Privacy Notice

Individual customer of, or visitor to, one of our buildings or our head office

• First and last name, company and email address

• Photographs

• Information about your visit such as your name, company/floor, person visiting, date and time, location

• CCTV incl. images

• Medical records / health and safety records

• Access control information including entrance and exit data and duration on sites

• Company you are associated with and floor location worked on

• Vehicle Registration

• Managing and operating our buildings;

• Identification;

• Crime prevention, security and public safety;

• For the purposes of fire or incident management including the safety of individuals;

• Crisis management and planning at our buildings;

• To maintain our operational records;

• In the handling of complaints, grievances and disciplinary proceedings;

• To record information (including relevant medical information) for health and safety purposes where you suffer an incident at one of our buildings and for control purposes;

• To issue you with a permit to work for health and safety purposes; and

• To manage individual contractors.

• Consent

• Legal Obligation

• Contract

Our Legitimate Interests:

• Building management including the safety and security of individuals;

• In wishing to provide an additional range of online services and information to you in order to improve your use of the building;

• We need to process your registration details and may moderate anything you post in order to ensure that the app/ portal is not used for illegal purposes or otherwise causes damage or distress;

• The processing we undertake is limited and concentrates on your use of the app/ portal insofar as it relates to the building;

• For evidential purposes; and

• In the exercise or defence of a legal claim.

The Legitimate Interest of third parties:

• In managing the use of buildings, and in the case of corporate customers, of our buildings this may include them monitoring the access of individual customers, who are employed or engaged by them. If you are an individual customer, please see your company privacy policy for further detail on this;

• For evidential purposes; and

• In the exercise or defence of a legal claim.

Individual customer of, or visitor to, one of our app-enabled buildings

• Information obtained from a portal, app or access card relating to use of a building including:

• First and last name,

• Company you are associated with and floor location worked on

• Email address

• Any other information individuals share

• Registration details

• Posts and communications made by users

• Access control information including entrance and exit data and duration on sites

• To manage and operate some of our services and buildings;

• To provide access to a greater range of services;

• To provide information to you that is relevant to your use of the building;

• To provide you with a range of on-line services relating to that building; and

• So we can better understand how our buildings are used by their customers;

• Identification;

• crime prevention, security and public safety;

• For the purposes of fire or incident management including the safety of individuals;

• Crisis management and planning at our buildings;

• dietary requirements and

• to maintain our operational records.

Our Legitimate Interests:

• Building management including the safety and security of individuals;

• In wishing to provide an additional range of online services and information to you;

• In order to improve the use of a building;

• To prevent and detect any crime; and

• To manage the purposes the app/portal is used for including to prevent damage and distress.

The Legitimate Interest of third parties:

• In managing the use of buildings, and in the case of corporate customers, of our buildings this may include them monitoring the access of individual customers, who are employed or engaged by them. If you are an individual customer, please see your company privacy policy for further detail on this; and

• To process your registration details and moderate anything you post in order to ensure that the app/ portal is not used for illegal purposes or otherwise causes damage or distress. The processing we undertake is limited and concentrates on your use of the app/portal insofar as it relates to the building.

Individuals with a lease agreement with us

• First and last name, company and email address

• Photographs

• Information about your visit such as your name, company/floor, person visiting, date and time, location

• CCTV incl. images

• Medical records / health and safety records

• Duration on sites

• Bank account details and other financial information

• Contact details for your representatives

• Any information in your agreement that you provide

• Vehicle registration

• To manage and administer your lease agreement;

• to carry out due diligence;

• In the handling of complaints, grievances and disciplinary proceedings;

• To manage our portfolio of buildings and perform those agreements; and

• To communicate and carry out marketing including on satisfaction surveys and provisions of a newsletter.

• Consent

• Contract

Our legitimate Interests:

• To communicate with you;

• To administer and manage your lease agreement with us;

• To carry out security verification checks on those we interact and contract with;

• For evidential purposes;

• In the exercise or defence of a legal claim; and

• To perform our obligations.

The Legitimate Interest of third parties:

• For evidential purposes; and

• In the exercise or defence of a legal claim.

Neighbours to our projects

• Contact details

• Photograph

• Dietary requirements

• To communicate and handle any complaints;

• To manage our construction projects;

• To manage compliance with

• any third party consents;

• To manage relationships with

• third parties;

• For evidential purposes;

• to consult on construction projects; and

• To manage events including registration and health or disability requirements such as dietary needs and preferences or physical access needs.

• Legal obligation

Legitimate Interests of us third parties:

• To consult with our neighbours over our projects; and

• To grow our business.

Our service partners including contractors and any representatives of such

• Contact information including first and last name,

• Bank account details

• CV

• Occupation

• To facilitate communication;

• To manage our service partners and contractors in respect of our construction projects;

• For the maintenance of our buildings;

• For the supply of other goods and services that our business may need; and

• To perform our obligations including with respect to payments.

• Contract

Legal obligation including with respect to:

• The Modern Slavery Act 2015; and

• Health and safety.

Our Legitimate Interest:

• In engaging and managing our contractors and other service partners (both in connection with individual buildings and more generally in our business).

