Privacy Notice

This section of our website is designed to help you understand what we do with information about people, referred to as “personal data”.

As we undertake a wide range of activities, we’ve divided this Privacy Notice into a number of different sections, reflecting the different ways you might interact with us, in order to help you get to the information you want quickly.

Unless otherwise stated in the sections, the data controller of your information is Great Portland Estates Services Limited (company number 5517550) of 33 Cavendish Square, London, W1G 0PW, which is the property management company of Great Portland Estates plc (company number 00596137) of 33 Cavendish Square, London, W1G 0PW.

If you have any questions or concerns about the information on this page, or about what we do with personal data, you should email us at dataprotectionmanager@gpe.co.uk, or write to us at the above address, for the attention of the Data Protection Manager.

Our approach to how long we keep your information is set out in more detail below.

In each case, you have certain rights, including how to get a copy of your data, how to get it corrected or deleted and how to complain. These rights are set out in more detail below.

Who are you?

You are an occupier of, or visitor to, one of our buildings or our head office

We store and use your information for the purposes of managing and operating our buildings.

The information we collect about you and why we collect it

In order to manage and operate our buildings, we will collect and store contact information about you, such as your name, company and email address. We may also store a photograph of you (for identification purposes). If you are a visitor, we will also collect and store information about your visit.

We use CCTV at our buildings for the purposes of crime prevention, security and public safety and, accordingly, will capture imagery of visitors to, and occupiers of, our buildings.

We will also use that information:

for the purposes of your involvement in fire, incident and/ or crisis management planning at our buildings;
to maintain our operational records;
to record information (including relevant medical information) for health and safety purposes where you suffer an incident at one of our building and for Covid-19 control purposes; and
to issue you with a permit to work for health and safety purposes.

Who we share it with

We only share the information we collect with the following third parties:

our suppliers to the extent it is necessary for them to perform their services to us;
where access control information or a permit to work relates to a particular occupier’s own premises, we will share the information with that occupier. Similarly, we will share fire evacuation information with our occupiers too;
where the information relates to health and safety incidents, security events or any matter giving rise to an insurance claim or relevant to our insurance coverage, our lawyers, insurance brokers and other professional advisers; and
the police in the event of a criminal event occurring.

The legal basis for processing it

Except in the circumstances highlighted below, we process this information on the basis of our legitimate interests:

we have a legitimate interest in wishing to interact with you to manage and operate effectively our buildings and to ensure that those buildings are safe and secure for all persons occupying or visiting them;
to be able to do so, we need to understand details of who is in the building and to be able to communicate with them; and
the processing we undertake is limited and concentrates on your use of the building.

Where we are required by law to hold certain records for health and safety purposes, then we collect and hold those records to comply with that statutory obligation. Where those records contain medical information, we collect and hold them on the basis that we need to do so to hold them for evidential purposes.

Where we are engaging individual contractors we will also use details of their time on site to enable us to perform our contract with them.

Transfer of your data to other countries, and how we safeguard your rights when we do so

We do not transfer any of this personal data to other countries.

Automated decisions we make about you

We do not make automated decisions using this information.

You are an occupier of, or visitor to, one of our app-enabled buildings

We use a portal and app for the purposes of managing and operating some of our buildings, which gives you access to a greater range of services relating to them.

The information we collect about you and why we collect it

In order to operate the portal, we will process the following information about you (which is collected via the portal): name, company name, email address, and anything you post on the app/ portal.

We will also use that information:

to provide information to you that is relevant to your use of the building;
to provide you with a range of on-line services relating to that building; and
on an anonymous basis so we can better understand how our buildings are used by their occupants.

Who we share it with?

We only share this information with the following third parties:

D2 Interactive Limited, who have created and operate the app/ portal. This is shared with them on a controller to controller basis and they also process certain personal data for us on processor basis. Full details of how they use your data are set out in their privacy policy at https://200gir.smartspaces.app/privacy-policy/; and
Privée Limited, who acting as our processor provide a concierge service (branded as ‘Lifestyle’) on our behalf linked to the portal.

The legal basis for processing it

We process this information on the basis of our legitimate interests:

we have a legitimate interest in wishing to provide an additional range of online services and information to you in order to improve your use of the building;
to be able to do so, we need to process your registration details and may moderate anything you post in order to ensure that the app/ portal is not used for illegal purposes or otherwise causes damage or distress; and
the processing we undertake is limited and concentrates on your use of the app/ portal insofar as it relates to the building.

