Privacy Policy

OUR PRIVACY POLICY

Union Square Developments Limited (Union Square, we, us or our) have certain obligations to notify individuals (you, your or data subject) about how we process any personal data we collect from you or about you.

We take your data privacy very seriously and are committed to ensuring your privacy is protected. This Privacy Policy provides information regarding what personal information we collect and how we use it, the legal basis for processing and the legal rights you may have to control that processing. It is important to read this carefully.

ABOUT US

We, Union Square, act as the data controller of your personal information. Union Square Developments Limited is a limited company registered in Scotland. Our company registration number is SC195182, and our registered office is C/O Shepherd and Wedderburn Llp, 9, Haymarket Square, Edinburgh, Scotland, EH3 8FY. Our registered VAT number is 239432065.  

OUR CONTACT DETAILS

Our contact address is Union Square, Management Suite, 12 First Level Mall, Guild Square, Aberdeen, AB11 5RG.

If you have any specific issues relating to this privacy policy, or any wider privacy issues relating to us, please get in touch via our Contact us page, or by sending an email to customer.service@unionsquareaberdeen.com.

HOW DO WE COLLECT YOUR PERSONAL INFORMATION

We collect your personal information when you:

• Sign up to our newsletter.
• Communicate or interact with us using your social media account such as Facebook, Instagram, X or TikTok.
• Communicate with us over the phone, email or post, this may include when you make an inquiry.
• Enter a competition or promotion.
• Register to attend any of our events. You may provide your personal information when filling in a form to register for an event. This data may be captured on a third-party booking system such as the Eventbrite website.
• Provide your consent for us to use your photo or video footage when you attend any of our events. You will be made aware of any photography taking place beforehand, and photos will only be taken with your explicit verbal consent.
• Access and use our website. We automatically collect information about you when you use our website. This is collected through cookies, beacons and similar technologies. This includes information regarding your device type and IP address, more detail on this is described in the section below and in our Cookie Policy which can be accessed here.
• Enter onto our premises including our car park. We may also collect information about you through our use of CCTV, body worn video and Automatic Number Plate Recognition (ANPR) within our premises, when you enter onto our property or park in our car parks.

WHAT PERSONAL INFORMATION DO WE PROCESS

The personal information we process about you may include:

Personal identifiers, contacts and characteristics:

Your name, contact details including email address and mobile telephone number, post code, date of birth, gender, details of any offers or competitions you have signed up for, any communications you may have with us, and your preferences to any methods and types of marketing information you have consented to receive. Where you interact with us on social media, we may collect information about your social media profile such as username and details of any direct messages you may have sent us.

Geolocation and device information:

The type of device, your operating system, your browser (for example, whether you used Internet Explorer, Firefox, Safari, Chrome or another browser), your internet service provider, your domain name, your internet protocol (IP) address, your device identifier (or UDID), the date and time that you accessed our service, the website that referred you to our website, the web pages you requested, the date and time of those requests, and the subject of the ads you click or scroll over. To collect this information, we use cookies, beacons and similar technologies. For further information on this, please see our Cookie Policy.

Images and Video Recordings:

a.    Promotional Photography:

Images and video recordings of you may be captured when you attend one of our events. You will be made aware of this beforehand, and you will be able to refuse your photo being taken. Some professional photographs will be blurred and therefore may not identify you, however photography taken by our team members for the purposes of publishing on our social media accounts may identify you. We will always ask for your consent.

b.    CCTV images and Video Recording:

Our shopping centre makes use of CCTV cameras and body worn video (BWV) used by security personnel for security purposes. This may include capturing images and video recordings of you when on our property, and video and audio recordings of you when you are in close proximity to or interact with our security personnel.

c.     Parking and the use of ANPR:

The personal data which may be collected and used by us in our provision of the car park service includes your vehicle registration number, which is collected by automatic number plate recognition cameras (“ANPR”), and other details relating to your car such as car make/model/car colour/fuel type/emissions; photograph (which may be collected as part of ANPR image); video recording (without sound) (collected by CCTV used in the car park); the time and date of your use of our services (and, consequently, your location); and/or payments and payment methods for the use of the car park.

For a more detailed understanding of the types of personal data collected by your use of our car park, please see the bottom of this Policy.

HOW DO WE USE YOUR PERSONAL INFORMATION

How we use these types of information will be described below.

1.    Personal Identifiers and contact information:

Marketing and communication purposes:

Your personally identifiable contact information will be used for the purpose of sending you marketing messages or otherwise engaging with you. We use your data to send you marketing information by various channels including email, SMS, mail or telephone, including sending notices of new products, special offers and other marketing materials to enhance and support your relationship with Union Square. This will be used in accordance with your preferences as selected.

