Canvas Pamplona Plazaola:

Controller identity: Oion Construmat, S.L.U. (hereinafter, “Canvas”) with Tax ID (CIF) B65311821

Address: Calle del Sadar, 31006 Pamplona, Navarra

Canvas Sevilla Lago:

Controller identity: MK Esudiantes Cartuja, S.L.U. (hereinafter, “Canvas”) with Tax ID (CIF) B72727126

Address: Calle Juan Bautista Muñoz 3, 41092 Sevilla, Spain

To provide you with services, we process (or you may provide us with) personal information that can identify you or relate to you as an individual.

Depending on the type of relationship you have with Greystar, and subject to applicable laws, we may generally process the categories of personal information described below:

• Contact information such as name, mailing address, email address, date of birth, photograph, and emergency contact details.
• Other personal identifiers such as username/account name, Social Security number, taxpayer identification number, driver’s license number, passport number, identity card or student card number, and resident identification number.
• Financial and insurance information such as bank account/credit card number, rent payment details, insurance policy number, credit history, sanctions screening results, politically exposed person (“PEP”) screening results, and other financial or tax documentation.
• Demographic information such as age, race, color, ancestry, national origin, citizenship, marital status, sex, veteran or military status, criminal background—each subject to applicable laws. In certain jurisdictions, you may also choose to share with us any disability or other health-related limitations so that we can provide appropriate accommodations.
• Commercial information such as records of products or services purchased, obtained, or considered; other purchasing histories or tendencies; utility invoices; name and contact information for the insurance holder; leasing information; rental history and rental amount; applicant screening information; and information related to your tenancy, such as information about your pets and vehicles (year, make, and model).
• Application, browser, and device information such as device model, software version, and other device characteristics; mobile application identifiers such as session ID and client ID; browsing history; search history; Internet Protocol address; cookie ID; consumer interaction data with a website; and online posts. For more information, see the section Cookies and Other Tracking Technologies.
• Sensory data such as images, videos, and sound recordings, including photographs submitted with maintenance requests, which—if you use the mobile application—may require allowing us access to your device’s camera.
• Employment or other professional information such as education, work history, job title, university or school attended, degree, other résumé information, employment history, and salary.
• Environmental, Social, and Governance (ESG) information such as monitoring and reporting on energy usage both at the plant level and within individual units.

When personal information is considered a sensitive or special category of personal information (“sensitive personal information”) under applicable laws, we will comply with all relevant legal requirements for processing such sensitive personal information.

We may process personal information through the following:

• Online services. We process personal information when you interact with our online services, which may include, among others, searching for an apartment, contacting us or an Artificial Intelligence (AI) chatbot, applying for an open position, posting on social media pages, or participating in a survey.
• Mobile application. We process personal information when you use the mobile application, including creating and updating your account, providing residential services such as maintenance, and ensuring that the mobile application functions as expected.
• Property owners. We process personal information of the owners of the properties we manage.
• Property visits and offline interactions. We process your personal information when you visit our properties, attend events held at our properties, inquire about accommodation directly at our properties, complete a rental application, or during our day-to-day relationship with you as a tenant.
• Other sites and third parties. We may use independent websites and third-party service providers to process rental applications and agreements and to assist our residents and service providers with other tasks that are necessary or useful for them, such as paying rent online. We also use independent sites to book corporate or flexible stays. We may also receive information about you from third parties. For example, if you are on another website and choose to receive information from us, that website will forward your email address and other information about you so we can contact you if you request it and in accordance with applicable law.
• Due diligence. When you offer services to Greystar as an external provider/contractor, we process certain information through our conversations with you, documents you may provide us, and in the ordinary course of our business relationship.
• Other sources. We process personal information from other sources, such as public databases or credit agencies.

When legally required, we will obtain your consent before collecting, processing, or transmitting your personal information and/or sensitive personal information. Otherwise, we will interpret your receipt of this policy and your provision of personal information as your consent.

Also, we may process “other data” that generally does not reveal your specific identity or is not directly related to an individual. To the extent that other data does reveal your specific identity or relates to an individual, we will treat such other data as personal information. Other data includes:

• Your browser or device. We process certain data through your browser or automatically through your device, such as the name and version of your operating system, the device manufacturer and model, language, the type and version of your Internet browser, and the name and version of the online services (such as applications) you are using. We use this data to ensure that the online services function properly.
• IP address. We process your Internet Protocol (IP) address, which is a number automatically assigned to your computer whenever you use the Internet. Web servers—the main computers that deliver web pages—automatically identify your computer by its IP address. To the extent permitted by applicable law, Greystar processes IP addresses for system administration, gathering and analyzing aggregated information, creating a better experience for users, and auditing use of our sites. We generally do not link IP addresses to anything personally identifiable, which means your session will be logged but you will remain anonymous to us. We may attempt to link your IP address to your identity when we deem it necessary to protect our sites and other users from potential harm and to prevent criminal behavior.
• Aggregated data. We may aggregate the data we process, and such aggregated data will not personally identify you or any other user.

