Privacy Policy

This Privacy Policy explains how we collect, use, and take care of your personal data and sets out your privacy rights.

All personal data provided to us will only be held and used in accordance with this policy, and the UK General Data Protection Regulation and relevant privacy laws. (“GDPR”). We are registered with the Information Commissioner’s Office with registration number Z6390151.

How we might collect personal data from you

Under the definitions in the GDPR, The Crown Estate is the Data Controller for the personal data we collect and process about you. This means that we decide the purpose for which we require your personal data and are responsible for communicating to you why we have collected your personal data.

We will not collect any personal data about you except where it is specifically and knowingly provided by you, for example:

  • If you request information from us

  • Fill in an online or paper form

  • When you visit or provide feedback via our website or social media channels

  • When you provide it to one of our managing partners or suppliers

  • When you have given Third Parties consent to share it with us

  • Personal data we may collect from you

We may collect and process the following data about you:

  • Information that you provide by filling in a form/s or providing information online to register an interest or to request further information or offers.

  • Information you provide when you contact us by telephone, email, web form or letter, including your contact details.

  • If you visit one of our sites, CCTV images and ANPR information we collect for health and safety and security purposes and to help us understand how our customers use our facility. We will also collect information to provide you with wi-fi services and for customer analysis at our sites.

  • Information you provide by responding to questionnaires, surveys and competitions and attending events.

  • Information you provide as part of your employment with us.

  • Information you may provide as part of a tenancy with us.

  • Photography of audio/video recordings of you, for example at one of our events.

In some circumstances we may also collect special category or “sensitive” data about you and may include:

  • Your racial or ethnic origin

  • Your religious beliefs

  • Your medical data

Where we collect special category data about you, we will be clear as to why we need it and will only process under a specific lawful basis. If you visit one of our dedicated consumer websites or The Crown Estate websites, further information may be collected – please refer to the section below where we explain the information, we may collect via each website. When personal data is collected, it may be used by us to process and fulfil requests for information or to help us to develop or personalise the website to make it more useful to you. If you complete a form on any of The Crown Estate websites, you will be told why and how we will process the personal data you submit before you submit it.

How Your Personal Data Will Be Processed

We use information about you in the following ways:

  • To provide you with information on products, services offers and events provided by us or our retail tenants that you request or which we feel may interest you where you have consented to be contacted for such purposes.

  • To notify you about changes to our service.

  • To carry out obligations arising from contracts, leases or agreements entered between you and The Crown Estate.

  • To perform surveys and analysis with the aim of improving the services we provide.

  • To ensure that your visit to our site is safe and secure.

  • To manage your tenancy or employment.

  • To process freedom of information requests and individual rights requests under the data protection legislation.

We may give your personal data to third parties where:

  • It is necessary for them to provide you with services on our behalf.

  • They provide profiling of our customer base so we can understand our customers better.

  • We sell or buy any business or assets; in which case we may disclose your personal data to the prospective buyer or seller of such business or assets as far as they relate to them.

  • We are under a duty to disclose or share your personal data to comply with any legal obligation or to enforce agreements or contracts or to protect our rights, our property, or the safety of our customers or others. This includes exchanging information with other companies and organisations for the purposes of fraud prevention and credit risk reduction.

How we process your personal data for our social media

The Crown Estate may process your personal data via internet applications such as Facebook, X (formerly Twitter), Instagram, LinkedIn, and YouTube.

  • You may provide personal data to us in the following way:

  • By liking our social media pages

  • By following our social media pages

  • By sharing personal data when posting comments on our social media pages

  • By contacting us through our social media pages

  • By emailing us at one of our email addresses listed on our social media pages

We may collect the following personal data about you when you interact with any of our social media pages:

  • Name

  • Email address

  • Mailing address

  • Profile photo

  • Username or Login ID’s

  • Company, job title, organisation, gender

  • IP address

  • Geographic location

We use a social media management platform Orlo to help us to review and respond to social media interactions and they will process associated social media posts on our behalf. This is done under agreement with the third-party provider which includes all appropriate safeguards to protect your personal data.

The Lawful Basis we use to process your personal data

We will process your personal data under one of more of the following lawful bases:

  • Where you have given us clear, informed consent

  • We will ask for your informed consent using clear plain language at the point of collection via privacy statements, so you fully understand what you are consenting to. We will also explain your right to withdraw your consent at any time and how you can do that.

  • The processing is necessary for the performance of a task carried out in the public interest

We may also process your personal data for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

  • The processing is required for the performance of a contract

We may process your personal data as part of an agreement we have with a supplier or contractor. The Crown Estate will ensure that such suppliers or contractors process your personal data in line with data protection laws. This will also apply to the processing of personal data in relation to a tenancy agreement.

  • We have a legal obligation to process the data

We may need to share your personal data in exceptional circumstances to comply with the law. For example, we may be obliged to share personal data with law enforcement agencies or courts where it may assist them with an investigation.

