Purpose

ISPT[1] (referred to in this policy as “ISPT”, “we”, “us” or “our”) and business partners who act on our behalf are committed to protecting your privacy and complying with our obligations under the Privacy Act 1988 (Cth) (Privacy Act) and Australian Privacy Principles (APP), in respect of the collection, storage, use and disclosure of personal information.

This Policy sets out the principles that we adopt to manage the personal information of our tenants and their employees, service providers, agents, contractors, investors, and visitors and potential visitors to our properties (“you”).

This Privacy Policy outlines the following:

1. why we collect personal information;
2. the types of personal information we collect and how we use that information;
3. who may collect personal information;
4. how we collect and hold personal information;
5. how we keep personal information secure;
6. the circumstances in which we may disclose personal information;
7. how you may access personal information held by us and seek correction; and
8. how you may complain about a breach of privacy, and how we will deal with such a complaint.

 

This Privacy Policy applies to personal information provided to us whether at one of our properties, via our websites, customer, tenant or investor portals, mobile apps, Wi-Fi landing pages, competition forms, feedback and surveys, interactive digital devices or any other means (hereafter “channels”). By accessing and/or using our channels, products and services, you consent to the use, collection, storage and disclosure of your personal information in accordance with this Privacy Policy and the Privacy Act.

Although we will comply with this Privacy Policy in respect of information provided to us by persons under the age of 18 years, persons under the age of 18 years must obtain the consent of a parent or guardian prior to accessing and/or using our channels, products and services and the parent or guardian will be responsible for appropriately supervising that person’s access to and/or use of our channels, products and services.

1. Why do we collect personal information?

We collect and use personal information about you primarily to provide you access to and use of our channels, products and services to manage our relationship with you and to allow us to communicate with you.

Examples of why we may collect your personal information include:

• to enter into contracts with goods or service providers to conduct our business;
• to facilitate the use of our products and services;
• to participate in marketing promotions, surveys, competitions and other engagement activities;
• for internal administrative purposes, such as procedural assessments, risk management, accounting, billing, customer service and product and service reviews;
• in connection with the management of access and security at our properties;
• for marketing and promotional purposes;
• to provide you with personalised communications;
• to measure and analyse customer or visitor behaviour in order to improve our properties and otherwise in connection with our business;
• to better understand your needs and deliver improved services and an enhanced experience before, during and after your visit to our properties;
• for safety and security when visiting our properties;
• to comply with our legal obligations; and
• for other purposes for which you would reasonably expect us to use that information.

We may also use information we collect about you to obtain further details from available sources via our trusted data service providers, where it may help us to improve our communications and customer service to you and to deliver an enhanced, personalised shopping experience.

Additionally, analytics may be conducted on personal information provided directly by you, as well as third party sources and third-party social-networking sites (including but not limited to Facebook, Instagram, LinkedIn and/or Twitter). This may be for the purpose of better marketing, determining your preferred products/services and to better understand your needs in order to deliver improved services and an enhanced experience before, during and after your visit to our properties. We may share information we collect about you with our affiliates, agents and trusted business partners for this purpose.

2. What personal information do we collect and how do we use it?

The following are examples of personal information which may be collected and circumstances in which that information may be used:

From Visitors to our properties

ISPT, or one of our trusted business partners, may collect your personal information when you are visiting our properties in a number of different ways. These include:

