Scentre Group Privacy Policies

As at 6 December 2019

Scentre Group general privacy policy

Your privacy is important to Scentre Group

Scentre Group recognises the trust you are placing in us through your dealings with us. We are committed to the protection of your personal information. Our policies comply with our obligations under the Australian Privacy Principles that form part of the Privacy Act 1988 (Cth) (Australia) and the Information Privacy Principles that form part of the Privacy Act 1993 (New Zealand), as required, and are intended to protect your privacy in respect of any personal information that you may provide to us. We have also taken steps to ensure that, if you tell us you are located in the European Union, and advise us that you wish to exercise the additional rights available to you under the General Data Protection Regulation, we will endeavour to meet those requests subject to the below terms.

Members of the Scentre Group, comprising Scentre Group Limited ABN 66 001 671 496, Scentre Management Limited ABN 41 001 670 579 (as responsible entity of Scentre Group Trust 1 ABN: 55 191 750 378), RE1 Limited ABN 80 145 743 862 (as responsible entity of Scentre Group Trust 2 ABN 66 744 282 872) and RE2 Limited ABN 41 145 744 065 (as responsible entity of Scentre Group Trust 3 ABN 11 517 229 138) and their respective controlled entities, and the owners of the Australian and New Zealand shopping centres managed by members of the Scentre Group (referred to in these terms and conditions as Westfield shopping centres), may collect personal and other information in the circumstances set out below, either directly or through their authorised agents and subcontractors. We refer to each of these entities in this policy as "us", "we", or "Scentre".

What personal information Scentre generally collects and why:

Customers

Scentre collects information from customers in a number of different ways. These include the following:

• In connection with competitions or signing up to email or mobile newsletters (either while in a Westfield shopping centre ("in-centre") or online), customers provide us with their contact details. Your name and address are automatically entered into Scentre’s database when you enter competitions. Scentre collects these details to contact competition winners, and to inform customers about events, activities and promotions, both in-centre and as part of Scentre's other activities. Customers have the option to opt out from receiving this information.
• When customers hire mobility aids or other equipment from Scentre, or apply to use certain restricted spaces at Westfield shopping centres, customers provide Scentre with certain information, including contact information . Scentre collects this information to ensure that there is a record of the hirer and to enable customers to be informed about upcoming events, activities and promotions, both in centre and as part of Scentre's other activities.
• When customers attend Westfield shopping centres and car parks under video and camera surveillance. When entering Westfield shopping centres and car parks, customers' personal information, car licence plate details and images may be collected by Scentre, and Scentre may also collect customers' personal information and images from third parties (for example, the police or retailers) in connection with the management and security of Westfield shopping centres. This information may be used by Scentre in connection with the management and security of Westfield shopping centres. This information may be provided to law enforcement and government bodies, Scentre staff and subcontractors, third parties who provide Scentre with services from time to time, insurers and retailers for those purposes.
• When customers park in our car parks with a ticketless parking system or car locator functionality, customers consent to provide us with their car licence plate details and, in some circumstances, other information including name, email address and telephone number. These details are used for measuring and analysing car parking dwell times and shopper behaviour in order to improve Westfield shopping centres, for the purposes of providing and managing car parking at Westfield shopping centres, marketing purposes and also to assist customers to locate their cars including via online and mobile applications.
• When customers use mobile applications developed by Scentre, or logon to Wi-Fi provided in Westfield shopping centres or third party applications utilising Scentre’s infrastructure (including Bluetooth beacon networks), customers provide Scentre with certain information, including their contact details and location. Scentre collects this information to enable customers to be informed about upcoming events, activities and promotions, both in-centre and as part of Scentre's other activities, sponsor and retailer promotions and other activities.
• When customers purchase, redeem or are provided with Westfield Gift Cards, they may provide Scentre with their contact details. These details are used for card fulfilment purposes and, if customers opt in, to contact customers about events, activities and promotions, both in centre and as part of the Scentre's other activities.
• Where customers provide their, or another person’s, contact information and personal stories to Westfield Community. These details are used to carry out community programs, like Westfield Local Heroes. In addition to the purposes set out above, this information may be used by Scentre in connection with the management and security of Westfield shopping centres generally, to obtain feedback about a customer’s experiences at a Westfield shopping centre (including with our retailers), and may be provided to law enforcement and government bodies, insurers, Scentre staff and subcontractors, third parties who provide Scentre with services from time to time and retailers for these purposes. Where you provide information to us in different ways, or we hold information about you, Scentre may connect information provided to us for one purpose, with other information for use for one or more of the above purposes. Additionally, Scentre also conducts certain online activities through the Scentre websites, and associated sites managed by members of the Scentre Group or their subcontractors. The collection of personal information through these activities and information associated with these websites is dealt with in the Scentre Online Privacy Policy, which can be found below.