Cookies, pixels, and similar technologies. We process certain data from cookies, pixel tags, web beacons, and other technologies (“cookies”) that are pieces of data stored directly on your device or browser and may, in certain jurisdictions, be considered personal information. Cookies may be set by us and are called first-party cookies. We also use third-party cookies in our advertising and marketing to measure the success of our campaigns and gather statistics about the use of the online services. Information about how you interact with our website—including clicks on links, videos, and other features available through our site—may be disclosed to third parties in the normal course of our business. See the section PROFILING AND AUTOMATED DECISION-MAKING below.

• Strictly necessary cookies are required for the website to function and cannot be disabled in our systems. They are usually set in response to actions you take that amount to a request for services, such as setting your privacy preferences, logging in, or filling out forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not work.
• Performance cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us know which pages are the most and least popular and see how visitors navigate the site. All information collected by these cookies is aggregated and therefore anonymous. If you do not allow these cookies, we will not know when you have visited our site and will be unable to monitor its performance.
• Functional cookies enable the website to provide enhanced functionality and personalization. They may be set by us or by third-party providers whose services we have added to our pages. If you do not allow these cookies, some or all of these services may not function properly.
• Targeting cookies may be set by our advertising partners through our site. These companies may use them to build a profile of your interests and show you relevant ads on other websites. They work by uniquely identifying your browser and Internet device. If you do not allow these cookies, you will receive fewer personalized ads.
• Social media cookies are set by a range of social media services that we have added to the site to allow you to share our content with your friends and networks. They are capable of tracking your browser across other sites and creating a profile of your interests. This may influence the content and messages you see on other websites you visit. If you do not allow these cookies, you may not be able to use or view these sharing tools.

Most browsers are set to accept cookies. If you wish to change your cookie preferences, you can do so through your browser settings or by updating your cookie preferences via our cookie banner, where applicable, when you enter any of our websites.

• We may share personal information with the following third parties to provide services to you, upon a specific request from you, or to comply with our legal obligations.
• Greystar affiliates. We disclose your personal information and other data to our affiliated companies as necessary to communicate with you, provide services to you, fulfill our contract with you, and meet our business purposes.
• Service providers. We disclose personal information and other data to third parties that provide services such as hosting our websites, providing our IT systems, supporting outsourcing arrangements, processing payments, conducting research and analytics, providing on-site services, delivering benefits, performing financial, identity, and other legal checks, and providing professional advice. Some of these service providers may use your personal information for their own purposes and legal obligations; when this is the case, these service providers are therefore considered independent data controllers.
• Property owners. We disclose personal information to the owners of the properties we manage. Owners may use your personal information for their own purposes and legal obligations, and are therefore considered independent data controllers for multiple processes during your rental experience.
• Property managers. We disclose your personal information to managers who assist us in managing your property and/or who may assume our management responsibilities.
• Partners. We disclose personal information and other data to our advertising partners or to sponsors of events and promotions in which you have expressed interest or for which you have registered.
• Government authorities. We disclose personal information and other data to government authorities in accordance with applicable laws.

We may also use and disclose your personal information as necessary to comply with applicable laws, respond to requests or requirements of government authorities, enforce our terms and conditions, or otherwise protect the rights, property, or safety of Greystar employees, residents, and others, including sharing information with third parties for fraud protection and credit risk reduction.

If Greystar undergoes a business transition, such as a merger, an acquisition by another company, or the sale of all or part of its assets, such as an individual property, personal information may be transferred as part of that transition. By using our websites and providing your personal information, you consent to this transfer, provided that the use of the personal information is in accordance with the Global Privacy Policy in effect at the time of the transfer. If required by law, we will separately notify you of such transfer.

Below we provide you with choices, information, and options as required by applicable law to express your preferences.

Consent to email and opt-out

Each of our commercial emails contains a link with instructions on how to unsubscribe from our email list. Please note that if you are a resident of a Greystar property and use this site and your property’s site, you will need to unsubscribe from your property’s site separately. You will also need to unsubscribe separately from any third-party site with which you have registered. If you choose not to receive marketing messages, we will continue to send you transactional messages. These messages include responses to your questions. If your request has not been properly addressed or you have further questions, you may contact us by email at:

privacy@greystar.com.

