2. Data Controller

The Data Controller for the processing of your personal data via our websites is:

Unibail-Rodamco-Westfield Germany GmbH

Klaus-Bungert-Straße 1, 40468 Düsseldorf, Germany

Phone: 0049 (0) 211 38 302 310

Fax: 0049 (0) 211 302 31 111

E-mail: germany(at)urw.com

Website: www.unibail-rodamco-westfield.de

3. Data Protection Officer

The Data Protection Officer has been appointed by the regional Data Controller. Please find his contact details below:

Data Protection Officer

Unibail-Rodamco-Westfield Germany GmbH

Klaus-Bungert-Straße 1, 40468 Düsseldorf, Germany

Tel.: 0049 (0) 211 302 31 963

E-Mail: datenschutz(at)urw.com

4. Purpose of processing

As a general rule, you may use our websites without entering any personal data. To the extent that we collect your personal data via our website, the purposes outlined below are served:

(I)     technical website provision and monitoring of operability

(II)    opportunity to contact us via the contact form

(III)   application-related purposes

We collect your personal data via our website as follows:

(a) Contact form

When you use our website contact form to contact us directly, your address information and contact data, such as your e-mail address and phone number, are collected in order to assist our company in the processing of your request and, if necessary, to contact you.

(b) Log files

Every time you access our website, your browser automatically sends some information to the website server in order to enable communication between your browser and the server. This information is stored in a log file. The information stored includes:

• the type and version of your browser,
• your operating system,
• the website via which you access the current site,
• your computer’s host name (IP address), and
• the time of access.

Subject to legal archiving requirements, your IP address is deleted or anonymized after you leave our website, unless otherwise defined in the Privacy Policy and to the legally admissible extent.

For the rest, the information your browser transfers to our server is used in an anonymized format, which protects your identity, for analysis and to improve our services. This allows us to detect potential errors and to identify on which days and at what times our websites are most frequently accessed.

(c) Applications

The Unibail-Rodamco-Westfield Group application portal can also be accessed via our website and this method may be used to send us applications for current job offers. In such cases, you will be directed to one of our “parent company” web portals. Please note the Privacy Policy posted there. To the extent that you submit your application data, such as your résumé, contact details, professional qualifications, certificates, photos, and health status, this data will be sent to us for the purpose of processing your application, inklusive der Möglichkeit der Kontaktaufnahme durch unsere Muttergesellschaft übermittelt. However, such transmissions will only be possible if you have agreed to this processing in advance.

Please note the separate Privacy Policy and Terms of Use for our application portal, which are available via this website.

5. Links to other websites

We may provide hypertext links from our website to third-party websites or Internet sources. For external websites, the privacy policies of the respective website operators generally apply. Prior to using a website that you have accessed via a link, please read the respective telemedia services provider’s privacy policy. Please be informed that we do not control any of these websites or Internet sources. Third-party websites are legally responsible for any unlawful privacy practices on their platforms. Please read the respective third-party privacy policies carefully to find out how your personal data is collected and processed.

6. Data processing within and outside the EEA

We use third-party service providers to provide the telemedia services to you, for example, for hosting purposes, and to process your personal data on our behalf, in particular, for application purposes. Such third-party service providers are always subject to security and confidentiality obligations consistent with this Privacy Policy and applicable law. By means of appropriate contractual and effective measures, such as the conclusion of contracts for order data processing or EU standard contracts, we ensure that your personal data is processed in compliance with data protection regulations.

7. Cookies

These websites do not use cookies. However, cookies, which render the provider’s offerings more user-friendly, effective, and secure, may be integrated via third-party providers, such as Google Maps. Cookies are small text files that are stored on your computer and archived by your browser.

Most of the cookies we use are so-called “session cookies”, which are automatically deleted at the end of your session. Other cookies remain stored on your device until you delete them. These cookies enable us to recognize your browser upon your next visit.

You can configure your browser settings to inform you about the use of cookies and only permit cookies in individual cases, to prohibit the use of cookies in certain cases or in general, or to activate automated deletion of cookies when closing your browser. If you deactivate cookies, the functionality of this website may be limited.

8. Google-Maps

We use the “Google Maps” component of Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043 USA, “Google”, on our site.

