Purpose

Cromwell Corporation Limited (ABN 44 001 056 980) (referred to as “Cromwell”, “we”, “us” or “our”) and our related bodies corporate are committed to protecting your privacy and complying with our obligations under the Privacy Act 1988 (Privacy Act) and the Australian Privacy Principles (APP), in respect of the collection, storage, use and disclosure of personal information. This Policy sets out the principles that we adopt to manage the personal information of our tenants and their employees, service providers, agents, contractors and visitors at our properties (“you”).

This Privacy Policy outlines the following:

  • the types of personal information collected and held by Cromwell;
  • the purpose for which we collect, hold, use and disclose personal information;
  • how we collect and hold personal information;
  • how an individual may access personal information held by us and seek correction;
  • how an individual may complain about a breach of privacy, and how we will deal with such a complaint; and
  • the circumstances in which we may disclose your personal information.

This Policy applies to information provided to us whether via our websites or any other means. By accessing our websites and using our services, you consent to the use, collection, storage and disclosure of your personal information in accordance with this Policy and the Privacy Act.

Although we will comply with this Privacy Policy in respect of information provided to us by persons under the age of 18 years, those persons must obtain the consent of a parent or guardian prior to using our websites and the parent or guardian will be responsible for appropriately supervising the person’s use of the website and Wi-Fi services.

Why do we collect personal information?

We collect personal information from you when it is necessary for the purposes of providing you with our products and services and to administer our relationship with you.

Examples of why we may collect your personal information include:

  • to enter into contracts with goods or service providers to conduct our business;
  • for internal administrative purposes, such as procedural assessments, risk management, accounting, billing and product and service reviews;
  • in connection with the management of access and security at Cromwell properties generally;
  • for marketing and promotional purposes;
  • to measure and analyse shopping behaviour in order to improve our centres and the services we provide to you directly or via our business partners; and
  • to comply with our legal obligations.

What personal information do we collect and how do we use it?

We may collect and hold personal information where it is reasonably necessary to perform one or more of Cromwell’s functions or related activities, and where it is required by law.

We may use personal information we collect about you for the primary purpose of providing you with our services, and other purposes for which you would reasonably expect us to use that information.

The following are examples of personal information which may be collected:

From our Tenants and their Staff

We may collect the following types of personal information from tenants, guarantors and other individuals related to tenants during negotiations for, and during the term of, the lease/licence for premises, kiosks and other activities at its properties:

  • name, address and date of birth;
  • contact and insurance details;
  • ABNs;
  • information as to tenants’ financial standing and retailing experience; and
  • other financial and trading information.

We use this information to:

  • evaluate whether we should enter into a lease, licence or other agreement with a tenant;
  • to assist us in the preparation documentation to formalise the lease, licence or other agreement;
  • to manage our relationship with tenants in connection with the management and security of our properties; and
  • in order to monitor the performance of a property.

If it is reasonable and practical to do so, we will collect this personal information directly from the individual. We may also collect personal information from third parties such as our business partners, your representatives, or publicly available sources of information. To the extent that you provide us with personal information about another person, you warrant that you are authorised to do so.

Where in connection with an application for a tenancy we require a credit check, we will obtain your consent to this and hence may collect and share information about you with credit reporting agencies.

Occasionally, the information may also be made available to others in connection with these activities, in order for those people to provide services to us or as required by law, as well as to third parties in connection with any transactions involving the ownership of the property.

If a tenant provides us with direct debit or direct credit details, we will only disclose those details to our banks to facilitate the provision of that service.

When entering an Cromwell property, the images of tenants and their staff may be collected. This information may be used by us in connection with the management and security of our properties and may be provided to law enforcement and government bodies, insurers, Cromwell staff and subcontractors, third parties who provide Cromwell with services from time to time and other tenants for those purposes.  This information is held securely and in a format which is access controlled.

Where tenants or their employees sign up to one of our building websites (portals), we may also collect information for the purposes of maintaining our relationship with you and to provide services offered by the portal. These portals may be operated by Cromwell, or by one of our trusted business partners. For further information in relation to how these sites collect, manage and use your personal information, please refer to the Terms & Conditions and privacy information available on that site.

  • From our Agents, Contractors and Suppliers

If you, or a company you work for, supplies goods or services to Cromwell, we may collect personal information about you in connection with the provision of those goods or services, either directly from you or from that company.  This information may include your name, date of birth, contact information, and any other information you provide, or is provided on your behalf, as part of our induction and compliance processes, such as licences to use certain equipment on our premises. This information will be used by us for our business related purposes, including management of the provision of the goods or services in question.

This information will be retained by us in accordance with this Policy and only disclosed as required for our business purposes.

  • From Visitors to our properties

Cromwell, or one of our trusted business partners, may collect your personal information when you are visiting our properties in a number of different ways. These include:

  • In connection with competitions or signing up to email or mobile newsletters, customers provide us with their contact details. We collect these details to contact competition winners, and to inform customers about events, activities and promotions in Cromwell centres. Customers have the option to opt out from receiving this information.
  • When customers hire mobility aids or other equipment, or apply to use certain restricted spaces at Cromwell centres, they provide us with certain information, including contact details. We collect this information to ensure there is a record of the hirer and to enable customers to be informed about upcoming events, activities and promotions in Cromwell centres.
  • Cromwell properties and car parks are under video and camera surveillance. When entering Cromwell’s properties and car parks, images of visitors and their vehicles may be collected. We may also collect personal information and images from third parties (e.g. the police or retailers). This information may be used by us in connection with the management and security of the property and may be provided to law enforcement and government bodies, Cromwell staff and subcontractors, third parties who provide us with services from time to time, insurers and retailers for those purposes. The licence plates of vehicles in car parks may also be collected and used for the above purposes and also to assist people to locate their cars including via online and mobile applications.
  • When visitors logon to Wi-Fi services provided at our properties, or third party applications utilising Cromwell’s infrastructure, they may be required to provide certain personal information to access the service. Further details in relation to what information is collected when using these services and the purpose of this collection is provided in the Terms & Conditions sections and associated Privacy Policies of the service,which you are required to be accept prior to use.

