Privacy Notice
At the Derbion, we’re committed to protecting and respecting your privacy. We understand that your privacy is important to you and that you care about how your personal data is used.
Please read this privacy notice carefully as it contains important information on who we are and how and why we collect, store, use and share your personal data. It also explains your rights in relation to your personal data and how to contact us or supervisory authorities if you have a complaint about the use of your personal data.
If you have any questions about this privacy notice or the personal data we use about you, please contact our Data Protection Officer (DPO) using the details below:
Email at: DPO@derbion.com;
Post at: Derbion, West Mall Level 3, Derby, DE1 2PQ; or
Telephone at: 01332 366383.
Who Are We?
We’re Wilmslow (No.3) Limited Partnership trading as Derbion. Wilmslow (No.3) Limited Partnership is a limited partnership, registered under number LP007037, whose registered address is 8 Sackville Street, London, W1S 3DG.
When will this Privacy Policy apply?
This Privacy Notice will apply to the personal data we collect and process when you:
a. Visit www.Derbion.com (Our Website);
b. Visit the Derbion shopping centre, via CCTV;
c. Interact with our security team, please note, they may activate their body worn cameras
d. Hire services and facilities or purchase products from the Derbion;
e. Speak to a member of the Derbion team on the telephone or face-to-face;
f. Email our customer service team to make an enquiry relating to Derbion or your visit;
g. Enter a competition or prize draw with Derbion
h. Enter our car parks via automatic number plate recognition;
i. Sign-up to attend an event at the Derbion; or
j. Sign up for the free WI-FI in Derbion.
What is Personal Data?
Personal data is defined by the UK General Data Protection Regulation (the “GDPR”) and the Data Protection Act 2018 (collectively, “the Data Protection Legislation”) as ‘any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier’.
Personal data is, in simpler terms, any information about you that enables you to be identified. Personal data covers obvious information such as your name and contact details video footage and photographs, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.
Lawful basis for processing personal data
Processing of personal data will be lawful only if one or more of the following lawful bases for processing applies:
a. processing is necessary for the performance of a contract which you are party to or to take steps at your request prior to entering a contract;
b. for compliance with a legal obligation to which Derbion is subject;
c. for the purposes of Derbion’s legitimate interests or those of a third party (such as advertising agencies), but only if these are not overridden by your interests, rights or freedoms; or
d. you have given your consent to the processing of your personal data for the processing detailed in this privacy notice.
We have set out in the table below, a description of all the ways we use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose in this privacy notice.
| Personal data | Purpose of processing | Lawful basis |
| Name, email address, content of the email* | To monitor and reply to customer queries received in the customer services inbox | Legitimate interest – to be able to respond to any customer queries received via email and to ensure customer satisfaction |
| Name, email address, picture, opinion and content of the comment, location and any additional voluntary information provided* | To respond to any queries or comments via social media | |
| Name, postal address* | To allow customers to collect parcels via the collect plus service | Legitimate interest – to offer customers opportunity to collect parcels from Derbion |
| Name, telephone number, postal address, a photo ID i.e. a bus pass* | To allow customers to hire a wheelchair when in the centre and to ensure it is safely returned | Legitimate interest – to offer customers the possibility to hire a wheelchair during their visit to Derbion and to ensure it is returned following their visit. |
| Name, telephone number, postal address* | To allow customers to use the quiet room onsite | Legitimate interest – to enhance the customer experience by allowing the use of the quiet room for a number of personal reasons |
| Name, telephone number, postal address, ID* | To allow customers to hire fun buggies when onsite and to ensure the safe return of them
|
Legitimate interest – to enhance customer day by allowing customers to hire fun buggies and to ensure their safe return |
| Name, phone number, incident description* | To maintain and keep a record of any incidents that have been attended to | Legal obligation |
| Name, details of the incident, telephone number | To provide a courtesy customer callback to visitors who have been involved in an incident onsite at Derbion | Legitimate interest – to give customers a call back who have been involved in an incident onsite |
| Name, date, telephone number | To keep an internal log of lost property and record when the items were collected by the individual to be able to validate collection | Legitimate interest – to have a record when an individual has collected an item in case there is a dispute |
| Video and images* | To monitor individuals in the centre to prevent and detect crime, ensuring public safety in Derbion | Legitimate interest for prevention, inspection and detection of crime, apprehension and prosecution of offenders (including the use of images in criminal and civil processing), public and employee safety, monitoring the security of Derbion premises and protection of Derbion assets |
| Video, images and audio* | Body worn video cameras (BWV) – to safeguard security officers when dealing with certain volatile incidents | Legitimate interest to offer additional protection to the security guards when dealing with certain incidents and to be able to use as additional evidence in the case of a investigation/claim. |
| Name, email address, copy of the ID* | To respond to the customers or insurance companies who send out a request for a CCTV/Body Worn camera footage | Legal obligation |
