Privacy Policy

We will collect personal information about you from a variety of sources, including information we collect from you directly (e.g. when you contact us) and information we collect about you from other sources, described below.

Note that we may be required by law to collect certain personal information about you, or as a consequence of any contractual relationship we have with you. Failure to provide this information may prevent or delay the fulfilment of our obligations. We will inform you at the time your information is collected whether certain data is compulsory and the consequences of the failure to provide such data.

1.11. When you visit our websites the web server collects some basic information such as your browser type, MAC or IP address, internet service provider’s domain name, which pages you accessed on the site, and when. Details of cookies that we use on our websites can be found in our Cookie Notice.

1.12. Where you sign up for a newsletter, fill out a feedback form, complete a “contact us” form or enter a competition or promotion we may collect personal information such as your email address, name, contact number, and date of birth. Not all fields are mandatory, and provision of the information is optional but if you provide less information this may limit your use of our online services. Where you enter into a competition or promotion we may share your details with the retailers to which the competition relates where necessary for the purposes of fulfilling a prize or experience at that venue. This will be made clear to you at the time you sign up to the competition or promotion.

1.13. When we send emails to you, we review whether these have been opened and whether you have clicked on any links within these.

1.14. We operate free visitor Wi-Fi services at Central Saint Giles within the Ground Floor reception area and public Piazza, provided via a third party. The Wi-Fi provider does not collect personal information about the user, such as name or email address.

1.15. We occasionally take and display photos and videos of members of the public at our events and retailers for use on our social media channels. Where we do so, we inform members of the public of this possibility through the signs placed around the centre or building, and terms and conditions copy on our event listings. We use model release forms for photography intended for paid advertising purposes.

1.16. We operate CCTV at Central Saint Giles for our legitimate interests of maintaining security and public safety, dealing with disputes, crime prevention and prosecution, insurance, and property management. We only use CCTV footage for these purposes. Any areas where CCTV monitoring is in place will have clear notices setting this out. We only release footage following a warrant or formal request from law enforcement, or as necessary in relation to disputes. CCTV footage is retained for up to 28 days.

1.17. We capture personal data within the system which controls access to our buildings. This comprises personal data of people who work in a building and those who visit it and includes name, occupation, employer and contact details. In relation to access control and visitor data where the data relates to us, we consider ourselves to be the data controller. Where the personal data relates to our tenants’ staff, contractors or visitors, our tenants may also be data controllers depending on the circumstances.

1.18. CBRE Limited UK provides property management services for Central Saint Giles and collects data on accidents, in order to comply with health and safety legislation. If you have an accident at Central Saint Giles, or make a claim against us, we will record any relevant information about the incident or claim, which may include your name, contact details and health information about you. This information is stored and used only for our legitimate interest in properly dealing with disputes and for the defence of legal claims (including potential legal claims). It may be provided to our insurers or professional advisors as necessary for that purpose. We keep this information for six years from the date of the incident, or, where the incident involves a child (and the period is longer) until the child involved reaches the age of 24.

1.19. Where you work for a commercial tenant in the building, we may be provided with your contact details by your employer if we need to liaise about estate management matters.

We use your personal information to:

• Provide and personalise our services;
• Deal with your enquiries and requests;
• Comply with legal obligations to which we are subject and cooperate with regulators and law enforcement bodies;
• Contact you with marketing and offers relating to products and services offered by us and/or other members of our group (unless you have opted out of marketing, or we are otherwise prevented by law from doing so);
• Personalise the marketing messages and offers we send you to make them more relevant and interesting;
• To contact you for research purposes, where you have consented to us doing so, in order to understand what you think of our sites and how we can improve them;
• Maintain the quality of our websites and to analyse the use of our websites in order to help guide improvements;
• To better design and optimise our properties to improve the experience of our consumers;
• Drive our insights, research and data analytics programme. This is used for research, analysis, testing, monitoring, risk management and administrative purposes and to develop our business, inform business decision making and support the purposes identified elsewhere in this section by collecting statistics, traffic patterns, information on the movement around our centres and other buildings, demographics, customer satisfaction, geographic catchment, shopper analysis, retail mix, centre and building performance including footfall and identifying shopping trends; and
• We contract with third parties which in certain circumstances will be controllers of your personal data and responsible for managing it properly and in others will be processors who deal with your personal data in accordance with our instructions. Whether a third-party supplier (who is not us) is a processor or controller of your personal data depends on the facts and where we appoint a third-party processor of your personal data, we will put a framework around what we expect them to do with it and how they manage it.

We must have a legal basis to process your personal information. In most cases the legal basis will be one of the following:

• To fulfil our contractual obligations to you, for example to fulfil the terms of a competition or promotion that you have entered or to provide you with information you have requested;
• To comply with our legal obligations to you, for example health and safety obligations while you are on our premises, or to a third party (e.g. the police); and
• To meet our legitimate interests, for example to understand how you use our services and our centres and other buildings and to enable us to derive knowledge from that which in turn enables us to develop new services and further tailor our centres and other buildings to appeal to a wide variety of persons. When we process personal information to meet our legitimate interests, we put in place robust safeguards to ensure that your privacy is protected and to ensure that our legitimate interests are not overridden by your interests or fundamental rights and freedoms.

