1.1 Woodlands Boulevard’s Online Privacy Policy

1. OVERVIEW OF HYPROP INVESTMENTS LIMITED

1.1 Hyprop Investments Limited ("Hyprop, we, us, our") is a leading specialist shopping centre Real Estate Investment Trust (REIT) listed on the JSE Limited.
1.2 Our strategy is to create safe environments and opportunities for people to connect and have authentic and meaningful experiences by owning and managing dominant retail centres in mixed-use precincts in key economic nodes in South Africa and Eastern Europe.
1.3 Hyprop’s contact details are:

Physical Address: 2nd Floor, Cradock Heights, 21 Cradock Avenue, Rosebank, Johannesburg;
Postal address: P O Box 52509, Saxonwold, 2132;
Tel: +27 11 447 0090;
Fax: +27 11 447 0092;
Email Enquiries: paia@hyprop.co.za.

1.4 Details of our legal entity and structure can be found on our website at: www.hyprop.co.za.

2. DEFINITIONS

2.1 In this Privacy Policy, unless the context indicates to the contrary-
2.1.1 "Associates" means its co-owners, subsidiaries, affiliates, partnerships, directors, employees, agents, consultants, subcontractors, sponsors, Service Providers, and/or any other third party;
2.1.2 "Data Subject" means the person to whom the Personal Information relates;
2.1.3 "Information Regulator" means the information regulator appointed under POPIA;
2.1.4 "Operator" means any natural or juristic person that Processes Personal Information on behalf of the Responsible Party;
2.1.5 "Personal Information" means any information that identifies a natural or juristic person and includes (without limitation) information relating to the race, gender, pregnancy, marital status, national, ethnic or social origin, colour, physical or mental health, sexual life, trade union membership, religious or philosophical beliefs, any actual or alleged criminal offences, identification number, vehicle registration number, email address, location information, online identifier, telephone number, biometric information, language, birth or name;
2.1.6 "POPIA" means the Protection of Personal Information Act, 4 of 2013;
2.1.7 "Privacy Policy" means the privacy policy set out in this document;
2.1.8 "Process, Processing or Processed" means how we collect, use, store, make available, destroy, update, organise, record, structure, disclose or otherwise deal with your Personal Information;
2.1.9 "Responsible Party" means the entity that decides how or why the Personal Information is Processed and includes Hyprop and, where applicable, it’s Associates;
2.1.10 "Service Provider" means any third party provider of various services with whom we engage including, but not limited to, accounting or auditing services, legal services, providers of information technology, property management data services, data and hard-copy storage, document management, shredding services, architects, quantity surveyors and/or other professional advisors;
2.1.11 "Special Personal Information" means Personal Information concerning the religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, medical history, sexual life or biometric information, any actual or alleged criminal offences; and
2.1.12 "Website" means any website operated or maintained by us or on our behalf.

3. INTRODUCTION

3.1 We recognise the importance of protecting your privacy in respect of your Personal Information. Accordingly, we are committed to protecting and safeguarding your Personal Information.
3.2 Please read this Privacy Policy to carefully to understand how your Personal Information will be treated by us and our Associates.
3.3 By providing us with your Personal Information, you-
3.3.1 agree to this Privacy Policy and authorise Hyprop and our Associates to Process your Personal Information as set out in this Privacy Policy; and
3.3.2 authorise Hyprop and our Associates to Process your Personal Information for the purposes stated in this Privacy Policy.

4. PERSONAL INFORMATION WE MAY COLLECT ABOUT YOU

4.1 We may collect and Process the following Personal Information we receive about you-
4.1.1 directly from you;
4.1.2 in the course of our business relationship with you or your organisation;
4.1.3 from credit bureaux;
4.1.4 in the course of entering into an agreement with you or your organisation;
4.1.5 where your Personal Information is made publicly available;
4.1.6 when you visit and/or interact with our Websites, applications, Wifi captive portal and/or our various social media platforms (collectively referred to as our "Sites");
4.1.7 when you enter or participate in any of our promotions, competitions and/or surveys;
4.1.8 from our sponsors;
4.1.9 when you apply for a job with us;
4.1.10 when you attend any of our events or functions;
4.1.11 when you register to receive newsletters, events and/or updates about us or our shopping centres;
4.1.12 when you interact with any third party content or advertising on our Sites;
4.1.13 when you visit our shopping centres and/or offices;
4.1.14 when you purchase our gift cards in our shopping centres;
4.1.15 through video surveillance or CCTV footage;
4.1.16 through sensor technology;
4.1.17 to detect and prevent fraud.

