1.    Introduction

Falcon AM is strongly committed to protecting the privacy of your personal data. We only use your personal data legitimately and responsibly in line with applicable privacy laws and regulations.

In this Privacy Notice, we describe who is responsible for processing your personal data, what personal data we process, when we process your personal data, why we process your personal data, and how we process your personal data. Furthermore, we will explain how you can exercise your privacy rights and all other information that may be relevant to you.

We did our best to provide you with all information in a clear and readable format. However, if you have any questions about our use of your personal data after reading this Privacy Notice, you can contact us by sending an email to datacontroller@blanchardstowncentre.com.

We are continually developing and improving our products and services, which might result in some changes to the way we are processing personal data. We will make sure to reflect these changes in this Privacy Notice. We recommend that you regularly take notice of this Privacy Notice for any modifications. At the bottom of this Privacy Notice you can read when this Privacy Notice was most recently modified.

2.    Who is responsible for processing your personal data?

Falcon AM, located at Blanchardstown Centre, Blanchardstown, Dublin 15, D15 XKK8 is responsible (the Controller) for processing your personal data.

This Privacy Notice does not apply when Falcon AM processes personal data as processor in our capacity of asset and/or property manager of a property at the instruction and/or on behalf of an owner of such property (the controller). We refer to the controller’s privacy notice in such case.

3.    What personal data do we process?

‘Personal data’ means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, etc. Different pieces of information, which are collected together and can lead to the identification of a particular person, also constitute personal data.

We may process the following categories of personal data, which we either receive directly from you or obtain through external parties and/or your use of Falcon AM’s services and/or application(s).

• Private contact details (such as name, address, postal or email address, telephone number).

• Business contact details (such as job title, department, name of organisation).

• Demographic data (name, gender, date of birth, age, nationality).

• Application data (such as curriculum vitae, motivation).

• Financial data (such as bank account details, credit card number).

• Company details (such as address, trade register number, tax identification number).

• Account details (such as username and password).

• Marketing details (such as participation details, loyalty details, survey details).

• Interaction details (such as digital and/or written correspondence).

• (Online) identifiers, surfing data and visitor movement data (such as IP address, cookies, MAC address, browsing behaviour on our websites and applications, shopping behaviour and location).

• Data needed for security and fraud prevention (such as official identification details, CCTV recordings).

• Data needed to comply with anti-bribery and corruption laws and other regulatory requirements (such as suspected and actual criminal behaviour, criminal records or proceedings regarding criminal or unlawful behaviour).

• Image data (such as photos, video images).

We do not collect any special categories of personal data (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

4.    When do we process your personal data?

We may process your personal data when:

• you access our website and/or use our application(s).

• you visit our office(s) and/or shopping centre(s).

• you contact us and/or subscribe to our newsletter(s).

• you take part in our survey(s), marketing event(s) and/or campaign(s).

• you apply for a position and/or attend a recruitment

• you, or the organization through whom you are known to us, operate(s) as our existing or prospective investors, business partners, tenants, and/or clients.

5.    Why do we process your personal data?

We may process your personal data for the following purposes:

Website

Falcon AM uses cookies to understand the usage of the website and to help improve your overall experience on our website. Cookies are small text files containing small amounts of information which are downloaded and may be stored on your user device (such as your computer, tablet, mobile phone or other internet enabled devices).

The types of cookies that Falcon sets are:

• performance

• essential

• targeting

You can monitor, disable and delete cookies from your browser. To delete or stop cookies being placed on your computer, refer to the help menu on your web browser. Please note if you select this setting you may be unable to access certain parts of our website, or it may impact on the usability of the site.

For more information on how we use cookies, you may also want to read our Cookie Policy.

Communication and marketing

We process your personal data for the purpose of managing relationships and marketing, such as sending a newsletter, maintaining and promoting contact with our existing or prospective investors, business partners, tenants, clients and visitors, account management, service and support, and development, execution and analysis of surveys and marketing strategies.

