App Privacy Notice

Introduction to privacy notice

This is the privacy notice for Outernet London’s companion app and describes how we process your personal data when you visit us or use our app. It may be updated from time to time and users should check periodically.

Outernet London Limited is a company registered in England and Wales with registration number 13634371. Outernet London is also registered with the UK Information Commissioner’s Office (ICO) under registration number ZB267944.

We respect your rights to data protection and privacy and this notice provides details of what personal data we collect, what we use it for, who we share it with and the rights you have under data protection legislation, which means the UK Data Protection Act 2018 (DPA 2018), the UK General Data Protection Regulation (UK GDPR) and the Privacy and Electronic Communications (EC Directive) Regulations 2003.

Contact details

If you have any questions about this privacy notice or how we process your personal data you can contact our Data Protection Officer by any of the following methods:

• Telephone: +44 20 7494 0494

• Email: [email protected]

• Post: Outernet London, 26 Soho Square, London, W1D4NU

If you are not happy with how we respond to your request, you can contact the ICO via their website https://ico.org.uk/make-a-complaint

The remainder of this policy provides details of:

• The personal data we collect or create

• Personal data you give to third parties

• Who we share your personal data with

• Other features of the companion app

• When you visit Outernet London

• Our approach to data retention

• Your rights under data protection legislation

• Security of your data

• The Children’s Code.

The personal data we collect or create

When you use our companion app

When you download the companion app from the store a unique identifier is created for your device, and we record this along with your location and use these data points to enhance your enjoyment of the District by:

• Providing wayfinding information relevant to your location

• Sending you relevant content and/or communications, endeavouring to ensure that these are relevant to your location

• Facilitating interaction with events for example via QR codes.

The creation and our use of this unique identifier is based on you giving your consent when you download the app to your mobile device.

To enjoy the full functionality of the companion app you need to create an account. The information we collect when you do so is limited by what you share with us and, in any case, to your:

• Email address

• First and last names

• Date of birth

Your date of birth, if you share it with us, is used to inform content decisions across all media that we use and will help us to tailor the live experience.

When you create your account, you will be asked for your marketing preference which, once set, can be changed by you through your account on the companion app. You will also be able to unsubscribe at any time by using the link that will be in any emails we send you.

The use of your personal data in your account profile is based on you giving your consent when you provide it.

Personal data you give to third parties

When you purchase tickets for events and major activations

Through the Discover section of the companion app you can find out about upcoming events and major activations, which will include links to buy tickets from our ticketing partners. Any information you provide during the purchase of tickets will be subject to the individual ticketing partner’s privacy notices and will not be shared with us.

You can sign up to receive offers and exclusives from the neighbourhood’s restaurants. This is done through their websites and any personal data you choose to share with them will be covered by their privacy policy.

When you make retail purchases

The Discover section of the companion app will provide details of, and links to, the on-screen campaigns being run by our retail partner organisations. When you click on the link it will take you to the website of the partner running the campaign, where you can then complete the purchase. Any information you provide for purchases will be subject to the retail partner’s privacy notices and will not be shared with us.

Who we share your personal data with

We use key suppliers to provide our core services and these are shown in the table below.

Outernet may share your personal data if required to do so by law and only if it is strictly necessary. We do not sell or otherwise share your personal data with any other third party.

Other features of the companion app

Charitable giving

If you have signed up for an account on the companion app you will be able to read about the charities that Outernet supports, via its charitable foundation ADOT. ADOT will offer you the option to sign up to receive their newsletter which contains more detail about their work and may include invites to their events. ADOT does not share your contact details with Outernet.

When you visit Outernet London

Our CCTV system

We operate CCTV within the public areas of Outernet London for two main purposes:

• Security and safety – this includes crowd management and the recorded footage is retained for 90 days unless required for evidential purposes. The lawful basis for this processing is our legitimate interests

• Proof of play – these cameras are focused on our main screens to record what is being played and is not processing the personal data of visitors to Outernet London. The footage is kept for 90 days, which is an Ofcom requirement to which Outernet London has chosen to align.

• Streaming of performances at designated ‘busker’ spots. The lawful basis for this processing is our legitimate interests.

• Investigation of property damage. The lawful basis for this processing is our legitimate interests.

• Determining visitor numbers - visitors we have per day, and any variation driven by day of week and content type. The lawful basis for this processing is our legitimate interests.

Our approach to data retention

Outernet London will only retain your personal data for as long as we have a relationship with you or because there is an external requirement for us to do so, for example, for accounting or legal reasons.

Your rights under data protection legislation

You have several rights, which are described below, and these depend on the nature of the processing that we are doing.

• Right of access – you can request that we provide you with a copy of your personal data that we hold, which is commonly referred to as a subject access request, what we are doing with it, who we are sharing it with and where we obtained it

• Right to rectification – you can ask us to correct or complete any information that is inaccurate or incomplete

• Right to erasure – you can request that we erase your personal data., also known as the right to be forgotten. It is important to note that this is not an absolute right and there are some circumstances in which it does not apply

• Right to restriction of processing – You can ask us to restrict the processing of your personal data in some circumstances

• Right to object to processing – You can object to us using your personal data at any time. Again, this only applies in certain circumstances, and we may have a legitimate reason to continue to use your personal data

• Right to data portability – this right only applies to personal data that you have given us and where it is being held in electronic form

To exercise your rights under data protection legislation you should contact us using the information given in the contact details section of this privacy policy.

Security of your data

Outernet London takes seriously the security of any personal data that you provide to us and has implemented appropriate technical and organisational measures to protect it from unauthorised access, misuse or compromise.

The Children’s Code

Our view is that it is not likely that our companion app and its associated services will be accessed by children. This, coupled with the fact that our overall collection and processing of personal data is low risk, means that we have not explicitly applied the requirements of the ICO’s Age Appropriate Design Code. We are keeping this decision under regular review and, if there is evidence to suggest our approach is no longer valid, we will take steps to comply with this important statutory code of practice.