5. CATEGORIES OF PERSONAL INFORMATION WE MAY PROCESS

5.1 We may Process the following categories of Personal Information about you-
5.1.1 personal and basic data: name and surname, gender, title, organisation, photograph and interests;
5.1.2 demographic information: gender, date of birth, age, nationality, language preferences, shopping trends and preferences;
5.1.3 identifier information: passport or identity number, utility provider details, bank statements and vehicle registration number;
5.1.4 contact details: correspondence address, postal address, physical address telephone number, email address and details of your public social media profile/s;
5.1.5 business dealings and transaction data: details of natural or juristic persons that enter into lease agreements, service level agreements or other commercial agreements with us including all Personal Information included in leasing applications, credit checks, correspondences, documents, agreements or other records that we process in the course of our business relationship with you;
5.1.6 attendance records: details of meetings, events, functions organised by or on behalf of us that you have attended;
5.1.7 consent records: records of any consents you may have given us, together with the date and time, means of consent and related information;
5.1.8 data relating to your visits to our Sites: including device type, Cookies, unique device identifier (UDID), operating system, browser type, browser settings, Computer Internet Protocol (IP) address, language settings, dates and times of connecting to our Sites, location information, posting a review, rating or comment on our Sites;
5.1.9 personal preference data: including how often you enter upon our shopping centres, an assessment of your personal shopping preferences, and understanding your interests, choice of brand products and consumer behaviour, create your customer profile and to enhance our services to you;
5.1.10 content and advertising data: records of your interactions with our online advertising and content;
5.1.11 sensor data: records from sensors capturing signals automatically emitted from mobile devices when entering our shopping centres;
5.1.12 marketing data: data about individual participation in (without limitation) events, functions, competitions and/or surveys;
5.1.13 security data: video surveillance and CCTV footage;
5.1.14 legal requirements: Processing of Personal Information where it is permitted in accordance with applicable law;
5.1.15 job application data: Personal Information provided by job applicants or others in connection with employment opportunities, which may be subject to an additional relevant recruitment privacy policy;
5.1.16 financial records: annual turnover of natural or juristic person in occupation of premises in our shopping centres; credit checks and assessment of credit worthiness and where applicable, debit orders;
5.1.17 payment details: billing address, payment method, credit card details, bank account number, invoice records, payment records, payment amount, payment date and records of electronic funds transfer payments.

6. PROCESSING OF SPECIAL PERSONAL INFORMATION

We may Process your Special Personal Information if the Processing is permitted in accordance with applicable law, for a legitimate purpose, in the ordinary course of our business or where the natural or juristic person has consented to the Processing of the Personal Information.

7. PROCESSING OF PERSONAL INFORMATION OF CHILDREN

Where we need to Process the Personal Information of children, we will do so for a legitimate purpose, in accordance with all applicable law and with the consent of the parent or guardian of the child.

8. USE AND PURPOSE OF PROCESSING YOUR PERSONAL INFORMATION

8.1 We will use and process your Personal Information in the ordinary course of our business and for purposes of leasing premises, managing and operating our shopping centres. We will collect, use, disclose or Process your Personal Information in accordance with this Privacy Policy and for the purpose for which it was originally or primarily intended. In certain circumstances, we may use your Personal Information for other purposes. We will only do this in accordance with applicable law or if the other purpose is compatible with the original purpose. We may Process your Personal Information for, without limitation, the following purpose-
8.1.1 operating our business and managing and leasing premises in our shopping centres;
8.1.2 to manage and administer our client and customer relationships;
8.1.3 recruitment;
8.1.4 compliance with applicable law and fraud prevention;
8.1.5 transfer of information to our Service Providers and other third parties;
8.1.6 analysis, evaluation, review and collation of information in order to assess your individual requirements; understand your interests and behaviour so that we can provide you with more effective communication and services; enhance our performance; carry out statistical and other analyses to identify potential markets and trends and evaluate and improve our business;
8.1.7 inform you about and to hold promotions, events, functions and/or competitions in our shopping centres;
8.1.8 inform you about new tenants taking occupation in our shopping centres;
8.1.9 verify and protect your identity;
8.1.10 carry out credit checks;
8.1.11 meet and comply with our obligations with you under any agreement;
8.1.12 marketing purposes in relation to our shopping centres;
8.1.13 in the event of a merger, acquisition, sale or transfer of any portion of our business or assets;
8.1.14 accounts management;
8.1.15 maintain and improve our relationship with you and with our Service Providers;
8.1.16 statistical and/research purposes;
8.1.17 provide you with information, products, services or experiences that you request from us;
8.1.18 process payments for purchases;
8.1.19 compile your customer profile;
8.1.20 to help us better understand and improve your customer experience at our shopping centres through sensors capturing signals automatically emitted from a Data Subject’s mobile device;
8.1.21 provide and personalise our products and services to you and your preferences, including making predictions about your shopping profile, brands, products, characteristics, interests and/or preferences;
8.1.22 display targeted advertisements, products, brands, content, features, deals and/or offers ("Products") that match your customer profile and/or notify you about Products that we consider will be of interest to you;
8.1.23 keep track of your activity patterns and preferences in order to improve the level of service you receive and to increase the functionality of the Sites, including monitoring and analysing usage trends, determining the effectiveness of our advertisements, promotions and/or events and personalising and improving our Sites;
8.1.24 link or combine with other information we get from third parties to better understand your requirements, to provide you with better services and/or to enhance your shopping experience at our shopping centres;
8.1.25 inform you of Products, services, experiences, events, brands and/or promotions which we consider will be of interest to you where you have indicated that you wish to be contacted for such purposes by post, email, SMS, cellular phone, telephone, through our Sites or via social media platforms and/or any other means of electronic communication;
8.1.26 ensure that the content from our Sites is presented in the most effective and efficient manner for you and your electronic device;
8.1.27 make our Sites more intuitive and easy to use;
8.1.28 protect the security and effective functioning of our Sites and information technology systems;
8.1.29 send you push notifications;
8.1.30 interact with you on social media platforms;
8.1.31 allow you to participate in any interactive features of our Products when you choose to do so;
8.1.32 request feedback from you;
8.1.33 respond to your emails, queries, questions, comments, requests and/or complaints;
8.1.34 send you surveys, updates, security alerts, support and/or administrative messages and/or facilitate your use of, and our administration and operation of, our Sites;
8.1.35 safety and security purposes;
8.1.36 address any compliance, legal and regulatory obligations.

