Privacy Policy

1. Who We Are

This Privacy Policy explains how Hempstead Valley LLP, trading as Hempstead Valley Shopping Centre (“we”, “us”, “our”), collects, uses and protects personal data when you use our website at www.hempsteadvalley.com (“the Site”) or contact us directly.

We are the Data Controller for the personal data described in this policy. Hempstead Valley LLP is registered with the Information Commissioner's Office (ICO). The property is managed on our behalf by MAPP (Property Management) Limited.

Contact details:

• Registered company number: OC426327

Contact us about this website or data protection:

• Email: info@hempsteadvalley.co.uk

• Telephone: 01634 387 076

• Post: Hempstead Valley Shopping Centre, Gillingham, Kent, ME7 3PD

2. What Personal Data We Collect

We collect personal data in the following ways:

a) Newsletter Subscriptions

When you sign up to our newsletter, we collect:

• Your name

• Your email address

• Your postcode

b) Contact Form Enquiries

When you submit an enquiry via our contact form, we collect the personal data you provide, which may include your name, email address, telephone number and the content of your message.

c) Website Usage Data (Analytics)

When you visit the Site, we automatically collect anonymised technical information about how you interact with the Site. This includes:

• IP address (anonymised before storage — the full IP address is never retained)

• Browser type and version

• Pages visited and time spent on each page

• Referring website or search terms that brought you to the Site

• Date and time of your visit

• Device type and operating system

No cookies are used for analytics purposes. Our analytics service operates in cookieless mode, meaning no tracking cookies are placed on your device as a result of browsing the Site.

d) Form Security Data (reCAPTCHA)

Our contact forms use Google reCAPTCHA v3 to protect against automated spam and abuse. reCAPTCHA collects browser and device information (including IP address and interaction patterns) and transmits this to Google for analysis. This processing is carried out by Google on our behalf. For more information, see Google's Privacy Policy at policies.google.com/privacy.

3. Lawful Basis for Processing

Under UK GDPR, we are required to have a lawful basis for processing your personal data. The table below sets out our processing activities and the lawful basis for each:

4. Cookies

Cookies are small text files placed on your device when you visit a website.

First-Party Cookies

We use a small number of essential first-party cookies to ensure the Site functions correctly. These may include session cookies (which expire when you close your browser) used to remember your preferences during your visit. These cookies do not collect personal data and are necessary for the Site to operate.

Analytics

We do not use analytics cookies. Our website analytics service (provided by Why Media Ltd) operates in cookieless mode — no cookies are placed on your device for the purpose of tracking or analytics.

Third-Party Cookies

Certain third-party services embedded in the Site may set their own cookies. These include:

• Google reCAPTCHA: Google may set cookies as part of the reCAPTCHA service used to protect our contact forms. These are governed by Google's Privacy Policy (policies.google.com/privacy).

• Elfsight widgets: We use an Elfsight widget (such as a social media feed) on the Site. Elfsight may set cookies to display this content. These are governed by Elfsight's Privacy Policy (elfsight.com/privacy-policy/).

You can manage or disable cookies at any time by adjusting your browser settings. For guidance, visit www.allaboutcookies.org. Please note that disabling certain cookies may affect how some parts of the Site function.

5. How We Use Your Personal Data

Newsletter Communications

We use your name, email address and postcode to send you our newsletter, which may include information about events, offers, news and promotions at Hempstead Valley Shopping Centre. We will only send you marketing emails where you have given your consent. You can unsubscribe at any time by clicking the unsubscribe link in any of our emails, or by contacting us directly.

Contact Enquiries

We use the personal data you provide via our contact form solely to respond to your enquiry and to follow up where necessary. We may retain a record of the correspondence for our legitimate operational purposes (see Section 8 for retention periods).

Website Analytics

We use anonymised analytics data to understand how visitors use the Site, identify areas for improvement, and assess the effectiveness of our content. As this data is anonymised before storage and no cookies are used, it does not identify you as an individual.

Form Security

We use Google reCAPTCHA to protect our contact forms from automated spam submissions. This involves processing browser and interaction data by Google to determine whether a submission is from a human or an automated bot.

Site Security

We may use IP address and log file data to help identify and prevent fraudulent activity and to maintain the security and integrity of the Site.

6. Sharing Your Personal Data

We do not sell your personal data. We may share it only with the following trusted third-party service providers, who act as Data Processors on our behalf and are contractually bound to process your data only on our instructions and in accordance with UK GDPR:

Mailchimp (Newsletter Distribution)

Our newsletter is distributed using Mailchimp, a service provided by Intuit Inc., based in the United States. Mailchimp processes your name, email address and postcode on our behalf for the sole purpose of sending newsletter communications. Data is transferred to the United States under the UK-US Data Bridge, an adequacy framework approved by the UK Secretary of State. You can view Mailchimp's Privacy Policy at mailchimp.com/legal/privacy.

Why Media Ltd (Website Analytics)

Our website analytics are provided by Why Media Ltd, a UK-based digital agency. Analytics data is processed and stored on Why Media's UK-based servers in fully anonymised form. Why Media acts solely as a Data Processor and does not use this data for any purpose other than providing the analytics service to us. No cookies are placed on your device as part of this service.

