Mobile application privacy and cookie policy

1. Understanding and using this privacy policy

In this privacy and cookie policy, we have used some keywords to describe some longer words or phrases – please read this part carefully so you understand what these words mean when they are used in this policy.

• “App” means the Discover at Liverpool ONE mobile application which is available to download on Android via Google Play and on iOS via the App Store,
• “Data Protection Laws” mean the UK data protection rules (including the guidance associated with it),
• “Information” means any personal data or information about you that you share with us or we collect about you when you use the App – this is explained in more detail below, see ‘how we use your information‘,
• “Policy” means this privacy and cookie policy,
• “we“, “our“, and “us” mean Liverpool ONE Management Company Limited, which is the company that has created the App and makes the App available to you to download and use.

Use the links below to navigate quickly to parts of this Policy that we think you might be interested in:

• Our contact details if you want to ask us any questions or exercise your rights
• Information you provide to us when you use the App
• Information we will collect as you use the App
• How we use your Information
• Marketing and opting out
• Keeping your data secure
• Your rights
• Use of cookies and other in-app permissions

The App contains links to our website. Please note that if you follow these links then our website, and any services provided through it, has its own privacy policy and terms and conditions. Your use of the App is governed by this Policy and the terms and conditions displayed to you in the App. Please ensure that you review the relevant privacy policy and terms and conditions prior to providing any personal data to us, or using our website and services.

2. Who we are and contacting us

We are a data controller of your Information and this means that we are responsible for looking after it. We will use your Information fairly and in accordance with the law, including the Data Protection Laws. We also aim to be clear to you in this Policy about how we use it.

We take your privacy very seriously. Please read this Policy carefully as it contains important information about how we will use your Information and how we will meet our obligations to you under the Data Protection Laws.

> Our company information and registration as data controller:

Liverpool ONE Management Company Limited is registered in England with company registration number 06444922 and registered office address: York House, 45 Seymour Street, London, W1H 7LX. We are registered as a data controller with the Information Commissioner’s Office with registration number Z196129X.

> Our contact details if you want to ask us any questions or exercise your rights:

If you have any questions about this policy or generally about how your Information is processed by us please contact our Data Protection Officer by email at data@liverpool-one.com or write a letter to The Data Protection Officer, Liverpool ONE Management Company Limited, 5 Wall St, Liverpool L1 8JQ.

3. Information we may receive about you

After you have read about the Information we receive about you, please read ‘how we use your information‘ for more detail about what we do with your Information.

• Information you provide to us when you use the App

We will receive your name, email address, date of birth, gender and postcode when you fill in the form in the App to create an account. You will also need to create a username when you create an account.

We will also ask you for your marketing preferences. We will take a note of whether or not you agree to receive our newsletter or other marketing from us and the date and time when you gave us your preference. If you are under 16 years of age you cannot agree to us sending you marketing and we will not provide you with marketing – we explain this further below. See ‘marketing and opting out’

We may keep copies of your Information when you make contact with us or we have contact with you.

• Information we will collect as you use the App

Cookies

We may monitor your use of the App through the use of cookies and similar tracking technology. We explain our use of cookies below. See ‘use of cookies and other in-app permissions‘.

Location data

We collect information that tells us your location using GPS technology, including where you used the App to interact with a feature in our App (for example, scanning a marker to collect eggs or energy boosters to build up your points), how many times you visit Liverpool ONE and the time you spend at Liverpool ONE.

Some of the features of the App will require your location data to work. You will be asked to consent to providing your location data to us if you would like to use the features in the App that need your location data (for example, the “you are here” feature to pinpoint your location in relation to markers that you can scan to build up your points). You can withdraw your consent to sharing your location data with us at any time by turning off location services in the settings in your mobile device, however if you do not consent to sharing your location with us, then unfortunately some of the features of the App will not work.

Mobile device information and information based on your use of the App

We collect Information about your mobile device each time you use the App. For example, we may collect Information on the brand and type of your mobile device and the mobile operating system that you are using. See ‘how we use your information’.

We may also collect Information about how you use the App. For example, we may collect statistics on how many photographs or videos you take while using the App.

4. How we use your information

The main reason why we use your Information is to provide you with an augmented reality experience created and hosted by us at Liverpool ONE. By using our App, users can build up points as they move around Liverpool ONE collecting dinosaur eggs, participating in dinosaur battles and collecting food for their dinosaur. Users appear on a leader board with other users of the App based on how many points they have collected by using the App.

