PRIVACY POLICY

1. Introduction
2. Definition of Personal Information
3. What Personal Information Do We Collect And How?
4. Why Do We Collect Your Personal Information?
5. Electronic Communications and Notifications
6. Your Consent
7. Right to Withdraw Consent
8. Disclosure of Personal Information
9. Security
10. Retention of Personal Information
11. Location, Storage and Cross-Border Transfer
12. Children
13. Updating and Accessing Your Information
14. Contacting Ivanhoe Cambridge
15. Changes to Privacy Policy
Appendix A – EU/UK Notice
Appendix B – Ivanhoé Cambridge Entities Acting as Personal Information Controller

1.  INTRODUCTION

This Privacy Policy (the “Privacy Policy”) of Ivanhoé Cambridge1 (“Ivanhoe Cambridge” or ‘’IC’’ or ‘’us’’) generally applies to any personal information (as defined below in the section entitled Definition of Personal Information) collected and processed by Ivanhoé Cambridge from or about guests (which includes guests of our websites and users of our mobile apps), tenants (which includes retailers and occupants of our properties), service providers or business partners (hereinafter collectively referred to as “users”).

The objective of the Privacy Policy is to help you understand our practices concerning the collection, use, communication and retention of personal information and of the choices you can make in this regard. Our websites and mobile apps are also governed by applicable terms of use, the Website and Mobile Apps Terms and Conditions Of Use, and the use of Wi-Fi is governed by the Wi-Fi Terms Of Use. These documents can be accessed through each property website, mobile app or Wi-Fi portal.

Generally, by interacting and/or doing business with IC and/or submitting information to IC in connection with using Ivanhoé Cambridge’s services (through our website, by email, in person, by telephone or by any other means), you are providing your consent to the collection, use and disclosure of personal information as set out in this Privacy Policy.

This Privacy Policy does not apply to third-party websites or third-party services which may be accessed by clicking on links appearing on such websites, and Ivanhoé Cambridge is not responsible for such third-party websites or services. If you follow a link to a third-party website, that third party will have its own privacy policies which you should review before submitting any personal information.

If you are located in the European Union or in the United Kingdom, you may have additional rights as described in Appendix A of the Privacy Policy entitled EU/UK Notice.

[1] Ivanhoé Cambridge means all real estate subsidiaries owned directly or indirectly by la Caisse de dépôt et placement du Québec, consolidated and operating under the Ivanhoé Cambridge banner.


2.  DEFINITION OF PERSONAL INFORMATION

When used in this Privacy Policy, personal information means “any information about an individual that directly or indirectly allows that individual to be identified”. This may include contact or demographic information, information relating to your communications with us or more technical information (such as users’ IP addresses, usernames) but only when this information can identify you as an individual. Ivanhoé Cambridge may use and disclose de-identified, anonymized and/or aggregated information in accordance with applicable laws.

Personal Information.

Personal information may include, for example, your name, contact information, home address, telephone number, email address, information relating to your inquiry with us, any complaints documented in a file or other personal or demographic information. It may also include other types of more technical information such as users’ IP addresses, usernames, browser history (pages accessed, date of access, location when accessed), but only when this information can identify you as an individual.

Anonymized Information.

Personal information that is anonymized and/or aggregated is not considered personal information when it is reasonable to expect in the circumstances that it will no longer be capable of directly or indirectly identifying an individual. Ivanhoé Cambridge reserves the right to conduct statistical analyses through the use of personal information and/or data collected, including the data collected from individuals who enter our properties, through our websites, mobile apps and/or Wi-Fi on an anonymous and/or aggregated basis in order to improve our services and measure interest in and use of our websites and/or mobile apps, in accordance with applicable laws. Ivanhoe Cambridge reserves the right to provide its analyses based on such anonymous and/or aggregated data to third parties.


3.  WHAT PERSONAL INFORMATION DO WE COLLECT AND HOW?

Information Collected from or about You.

