This Privacy Policy governs our collection, use and disclosure of personal information during the course of our business activities. It covers our:

• corporate website: www.cadillacfairview.com

• shopping centre website: shops.cadillacfairview.com

• gift card website: www.cfshopcard.ca, this will open in a new tab

• individual property-specific websites and other web applications where this Privacy Policy appears

• mobile applications

• individual buildings and shopping centres

• contests

• electronic communications with you (such as email, text/SMS, and push notifications)

Some of our services, mobile apps and websites may also have separate privacy notices. These privacy notices will provide you with specific information applicable to those services, mobile apps and websites. 

Sometimes we provide links to other companies’ websites and services (like retail tenants in our shopping centres). Those companies have their own privacy and cookies policies. Information you give them will be governed by their rules and not ours.

We have a separate privacy policy for our employees.

What personal information we collect depends on how you interact with us. 

Please see the sections below to understand the personal information we collect and use based on the most common types of interactions with us. For an explanation of what information we collect automatically when you use our online services, see What types of online information do we collect automatically?

We may combine information that we have collected offline with information we collect online. We may also combine information we collect with information we obtain from other sources. We do this in order to understand preferences and trends. Keep in mind that we may also collect other information as we develop new products, services and techniques for delivering improved or personalized services to you

If you make a request for customer assistance or services, we collect information that is necessary to respond to your request. This may include contact information, details of your request and our response.

When you create an account with us, including through our mobile applications, we may ask for your name, email address, password and information about your interests to create an account for you. 

If you sign into our websites, mobile apps or wifi using a social media account (such as Facebook, Instagram or Pinterest), we will collect profile information from those accounts and other information that you have consented to sharing with us in order to create your CF Account. 

We use account information to register and to authenticate you. We may also use information we collect and associate with your CF Account to tailor our products and services to your interests.

We may collect information when you subscribe to a newsletter, enter a contest, register for a service, or create an account with us. This information could include your contact information. 

If you subscribe for email communications, we will collect your email address. 

If you enter a contest or promotion, we will collect personal information from you to administer the contest or promotion. 

We collect information such as your name, address and payment information if you purchase a CF SHOP! card® or rent equipment from us. We will also collect contact information to deliver communications and packages to you.

We track transactions and your account balance using your CF SHOP! card. If you register your CF SHOP! card with us or associate the CF SHOP! card with your CF Account, this information will be associated with you. 

If you make a large purchase of CF SHOP! cards, we may collect additional information as part of our obligations and corporate best practices to combat money-laundering and other criminal activity.

We may collect information if you interact with us on social media. We may view and share posts that mention us, our services or one of our properties. We only view and share this information if your privacy settings permit us to see your post. We use this information to understand trends and what visitors and tenants are saying about our properties and services.

We collect information from our digital advertising campaigns. For example, if you open our newsletters or interact with our digital advertisements, we may receive information about the actions you took. In some cases, such as our newsletters, this information may be connected to you as an identifiable individual. In other cases, it may be connected to an advertising ID associated with your social media account or device. In some cases, ad tech companies may provide us with information about the location where you saw our digital advertisement. This location may be inferred from your IP address or based on location services settings of your device. We require the ad tech company or the provider of the location data to obtain your consent. You can limit or opt-out of the information we collect or that ad tech companies share with us. See Online advertising under Your rights and choices below.

Our properties are equipped with video surveillance cameras. These cameras may collect your image or vehicle (including licence plate) when you are at one of our properties. In limited cases, the field of cameras on our property may capture images of individuals who are near the perimeter of our properties. 

Access to some areas of our properties are restricted. To access these areas, you may need to provide your name and other information. If you are visiting one of our employees in a restricted space, you may need to provide the name of the employee you are visiting, your name, your employer (if relevant) and your contact information. 

If you are one of our contractors or if you are an employee or contractor of one of our tenants, we may issue you a physical or digital passcard to access our building and the tenant’s premises. We will collect information about you and the business authorizing us to issue you a passcard. Our passcard readers collect logs of the dates and times of your use of your passcard.