We also use your Information for the following purposes:

• to help us identify you and the account you create when you use the App;
• administration of your account, for example, if you forget your password;
• research, statistical analysis and behavioural analysis to assess:
  • if this campaign influences visitor numbers to Liverpool ONE;
  • the popularity of the App and if we might run another campaign of this nature in the future;
  • if the App appeals to both male and female users so that we can develop our future apps to appeal to a wide audience; and
  • if the App has enriched the experience of those visiting Liverpool ONE;
• aggregating and anonymising your Information to enable us to analyse users’ use of the App (and ‘your rights‘ still apply to the process we carry out to aggregate or anonymise your Information, but do not exist once we can no longer identify you from this data), for example, anonymising postcodes to understand where the majority of our visitors come from to assist us with assessing how well we engage with individuals outside of the local area;
• to optimise the user experience of the App (for example, moving markers that are not being scanned by users);
• marketing, including customer profiling to understand if our marketing is relevant to those attending Liverpool ONE – see ‘marketing and opting out’;
• improving our advertising at Liverpool ONE;
• to verify that you are over 16 years of age if you choose to opt in to receive marketing from us;
• to notify you of any changes to the App or to our services that may affect you;
• providing support for different mobile devices; and
• assessing which mobile operating systems are most popular to inform future mobile application developments.

You may take photographs and videos when you use the App. We do not store any of the photographs or videos you take when you use the App. Photographs and videos remain on your mobile device, unless you choose to share these via social media or any other third party using features outside and not connected with the App.

Marketing and opting out

Anyone under 16 years of age cannot agree to receive marketing from us without their parent’s consent.

If you are over 16 years of age and have given us your consent to receive our newsletter or other marketing communications, we may contact you by email about offers (for example, discounts at restaurants or shops), events and competitions at Liverpool ONE because we think that this information may be of interest to you. We do not share your Information with any third parties and any offers, events or competitions are chosen by us and sent to you by us directly (and not sent by a third party). We may monitor user engagement with the marketing emails that we send out. When we send you an email we keep a record of whether you opened the email, for the purposes of understanding if you are engaging with our marketing communications.

If you decide at any time that you do not want to receive any marketing from us, you can opt out at any time. See ‘your rights’.

Lawful basis for using your information

We can only process your Information if we have a “lawful basis” to do so. The Data Protection Laws set out a number of lawful bases, and we’ve set out below those that we may rely on when we process your Information.

Legitimate interests
We may rely on our legitimate interests to process your Information provided that we have carried out a balancing test to assess our legitimate interests in using your Information against your interests and rights under the Data Protection Laws. We may process your Information based on our legitimate interests where we have determined, acting reasonably and considering the circumstances, that we have a legitimate interest to do so, which does not outweigh your interests and rights under the Data Protection Laws, and provided always that we are able to process your Information in accordance with the Data Protection Laws.

Consent
We may rely on your consent to process your Information and you will be notified by us when we intended to do so. You have the right to withdraw your consent to processing of this nature at any time by contacting us using the contact details provided at the beginning of this privacy policy. See ‘ Our contact details if you want to ask us any questions or exercise your rights’.

5. Disclosure of your information

We may disclose your information to:

• • a third party who acquires Liverpool ONE Management Company Limited or acquires substantially all of its assets, in which case the Information will be one of the acquired assets;
  • our developers who may access our servers to fix issues with the App;
  • our third party hosting provider; and
  • our third party marketing platform provider. See ‘marketing and opting out‘; and
  • law enforcement and regulatory agencies in connection with any investigation to help prevent unlawful activity or as otherwise required by applicable law.

Transfers outside of the European Economic Area
Transfers to the United States
The Information which we collect about you may be transferred outside the European Economic Area for the purposes of providing marketing to you. Specifically, your Information may be transferred to The Rocket Science Group LLC who is based in the United States and which is a country that the European Commission has deemed to have adequate data protection practices in place under the EU-US Privacy Shield decision. A copy of the decision can be found here.

6. Keeping your information secure and how long do we keep it for?

We use a variety of measures to protect your information and these include:

• access to your account is controlled by a password and username that are unique to you;
• we store your Information on secure servers provided by our third party hosting provider that are dedicated to us and for our own use (except if we share your Information with a third party. See ‘disclosure of your information‘);
• our servers are maintained to ensure that the latest patches are installed as they are released;
• your Information is protected by a firewall with identity based access control;
• regular penetration testing is carried out on our servers (which may be carried out by a third party on our behalf);
• an annual security audit is performed on our servers and these are continuously monitored using anti-virus software;
• your Information is backed-up daily; and
• the data centre containing our servers is manned 24 hours a day, 7 days a week, 365 days a year by security guards and is protected by multiple physical and electronic security systems including 2.8m prison fencing, CCTV and multi-factor access control systems.

Our third party marketing platform provider uses a variety of measures to protect your Information and these include:

• the servers are protected by physical security 24 hours a day, 7 days a week with biometric scanners;
• our passwords to access the marketing platform are hashed (meaning the original password is stored and a series of characters are used in its place, so the original password is kept secret);
• the marketing platform is encrypted; and
• performing regular external security penetration tests throughout the year.