• In connection with competitions or signing up to email or mobile newsletters (either while in our properties or online), you may provide us with your contact details. Your name and address are automatically entered into our database when you enter competitions. We collect these details to contact competition winners and communicate with our visitors and to inform them about events, activities and promotions in our properties and as part of our other activities. You will have the option to opt out from receiving this information.
• When you hire equipment from us, or apply to use certain restricted spaces at our properties, you may provide us with certain information, including your contact details. We collect this information to ensure there is a record of the hirer, but may use this information for marketing and promotional activity and to enable you to be informed about upcoming events, activities and promotions both in our properties and as part of our other activities.
• When entering our properties and car parks, customers’ or visitors’ personal information, vehicle and car park licence plate details and images may be collected by us under video and camera surveillance. We may also collect customers’ or visitors’ personal information and images from third parties (e.g. the police or retailers). This information may be used by us in connection with the management and security of our properties and may be provided to law enforcement, government bodies or in litigation (including, without limitation, where the information may be required for use in litigation relative to or affecting us or where we have been subpoenaed to provide that information), ISPT staff and subcontractors, third parties who provide us with services from time to time, insurers and retailers for those purposes.
• When customers park in our properties or car parks with a ticketless parking system or car locator functionality, customers consent to provide us with their car licence plate details and, in some circumstances, other information including name, email address and telephone number. These details are used for measuring and analysing car parking dwell times and shopper behaviour in order to improve our services, for the purposes of managing car parking at our properties and also to assist customers to locate their cars including via online and mobile applications.
• Where devices are enabled to connect to, or are identifiable by, in-centre infrastructure (for example, in-centre Wi-Fi networks or blue tooth transmitter (beacon) infrastructure), we and our third party providers may automatically collect data from those devices including usage, type of device and location and proximity of your wireless device in our properties, arrival and departure time from our properties, and other data which users consent to us collecting from time to time.
• Audience measurement information collected passively using in-centre technologies such as SmartScreen Advertising Units which utilise image processing software to aggregate data such as visitor numbers and demographics. These technologies do not identify individual visitors, or record or retain images of individual visitors.

From Users of our Wi-Fi Services and mobile applications

When you log on to Wi-Fi Services or download any mobile apps provided at our properties, use mobile applications developed by us or third party applications utilising our infrastructure (Mobile Services) or request access to our services, you may be required to provide certain personal information, including your contact details, to access the service.

When you register to use any Mobile Service or request access to our services, we may collect:

• your name;
• your email address;
• your date of birth;
• drivers licence information;
• gender;
• your telephone or mobile number or residential address;
• the domain name from which you accessed our Wi-Fi;
• your MAC and IP address and device name or ID;
• the date and time you accessed our Wi-Fi;
• your data usage;
• type of device and location and proximity of your wireless device in the property, arrival and departure times;
• cookies which enable tracking or provide other information regarding your interaction with the Wi-Fi;
• the web browser that you are using and the URL of any webpage you accessed using our Wi-Fi, including access to online applications created or operated;
• cookies;
• other audience measurement information which may be collected passively using various technologies that identify the demographic, age group and gender of shoppers;
• if you sign on via a third-party social-networking site (including but not limited to Facebook, Instagram, LinkedIn and/or Twitter), publicly accessible social media posts and any personal information we obtain from those sites or if linking accounts;
• heat mapping information;
• credit card and digital wallet payment information; and
• any other information you provide us when using our Mobile Services.

We collect this information (and may use or hold this information) for the following purposes:

• to improve our Wi-Fi network and its functionality and your in-centre experience;
• for the purposes of and incidental to your use of the in-centre Wi-Fi services;
• to enable users to be informed about upcoming events, activities and promotions, both in our properties and as part of our other activities, sponsor tenant promotions, and other activities, which will usually be notified to users as they sign in to use those facilities; and
• to provide you with access to our Mobile Services or you request access to our services.

In addition to the purposes set out above, this information may be used by us in connection with the management and security of our properties generally, to obtain feedback about a visitor’s experiences at a property (including with our tenants), and may be provided to law enforcement and government bodies (including, without limitation, where the information may be required for use in litigation relative to or affecting us), insurers, our staff and subcontractors, third parties who provide us with services from time to time and tenants for these purposes.

Where you provide information to us in different ways, or we hold information about you, we may connect information provided to us for one purpose, with other information for use for one or more of the above purposes. Additionally, we also conduct certain online activities through our website, and associated sites managed by us or our subcontractors. The collection of personal information through these activities and information associated with these websites is dealt with in accordance with this Privacy Policy or the relevant website’s privacy policy.