  • The processing is necessary for your vital interest or the vital interests of other

We have a responsibility to ensure that individuals are safe therefore we may not always be able to keep information you provide confidential. If we consider that you have given us information about yourself or another person which puts yourself or anybody else at risk from harm, we may need to tell someone who can help. Another example may be where someone has become ill or injured at any of our sites and we may need to provide personal data to paramedics, health care staff or next of kin.

  • We have a genuine and legitimate reason, and we are not harming any of your rights and interests

There may be activities that we carry out that are in the legitimate interests of The Crown Estate, or which are in your legitimate interests for example for fraud prevention and ensuring network and information security as well as business to business contact. Whenever we use this lawful basis to process your personal data, we will carry out a balancing exercise to ensure that we consider the impact on your rights and freedoms and do not override these.

Use of emails

If you send us an email (e.g. to request information or provide feedback on website content), the information you provide will be used to help us gather the information requested and to respond to your message.

The Crown Estate monitors and scans emails, using automated monitoring techniques, for malicious software and unsuitable material. The Crown Estate monitors all its digital systems in accordance with relevant laws and for applicable regulatory and business purposes.

Links to other websites

We may refer to, or establish relations with, other companies, organisations and public bodies that will enable you to access their websites directly from ours. Each company, organisation or public body will operate its own policy regarding the use of cookies and collection and use of information. If you have any concerns regarding the way in which your data will be used, you are advised to read the privacy statement on the relevant website.

We will try to provide you with links to high quality, reputable websites which we think will be of interest and relevance to you. However, please note that such third-party websites are not under our control, and we do not contribute to the content of such websites. We cannot accept responsibility for any issues arising in connection with the third party's use of your data, the website content or the services offered to you by these websites.

Use of your personal data for Research and Insights

The Crown Estate conducts research to monitor performance and inform decision making. This includes, but is not limited to, surveys, focus groups, interviews, observation, and ethnography which may be conducted in person, online, via telephone or by post. The Crown Estate considers it in our public interests (or legitimate interests) to carry out research of this nature.

Participation in research is voluntary and you can request to be withdrawn at any time without giving a reason. We will always tell you at the beginning of the research how your personal data will be used. Some of our research findings may be published. It will not be possible to identify research participants from the research findings we produce, unless consent has been expressly given by those participants in advance.

The Crown Estate may also publish case studies. These case studies are used to get across an individual's story or experience and may be used in printed marketing materials, on our online channels and social media platforms, as well as with other third-party media channels. Participation in case studies is voluntary, and consent is actively sought at the start of any of these conversations and before publication.

The Crown Estate may also use your personal data to optimise and improve its services, by performing analysis and extracting insight from that analysis. The Crown Estate takes great care in ensuring that any analysis is in the public interest and particularly in the interest of advancing The Crown Estates function and its obligations.

Your rights

You have the following rights under the GDPR:

  • Right to be informed – told in a clear and transparent way how we process your personal data.

  • Right of access – you can request a copy of the personal data we hold about you. This includes a description of the data being processed, the purposes of processing and any recipients to whom the data is disclosed.

  • Right to object - You can ask us not to process your personal data for direct marketing purposes. You will be given an opportunity to opt in to processing for direct marketing purposes when you first engage with us. However, you can withdraw your consent to receive marketing material at any time.

  • Right of rectification – you can update or amend the personal data we hold about you if it is incorrect.

  • Right to erasure – you can ask us to delete your personal data from our records. This right is subject to exemptions under the GDPR and is not a blanket request as we may have a legal obligation to retain some personal data.

  • Right to restrict processing – in some circumstances you can ask us to stop using your personal data.

  • Right related to automated decision making and profiling - you can request to not be subject to a decision when it is based on making a decision solely by automated means without any human involvement and/or automated processing of personal data to evaluate certain things about an individual.

To exercise any of the above rights please submit your request to dataprotection@thecrownestate.co.uk.

Transfer of personal data outside the UK

We will only transfer your personal data out of the UK where appropriate safeguards have been put in place to ensure that your personal data and your privacy rights are protected.

The Crown Estate and Marketing

We would like to tell you about what we do and send you information about our news, offers, events, invitations, surveys and insights and any other updates you subscribe to. If you agree to receive marketing information from us, you can always change your mind later.

We will not use your personal data to send you marketing communications if you have told us that you do not want to be contacted for this purpose.

You can change your marketing preferences, such as the method by which we contact you or what you would like to hear from us about or opt out of receiving marketing communications from us at any time by clicking in the link of your communication to select your preferences. For information on objecting to processing or withdrawing your consent, please see the information on Your Rights above.

Where you choose to opt out or unsubscribe from our communications, we will stop sending you marketing communications.

How we protect your personal data

To help protect your privacy, we maintain physical, technical, and administrative safeguards. These safeguards are designed to prevent unauthorised access, disclosure, use and modification of data. We regularly review our security procedures and consider appropriate innovative technologies and methods.

We train our employees about the importance of confidentiality and maintaining the privacy and security of your information, and your personal data is only accessed by appropriately trained staff.

We carry out comprehensive checks on all our partners and other suppliers we use who process your personal data on our behalf. All sharing of personal data is done under contract which sets out our expectations and requirements, especially regarding how they manage the personal data they have collected or have access to on our behalf.