9. DISCLOSURE OF YOUR PERSONAL INFORMATION

9.1 We may disclose your Personal Information to our Associates and Service Providers for legitimate business purposes, in accordance with applicable law.
9.2 We require our Associates and Service Providers to take appropriate, reasonable, technical and organisational measures to safeguard your Personal Information and to keep it secure.
9.3 Moreover, our Associates and Service Providers may not use or disclose your Personal Information for any purpose other than for which it was originally or primarily intended or for purposes of providing services to us on our behalf.
9.4 We may disclose your Personal Information-
9.4.1 To legal and regulatory authorities, upon request, or for the purposes of reporting any actual or suspected breach of applicable law or regulation;
9.4.2 to our professional advisors;
9.4.3 to third parties in an aggregated or anonymous form that does not identify you in any way;
9.4.4 to our sponsors, if you enter into or participate in any competition, promotion, function or event which is sponsored by a sponsor;
9.4.5 to obtain third party surveys or market research;
9.4.6 to credit bureaux;
9.4.7 to third parties where you have consented to such disclosure;
9.4.8 to meet tax reporting requirements;
9.4.9 to attorneys, tracing agents, debt collectors and other persons that assist with the enforcement of commercial agreements or where it is necessary for the purposes of, or in connection with, actual or threatened legal proceedings or the establishment, exercise or defence of legal rights;
9.4.10 for payment processing to service providers, merchants, banks and other persons that assist with the processing of your payment instructions;
9.4.11 to our insurers and brokers;
9.4.12 to Operators (including, but not limited to, data hosting services, document management technology and property management technology);
9.4.13 to any relevant third party purchaser/s in the event of a merger, acquisition, sale or transfer of any portion of our business or assets, as well as in the case of insolvency or business rescue;
9.4.14 where it is mandatory in terms of applicable law, to comply with a court order, subpoena or other legal process, to comply with a request from our regulators, governmental request or other legally enforceable demand;
9.4.15 where it is in our legitimate interest, to establish or protect our legal rights, property, or safety or the rights, property, or safety of others, or to defend against legal claims.
9.5 If we use the services of an Operator to Process any of your Personal Information, we take cognisance of the fact that any Operator who is in a foreign country must be subject to a law, biding corporate rules or binding agreements which provides adequate levels of data protection substantially similar to POPIA. To the extent required, we will require such Operators to contractually agree to-
9.5.1 only Process such Personal Information in accordance with our written instructions; and
9.5.2 use appropriate and reasonable measures to protect the confidentiality and security of such Personal Information.

10. CROSS BORDER TRANSFER

10.1 We may transfer your Personal Information to jurisdictions outside of Republic of South Africa for the purposes referred to in this Privacy Policy.
10.2 Personal Information may be transferred out of the Republic of South Africa provided that the jurisdiction to which the data is transferred has adopted data protection laws substantially similar to POPIA. Where we transfer Personal Information to jurisdictions that may not provide substantially similar data protection to POPIA, we will only do so subject to the provisions contained in clause 9.5 of this Privacy Policy.

