PRIVACY POLICY

This Privacy Policy was last updated on December 20, 2019:

This Privacy Policy applies to information we collect through: (1) the Greystar websites operated by Greystar Worldwide, LLC and its affiliates (referred to herein as "Greystar", "we", "us", or "our"),; (2) other websites and online services that we own, operate, or make available and that link to the Privacy Policy and (3) to all other general enquiries we receive (including postal mail, electronic mail, telephone requests and in person).

Greystar recognizes the importance of protecting the privacy of individual-specific information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device (“Personal Information”) particularly our consumer users (referred to as "you" or "your" in this Privacy Policy). This Privacy Policy describes what Personal Information we gather, how we use it, how it is shared and how you can correct, change and limit our use of it. if you are asked to submit registration details via this site, you may be requested to agree to additional terms regarding our use of your Personal Information, and those additional terms will apply in that context. Any additional terms will be provided for your review at the time of registration.

We encourage you to read this Privacy Policy before you send or share Personal Information with us or use our websites. We also encourage you to read it again when you return to our websites.

WHAT PERSONAL INFORMATION DOES GREYSTAR COLLECT?

We collect the Personal Information described in general terms below. For greater detail, we have set out in Annex 1 details of the categories of Personal Information we have processed over the last twelve (12) months.

The type of Personal Information we collect will depend upon what we will need to provide you with the product or service you are interested in.

Prospective residents may be asked to provide the following information: first and last name, primary phone number, email address, the apartment size you are looking for (number of bedrooms, number of bathrooms), where you want to live (e.g., city and state or community name), the type of building you prefer, your proposed rent budget, move-in date, desired lease term, and whether or not you have pets (if so, what type), and any additional comments you wish to provide.

Current residents of one of our residential communities may be asked to provide an apartment number, first and last name, phone number, email address, reason for contacting us, and any additional comments.

Our residential communities may have their own separate sites and we may use separate sites for the processing of rental applications and agreements and to assist our residents with other tasks which are required or helpful to them, such as paying rent online. You will move away from this site when engaging in those activities and those sites will have their own privacy policies, and so please review that privacy policy before using those separate sites. See also Third-Party Site Links below.

For those interested in booking corporate housing stays, you can view available listings on our Greystar general websites. We use separate sites for booking corporate stays and you will be redirected to those websites, which have their own privacy policy.

For those interested in applying for employment at Greystar, the following Personal Information may be requested or obtained: name and address, age or date of birth, email address, occupation, employment information, telephone number, educational background and Social Security/national insurance number, credit checks, background checks and employment verification. Where legally required, we will obtain your consent before undertaking these checks. Once a candidate accepts a position, the candidate may be asked to complete further online details. This may include an invitation to self-identify ethnicity or race. This information is only collected in relation to positions in some jurisdictions and we do this to meet government reporting requirements. Provision of this information by candidates is voluntary and it is not collected where it would be unlawful for us to do so.

We may receive information about you, including Personal Information, from third parties. For example, if you are on another website and you opt-in to receive information from us, that website will forward to us your email address and other information about you so that we may contact you as requested.

USAGE TRACKING: USE OF IP ADDRESSES

An IP address is a number that is automatically assigned to your computer whenever you are using the Internet. Web servers, the main computers that serve up web pages, automatically identify your computer by its IP address. As permitted under applicable law, Greystar collects IP addresses for the purposes of system administration, gathering and analyzing aggregated information, creating a better experience for users and auditing the use of our sites. We do not normally link IP addresses to anything personally identifiable, which means that your session will be logged, but you remain anonymous to us. We will seek to link your IP address when we feel it is necessary to protect our sites and other users from harm and to prevent criminal misconduct. Please see the section on Use of "Cookies."

USE OF "COOKIES"

Cookies are pieces of information that a website transfers to an individual for record-keeping purposes. Cookies make web use easier for you by saving your preferences while you are at our sites. The use of cookies is an industry standard, and as such, you will find them at most major websites. By showing how and when users use a site, cookies help us see which areas are popular and which are not. Many improvements and updates to our sites are based on such data as total number of visitors and pages viewed. This information is most easily tracked with cookies. We use the information from cookies only to provide services better tailored to your needs and for the protection of our websites and users from potential harm. We never save passwords or credit card information in cookies.