In many cases, we collect personal information directly from you when you visit our premises, interact with us (inquiry), use our services, websites, mobile apps and/or Wi-Fi, register to receive our newsletter or enter a contest or promotion. We may also collect personal information when you rent our premises or when you submit a job application. You will therefore know when we collect this information.

We may collect personal information from you in the following situations:

  • Guests.
    We may collect your name, contact information, email address and other similar types of information when you are interacting with us, for instance when you make an inquiry or contact IC in person or through our websites, when you register to receive our newsletter, when you enter a contest or promotion, when you use our websites or Wi-Fi (if you chose to provide your information) or when you download and/or use our mobile apps or any of our applications. When you use our chat services, we will also collect your messaging content. When you use our guest services desks, for example, to rent carts or equipment, book stylist services or purchase gift cards, payment information may also be collected, although your credit card will not be stored on our systems.
  • Tenants, as Individuals.
    We may collect the name, address, telephone numbers (office, home, cell), email addresses, credit report, information from government-issued identification, banking information, insurance policy number and other information regarding insurance, photograph for access card purposes as well as details regarding the existence of a dispute between a consumer and a merchant.
  • Suppliers and Other Business Partners, as Individuals.
    We may collect the name, address, telephone numbers (office, cell), email addresses, IT systems activity logs and in certain circumstances, personal information collected in the context of a background check (such as employment records, credit records and criminal records).
  • Employment Applications.
    We may collect the information which you have included in your resume when you submit a job application or when you apply for a position with Ivanhoe Cambridge.
  • Personal Information Collected from Third Parties.
    In some other cases, we may collect personal information from third parties (for example, from credit score companies or when conducting a background check) but at all times, with your prior consent and/or as authorized by law.

    • Credit Information:
      In accordance with and where authorized by applicable law, Ivanhoé Cambridge may collect credit information from job applicants or from employees. Ivanhoé Cambridge performs these checks during the hiring process in compliance with contractual and employment-related obligations, and in some cases periodically thereafter to ensure the financial accountability of job candidates, as well as to meet certain contractual requirements and manage risks.

      This information allows us to assess the financial integrity of job candidates and employees, in addition to other hiring and human resources management criteria. By reviewing credit information, Ivanhoé Cambridge can obtain insight into financial responsibility, reliability and likelihood that a person may be exposed to material financial risks. Credit information is used only in making fair and objective decisions, taking into account the skill set, competencies and skills required for the position. The collection of credit information may be necessary to meet certain contractual requirements with our clients or business partners, as well as to manage financial risks and ensure business continuity.

Information Collected Automatically.

In some cases, we may collect information automatically which may not necessarily identify you directly. This may include information collected via our video surveillance system on our properties, technical information collected when you visit our websites or use our mobile apps, IT systems and/or Wi-Fi network, geolocation (if you use our mobile apps, Wi-Fi network and/or similar technologies and data, including aggregated data received from third parties in accordance with applicable laws), information flow, demographic information (estimated gender, age, mood) and device count information collected via Anonymous Video Analytics or other similar technologies that you may encounter when you visit our properties, metadata (mobile phone number and date/time stamp) when you use our chat services, profile information if you use a social media account when interacting with IC and your vehicle information if you park on one of our properties.

We may collect the following type of information:

  • Video Surveillance.
    As a security measure for our properties and in order to ensure the safety of our guests, tenants, retailers and occupants of our properties, we may use video surveillance at various locations on our premises. This collection is subject to applicable privacy laws and may be shared in limited circumstances, as detailed in the section of this Privacy Policy entitled Sharing of Personal Information.
  • Browser, Device and Technical Information.
    When you visit our websites, or use our mobile apps, and/or Wi-Fi, we may use electronic means such as cookies, to collect technical information about your browser or device, and about your usage of such websites, mobile apps, IT systems and/or Wi-Fi. This information may include information about your visit or usage, including the IP address of your device or computer and the browser you used to access our websites, mobile apps or Wi-Fi network. This information may also include your operating system, the MAC address of your mobile device, screen resolution, browser language settings, the last website you have visited, keywords searched (if arriving from a search engine), the number of pages viewed, as well as the information you entered and the advertisements you saw. For information on how you can limit the type of information that we collect, use or share about you when you visit and/or use our websites, mobile apps or Wi-Fi network, please refer to our Cookies Usage Notice and the Right to Withdraw Consent section of this Privacy Policy. We may also collect and use the following types of information:

    • Google Analytics: We use Google Analytics which allows IC to see information on users’ online activities including, but not limited to, visited pages, source and time spent on our websites and/or mobile apps. This information is de-identified and is displayed as figures, meaning that it cannot be used to directly identify a particular individual. You may opt out of the use of Google Analytics by visiting the Google Analytics opt-out page.
    • Google AdWords: We use Google AdWords remarketing to advertise Ivanhoé Cambridge across the Internet and to place on third-party websites (including Google) advertisements aimed at previous visitors to our websites. AdWords remarketing will display ads to you based on what parts of the Ivanhoe Cambridge websites you have viewed by placing a cookie on your web browser. It could mean that we advertise to previous visitors who haven’t completed a task on our site or that we advertise on the Google search results page, or a site in the Google Display Network. This cookie does not in any way identify you or give access to your computer or mobile device. The cookie is only used to indicate to other websites that you have visited a particular page on our websites, so that they may show you ads relating to that page. If you do not wish to participate in our Google AdWords remarketing, you can opt out by visiting Google’s Ads Preferences Manager.
  • Geolocation Information. 
    If you chose to use our mobile apps, some functionality or services may depend on the use of your geolocation information. We will only collect such information if you chose to use such functionality or services. We may send you notifications that you chose to receive, such as reminder alerts, deals, recommendations, weekly digests and parking prompt notifications. You may manage your notification preferences directly in the mobile apps. When you use our Wi-Fi or similar technologies, we may gather information about your device, such as an anonymized version of your device’s MAC address and the Relative Signal Strength Indicator (RSSI), to determine your device’s approximate location within our properties. This information is used to improve your ability to use our Wi-Fi service and connect to our network, to manage our Wi-Fi services, including troubleshooting, and to generate location analytics in an aggregated format, as further detailed in the Why Do We Collect Personal Information? section of this Privacy Policy. You should note that your use of our Wi-Fi network is also subject to our Wi-Fi Network Terms of Use. Please note that recent devices may automatically generate randomized MAC addresses.
  • Traffic, Demographic and Peripheral Count Information.
    In some cases, we may use and/or allow third parties to use cameras and other technologies in our malls to conduct anonymous video analytics (“AVA”) and anonymous traffic analysis. This allows IC to estimate the number of individuals in our properties but does not allow IC to identify them. We do not take or retain any photos or video records of our guests.
  • SMS and Webchat.
    When you use our chat services, we may collect metadata, such as your mobile phone number and date/time stamps, linked to your interactions. We may also gather certain information automatically from electronic communications with you and retain it in log files. This information may include IP addresses as well as browser, internet service providers, ref erring/exit pages, operating system, date/time stamp and click stream data.
  • Social Media.
    If you sign into one of our websites, mobile apps or Wi-Fi using a social media account such as Facebook or Twitter, we will collect information that you have added in your registration profile from those accounts, and which is made available to IC by default by Facebook or Twitter. For instance, when you log in to our Wi-Fi using your social media account, you authorize us to collect (or to receive) information about your profile, such as your name, age, gender and email address. We may also collect personal information about you from your use of social media networks you participate in (“Social Media Channels”), although at all times, in compliance with applicable privacy laws. You may also choose to participate in a third-party app or feature (such as one of our Facebook or Twitter apps or a similar app or feature on a third-party website) through which you allow IC to collect (or the third party to share) information about you (including personal information) such as details of your friends/connections, “likes”, comments you have shared, groups and location. In addition, we may receive information about you (including your personal information) if other users of a third-party website give IC access to their profiles and you are one of their friends/connections or information about you is otherwise accessible through your friends’/connections’ web page, profile page, or similar page on a Social Media Channel or other third-party website or interactive service. We may supplement the information we collect about you directly with the information we receive from third parties in order to enhance our ability to serve you, to tailor our content to you and send you details of promotions and/or offers which we believe may be of interest to you, although at all times, in compliance with applicable privacy laws.
  • Information on Your Vehicle.
    If you park on one of our properties, we may collect information about your vehicle for the purposes of managing our parking facilities, providing parking services to you, and enforcing our parking regulations.