We rely on the legal basis of consent (where it has been requested) or of legitimate interests.

We may use your personal data for our legitimate business interests, without consent, for:

• sending you surveys or supporting Marketing Research activities to you in other ways to help us improve our services and understand our customers better;
• allowing you to participate in interactive features of our service, when you choose to do so;
• ensuring that content from our digital channels is presented in the most effective manner for you and for your computer/smart phone and/or tablet;
• allowing us to investigate and respond to any issues or correspondence received;
• administering any promotion or competition which you have entered;
• providing a service to you;
• administering event registrations where you have registered to attend an event;
• notifying you about changes to our services.

We also collect personal information from you directly for the purposes of communicating with you as a competition winner. This is usually done through our social media platforms in which we will collect the personal information provided by you, the winner, in order to liaise with you about the collection of the prize.

2.    Geolocation, Device and Website Use

We use Geolocation and Device and Website Use information to improve the effectiveness and operation of the website, to improve our existing services and develop new services and to inform and direct our marketing strategy. In addition, anonymised statistical data may also be shared with retailers or used by us to develop new promotions that may interest our customers.

We will also use this information for system administration and to report aggregate information to our retailers. This is anonymised statistical data about our users’ browsing actions and patterns and to help us to improve our site and to deliver a better and more personalised service. 

The legal basis we rely on for this processing is legitimate interests. We may use this information for our legitimate interests:

• To estimate our audience size and usage pattern
• To store information about your preferences, and so allow us to customise our site according to your individual interests.
• To speed up your searches; and
• To recognise you when you return to our site.

For more information, please see our Cookie Policy.

3.    Images and Recordings:

a.    Promotional Photography and Videos

We rely on the legal basis of consent, in which we will obtain your verbal consent to use and publish photos or video recordings that may identify you. If you refuse to such photography, you will not be featured within the imagery. We may use this information to:

• Promote our shopping centre on our website or social media platforms
• Improve our marketing, advertising and communications campaigns

b.    CCTV on our premises:

We rely on the legal basis of legitimate interests to process images and recordings captured by CCTV and BWV footage. Union Square operates CCTV and BWV equipment at Union Square to:

• facilitate good property management
• monitor the security of the premises and property of those present on the site
• prevent or detect crime, and assist law enforcement authorities such as the police
• ensure compliance with health and safety rules and to identify unsafe working practices

CCTV and BWV recordings relevant to any civil or criminal cases, or relevant for health & safety purposes, can be used as evidence against those present on site.

c.      ANPR and Parking:

When processing your personal information captured by ANPR, we rely on the lawful basis that it is necessary for the performance of our contract with you, for our legitimate business interests or where it is necessary for compliance with a legal obligation, for the following purposes:

• providing you a parking space,
• management reporting, accounting, other internal business,
• sales management,
• customer relationship management,
• enforcement of our terms and conditions,
• compliance with legal, regulatory and other governance obligations,
• preventing your vehicle access to our car parks where we have determined not to permit your vehicle from entering the car park.

See the bottom of this Privacy Policy for further information regarding the use of ANPR within our car parks.

DATA PROCESSED WHERE IT IS NECESSARY FOR COMPLIANCE WITH A LEGAL OBLIGATION IMPOSED ON US

We will process your personal data to allow us to comply with any requests you are lawfully entitled to make, including under data protection laws, to ensure that age inappropriate content is not provided to individuals under 18, and to allow us to keep records that we are legally required to retain, including evidence of consents provided, or to evidence our compliance with legal obligations.

HOW DO WE STORE YOUR PERSONAL INFORMATION

Your information is stored securely. We take precautions including administrative, technical and physical measures to protect your personal data against loss, theft and misuse, as well as against unauthorised access and disclosure.

HOW LONG WILL WE HOLD YOUR INFORMATION

We will normally retain your personal data for a period of up to 7 years from the last time you used or interacted with our services, or when you unsubscribe from receiving marketing from us (if later).

This is the case unless we are legally required to retain the information for longer. However, we may delete your data sooner if we have no purpose to retain it.

We will retain your details if you have unsubscribed from marketing to ensure that we respect your withdrawal of consent on an ongoing basis.