For information about your choices related to cookies and other data, please refer to the Cookies and Other Tracking Technologies section above.

Access, Change, Deletion, Restriction of Use, or Objection to the Processing of Your Personal Information

Under applicable privacy laws, you may have the right to request that Greystar inform you whether it is processing personal information related to you. Subject to certain exceptions under applicable privacy laws, you may also have the right to submit a request to access, withdraw your consent, change, delete, restrict the use of, or object to the processing of your personal information that you previously provided to us. If you would like to exercise your rights, please visit our portals and complete one of the following forms. For your protection, we will verify your identity before granting access to certain requests. Where permitted by law, we may charge a reasonable fee to cover the costs of responding to your request.

If you are a prospective, current, or former resident; a current or former team member; an investor; or a job applicant, please submit your request using this form or by calling 1-844-795-2806.

If you wish to exercise your right to opt out of the sale or sharing of your information, please submit your request using this form.

For any other inquiry, or if you have any questions regarding the forms or our process, please feel free to contact us at privacy@greystar.com or refer to the Contact Information section below..

Greystar takes reasonable technical and organizational measures to safeguard users’ personal information. Although Greystar strives to protect your personal information and privacy, we cannot guarantee the security of any personal information you disclose online, and therefore you should be aware of this risk.

We limit access to personal information to those individuals and organizations that we reasonably believe need to receive such information to provide our services or perform their work, and we take precautions we consider reasonable to protect the security of users’ personal information in accordance with applicable law. However, as with many computer systems and Internet software applications and programs, unauthorized use, hardware or software failures, and other issues may compromise the confidentiality of users’ personal information despite the measures we take to prevent it. Because the security of all personal information associated with our users is essential to us, we periodically review and enhance our security as new technology becomes available. This includes the use of software that encrypts (typically processed at 256 bits) or scrambles the data you send us in connection with an online rental application or a job application.

If users have any questions about security, please contact us using the information in the Contact Information section.

We will retain your personal information for the period we deem appropriate to fulfill the purposes described in this Global Privacy Policy unless a longer retention period is required or permitted by law.

The criteria used to determine our retention periods include:

•  the duration of the ongoing relationship with you and the services we provide to you;
• whether there is a legal obligation to which we are subject (for example, certain laws require us to retain records of your transactions for a specific period of time before deleting them); and
• whether retention is advisable in light of our legal position (such as for statutes of limitations, litigation, or regulatory investigations).

Our websites are not directed to children. We do not process or store information in our systems from individuals who are considered children in the jurisdiction where they reside. We do not permit children under the age of 16 (or the higher age that may be specified by applicable law) to become registered users of our sites. By using any of our sites, you represent that you are not under the age of 16 (or the higher age that may be specified by applicable law). If we discover that you do not meet these age requirements, we may block and/or delete the personal information you have provided.

If you are a parent or guardian and believe that your child does not meet these age requirements, please contact us using the information in the Contact Information section.

Greystar is an international company and may, subject to law, transfer personal information and other data processed in connection with our services to entities in countries where data protection standards may differ from those in the country where you reside. If you provide personal information to us, it may be transferred to and processed in the U.S. and other countries such as India. These transfers will comply with the data transfer requirements of applicable laws. Please review the information provided in the section titled Location-Specific Disclosures for more details about data transfers in your jurisdiction.

ChatGPT Plus

In certain circumstances and subject to applicable law, we may use automated decision-making to assess your credit according to our established criteria. Except as set forth in the Location-Specific Disclosures section, credit checking is a mandatory step in our application review process.

In certain circumstances and subject to applicable law, we or our third-party service providers will use automated means to screen for sanctions and conduct politically exposed person (PEP) checks and, in some cases, to carry out background checks. This processing is conducted in accordance with our legal obligations and our legitimate interests, and human involvement plays a significant role before any final decisions are made that could affect your application.

Sanctions screening involves comparing applicants against public lists established by the U.S. Office of Foreign Assets Control (OFAC) and other lists from other jurisdictions. We perform this through a secure online service, and the data used for these searches includes your name, date of birth, and nationality. For common names, the system may sometimes return a “false positive.” A human analyst will then use additional data you have provided, such as your address, to make a final determination about the match.

