theshopsattanforan.com PRIVACY POLICY

CBRE, on behalf of its subsidiaries and divisions (collectively, “The Shops at Tanforan,” “us,” “we,” or “our”) has prepared this Privacy Policy (“Policy”) to describe to you, or if you represent an entity or other organization that entity or organization (in either case, “you,” or “your”), our practices regarding the personal information that The Shops at Tanforan collects, uses, and shares through the website(s) or application(s) that link to this Policy (each a “Service”). Capitalized terms not defined in this Policy shall have the meanings given to them in the The Shops at Tanforan Terms of Use.

By using this Service you are consenting to the collection, use, and disclosure of your personal information as set forth in this Policy. If you do not agree to be bound by this Policy, you may not access or use this Service. By using the Service, you further represent and warrant that you (i) are located inside the U.S., or (ii) are located outside the European Union (“EU”) and agree to be bound by U.S. laws, and (iii) are over the age of 16. You may not use the Service from the EU or if you are under the age of 16. Use of and access to the Service is void where prohibited. If you believe we have inadvertently collected the personal information your child under age 16, please contact us using the information below.

The Shops at Tanforan reserves the right, at any time, to modify this Policy. If we make revisions that change the way we collect, use, or share personal information, we will post those changes in this Policy and change the “Last Updated” date above. Your continued use of the Service following posting of changes constitutes your acceptance of such changes.

1. COLLECTION OF PERSONAL INFORMATION

A. Personal Information. “Personal information” means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked to, directly or indirectly, a particular consumer or household. The following are categories of personal information we may collect about you:

Categories of Information Collected	Sources of Information Collected	Purposes of Collection	Third Party Disclosure for Business Purpose
Individual Identifiers and Demographic Information, such as: email, password, full name, address, phone number, date of birth, age range, internet protocol address, name and age of child, demographic data (collectively “Registration Information”).	Interaction with the Service or marketplace, such as signing up for an Account, browsing, purchasing goods or services, attending events, sign up for our newsletter, or contact us	To provide and improve our products and services To set up your account on the service (an “Account”) To market products or services To communicate with you To fulfill your orders To respond to your requests or questions	To hosting providers of the Service To mall tenants to enable purchases, communication, or other interaction with them To marketing and advertising providers to market products and services To IT providers to monitor and secure the Service
Classifications, such as gender or age	When you sign up for an Account	To set up your Account To provide and improve our products and services To communicate with you To market products or services	To hosting providers of a Service To marketing and advertising providers to market products and services
Customer Records Information, such as name, address, payment card information.	When you purchase a good or service on the Service	To fulfill your orders, returns, or refunds, if any To improve our products and services To communicate with you	To hosting providers of a Service To payment processors to enable payment for goods or services To third party logistics providers to enable delivery of purchased goods to you To mall tenants to enable purchases, communication, or other interaction with them To marketing and advertising providers to market products and services
Commercial Information, such as: records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies, including information about you obtained from third parties.	When you interact with the Service or marketplace or purchase a good or service on the Service	To provide and improve our products and services To understand your interests To market products or services To communicate with you	To hosting providers of a Service To mall tenants to enable purchases, communication, or other interaction with them To marketing and advertising providers to market products and services To IT providers to monitor and secure the Service
Internet or Network Activity, such as browsing history, IP address, search history, information on an individual’s interaction with a Service or advertisement; network and device related information; social media integration.	Automatically collected when you visit or interact with a Service or advertisement	To improve our products and services To market products or services To secure the service To understand your interests	To hosting providers of a Service To marketing and advertising providers to market products and services To IT providers to monitor and secure the Service
Geolocation Information	When you provide your consent	To improve our products and services To understand your interests To market products or services To communicate with you To use as you request	To hosting providers of a Service To marketing and advertising providers to market products and services To IT providers to monitor and secure the Service
Inferences Drawn from Personal Information, such as your preferred retailers and interests, or purchasing or consuming characteristics.	Automatically collected when you interact with the Service by purchasing goods or services, sign up for events, open emails, or interact with advertisements	To improve our products and services To communicate with you To understand your interests	To hosting providers of a Service To mall tenants to enable purchases, communication, or other interaction with them To marketing and advertising providers to market products and services To IT providers to monitor and secure the Service

Personal information does not include:

Publicly Available - Publicly available information from federal, state, or local government records.