From our Tenants and their Staff

We may collect the following types of personal information from tenants, guarantors and/or individuals related to tenants during negotiations for, and during the term of, the lease/licence for premises, kiosks, access to our IT applications and other activities at its properties:

• name,
• email address;
• telephone or mobile number or residential address
• date of birth;
• contact and insurance details;
• next of kin or emergency contact person(s) details;
• ABN(s);
• information as to tenants’ financial standing and experience (or the financial standing and experience of the tenant’s director(s) or guarantor(s);
• other financial and trading information;
• company name;
• location in building; and
• live location data, pages visited, booking information, purchase history and payment information and method when using our IT applications.

We use this information to:

• evaluate whether we should enter into a lease, licence or other agreement with a tenant;
• to assist us in the preparation documentation to formalise the lease, licence or other agreement;
• to manage our relationship with tenants in connection with the management and security of our properties;
• to provide information and services when at our properties; and
• in order to monitor the performance of a tenancy and property.

Where in connection with your tenancy we require a credit check, we will obtain your consent to this and hence may collect and share information about you with credit reporting agencies.

Occasionally, the information may also be made available to others in connection with these activities, in order for those people to provide services to us or as required by law, as well as to third parties in connection with any transactions involving the property.

If a tenant provides us with direct debit or direct credit details, we will only disclose those details to the relevant institutions to facilitate the on boarding and ongoing delivery of that service.

When entering one of our properties, the personal information and images of tenants and their staff may be collected in the same way as any other visitor to the property. This information may be used by us in connection with the management and security of our properties and may be provided to law enforcement, government bodies or in litigation (including, without limitation, where the information may be required for use in litigation relative to or affecting us, or if where we have been subpoenaed to provide that information), insurers, our staff and subcontractors, third parties who provide ISPT with services from time to time and other tenants for those purposes. This information is held securely and in a format which is access controlled unless it is necessary to use this information for these purposes.

Where tenants or their employees sign up to use or access our products, services or channels, we may also collect information for the purposes of maintaining our relationship with you and to provide services offered through that channel. These channels may be operated by us, or by one of our trusted business partners. For further information in relation to how these channels collect, manage and use your personal information, please refer to the Terms & Conditions and privacy information available on that channel.

From our Agents, Contractors and Suppliers

If you, or a company you work for, supplies goods or services to us, we may collect personal information about you in connection with the provision of those goods or services, either directly from you or from that company. This information may include your name, date of birth, contact information, emergency contacts, business information and address, insurance details and any other information you provide, or is provided on your behalf, as part of our induction and compliance processes, such as licences to use certain equipment on our premises. This information will be used by us for our business related purposes, including management of the provision of the goods or services in question.
This information will be retained by us in accordance with this Privacy Policy and only disclosed as required for our business purposes and for any legal or compliance requests.

From potential employees of ISPT

If you are seeking employment with us, we may collect personal information about you in connection with your employment. This information may include your name, date of birth, contact information, and any other information you provide, or provided on your behalf, as part of our induction and compliance processes. This information will be used for the purposes of our recruitment process and, if successful, managing your employment, in accordance with the requirements of the Privacy Act. You need to ensure this information is up to date, in accordance with our policies and procedures.

From investors and their officers, employees and agents

If you are an officer, employee or agent of an investor in ISPT, we may collect personal information from you from time to time, including when you register for, access or use the ISPT investor portal. ISPT may collect personal information about you in connection with the provision of services to you, either directly from you or from the investor. This information may include your name, username, email address and any other information you provide, or is provided on your behalf, as part of our registration and compliance processes. Such information will be used by us for business related purposes, including management of the provision of the services in question.

From users of our website
When you use, access or become a registered user of www.ispt.com.au or any associated site or other site operated or maintained by us from time to time (website(s)), including when you use services offered by a website or subscribe to our email newsletters service from time to time, we may ask for information including:

• your name;
• your email address;
• your date of birth; and
• your telephone or mobile number or residential address.