Transfer of your data to other countries, and how we safeguard your rights when we do so

We do not transfer any of this personal data to other countries.

Automated decisions we make about you

We do not make automated decisions using this information.

You have an occupational agreement with us

If you are entering or have entered into an occupational agreement with us, then in addition to our use of your information in accordance with the section entitled an occupier of, or visitor to, one of our buildings or our head office, we also collect and hold further information about you related to our management and administration of your occupational agreement with us.

The information we collect about you and why we collect it

In order to carry out due diligence on you (if you are an actual or prospective party to an occupational or other legal agreement with us), we will collect and process your name and other contact details together with details of your bank account and other relevant financial information.

If you enter into an occupational or other legal agreement with us, then to manage our portfolio of buildings and perform those agreements we will continue to store those details together with contact details for your representatives.

To ensure we engage with our occupiers, we will use your information:

to undertake occupier satisfaction surveys; and
to provide a regular newsletter.

Who we share it with

We only share the information we collect with the following third parties:

we will provide your information to utility companies as and when you move into or move out of one of our buildings;
our joint venture partners and banks; and
we also provide information about you to our agents and other professional advisers in order to progress and complete transactions.

The legal basis for processing it

Except in the circumstances highlighted below, we process this information on the basis of our legitimate interests:

we have a legitimate interest in wishing to interact with you and to administer and manage your occupational agreement with us;
to be able to do so, we need access to information about you and your agreement; and
the processing we undertake is limited and concentrates on the management of your occupational agreement with us.

Where we collect information about you for the purposes of carrying out due diligence on you, we do so on the basis that it is necessary to do so to enter into an occupational agreement with you.

Where we process your bank account details or the name and address of our occupiers, we do so on the basis that it is necessary to perform our occupational agreement with you.

Transfer of your data to other countries, and how we safeguard your rights when we do so

We do not transfer any of this information to other countries.

Automated decisions we take about you

We do not make any automated decisions using this information.

You are one of the neighbours to our projects

We store and use your information for the purposes of managing our construction projects.

The information we collect about you and why we collect it

As part of the consultations we undertake with regards to our construction projects, we will collect contact information about some of our neighbours and, in some cases, a photograph and dietary requirements (should you attend one of our events).

Who we share it with

We only share the information we collect with the following third parties:

local and statutory authorities in order to meet our legal obligations to them;
our suppliers who constitute the project team to the extent it is necessary for them to communicate and consult with our neighbours; and
where we hold a joint event with a third party in respect of a project, we will share the attendance list with our joint host or event organiser.

Legal basis for processing it

Except in the circumstances highlighted below, we process this information on the basis of our legitimate interests:

we have a legitimate interest in wishing to consult with our neighbours over our projects;
to be able to do so, we need to understand details of who those neighbours are and to be able to communicate with them; and
the processing we undertake is limited and concentrates on managing the development process.

Indeed, often we are required by legal obligations on us to engage in such a consultation process.

Transfer of your data to other countries, and how we safeguard your rights when we do so

We do not transfer any of this information to other countries.

Automated decisions we make about you

We do not make any automated decisions using this information.

You are one of our service partners

We store and use your information for the purposes of managing our service partners and contractors in respect of our construction projects, the maintenance of our buildings, and for the supply of other goods and services that our business may need.

The information we collect about you and why we collect it

In order to engage and manage our contractors and other service partners , where you are a contractor or other service partner (or where if it is a company, you are its representative) we collect and store your contact information together with your bank account details.

You may also be asked to provide details of your occupation and your CV.

We collect the names of persons engaged by our contractors to ensure that we are complying with our obligations under the Modern Slavery Act.

Where you visit a building we will collect and process the information set out in the “an occupier of, or visitor to, one of our buildings or our head office” section above.

Who we share it with

We share the information we collect with the following third parties:

our service partners to the extent it is necessary for them to perform their services to us;
our joint venture partners; and
where the data was collected from our consultants, contractors and sub-contractors for health and safety reasons it will be shared with the project’s principal designer and project manager.

