GREYSTAR US STATE LAW PRIVACY STATEMENT

Effective as of: July 29, 2024

This Greystar US State Law Privacy Statement (this “Statement”) applies to “Consumers” (referred to as “you” or “your” in this Statement) as defined under the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA”), and all laws implementing, supplementing, or amending applicable state law, including regulations promulgated thereunder (collectively, “U.S. Privacy Laws”). This Statement is intended to supplement the general privacy policies of Greystar Global Enterprises (“Greystar,” “we,” “us,” or “our”), including our Global Privacy Statement. We refer to our websites, online services, property visits and offline interactions as the “services.” For more information about how your information is collected, used, stored and disclosed, please refer to the Global Privacy Statement. Capitalized terms used but not defined in this Statement shall have the meanings given to them under U.S. Privacy Laws.

We collect information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household, or device (“Personal Information”). Personal Information does not include:

• Publicly available information from government records; or
• Deidentified or aggregated consumer information.

The chart below describes, in the preceding twelve (12) months, the: (i) categories of Personal Information collected; (ii) sources from which we collect that Personal Information; (iii) purpose for which the Personal Information is collected; and (iv) third parties the Personal Information is disclosed to.

We may use or disclose the Personal Information we collect for one or more of the following purposes:

• Providing the services.
• Engaging with prospective tenants.
• Collecting and processing applications or contracts and communicating with you regarding your application or account.
• Communicating with you and to respond to questions you send to us.
• Advertising and marketing our products and services to you.
• Preventing and detecting fraud and otherwise comply with law.
• Protecting and enforcing our legal rights.
• Helping maintain the safety, security, and integrity of the services, databases, and other technology assets, and business.
• Testing, research, analysis, and product development, including to develop and improve the services.
• Responding to law enforcement requests and as required by applicable law, court order, or governmental regulations.
• As described to you when collecting your Personal Information or as otherwise set forth by applicable law.
• In evaluating or conducting a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Information held by us is among the assets transferred.

We will not collect additional categories of Personal Information or use the Personal Information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

In the past 12 months, we’ve disclosed the categories of Personal Information indicated in the chart above for a business purpose or at your direction with our affiliates, service providers, and third parties. For more details on the business purpose(s) for which, and the third parties, we share data with, see the How and When We Share Your Personal Information section in our Global Privacy Statement.

We in the past 12 months disclosed Personal Identifiers, Device Information, Internet/Network Activity with businesses, service providers, and third parties, such as advertising networks, analytics and social media networks for a commercial purpose.

We will retain your Personal Information for the period we believe reasonable to fulfill the purposes for which we hold your Personal Information, as outlined in this Statement, unless a longer retention period is required or permitted by law.

The criteria used to determine our retention periods include:

• The length of time we have an ongoing relationship with you and provide the services to you;
• Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them); and
• Whether retention is advisable considering our legal position (such as, for statutes of limitations, litigation or regulatory investigations).

We only process Sensitive Personal Information for purposes permitted under U.S. Privacy Laws.

Our Site uses cookies and other online tracking technologies that may be considered a “sale,” “sharing” when processed for targeted advertising purposes as defined under applicable law. You may exercise your right to opt out of the “sale,” “sharing,” and of your Personal Information by submitting your request here.

Residents of certain states may opt out by broadcasting an Opt-Out Preference Signal, such as the Global Privacy Control (GPC) (on the browsers and/or browser extensions that support such a signal). If you choose to use the GPC Signal, you will need to turn it on for each supported browser or browser extension you use.

Categories of Personal Information disclosed that may be considered “sale,” “sharing,” include Basic Identifying Information, Device Information, and Internet/Network Activity.

Categories of third parties to whom Personal Information is disclosed that may be considered “sale,” “sharing,” include certain advertisers and marketing partners, data analytics providers, and social media networks.

Residents of Connecticut, Utah, Oregon, and Montana are entitled to access the Personal Information once every 12-month period. Residents of all other states with applicable U.S. Privacy Laws, including California, Virginia, Colorado, and Texas, are entitled to request access to collected Personal Information twice in a 12-month period. These requests cover what Personal Information was collected and the right to know the business and commercial purpose with which Greystar processed the Personal Information over the past 12 months. Residents also have the right to correct any Personal Information maintained by Greystar that may be incorrect. Once we receive your request and confirm your identity, we will disclose to you:

• The categories of Personal Information collected about you and the sources from which we collected such information.
• Our business or commercial purpose for collecting or selling that Personal Information.
• The categories of third parties with whom we share that Personal Information.
• The specific pieces of Personal Information we collected about you.

Residents of states with data privacy laws have the right to request that Greystar delete any of Personal Information collected and retained, subject to certain exceptions. Once we receive your request and confirm your identity, we will review your request to see if an exception allowing us to retain the information applies. We may deny your deletion request if retaining the information is necessary for us or our service provider(s) and as permitted by applicable law. We will delete or deidentify Personal Information not subject to an exception from our records and will direct our service providers to take similar action.

To exercise your rights described above, please submit a request by either:

• If you are a prospective, current or former resident, a current or former team member, an investor, or a job applicant, submitting your request using this form or by calling 1-844-795-2806.
• If you would like to exercise your right to opt out of the selling or sharing of your information, submitting your request using this form.

Only you, a natural person, or an authorized agent may make a verifiable consumer request related to your Personal Information. You may make a verifiable consumer request on behalf of your minor child.

Your request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative; and
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. You do not need to create an account with us to submit a request. We will only use Personal Information provided in the request to verify the requestor’s identity or authority to make it.

Residents of certain states may have the right to appeal our decision with respect to a request. To appeal a decision, please contact us through the ways listed above or any method outlined in the decision.

You may use an authorized agent to make a request for you, subject to our verification of the agent, the agent’s authority, and your identity. If you are using an authorized agent to make a request, you or the agent must submit the following to the email address in the Contact Information section below:

• A copy of a power of attorney provided by the consumer pursuant to applicable law; or
• Proof of signed permission along with a copy of the agent’s ID and an email directly from the consumer to us confirming that they provided the agent permission to submit the request.

We will acknowledge a verifiable consumer request within ten (10) days of receipt, where applicable law requires, and we will respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing.

Any disclosures we provide will only cover the 12-month period preceding our receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

We will not discriminate or retaliate against you in a manner prohibited by applicable U.S. Privacy Laws for exercising any of your rights.

Under California’s “Shine the Light” law, California residents who provide Personal Information in obtaining products or services for personal, family, or household use are entitled to request and obtain from us once a calendar year information which includes a list of all third parties to which Greystar has disclosed Personal Information, as defined in California Civil Code Section 1798.83(e) during the preceding year, if any, with other businesses for their own direct marketing uses. If applicable, this information would include the categories of customer information and the names and addresses of those businesses with which we shared customer information for the immediately prior calendar year. California residents may request this information in writing by contacting us by email at privacy@greystar.com with “California Privacy Request” in the subject line. In your request, please attest to the fact that you are a California resident and provide a current California address for your response.

We reserve the right to amend this Statement at our discretion and at any time. When we change this Statement, we will post the updated notice on the website and update the notice’s effective date. Your continued use of our services following the posting of changes constitutes your acceptance of such changes.

If you have any questions or comments about this Statement, the ways in which we collect and use your information, your choices and rights regarding such use, or wish to exercise your rights under, please contact us at privacy@greystar.com:

If you need to access this Statement in an alternative format due to having a disability, please use the contact information found above.