Privacy Notice for California Residents

This Privacy Notice for California Residents supplements the information contained in our General Privacy Notice which can be accessed at https://prometheusapartments.com/privacy and applies solely to all visitors, users, and others who reside in the State of California (“consumers” or “you”). The purpose of this notice is to provide you with a comprehensive description of our online and offline practices regarding the collection, use, disclosure, and sale of personal information and of your rights regarding your personal information. We adopt this notice to comply with the California Consumer Privacy Act of 2018 (“CCPA”) and any terms defined in the CCPA have the same meaning when used in this notice. I. Data Collection Notice Prometheus Real Estate Group, Inc. (“Prometheus”) collects information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household (“Personal Information”). In particular, we collect the categories of personal information specified below. Prometheus may use, share, or disclose these categories of personal information for one or more of the indicated business or commercial purposes.

	Categories	Description	Purpose(s)
A	Identifiers	A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, or other similar identifiers.	To fulfill or meet the reason you provided the information, such as responding to your inquiry, processing your lease application, investigating your qualifications and verifying your information. To maintain, customize, and secure your residential leasing and living experience, process your requests, purchases, transactions, and payments and prevent crime To provide you with support, respond to your inquiries, investigate and address your concerns and monitoring and improve our responses. To personalize your tenancy experience and to deliver content and product and service offerings relevant to your interests (including targeted offers and ads through our Website, third-party sites, and via email or text message) To help maintain the safety, security, and integrity of our Website, products and services, and properties. To manage and operate our properties, fulfill our legal obligations, and develop our Website, products, and services. To evaluate or conduct any sale or transfer of some or all of Prometheus’s assets, in which personal information held by Prometheus about our tenants is among the assets transferred. To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations. To provide smart and convenient living experiences such as easy access to delivery services, utility services, and technology. As described to you when collecting your personal information.
B	Categories listed in the California Customer Records statute	A name, signature, Social Security number, physical characteristics or description, address, telephone number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information.
C	Protected classification characteristics under California or federal law.	Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, and veteran or military status.
D	Commercial information	Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
E	Internet or similar network activity	“Internet browsing activity on our sites” (such as a consumer’s interactions with our website, applications or advertisements).
F	Professional or employment-related information	Current or past job history or performance valuations.

II. Right to Know About Personal Information Collected, Disclosed, or Sold You have the right to request that Prometheus disclose to you: (1) the categories of your personal information collected; (2) the categories of sources from which your personal information was collected; (3) the categories of your personal information that were sold or disclosed for a business purpose, if any; (4) the categories of third parties to whom your personal information was sold, if any; (5) the business or commercial purpose for collecting and/or selling your personal information; and (6) the categories of third parties with whom we share your personal information. You also have the right to request to receive the specific pieces of your personal information collected by Prometheus to the extent such information is maintained by, and available to, Prometheus. To submit a request, please visit our online request portal: https://prometheusapartments.com/privacy/online-privacy-policy-portal or call our toll-free number, 1-888-977-1383. In order to verify you are the person about whom we collected personal information, we will need to verify your identity by matching at least two pieces of Personal Information provided by you with Personal Information maintained by Prometheus that we have determined to be reliable. However, if your request involves receiving specific pieces of Personal Information (rather than categories of Personal Information), we must first verify your identity by matching at least three pieces of Personal Information provided by you with Personal Information maintained by Prometheus that we have determined to be reliable. Then, you must provide a signed declaration under penalty of perjury that you are the consumer whose Personal Information is the subject of the request. We cannot respond to your request to provide any personal information if we cannot verify your identity using the information provided. In the preceding 12 months, Prometheus has not sold consumer personal information to third parties, and will not sell such information. Prometheus has disclosed consumer personal information to service providers for a business purpose. However, we do not disclose the personal information of consumers we actually know are less than 16 years of age without affirmative authorization. The chart below provides information regarding the categories of personal information Prometheus collected, used, and disclosed in the past 12 months.

