Privacy policies

1. General

mfi Betriebsgesellschaft mbH, Klaus-Bungert-Straße 1, 40468 Düsseldorf, Germany, Local Court of Düsseldorf, Commercial Register No. B 75891, is the data controller for the processing of your personal data in connection with the use of our website, We place great emphasis on the protection of personal data. Therefore, your personal data is collected on the basis of the legal requirements set forth in BDSG (Federal Data Protection Act), TMG (German Telemedia Act), EU-DSGVO (EU General Data Protection Regulation) and other relevant directives.

Personal data includes any information relating to an identified or identifiable individual.
mfi collects personal data from you, as a user of the website, in order to provide you with website content. Data collection also enables you to contact us regarding the lease of mall spaces or with general concerns.

The purpose of this privacy policy (“Privacy Policy”) is to inform you about
(i) how we collect and process the personal data that you submit or disclose to us or that is collected via your access or use of our website, and
(ii) your rights, including how you can exercise them and what we can do to assist you in the exercising of your rights.
We encourage you to read this Privacy Policy carefully. If you do not wish for your personal data to be used by Us as set out in this Privacy Policy, please do not provide Us with your personal data. In this case, you may not be able to use all website functionalities.

2. Data Controller

The Data Controller for the processing of your personal data via our websites is:

mfi Betriebsgesellschaft mbH
Klaus-Bungert-Straße 1, 40468 Düsseldorf, Deutschland
Phone: 0049 (0) 211 302 310
Fax: 0049 (0) 211 302 31 111

3. Data Protection Officer

The Data Controller has appointed Mr. Torsten Weirich, LL.M. as the Data Protection Officer. Please find his contact details below:

Torsten Weirich, LL.M.
Unibail-Rodamco-Westfield Germany GmbH
Klaus-Bungert-Straße 1, 40468 Düsseldorf, Deutschland
Phone: 0049 (0) 211 302 31 480
Fax: 0049 (0) 211 302 31 111,

4. Purpose of processing

As a general rule, you may use our websites without entering any personal data. To the extent that we collect your personal data via our website, the purposes outlined below are served:
(i) technical website provision and monitoring of operability,

(ii) contacting us via the contact form,
We collect your personal data via our website as follows:

(a) Contact form

When you use our website contact form to contact us directly, your address information and contact data, such as your e-mail address and phone number, are collected in order to assist our company in the processing of your request and, if necessary, to contact you.

(b) Log files
Each time you access our website, your browser will automatically send some information to the website server so as to enable communication between your browser and the server. This information is stored in a so-called logfile. The information stored includes

• the type and version of your browser,

• your operating system,

• the website via which you accessed the current site,

• your computer’s host name (IP address), and

• the time of access.

Subject to legal archiving requirements, we will delete or anonymize your IP address after you leave our website, unless this is defined otherwise in the Privacy Policy and to the legally admissible extent.

For the rest, we use the information your browser transfers to our server in an anonymized format, which does not allow identification of who you are, for analyzing purposes, and to improve our services. It allows us to detect potential errors and identify on what days and at what times our websites are most frequently accessed.

5. Links to other websites
We may provide hypertext links from our website to third-party websites or Internet sources. For external websites, the privacy policies of the respective website operators generally apply. Prior to using a website that you have accessed via a link, please read the respective telemedia services provider’s privacy policy. Please be informed that we do not control any of these websites or Internet sources. Third-party websites are legally responsible for any unlawful privacy practices on their platforms. Please read the respective third-party privacy policies carefully to find out how your personal data is collected and processed.
6. Data processing within and outside the EEA

We use third-party service providers to provide the telemedia services to you, for example, for hosting purposes, and to process your personal data on our behalf, in particular, for application purposes. Such third-party service providers are always subject to security and confidentiality obligations consistent with this Privacy Policy and applicable law. By means of appropriate contractual and actual measures, such as the conclusion of contracts for order data processing or EU standard contracts, we ensure that your personal data is processed in compliance with data protection regulations.