Legal basis for processing it

Except in the circumstances highlighted below, we process this information on the basis of our legitimate interests:

we have a legitimate interest in engaging and managing our contractors and other service partners (both in connection with individual buildings and more generally in our business);
to be able to do so, we need to hold details of who those contractors and service partners are; and
the processing we undertake is limited and concentrates on engaging and managing those contractors and other service partners in a business context.

Where we are required by law to hold certain records for health and safety purposes, then we hold those records to comply with that statutory obligation.

Where we hold your bank account details, we do so on the basis that it is necessary for us to perform our contract with you.

Transfer of your data to other countries, and how we safeguard your rights when we do so

Some of our third party service partners are based outside of Europe and therefore, some of your data will be transferred there. Further information on how we will safeguard your rights in these circumstances is available from our Data Protection Manager.

Automated decisions we make about you

We do not make automated decisions using this personal data.

You are a party to a property transaction with us

As part of the property transactions we will enter into we will store and use personal information.

The information we collect about you and why we collect it

In order to undertake property transactions with you, we will collect and store the information about you including your contact details, occupation, nationality, reasons for purchasing a property, bank account, identification information and extracts from share registers.

Who we share it with

In accordance with the legal obligations on us, we will share your name and address and transaction details with our auditors so that they can audit the transactions undertaken.

We will also share the data we collect from you with our agents, solicitors and joint venture partners for the purposes of executing the transaction.

Legal basis for processing it

We process this information on the basis that it is necessary for us to do so in order to enter into a contract with you.

Transfer of your data to other countries and how we safeguard your rights when we do so

Some of our joint venture partners are based outside of Europe and, therefore, some of your data may be transferred there. Further information on how we will safeguard your rights in these circumstances is available from our Data Protection Manager.

Automated decisions we make about you

We do not make automated decisions using this information.

You are a shareholder or former shareholder

If you are a shareholder or former shareholder, the data controller is Great Portland Estates plc (company number 00596137) of 33 Cavendish Square, London, W1G 0PW.

We collect and process your personal information so that we can:

manage your shareholding in Great Portland Estates plc and keep your record on the share register up to date;
make shareholder communications and shareholder meeting materials available to you;
pay dividends to you;
allow you to exercise your rights as a shareholder, such as a right to vote at shareholder meetings; and
respond to any correspondence you send to us or to our registrar, Link Market Services.

If you cease to hold Great Portland Estates plc shares, your personal information will be kept for up to 13 years from the date you cease to be a shareholder or, if later, 13 years from the date we cease to hold a cash balance in relation to your shareholding.

The information we collect about you and why we collect it

We collect and process personal information which includes your name, registered address, investor code, shareholding and communication method preference. It may also include your email address and bank account details if you have provided these to us.

Who we share it with

We share your personal information with Link Market Services who we have engaged as our share registrar. Link Market Services maintains the Great Portland Estates plc share register and processes shareholders’ personal information on our behalf.

The legal basis for processing it

Except as set out below, we process this information on the basis of our legitimate interests:

we process personal details on our share register because we are under a statutory duty to do so.

Transfer of your data to other countries and how we safeguard your rights when we do so

We do not transfer any of your personal data to other countries.

Automated decisions we make about you

We do not make automated decisions using this information.

You are on our results presentations/investor relations events contact list (e.g. investors, analysts and bankers)

We store and use your information for the purposes of providing information on our financial performance to you.

The information we collect about you and why we collect it

We collect and store details of the name, email addresses, telephone numbers and companies of investors, analysts and bankers to facilitate results presentations and investor relation events.

Who we share it with

We share this data with our corporate PR agency to the extent it is necessary for them to perform their services to us.

The legal basis for processing it

We process this information on the basis of our legitimate interests:

we have a legitimate interest in wishing to provide details of our financial performance to you;
to be able to do so, we need to invite you to events and presentations in order to provide that information to you; and
this processing is in a business to business context and is restricted to providing information on our financial performance. Accordingly, it is within the scope of what you would reasonably expect us to do.

Transfer of your data to other countries and how we safeguard your rights when we do so

We do not transfer any of this personal data to other countries.

Automated decisions we make about you

We do not make automated decisions using this information.