Party to a property transaction with us

• Contact details

• Occupation

• Nationality

• Reasons for purchasing a property

• Bank account

• Identification information

• Your interest including information extracted from share registers

• To facilitate property transactions;

• To enter into a contract;

• To carry out checks and verification of people and funds; and

• For compliance purposes including to prevent money laundering and fraud.

• Legal obligation

• Contract

Legitimate Interests of us and our third parties:

• In verifying contacts and relationships; and

• Furthering the growth of our businesses.

Current shareholder or former shareholder

• First and last name

• Registered address

• Shareholding and communication method preference

• Your email address

• Bank account details where provided

• To manage your shareholding in Great Portland Estates plc;

• To keep your record on the share register up to date;

• Make shareholder communications and shareholder meeting materials available to you;

• Pay dividends to you;

• Allow you to exercise your rights as a shareholder, such as a right to vote at shareholder meetings; and

• Respond to any correspondence you send to us or to our registrar, Link Market Services.

• Consent

• Contract

Legal Obligation including in relation to:

• Companies Act 2006

You are on our results presentations/investor relations events contact list (e.g. investors, analysts and bankers)

• First and last name

• Email addresses

• Telephone numbers

• Companies related to the investors, analysts and bankers

• To invite you to events and presentations;

• To manage your registration;

• To facilitate communication;

• For the purposes of providing information on our financial performance to you; and

• To facilitate results presentations and manage investor relation events.

Our Legitimate Interests:

• Build and maintain relationships with third parties; and

• Grow our business.

Job applicants

• CV

• First and last name,

• Email address

• Telephone number

• Any other information on an application form

• Medical information

• To carry out pre-employment checks;

• To facilitate tests to assess the aptitude and ability of a candidate; and

• To gain references from former employers.

• Consent

Our Legitimate Interest:

• Selecting and recruiting appropriate suitable and competent candidates and Personnel.

Website user

• Information via cookie such as Google Analytics, Meta, LinkedIn identifiers, IP address, browser type, pages visited etc. (for more information on cookies see our cookie policy)

Subscribers to emails and alerts:

• Name

• Email address

• Your choice of news and information services

Submission of enquiries:

• First and last name

• Company

• Email address

• Telephone

• Your choice of space type and size

• Location

• Your enquiry text

• To allow you to subscribe to emails and alerts;

• To allow you to apply for a job/role;

• to allow you to submit an query;

• To facilitate your use of the website;

• To provide the services requested;

• To communicate with you about services;

• To deal with any query you raise;

• To provide you with details of our properties; and

• To enable us to monitor and improve our website

• Consent

Our Legitimate Interests in:

• Managing our website; and

• Developing our

• business.

You are a participant in one of our CSR activities

• First and last names

• Company names

• Email addresses

• Money raised by the individual

• Room sharing allocation of the participants

• To manage and facilitate events and CSR activities including registration;

• To communicate with participants; and

• To record charity funds.

• Legal obligation

• Consent

Our Legitimate Interests:

• To participate and raise funds for charity.

You are engaged with us for marketing or advertising

• First and last names

• Email addresses

• Telephone numbers

• Photography or videography relating to you

• Sensitive data including health or disability needs or requirements

• Any other information provided on your registration for which you may provide

• To facilitate communication;

• To invite you to and manage your registration at events, workshops and presentations;

• To manage events, workshops and presentations including security, health and safety, and disability requirements;

• To facilitate communication;

• For marketing / advertising including on social media, websites and email;

• For publications, press releases and other communications; and

• To facilitate and manage competitions.

• Legal obligation

Legitimate Interests of us and our third parties:

• To build and maintain relationships;

• Build our brand and implement our strategy; and

• Grow our business

The right to be informed

You have the right to be provided with clear, transparent and easily understandable information about how we use your information and your rights. This notice is an example of this right.

The right of access

You have the right to obtain a copy of personal data relating to you (and other information) from us where we are processing it. This is so you are aware and can check that we are using your information in accordance with data protection law.

The right to rectification

You are entitled to have your information corrected if it is inaccurate or incomplete. It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal information changes during your relationship with us.

The right to erasure

This enables you to request the deletion or removal of your personal data where there is no compelling reason for us to keep using it.

The right to object

• Under certain circumstances individuals have the right to stop or prevent the processing of their personal data by GPE.

• Individuals also have an absolute right to stop their data being used for direct marketing.

The right to restrict processing

• You have the right to ‘block’ or suppress further use of your personal data that we process. This means that it can only be used for certain things, such as legal claims or to exercise legal rights.

• You can ask us to restrict the use of your personal data if it is not accurate; it has been used unlawfully but you don’t want us to delete it; it is not relevant any more, but you want us to keep it for use in legal claims; or you have already asked us to stop using your data but you are waiting for us to tell you if we are allowed to keep on using it. If we do restrict your information in this way, we will not use or share it in other ways while it is restricted.

The right to data portability

You have the right to receive your personal data in a structured, commonly used and machine-readable format and to request that this data is transmitted to another party/controller where this is technically feasible. This right only applies to personal data you have directly provided to us (not any other information).

The right to lodge a complaint

You have the right to lodge a complaint about our handling or processing of your personal data to data protection regulators. (See section 9 for further details).

The right to withdraw consent

Where you have given your consent to us for the processing of any personal data, you have the right to withdraw your consent at any time (although this does not mean that any processing of personal data carried out by us with your consent up to that point is unlawful).