The website is an Australian based website, and it is not intended to provide services to EU residents, and its terms may not be fully consistent with the General Data Protection Regulation. If you are an EU resident and you choose to use the Website then you do so at your own risk, and on the terms of our website. We may also collect the following information from you when you access our website or use services offered by our website:

• the fully qualified domain name from which you accessed our websites, or alternatively, your IP address;
• device ID number (MAC address);
• the date and time you accessed each page on our websites;
• the URL of any webpage from which you accessed our websites;
• publicly accessible social media posts and content and any personal information you allow us to collect by linking your account on our website with a third-party social-networking site including but not limited to Facebook, Instagram, LinkedIn and/or Twitter;
• the URL from any webpage from which you accessed our website (the referrer);
• cookies which enable tracking or provide other information, including your visits to and interaction with our web sites; and
• the web browser that you are using and the pages you accessed.

We are collecting this information (and may use or hold this information) for the following purposes:

• so that we can tell which web pages are the most popular and where visitors spend most of their time;
• to improve our website or functionality provided by the website or in-centre experience;
• for the purposes of and incidental to your use of our website (if applicable);
• to measure visitor numbers, characteristics and demographics, and analyse visitor behaviour in order to continuously improve our properties and for use otherwise in connection with our business;
• to send to you special deals and discounts, surveys and other marketing materials based on your location or known web usage;
• for other purposes to which you, either expressly or impliedly, consent to, and for the purposes set out in these terms and conditions, we may provide this information to our agents, contractors, service providers, joint venture and commercial partners and regulatory authorities, and may transfer your personal information to others in countries outside Australia (including to those that operate or host our data or cloud servers outside of Australia, including the United States of America and countries located in regions such as the European Union and Asia).

General

Further:

• We may use the anonymised data for the purposes set out above and to inform our promotional and marketing strategies, as well as research and profiling purposes including visitor demographics, interests and behaviours based on personal information and other information provided to us. This research may be compiled and analysed on an aggregate basis, and we may share this aggregate data with our affiliates, agents and business partners. This aggregate information does not identify you personally. We may also disclose aggregated information in order to describe our services to current and prospective business partners, and to other third parties for other lawful purposes
• We may connect information you provide to us for one purpose with other information for use for one or more of the above purposes. If you access or log-in to an in-centre Wi-Fi service, and we already hold other information (both personal or non-personal) that can be associated to you or the device on which you are accessing the Wi-Fi service (including, but not limited to a device ID number (MAC address)), then that information may be linked with personal information we hold about you as set out in this policy, and will be treated in the same manner as the personal information to which it has been linked.

3. Who collects the personal information?

Personal information may be collected directly by us, our agents or by our trusted business partners acting on our behalf, such as property management companies, technology providers and trusted data service providers.
Information may also be collected by us on behalf of other people as set out in notices given to you, or consents given by you, at or prior to the time the personal information is collected.

4. How do we collect personal information?

We will only collect personal information by lawful and fair means.

If it is reasonable and practical to do so, we will collect personal information directly from you. We may also collect personal information from other companies that are able to disclose it to us, if it is not practical to collect it from you. For example, we may obtain personal information from trusted data sources to help us identify additional information about people who might be interested in hearing about particular products and services.

Personal information gathered by our agents and business partners acting on our behalf will be treated in a manner consistent with this Privacy Policy. Our properties use CCTV and other surveillance techniques in connection with the management and security of our properties and to measure visitor numbers, characteristics and demographics, and analyse visitor behaviour in order to continuously improve our properties and for use otherwise in connection with our business.
Notices in relation to surveillance are in place at various points throughout our properties. By entering the property you consent to this surveillance and to our use and disclosure of the information captured by surveillance as set out in this Privacy Policy.

Cookies and third party websites

When you visit our websites, the server may attach a ‘cookie’ to your computer or other device’s memory. A cookie assists us to store information on how visitors to our website use it and the pages that may be of most interest. ISPT uses cookies to identify you between multiple visits, to better understand how our websites are used, to provide users of your computer or device with information that we think may interest the users of your computer or device to improve our communications and service delivery, to provide you information which may be of interest to you based on your previous visits to our websites, and to provide targeted advertising to you (including through adservers and other third party advertisers) when you visit our website and certain other websites where advertising is found from time to time.