Retailers

Scentre may collect the following types of personal information from unincorporated retailers, guarantors and other individuals related to retailers during negotiations for, and during the term of, the lease/licence for premises, kiosks and other activations at Westfield shopping centres:

• Name, address and date of birth;
• Contact and insurance details;
• ABNs;
• Information as to retailers' financial standing and retailing experience; and
• Other financial and trading information.

Scentre requires this information to evaluate whether the relevant centre owner should enter into a lease, licence or other agreement with a retailer; to assist Scentre in the preparation of that document; to manage Scentre’s relationship with retailers; in connection with the management and security of Westfield shopping centres; and in order to monitor the performance of Westfield shopping centres. Occasionally, the information may also be made available to others in connection with these activities, in order for those people to provide services to Scentre or as required by law, as well as to third parties in connection with any transactions involving the ownership of the Westfield shopping centre.

If the retailer provides Scentre with direct debit or direct credit details, Scentre will only disclose those details to Scentre's bank to facilitate the provision of that service.

Additionally, as noted above, Westfield shopping centres are under video and camera surveillance. When entering Westfield shopping centres, the personal information and images of retailers and their staff may be collected by Scentre. This information may be used by Scentre in connection with the management and security of Westfield shopping centres and may be provided to law enforcement and government bodies, insurers, Scentre staff and subcontractors, third parties who provide Scentre with services from time to time and other retailers for those purposes. This information is held securely and in a format which is access controlled, unless it is necessary to use this information for these purposes.

Securityholders

Scentre maintains securityholder registers through an external service provider, currently Computershare Investor Services Pty Limited (Computershare). Scentre requires Computershare to comply with the requirements of the Privacy Act 1988 (Cth) in Australia or the Privacy Act 1993 in New Zealand when performing these services. Scentre Group may collect personal information of its securityholders either from Computershare or directly from securityholders.

Personal information collected from securityholders (being members of the Scentre Group (ASX code: SCG) and Carindale Property Trust (ASX code: CPD) includes: contact information, bank account and securityholding details and tax file numbers.

This information is used primarily to carry out registry or investor relations functions such as payment of distributions, sending annual and half yearly reports, notices of meetings or newsletters and notifications to the Australian Tax Office or New Zealand Inland Revenue Department (where necessary).

This information may also be used for the purposes of Scentre Group complying with legal or regulatory requirements, investigating or preventing any suspected fraud or crime, informing securityholders about new initiatives concerning Scentre Group, or for any other purpose which a securityholder authorises Scentre Group to from time to time.

More information on Computershare’s privacy policy can be found at www.computershare.com/au/help/Pages/privacy-policies.aspx

Suppliers

If you, or a company you work for, supplies goods or services to Scentre, Scentre may collect personal information about you in connection with the provision of those goods or services, either directly from you or from that company. This information may include your name, date of birth, contact information, and any other information you provide, or provided on your behalf, as part of our induction and compliance processes. This information will be used for the purposes of managing the provision of those good or services.

Employees or potential employees

If you are employed by a member of the Scentre Group, or are seeking employment with a member of the Scentre Group, Scentre may collection personal information about you in connection with your employment. This information may include your name, date of birth, contact information, and any other information you provide, or provided on your behalf, as part of our induction and compliance processes. This information will be used for the purposes of our recruitment process and, if successful, managing your employment, in accordance with the requirements of the Privacy Act 1988 (Cth) in Australia or the Privacy Act 1993 in New Zealand. You need to ensure this information is up to date, in accordance with Scentre’s policies and procedures.

Unsolicited Information

If we receive personal information about you that we did not ask for either directly from you, from someone on your behalf, or through someone on our behalf, and we determine that we could have collected this information from you had we asked for it, we will take reasonable steps to notify you, as soon as practicable, that we have collected your personal information. If we could not have collected this personal information from you (or if you do not agree to us collecting information in this way), we will lawfully de-identify or destroy that personal information. Any unsolicited information provided by you, someone on your behalf or someone on our behalf, will be used for the purposes for which it was provided.