We retain security guards to monitor and protect our buildings. If there is an incident, these security guards may collect information about the individuals involved in the incident, information from witnesses, and other information that they observe or are told.

We also retain third party services that scan social media and other sources of information for threats to our properties and personnel.

We use information we collect as part of building security programs to help secure and protect our property, to create a safe environment for our tenants, building occupants and visitors, to respond to emergencies, to investigate violations of our policies or laws, and to investigate claims (such as property damage or personal injury).

We may collect your vehicle make, model and licence plate number for the purposes of enforcing our parking regulations. If you have a reserved parking spot in one of our buildings, we collect registration information such as your name, contact information, employer, vehicle make and model and licence plate number for the purposes of providing and managing our parking services.

We will collect personal information that you provide to us in connection with your employment application, and, if applicable, any interviews, aptitude, and personality testing in which you participate in. This personal information may you provide us include previous work experience, education, and other relevant information to the position you applied for. If we use a recruiter, we will collect information about you that the recruiter provided to us. If we are considering making you an offer of employment, we will conduct reference checks, social media checks, and employment, education and credential verifications. As part of conducting those checks, we will need to share the information you provided with us, and we will collect information from your references, former employers, educational institutions and professional associations. If the position you applied for requires you to complete a criminal background check, we will share information about you with the background check company in order to facilitate that check and we will receive the result of that check from the background checking company. We use the information we collect during the employment application and screening process to assess your suitability for employment with us.

If you rent or lease residential, retail or commercial space in one of our properties, we may collect personal information that you or your real estate broker provides to us or that you authorize us to collect from third parties in connection with your rental or lease application and the administration of any subsequent rental or lease. The information we collect may include, among other things, your contact information, government issued identification, financial and tax information, employment information, other businesses you own or operate, rental history information, banking information, references, rental rates and payment history. We use this information to assess your suitability for renting or leasing the property and for admininstering our rights and obligations under any rental agreement or lease.

We automatically collect technical information and information about how you use our websites, website applications and mobile apps. Please see the Sections below to learn more.

• Wherever technically feasible, we will give you the option of browsing or using our online services as a guest without logging in and identifying yourself but not all features may be available to you as a guest

• If you are not logged into our services, we will not attempt to discover who you are by using online technical information

• We or our ad tech providers will obtain your explicit consent for personalized ads, if required by applicable laws, such as in Quebec. We or ad tech partners will also provide you with the means to withdraw consent.. See Online Advertising for details.

When you use our websites, website applications and mobile apps, our servers automatically collect information from your device or session. We collect this information as part of the normal process of delivering online content to your device. In some cases, we may also scan this information to detect cybersecurity threats.

Online technical information that we collect includes but is not limited to IP address, browser type and version, advertising IDs, app unique ID (if you are using one of our mobile apps) and operating system and device type in order to properly format information for your device.

You may see a pop-up asking to share your location. We ask for this permission to provide you with location-based services, such as showing you content from the nearest shopping centre. Even if you do not enable location-based services, we may still receive general city or country location information based on your IP address and from other information provided from third-party telecommunications services. 

For more information and the promises we make about location information, see location-based services. 

Understanding how people use our websites, website applications and mobile apps helps us do a better job of meeting your needs and improving our business. 

For example, if a feature does not seem useful to our visitors, we learn that we need to improve it. If we detect that the search results for a particular search term are not helpful, we can try to make the results more relevant. 

Usage information also helps us understand what ads and promotional communications were effective. We also use usage information to tailor your experience and the ads that you see so that the information we provide to you is more relevant to your interests.

The usage information we collect includes how long you visited our websites, website applications and mobile apps, what pages you visited, what features you used, what search queries you entered, and your other activities using our services. 

We or our analytics providers will obtain your explicit consent for the collection of personal information that profiles you, if required by applicable laws, such as in Quebec. We or analytics providers will also provide you with the means to withdraw consent or block the collection of this information.

