Dundrum Town Centre Management Limited (we) are committed to protecting any personal data you provide to us, including information you provide or we collect when you use our digital channels.

 We believe it is important for you to know what personal data we collect and how we use it. This policy (together with our terms and conditions and any other documents referred to in it) explains the personal data we process, what it is used for and the legal basis upon which we process this information. It also explains legal rights you may have to control that processing.

About us and how to contact us

Dundrum Town Centre Management Limited are part of the Hammerson Group, and both Dundrum Town Centre and other Hammerson group companies, including Hammerson Group Management Limited are data controllers in respect of your data.

Our contact address is 6th Floor, 2 Grand Canal Square, Dublin 2. If you have any specific issues relating to this privacy policy, would like a list of Hammerson group companies who may process your data, or any wider privacy issues relating to us, please get in touch via our Contact Us page or by sending an email to dataprotectionofficer@hammerson.com

What personal data do we process

We process the personal data set out below, provided to us by either you or your device when accessing our website. There is no obligation on you to provide the information listed below; however, if you do not, we may be unable to engage with you, open an account for you, send you the materials you have if we do not have the necessary information to do so.

The type of data that we process about you includes: Information you have given to us by filling in forms including name and email address.

Information we collect from you when you use our website, including:

(a) Visitor data and analytics on how you interact with our website.

How we use it

Sending marketing messages or otherwise engaging with you. We use your data to send you marketing information by email, other marketing materials to enhance and support your relationship with Ironworks Dundrum. We will use this data in accordance with any preferences you have selected, either on the basis of consent (where requested) or of legitimate interests where you have not objected to receiving such information.

We may also use your data for our own legitimate interests, which include:

• sending you surveys or supporting Marketing Research activities to you in other ways to help us improve our services and understand our customers better;

• ensuring that content from our digital channels is presented in the most effective manner for you and for your computer/smart phone and/or tablet; allowing us to investigate and respond to any issues or correspondence received;

• notifying you about changes to our services.

We believe that these interests are justified as it is completely optional for you to register, participate or otherwise provide us with Personal Data in the above situations. You will be able to object to this processing at any time. For more information, please see Your rights below.

Geolocation and Device and Website Use

We Device and Website Use information to improve the effectiveness and operation of the website, to improve our existing services and develop new services and to inform and direct our marketing strategy.

We will also use this information for system administration. This is anonymised statistical data about our users' browsing actions and patterns and to help us to improve our site and to deliver a better and more personalised service. They enable us:

• To estimate our audience size and usage pattern.

• To store information about your preferences, and so allow us to customise our site according to your individual interests.

• To speed up your searches; and

• To recognise you when you return to our site. For more information, please see our Cookie Policy.

Data processed where it is necessary for compliance with a legal obligation imposed on us.

We will process your personal data to allow us to comply with any requests you are lawfully entitled to make, including under data protection laws, to ensure that age inappropriate content is not provided to individuals under 18, and to allow us to keep records that we are legally required to retain, including evidence of consents provided, or to evidence our compliance with legal obligations.

How long will we hold your information

We will normally retain your personal data is for a period of up to 7 years from the latter of:

• the last date you logged into our website or used our App; or

• when you unsubscribe from receiving marketing from us (if later); unless we are legally required to retain the information for longer. However, we may delete your data sooner if we have no purpose to retain it.

We will retain your details if you have unsubscribed from marketing to ensure that we respect your withdrawal of consent on an ongoing basis.

Who will we share your personal information with

We will share your personal data within the Hammerson group of companies (including our subsidiaries, our ultimate holding company and its subsidiaries (if applicable)), for the purposes outlined above, including for our own internal business management and the provision of efficient centralised services within our group, where this occurs, they will comply with a privacy notice comparable to this one, unless they provide you with an alternative privacy notice. For further details of the Hammerson group of companies, please visit: https://www.hammerson.com/property/.

We also use third party service providers acting on our instructions to support our provision of the website or our services to you, who are specifically contracted to process personal data on our behalf. We may share your personal data, where necessary, with prospective purchaser(s) or purchaser of any part of our business, on the basis of our legitimate interests and the interests of our purchaser, so that they can appropriately value the business and assess any risks and continue doing business with you after the acquisition.

We will also share your personal data where:

(a) you have provided prior explicit consent;

(b) where we are required by law, including any court order;

(c) where necessary to protect you, the Dundrum, its customers or the wider public.