We use persistent tracking cookies on our websites which are cookies that stay in your web browser between visits. These cookies can also be used to show us which sites you have visited before entering our sites and which sites you may go to if you leave, especially if you access the registered user parts of our sites by using your social media log-in credentials. We use these to capture analytical information about our visitors that helps us to improve the performance of our website and create a better experience. These cookies allow us to recognize and count the number of visitors, to provide content related to a prior visit to our websites, to see how visitors move around the sites and the products and services they are interested in when they are using them and to see what other types of products and services they may be interested in. This helps us to improve the way our websites work, for example by making sure users are finding what they need easily.

We may also use cookies which allow us or third parties to advertise our products and services on websites that you access after you have visited our sites. You may also see advertisements from us if other websites you visit capture through a cookie that you have been on our sites. These ad preference cookies are often used by search engine sites. Our cookies can be disabled as indicated below. To prevent this advertising, you may also need to review the cookies disabling information on the other sites you visit.

Most browsers are set up to accept cookies. If you want to change your cookie preferences, you can do so through your browser settings or refuse the cookies when you enter any of our websites. You may also limit the information we gain from certain cookies by logging directly into the registered areas of our sites rather than by logging in by using your social media log-in credentials. Please remember that our cookies are often used to give you certain functionality and without them you may not be able to use some of our websites e.g. save properties from our listings.

You can also remove cookies that have already been set in your browser via your browser settings.

WHAT INFORMATION DO WE SHARE OR DISCLOSE?

Generally, Greystar will not disclose Personal Information except when we have your permission or under special circumstances, such as when we believe, in good faith, that the law requires our disclosure. We may also disclose Personal Information for business operations as described below.

We do not share your Personal Information with third parties, unless:

• Such information is shared following receipt of a specific request and/or permission from users;
• Such information is shared with affiliated companies and/or potential investors (in any form of business transaction, including purchase or merger) pursuant to an agreement which contains reasonable confidentiality arrangements;
• Such information is shared with contractors who work with us pursuant to an agreement which contains reasonable confidentiality arrangements;
• Such information is shared to comply with or in accordance with any applicable law and/or court orders and/or to prevent suspected illegal acts, frauds, situations involving potential threats to the safety of any person, or as otherwise required by law. This includes responding to lawful requests by public authorities, including to meet national security or law enforcement requirements;
• Such information is shared to help Greystar defend against claims and/or establish or exercise any legal right that Greystar may have;
• Such information is shared to help Greystar prevent violations of the Greystar Terms of Use and this Privacy Policy or to otherwise protect the rights, property, or safety of Greystar employees, residents and other persons others, including exchanging information with third parties for fraud protection and credit risk reduction.

BUSINESS TRANSITIONS

If Greystar goes through a business transition, such as a merger, being acquired by another company, or selling all or part of its assets, users' Personal Information will, in most instances, be part of the assets transferred. By using our websites and providing your Personal Information, you consent to this transfer, provided use of the Personal Information will remain in accordance with the Privacy Policy in place at the time of the transfer.

THIRD-PARTY SITE LINKS

You should be aware that when you are on a Greystar website you could be directed to other third-party sites that are beyond our control, including, without limitation, to the websites of residential communities. There are links to other sites from Greystar, which take you outside our service. For example, if you "click" on a banner, an advertisement or a search result, the "click" may take you off the Greystar sites. These other sites may include sites of other advertisers, sponsors and partners that may use their logo with ours as part of a co-branding agreement. These other sites may send their own cookies to visitors to collect data or solicit information. Greystar does not control these sites and therefore is not responsible for their content. The inclusion of hyperlinks to any other sites by Greystar does not imply any endorsement of the material on such sites, nor any association with their operators.

Greystar policies do not extend to anything that is inherent in the operation of the Internet, which is beyond our control. Remember that whenever you give out Personal Information online, that information may be collected and used by people you do not know.

SECURING INFORMATION

Greystar takes reasonable technical and organizational measures in accordance with applicable laws to safeguard users' Personal Information. While Greystar strives to protect your Personal information and therein your privacy, we cannot guarantee the security of any Personal Information you disclose online, and you therefore disclose such Personal Information at your own risk.

We limit access to Personal Information to those individuals and organizations who we believe reasonably need to receive such information to provide our services or to do their jobs, and we take the precautions we deem reasonable to protect the security of users' Personal Information. However, as in many computer systems, internet applications and software programs, unauthorized use, failure of hardware or software, etc. may be injurious to the confidentiality of users' Personal Information.

