Privacy Notice for California Residents

Privacy Rights Notice

This Privacy Notice for California Residents supplements the information contained in our General Privacy Notice which can be accessed at Privacy Policy and applies solely to all visitors, users, and others who reside in the State of California (“consumers” or “you”). The purpose of this notice is to provide you with a comprehensive description of Prometheus's (“we”, “us” or “our”) online and offline practices regarding the collection, use, disclosure, and sale of personal information and of your rights regarding your personal information. We adopt this notice to comply with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CPRA”) and any terms defined in the CPRA have the same meaning when used in this notice.

I. Data Collection Notice

Prometheus Real Estate Group, Inc. (“Prometheus”) collects information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household (“personal information”). In particular, in the past 12 months, we have collected the categories of personal information specified below. Prometheus has used, shared, sold, or disclosed these categories of personal information as indicated below.

Categories	Description	Disclosed for a Business Purpose?	Categories of Third Parties to Whom the Information was Disclosed	Sold or Shared?	Categories of Third Parties to Whom the Information was Sold or Shared	Purpose(s) for Selling or Sharing
Identifiers	A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver's license number, license plate number or other similar identifiers.	Yes	Service providers, including but not limited to those who host our website or assist in providing functionality on our website, resident rewards program provider, package, mail and delivery service providers, debt-collectors and payment processors, rental screening data providers and management software service providers Consumer reporting agencies “Smart” property product retailers As directed by you Governmental / regulatory agencies, courts or law enforcement Third parties as part of an acquisition or liquidation, namely if we are involved in a merger, asset sale, financing, corporate divestiture, reorganization, or acquisition of all or some portion of our business to another company, or if we undergo liquidation or bankruptcy proceedings	No, except for IP addresses and online identifier as described in the “Internet or other electronic network activity information” category, below.	Third-party website analytics or digital advertising service providers	To help us understand how visitors interact with our website and analyze technical and navigational information about our website; To help deliver advertisements that are relevant to you and your interests and measure the effectiveness of our advertising campaigns; For security and to detect fraud or illegal activities and for archival and backup purposes in connection with the provision our website; To operate, improve, and personalize our website and the services we offer, and to give each user a more consistent and personalized experience when interacting with us when interacting with us.
Categories listed in the California Customer Records statute	A name, signature, Social Security number, physical characteristics or description, address, telephone number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information.	Yes	Service providers, including but not limited to those who host our website or assist in providing functionality on our website, resident rewards program provider, package, mail and delivery service providers, debt-collectors and payment processors, rental screening data providers and management software service providers Consumer reporting agencies “Smart” property product retailers As directed by you Governmental / regulatory agencies, courts or law enforcement Third parties as part of an acquisition or liquidation, namely if we are involved in a merger, asset sale, financing, corporate divestiture, reorganization, or acquisition of all or some portion of our business to another company, or if we undergo liquidation or bankruptcy proceedings	No	N/A	N/A
Protected classification characteristics under California or federal law.	Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, and veteran or military status.	Yes	Service providers, including but not limited to rental screening data providers and management software service providers Consumer reporting agencies As directed as you Governmental / regulatory agencies, courts or law enforcement Third parties as part of an acquisition or liquidation, namely if we are involved in a merger, asset sale, financing, corporate divestiture, reorganization, or acquisition of all or some portion of our business to another company, or if we undergo liquidation or bankruptcy proceedings	No	N/A	N/A
Commercial information	Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	Yes	Service providers, including but not limited to debt-collectors and payment processors Consumer reporting agencies Governmental/regulatory agencies, courts of law enforcement Third parties as part of an acquisition or liquidation, namely if we are involved in a merger, asset sale, financing, corporate divestiture, reorganization, or acquisition of all or some portion of our business to another company, or if we undergo liquidation or bankruptcy proceedings	No	N/A	N/A
Biometric information	Biometric information	No	N/A	No	N/A	N/A
Internet or similar network activity	IP addresses, online identifiers, computer type and operating system type and version, Internet browser type and version, browsing history, search history, Internet browsing activity on our sites (such as a consumer's interactions with our website, applications or advertisements), device type and network service provider, unique device identifiers associated with the device you use to access our website and cookies stored on your computer or device.	Yes	Service providers, including but not limited to those who host our website or assist in providing functionality on our website Consumer reporting agencies “Smart” property product retailers As directed by you Governmental/regulatory agencies, courts or law enforcement Third parties as part of an acquisition or liquidation, namely if we are involved in a merger, asset sale, financing, corporate divestiture, reorganization, or acquisition of all or some portion of our business to another company, or if we undergo liquidation or bankruptcy proceedings	Yes	Third-party website analytics and digital advertising service providers	To help us understand how visitors interact with our website and analyze technical and navigational information about our website; To help deliver advertisements that are relevant to you and your interests and measure the effectiveness of our advertising campaigns; For security and to detect fraud or illegal activities and for archival and backup purposes in connection with the provision our website; To operate, improve, and personalize our website and the services we offer, and to give each user a more consistent and personalized experience when interacting with us.
Professional or employment-related information	Current or past job history or performance valuations.	Yes	Service providers, including but not limited to those who host our website or assist in providing functionality on our website Consumer reporting agencies “Smart” property product retailers As directed by you Governmental/regulatory agencies, courts or law enforcement Third parties as part of an acquisition or liquidation, namely if we are involved in a merger, asset sale, financing, corporate divestiture, reorganization, or acquisition of all or some portion of our business to another company, or if we undergo liquidation or bankruptcy proceedings
Geolocation Data	Geolocation Data	Yes	Service providers, including but not limited to those who host our website or assist in providing functionality on our website “Smart” property product retailers As directed by you Governmental/regulatory agencies, courts or law enforcement Third parties as part of an acquisition or liquidation, namely if we are involved in a merger, asset sale, financing, corporate divestiture, reorganization, or acquisition of all or some portion of our business to another company, or if we undergo liquidation or bankruptcy proceedings	Yes	Third-party website analytics and digital advertising service providers	To help us understand how visitors interact with our website and analyze technical and navigational information about our website; To help deliver advertisements that are relevant to you and your interests and measure the effectiveness of our advertising campaigns; For security and to detect fraud or illegal activities and for archival and backup purposes in connection with the provision our website; To operate, improve, and personalize our website and the services we offer, and to give each user a more consistent and personalized experience when interacting with us.