Every time Google Maps is utilized, Google sets a cookie to process user preferences and data when viewing the page on which the Google Maps component is integrated. As a rule, this cookie is not deleted upon the closing of the browser, but it expires after a certain period of time unless it is manually deleted.

If you do not wish to have your data processed, you may disable the “Google Maps” service, thereby preventing the transmission of data to Google in this manner. In order to deactivate this service, the Java Script feature in your browser must be disabled. Should you choose to deactivate this feature, please be aware that you will either be unable to use “Google Maps” or only be able to use it to a limited extent.

Use of “Google Maps” and information obtained via “Google Maps” is subject to Google’s Terms of Use

www.google.de/intl/de/policies/terms/regional.html

as well as the additional Terms and Conditions stipulated by “Google Maps”

https://www.google.com/intl/de_de/help/terms_maps.html.

9. Duration of data storage

Please note that we will automatically delete your personal data or block it from further use if or when the purpose of data collection is no longer relevant.

10. Your rights as a data subject

If you exercise any of your rights, pursuant to this section or pursuant to applicable law, we will communicate any correction to or deletion of your personal data or restriction of processing carried out in accordance with your request to each recipient to whom the personal data has been disclosed, unless such communication proves impossible or involves disproportionate effort.

If you wish to exercise these rights and/or obtain all relevant information, please contact the Data Controller or the Data Protection Officer. You will be asked to provide some of the identification information that you submitted upon your registration; this is necessary to verify that the request has been sent by you. We will respond within one month after receipt of your request, but we reserve the right to extend this period by two months. We will, in any event, inform you within one month after receipt of your request if we decide to extend the response period.

10.1 What you may request

In accordance with applicable law and as detailed below, you have the right to request access to, correction, deletion, or portability (e.g., transfer of your personal data to another service provider) of your personal data, as well as to request restriction of such processing.

10.2 Correction of your personal data

Under applicable law, you have the right to correct the personal data that you share with us. Via your settings in Services, you can update your account information, change your profile settings, subscribe to / unsubscribe from communication you receive from us, and set your Services sharing preferences, including location-based functionalities. Please be informed that if you wish to limit or change access to or sharing of your personal data with a social network, you must change your account settings on that social network.

If you registered for our Services in written format, please contact the Data Controllers detailed in Section 2 above in writing or via e-mail to correct your personal data.

10.3 Integrity of your personal data

We will take adequate steps to ensure that you are able to keep your personal data up to date. You may contact us at any time to request confirmation regarding whether or not your personal data is still being processed.,

If you find that the personal data processed is inaccurate or incomplete and you are unable to update your personal data according to Section 9.2 of this Privacy Policy, you may ask us to update your personal data. We will verify your identity and update your personal data.

10.4 Deletion of your personal data

You may ask us to delete your personal data at any time. We will immediately delete all of your personal data upon request. We will also delete (and ensure deletion by the processors we engage) all of your personal data if we are required to do so under applicable law.

10.5 Restriction of processing

If you ask us to restrict the processing of your personal data, e.g., if you contest the accuracy of, lawfulness of, or our need to process your personal data, we will limit processing of your personal data to the necessary minimum (storage) and, if applicable, will only process it for the establishment, exercise, or defense of legal claims or, when necessary, for the protection of the rights of another natural or legal person, or other limited reasons dictated by applicable law. Once the restriction is lifted and we continue processing your personal data, you will be informed accordingly without undue delay.

10.6 Portability of your personal data

You have the right to receive the personal data that you provide to us. Upon receipt of your request, we will submit your personal data in a commonly used and machine-readable format without undue delay. Upon request, we will send your personal data to any third party (data controller) that you identify in your request, unless such request would adversely affect the rights or freedoms of others, when technically feasible.

10.7 Complaints to a data protection authority

You have the right to submit complaints concerning our data processing activities. Please address your complaints to:

Landesbeauftragter für Datenschutz und Informationsfreiheit Nordrhein-Westfalen

Kavalleriestraße 2-4, 40213 Düsseldorf, Germany

Telefon: 0049 (0) 2211 38 424 0

Fax: 0049 (0) 211 38 421 10

E-mail: poststelle@ldi.nrw.de

Website: www.ldi.nrw.de

11. Updating of Privacy Policy

We may revise or update this Privacy Policy from time to time. Any changes to this Privacy Policy will become effective upon the posting of the revised Privacy Policy on our website.