You are applying for a job

The information we collect about you and why we collect it

CVs may be submitted to us through recruitment agencies, through our website or to individuals within our organisation. Should they be submitted to any individuals within our organisation they will be passed on to our HR team and the individual who originally received the CV will immediately delete it from their email.

If you are applying for a job through our website, we will also collect and store your application question answers, including your name, email, and telephone number, if you have submitted such details.

We will store and assess all the information held within your CV for recruitment purposes.

As part of our recruitment and pre-employment process, we will also review any further information provided to us as part of that process, including from background check providers, applicant testing providers, and references from former employers. We do so in order to assess our applicants.

Who we share it with

We share the information we collect with the following third parties:

our background check and applicant testing suppliers to the extent it is necessary for them to perform their services to us; and
should the CV have been submitted via a recruitment agency then that agency will have a copy of the CV itself.

The legal basis for processing it

As you have provided the CV to us, either directly or through a recruitment agency, then you will have consented to us processing the data.

To the extent that the CV contains special categories of data (such as medical information), then you will have explicitly consented to us processing the data.

We will undertake the further recruitment and pre-employment processing on the basis of our legitimate interests:

we have a legitimate interest in recruiting the most suitable candidates for our roles;
to be able to do so, we need to be able to test those candidates to ensure they have the right aptitudes for our roles; and
the processing we undertake is limited and concentrates on assessing your abilities in a recruitment context.

Transfer of your data to other countries and how we safeguard your rights when we do so

Some of our third party suppliers are based outside of Europe and therefore, some of your data will be transferred there. Further information on how we will safeguard your rights in these circumstances is available from our Data Protection Manager.

Automated decisions we make about you

We do not make automated decisions using this information.

You are a visitor to our website

If you are a visitor to our website, then we will collect information from you by means of cookies as well as by giving you the opportunity to subscribe for emails or alerts, to apply for a job, and to submit an enquiry form.

The information we collect about you and why we collect it

If you sign-up for the email, or RNS, alerts on our website, then we will collect and store details of your name, email address and your choice of news and information services. For example, on the “email alert” section of the website, you may subscribe to a news and information service to receive notification when press releases and presentations are added or other updates are made to the Website. We will use this information to provide the services requested.

We may also use your submitted information to send notification of new services and general correspondence regarding the information and services you have enquired about.

You may unsubscribe from the news and information service at any time and/or “opt out” of receiving communications by visiting clicking the unsubscribe link in any email we send you. If you unsubscribe from this service, we will not retain the data you submitted when you subscribed for the service, and will cease sending you news and information.

If you apply for a job with us via our website, then we will process it in accordance with the I am applying for a job section of this Privacy Notice.

If you submit an enquiry form via our website, be that on our contact us page, or through the enquiry form on any of our property pages or property search pages, then we will collect and store details of your name, company, email address, telephone, and your choice of space type and size, location and your enquiry text. We will use this information to provide you with details of our properties and any other information you have requested.

To enable us to monitor and improve our website, we gather and record on our servers certain information about all users who visit the website, including without limitation, details of the operating system, browser version, internet service provider, domain name and IP address of the user, the URL which a user has come from, the parts of our website visited and the date and length of each visit ("collected information").

We use certain cookies (small files containing information about you which are stored on your hard drive by our browser) to monitor your use of the website. We use the following cookies on our website:

Cookie:	Name:	Typical content	Expires	Purpose
Google Analytics	_ga	randomly generated number	2 years	This cookie is used to distinguish users on our website so that we can tell how many different users visit the site. The results are tracked and can be viewed on our Google Analytics account.
Google Analytics	_gat	1*	10 minutes	This cookie does not store any user information. It is just used to limit the number of requests that have to be made to doubleclick.net for Google Analytics tracking.
Google Analytics	_gid	randomly generated number	24 hours	This cookie is used to group the entire session’s activity together for each user of our website.
Facebook	_fbp	randomly generated number	90 days	This cookie is used to distinguish and keep track of unique users visiting our website. The results are tracked and can be viewed on our Facebook Business Manager account.
Facebook	_fbc	randomly generated number	90 days	This cookie is set when a user arrives on gpe.co.uk website from an advertising campaign run from Facebook Business Manager, and is used to identify user actions following the clickthrough. The results are tracked and can be viewed in Facebook's Ad Manager account.