Other information we collect

We may also collect the following information from you:

• Where devices are enabled to connect to, or are identifiable by, in-centre infrastructure (for example, in-Centre WiFi networks or blue tooth transmitter (beacon) infrastructure), we and our third party providers may automatically collect data from those devices including usage, type of device and location and proximity of your wireless device in-centre, centre arrival and departure time, and other data which users consent to us collecting from time to time;
• Audience measurement information collected passively using in centre technologies such as SmartScreen Advertising Units which utilise image processing software to aggregate data such as shopper numbers and demographics. These technologies do not identify individual shoppers, or record or retain images of individual shoppers.
• The fully qualified domain name from which you accessed our websites, or alternatively, your IP address;
• Device ID number (MAC address);
• The date and time you accessed each page on our websites;
• The URL of any webpage from which you accessed our websites or using in-centre WiFi, and the details of any mobile apps you have accessed from a device using in-Centre WiFi;
• Publicly accessible social media posts and any personal information you allow us to collect by linking your account on our website with a third-party social-networking site including but not limited to Facebook, Twitter, or Google+;
• Cookies which track your visits to our web sites;
• The web browser that you are using and the pages you accessed; and any online applications we have created or operate which you install or access on a mobile device or computer. We are collecting this information (and may use or hold this information) for the following purposes:
• So that we can tell which web pages are the most popular and where shoppers spend most of their time;
• To improve our website, applications or in-centre experiences;
• For the purposes of and incidental to your use of in-centre Wi-Fi services (if applicable), our mobile apps, online services and gift card services;
• To measure shopper numbers, characteristics and demographics, and analyse shopper behaviour in order to continuously improve our centres and for use otherwise in connection with our business;
• To send to you special deals and discounts, surveys and other marketing materials based on your location or known web usage; and
• For other purposes to which you, either expressly or impliedly, consent to, and for the purposes set out in these terms and conditions, we may provide this information to Scentre Group’s agents, contractors, service providers, joint venture and commercial partners and regulatory authorities, and may transfer your personal information to others in countries outside Australia and New Zealand (including to those that operate our cloud servers outside of Australia and New Zealand). Scentre Group may use the anonymised data for the purposes set out above and to inform our promotional and marketing strategies, as well as research and profiling purposes including customer demographics, interests and behaviours based on personal information and other information provided to us. This research may be compiled and analysed on an aggregate basis, and we may share this aggregate data with our affiliates, agents and business partners. This aggregate information does not identify you personally. We may also disclose aggregated information in order to describe our services to current and prospective business partners, and to other third parties for other lawful purposes. Scentre Group may connect information you provide to us for one purpose with other information for use for one or more of the above purposes. If you access or log-in to an in-centre Wi-Fi service, and we already hold other information (both personal or non-personal) that can be associated to you or the device on which you are accessing the Wi-Fi service (including, but not limited to a device ID number (MAC address)), then that information may be linked with personal information we hold about you as set out in this policy, and will be treated in the same manner as the personal information to which it has been linked.

Who collects the information

Personal information collected about individuals (as described above) may be collected by, or on behalf of:

• Members of the Scentre Group; and
• The owners of Westfield shopping centres in Australia and New Zealand. Information may also be collected by Scentre on behalf of other people as set out in notices given to individuals, or consents given by individuals, at or prior to the time the personal information is collected.

How your personal information is stored and kept secure

All personal information collected by Scentre is held securely, whether on Scentre's physical files, in Scentre's computer systems or in a database (which may be hosted by Scentre or a third party on Scentre’s behalf). This information is only made available to Scentre staff on a 'need to know' basis and for the purposes outlined above or to other people as outlined in this policy who have agreed to treat that information confidentially. These databases are protected by a firewall as well as host-based security. Your personal information may be transmitted over the internet once it has been stored in a database and may also be transferred across borders to recipients in foreign countries other than Australia and New Zealand, including the United States of America and United Kingdom, and may be stored on servers, using databases or via cloud technology in a number of countries other than Australia and New Zealand, including regions such as the Americas, the European Union and Asia, where doing so is part of Scentre’s ordinary business practices relating to the storage of data and where permitted by law.