| Name, email, postal address, personal data provided in order to enter the competition and a signature when collecting the prize* | To enable individuals to enter competitions and retrieve any prizes | To enter into a contract |
| Name, postal address, copy of ID and signature* | To run fraud checks on customers before issuing a large value gift card | Legal obligation |
| To keep an internal log and confirm the identity of the individual collecting the gift cards for high value or quantity gift cards. | Legitimate interest – to confirm the identity of the individual and keep the records of collected gift cards | |
| Licensee name, postal address, email address and reason for hire* | To monitor and take reservations for the community hub, which are licensed spaces | Contractual necessity |
| Name, postcode, email address, date of birth, car registration, telephone number* | To create a customer base of individuals who have interacted with Derbion’s events and to analyse such interactions. | Legitimate interest – for Derbion to gather a database of their customers and understand their shopping habits and interactions to improve the centre experience |
| Name, email, date of birth (to make sure we are promoting appropriately aged content) | To send out direct marketing emails to customers to promote Derbion as a centre and send a birthday promotion | Consent |
| Name, postcode, email address, date of birth, car registration, telephone number, IP addresses* | To gain customer insights from individuals who sign up for Wi-Fi and to be able to track their movements around the centre, so they can plan store locations and events | Legitimate interest – to gain customer insight, including understanding the customer base and how they spend time in the centre. |
| To use ticketing system Eventbrite to sell tickets to Derbion events, so they have confirmed entry and details of those attending the event* | Name, postcode, email address, car registration, telephone number, payment details held in Eventbrite system | Legitimate interest – to offer customers opportunity to buy tickets to Derbion events, and to allow Derbion to track and monitor who is attending the events |
| To capture individuals at events held in Derbion for advertising purposes* | Images | Legitimate interest – to record photos and videos for advertisement purposes
|
| To use Google analytics to track customer behaviour on Derbion’s website* | IP address and activity on the website | Legitimate interest – to understand customer behaviour on Derbion’s website |
| To have an overview of all comments and interactions on social media sites made by the public in an easy to view format* | Name, email, picture, opinion and content of the comment, location and any additional voluntary information provided | Legitimate interest – to understand what customers are saying about Derbion and to make any necessary improvements. |
| To improve Our Websites usability and to review how personal data is stored and used for aggregated and statistical reporting* | These services may record mouse clicks, mouse movements, page scrolling and any text keyed into website forms | Legitimate interest – To improve Our Website usability |
| To allow us to monitor your stay in the carpark and charge you accordingly | Automatic number plate recognition, entry to the carpark and leaving the carpark | Contractual necessity. |
In certain circumstances you may be obliged to provide us with personal data and if you fail to provide the personal data, when requested, we may not be able to offer services to you or assist with your enquiry. Where this is the case we have identified these instances in the table above with an “*.”
Credit card and debit card information
If you purchase a product from us, your card information is not held by us, it is collected by our third party payment processors, who specialise in the secure online capture and processing of credit/debit card transactions, as explained below
Retention of Data
We review our retention periods for personal information on a regular basis. We are legally required to hold some types of information to fulfil our statutory obligations.
We will hold your personal information on our systems for as long as is necessary for the relevant activity, as long as is set out in any relevant contract you hold with us or as long as we are required to do so by our statutory obligations.
Who has access to your information?
We will not sell or rent your information to third parties.
We will not share your information with third parties for marketing purposes.
We share your personal data with the following third parties:
1. Savills PLC our property management team;
2. our online payment providers;
3. our customer issue tracking tool provider, this includes our call recordings;
4. our customer reviews provider;
5. our customer database system providers;
6. our digital marketing tool providers, such as email service provider;
7. our website platform provider;
8. our website app providers, for services such as wish list and reserve in store;
9. marketing service providers, for example those used to help us generate online advertisements.
We may also share Personal Data with third parties in an aggregated or anonymised form that does not directly identify you, e.g. we may share aggregated information about your interests and geographic preferences and/or location (if given) with advertisers and third-party Websites for marketing purposes.
Before we share Personal Data with any third parties, we will carry out due diligence on their processes and procedures to ensure they will keep any Personal Data we share with them adequately secure. We will require all third parties to respect the security of your Personal Data and to treat it in accordance with the law and subject to appropriate contractual terms. We do not allow our third-party service providers to use your Personal Data for their own purposes and only permit them to process your Personal Data for specified purposes and in accordance with our instructions.