The website contains links to other websites which are outside our control and are not covered by this Privacy Notice. We are not responsible or liable for these websites, their privacy policies or their use of your personal information. If you access other sites using the links provided, the operators of these sites may collect information from you which will be used by them in accordance with their privacy policy, which may differ from ours. We strongly recommend that you read the privacy notices of each and every website that collects personally identifiable information from you.

There are inherent security risks of transmitting information on-line over the Internet. By transmitting your personal data to the website you accept these inherent risks and understand that such transmission is entirely at your own risk. Once we have received your personal information, we will take practicable and reasonable steps to protect your personal information and to try to prevent unauthorised access.

Who we share it with

We only share the information we collect with our suppliers to the extent it is necessary for them to perform their services to us. Most notably this will be with the providers of our website.

The legal basis for processing it

As you have agreed to us providing the email and/ or RNS alerts or to us processing your CV, then you will have consented to us processing that information.

Similarly, you have agreed to us placing cookies by consent - by using our website you agree that we may place cookies on your computer or device (as describe above). Most web browsers allow some control of most cookies through the use of browser settings. If you want to find out more information about cookies including how to control what cookies are put on your computer or device and how to delete them then visit http://www.allaboutcookies.org/. If you would like to opt out of being tracked by Google Analytics then visit http://tools.google.com/dlpage/gaoptout.

Transfer of your information to other countries, and how we safeguard your rights when we do so

We do not transfer any of this information to other countries.

Automated decisions we make about you

We do not make automated decisions using this information.

You are a participant in one of our corporate social responsibility activities

We collect and store information about participants in those CSR events that we organise.

What data we collect about you and why we collect it

With respect to the annual bike rides that we organise, we collect details of the names, company names, email addresses, money raised, and room sharing allocation of our participants.

Who we share it with

The information collected is shared with the organiser of the event.

The legal basis for processing it

We do so on the basis of our legitimate interests:

we have a legitimate interest in wishing to invite previous participants to enter each year’s event and to communicate with and manage each year’s participants;
to be able to do so, we need to record the detail of participants and their contact details; and
the processing we undertake is limited and concentrates on your involvement in the activity. Accordingly, it doesn’t unduly interfere with your interests, rights or freedoms.

Transfer of your data to other countries and how we safeguard your rights when we do so

We do not transfer any of this personal data to other countries.

Automated decisions we make about you

We do not make automated decisions using this information.

How long we keep your information

We will only retain your personal information for as long as is necessary to fulfil the purposes we collected it for. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. This is recorded in our retention policy, details of which are available from our Data Protection Manager.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

Your rights

The law gives you certain rights in respect of the information that we hold about you. Below is a short overview of those rights.

With some exceptions designed to protect the rights of others, you have the right to a copy of the personal data that we hold about you. We may make a reasonable charge for additional copies of that data beyond the first copy, based on our administrative costs. Where the data is data that you have given to us, you have the right to receive your copy of it in a common electronic format, and to provide copies of it to other people if you wish.
You have the right to have the personal data we hold about you corrected if it is factually inaccurate.
In some limited circumstances, you have the right to have personal data that we hold about you erased ("the right to be forgotten”). This right is not generally available where we still have a valid legal reason to keep the data (for example, for security reasons or because we are obliged to do so by law).
You have the right to require us to stop using your personal data to send you marketing information.
You also have the right in some circumstances to request that temporary restrictions are placed on how we process your personal data, for example, if you contest its accuracy or where we are processing it on the basis of our legitimate interest and you contest our assessment that our interest overrides your rights.
If we are processing your personal data on the basis of your consent, you have the right to withdraw that consent at any time, in which case we will stop that processing unless we have another legal basis on which to continue.

If you want us to stop sending you information, the quickest and most efficient way is to use the provided “unsubscribe” links in our communications (although you can contact us direct if you prefer). Otherwise, if you want to exercise your rights in respect of your personal data, the best way to do so is to contact us by email on dataprotectionmanager@gpe.co.uk or to write to us at 33 Cavendish Square, London, W1G 0PW for the attention of the Data Protection Manager. In order to protect your privacy, we may ask you to prove your identity before we take any steps in response to such a request.

You also have the right to lodge a complaint about our handling of your personal data with the Information Commissioner’s Office via ico.org.uk/concerns. You can contact them on 0303 123 1113.