We may also use third parties to deliver personalized advertisements that may be of interest to you. To provide these ads, those third parties place a cookie or other tracking technology on your browser to manage your access to and use of our online services. For more information about Greystar’s use of cookies and how to manage your cookie preferences, please see the Cookies and Other Tracking Technologies section. If you would like more information about this practice, visit https://thenai.org/opt-out/ and https://youradchoices.com/ .

Our website and/or the websites of the properties we manage may offer certain AI tools, including any AI chatbot that uses Microsoft’s pretrained generative transformer language models known as GPT. The AI chatbot does not collect personal information unless you voluntarily enter such information. We may use prompts submitted by users to improve the quality of the AI chatbot’s responses; however, prompts used for quality improvement do not identify an individual unless the user voluntarily provides their personal information. Dynamic choices are shared with Microsoft solely for the purpose of providing the AI chatbot service. The AI chatbot is not used for automated decision-making.

En muchos casos, Greystar actúa como responsable independiente (según se define en el RGPD) con los propietarios de propiedades, que también pueden utilizar la información personal que tratamos, y esto también puede ser el caso cuando trabajamos con otro gestor de propiedades o cuando otro gestor de propiedades nos suceda. Los propietarios tienen derecho a utilizar cierta información personal para sus propios fines de acuerdo con su contrato de arrendamiento y para cumplir con sus propias obligaciones legales, incluido el mantenimiento de libros y registros. En otros casos, Greystar puede ser un encargado del tratamiento (según se define en el RGPD) para cierta información personal, actuando en nombre del propietario para gestionar la propiedad y proporcionar servicios de residencia.

NOTICE TO RESIDENTS OF CERTAIN U.S. STATES

Some state laws allow residents who provide us with personal information to request certain details regarding our disclosure of such information to third parties for their advertising purposes. We currently do not disclose such information to third parties for their advertising purposes. If we change this policy, we will update this provision and provide instructions on how you may request details.

Some state laws, such as the California Consumer Privacy Act (“CCPA”), allow residents to exercise certain rights regarding their personal information. Residents of these states may find more information about exercising their rights under these state laws by reviewing our US State Privacy Law Notice.

NOTICE TO RESIDENTS OF CANADA

Any transfer of personal information outside your province will comply with applicable privacy laws, including the requirement to use data transfer agreements to provide your information with adequate protection.

In addition to the rights of access, change, and withdrawal of consent described above in the “Your Privacy Preferences and Rights” section, Canadian residents have the right to file a complaint with the applicable data protection authority if they believe their privacy rights have been violated.

In certain circumstances, residents of Quebec may also have the right to request that: (i) we stop disclosing their personal information; (ii) we de-index or re-index a hyperlink attached to their name that provides access to personal information by technological means; or (iii) computerized personal information collected from them be communicated to them in a commonly used technological format, as well as to any person or entity legally authorized to collect such information.

If you would like additional information about Greystar’s processing of personal information, we invite you to contact:

Canada:

Entity: Greystar Canada Property Management Services Ltd.

Location: Charleston, South Carolina

Registered Office: 465 Meeting Street, Suite 500, Charleston, SC 29403, USA

Data Protection Inquiry Contact: privacy@greystar.com

NOTICE TO BRAZILIAN DATA SUBJECTS

When personal information is transferred outside of Brazil, including to other Greystar entities, we ensure that your personal information is processed only in countries that provide an adequate level of protection or when the recipient provides appropriate safeguards for such processing. In addition, we ensure that all guidelines and standard clauses issued by national authorities are applicable and properly observed when processing your personal information.

Corporate data of the data controller (including contact details):

Brazil:

Entity: Greystar Brasil Consultoria Imobiliária Ltda.

Location: São Paulo, Brazil

Registered Office: Rua São Bento, 470, 10th floor, São Paulo, Brazil

Data Protection Inquiry Contact: privacy@greystar.com

NOTICE TO EU AND UK DATA SUBJECTS

This section of the Global Privacy Policy includes additional provisions for purposes of the EU and UK General Data Protection Regulation and related national legislation (collectively, “GDPR”). For GDPR purposes, we have appointed Greystar Netherlands Cooperatief U.A. as our EU representative for services offered in the EU by non-EU Greystar entities, and Greystar Europe Holdings Limited as our UK representative for services offered in the UK by non-UK Greystar entities.

For users residing in the European Union or the United Kingdom, when we transfer your data outside the EU/UK, including to other Greystar entities, we ensure that your data is processed only in countries that provide an appropriate level of protection for your data or when the recipient provides adequate safeguards, such as standard contractual clauses or binding corporate rules.

