Brands & Partners Privacy Notice

Introduction

We are committed to protecting and respecting your privacy and want to ensure you understand our processing of your personal data. You should read through this Notice carefully to fully understand the basis upon which we will use your information, including what information we collect about you, how we use the information, where we store the information and to whom the information is disclosed.

Who we are and how to contact us

This Notice explains how Value Retail Management and our Villages collect, use and manage your personal data in compliance with applicable data protection law. In most instances, Value Retail Management Ltd and the Villages are the controller of your personal data described in this Notice.

If you need to contact us for any reason (including with any questions in relation to this Notice or to exercise any of your rights as set out below) please contact us at Notices@ValueRetail.com.

The Villages in Germany, Ingolstadt Village and Wertheim Village, have appointed a Data Protection Officer for Germany, who can be contacted at DatenSchutzBeauftragter@ValueRetail.com

Please click here to see who we are. The entities listed are the owners and operators of retail outlet villages (Villages) within The Bicester Collection. References in this Notice to “we”, “us” or “our” are to the entities listed. Each of the listed entities are joint data controllers and are committed to protecting your privacy.

As joint data controllers, we have arrangements between us to ensure that we handle your personal data properly and in accordance with data protection law. These arrangements reflect our respective roles and responsibilities in relation to you and your personal data, and consider which entity is in the best position to fulfil our services and obligations. This arrangement between us does not affect your rights under data protection law. For more information on these arrangements, feel free to contact us using the address above.

Employers of Brand and Contractor staff working in our Villages will process personal data about their employees in relation to their relationship with them and will always be the data controller of that data. All interaction and exchange of personal data between our Brand Village Partners, Contractors and Value Retail is managed through contractual arrangements between us, as independent data controllers.

Application of this Notice

This Notice applies to the way we collect and process the personal data of our Brands and Contractors who may be working in our Villages, Brand Head Office contacts, suppliers and other partners such as key opinion leaders, influencers and tourism and leisure partners.

Personal data will be collected and processed during the course of our business engagement with you and maybe collected from yourself or from your employer, where they have arrangements to do so.

Other Privacy Notices may apply for our use of your personal data, for example, in-Village activities are described in our Village Privacy Notice, or when you register with our Membership Programme or use our websites or the Village app.

Information we collect

It is routine for us to collect, process and store personal data as part of business engagement with you and whilst our partners work and operate in our Villages, including:

full name;
work email (personal email where you choose to use this);
work telephone (personal telephone where you choose to use this);
vehicle registration;
signature;
image (where you consent);
role information (such as job title) and job-specific skills;
languages spoken;
working location, hours available / hours worked;
details of your employer (including your line manager name and contact information); and
login information, where you access any systems or platforms shared by / managed by Value Retail.

Where you choose to participate in Value Retail’s training services and where Brand Partner Store Managers participate in our Value Retail Leadership Excellence Programme, we will process training, career and assessment information, such as the length of time you have been in your role, any significant role changes, and assessment dates. We will also process information relating to measurement of your leadership, mindset skills, attitude and knowledge (which form part of the Value Retail Leadership Excellence Programme Store Manager Competency Framework) as they apply to your role.

During our training events, we will process details of the training event (date, time, name of the event), record of your attendance, performance and any test or assessment result.

How we use your information

We process your information as part of our day-to-day business, as required by law or to fulfil our contractual arrangements with Brands and Partners, for the purposes of:

managing site access and parking;
managing Village operations including opening and closing, security and safety, and any incident or emergency;
maintaining records relating to meetings, boutique sales and property reporting;
managing guest services where you are contracted to provide these;
managing campaigns and marketing materials including photoshoots and films, where you choose to participate;
contacting you in relation to Village operations;
supporting enquiry and referral or any feedback and complaint;
sharing news and other relevant information;
administering access to systems or platforms shared or managed by Value Retail, including any necessary action to prevent access if required;
facilitating events arranged for partners working in our Villages;
managing supplier arrangements including due diligence, work orders and payments;
organising contractor work orders or permits; and
offering and hosting training and development for our brand partners and onsite contractor staff, where you choose to participate.

As part of the Value Retail Leadership Excellence Programme, we:

maintain high standards of performance by Store Managers by highlighting and developing strengths and identifying and supporting areas for improvement;
ensure that any underperforming Store Managers are provided with appropriate assistance, complementary training and attention to help them improve their performance;
apply a fair, calibrated and consistent assessment process for all Store Managers who work for our Village Brand Partners;
create assessment summaries and output and share them with your employer and with other Value Retail personnel; and
collate and assess Store Manager performance throughout a Brand Partner, Village or at Value Retail group level to understand if the Programme objectives and aims are being realised, to identify trends and potential improvements, and to inform stakeholders and senior management.

Legal basis of our processing

Whenever we process your personal data we will have a lawful reason to use it. The legal basis for our processing is either:

Legitimate business interests – to manage Village operations, support guest service and experience, facilitate management reporting and forecasting, to manage system access and to operate the Value Retail Leadership Excellence Programme and other training services.

We will process personal data for the purposes of our legitimate business interests as described above and have conducted an assessment to ensure that the rights and freedoms of individuals processed do not outweigh our legitimate interests.

Fulfil our contractual obligations – where we have arrangements with Brands, Contractors, suppliers and other individuals who contract with Value Retail and / or the Villages.

Performance of legal obligations – for the establishment, exercise or defence of legal claims.

Consent – to processing where you agree to the use of your image.

Transfers of personal data

We are part of a global collection of companies and operate in several countries. Value Retail Management and our Villages may have access to your information for the purposes explained in this Notice, including as part of part of the Value Retail Leadership Excellence Programme, where we may also share your personal data with consultants and professional advisors who assist us from time to time. Please contact us if you would like to know more about this.