If Scentre ever has a requirement to transmit such data over the Internet (for example, to make an off-site back up) it will be in an encrypted or otherwise secured form. By providing us with your personal information, you consent to these transfers.

Securityholder information is held by the registry in accordance with registry arrangements which require such information to be held securely.

We will use all reasonable endeavours to keep your personal information in a secure environment. However, this security cannot be guaranteed due to the nature of the Internet. These measures are designed to assist in your personal information not being accessed by unauthorised personnel, lost or misused. If you reasonably believe that there has been unauthorised use or disclosure of your personal information please contact us (see below).

All reasonable steps are taken by us to ensure that your personal information held by us is accurate, complete and up to date. If you believe that any of your personal information is inaccurate, please contact us (see below) and we will take all reasonable steps to correct it within a reasonable timeframe.

The electronic environments are monitored by Scentre Group and third party specialist security monitoring companies. Scentre Group reviews its security arrangements regularly, and implements improvements when necessary.

Disclosing your personal information

We understand how important it is to keep your personal information private, so we will disclose personal information we have about you only in certain specific circumstances, when:

• You agree to the disclosure; or
• We use it for the purposes we collected it; or
• Disclosure is required or authorised by law. To the extent permitted by law, we may also disclose information about you to:
• Related companies for marketing purposes;
• The owners of Westfield shopping centres managed by members of the Scentre Group from time to time;
• Third parties who provide services to Scentre from time to time;
• Government agencies as part of our statutory obligations; or as otherwise permitted by law.

Right of access to and correction of your information

You have rights to access, update and correct your personal information held by us. We will take reasonable steps to ensure that personal information is up-to-date, accurate and complete.

If you wish to access, update or correct your personal information held by us, please contact our Privacy Officer, whose details appear below, or your relevant shopping centre manager.

How long do we hold your information?

We will keep your personal information for only as long as is necessary to achieve the purpose for which we collected it.
SCENTRE ONLINE PRIVACY POLICY

What information we collect and why

When you become a registered user of westfield.com.au, scentregroup.com, westfield.co.nz, or any associated site (Site), including when you use services offered by a Site, subscribe to Scentre's Email Newsletters service or shop with Participating Retailers, we may ask for information including:

• Your name;
• Your email address; and
• In certain circumstances, your telephone number, address or credit card details. The Site is an Australian based website, and it is not intended to provide services to EU residents, and its terms may not be fully consistent with the General Data Protection Regulation. If you are an EU resident and you choose to use the Website then you do so at your own risk, and on the terms of the Site.

On the Site we invite you to:

• View products from Participating Retailers;
• Shop with Participating Retailers;
• Set up a membership of the Site;
• Subscribe to Scentre's Email Newsletters;
• Purchase Westfield Gift Cards;
• Submit your resume (and other related applicant information including background information) to us for consideration of job vacancies;
• Become a member of, and participate in, an online insights community, and provide comments and insights on your experiences relating to Westfield shopping centres;
• Tell us about your shopping experiences by completing a customer service survey; and
• Tell us about any other matter by contacting us directly. We collect this information in order to facilitate your access to the Site and the functionality provided by the Site. If you do not provide us with this information, we may not be able to provide you with access to all or part of the Site or functionality offered through the Site. In addition to the purposes set out above, this information may be used by Scentre in connection with the management and security of Westfield shopping centres and the operation of the Site generally, and may be provided to law enforcement and government bodies, insurers, Scentre staff and subcontractors, third parties who provide Scentre with services from time to time and retailers for these purposes. If you submit your resume to us (including other related information relating to job applications), we will keep it in a database (which may be hosted by Scentre or a third party on Scentre’s behalf) for consideration of particular jobs that arise within Scentre. We also use this information to send to you special deals and discounts, surveys and other marketing materials based on your location or known web usage.
• The Customer Service Survey that you complete will be used to help us improve our services at Westfield shopping centres, or to improve our Site.
• We update the information we hold about you, for example, your resume, when you provide or we receive new information about you. We may connect information, including personal information with other information for use for one or more of the above purposes.