Because the security of all Personal Information associated with our users is of utmost concern to us, we periodically review and improve our security when new technology becomes available. This includes use of software which encrypts (generally processed at 256 bits) or distorts data submitted to us relating to an online Rental Application or employment application. If users have any questions about security, please contact us using the information in the "Contact Information" section.

EMAIL CONSENT AND OPT-OUT

Your provision of Personal Information through any of our registration forms on our sites constitutes your affirmative consent that we may contact you by email to provide you with information and notices relating to the property where you reside, on various similar services available to you at or through that property and on various other properties that may be available and of interest to you in the future. It also means we may email you regarding updates to this Privacy Policy.

You may choose to opt out of receiving future commercial email messages from us. Each mass commercial email sent by us contains a link with instructions on how to remove yourself from our email list. Please note that if you are a resident of a Greystar community and you use this site and your community site, you will need to opt-out of your community site separately. You will also need to opt-out separately from any third-party sites you have registered with. Please see the section on Third-Party Site Links.

CHILDREN'S PRIVACY

Our websites are not directed at children. We do not collect or maintain information at our sites from those we know are under 16, and we do not permit children under 16 years of age to become registered users of our sites. By using any of our sites, you represent that you are not under 16 years of age. If you are a parent or guardian and you believe that your child under age 16 may have provided personally identifiable information through any of our websites, please contact us using the information in the "Contact Information" section.

DATA TRANSFERS – INTERNATIONAL USERS

If you provide Personal Information to us, it may be transferred to and processed on computers in the U.S. and other countries. Do not provide your Personal Information to us if you do not want this information to be transferred outside of your country, or if the laws in your country restrict these types of transfers.

For users residing in the European Union or United Kingdom, Greystar complies with the EU-U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce ("Privacy Shield") regarding the collection, use, and retention of Personal Information from European Union member countries and the United Kingdom. Greystar has certified that it adheres to the Privacy Shield Principles of Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement and Liability. If there is any conflict between the policies in this Privacy Policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern. The Greystar entities that adhere to the Privacy Shield Principles can be found at www.privacyshield.gov/list. To learn more about the Privacy Shield program, and to view our certification page, please visit www.privacyshield.gov.

In compliance with the EU-U.S. Privacy Shield Principles, Greystar commits to resolve complaints about your privacy and our collection or use of your Personal Information. European Union and United Kingdom residents with inquiries or complaints regarding this Privacy Policy should first contact Greystar. Please use the details in the Contact Information section to do so.

Greystar has further committed to refer unresolved privacy complaints under the EU-U.S. Privacy Shield Principles to BBB EU PRIVACY SHIELD, a non-profit alternative dispute resolution provider located in the United States and operated by the Council of Better Business Bureaus. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit www.bbb.org/EU-privacy-shield/for-eu-consumers/ for more information and to file a complaint.

Greystar has further committed to cooperate with the panel established by the EU data protection authorities (DPAs) regarding unresolved Privacy Shield complaints concerning human resources data transferred from the EU in the context of the employment relationship.

Please note if your EU originating complaint is not resolved through these channels, under limited circumstances, a binding arbitration option may be available before a Privacy Shield Panel. Greystar is subject to the Federal Trade Commission in respect of its compliance with the Privacy Shield.

Under certain circumstances, we may remain liable under the Privacy Shield Principles if our agents process your Personal Information that we transfer to them in a manner inconsistent with the Privacy Shield Principles.

CORRECTING AND DEACTIVATING PERSONAL INFORMATION

You may have the right under applicable privacy laws to request that Greystar inform you as to whether Personal Information relating to you is being processed. Subject to certain exceptions under applicable privacy laws, you may also have the right to request that Greystar correct, supplement, delete or block your Personal Information if the data are factually inaccurate, incomplete or irrelevant to the purposes of the processing activities or if the Personal Information is being processed in any other way which infringes a legal provision. If you wish to exercise your rights or if you have any questions or suggestions regarding the use, collection, or security of your Personal Information, please contact us using the contact details in the "Contact Information" section.

When a request for user deletion is received, we will make all reasonable efforts to purge said data from our systems. Due to the nature of our services, some information may not be fully removed (e.g., backups or archived copies. Following a deletion request, any Personal Information about you that was not deleted from our systems due an exception under applicable privacy laws will only be used for the purposes provided for by the applicable exceptions (e.g., to continue performing a contract that you have with us).