We have collected, used, disclosed, sold and shared the following categories of sensitive personal information in the last twelve (12) months:

Categories	Description	Disclosed for a Business Purpose?	Categories of Third Parties to Whom the Information was Disclosed
Personal information that reveals a consumer's Social Security, driver's license, state identification card, or passport number	Social Security number, driver's license number, license plate numbe	Yes	Service providers, including but not limited to those who host our website or assist in providing functionality on our website, resident rewards program provider, package, mail and delivery service providers, debt-collectors and payment processors, rental screening data providers and management software service providers Consumer reporting agencies “Smart” property leasing product retailers As directed by you Governmental / regulatory agencies, courts or law enforcement Third parties as part of an acquisition or liquidation, namely if we are involved in a merger, asset sale, financing, corporate divestiture, reorganization, or acquisition of all or some portion of our business to another company, or if we undergo liquidation or bankruptcy proceedings
Personal information that reveals a consumer's account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.	Personal information that reveals a consumer's account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.	Yes	Service providers, including but not limited to those who host our website or assist in providing functionality on our website, resident rewards program provider, package, mail and delivery service providers, debt-collectors and payment processors, rental screening data providers and management software service providers As directed by you Governmental / regulatory agencies, courts or law enforcement Third parties as part of an acquisition or liquidation, namely if we are involved in a merger, asset sale, financing, corporate divestiture, reorganization, or acquisition of all or some portion of our business to another company, or if we undergo liquidation or bankruptcy proceedings
Personal information that reveals a consumer's racial or ethnic origin, religious or philosophical beliefs, or union membership	Race, national origin, citizenship, religion or creed,	Yes	Service providers, including but not limited to those who host our website or assist in providing functionality on our website, resident rewards program provider, package, mail and delivery service providers, debt-collectors and payment processors, rental screening data providers and management software service providers Consumer reporting agencies As directed by you Governmental / regulatory agencies, courts or law enforcement Third parties as part of an acquisition or liquidation, namely if we are involved in a merger, asset sale, financing, corporate divestiture, reorganization, or acquisition of all or some portion of our business to another company, or if we undergo liquidation or bankruptcy proceedings
The processing of biometric information for the purpose of uniquely identifying a consumer	The processing of biometric information for the purpose of uniquely identifying a consumer.	No	N/A
Personal information collected and analyzed concerning a consumer's health	Medical condition, physical or mental disability	Yes	Service providers, including but not limited to those who host our website or assist in providing functionality on our website, resident rewards program provider, package, mail and delivery service providers, debt-collectors and payment processors, rental screening data providers and management software service providers Consumer reporting agencies As directed by you Governmental / regulatory agencies, courts or law enforcement Third parties as part of an acquisition or liquidation, namely if we are involved in a merger, asset sale, financing, corporate divestiture, reorganization, or acquisition of all or some portion of our business to another company, or if we undergo liquidation or bankruptcy proceedings
Personal information that reveals precise geolocation	This includes precise location data derived from use of keycards for access, GAPS coordinates or telemetry data.	Yes	Service providers As directed by you Governmental / regulatory agencies, courts or law enforcement Third parties as part of an acquisition or liquidation, namely if we are involved in a merger, asset sale, financing, corporate divestiture, reorganization, or acquisition of all or some portion of our business to another company, or if we undergo liquidation or bankruptcy proceedings