Other information we collect

We may also collect the following information during your visit to the Site and to the websites of Participating Retailers:

• The fully qualified domain name from which you accessed our Site, or alternatively, your IP address;
• The date and time you accessed each page on our Site;
• The URL of any webpage from which you accessed our Site (the referrer);
• Cookies which track your visits to the Site;
• The web browser that you are using and the pages you accessed;
• Detail of the purchases you make on the websites of Participating Retailers; and
• If you are a member of our online insights community, we may also collect the above information as well as your postcode, suburb and general demographic information.
• We use this information so that we can tell which pages are the most popular and where shoppers spend most of their time. We use this information to improve our Site. We may connect information you provide to us for one purpose, with other information for use for one or more of the above purposes. If this information is linked with personal information we hold about you as set out above, this information becomes personal information and will be treated in the same manner as the personal information to which it has been linked.

How your information is stored

Information held about you (for example, your E-mail Newsletter subscriptions) is held in a database. The database is protected by a firewall as well as host-based security. Your personal data may be transmitted over the Internet once it has been stored in the database and may also be transferred across borders to foreign countries, where doing so is part of Scentre’s business practices relating to the storage of data and where permitted by law. If Scentre ever has a requirement to transmit the data over the Internet (for example, to transmit your purchase through a payment gateway or to make an off-site back up) it will be in encrypted form. If you provide us with additional information to verify your identity, we will destroy the copies of the documents you provide to us after we have successfully verified your identity.

How you can unsubscribe from the Email Newsletters service

You can choose to unsubscribe from our email newsletters either by clicking the “unsubscribe” link at the bottom of any email newsletter you receive or by going to:

• westfield.com.au/unsubscribe for our Westfield Australia shopping centres’ database; or
• westfield.co.nz/unsubscribe for our Westfield New Zealand shopping centres’ database.

There is no fee for this access.

Advertisers and Partners on Scentre Group Websites

Scentre may allow advertising on its Site from time to time. Once you have clicked on an advertisement and have left the Site, our privacy policy no longer applies. You must read the privacy policy of the advertiser or subsequently visited site to see how your personal information will be handled on those sites. In addition, many business advertisements may be managed and placed on our Site by third-party companies. These "network advertisers" collect non-personal information when you click on or scan one of their banner advertisements. The information is collected using technology, so you may not realise it is being collected. The network advertisers collect this information so that they may show you ads that are more relevant or interesting to you.

On occasion the Site may also provide content that is created by a third-party partner website. In some instances the third-party sites will collect information in order to facilitate the transaction or to make the use of their content more productive and efficient. In these circumstances, the information collected is shared between Scentre and our third-party sponsors.

Disclosing your information

We understand how important it is to keep your personal information private, so we will disclose personal information we have about you only in certain specific circumstances, when:

• You agree to the disclosure;
• We use it for the purposes we collected it; or
• Disclosure is required or authorised by law.

We may also disclose information about you to:

• Related companies for marketing purposes;
• The owners of Westfield shopping centres managed by members of the Scentre Group from time to time;
• Where you place an order to purchase goods or services from Participating Retailers, to Participating Retailers or their agents (such as financial institutions or our courier companies);
• Third parties who provide services to Scentre from time to time, including marketing, insights, recruiting and survey services; and
• Law enforcement and government agencies as required from time to time.

Junk mail or unsolicited email

You will only receive emails from Scentre if:

• You subscribe to our Email Newsletters service. Our Email Newsletters will keep you informed of the latest offers, current promotions and specials at the centre(s) of your choice and also Media Releases, Annual Reports and Financial Reports from the Scentre Corporate site. If you no longer wish to receive Email Newsletters, you may unsubscribe either by clicking the “unsubscribe” link at the bottom of any email newsletter you receive or by going to the relevant unsubscribe link set out above;
• A friend nominates you to receive a page from the Westfield Site. The email will be sent to you on behalf of your friend. You will not receive subsequent e-mails from us, because Scentre will not record your e-mail address;
• You request information about our services when you choose to contact us. You will not be added to a mailing list of any kind and will only receive e-mail in the matter that you have contacted us about;
• You provide your details and request that we contact you when you send us your resume or when you complete our customer service survey; or
• They are otherwise relevant to the reasons for which we hold your email address, where we are permitted to do so by law.

What is a cookie and what are they used for?