4.  WHY DO WE COLLECT PERSONAL INFORMATION?

Ivanhoe Cambridge may use your personal information for the following purposes or otherwise, with your consent or as permitted or required by law:

Ivanhoe Cambridge collects personal information for general business-related purposes such as to manage its business, provide or deliver a product or service requested (through the use of our website, mobile apps and/or Wi-Fi) or when necessary for the safety of a product or service that we provide or deliver (ensure the security of our properties, authenticate the identity of individuals contacting us, monitor use of Wi-Fi to ensure that it is lawful and complies with the Wi-Fi Terms of Use). We may also collect personal information as necessary to ensure the efficiency of the Ivanhoe Cambridge information systems and networks, protect their reliability and security, as well as, prevent or reduce our commercial risk (internal training and quality assurance, prevention of fraud, unauthorized activities, claims and other liabilities).

More specifically, we may collect personal information from guests, tenants, suppliers and other business partners, and applicants for the following purposes:

  • Guests.
    We collect personal information from you as guests to provide you with the information requested or to contact you in order to answer your questions, requests or inquiries, to administer the contest or promotion which you have entered, or to send you our newsletter if you have registered to receive a newsletter through one of our websites or our mobile apps, or if we have your implied consent to send you such communications. If you connect to, register on, visit or use our websites, mobile apps and/or WI-FI network, we may also collect your personal information to perform or complete a registration, to measure and monitor traffic on the websites and/or mobile apps, to increase the effectiveness of our websites and/or apps or to improve user experience. We may also use your information to process your requests, provide and manage our services (including troubleshooting), monitor, detect and respond to any activity that may be unlawful or may compromise the security of our services, property, networks, employees or guests, or otherwise violate an applicable agreement, such as the WI-FI network terms of use.
  • Tenants.
    We collect personal information from tenants to evaluate their creditworthiness, evaluate and process applications for tenancy, prepare leases and to provide tenants with relevant information and services throughout the term of the lease (including specialized services and memberships, such as for parking and fitness facilities). We may also use tenants’ personal information for emergency, security or incident reporting involving video, swipe card and other surveillance methods, for insurance, security and risk management purposes, and generally speaking, to establish, manage or terminate our business relationship.
  • Suppliers and Other Business Partners.
    We collect personal information from suppliers and other business partners to evaluate and select them, to initiate orders, process payments, maintain our business relationship, to establish and maintain responsible business relations with clients and partners, to provide ongoing service, to protect the security of our IT systems, such as by maintaining activity logs, and to manage risk.
  • Employment Applications.
    We collect personal information from applicants for recruitment and other customary human resources purposes. For example, we may send you information about new job opportunities within Ivanhoe Cambridge as well as other career development resources.

Research and development purposes.

Subject to applicable laws and, when necessary, with your consent, we may collect and use anonymous or de-identified information to understand and assess the interests and changing needs of our guests with a view to improving our products and services and developing new ones, to measure and monitor traffic to our properties, to understand how our guests interact with our properties, and how many guests return and/or visit our other properties, to evaluate potential improvements or other modifications to the functionality of our websites, mobile apps, Wi-Fi and to our properties, as well as to improve the experience of guests at our properties.