Regarding personal data captured by CCTV, BWV and ANPR, we will only keep the personal data for a limited amount of time and no longer than is necessary for the purposes for which it is processed, as set out below:

• Personal data related to your transaction (with the exception of CCTV images) will be retained for a period of up to 5 years from the date of the transaction to the extent necessary for the purposes of legal claims and dealing with any queries from you;
• Images captured by CCTV and BWV will be retained by us for a maximum of 31 days, unless required to be kept for longer due to legal obligations or legal claims;
• Vehicle registration data captured through ANPR is held for a period of 3 months.

WHO WILL WE SHARE YOUR PERSONAL INFORMATION WITH

We may share your personal information to third parties service providers acting on our instructions to support our provision of the website, or our services to you, who are specifically contracted to process personal data on our behalf.

We may share your personal data, where necessary, with prospective purchaser(s) or purchaser of any part of our business, on the basis of our legitimate interests and the interests of our purchaser, so that they can appropriately value the business and assess any risks and continue doing business with you after the acquisition.

Any images captured by CCTV, BWV, and ANPR may be shared with third parties providing relevant services under contract to us, for these purposes, such as:

• providers of certain business function services, such as IT support, processing of payment card/details website and data hosting providers and administrators. These parties will process the personal data on our behalf (as our data processor). We will disclose your personal data to them so that they can perform those functions. Examples of these providers include our outsourced IT systems software and maintenance, payment processing and back up and server hosting providers; and
• security/parking team service provider (for watching CCTV and responding to barrier/ticket questions). This provider will process the personal data on our behalf (as our data processor) and will disclose your personal data to it so it they can provide us with these services.

We will also share your personal data where:

1. you have provided prior explicit consent;
2. we are required by law, including any court order;
3. necessary to protect you, Union Square, its customers or the wider public.
4. we believe that disclosure is appropriate in connection with efforts to investigate, prevent, or take action regarding illegal activity, suspected fraud, or other wrongdoing; to protect and defend the rights, property or safety of the Company, its customers, staff, suppliers or others; to comply with applicable law or co-operate with law enforcement; or to enforce its terms or other agreements
5. we need advice and services from our advisors (such as consultants, legal advisors, auditors and other professional advisors) (legitimate business interest)
6. we are engaging with prospective or actual buyers in the event that the Union Square sells or buys any of its business or assets.

WHERE WILL YOUR PERSONAL DATA BE HELD

We may store or process your personal data outside the European Economic Area (EEA), or other countries approved by the European Commission as providing appropriate safeguards for personal data, when we use service providers located in those countries. If this is the case, we will put in place appropriate safeguards to protect your personal data and ensure that it is compliant with all appropriate legal requirements. This includes having the appropriate standard contractual clauses in place with the service provider receiving the information to ensure your personal information is protected in the same manner that is available within the EEA.

If you require further information in respect of the countries where your personal data is processed and/or copies of any documents setting out the appropriate safeguards we have implemented to protect it, please contact us.

Your personal data captured by CCTV, BWV, and ANPR may be transferred to recipients who are located within the European Economic Area (“EEA”). It will not be transferred to or otherwise processed by recipients located outside of the EEA.

CHILDREN’S PRIVACY

Where people under the age of 13 use our services, they are required to confirm that they have their parent’s consent. Parents should supervise the online activities of their children and consider the use of tools available from online services and software providers that help provide child-friendly Internet environments. If any of our products or services are targeted directly at children, we will provide you with additional information about how their data will be used in the context of that service.

If the user’s age has been provided it is used to ensure that products inappropriate for those under 18 are not promoted to any user aged under 18.

OTHER SITES

Our digital channels may contain links to other sites on the Web. These other sites are not covered by this privacy policy and although we are committed to protecting your Personal Data, we cannot control and do not accept any responsibility or liability for the privacy practices, cookies or content of such other websites. We encourage you to read the privacy statements of each and every website that collects your Personal Data.

You are solely responsible for maintaining the secrecy of your passwords and other account information, and we cannot take responsibility for any damage arising from any disclosure of your password or access to your email account by other parties.

YOUR RIGHTS

You have certain legal rights in relation to any personal data about you which we hold, as summarised below. They do not apply in all circumstances. If you wish to exercise any of them, we will explain at that time if they are engaged or not:

• the right to request access, receive copies of your personal information and to obtain information about how we process it;
• the right to have your personal information corrected if it is inaccurate and to have incomplete personal information completed;
• the right to object to processing of your personal information;
• the right to restrict processing of your personal information;
• the right to have your personal information erased (the “right to be forgotten”);
• the right to move, copy or transfer your personal information (“data portability”);
• rights in relation to automated decision making which has a legal effect or otherwise significantly affects you.