Deidentified or Aggregate information - "Deidentified Information" means information that cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular individual, and for which The Shops at Tanforanhas implemented technical safeguards and business processes that prohibit reidentification of the individual. “Aggregate Information” means information that relates to a group or category of individuals, from which individual identities have been removed, that is not linked or reasonably linkable to any individual or household, including via a device. We may use Deidentified Information and Aggregate Information for any legal purpose, including without limitation for any purpose for which we use personal information.

Excluded Information - Certain laws require separate privacy notices or are exempt from general personal information privacy policy disclosure requirements. Such laws include the Fair Credit Reporting Act (FRCA); and the Driver’s Privacy Protection Act of 1994. We will notify you separately according to those laws if any of our collection, use, or sharing of personal information falls under any of those laws.

2. SHARING OF PERSONAL INFORMATION

In addition to the specific situations discussed elsewhere in this Policy, The Shops at Tanforan may share your personal information in the following circumstances:

A. Related Companies and M&A Transactions. We may share your personal information with companies that are affiliated with us (that is, that control, are controlled by, or are under common control with us). In addition, if we sell all or part of its business or make a sale or transfer of assets or is otherwise involved in a merger or business transfer, we may transfer your personal information to a third party as part of that transaction, including at the negotiation stage.

B. Consent. We may ask if you would like us to share your personal information with other unaffiliated third parties who are not described elsewhere in this policy, and we may do so with your consent.

C. Legal Compliance. We may disclose personal information in response to subpoenas, warrants, or court orders, in connection with any legal process, or to comply with relevant laws. We may also share your personal information in order to establish or exercise our rights; to defend against a legal claim; to investigate, prevent, or take action regarding possible illegal activities or fraud; to protect the safety and security of other users; or to prevent a violation of our Terms of Use.

D. Service Providers. As described in the above table, we may share your personal information with third parties who perform services on our behalf that are necessary for the orderly operation of the Service. For example, we use Placewise to host our Service; for more information on them, please see their Privacy Policy. Among other things, service providers may help us perform website or application hosting, app design, maintenance services, database management, web analytics, app analytics, SMS notifications, payment processing, delivery, inventory management, fraud protection, marketing, or any other use set out in this Policy. Access to your personal information by these service providers is limited to the information reasonably necessary for the service provider to perform its limited function.

E. Behavioral-Based and Targeted Advertising. We, and certain third parties operating on or through our Services, may engage in online behavioral or targeted advertising. These forms of advertising include various parties and service providers, including third party service providers, engaged in the processing of personal information in connection with advertising. We may collect usage data and social media data from you and provide it directly to a third party for targeting on a third party platform. Sometimes, these third parties may collect this information directly (e.g. a Facebook “Like” button). The parties that control the processing of personal information for behavioral advertising purposes may build a profile of you containing this information, and may be able to identify you across sites, devices, and over time. These services may also track whether you view, interact with, or how often you have seen an ad, or whether you complete a purchase for a good or service you were shown in an advertisement. Please see Cookie Policy and Opting Out below for more information.

F. Affiliated Offerings. We may jointly offer events, promotions, or any other product or service offerings with our network of affiliated malls or merchants. The personal information that you submit through an event, promotion, or other product or service offering offered by any of our network of affiliated malls may be combined and transmitted with the Registration Information related to your Account. Third party partners or clients may collect information directly from you, which may be combined with personal information disclosed by us. If you decide to request, enter into, or participate in an event, promotion, or other product or service offering that is offered by us and identified as a joint effort with an affiliated mall or merchant, the information that you provide may be shared with us and with that identified affiliated mall or merchant.

G. Social Networking. The Service may offer you the ability to share your personal information through a social networking website (e.g., Facebook, Twitter), using such site’s integrated tools (e.g., Facebook “Like” button). The use of such integrated tools enables you to share personal information about yourself with other individuals or the public, depending on the settings that you have established with such social networking site. For more information about the purpose and scope of data collection and use in connection with such social networking site or a site’s integrated tools, please visit the privacy policies of the entities that provide these social networking sites.

H. Aggregate Information. We may also share Aggregate Information and other anonymized information for regulatory compliance, industry and market analysis, research, demographic profiling, marketing and advertising, and other business purposes.

3. SECURITY OF PERSONAL INFORMATION

No method of transmission over the Internet, or method of electronic storage, is fully secure. While we use reasonable efforts to protect your personal information from the risks presented by unauthorized access or acquisition, we cannot guarantee the security of your personal information. In the event that we are required by law to inform you of any unauthorized access or acquisition of your personal information we may notify you electronically, in writing, or by telephone, if permitted to do so by law.