NOTICE TO CALIFORNIA RESIDENTS

The California Consumer Privacy Act (“CCPA”) provides California residents with certain rights regarding their Personal Information. These rights and the methods for exercising them are described in more detail below. Please note that this section applies only to and the rights described in it can only be exercised by residents of California.

Description of Rights

• Right to Opt-Out of Sale
• Greystar does not sell your information to third parties.
• Right to Know
• You have the right to request that we disclose that Personal Information about you that Greystar collects, uses, discloses, and sells (if any at all). Once we receive and confirm your verifiable consumer request, we will disclose to you:
• The categories of information we have collected about you.
• The categories of sources for the Personal Information we have collected about you.
• Our business or commercial purpose for collecting or selling that Personal Information.
• The categories of third parties with whom we share that Personal Information.
• If we sold or disclosed your Personal Information, we will let you know and list the categories of Personal Information that were disclosed or sold to third parties for a business or commercial purpose.
• Whether or not we sell the Personal Information of minors under 16 years of age without affirmative consent.
• Greystar’s response to requests to know (either the categories or specific pieces of Personal Information) will only cover the 12-month period preceding the request.
• Right to Delete
• You have the right to request that Greystar delete any Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct service providers to delete) your Personal Information from our records. Greystar may deny your deletion request if retaining the information is necessary for us or our service providers to:
• Complete the transaction for which the Personal Information was collected, provide a good or service already requested by the consumer or reasonably anticipated to be requested, taking into account our ongoing relationship with the consumer, or to otherwise perform a contract between us and the consumer.
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or to prosecute those responsible for that activity.
• Debug to identify and repair errors that impair existing functionality.
• Exercise free speech, ensure the right of another consumer to exercise his or her free speech, or exercise another right provided for by law.
• Comply with the California Electronic Communications Privacy Act.
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest, if the deletion of the information is likely to render impossible or seriously impair the achievement of such research, if the consumer has provided informed consent.
• Enable solely uses that are reasonably aligned with the expectations of the consumer based on the consumer’s relationship with the business.
• Comply with a legal obligation.
• Otherwise use the consumer’s Personal Information, internally, in a manner that is compatible with the context in which the consumer provider the information.
• Right to Non-Discrimination
• Greystar will not discriminate against a consumer for exercising any of their privacy rights under the CCPA by doing any of the following:
• Denying goods or services.
• Charging different prices or rates for goods or services, including applying discounts or imposing penalties.
• Providing a different level or quality of goods or service.
• Suggesting that a consumer will receive a different price or rate for goods or services or a different level or quality of goods and services.

Exercising Your Rights

• How to Exercise Your Rights
• To exercise any of your rights described above, please submit a request to Greystar by either:
• Calling us at 1-877-862-2797
• Following this link to our online request portal.
• Only you, or a person registered with the California Secretary of State that you have authorized to act on your behalf, may make a verifiable consumer request related to your Personal Information. You may, however, make a verifiable consumer request on behalf of your child.
• Greystar cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. All requests must:
• Provide enough information for us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative. The amount of information necessary will depend on the request but we will only use Personal Information provided with a request to verify your identity and authority to make the request.
• If you have any questions or concerns regarding the exercise of your rights or Greystar’s privacy policies and practices, please let us know. You can contact us by using the "Contact Information" details below.
• Exercising Rights for Someone Else
• Only you, or a person registered with the California Secretary of State that you have authorized to act on your behalf, may make a verifiable consumer request related to your Personal Information. You may, however, make a verifiable consumer request on behalf of your child.
• Response Timing and Format
• We will make our best effort to respond to a verifiable consumer request within 45 days of its receipt. Within ten (10) days of receiving the request, Greystar will confirm receipt and provide information about its verification and processing of the request. If we require more time, we will inform you of the reason and an extension period in writing. For requests that seek the disclosure of specific pieces of information about the consumer, we will select a format that is readily useable and should allow consumers to transmit the information from one entity to another entity without hindrance. We do not charge a free to process requests, unless they are manifestly unfounded or excessive. Greystar will maintain records of consumer requests made pursuant to CCPA as well as our response to said requests for a period of at least twenty-four (24) months.