Google (reCAPTCHA)

Google reCAPTCHA v3 is used on our contact forms to protect against automated submissions. Browser and interaction data is transmitted to and processed by Google LLC. Google acts as an independent Data Controller for this data under its own Privacy Policy (policies.google.com/privacy). Data may be processed in the United States under the UK-US Data Bridge framework.

Elfsight (Embedded Widgets)

We use a widget provided by Elfsight to display third-party content (such as a social media feed) on the Site. Elfsight may collect visitor data in connection with displaying this content. Elfsight acts as an independent Data Controller for data processed through its platform. You can view Elfsight's Privacy Policy at elfsight.com/privacy-policy/.

MAPP (Property Management) Limited (Managing Agent)

Hempstead Valley Shopping Centre is managed on behalf of Hempstead Valley LLP by MAPP (Property Management) Limited (Company No. 03602713), registered at 180 Great Portland Street, London, W1W 5QZ. MAPP acts as a Data Processor in respect of personal data processed through the operation and management of the Site and the shopping centre. MAPP is itself registered with the ICO (Registration No. Z2215738). You can find more information at wearemapp.com.

Legal and Regulatory Disclosure

We may disclose your personal data where we are required to do so by applicable law, regulation, or legal process, or where disclosure is necessary to protect the rights, property, or safety of Hempstead Valley Shopping Centre, our visitors or others.

7. International Data Transfers

Your personal data may be transferred to and processed in the United States in the following circumstances:

• Mailchimp (newsletter): transferred under the UK-US Data Bridge adequacy framework.

• Google reCAPTCHA: data processed by Google LLC in the United States, under the UK-US Data Bridge framework.

All analytics data (Why Media / Matomo) is processed and stored in the UK. We will not transfer your personal data to any country outside the UK unless adequate and lawful safeguards are in place.

8. How Long We Keep Your Data

We retain your personal data only for as long as is necessary for the purposes for which it was collected:

• Newsletter subscriber data: retained for the duration of your subscription, plus 12 months following unsubscription.

• Contact form enquiry data: retained for 2 years from the date of your enquiry, or longer if the matter relates to an ongoing legal or contractual issue.

• Website analytics data: automatically anonymised on collection; aggregated reports retained for up to 26 months.

• Log files and security data: retained for up to 90 days.

At the end of the applicable retention period, personal data is securely deleted or irreversibly anonymised.

9. How We Protect Your Data

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction or damage. These measures include:

• Secure HTTPS encryption for all data transmitted via the Site

• Restricted internal access to personal data on a need-to-know basis

• Use of reputable third-party processors who maintain appropriate security standards and are subject to Data Processing Agreements

While we take all reasonable steps to protect your data, no transmission of data over the internet can be guaranteed to be completely secure. If you have any concerns, please contact us.

10. Your Rights Under UK GDPR

You have the following rights in relation to your personal data under UK GDPR. These rights are not absolute and may be subject to certain exemptions in specific circumstances.

Right of Access

You have the right to request a copy of the personal data we hold about you (a Subject Access Request). We will respond within one calendar month.

Right to Rectification

You have the right to ask us to correct personal data we hold about you that is inaccurate or incomplete.

Right to Erasure

You have the right to ask us to delete your personal data in certain circumstances — for example, if we no longer need it for the purpose it was collected, or if you withdraw consent and there is no other lawful basis for processing.

Right to Restriction of Processing

You have the right to ask us to restrict how we process your personal data in certain circumstances — for example, while a complaint or accuracy dispute is being resolved.

Right to Data Portability

Where we process your personal data on the basis of consent or for the performance of a contract, and where that processing is carried out by automated means, you have the right to receive your data in a structured, commonly used, machine-readable format.

Right to Object

You have the right to object to processing based on legitimate interests. You also have the absolute right to object to your personal data being used for direct marketing at any time.

Automated Decision-Making

We do not carry out any automated decision-making or profiling that produces legal or similarly significant effects on individuals.

Withdrawing Consent

Where we rely on consent as the lawful basis for processing (e.g. newsletter subscriptions), you may withdraw that consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

To exercise any of these rights, please contact us using the details in Section 12. We will respond within one calendar month and may ask you to verify your identity.

11. Your Right to Complain

If you are dissatisfied with how we have handled your personal data, please contact us in the first instance so we can try to resolve your concern.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk

• Helpline: 0303 123 1113

• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

12. Links to Third-Party Websites

The Site may contain links to third-party websites. This Privacy Policy applies only to our Site. We are not responsible for the privacy practices of any third-party website and encourage you to read their privacy policies before providing any personal data.

13. Children

Our Site is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child under 16 has provided us with personal data without appropriate consent, please contact us and we will delete it promptly.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the services we use, or applicable law. Any changes will be published on this page with a revised “Last updated” date. Where changes are material, we will take reasonable steps to notify you.

15. How to Contact Us

For any questions about this Privacy Policy, to exercise your data subject rights, or to raise a concern:

• Email: info@hempsteadvalley.co.uk

• Telephone: 01634 387 076

• Post: Hempstead Valley Shopping Centre, Gillingham, Kent, ME7 3PD