Where our processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. If you do decide to withdraw your consent we will stop processing your personal data for that purpose, unless there is another lawful basis we can rely on – in which case, we will let you know. Your withdrawal of your consent won’t impact any of our processing up to that point.

If you wish to withdraw your consent to receive marketing materials, this can be done by:

• emailing us at customer.service@unionsquareaberdeen.com, or
• by clicking on the unsubscribe link on any emails we have sent.

If you withdraw your consent, this will not affect our rights to have sent you marketing material prior to your withdrawal, but we will not send any further marketing. Whilst we will endeavour to ensure that you do not receive any further marketing material immediately, there may be a slight delay for any changes to take effect. Please note that your information will not be deleted but will be retained in a suppression list to ensure that we do not inadvertently send further marketing communications once you have withdrawn your consent to receive them.

Where our processing of your personal data is necessary for our legitimate interests, you can object to this processing at any time. If you do this, we will need to show either a compelling reason why our processing should continue, which overrides your interests, rights and freedoms or that the processing is necessary for us to establish, exercise or defend a legal claim. 

If you wish to make such a request, please use either our Contact Us page or email us at customer.service@unionsquareaberdeen.com.

We may require additional information to either confirm your identity before we can process your request and/or to assist us in responding to your request.

If you are unhappy with the outcome of your request or with our processing of your personal data, you are entitled to lodge a complaint with the Information Commissioner’s Office (ICO), whose website is www.ico.org.uk.

Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you access our site.

If you do not wish us to process your Geolocation and Device and Website Use information, you may prevent this by disabling the function or blocking the cookies on your device or browser. However, if you select this setting, you may be unable to access certain parts of our site, or it may impact on the usability of our website.

For further information on how to do this, please visit https://allaboutcookies.org.

FURTHER INFORMATION ON PARKING

In addition to the types of personal information we collect, listed above, there may be certain circumstances where we may combine the images captured by CCTV and ANPR with identifiable information (although we do not seek to do this outside the following circumstances), this includes:

1. when it is necessary to obtain vehicle-owner information from the DVLA (in the limited circumstances permitted by law);
2. if you contact us and provide such additional information to enable us to identify you from the above data, for example (a) when raising an enquiry with us about your use of our services or (b) when signing up for other services which we may provide where applicable (including pre-booking services or to administer loyalty schemes); and
3. if you are eligible for automatic entry/exit to the car park e.g. if you are a Company employee, a contract 2 parker, pre-paid parker, competition winner for free parking, recipient of a loyalty or promotional offer, or a customer for any additional services, we may provide such as pre-booking services and loyalty schemes
4. Where we carry out enquiries, in accordance with our terms and conditions, or to deal with an enquiry raised by you, or to enable you to sign up for other services

In these circumstances we may process the following information about you; your name, contact details (business or personal), opinions or suggestions on our services; and/or bank account details (for the purposes processing payments).

Furthermore, we may process details of your unresolved, non-compliance (if any) with contracts between us (e.g. if there has been a non-payment or other breach of contract by you in relation to your use of the car park), whether your vehicle has been involved in crime in relation to the car park, or in relation to facilitating the exit from the shopping centre following the commission of a crime, or is otherwise known to the control authorities (police, intelligent services and local authorities), or whether you are subject to a banning order from the shopping centre the car park is affiliated with. In these circumstances, we may have determined not to permit your vehicle, or the vehicle we have connected to you, to enter the car park based on that previous behaviour.

UNDERSTANDING OUR PURPOSES FOR PROCESSING YOUR PERSONAL DATA

We process your information when you use our car park for the following purposes:

• providing car park services (and, where applicable, pre-booking services (season tickets and/or day to day) and loyalty schemes) to you in accordance with our terms and conditions. Our lawful basis is that it is necessary for the performance of our contract with you (or in order to take steps at your request prior to entering into a contract with you);
• management reporting, accounting, other internal business (including joint ventures and business sales) and sales management, if any personal data is involved. Our lawful basis is that it is necessary for the purposes of our (or a third party’s) legitimate business interests (e.g. to manage our business responsibly and efficiently), which are not overridden by your interests, fundamental rights and freedoms;
• customer relationship management – dealing with any queries or correspondence from you. Our lawful basis is as follows: (i) where the processing relates directly to responding to you, our lawful basis is that you have consented to us responding to you, by making a request to us which requires a response; and (ii) where the processing is not directly related to responding to you (e.g. obtaining professional advice to allow us to consider our response, discussing your request in management meetings), our lawful basis is that it is necessary for the purposes of our (or a third party’s) legitimate business interests (e.g. to manage our business responsibly and efficiently, and to consider and protect our own legal rights), which are not overridden by your interests, fundamental rights and freedoms.
• enforcement of our terms and conditions. Our lawful basis is that it is necessary for the performance of our contract with you (or in order to take steps at your request prior to entering into a contract with you);
• compliance with legal, regulatory and other good governance obligations, including to request additional information from third parties (e.g. the DVLA) to allow us to meet these obligations. Our lawful basis is that it is necessary for compliance with a legal obligation to which we are subject;
• where we have determined not to permit your vehicle (or a vehicle that we have associated with you) to enter the car park based on previous behaviour (e.g. non-payment, breach of contract, criminal behaviour, banning orders, as explained above), our lawful basis is that it is in our (or a third party’s, such as other users of our car park) legitimate business interests (e.g. to ensure that vehicles entering the car park do not present us with security or breach of contract risk, to enforce previous contracts, to protect others’ property rights or for the security of our car park), which are not overridden by your interests, fundamental rights and freedoms; and/or
• where our processing of the personal data referred to above, or otherwise to the extent this is caught on car park CCTV, relates to criminal offences (or alleged) (including its disclosure to law enforcement authorities or otherwise in relation to legal claims or determining not to permit your vehicle to enter the car park), our lawful basis for determining not to permit your vehicle to enter the car park or disclosure to law enforcement authorities is that it is in in the substantial public interest and necessary for prevention or detection of an unlawful act (and if we sought your consent for this it would prejudice these purposes), and in respect of legal claims is that it is necessary for the establishment, exercise or defence of such claims.

THE USE OF PROFILING AND AUTOMATED DECISIONS

We may also carry out profiling regarding the use of our car park which involves the processing of your personal data. The profiling we carry out is focused on your vehicle (or in some instances a vehicle which we have associated with you), although because we are able to identify you from your vehicle details (in conjunction with other personal data held about you, as described above in this Policy) this will constitute profiling based on your personal data.  We create a profile of your vehicle, including whether (or not, to the extent relevant) your vehicle is permitted to enter the car park based on previous behaviour (e.g. non-payment, breach of contract, criminal behaviour, banning orders, as explained above in this Policy), frequency of visits, vehicle and fuel type, or whether you are eligible for automatic entry/exit to the car park (e.g. if you are a Company employee, a contract parker, pre-paid parker, competition winner for free parking or recipient of a loyalty or promotional offer).  This enables us to determine whether to permit you to enter the car park, to enter into and enforce our contracts, or to potentially offer discounts (e.g. to low-emission vehicles, vehicles with certain characteristics, loyalty offers).

Where our profiling does not have legal or similarly significant effect on you, or where we (i.e. a representative of Union Square) have made a decision which is being implanted via our car park gates, such as to determine that the vehicle you are driving matches the details of a vehicle we have previously determined should be permitted or not to access the car park, our lawful basis is that is necessary for the purposes of our (or a third party’s) legitimate business interests (e.g. to ensure that vehicles entering the car park do not present us with security or breach of contract risk, to enforce previous contracts, to protect other’s property rights or for the security of our car park) in the case of vehicles which are not permitted to enter the car park), which are not overridden by your interests, fundamental rights and freedoms, or that it is necessary for performance of a contract with you (e.g. as to automatic entry/exit).  

However, where we use the personal data (including profiling) to make automated decisions about you which produce legal effects on you or similarly significantly affects you, we do so where it is necessary for entering into (or performing) a contract between us and you, as set out below. We will implement suitable measures to safeguard your rights, including providing you with the right to obtain human intervention, to express your point of view and contest the decision.

We may make such automated decisions based on your personal data where this is necessary for performance of a contract between you and us in order to:

• issue parking charge notices; and
• determine the correct tariff for our services to you – for example to offer discounts to low-emission vehicles or discounts based on other certain features of a vehicle (such as colour or vehicle type). 

Where we make these automated decisions, to obtain human intervention (i.e. a human will review the automated decision which has been taken), express your point of view and contest the decision, please contact us.

MODIFICATIONS TO THIS POLICY

We may revise this Privacy Policy from time to time. If we are going to use your Personal Data for any other additional purposes not set out in this privacy notice or if we make any changes to this privacy policy that may materially impact on you or our processing of your personal data, we will notify you.

Any questions, comments and requests regarding this privacy policy are welcomed and should be addressed via our Contact Us page or directly by email to customer.service@unionsquareaberdeen.com.