We may provide the information we gather from cookies to third parties for the above purposes and for other purposes connected with our websites. If cookie information is linked with personal information we hold about you as set out above, this cookie information becomes personal information and will be treated in the same manner as the personal information to which it has been linked. If you do not want adservers or other third party advertisers to use cookies to provide you with targeted advertising, we suggest you use an opt-out mechanism which can be found on:

 the Network Advertising Initiative opt-out provided through ww.networkadvertising.org/choices/DAA;
 the Digital Advertising Alliance opt-out provided through www.aboutads.info/choices/; or
 the Interactive Advertising Bureau (EU) opt-out provided through www.youronlinechoices.eu.

If our website uses cookies, you do not have to accept such cookies. Also, you may set up your browser to notify you when you receive cookies. This will give you the opportunity to decide whether or not to accept the cookies. If you choose to disable cookies, you may not be able to access certain features of the website.

Our websites may link directly to external websites (“Linked Websites”) operated by third parties. You acknowledge that these sites are not operated by us. We encourage you to always read the applicable privacy policy of any Linked Website prior to entering the Linked Website. We are not responsible for the content or practices of the Linked Websites nor their privacy policies regarding the collection, storage, use and disclosure of your personal information.

5. How is your personal information stored, kept secure and maintained?

We will take all reasonable steps to protect personal information held from misuse or loss and from unauthorised access, modification or disclosure. This includes restricting access to hardcopy and electronic records via physical and logical security methods. This information is only made available to our staff on a ‘need to know’ basis and for the purposes outlined above or to other people as outlined in this policy who have agreed to treat that information confidentially.

Personal information may be held securely on our electronic databases (which may be on a database maintained by a cloud hosting service provider or other third party database storage), or otherwise in hard copy form in secure storage facilities. Electronic databases are protected by a firewall as well as host-based security. Your personal information may be transmitted over the Internet once it has been stored in a database and may also be transferred across borders to recipients in foreign countries other than Australia, including the United States of America, and may be stored on servers, using databases or via cloud technology in a number of countries other than Australia, including the United States of America and countries in regions such as the European Union and Asia, where doing so is part of ISPT’s ordinary business practices relating to the storage of data and where permitted by law.

If ISPT ever has a requirement to transmit such data over the Internet (for example, to make an off-site back up) it will be in encrypted form. By providing us with your personal information, you consent to these transfers.

Where personal information is held with a third party, ISPT will ensure that appropriate technical and organisational measures are in place to protect the security of that information and to ensure that it is managed in accordance with the Privacy Act. ISPT maintains responsibility for your information at all times. As such, we ensure by all reasonable means, any third parties we use are subject to controls which protect your information from unauthorised use and disclosure and limit access and limit their use or disclosure of your personal information to the agreed purpose only.
We will keep your personal information for only as long as is reasonably necessary to achieve the purpose for which we collected it. Where we no longer require the personal information for a permitted purpose, we will take reasonable steps to destroy or de-identify it.
Whilst we will use all reasonable endeavours to keep your personal information in a secure environment, this security cannot be guaranteed due to the nature of the Internet. If you reasonably believe that there has been unauthorised use or disclosure of your personal information please contact ISPT via the details below.

In the unlikely event that there is an unauthorised use or disclosure of your personal information requiring disclosure (Data Breach), we will comply with our obligations under the Privacy Act and, if required, notify you of the Data Breach and will undertake an investigation into how the Data Breach occurred and its likely severity. As part of this, we will use commercially reasonable endeavours to work with you and the Office of the Australian Information Commissioner to limit the impact, and any reoccurrence, of such Data Breach.

We have also taken steps to ensure that, if you tell us you are located in the European Union, and advise us that you wish to exercise the additional rights available to you under the General Data Protection Regulation, we will endeavour to meet those requests subject to the terms of this Privacy Policy.