To understand more about how we collect some of this usage information, see cookies and  pixel technologies.

Cookies are small text files that are stored on your device. Pixels are small image files that appear on our web pages or in advertisements. Cookies and pixels help us recognize you and also help us with Online Analytics. Please see the sections below to learn more.

We use these technologies for a variety of business purposes. Some examples include:

• to remember your device the next time you visit one of our websites or web applications

• to keep you signed into a web application or mobile app

• to track how you are using our websites, website applications and mobile apps

• to deliver online advertising

• to find out if our emails have been read

• to find out if links were clicked in our promotional email content and advertisements 

• to store your location if you have given us permission to collect it

Some cookies and pixels are provided by third parties who share information with us. For example, we use Adobe Analytics to provide us with reports on where our website visitors are coming from and what web pages and mobile app features are useful. Another example is pixels provided by Facebook. If we advertise on Facebook, the advertisement and our website may contain pixels so that we understand that a visitor to our website saw the Facebook advertisement. This helps us know that the advertisement was useful and relevant.

Some cookies are necessary, and some are optional. Necessary cookies are used to ensure that our digital services are working correctly and to track certain page analytics. Optional cookies include cookies that are used for advertising and to recognize you when you are using different devices.

See Online Advertising and Cross Device Tracking for how to opt out. You can also block or restrict cookies using your browser settings.

Data analytics means studying data to look for patterns. We use data analytics to gather insights about the effectiveness of our business strategies and to make decisions. We also use data analytics to predict what visitors to our websites, website applications and mobile apps will find interesting.

Online analytics is the study of how our online services are used. 

Information collected by analytics services on our websites, website applications and mobile apps include date of session, session duration, pages and features viewed, operating system, device model, and geography. Although your IP address is collected, we anonymize your IP address when we use it for analytics purposes.

If you are using a browser to access online content, our analytics providers also collect the site you came from before landing on our website (such as the search engine you used to find us or the page you last visited when you came to our site). Third-party analytics services also collect the following information when you use our mobile apps: device model, first launch of the app, number of app opens and app updates. We use a randomly generated ID to identify your device. You can reset this ID by uninstalling and reinstalling the app. You can also adjust your browser settings to block or disable analytics cookies. Some of our websites may also provide you with a cookie consent manager that you can use to block analytics cookies. Our mobile apps do not collect and store your MAC address.

If you are using one of our mobile apps, we may offer you settings within our app to control the collection of data for analytics. Please see the privacy notice for the mobile app that you are using.

Location analytics involves collecting location data to understand where the users of our services are located. 

We can derive location information from your IP address using third party services. When we do this, we anonymize your IP address after it is used to identify a geographic location (usually city and province level). For some of our websites and web applications, you may see a pop-up asking for permission to share your location. 

If you accept, we will receive an inferred location for the device you are using. You can decline to share location. If you do, we will not be able to customize the site content to match the inferred location of your device.

For our mobile apps, we may also collect location information through location-based services. See location-based services for information on how you can control your location-based services settings in our mobile apps.

Foot traffic analytics uses de-identified information to understand when a device is in different zones in our properties. We use this information to measure traffic patterns. This helps us understand how our premises are used, what routes are common, and how many repeat visitors we get.

Our service provider, Aislelabs, automatically transforms the MAC address of mobile devices into a special code. We cannot use that code to re-identify your MAC address even if you use our wifi services. 

A media access control (MAC) address is broadcast by wifi-enabled devices when wifi is on. 

You can opt out of location-based analytics provided by Aislelabs by visiting http://optout.smart-places.org/, this will open in a new tab.

In some of our properties, we may use thermal sensing and infrared technologies. We use these technologies to understand building occupancy and use patterns. These technologies usually cannot be used to identify you because the heat signatures or images created are not detailed enough to be used for identification purposes. However, if we believe that there is a risk of identification, we will post signage to alert you to the use of this technology.