Who collects the personal information?

Personal information may be collected directly by us, our agents or by our trusted business partners acting on behalf of Cromwell, such as property management companies and technology providers.

How do we collect personal information?

We will only collect personal information by lawful and fair means.

Personal information gathered by our agents and trusted business partners acting on our behalf will be treated in a manner consistent with this Policy.

Cromwell properties use CCTV and other surveillance techniques for security purposes. Notices in relation to surveillance are in place at various points throughout Cromwell properties. By entering the property you consent to this surveillance.

Cookies and third party websites

When you visit our websites the server may attach a “cookie” to your computer’s memory.  A “cookie” assists us to store information on how visitors to our website use it and the pages that may be of most interest.  This information may be used to provide users of your computer with information that we think may interest the users of your computer.  However, this information is not linked to any personal information you may provide and cannot be used to identify you.  If you choose, you should be able to configure your computer so that it disables “cookies” or does not accept them.

Our websites may link directly to websites operated by third parties, including portals (Linked Sites). You acknowledge that Linked Sites are not operated by us.  We encourage you to always read the applicable privacy policy of any Linked Site on entering the Linked Site.  We are not responsible for the content or practices of the Linked Sites nor their privacy policies regarding the collection, storage, use and disclosure of your personal information.

How your personal information is stored, kept secure and maintained?

We will take all reasonable steps to protect personal information held from misuse or loss and from unauthorised access, modification or disclosure. This includes by restricting access to hardcopy and electronic records via physical and logical security methods.

Personal information will be held securely on Cromwell’s electronic databases (which may be on a database maintained by a cloud hosting service provider or other third party database storage), or otherwise in hard copy form in secure storage facilities. Where personal information is stored with a third party, Cromwell will take reasonable steps to ensure the privacy and security of that information is managed in accordance with the APPs.

All personal information is held within Australia.

Whilst we will use all reasonable endeavours to keep your personal information in a secure environment, this security cannot be guaranteed due to the nature of the Internet. If you reasonably believe that there has been unauthorised use or disclosure of your personal information please contact Cromwell via the details below.

We will keep your personal information for only as long as is reasonably necessary to achieve the purpose for which we collected it. Where we no longer require the personal information for a permitted purpose under the APPs, we will take reasonable steps to destroy or de-identify it.

Disclosure of your personal information

We will only disclose the personal information we have about you in limited specific circumstances, such as:

  • when you agree to the disclosure;
  • in relation to for the purposes we collected it;
  • when disclosure is required or authorised by law; or
  • as permitted by the Privacy Act.

To the extent permitted by law, we may also disclose information about you to:

  • our associated entities and related bodies corporate;
  • trusted business partners for marketing purposes, where you have provided consent to do so;
  • third parties who we engage to provide related services from time to time;
  • Cromwell staff, agents and subcontractors;
  • in connection with the management and security of our properties;
  • government agencies as part of our statutory obligations; or
  • as otherwise permitted by law.

We will not disclose personal information to recipients outside of Australia without obtaining your consent.

Direct marketing

By accessing our websites or using our services, you consent to the use and disclosure of your personal information by and to our business partners for the purpose of allowing them to directly market their products and services. For example, we may use your contact details to provide you with information about promotions at our properties or those of our tenants.

You may request to not receive such material by following the unsubscribe instructions that will be contained on any such material. Upon request, we will arrange for your details to be removed from our databases as soon as reasonably practicable.  You agree and acknowledge that even if you opt out of receiving marketing material, we may still send you essential information that we are required to send you relating to the services we provide.

Unsolicited personal information

If we receive personal information about you that we did not ask for either directly from you, from someone on your behalf, or through someone on our behalf, and we determine that we could have collected this information from you had we asked for it, we will take reasonable steps to notify you, as soon as practicable, that we have collected your personal information.  If we could not have collected this personal information from you (or if you do not agree to us collecting information in this way), we will lawfully de-identify or destroy that personal information.

Access to your information

We will take all reasonable steps to ensure that personal information held by us is accurate, complete and up to date. If you wish to access your information, or you believe that any of your personal information is inaccurate, please contact your relevant Centre or Property Manager, or the Cromwell Privacy Officer via the contact details below. We will respond to you and take all reasonable steps to correct it within a reasonable timeframe.

Privacy Complaints

If you believe we have breached our privacy obligations or your privacy rights in any way, please contact the Cromwell Privacy Officer. We will respond to your complaint as soon as possible, and within a reasonable timeframe.

Changes to our Privacy Policy

This Policy relates to our current privacy standards. We may vary our Privacy Policy from time to time. We will notify you of any changes by publishing the updated version of the policy at this location. You should check this Privacy Policy regularly so that you are aware of any variations.  You will be deemed to have consented to such variations by your continued use of our website and service following such changes being made.

Privacy Officer Contact Details

Cromwell Property Group Privacy Officer

GPO Box 1093

Brisbane QLD 4001, Australia

Email: cromwell@cromwell.com.au