We partner with third parties who support systems operation and administration. We take measures to safeguard the sharing of your personal data, including checking third parties have sufficient guarantees regarding the confidentiality and security of your personal information and having in place data processing agreements that set out the extent of processing and compliance with legal requirements.

The information we collect from you will not be transferred, unless reasonable and appropriate steps have been taken to ensure your information is treated securely and in accordance with this Notice. You can request a list of the third party and other parties to whom we disclose your information.

In addition, we may disclose your personal data:

if we are under a duty to share your information in order to comply with our legal obligations, to protect the rights, property or safety of our business, our guests, brands or others. This may include for the purposes of fraud prevention or detection; and
to successors in title or replacement operators of all or part of our respective businesses.

Your personal data may be transferred abroad, to EEA countries or to other countries deemed as offering adequate protection by the European Commission (including the UK). Where your information is transferred to countries outside the EEA that are not included in the list of adequate countries, we will conduct transfer risk assessments and put in place safeguards, such standard contract clauses issued by European and UK data protection authorities.

Please ask us if you would like more information about the safeguards that are used to protect your information when it is processed outside the EEA or other countries deemed as offering adequate protection (please see ‘Contact us’ above for contact details).

Data retention

We will not keep your personal data for longer than is reasonably necessary for the purpose for which the information is collected. Our data retention policies comply with all applicable laws including Data Protection Law. They set out how long we are allowed to retain different types of data we hold and are reviewed on a regular basis.

We will process your personal data for as long as you engage with us and our retention periods take into account:

any legal obligations under applicable relevant laws to retain data for a certain period of time (for example in relation to tax);
the statute of limitations under applicable law(s);
our need to deal with any disputes or potential disputes; and
guidelines issued by any relevant regulatory authorities.

We safely and securely destroy data that we no longer need to keep in accordance with our data retention policies. Sometimes we anonymise your information so that you cannot be identified and use this data for aggregate analytics and reporting.

Data accuracy

We will keep the personal data we store about you accurate and up to date. Data that is inaccurate or out of date will be corrected or destroyed.

You have a part to play here too, by making sure you tell us about changes to information such as your contact details. If you become aware of any inaccuracies in the personal data we hold about you, please contact us using the details in the ‘Contact us’ section above.

Your rights

You have a number of rights when it comes to your personal data.

The right to be informed.

You have the right to be provided with clear, transparent and easily understandable information about how we use your personal data and your rights. This is why we’re providing you with the information in this Notice.

The right of access.

If you ask us, we’ll confirm whether we’re processing your personal data and, if so, provide you with a copy of that personal data and information about how we use it. If you require additional copies, we may need to charge a reasonable fee.

The right to rectification.

You are entitled to have your personal data corrected if it’s inaccurate or incomplete (subject to certain exemptions).

The right to erasure.

This is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your personal data where there’s no compelling reason for us to keep using it. This is not a general right to erasure; there are exceptions.

The right to restrict processing.

You have rights to ‘block’ or suppress further use of your personal data. When processing is restricted, we can still store your personal data, but may not use it further. We keep lists of people who have asked for further use of their personal data to be ‘blocked’ to make sure the restriction is respected in the future.

The right to data portability.

You have rights to obtain and reuse your personal data for your own purposes across different services. For example, if you decide to switch to a new provider, this enables you to move, copy or transfer your information easily between our IT systems and theirs safely and securely, without affecting its usability.

The right to object to processing.

You have the right to object to processing for direct marketing (where you have previously consented) and also to processing that is carried out for the purposes of our legitimate interests. This is not a general right to objection; there are exceptions.

The right to withdraw consent.

If you have given your consent to anything we do with your personal data, you have the right to withdraw your consent at any time (although, if you do so, it does not mean that anything we have done with your personal data with your consent up to that point is unlawful). This includes your right to withdraw consent to us using your personal data for marketing purposes.

The right to lodge a complaint.

If you are unhappy about any aspect of the way we collect, share or use your personal data, we would like you to tell us. You can contact us using the details above.

You also have a right to complain to your local Data Protection Authority:

Country	Supervisory	Website
UK	The Information Commissioners’ Office (ICO)	www.ico.org.uk
Ireland	The Data Protection Commissioner (DPC)	www.dataprotection.ie
France	Commission Nationale de l’Informatique et des Libertés (CNIL)	www.cnil.fr
Italy	Garante per la protezione dei dati personali (Garante)	www.garanteprivacy.it
Spain	Agencia Española de Protección de Datos (AEPD)	www.aepd.es
Belgium	Gegevensbeschermingsautoriteit (GBA)	www.gegevensbeschermingsautoriteit.be

Germany
Data protection for private sector organisations is overseen by regional data protection authorities. Value Retail operates in two regions within Germany and, therefore, falls under the jurisdiction of two supervisory authorities:

Region	Supervisory	Website
Bavaria	Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)	www.lda.bayern.de
Baden-Württemberg	Der Landesbeauftragte für den Datenschutz Baden-Württemberg	www.baden-wuerttemberg.datenschutz.de

If you wish to exercise any of the rights detailed above, please contact us using the details in the ‘Contact us’ section above.

We usually act on requests and provide information free of charge, but we may charge a reasonable fee to cover our administrative costs of providing the information for:

baseless or excessive/repeated requests; or
further copies of the same information.

Generally, we will respond to you within one month from when we receive your request but, if the request is going to take longer, we’ll come back to you and let you know.

Changes to our personnel privacy notice

This Notice is reviewed on a regular basis by the Data Protection team to ensure it is achieving its stated objectives and to reflect any required changes. If we make any significant changes we will take additional steps to inform you of them.

This Notice does not form part of any personnel’s contract of employment or engagement and we may amend it at any time.