We may process personal information that we collect using machine learning techniques and algorithms. These technologies use advance techniques to recognize patterns, make predictions, and automate decision-making based on the data provided. This processing enables us to enhance efficiency, personalize services, and improve workflow or decision-making processes. In some cases, our service providers may use the information we collect to improve the machine learning techniques and algorithms that they provide to us and other customers.

This section explains some of your rights and how you can exercise them.

You can ask to see the personal information that we have collected about you. You can also ask us to correct your personal information. 

If you are using one of our mobile apps, you may be able to access your personal information by viewing your account settings. 

If you want to access or correct other information, you’ll need to contact us. You must explain the details of what you want to access or correct, so that we can help find that personal information for you. 

Sometimes we won’t grant access to or correct your personal information. If that happens, we will tell you why and what you can do about it if you are not satisfied.

You can contact us to withdraw consent to using your personal information or to ask us to delete your personal information if we no longer need it. If you are using one of our mobile apps, see the mobile app privacy notice for how to withdraw consent and to delete your account or mobile app data.

Sometimes we will still need to retain your personal information after you have asked us to stop using it and to delete it. If that is the case, we will tell you. For example, the law may require us to keep your personal information or we may need the information for our accounting records. We also may keep information if we believe there is a risk of a legal dispute or the information related to an investigation. These are just some of the reasons.

If your information is in electronic form, it may be stored in our backup data. If that’s the case, then we will retain it until we replace or purge our backups. 

If you signed up for one of our email newsletters and no longer want to receive them, you can unsubscribe at any time. For the quickest results, please use the unsubscribe link in the latest email we sent to you. Alternatively, you can contact us and we will process your request.

We want to show you ads that are relevant to you. However, we recognize that some people don’t like to see personalized ads. Below are some tips and tools to help you control advertising that uses your online activity and personal information.

You may control how your browser responds to cookies by adjusting the privacy and security settings of your web browser. Some browsers also offer privacy centres. Please review the options for your browser.

You can also opt-out of personalized advertising content, please visit Digital Advertising Alliance of Canada Opt-Out Page, this will open in a new tab, NAI Opt-Out Page, this will open in a new tab and the Ad Choices Opt-Out Page, this will open in a new tab. 

These websites provide tools that identify member companies that have placed cookies on your browser and provide mechanisms to opt-out. 

Please keep in mind that you will still receive other types of advertising.

Deleting browser cookies can remove your opt-out preferences, so you should use these tools periodically to ensure that your preferences are up-to-date. 

You can reset or opt-out of the use of your mobile device’s advertising ID by adjusting your mobile device advertising preferences. Please consult the settings for your mobile device and operating system,

Social media platforms (such as Facebook and Instagram) allow us to show you advertisements based on the fact that you match characteristics of our target audience or to exclude you from advertisements because we don’t think they are relevant to you. This is called custom audiences. 

These custom audience tools also include the ability to include or exclude you from the custom audience based on whether your profile information for those platforms matches information that we have collected. This happens by converting information (such as your email address or phone number) into a unique code. We do not share your actual email address or phone number with these social media companies. 

You can use the ad settings in your social media account settings to control the ads you see and the use of your personal information for advertising, including custom audiences. You can also contact us to opt out of the use of your personal information for custom audiences. 

Location-based services are features and functions of our websites, web applications and mobile apps that use your location in order to deliver relevant content. We also use location information for Data Analytics. Expand the headings to learn more about our promises to you, why we use location information, and how you can control location sharing. And we may also receive location information from ad tech companies. See Digital advertising under What types of personal information do we collect and use.

• We will only collect foot traffic information in our shopping centres in a way that does not identify you

• We do not track your movements outside of our shopping centres through our mobile apps and mobile services.

• If we receive location information about viewers of our ads from third parties, we will not try to determine your identity.