Where will your personal data be held

We may store or process your personal data outside the European Economic Area (EEA) or other countries approved by the European Commission as providing appropriate safeguards for personal data, when we use service providers located in those countries. If this is the case, we will put in place appropriate safeguards to protect your personal data and ensure that it is compliant with all appropriate legal requirements. Similarly, at the end of the Transition/Implementation Period, when the United Kingdom ceases to be subject to European laws including the GDPR, we will ensure that the protections referred to above will apply to any such transfers from the EEA to the United Kingdom in such an event. If you require further information in respect of the countries where your personal data is processed and/or copies of any documents setting out the appropriate safeguards we have implemented to protect it, please contact us.

Other Sites

Our digital channels may contain links to other sites on the Web. These other sites are not covered by this privacy policy and although we are committed to protecting your Personal Data, we cannot control and do not accept any responsibility or liability for the privacy practices, cookies or content of such other websites. We encourage you to read the privacy statements of each and every website that collects your Personal Data.

You are solely responsible for maintaining the secrecy of your passwords and other account information, and we cannot take responsibility for any damage arising from any disclosure of your password or access to your email account by other parties.

Your rights

Customer Data Deletion Process

Users may request deletion of their account and data at any time by contacting us at dataprotectionofficer@hammerson.com stating Data Deletion in the subject line. Please ensure the email address you have used to register your account is included in the message. Your data and customer account will be deleted within 30 days and you will be notified by email.

If you wish to withdraw your consent to receive marketing materials, this can be done by:-

• emailing us at dataprotectionofficer@hammerson.com

• updating your preferences on your online account; or

• by clicking on the unsubscribe link on any emails we have sent.

If you withdraw your consent, this will not affect our rights to have sent you marketing material prior to your withdrawal, but we will not send any further marketing. Whilst we will endeavour to ensure that you do not receive any further marketing material immediately, there may be a slight delay for any changes to take effect. Please note that your information will not be deleted but will be retained in a suppression list to ensure that we do not inadvertently send further marketing communications once you have withdrawn your consent to receive them.

Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you log on to our site.

If you do not wish us to process your Geolocation and Device and Website Use information, you may prevent this by disabling the function or blocking the cookies on your device or browser. However, if you select this setting you may be unable to access certain parts of our site, or it may impact on the usability of our website and/or App.

For further information on how to do this, please visit http://www.allaboutcookies.org/. You are also entitled to request that we:-

• provide you with a copy of any personal data we hold about you,

• provide you with a copy of any of your personal data, provided by you, that we hold in an electronic format, in a structured, commonly used, machine-readable format;

• have any incorrect personal data corrected or completed ( you can also update your records using your profile on your online account);

• delete any personal data that we no longer need for the above purposes, where you have withdrawn your consent and there are no other grounds to process that information, where the personal data has been unlawfully processed or where we are required by law to delete it; and

• restrict the processing of your personal data whilst we confirm whether any data needs correcting following your request, the processing is unlawful and you do not want us to delete this personal data; where we no longer need to process the personal data, but you require the information to establish, exercise or defend legal claims. In these circumstances we will only process your personal data for purposes for which you have consented, or for the establishment, exercise or defence of legal claims or the protection of the rights of another person; and/or

• object to our processing of your personal data, where we process it under the legitimate interests grounds and we are unable to show a compelling legitimate interest that overrides your interests, rights and freedoms, or for the purposes of defending, exercising or defending legal claims.

If you wish to make such a request, please use either our Contact Us page or email dataprotectionofficer@hammerson.com

We may require additional information to either confirm your identity before we can process your request and/or to assist us in responding to your request.

If you are unhappy with the outcome of your request or with our processing of your personal data, you are entitled to lodge a complaint with the Data Protection Commission’s Office (DPC), whose website is https://www.dataprotection.ie.

Modifications of this policy

We may revise this Privacy Policy from time to time. If we make any changes to this privacy policy that may materially impact on you or our processing of your personal data, we will notify you by email (sent to the email address specified in your account) or by means of a notice on our website prior to the change becoming effective. Date of last change 29 January 2020.

Any questions, comments and requests regarding this privacy policy are welcomed and should be addressed via our Contact Us page or directly by email to dataprotectionofficer@hammerson.com