We may collect anonymous and de-identified information for the following internal research and development purposes:

  • If you visit our websites, use our mobile apps and/or Wi-Fi, we will use browser, device and technical information collected to measure and monitor traffic and improve the effectiveness of our websites, mobile apps and/or Wi-Fi or enhance the experience of our guests. For instance, the technologies used in our properties to conduct anonymous video analytics and anonymous traffic analysis allow us to consider certain demographic information about our guests (such as gender and age) and their location within our properties, on an anonymous basis, for the purpose of improving their mall experience. We may also track devices which have accessed and/or visited our properties or used our services, websites, mobile apps and/or Wi-Fi, on an anonymous basis, for similar purposes. We may use statistical data about traffic in our properties to help us manage our properties, including choosing the most appropriate tenants, and we may share this statistical information with our business partners, including our tenants.
  • We may also use location information collected automatically from your Wi-Fi enabled device or similar technologies, including anonymized data received from third parties in accordance with applicable laws, to generate spatial analyses in an aggregated format, which allows us to understand how our guests interact with our properties, and how many guests return and/or visit our other properties. We use this information to manage our properties and support the operational and decision-making process.

Survey and Marketing Purposes.

Subject to you providing consent, we may use your information to contact you regarding future services and/or to conduct surveys on the quality of our products, services or customer service, to improve the experience on the website or to provide you with offers for additional products and services that we feel may be of interest to you. For instance, if you access our Wi-Fi using your social media accounts, we may collect and use information about your accounts (including your name, age, and email address) to inform you about promotions or offers that may be of interest to you, to tailor advertising content to your interests, and to understand the preferences and interests of our guests in order to customize how we promote our products and services on various channels and platforms, including social media channels. For further details on the type of commercial electronic messages (“MEC”) that you may receive from us, please refer to the section of this Privacy Policy entitled Electronic Communications and Notifications. To withdraw your consent from such use, see the section of this Privacy Policy entitled Right to Withdraw Consent.


5.  ELECTRONIC COMMUNICATIONS AND NOTIFICATIONS

You may receive the following types of electronic communications and notifications from Ivanhoe Cambridge:

  • Electronic Notifications. You may receive electronic notifications for various purposes including to facilitate or confirm a transaction such as your subscription to our services, to provide you with information about your use of our services or your current subscription or accounts, to inform you of any incident regarding the security of your information or in order to give effect to a legal right or obligation.
  • Commercial Electronic Messages. You may receive commercial electronic messages (CEMs) from Ivanhoe Cambridge if we have your consent to send you CEMs.

    • Express consent: You can verify that you have provided consent to Ivanhoé Cambridge (or verify the status of your consent) by contacting our Privacy Officer at the contact number or email address provided in the Contacting Ivanhoe Cambridge section of this Privacy Policy.
    • Implied consent: Ivanhoé Cambridge may infer your implied consent if: (i) We have an existing business relationship with you or had a business relationship with you which terminated less than two years ago (for instance, you purchased our services, entered into a lease with us, registered to use our Wi-Fi network, etc.); (ii) We have received a request from you within the last 6 months; and/or (iii) You have provided your electronic address to Ivanhoé Cambridge and the CEM sent by Ivanhoé Cambridge complies with the Canadian Anti-Spam Legislation.

For further information on how you may unsubscribe from such commercial electronic messages (CEMs), please refer to the section in this Privacy Policy entitled Right to Withdraw Consent.


In general, by interacting and/or doing business with us, visiting our properties, subscribing to our newsletter and/or submitting information to us in connection with using Ivanhoé Cambridge services, visiting, interacting with and/or using our websites, mobile apps and/or Wi-Fi network, you are providing your consent to the collection, use and disclosure of your personal information as set out in this Privacy Policy and, if applicable, on the Ivanhoé Cambridge Website and Mobile app Terms and Conditions Of Use and/or the Wi-Fi Network Terms of Use. In certain circumstances, your personal information may be collected, used or disclosed without consent in case of an emergency, when authorized by law (for example, to detect or prevent fraud or an illegal activity) or when required to comply with a court order or a similar type of requirement.