7. Cookies

Our website uses cookies and similar technologies to collect information about your use of our website in order to render it more user-friendly, effective, and safe. When visiting our website, you accept our use of cookies.
7.1 What are cookies?
Cookies are small text files that are stored on your computer or mobile phone when you visit a website. They are often used to enable or improve operation of a website. Cookies enable the website to identify your device and to remember details of your visit (i.e., your language settings, font size, other preferences, and information concerning your activities).

7.2 How we use cookies
When you access and use our website, We will place cookies in your web browser (“Own Cookies”).
The cookies allow Us to operate the services you requested and to simplify your navigation of our website and the use of its functions so as to enable a smooth and uninterrupted experience. A particular feature in this context is the “memory function”.
In addition, we use third-party cookies (“Third-Party Cookies”). In particular, we use Google DoubleClick and Facebook high-reach advertising to send targeted advertising on the basis of your interests and to improve reports on campaign success.

We also use Google Analytics to measure the use of our website and to create user statistics in order to understand how users access and use our website. We use the information collected via Cookies to improve our services and to create collective statistics of the use of our website by our visitors. Please note that Google will use the personal data collected via the use of Google Analytics on our website for its own purposes. Please refer to for more information on how Google uses Google Analytics and collects and processes data.

UX ANALYTICS by Content Square is used to track which pages of our website are visited. Cookies collect the following information:

◦ Technical information about the devices used, e.g., type of device, operating system, and browser;
◦ Statistical information about your visit to our website, e.g., mouse movement, scrolling, frequency of clicks, and origin of visitor traffic; and
◦ Connection data, e.g., cookie identification and IP addresses. In this context, UX ANALYTICS cookies replace the last three digits of each visitor’s IP address with “x”. This process takes place as promptly as possible following the collection of the data and prior to location determination. IP addresses are processed solely for the purpose of determining the locations of our website visitors and are not linked to any other information or data that might identify an individual.

The information collected is used to compile aggregate statistics about visitor use of our website. This information allows us to identify content that is of the greatest interest and to improve the user experience without identifying individuals. Please note that Content Square may use the information collected in this context for its own purposes in order to compile anonymous statistics to improve its services as well as to generate reports. For further information regarding UX ANALYTICS, please refer to /.

Please note that UX ANALYTICS does not permit the collection of the following data:

• Form field values
• Input via your keyboard
• Complete IP address

Please note that UX ANALYTIC neither carries out profiling nor transfers data abroad.

This information will be stored for a maximum period of thirteen (13) months. After expiration of this period, you will be requested to give your renewed consent.

7.3 How to manage your cookie settings
You may define or change your cookie settings at any time. Please note: If you block all cookies, you may not be able to use all functions and pages of our website.
Most browsers and devices allow for cookie settings to be changed via the browser settings.

The following browser settings are available:
• all cookies are automatically rejected or accepted;
• all Own Cookies and/or Third-Party Cookies are automatically rejected or accepted; and
• you will be notified prior to storage of cookies, and your consent will be requested.
If you initially agree to our use of cookies, but wish to withdraw your consent at a later time, you can delete the cookies via your browser settings and/or change your browser settings to block all or certain other cookies. Please refer to your browser’s “Help” function for instructions. Alternatively, click on the links below for instruction on how to manage your cookie settings in the most frequenstly used browsers:
• Chrome (
• Internet Explorer (
• Mozilla Firefox (
• Safari (
If you do not wish Google Analytics to be used via your browser, click on
• to install the Google Analytics browser add-on;
• use advertising settings;
• use advertising settings for mobile devices;
• log off via the revocation system of the Network Advertising Initiative for consumers, which is available via the following link:!/
Please refer to for comprehensive information on how to do this via a number of other browsers.
You may use a different online services to manage the advertising cookies stored on your devices:

8. Google Analytics

This website uses Google Analytics, a web analysis service provided by Google Inc. (“Google”). Google Analytics uses cookies that will be stored on your computer and enable an analysis of your use of our website. The information on your use of this website generated by the cookie (including your IP address) will be submitted to a Google server in the USA, where it will be stored. If IP anonymization has been activated, Google will abbreviate / anonymize the last eight-bit-sequence of your IP address in all EU member states as well as in member states of the European Economic and Monetary Union prior to submission. The full IP address will only be submitted to a Google server in the USA and abbreviated there in exceptional cases. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, to compile reports about website activities for the website operator, and to provide other services in connection with the use of the website and the Internet on behalf of the website operator.
You can prevent the data generated by the cookie and relating to your use of the website (including your IP address) from being collected by Google, as well as the processing of such data by Google, by downloading and installing the browser plugin available via the link below:

9. Duration of Data Storage

Please note that we will automatically delete your personal data or block it from further use if and when the purpose of data collection is no longer relevant.

10. Your rights as a data subject

If you exercise any of your rights, pursuant to this section or pursuant to applicable law, we will communicate any correction or deletion of your personal data or restriction of processing carried out in accordance with your request to each recipient to whom the personal data has been disclosed unless such communication proves impossible or involves disproportionate effort.

If you wish to exercise these rights and/or obtain all relevant information, please contact the Data Controller or the Data Protection Officer. You will be asked to provide some of the identification information that you submitted upon your registration; this is necessary to verify that the request has been sent by you. We will respond within one month after receipt of your request, but we reserve the right to extend this period by two months. We will, in any event, inform you within one month after receipt of your request if we decide to extend the response period.

10.1 What you may request
In accordance with applicable law and as detailed below, you have the right to request access to, correction, deletion, or portability (e.g., transfer of your personal data to another service provider) of your personal data, as well as to request restriction of such processing.

10.2 Correction of your personal data
Under applicable law, you have the right to correct the personal data you have shared with Us. Via your settings in the Services, you can update your account information, change your profile settings, subscribe to/unsubscribe from communication you receive from Us, and set your Services sharing preferences, including location-based functionalities.
Please note that if you wish to limit or change access to or sharing of your personal data with a social network, you must change your account settings on that social network.
If you registered for our Services in written format, please contact the Data Controllers detailed in Section 2 above in writing or via e-mail to correct your personal data.

10.3 Integrity of your personal data
We will take adequate steps to ensure that you are able to keep your personal data up to date. You may contact us at any time and request confirmation regarding whether or not we still process your personal data.
If you find that your personal data processed by Us is inaccurate or incomplete and you are unable to update your personal data according to Section 9.2 of this Privacy Policy, you may ask Us to update your personal data. We will verify your identity and update your personal data.

10.4 Deletion of your personal data
You may ask us to delete your personal data at any time. We will immediately delete all of your personal data upon request. We will also delete (and ensure deletion by the processors that we engage) all your personal data if we are required to do so under applicable law.

10.5 Restriction of processing
If you ask us to restrict the processing of your personal data, e.g., when you contest the accuracy, lawfulness, or our need to process your personal data, we will limit processing of your personal data to the necessary minimum (storage) and, if applicable, will only process it for the establishment, exercise or defense of legal claims or, where necessary, for the protection of the rights of another natural or legal person, or other limited reasons dictated by applicable law. Once the restriction is lifted and we continue processing your personal data, you will be informed accordingly without undue delay.

10.6 Portability of your personal data
You have the right to receive the personal data that you provide to us. Upon receipt of your request, we will submit your personal data in a commonly used and machine-readable format without undue delay. Upon request, we will send your personal data to any third party (data controller) that you identify in your request, unless such request would adversely affect the rights or freedoms of others, and where technically feasible.

10.7 Complaint to a data protection authority
You have the right to submit a complaint concerning our data processing activities. Please address your complaint to:
Landesbeauftragter für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2-4, 40213 Düsseldorf, Germany
Phone: 0049 (0) 211 38 424 0
Fax: 0049 (0) 211 38 421 10

11. Updates of Privacy Policy

We may revise or update this Privacy Policy from time to time. Any changes to this Privacy Policy will become effective upon the posting of the revised Privacy Policy on our website.

Website Unibail-Rodamco-Westfield