NOTICE TO RESIDENTS OF CERTAIN STATES

Some state laws permit residents who provide us with Personal Information to request certain information regarding our disclosure of such information to third parties for their direct marketing purposes. We do not, currently, disclose such information to third parties for their direct marketing purposes. If we change this policy, we will update this provision and provide instructions on how you may make a request for details.

DO-NOT-TRACK DISCLOSURES; THIRD-PARTY TRACKING

Certain mechanisms may allow you to send web browser signals, known as “Do Not Track” (“DNT”) signals, indicating your choice to disable tracking on websites. We do not respond to browser do not track signals currently. We may not be aware of or able to honor and respond to every such mechanism. More information about “do not track” is available at www.allaboutdnt.org concerning such information.

Third parties, other than our service providers, do not have authorization from us to track which websites, apps, or other online services you visit prior to and after visiting our websites. Please note, however, that we cannot control third-party tracking and there may be some third-party tracking that occurs without our consent or knowledge.

NOTIFICATION OF CHANGES

Any changes we make to this Privacy Policy will become effective upon posting. If we change our Privacy Policy, we will advise users of those changes through a general description at the top of this Privacy Policy and may also post these details to other places we deem appropriate, so our users are aware of what information we collect, how we use it, and under what circumstances, if any, we disclose it. If we are legally permitted to do so, we may also email you.

CONTACT INFORMATION

If your Personal Information changes (such as zip/postal code, phone, email or postal address), we provide a way to update your Personal Information. This can usually be done at the Registered User account settings page or by emailing our Data Privacy Department through privacy@greystar.com.

You may use this email to get in touch with us for any other reason relating to this Privacy Policy. If you send us an e-mail, our communication should clearly be marked as data protection query and as being time sensitive.

You may also contact us by postal mail at Greystar, Attn.: Data Privacy, 600 E. Las Colinas Blvd., Suite 2100, Irving, Texas, 75039. If you contact us by mail, your communication should clearly be marked as a data protection query and as being time sensitive.

APPENDIX 1

Personal Information Categories

• Identifiers: name, user/account name, postal address, email address, contact information, internet protocol address, internet cookie identification number, social security number, taxpayer identification number, bank account/credit card number, driver’s license number, passport number, date of birth, picture, resident identification number, device identification number, emergency contact details.
• Personal Information categories listed in California Civil Code § 1798.80(e): name, signature, social security number, address, telephone number, passport number, insurance policy number, education, employment, employment history, financial information, medical or health insurance information.
• Protected classification characteristics under California or federal law: age, race, color, ancestry, national origin, citizenship, marital status, sex, veteran or military status.
• Commercial Information: records of products or services purchased, obtained, or considered, other purchasing histories or tendencies, utility bills, insurance claimant name and contact information, credit history, lease information, rental history, rent amount.
• Internet or other electronic network activity information: browsing history, search history, internet protocol address, cookie identification number, information regarding consumer’s interaction with a website, internet postings.
• Sensory data: pictures, videos, and sounds.
• Employment or other professional information: current job and past job history, job title, and, in the case of prospective and current residents or tenants, pay history, income.

Purposes

• Fulfilling Our Obligations: We process Personal Information to fulfill or meet the reason you provided the information to us, such as contracting with us as a tenant or applying for a position with us.
• Advertising and Marketing: We process Personal Information to communicate with you about the Greystar products and services you have expressed an interest in and to provide you with information on other similar Greystar products and services we believe will be of interest to you.
• Service Performance: We process Personal Information for the performance of services and to better understand how we can help prospective residents, current residents and employees.
• Security and Legal Obligations: We process Personal Information to detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity We also process Personal Information in accordance with our legal rights and obligations under applicable laws.

Third Parties with Whom We Share Personal Information

• Contracted service providers who provide IT, system administration and hosting, payment processing, research and analytics, marketing and data enrichment for the purposes set forth above.
• Our affiliates where required based on the affiliate’s relationship with you or where sharing of data is necessary to fulfill a request you have submitted.
• Sponsors of events, contests and promotions in which you have expressed interest or for which you have registered.
• Third-party advertising networks and websites so that Greystar can market and advertise on third party platforms and sites.
• Professional advisors such as lawyers, bankers, auditors and insurers.
• Third parties who are part of a business transition such as a merger, reorganization or the sale of all or a part of our business.