11. HOW WE KEEP YOUR PERSONAL INFORMATION SAFE

11.1 We will endeavour to protect your Personal Information and we will only use your Personal Information in accordance with this Privacy Policy and applicable law. Accordingly, we will take appropriate and reasonable technical and organisational steps to protect your Personal Information that is in our possession against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and/or loss, unauthorised access, use, in accordance with applicable law.
11.2 Due to the inherent nature of the internet as an open global system, we cannot guarantee that any information, during transmission or while stored on our information technology platforms will be absolutely safe from the intrusion of others. We cannot accept responsibility or liability for any unauthorised access or loss of Personal Information.
11.3 You have an important role to play in the protection of your Personal Information. You should not share your username, password or other authentication data provided to you with anyone, and we recommend that you do not re-use passwords across more than one Website or application.

12. WHAT ARE THE CONSEQUENCES OF YOU NOT PROVIDING YOUR PERSONAL INFORMATION TO US

You are required to provide your Personal Information as contemplated in this Privacy Policy. If you do not provide us with your Personal Information, you may not be able to use our Sites, we may not be able to respond to your emails, requests or enquiries, nor may we be able to enter into a business relationship with you, nor may you be able to participate in any competition, nor may we provide you with marketing that we believe you would find valuable.

13. DATA ACCURACY

The Personal Information that you provide to us should be accurate, complete and up-to-date. Should your Personal Information change, the onus is on you to notify us of the change and to provide us with the accurate information.

14. DATA MINIMISATION

The Personal Information that we collect from you will be adequate, relevant and not excessive. We will Process your Personal Information for the purpose for which the information was given and for the fulfilment of the legitimate purpose for which it was collected.

15. DATA RETENTION

We will not retain your Personal Information for longer than is necessary to achieve the purpose for which we collected it, unless there is a lawful basis or legal requirement for us to retain your Personal Information for a longer period.

16. ACCESS TO YOUR PERSONAL INFORMATION

16.1 You may request access to any of your Personal Information that is held by us at any time and for any purpose, including to request us to rectify, erase and restrict our use of your Personal Information. Furthermore, you may have the right to object to us Processing your Personal Information and to withdraw your consent to our use of your Personal Information.
16.2 Details of your legal rights can be found on the Information Regulator’s website at www.justice.gov.za/inforeg. The details of the Information Regulator are:
16.2.1 Address: J D House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
16.2.2 Postal Address: P O Box 31533, Braamfontein, Johannesburg, 2017
16.2.3 General Enquiries Email: enquiries@inforegulator.org.za
16.3 You also have the right to lodge a complaint to the Information Regulator at the following email address: complaints.IR@justice.gov.za

17. MARKETING DATA

You have control regarding our use of your Personal Information for marketing purposes. For all direct marketing, you will need to give your express consent to us before you will receive marketing from us. If you give your consent to receive such marketing, you may unsubscribe or opt-out from such marketing at any time by following the opt-out process set out in any marketing communication received from us.

18. COOKIES

18.1 We use and engage certain providers to use cookies, web beacons and other tracking devices (collectively referred to as "Cookies") on our Sites.
18.2 Cookies are a text file placed into the memory of your computer or device by our Sites. A copy of this text file is sent by your device or computer whenever it communicates with our Sites.
18.3 Subject to you giving us your consent, Cookies are used to gather information about your usage patterns when you navigate our Sites in order to enhance your personalised experience, and to understand your usage patterns to improve our Sites, Products and services.
18.4 Cookies on our Sites are generally divided into the following categories:
18.4.1 Operational Cookies: these Cookies are required for the operation of our Sites. They include, for example, Cookies that enable you to log into secure areas. These Cookies are session Cookies that are erased when you close your browser;
18.4.2 Analytical/Performance Cookies: these Cookies allow us to recognise and count the number of users of our Sites and understand how such users navigate through our Sites. This helps to improve how our Sites work, for example, by ensuring that users can easily find what they are looking for. These Cookies are session Cookies which are erased when you close your browser. We use Google Analytics for this purpose;
18.4.3 Functional Cookies: these Cookies improve the functional performance of our Sites and make it easier for you to use. For example, Cookies are used to remember that you have previously visited the Sites and asked to remain logged into it;
18.4.4 Cookie Pop-Up: we use a Cookie pop-up to determine if you have read our Cookies policy contained in this Privacy Policy.
18.5 If you do not want to use our Cookies, you may not be able to access or use important functions or features on our Sites.

19. OUR RIGHT TO CHANGE THIS PRIVACY POLICY Please note that we may update this Privacy Policy from time to time by posting the latest version on our Sites, so please ensure that you refer to it periodically.