB to process Frequent Flyer Redemptions. |
TMB facilitates the collection and storage of village spend and Loyalty Membership data on their secure platforms to communicate redemption claims to Loyalty Membership Programmes. To view the TMB privacy policy, please visit www.tmb.co.uk |
|
SalesForce |
We use SalesForce to manage our in-village CRM system |
SalesForce will be used to allow us to collect, view and edit your data to assist you in managing your personal data. To view the SalesForce privacy policy, please visit www.salesforce.com |
|
Transive Limited |
Transive are the data controller for village e-commerce services, including booking and transaction data. |
Transive will collect, view and store your data to deliver e-commerce services. Transive will share your data with service suppliers to fulfil the booking contract. To view the list of service suppliers and their privacy policies, please visit https://travel.thebicestervillageshoppingcollection.com/en/experience/chic-travel/shop/terms-conditions |
|
Global Reach Technology (Trading as Global Reach Tech) |
GRT are the data controller for free Village Wifi access |
GRT will collect, view, store and report data relating to the provision of Wifi services. The personal data may be in relation to your device, email, enquiries, website visits, location data and fault reporting. To view the GRT privacy policy, please visit www.globalreachtech.com |
|
Six Payment Services |
Six Payment Services are the data controller and operator of Welcome Centre, Bicester Village Train Station, The Apartment PDQ card payment devices |
Six Payment Services will collect, view and store your transactional data to support the delivery of paid services. To view the Six Payment Services privacy policy, please visit www.six-payment-services.com |
|
Restore Plc (Trading as Data Solutions 2016 Ltd) |
Data Solutions are the data processor for secure and confidential waste disposal |
Data Solutions may view your data whilst carrying out secure data shred services. To view the Data Solutions privacy policy, please visit www.restoreplc.com |