A cookie is a text file placed into the memory of your computer by our computers. A copy of this text file is sent by your computer whenever it communicates with westfield.com.au or westfield.co.nz (as applicable). Scentre uses cookies to identify you between multiple visits, to better understand how westfield.com.au or westfield.co.nz is used, and to provide you information which may be of interest to you based on your previous visits to westfield.com.au or westfield.co.nz and to provide targeted advertising to you (including through adservers and other third party advertisers) when you visit westfield.com.au or westfield.co.nz and certain other websites where advertising is found from time to time. We may provide the information we gather from cookies to third parties for these purposes and for other purposes connected with westfield.com.au. If cookie information is linked with personal information we hold about you as set out above, this cookie information becomes personal information and will be treated in the same manner as the personal information to which it has been linked. If you do not want adservers or other third party advertisers to use cookies to provide you with targeted advertising, we suggest you use an opt out mechanism which can be found on:

• the Network Advertising Initiative opt-out provided; through networkadvertising.org/choices/DAA;
• the Digital Advertising Alliance opt-out provided ;through aboutads.info/choices/; or
• the Interactive Advertising Bureau (EU) opt-out provided through youronlinechoices.eu

You do not have to accept cookies and you can set up your browser to notify you when you receive cookies. This will give you the opportunity to decide whether or not to accept the cookies. If you choose to disable cookies, you may not be able to access certain features of the website.

General

Tips on sending us information

While we do all we can to guard your privacy, no data transfer over the Internet is 100% secure. When you share your information with us, it is at your own risk. There are ways you can help maintain the secrecy of your information:

• Always close your browser when you have finished your user session; and
• Ensure others cannot access your personal information and emails if you use a public computer.

If something goes wrong

Please contact us by email or by phone, if you believe:

• Someone has gained access to your personal information by mistake;
• We have breached our privacy obligations or your privacy rights in any way; or
• You would like to discuss any issues about our privacy policy.

We will try to satisfy any privacy questions that you have and correct any errors on our part. If you still have concerns please contact our Privacy Officer by email to privacy@scentregroup.com, or phoning +61 2 9358 7000 (Australia) or +64 9 978 5050 (New Zealand).

Changes to our privacy policy

This privacy policy relates to our current privacy standards. We may vary our privacy policy from time to time. We will notify you of any changes by publishing the latest policy from time to time at westfield.com.au/privacy-policy and at westfield.co.nz.

Further information regarding Privacy Legislation

If you would like further information relating to the Australian Privacy Legislation and the Australian Privacy Principles, please visit oaic.gov.au.

If you would like further information relating to the New Zealand Privacy Legislation and the Information Privacy Principles, please visit privacy.org.nz.

Scentre Group Contact Details

Please contact Scentre's Privacy Officer or your centre manager if you believe:

• Someone has gained access to your personal information by mistake;
• We have breached our privacy obligations or your privacy rights in any way; or
• You would like to discuss any issues about our privacy policy.

You can contact Scentre's Privacy Officer by:

Phone: +61 2 9358 7000 (Australia) or +64 9 978 5050 (New Zealand)
Email: privacy@scentregroup.com
Post: Privacy Officer. Scentre Group Level 30, 85 Castlereagh Street Sydney, NSW 2000, Australia

or

Privacy Officer, Scentre Group P.O. Box 109-280, Newmarket Auckland 1149, New Zealand

As at 18 February 2020

Scentre Group, through the Westfield Plus application (the Westfield Plus App),
collects your personal information to:

• establish a profile of you;
• give you access to membership services;
• allow you to activate and manage Westfield Digital Gift Cards; and
• serve personalised offers.

Scentre Group may also share personal information with our service providers who provide services to you through your Westfield Plus Membership, including processing of payments relating to goods and services, issuing and processing Westfield Digital Gift Cards and related transactions, financial institutions, gateway providers, delivery service providers and organisations that assist us to check for or prevent unauthorised or fraudulent transactions, in order to deliver you relevant benefits when you are in our shopping centres.

If you have any questions or would like further information about the collection of your personal information, you can contact us at privacy@scentregroup.com.

The information we collect

Profile information

We collect personal information about you when you create your Westfield Plus Membership or update your details.

The type of information we collect includes your email address, and it may also include, but is not limited to, your name, your vehicle’s number plate, payment details and mobile phone number. This also includes the preferences and settings you enable for your Westfield Plus Membership.