Prometheus collects and discloses the personal information, including the sensitive personal information, described above for a variety of business purposes, such as:

You (directly or indirectly, including but not limited to when you complete an application to become a tenant, schedule a tour, use our website, park at a Prometheus property, etc.)
Service providers
Third parties
Consumer reporting agencies
Public records
Referral sources

Prometheus collects and discloses the personal information, including the sensitive personal information, described above for a variety of business purposes, such as:

To fulfill or meet the reason you provided the information, such as responding to your inquiry, processing your lease application, investigating your qualifications and verifying your information.
Your lease application, investigating your qualifications and verifying your information. · To maintain, customize, and secure your residential leasing and living experience, process your requests, purchases, transactions, and payments and prevent crime
To follow up with you on inquiries and tours of properties leases and stays.
To process your rent payments.
To allow you to enroll in our rewards program for residents.
To provide you with support, respond to your inquiries, investigate and address your concerns and monitoring and improve our responses.
To personalize your tenancy experience and to deliver content and product and service offerings relevant to your interests (including targeted offers and ads through our website, third-party sites, and via email or text message).
To help maintain the safety, security, and integrity of our website, products and services, and properties.
To manage and operate our properties, fulfill our legal obligations, and develop our website, products, and services.
To evaluate or conduct any sale or transfer of some or all of Prometheus's assets, in which personal information held by Prometheus about our tenants is among the assets transferred.
To comply with any valid legal process, governmental request, or applicable law, rule, or regulation.
To investigate, remedy, or enforce potential violations of our Terms & Conditions, General Privacy Notice or this Privacy Notice for California Residents
To protect the rights, property, and safety of us, our users, or others and/or to pursue available remedies or limit damages we may sustain
To detect and resolve any fraud or security concerns
To support external auditing, compliance and corporate governance functions.
To provide smart and convenient living experiences such as easy access to delivery services, utility services, and technology
As described to you when collecting your personal information.

Prometheus will retain the personal information, including the sensitive personal information, described above for as long as necessary to fulfill the purpose for which it was collected, or as required by applicable laws or regulation.

II. Right to Know About Personal Information Collected, Disclosed,or Sold

You have the right to request that Prometheus disclose to you: (1) the categories of your personal information collected; (2) the categories of sources from which your personal information was collected; (3) the business or commercial purpose for collecting selling or sharing your personal information; (4) the categories of third parties with whom we disclose your personal information; and (5) the specific pieces of your personal information collected. You may also request that we disclose to you: (1) the categories of personal information that we have sold or shared about you and the categories of third parties to whom the personal information was sold or shared, by category or categories of personal information for each third party to whom the personal information was sold or shared; and (2) the categories of personal information that we disclosed about you for a business purpose and the categories of persons to whom it was disclosed for a business purpose.

To submit a request, please visit our online request portal:
https://prometheusapartments.com/privacy/online-privacy-policy-portal or call our toll-free number, 1-888-977-1383. In order to verify you are the person about whom we collected personal information, we will need to verify your identity by matching at least two pieces of Personal Information provided by you with Personal Information maintained by Prometheus that we have determined to be reliable.

However, if your request involves receiving specific pieces of Personal Information (rather than categories of Personal Information), we must first verify your identity by matching at least three pieces of Personal Information provided by you with Personal Information maintained by Prometheus that we have determined to be reliable. Then, you must provide a signed declaration under penalty of perjury that you are the consumer whose Personal Information is the subject of the request.

We cannot respond to your request to provide any personal information if we cannot verify your identity using the information provided.

III. Right to Request Deletion of Personal Information

You have the right to request that Prometheus delete personal information that we collected from you and retained, subject to certain exceptions. To submit a request, please log in to your online account and visit our online request portal: https://prometheusapartments.com/privacy/online-privacy-policy-portal or call our toll-free number, 1-888-977-1383. In order to process your request, you must first verify you are the person about whom we collected personal information. If your request relates to non-sensitive information, we can verify your identity by our online account login information, or if you do not have an account, by matching at least two data points provided by you with two data points already maintained by Prometheus.