We may obtain your consent to collect and use certain types of personal information when we are required to do so by law (for example, in relation to our direct marketing activities, Cookies or when we process sensitive personal information). If we ask for your consent to process your personal information, you may withdraw your consent at any time by contacting us using the details at the end of this privacy notice.

You have certain rights regarding your personal information, subject to local law. These include the following rights to:

• Access your personal information
• Rectify the information we hold about you
• Erase your personal information
• Restrict our use of your personal information
• Object to our use of your personal information
• Receive your personal information in a usable electronic format and transmit it to a third party (right to data portability)
• Lodge a complaint with your local data protection authority.

If you would like to discuss or exercise such rights, please contact us at the details below.

We encourage you to contact us to update or correct your information if it changes, or if the personal information we hold about you is inaccurate.

We will contact you if we need additional information from you to honour your requests.

As well as any sharing we have described above, we may also share your information with third parties, including our ground companies, CBRE Ltd and other third-party service providers. We require third parties to respect the security of your personal information and to treat it in accordance with the law. We never sell your data to third parties.

We may share your personal information with third parties under the following circumstances:

• Service providers and business partners. We may share your personal information with our service providers and business partners that perform marketing services and other business operations for us. For example, we may partner with other companies to process secure payments, fulfil orders, optimize our services, supply free wi-fi services, send newsletters and marketing emails, support email and messaging services and analyse information.
• Central Saint Giles work closely with other businesses and companies that fall under the CBRE UK Ltd family. We may share certain information about you with other CBRE UK Ltd companies for marketing purposes, internal reporting and in order to carry out the purposes listed in this notice.
• Law enforcement agency, court, regulator, government authority, insurer or other third party. We may share your personal information with these parties where we believe this is necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights or the rights of any third party or to put in place insurance.
• Asset purchasers and joint venture partners. We may share your personal information with any third party that purchases one or more of our properties or the companies with which we might jointly own a property.
• We may share non-personally identifiable information with third parties such as partners, customers, tenants and suppliers, for example to show trends on the use of our properties.

All our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal information for their own purposes unless you have agreed that they may do so or unless they are acting as a controller of your personal information. We only permit our third-party service providers them to process your personal information on our behalf for specified purposes and in accordance with our instructions.

Because we operate as part of a large business, the recipients referred to above may be located outside the jurisdiction in which you are located (or in which we provide the services). See the section on “International Data Transfer” below for more information.

We implement technical and organisational measures to ensure a level of security appropriate to the risk to the personal information we process. These measures are aimed at ensuring the on-going integrity and confidentiality of personal information. We evaluate these measures on a regular basis to ensure the security of the processing.

We will keep your personal information for as long as we have a relationship with you. Once our relationship with you has come to an end, we will retain your personal information for a period of time that enables us to:

• Maintain business records for analysis and/or audit purposes or risk management purposes;
• Comply with our business record retention requirements;
• Defend or bring any existing or potential legal claims; and
• Deal with any complaints regarding the services.

We will delete your personal information when it is no longer required for these purposes. Your personal information will be retained in compliance with our obligations under the Data Protection Act 2018 (and any other applicable legislation), any statutorily prescribed data retention periods and in accordance with our data retention policy.

Your personal information may be transferred to, stored, and processed in a country that is not regarded as ensuring an adequate level of protection for personal information under European Union law / by the European Commission. Where this is the case, we have put in place appropriate safeguards (such as contractual commitments) in accordance with applicable legal requirements to ensure that your data is adequately protected. For more information on the appropriate safeguards in place, please contact us at the details below.

Your personal information may be transferred to, stored, and processed in a country that is not regarded as ensuring an adequate level of protection for personal information under European Union law / by the European Commission. Where this is the case, we have put in place appropriate safeguards (such as contractual commitments) in accordance with applicable legal requirements to ensure that your data is adequately protected. For more information on the appropriate safeguards in place, please contact us at the details below.

Any questions? Please contact us at: info@centralsaintgiles.com

Google UK Limited, company number 03977902, whose registered office is at 1 St. Giles High Street, London, WC2H 8AG, United Kingdom.

Google UK Limited is the data controller responsible for the personal information we collect and process (save in circumstances where we specify otherwise).

If you have questions or concerns regarding the way in which your personal information has been used, please contact info@centralsaintgiles.com.

We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy. If, however, you believe that we have not been able to assist with your complaint or concern, you have the right to complain to the data protection authority in your country (the Information Commissioner in the UK).

For independent advice about data protection and privacy, please contact the ICO. The ICO oversees how businesses and organisations comply with data protection legislation in the UK:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 0303 123 1113 / 01625 545745
Email: casework@ico.org.uk
Website: https://ico.org.uk

You may request a copy of this privacy notice from us using the contact details set out above. This privacy notice is effective from and including 18 May 2026.

It may vary from time to time so please check it regularly.