Sometimes we collect your location to provide you with services, to learn about how our shopping centres and other properties are used, and to understand the effectiveness of our advertisements in bringing visitors to our properties. For example:

• If you enable location-based services on our websites, web applications or mobile apps, we can use that information to help you find the nearest shopping centre or show you offers, stores, products and shopping centre information that are relevant to the shopping centre you are at or that is near you.

• If you log into our wifi services, we will recognize what shopping centre or office building you are at when you are logged in.

• If you are an occupant of one of our buildings and are using a mobile digital passcard with our access control services to open a door, we will collect location information from your mobile device. We do this to ensure that the authorized mobile device is in the vicinity of the passcard reader.

We also use location information for Data Analytics. 

If you are using one of our mobile apps and have enabled location-based services, you can always opt-out using the permissions settings within the mobile app. 

You can also opt-out of location-based services by changing your device’s permissions. For Android devices, open your Settings App and choose Location > App permission or Security & location > Location. For iOS devices, choose Settings > Privacy > Location Services.  For more information or help, please refer to your device’s operating system user guide.

To learn about opting-out of using location for Data Analytics, please see Location Analytics and Foot Traffic Analytics.

Sometimes we share personal information with others. We share personal information between our related companies. We share information with our tenants about who is using passcards to enter their premises and in connection with an incident that affects them. We share information relating to personal injuries and damage to property with tenants and contractors and their insurers when we believe they are required to indemnify us or compensate us. We also share personal information about incidents in order to investigate the incident, file an insurance claim, report to or assist police in an investigation, and respond to or prevent a danger to health, life or property. 

• We do not sell your personal information to other companies

• We will only provide information that identifies you to other companies for marketing purposes with your consent

• If we provide aggregated or statistical information to other companies, such as retailers in our properties, we do so in a way that does not identify you

Some of our services, websites, web applications and mobile apps are provided by The Cadillac Fairview Corporation Limited and others are provided by Ravel by CF Inc. These are related companies. We share information between these companies to develop a single view of individuals who use our services and to streamline customer service responses. 

We use third parties to assist us with our business. These third parties may handle your personal information when performing services for us. Some types of service providers that we use include:

• technology service providers who develop, host and manage our website, mobile apps and web applications and other information technology we use in our business

• service providers who help run our CF SHOP! card® program

• third party security guards

• third parties who help us with security-related purposes, investigating potential wrong doing, fraud-detection and prevention, or protecting our rights

Usually, service providers are not permitted to use your personal information for their own purposes separate from providing and improving the services they are providing to us. There are exceptions. One exception is that we allow some service providers to create aggregated or statistical data or to use non-identifying data for their own use. Another exception are third parties who manage a service for us. For example

• if you use www.cfregister.ca, this will open in a new tab to register your CF SHOP! card, your personal information will be managed by EML Payments Canada, Ltd, this will open in a new tab.

• we collect information from Adobe , this will open in a new taband other analytics providers

If we disclose identifiable information to a service provider for the service provider’s own use, we will usually notify you so that you understand that your information will be used in accordance with the service provider’s privacy notice. There are exceptions. For example, we rely on your implied consent to pass your payment card and transaction information to a payment network in order to process a credit or debit card payment. We will also rely on implied consent to pass your name and address to a courier company or Canada Post in order to ship something to you.

Sometimes we share personal information with tenants. Examples include:

• if we have issued you a passcard that is used to access our tenant’s premises, we will share information about your use of the passcard with the tenant

• if there is an accident or other incident that involves our tenant, we may share video surveillance footage, incident reports and other information with our tenant so that our tenant can investigate the accident or incident, seek legal advice and/or file an insurance claim

• if you make a complaint about a tenant, we may share information with the tenant to investigate the complaint or to ask the tenant to address your concerns

See building security for more information about how we use personal information for building security and investigating incidents.

We may also enter into co-marketing initiatives with our tenants or provide services to our tenants to help them in their business. When we engage in these activities, we may share relevant personal information with them.

We share information with our insurers when there is an incident at one of our properties and the information is reasonably required to make an insurance claim or report. This may include video surveillance, incident reports and other relevant data that may include your personal information. 