4. COOKIE POLICY

"Cookies" are small pieces of information that a website stores on your device while you are viewing a Service. We may use both session cookies (which expire once you close your web browser) and persistent cookies (most of which have an expiration date, based on the purpose of the cookie, at which point they self-delete) to provide you with a more personal and interactive experience on our Services. We place three kinds of cookies: essential, advertising, and performance/analytics, as detailed below.

A. Essential Cookies. These cookies are strictly necessary to provide you with the Service and to use some of their features, such as access to secure areas. Because these cookies are strictly necessary to deliver the Service, you cannot refuse them without impacting how our Service functions.

B. Non-Essential Cookies. We use two kinds of non-essential cookies: performance and advertising. You may opt out of non-essential cookies using the cookie banner on the Service.

Non-essential performance cookies help us analyze how the Service is are being accessed and used, enable us to track performance, and secure the Service. For example, we use those cookies to get insights regarding users and performance, such as page speed or to help us customize our Services for you in order to enhance your experience.

Non-essential advertising cookies are used to make advertising messages more relevant to you and your interests. We sometimes use cookies delivered by third parties to track the performance of our advertisements. For example, these cookies remember which browsers have visited our Service. The information provided to third parties does not include personal information, but this information may be re-associated with personal information after we receive it. This process helps us manage and track the effectiveness of our marketing efforts.

We use generally use cookies and similar technologies as follows:

for “essential” or “functional” purposes, such as to enable various features of the Service like remembering passwords or staying logged in during your session;

for transaction purposes in our marketplace, if any, to secure your session and assist in the transaction;

for social media integration e.g. via third-party social media cookies, when you share information using a social media sharing button or “like” button, or when you engage with our content on or through a social networking website such as Facebook;

for analytics purposes, consistent with our legitimate interests in how our Service is used or performs, how users engage with and navigate through the Service, what sites users visit before visiting our Service, how often they visit our Service, whether an email was received or opened, and other similar information;

subject to any consent required by law, for the purpose of displaying advertisements via retargeting to those users who have visited our Service, or for targeting advertising to visitors to our Service; and

subject to any consent required by law, for the purpose of analyzing your feedback on our products on other platforms.

If you’d like to remove or disable cookies via your browser, refer to your browser’s configuration.

5. OPTING OUT

You can make the following choices to opt out of certain activities regarding your personal information:

A. Promotional E-mails. You may choose to provide us with your e-mail address for the purpose of allowing us to send newsletters, surveys, offers, and other promotional materials related to our merchants and featured products, as well as targeted offers from third parties. You can stop receiving promotional e-mails by clicking the “unsubscribe” links in the e-mails or by contacting us as described below. If you decide not to receive promotional e-mails, we may still send you service-related communications, such as those about your Account, to fulfill orders for products and service you have requested, or deliver notifications directly to you through the Service.

B. Behavioral and Targeted Advertising. If you wish to limit third parties’ collection of information about your use of our Service for behavioral or targeted advertising, you can opt-out of such at the Digital Advertising Alliance or Network Advertising Initiative. PLEASE NOTE THAT OPTING-OUT OF BEHAVIORAL ADVERTISING DOES NOT MEAN THAT YOU WILL NOT RECEIVE ADVERTISING WHILE USING THE SERVICE. IT WILL, HOWEVER, EXCLUDE YOU FROM INTEREST-BASED ADVERTISING CONDUCTED THROUGH PARTICIPATING NETWORKS, AS PROVIDED BY THEIR POLICIES AND CHOICE MECHANISMS.

C. Do-Not-Track. Some web browsers and devices permit you to broadcast a preference that you are not “tracked” online. At this time we do not modify your experience based upon whether such a signal is broadcast.

6. RIGHTS AND CHOICES FOR CALIFORNIAN USERS

The following applies to individuals located in California:

A. Categories of Personal Information Disclosed for a Business Purpose or Valuable Consideration. The Shops at Tanforan must disclose whether the following categories of personal information are disclosed for a "business purpose" or “valuable consideration” as those term is defined under California law. Note that while a category below may be marked, that does not necessarily mean that we have personal information in that category about you. In the past twelve months, we have disclosed the following categories of personal information in the manner described. The Shops at Tanforan does not sell and has no knowledge of the sale of personal information of consumers under 16 years of age under the control of The Shops at Tanforan.