Corporate data of the data controller (including contact details):

Austria:

Entity: Greystar Austria GmbH

Location: Vienna, Austria

Registered Office: c/o TPA Steuerberatung GmbH, Wiedner Gürtel 13, 1100 Wien (Austria)

Data Protection Inquiry Contact: privacy@greystar.com

Germany:

Entity: Greystar Germany GmbH

Location: Frankfurt, Germany

Registered Office: Grosse Gallusstrasse 16-18, Frankfurt, 60311 Germany

Data Protection Inquiry Contact: privacy@greystar.com

France:

Entity: Greystar France SAS

Location: Paris, France

Registered Office: 54 Avenue Hoche, 75008 Paris

Data Protection Inquiry Contact: privacy@greystar.com

Ireland:

Entity: Greystar Ireland Limited

Registered Office: 1st Floor, 118 Lower Baggot Street, Dublin 2, Ireland

Data Protection Inquiry Contact: privacy@greystar.com

Spain:

Entity: Greystar Spain S.L.U.

Location: Madrid, Spain

Registered Office: 3rd Floor, Paseo de la Castellana 163, 3º Izda., 28046 Madrid

Data Protection Inquiry Contact: privacy@greystar.com

Netherlands:

Entity: Greystar Netherlands Cooperatief U.A.

Registered Office: New Babylon Gardens, Anna van Buerenplan 48, 2595 DA, The Hague, Netherlands

Data Protection Inquiry Contact: privacy@greystar.com

United Kingdom:

Entity: Greystar Europe Holdings Limited

Location: London, United Kingdom

Registered Office: Finsbury Circus House, 15 Finsbury Circus, London, EC2M 7EB

Data Protection Inquiry Contact: privacy@greystar.com

EU Supervisory Authorities:

If you have any concerns regarding the processing of your personal information, you may contact the national data protection authority in the EU jurisdiction where you normally access our sites at: https://ec.europa.eu/newsroom/article29/items/612080.

The UK supervisory authority is the Information Commissioner’s Office, whose contact details are available at ico.org.uk.

NOTICE TO RESIDENTS OF INDIA

In accordance with the provisions of India’s Information Technology Act of 2000, residents of India may request the name and address of any external third party that may have access to or maintain personal information by submitting such a request to Greystar.

India:

Entity: Greystar India Services Private Limited

Location: Mohali, India

Registered Office: Unit A-711, Tower A, Bestech Business Towers, Sector 66, Mohali - 160059

Data Protection Inquiry Contact: privacy@greystar.com

NOTICE TO MAINLAND CHINA DATA SUBJECTS

Individuals in Mainland China can find more information by reading our Privacy Declaration for Continental China.

NOTICE TO INDIVIDUALS LOCATED IN AUSTRALIA

This section of the Privacy Statement includes additional provisions for the purposes of the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

“Personal information” means information or an opinion about an identified individual or an individual who is reasonably identifiable.

In addition to the purposes set out above, we may also use or disclose your personal information for any purpose permitted by applicable law.

In the course of our ordinary business operations, we typically disclose personal information to third parties located in the following countries:

• United States of America

• United Kingdom

In addition to the Securing Information section, we store your personal information electronically, and the steps we take to protect personal information include encryption measures and access controls. Hard-copy documents containing personal information are retained only when considered essential and are stored in secure environments.

Credit checking is not a mandatory step in our application review process.

If you have any questions or concerns about our collection, use, or disclosure of personal information, or if you believe we have not complied with this Privacy Policy or the Privacy Act, please contact us as set out below. Our Privacy Officer will investigate the complaint and determine whether a breach has occurred and, if so, what action should be taken.

Data Privacy Officer

privacy@greystar.com

465 Meeting St., #500

Charleston, SC 29403

If you remain dissatisfied, you may also lodge a formal complaint with the Office of the Australian Information Commissioner (OAIC), which is the regulatory authority responsible for privacy in Australia:

Office of the Australian Information Commissioner (OAIC)

Complaints must be made in writing

Director of Compliance

Office of the Australian Information Commissioner

GPO Box 5288

Sydney, NSW 2001

www.oaic.gov.au

For telephone inquiries: 1300 363 992

Any changes we make to this Global Privacy Policy will take effect when they are posted. If we change our Global Privacy Policy, we will inform users of those changes by providing an overview at the top of this Privacy Policy, and we may also post these details in other places we deem appropriate. Where permitted by law, we may also send you an email.

If you have any questions about this Global Privacy Policy or have any complaints regarding the processing of personal information, please contact us at privacy@greystar.com.

You may also contact us by mail at the following address:

Greystar

Attn: Data Protection

465 Meeting St., #500

Charleston, SC 29403