Information relating to your use of the Services

We may collect additional personal information when you choose to use services as a Westfield Plus Member, including the Westfield Plus App. This includes:

1.2.1 Location information: Where you have authorised the Westfield Plus App to access location services on your mobile device, and when the app is open, we use geo-location to collect location information in the following circumstances:

• Each time you use the Westfield Plus App to activate and add a Westfield Digital Gift Card to your mobile wallet, we use location services to check you are in Australia. This is because we do not allow the activation of a Westfield Digital Gift Card outside of Australia. We do not collect or store your specific location when performing this check.

• When you use the Westfield Plus App for any other purpose, we check your proximity to a Westfield centre. If we are able to determine that you are in a Westfield centre, then we also collect your precise latitude and longitude. If we determine that you are not at a Westfield centre, then we do not collect or store your specific location.

1.2.2 Usage information: We collect information about how you use our services as a Westfield Plus Member. This includes when you use our services in a Westfield centre, including the types of service used, when and how long for. It also includes when you access the Westfield Plus app, the app features used or pages viewed, app error reports, and other system activity.

• If you have activated a Westfield Digital Gift Card, we also collect transaction information made with the card, including the retailer and cost of each transaction.

1.2.3 Device information: We may collect information about the devices you useto access the Westfield Plus App, including but not limited to the hardware models, operating systems and versions, and mobile network information.

How we use your personal information

We use your personal information to:

2.1 Operate and administer the Westfield Plus Membership program. This includes providing it to third parties who provide services to us in connection with your Westfield Plus membership, including processing of payments relating to goods and services, issuing and processing Westfield Digital Gift Cards and related transactions, financial institutions, gateway providers, delivery service providers and organisations that assist us to check for or prevent unauthorised or fraudulent transactions, or who facilitate payments made through the Westfield Plus App;

2.2 Communicate with you about your Westfield Plus Membership, including surveys about your visits to Westfield centres and experience with the Westfield Plus App;

2.3 Combine de-identified and aggregated data with other third party-provided data sets that Scentre Group has authorised access to for business insight purposes;

2.4 Share data analytics and insights of de-identified and aggregated data with other owners of Westfield centres and their retailers, as well as Scentre Group’s commercial and brand partners, for business insight purposes;

2.5 If you have given us consent to receive marketing and promotional offers, send you information about the Westfield Plus Membership program, including member benefits and targeted offers from Scentre Group and our commercial and brand partners.

2.6. Optimise and personalise your experience, including the Westfield Plus App experience, the marketing communications you have consented to receive, and your experience when you visit a Westfield centre;

2.7 Comply with our legal, audit and reporting obligations where required by law;

2.8 Respond to feedback, queries and complaints regarding your Westfield Plus membership or the Westfield Plus App; and

2.9 Comply with purposes to which you, either expressly or impliedly, consent to.

How we use your location information

3.1 When using the Westfield Plus App to activate your Westfield Digital Gift Card we use your location information to check that you are in Australia.

3.2 We also use your location information while using the Westfield Plus App to check whether you are in Australia or New Zealand so that we can determine your proximity to a Westfield centre and show the nearest Westfield centre to you. We may also enable certain features and information, such as parking information, in the Westfield Plus App when you are near or in a Westfield centre. If you are not at a Westfield centre, then you may continue to use the Westfield Plus app, however some functionality may not be available.

3.3 Where you have otherwise enabled your mobile device to connect to, or be identifiable by, other in-centre infrastructure (for example, in-centre WiFi networks or blue tooth transmitter (beacon) infrastructure) outside the Westfield Plus App, we may also combine the location information you have consented to be collected through those other sources with location information collected through the Westfield Plus App for the purposes set out in 2.4 and 2.5. We also use this information to improve the location-based services provided to you.

Please also refer to the Privacy Policy, which contains further information about:

• How we handle your personal information;
• How you can access, update or correct the personal information we hold about you; and
• How you can make a privacy complaint and how we deal with privacy complaints.

Scentre Group

Members of Scentre Group means Scentre Group Limited ABN 66 001 671 496,
Scentre Management Limited ABN 41 001 670 579 (as responsible entity of Scentre Group Trust 1 ABN: 55 191 750 378), RE1 Limited ABN 80 145 743 862 (as responsible entity of Scentre Group Trust 2 ABN 66 744 282 872) and RE2 Limited ABN 41 145 744 065 (as responsible entity of Scentre Group Trust 3 ABN 11 517 229 138) and their respective controlled entities, and the owners of the Australian and New Zealand shopping centres managed by members of the Scentre Group (referred to in these terms and conditions as Westfield shopping centres).