Sometimes we need to share personal information with the police. If there has been a criminal incident at one of our properties, we may share personal information with the police that is related to that incident. We may also share relevant personal information as part of filing a police report or in response to a police request.

We may share personal information if we sell all or part of our business or if it is relevant to a business transaction.

We will also share personal information with third parties if we are required to do so by a law, a court order or a similar requirement. 

We may also share personal information in an emergency affecting or threatening to affect someone’s health or life or if there is a threat to ours or someone else’s property.

Although we take care to secure your information, no system of safeguards can provide you with a guarantee of security.

The security of your information is also a shared responsibility.

We employ administrative, technical and physical safeguards to protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification. 

The types of safeguards that we employ and that our service providers employ depend on the sensitivity of the information. Examples of how we protect your personal information include:

• employee privacy and security training

• restricting access to personal information to employees who need access to it

• technical measures such as encrypted connections, strong passwords, multifactor authentication (where feasible), firewalls and other technical security tools

• physical measures such as locked storage areas and restricted access to our offices and other areas where personal information is stored

• background checks of employees in line with the sensitivity of the information those employees will be handling and provincial laws governing when we can do background checks

• requiring service providers who will handle your personal information on our behalf to commit to safeguard your personal information when they enter into contracts with us

You have a shared responsibility to keep your personal information secure when you use our websites, mobile apps and web applications. Please take the following steps to help secure your personal information:

• install the latest security updates and anti-virus software on your device to help prevent malware and viruses

• use the latest version of browsers

• change your account password frequently

• use complex passwords to lock your device and mobile applications. Complex passwords include capital letters, numbers and special symbols

• do not use the same password for multiple sites

• do not share your password with others

We do not ask you for sensitive personal information over email. Sensitive personal information includes passwords, bank account or payment card information, your social insurance number, or similar information by email. We might ask for proof of identify if you want to make a request to access or delete your personal information, but we will give you the option of coming to one of our properties to present your ID.

Our preference is to store and use your personal information in Canada. However, this is not always feasible. Our service providers may be located outside of Canada or they may store and process data outside of Canada. If that is the case, then your personal information may be transferred to other countries. 

Although we employ contractual protections when we transfer personal information to other countries and we consider the protections offered under the laws of the other country, we cannot guarantee that your personal information will receive equivalent protection when transferred. In certain circumstances, your personal information may be accessible under the laws of those other countries by foreign law enforcement, regulatory bodies or other authorities.

We do not use facial recognition technologies in our shopping centres. Facial recognition technologies match an image to a database in order to identify an individual. We do not use these technologies.

If we use biometric technologies, including facial recognition, as part of our access control systems for our buildings in the future, these technologies will be voluntary and part of separate privacy notice.

We may offer mobile apps and special web applications to provide you with special services. Examples include:

• CF Concierge - a mobile app that helps you obtain building news and events, create service requests, access workplace amenities, obtain special offers, and use mobile key access passcards.

• Event registration sites, such as to reserve a visit with Santa or another special event.

These mobile apps and web applications may have their own privacy notices or additional disclosures that supplement this Privacy Policy and explain how personal information is collected, used and disclosed through those mobile apps and web applications. You will be able to find the relevant privacy notice on the web application or inside the mobile app or in our Google Play or Apple App Store listing. 

We are innovating with new apps and special web applications all the time. Not all of these apps and web applications will be listed in this Privacy Policy.

We have appointed a Chief Privacy Officer to oversee compliance with this Privacy Policy. 

You can contact our privacy office in writing to ask a question or make a complaint. You may also contact our privacy office to request access or correction to your personal information or to request deletion of data that you believe we no longer need to retain. We may need to see identification to check that you are who you say you are.

Privacy Office The Cadillac Fairview Corporation Limited & Affiliates 20 Queen Street West Suite 500 Toronto, ON M5H 3R4 cfprivacy@cadillacfairview.com