While we will take great care to protect your Information, you acknowledge that using the internet is not completely secure and for this reason we cannot guarantee the security or integrity of any Information that are transferred from you or to you via the internet; any transmission is at your own risk.

7. How long do we keep your information for

Your account Information
If you create an account, we will delete your account (including the Information you provided to us when you set up your account) at the end of the campaign associated with this App, except that we may keep your name and email address for up to six years after the campaign for the purposes of dealing with any issues or concerns you may have about how we handled your account, and also to allow us to bring or defend legal proceedings.

Marketing
If you receive marketing from us, we will continue to send you marketing for a period of 12 months from the last time you opened a marketing email from us. If you do not engage with our marketing for a period of 12 months we will add your email address to a suppression list (see below).

If you do not opt in to receive marketing from us we will add your email address to a suppression list so that we do not include your email address within our mail shots.

Your Information that we aggregate and anonymise in reports
We may keep Information that we have aggregated and/or anonymised by creating statistical reports and analysis based on how users use the App. The information contained in these reports cannot identify you and we may use and share this information as we choose to.

8. Your rights

You have a number of rights under the Data Protection Laws as a result of us processing your Information. We have listed these below and explained them in more detail under each heading.

To exercise any of your rights, please use the contact details at the beginning of this Policy. See ‘Our contact details if you want to ask us any questions or exercise your rights‘.

There may be cases where we may be unable to carry out your request. If this is the case, we will write to you to explain why.

You have the right to request access to your personal data
You have the right to ask us to confirm that your personal data is being processed and any other information about how we process your personal data. You can also ask us for access to a copy of your personal data.

You have the right to ask us to correct any errors in your personal data
You have the right to ask that we correct your personal data if it is inaccurate or incomplete.

You have the right to ask us to erase your personal data
You have the right to ask us to erase or delete your personal data where there is no reason for us to continue to process your personal data. This right applies if we no longer need to use your personal data to provide the App to you, where you withdraw your consent, or where you object to the way we process your personal data.

You have the right to withdraw your consent
You have the right to withdraw your consent if we are relying on it to use your personal data.

You have the right to object to us processing of your personal data
You have the right to object to our processing of your personal data on the basis of our legitimate business interests, unless we are able to demonstrate that, on balance, our legitimate interests override your rights or we need to continue processing your personal data for the establishment, exercise or defence of legal claims.

You have the right to ask us to restrict or block the processing of your personal data
You have the right to ask us to restrict or block the processing of your personal data that we hold about you. This right applies where you believe the personal data is not accurate, you would rather we block the processing of your personal data rather than erase your personal data, where we don’t need to use your personal data for the purpose we collected it for but you may require it to establish, exercise or defend legal claims.

You have the right to port your personal data
You have the right to obtain and reuse your personal data from us to reuse it for your own purposes across different services. This allows you to move personal data easily to another organisation, or to request us to do this for you.

You have the right not to be subject to automated decisionsYou have the right to object to any automated decision making, including profiling, where the decision has a legal or significant impact on you. We do not make any automated decisions based on your personal data.

• Complaints

If you have any concerns regarding how we process your Information, or if you are not satisfied with how we handle any request you make, or would like to make a complaint of any kind, please contact our Data Protection Officer in the first instance. See ‘ Our contact details if you want to ask us any questions or exercise your rights’.

You can also contact the Information Commissioner’s Office at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF or via its website at www.ico.org.uk.

9. Use of cookies and other in-app permissions

A cookie is a small text file which is placed onto your mobile device (or other electronic device) when you access our App. We use cookies on our App to:

• recognise you whenever you visit the App (this speeds up your access to the App as you do not have to log on each time);
• store information about your use of the App (including as you interact with features in the App to build up points, for example); and
• make your online experience more efficient and enjoyable.

In most cases we will need your consent in order to use cookies in the App. The exception is where the cookie is essential in order for us to provide you with a service you have requested.

For more information on cookies and how they work please visit www.allaboutcookies.org.

• Consent

When we ask you to create an account or log-in for the first time, we request your consent to placing cookies on your mobile device.

• Description of cookies and in-app permissions

The table below is designed to provide more information about the cookies we use and why:

• How to turn off cookies

If you do not want to accept cookies, you can change the settings in your mobile device so that cookies are not accepted. If you do this, please be aware that you may lose some of the functionality of the App. For further information about cookies and how to disable them please go to: www.aboutcookies.org or www.allaboutcookies.org.

9. Changes to this privacy policy

We may change this Policy from time to time and may update you from time to time, and as and when required to do so, in respect of the changes we make to this Policy.