However, if your request involves sensitive personal information, we must first verify your identity by matching at least three pieces of Personal Information provided by you with Personal Information maintained by Prometheus that we have determined to be reliable. Then, you must provide a signed declaration under penalty of perjury that you are the consumer whose Personal Information is the subject of the request.

IV. Right to Opt-Out of the Sale or Sharing of Personal Information

You have the right to request a business that sells or shares personal information to third parties not to sell or share your personal information. Prometheus does not sell personal information to third parties for monetary consideration. However, the collection of data on our behalf by certain of our third-party website analytics or digital advertising service providers may be considered a “sale” and is considered “sharing” under the CPRA. For example, we use Google Analytics to help us understand how our website is used. To not have your information shared with such parties, please visit Do Not Sell or Share My Personal Information. If you would like to opt-out from the use of your information by Google Analytics, you may use Google Analytics' opt-out browser add-on designed for this purpose.

Please note that you may need to manage your cookie preferences as discussed above for each device you use to access our website. If you block certain cookies, some of our website functionality may not work properly

Prometheus does not have actual knowledge that it sells or shares personal information about minors under the age of 16.

V. Right to Correct Inaccurate Personal Information

You have the right to request that we correct inaccurate personal information about you, taking into account the nature of the personal information and the purposes of the processing of the personal information. To submit a request, please log in to your online account and visit our online request portal: https://prometheusapartments.com/privacy/online-privacy-policy-portal However, if your request involves sensitive personal information, we must first verify your identity by matching at least three pieces of personal information provided by you with personal information maintained by Prometheus that we have determined to be reliable. Then, you must provide a signed declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request.

VI. Limiting the Use and Disclosure of Sensitive Personal Information Request Rights

You have the right to direct us to limit our use of your sensitive personal information (1) to that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services; (2) for certain business purposes; and (3) as authorized by the implementing regulations of the CPRA. We do not use or disclose your sensitive personal information for purposes other than the aforementioned purposes

VII. Request Processing and Timing

We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

For any disclosures we provide in response to a request to know, we will select a format to provide your personal information that is readily usable and should allow you to transmit the information from one entity to another entity without hindrance, which in most cases will involve Adobe PDF and comma delineated data files. We do not charge a fee to process or respond to your request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request

VIII. Right to Non-Discrimination for the Exercise of Privacy Rights

We will not discriminate against you for exercising any of your CPRA rights. This means that, unless permitted by the CPRA, your exercise of these rights will not result in Prometheus: (1) denying you goods or services; (2) charging you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties; (3) providing you a different level or quality of goods or services; or (4) suggesting that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

IX. Designating an Authorized Agent

If you use an authorized agent to submit a request for additional disclosures described in Section II, a request for deletion described in Section III, or a request for correction described in Section V, he or she must provide their name, email address, phone number, and written permission from you that includes your contact information. We will contact you using the information provided and verify your identity directly with us. We cannot respond to your request to provide additional disclosures or delete any personal information if we cannot verify your identity and the authorized agent's authority to make the request on your behalf. Written permission is not required if the agent provides proof of power of attorney pursuant to Probate Code sections 4000 to 4465, or you are submitting the request on behalf of your minor child.

X. Notice of Financial Incentives

We offer financial incentives in exchange for your personal information through our resident rewards program which is provided by Bilt Rewards Alliance (“Bilt”). When you make rent payments through Bilt or use the Bilt Mastercard, you earn points that you can use towards travel, fitness, rent credit, etc. The terms and conditions of the rewards program will be presented to you when you enroll with Bilt. When you participate in the rewards program, we collect personal information from you, such as identifiers (like your name and email address). You can enroll in the rewards program by following the sign-up or participation instructions provided, and you have the ability to opt-out of the rewards program at any time by contacting us via our online request portal: Privacy Portal | Prometheus or call our toll-free number, 1-888-977-1383. The value of your personal information is reasonably related to the value of the offer or discount presented to you. We reasonably estimate the value of the data of residents participating in the rewards program by estimating the expenses related to the provision of the rewards program per resident. We incur a variety of expenses for providing financial incentives, such as administrative and technical expenses associated with providing the rewards program through Bilt.

XI. Changes to Our Privacy Notice

This privacy notice was last updated on November [date], 2023. Prometheus reserves the right to amend this privacy notice at its discretion and at any time. When we make changes to this privacy notice, we will post the updated notice on our website and update the notice's effective date.