Quality and management purposes

We process your personal data to monitor and improve the quality of our services and products, processes and systems, to inform our management and existing or prospective investors, to

implement controls, to conduct analysis, to execute (de)mergers, acquisitions and divestitures, and to perform (internal) audits and investigations.

Execution of an agreement

We process your personal data to prepare, effect, perform and (possibly) terminate agreements with you or existing or prospective investors, business partners, tenants and/or clients.

Health, safety and security

We process your personal data to ensure persons’ life or health and the safety of our visitors, to protect Falcon AM and our employees, and for the prevention and detection of crime.

Laws and regulations

We process your personal data to comply with laws and regulations.

6.    How do we process your personal data?

• Lawfulness of processing

Falcon AM may process personal data on the following legal grounds:

The performance of an agreement

We process your personal data, which is necessary for the performance of an agreement with you, or the organization through whom you are known to us, or in order to take steps at your request prior to entering into an agreement.

Compliance with a legal obligation

We process your personal data to comply with our legal obligations.

Legitimate interests

We may use your personal data for our legitimate interests, such as:

• to improve the quality and effectiveness of our services and products;

• to protect the interests of our investors, business partners, tenants, clients, and visitors;

• to detect health, safety and security incidents;

• to defend ourselves in legal proceedings;

• to comply with laws and

Your consent

If we cannot process your personal data on the basis of one of the previous three (3) legal grounds, we can only process your personal data with your prior consent. You may always withdraw your consent. Please bear in mind that such withdrawal does not affect the lawfulness of the processing prior to the withdrawal.

Falcon AM processes personal data it has collected for the purposes as identified above on the following legal grounds:

Please note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data and without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law. Please contact us at datacontroller@blanchardstowncentre.com if you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose or you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.

• Categories of recipients

We may provide your personal data to the following categories of recipients.

Associates

We may share your personal data with our existing or future investor(s) and one or more group companies.

Business service companies

We may provide your personal data to our agents, service providers, external auditors and/or sub- contractors.

Public Authorities

We may provide your personal data to public authorities:

• to comply with a statutory obligation, court order or law and regulation; or

• if this is necessary to prevent, trace or prosecute (criminal) offences; or

• if this is necessary to enforce our (internal) policies, or to protect the rights and freedoms of others.

Other

We may provide your personal data to external parties with your prior consent. We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We

do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

• Data transfers

We may transfer your personal data to third parties located outside the European Economic Area (EEA). We only do this if there is an appropriate level of protection for the processing of personal data. We ensure that at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission.

• Where we use certain service providers, we may use specific contracts approved by the European Commission which give personal data the same protection it has in Europe.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the EEA.

• Retention periods

Your personal data is kept as long as necessary for the purpose for which the personal data is processed including to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies.

Hereinafter, your personal data will be deleted or made anonymous.

7.    How can you exercise your privacy rights?

Under certain conditions, you have the right to:

• Request access to your personal This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

• Request to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing, where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

• Object to the processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. In some cases, we may demonstrate that we have a compelling legitimate ground to process your information.

• Request restriction of processing of your personal

Request the transfer of your personal data to you or to a third

• Withdrawn consent at any time where we are relying on consent to process your personal data. If you withdraw your consent, we may not be able to provide certain offerings to

To     exercise     these     rights,     please     contact      us     by     sending     an      email      to datacontroller@blanchardstowncentre.com.

Please keep in mind that we may ask for additional information to verify your identity.

You have the right to lodge a complaint with the relevant data protection supervisory authority if, for example, you believe that we do not process your personal data carefully, or because you have sent us a request to access or rectification of your personal data and you are not satisfied with our reply, or we did not reply in a timely manner.

8.    More information?

If you have any issues, queries or complaints regarding the processing of your personal data please contact us at:

Blanchardstown Centre Blanchardstown

Dublin 15 D15 XKK8

Ireland

T +353 1 822 1356

E datacontroller@blanchardstowncentre.com

9.    When was the last modification made to this Privacy Notice?

This Privacy Notice applies since 25 May 2018. The last modifications to this Privacy Notice were made on 8 July 2021.