Category	Information is Disclosed for a Business Purpose	Information is Disclosed for Valuable Consideration
A. Individual Identifiers and Demographic Information	Yes	No
B. Classifications	Yes	No
C. Customer Records	Yes	No
C. Commercial Information	Yes	No
D. Internet or Network Activity	Yes	No
E. Geolocation Information	Yes	No
E. Inferences Drawn from Personal Information	Yes	No

B. Your Rights. If you are a consumer as defined by the California Consumer Privacy Act (“CCPA”), you have certain rights in relation to your personal information under the CCPA. Under the CCPA, you have the following additional rights:

Access to Your Personal Information and Portability. You may request access to your personal information by contacting us as described below. We will grant you reasonable access to the data that we have about you as required by law. You may also be entitled to request copies of personal information that you have provided to us in a structured, commonly used, and machine-readable format and/or request us to transmit this information to another service provider (where technically feasible).

Changes to Your Personal Information. We rely on you to update and correct the personal information contained in your Account or contacting us as described below. Note that we may keep historical information in our backup files as permitted by law. If our Site does not permit you to update or correct certain personal information, please contact us as described below.

Deletion of Your Personal Information. We retain your personal information for the period necessary to fulfill the purposes outlined in this Policy, unless a longer retention period is required or permitted by law. You may, however, request that we delete your personal information by contacting us contacting us as described below. We will grant a request to delete information as required by law, but you should note that in many situations we must keep your personal information to comply with our legal obligations, resolve disputes, enforce our agreements, or for another one of our business purposes. Except as provided above, we will delete, aggregate, or de-identify all of your personal information as described in this subsection within the timeframes required by law.

Right to Opt Out of Disclosure of Personal Information for Valuable Consideration. We do not sell or exchange for valuable consideration the personal information of consumers, as those terms are defined under the CCPA. If we do begin to sell personal information, we will update this Policy and enable you to submit a request through our webform.

Notice of Disclosure for Direct Marketing. Under California Civil Code sections 1798.83-1798.84, California residents who have an established business relationship with Placewise are entitled to ask us for a notice describing what categories of personal information we share with third parties for their direct marketing purposes. This notice will identify the categories of information shared with and will include a list of the third parties with which it is shared, along with their names and addresses. If You are a California resident and would like a copy of this notice, please submit a written request to us at the addresses listed below.

7. EXERCISING YOUR PRIVACY RIGHTS

When exercising the rights or options described in this Policy, the following guidelines apply:

A. No Fee Usually Required. You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee or decline to comply with your request if your request is clearly unfounded, repetitive, or excessive.

B. What We May Need from You. When exercising your rights or otherwise assisting you, we may need to request specific information from you to help us confirm your identity. This is a security measure to ensure we do not disclose personal information to any person who is not entitled to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

C. Time to Respond. We try to confirm receipt of requests within 10 days and to respond to all legitimate requests within 45 days of the request. Occasionally, it may take us longer than 45 days to respond, for instance if your request is particularly complex or you have made a number of requests. In this case, we will notify you of the delay, and may continue to update you regarding the progress of our response.

D. No Discrimination. You will not be subject to discrimination as a result of exercising the rights described herein. In some cases, when you exercise one of your rights, we will be unable to comply with the request due to legal obligations or otherwise, or we will be unable to provide you certain products or services. These responses are not discrimination and our reasons for declining your request or ceasing services will be provided at that time.

E. Authorized Agent. You may designate an authorized agent to make a request on your behalf. In order to designate an authorized agent to make a request on your behalf, you must provide a valid power of attorney, the requester’s valid government issued identification, and the authorized agent’s valid government issued identification.

F. Accessibility. We have worked to develop our Service to conform to the World Wide Web Consortium (W3C) Web Content Accessibility Guidelines 2.0. These guidelines explain how to make web content more accessible for people with disabilities. For more information, please see Accessibility.

8. CONTACTING US

If you wish to access, update, or correct your personal information, please contact us using the information provided below. We will respond to you within a reasonable time and, in any case, within the time limits established by applicable law. We may ask you for additional information to verify your identity. In most cases, we will provide access and correct or delete any inaccurate information you discover. In some cases, however, we may limit or deny your request if the law permits or requires us to do so or if we are unable to verify your identify. Finally, if you have any questions or concerns about our Policy or any other privacy or security issue, please contact us at:

The Shops at Tanforan
Attn: The Shops at Tanforan Privacy Agent
2800 N.Main Street
Santa Ana, CA 92705

Telephone: 714.559.6525