Marketing
You have a choice about whether or not you wish to receive information from us when you provide us with your personal information. If you do not want to receive direct marketing communications from us about the work we do and our exciting products and services, then you can select your choices by clicking the unsubscribe link or button or the manage preferences link or button in any email communications you receive from us or ticking the relevant boxes situated on the form on which we collect your information.
We will not contact you for marketing purposes by email, phone or text message unless you have given your prior consent. We will not contact you for marketing purposes by post if you have indicated that you do not wish to be contacted. You can change your marketing preferences at any time by contacting us by email: DPO@Derbion.com or telephone on 01332 366383.
Finally, if you no longer wish to hear from us, then please:
• contact us at: DPO@Derbion.com;
• write to us at: Derbion, West Mall Level 3, Derby, DE1 2PQ;
• call 01332 366383; or
• Use the unsubscribe or preference management links or buttons in any email communication you receive from us.
Keeping your personal data secure
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
Use of ‘cookies’
Like many other websites, the Derby Centre website uses cookies. ‘Cookies’ are small pieces of information sent by an organisation to your computer and stored on your hard drive to allow that website to recognise you when you visit. They collect statistical data about your browsing actions and patterns and do not identify you as an individual. For example, we use cookies to store your country preference. This helps us to improve Our Website and deliver a better more personalised service.
It is possible to switch off cookies by setting your browser preferences. For more information on how to switch off cookies on your computer, visit our full cookies policy . Turning cookies off may result in a loss of functionality when using Our Website.
Links to other websites
Our Website may contain links to other websites run by other organisations. This privacy policy applies only to Our Website‚ so we encourage you to read the privacy statements on the other websites you visit. We cannot be responsible for the privacy policies and practices of other sites even if you access them using links from Our Website.
In addition, if you linked to Our Website from a third party site, we cannot be responsible for the privacy policies and practices of the owners and operators of that third party site and recommend that you check the policy of that third party site.
18 or Under
We are concerned to protect the privacy of children aged 18 or under. If you are aged 18 or under‚ please get your parent/guardian’s permission beforehand whenever you provide us with personal information.
Transferring your personal data out of the UK
To deliver services to you, it is sometimes necessary for us to share your personal information outside the UK.
Whenever we transfer your personal data outside of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
a. We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the UK;
b. Where we use third parties outside of the UK, we may use specific contracts approved under UK law, these are sometimes known as standard contractual clauses which give personal data the same protection it has in the UK.
If you would like more information about the methods used to transfer your personal data outside of the UK, please contact us at DPO@derbion.com.
Your Rights under data protection
You have a number of rights in relation to how we use your personal data. These are as follows:
a. your right to request access to your personal data – you have the right to know how we are using your personal data, a right to see a copy of the personal data we hold for you and a right to be provided with additional information, for example, about how and why we are using your personal data and who it is being shared with.
b. You have the right to request that any inaccurate personal data is amended – if you think that any of the personal data that we hold about you is wrong or incomplete then you have the right to tell us and we have to ensure that the personal data we have is reviewed and if necessary, amended to ensure it is correct.
c. You have the right to ask for your personal data to be deleted – in certain circumstances, you can ask us to delete your personal data where there is no good reason for us to hold or use this anymore, where:
i. we are using your personal data because you provided us with your consent to use it in this way and you withdraw your consent; or
ii. where you have challenged our use of your personal data and there are no good reasons for us to process your personal data.
d. This does not apply to all of your personal data, as we may need to still keep your personal data, for example, to comply with laws.
e. You have the right to request the restriction of processing of your personal data – this right allows you to ask us to put processing on hold so:
i. we can establish if the personal data that we have about you is correct;
ii. we can investigate any objection you have made about the use of your personal data; or
iii. if we have no justification for keeping it any longer you may ask us to put the processing on hold but retain the personal data in case you need this, for example, for legal reasons.
f. You have the right to have your personal data sent to another organisation – in certain circumstances, you have the right to get your personal data from us in a way that is accessible and machine-readable, and you also have the right to ask us to transfer your personal data to another organisation. This only applies to personal data that you have provided to us and which is held electronically. We only have to comply with this right if it is technically feasible to provide this personal data in a commonly used format, for example, a csv file.
g. You have the right to object to the processing of your personal data – you have the right to tell us about any concerns regarding the processing of your personal data and to ask us to stop using your personal data. This includes objection to marketing.
If you would like to exercise any of those rights please contact us by email to DPO@derbion.com.
Review of this Policy
We keep this Policy under regular review. This Policy was last updated on 01/07/2024