	Categories Collected	Source of Collection	Third Parties with Whom Shared For A Business Purpose	Purpose(s)
A	Identifiers (including, without limitation, a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number)	You (directly) Service providers Third parties Consumer reporting agencies Public records Referral sources	Service Providers Package, mail and delivery service providers Debt-collectors and payment processors Consumer reporting agencies “Smart” property leasing product retailers Rental Screening data providers Management Software Service Providers As directed by you	To fulfill or meet the reason you provided the information, such as responding to your inquiry, processing your lease application, investigating your qualifications and verifying your information. To maintain, customize, and secure your residential leasing and living experience, process your requests, purchases, transactions, and payments and prevent crime To provide you with support, respond to your inquiries, investigate and address your concerns and monitoring and improve our responses. To personalize your tenancy experience and to deliver content and product and service offerings relevant to your interests (including targeted offers and ads through our Website, third-party sites, and via email or text message) To help maintain the safety, security, and integrity of our Website, products and services, and properties. To manage and operate our properties, fulfill our legal obligations, and develop our Website, products, and services. To evaluate or conduct any sale or transfer of some or all of Prometheus’s assets, in which personal information held by Prometheus about our tenants is among the assets transferred. To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations. As described to you when collecting your personal information.
B	Categories listed in Cal. Civ. Code § 1798.80(e) (including, without limitation, a name, signature, Social Security number, physical characteristics or description, address, telephone number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number)	You (directly) Service providers Third parties Consumer reporting agencies Public records Referral sources	Service Providers such as payment processors Package, mail and delivery service providers Debt-collectors and payment processors Consumer reporting agencies “Smart” property leasing product retailers Rental Screening data providers Management Software Service Providers As directed by you
C	Protected classification characteristics under California or federal law (including, without limitation, age,race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex [including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions], sexual orientation, veteran or military status, genetic information)	You (directly) Service providers Third parties Consumer reporting agencies Public records	Service providers Consumer reporting agencies Rental Screening data providers Management Software Service Providers As directed by you
D	Commercial information (including, without limitation, Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies)	You (directly) Service providers Third parties Consumer reporting agencies Public records	Service providers Debt-collectors and payment processors Consumer reporting agencies As directed by you
E	Internet or similar network activity (such as browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement)	You (indirectly) Service providers Third parties	Service providers As directed by you
F	Professional or employment-related information (such as current or past job history or performance evaluations)	You (directly) Service providers Third parties Consumer reporting agencies Public records	Service providers Debt-collectors and payment processors Consumer reporting agencies Rental Screening data providers As directed by you

III. Right to Request Deletion of Personal Information You have the right to request that Prometheus delete personal information that we collected from you and retained, subject to certain exceptions. To submit a request, please log in to your online account and visit our online request portal: https://prometheusapartments.com/privacy/online-privacy-policy-portal or call our toll-free number, 1-888-977-1383.In order to process your request, you must first verify you are the person about whom we collected personal information. If your request relates to non-sensitive information, we can verify your identity by our online account login information, or if you do not have an account, by matching at least two data points provided by you with two data points already maintained by Prometheus. However, if your request involves sensitive personal information, we must first verify your identity by matching at least three pieces of Personal Information provided by you with Personal Information maintained by Prometheus that we have determined to be reliable. Then, you must provide a signed declaration under penalty of perjury that you are the consumer whose Personal Information is the subject of the request. IV. Request Processing and Timing We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. The response we provide will also explain the reasons we cannot comply with a request, if applicable. Any disclosures we provide in response to data access and/or data portability requests will only cover the 12-month period preceding the receipt of your request. We will select a format to provide your personal information that is readily usable and should allow you to transmit the information from one entity to another entity without hindrance, which in most cases will involve Adobe PDF and comma delineated data files. We do not charge a fee to process or respond to your request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request. V. Right to Non-Discrimination for the Exercise of Privacy Rights We will not discriminate against you for exercising any of your CCPA rights. This means that, unless permitted by the CCPA, your exercise of these rights will not result in Prometheus: (1) denying you goods or services; (2) charging you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties; (3) providing you a different level or quality of goods or services; or (4) suggesting that you may receive a different price or rate for goods or services or a different level or quality of goods or services. VI. Designating an Authorized Agent If you use an authorized agent to submit a request for additional disclosures described in Section II or a request for deletion described in Section III, he or she must provide their name, email address, phone number, and written permission from you that includes your contact information. We will contact you using the information provided and verify your identity directly with us. We cannot respond to your request to provide additional disclosures or delete any personal information if we cannot verify your identity and the authorized agent’s authority to make the request on your behalf. Written permission is not required if the agent provides proof of power of attorney pursuant to Probate Code sections 4000 to 4465, or you are submitting the request on behalf of your minor child. VII. Other California Privacy Rights California’s “Shine the Light” law (Civil Code Section § 1798.83) permits users of our Website that are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please send an email to [email protected] or call 1-888-977-1383. VIII. Changes to Our Privacy Notice This privacy notice was last updated on December 20^th, 2019. Prometheus reserves the right to amend this privacy notice at its discretion and at any time. When we make changes to this privacy notice, we will post the updated notice on our website and update the notice’s effective date.