Right to anonymity

At the point of collection, and when dealing with us, you may have the opportunity to remain anonymous where it is reasonable and practical to do so. It must still be practicable for us to perform the required services. Some exceptions do apply where it is a legal requirement for our business to deal with accurately identified individuals.

6. When will we disclose your personal information?

We will only disclose the personal information we have about you in limited specific circumstances, such as:

• when you agree to the disclosure;
• in relation to or for the purposes we collected it;
• when disclosure is required or authorised by law; or
• as permitted by the Privacy Act.

To the extent permitted by law, we may also disclose information about you to:

• our associated entities and related bodies corporate;
• trusted business partners for marketing purposes;
• third parties who we engage to provide related services from time to time;
• our staff, agents and subcontractors in connection with the management and security of our properties;
• government agencies as part of our statutory obligations;
• in the course of litigation; or
• as otherwise permitted by law.

Direct marketing

By accessing and using our channels and services, you consent to the use and disclosure of your personal information by and to our business partners for the purpose of allowing them to directly market products and services.
We aim to use your personal information to send advertising that is customised or more relevant to your interests, characteristics or general location. This doesn’t necessarily mean you’ll get more advertising. It just means that the advertising that you see will hopefully be more relevant to you. For example, we may use your contact details to provide you with information about promotions at our properties or those of our tenants.

You may request to not receive such material by following the unsubscribe instructions that will be contained on any such material. Upon request, we will arrange for your details to be removed from our databases as soon as reasonably practicable. You agree and acknowledge that even if you opt out of receiving marketing material, we may still send you essential information that we are required to send you relating to the services we provide.

Unsolicited personal information

If we receive personal information about you that we did not ask for either directly from you, from someone on your behalf, or through someone on our behalf, and we determine that we could have collected this information from you had we asked for it, we will take reasonable steps to notify you, as soon as practicable, that we have collected your personal information. If we could not have collected this personal information from you (or if you do not agree to us collecting information in this way), we will lawfully de-identify or destroy that personal information. Any unsolicited information provided by you, someone on your behalf or someone on our behalf, will be used for the purposes for which it was provided.

7. How can you access your information?

You have rights to access, update or correct your personal information held by us. We will take all reasonable steps to ensure that personal information held by us is accurate, complete and up to date. If you wish to access your information, or you believe that any of your personal information is inaccurate, please contact your relevant Centre or Property Manager, or the ISPT Risk & Compliance Officer (Privacy Officer) via the contact details below. We will respond to you and take all reasonable steps to correct it within a reasonable timeframe.

8. Enquiries and Complaints

A copy of the current ISPT Privacy Policy may be obtained by:

• visiting our website at www.ispt.com.au;
• visiting an ISPT Centre or property and requesting a copy from the Property Manager; or
• calling our Privacy Officer on 03 8601 6666.

If you believe we have breached our privacy obligations or your privacy rights in any way, please contact the Privacy Officer. We will respond to your complaint as soon as possible, and within a reasonable timeframe.

The contact details for our Privacy Officer are as follows:

ISPT Privacy Officer
Level 11, 8 Exhibition St
Melbourne VIC 3000, Australia

Email: privacy@ispt.com.au

Telephone: 03 8601 6666

If you think we have not resolved a complaint satisfactorily, we will provide you with information about the further steps you can take. You can also contact the:

Officer of the Australian Information Commissioner

GPO Box 5218, Sydney NSW 2001
Phone: 1300 363 992
Email: enquiries@oaic.gov.au or www.oaic.gov.au

Changes to our Privacy Policy

This Policy relates to our current privacy standards. We may vary our Privacy Policy from time to time. We will notify you of any changes by publishing the updated version of the Policy on our website https://ispt.com.au/ from time to time. You should check this Privacy Policy regularly so that you are aware of any variations. You will be deemed to have consented to such variations by your continued access and use of our website or other channels, products and services following such changes being made.

[1] In this policy, “ISPT” means ISPT Pty Ltd (ABN 28 064 041 283), ISPT Operations Pty Ltd (ACN  633 106 733) and any related bodies corporate from time to time, and the owners of properties managed by those entities.