Note that Ivanhoé Cambridge may rely on a legal basis other than consent if the General Data Protection Regulation or the UK Data Protection Act 2018 apply. For further details, please refer to Appendix A of the Policy entitled EU/UK Notice.

Exceptions to consent requirements. In certain circumstances, your personal information may be collected, used or disclosed without consent. These exceptional or statutory circumstances may include:

  • where it is clearly in the interest of the individual and consent cannot be obtained in a timely way, such as in emergencies, where the life, health or safety of the individual is threatened, or where legal, medical or security reasons make it impossible or unrealistic to obtain consent;
  • when information is being collected, used or shared for the detection, prevention of or remediation of the breach of an agreement, fraud or other illegal activity, and the collection of consent might defeat the purpose of collecting the information;
  • to comply with a subpoena, warrant or other court order, requests received from law enforcement authorities, or as may be otherwise required or authorized by law or any competent regulatory authority;
  • When personal information is used for purposes consistent with those for which it was collected;
  • When personal information is necessarily used for the purposes of supplying or delivering a product or providing a service requested by the person concerned; and
  • When collected personal information is de-identified and used for study, research or statistical purposes.

Consent may be withdrawn at any time. However, without such consent, Ivanhoé Cambridge may in some cases limit the services it can offer you and/or Ivanhoé Cambridge may be unable to enter into a business relationship, maintain such relationship and/or interact with you, but only to the extent that your personal information is necessary for those purposes. You may also withdraw your consent from the use or sharing of your personal information for marketing purposes or any collection of information from cookies.

You may withdraw your consent as follows:

  • Mail or Telephone Solicitation and Quality control communications. 
    You may decide that you prefer Ivanhoe Cambridge not use your personal information to promote new and/or additional products and/or services which may be of interest to you, not share your information with our affiliates, subsidiaries and retailers from our properties and not contact you by mail or telephone for marketing purposes or by email or telephone for quality control purposes. If this is the case, you may contact us by email at privacy@ivanhoecambridge.com.
  • Commercial Electronic Messages. 
    You can withdraw your consent for the marketing and commercial electronic communications that Ivanhoe Cambridge sends to you, at any time. To opt out, simply click on the link “Unsubscribe” at the bottom of every CME we send you. Please note that even if you opt out of marketing and commercial communications, we may still contact you when required by law.
  • Option Related to Cookies. 
    When visiting or using our websites and/or mobile apps, you can, at any time, block the use of cookies by activating the settings in your browser. The “Help” feature on most browsers will tell you how to prevent your browser from accepting new cookies, how to have the browser notify you when you receive a new cookie, or how to disable cookies altogether. If you choose to not accept cookies, or subsequently block cookies, you may not be able to access all or a part of the content of our websites and/or mobile apps. Additionally, you can disable or delete similar data used by browser add-ons, by changing the add-ons` settings or visiting the website of its developer.

8. SHARING OF PERSONAL INFORMATION

Personal information about our users will not be sold or otherwise transferred to unaffiliated third parties without your approval. However, Ivanhoe Cambridge may disclose personal information when authorized by law or share your personal information with its affiliates, subsidiaries and retailers (which may include our tenants) operating from its properties, for purposes related to service providers that are retained to perform work on our behalf, as well as in the context of a business transaction (for example in the context of a merger or sale of our business). If you submit an employment application, we may share your information with the retailer who is a tenant of our properties and to whom such application is being made.

Ivanhoe Cambridge may share personal information as follows:

  • Affiliates and Business Partners.
    Subject to our users’ rights under the Right to Withdraw Consent section found in this Privacy Policy, Ivanhoé Cambridge may share personal information with its affiliates, subsidiaries and retailers (which may include our tenants) operating from our properties, for purposes related to marketing the services offered by Ivanhoé Cambridge, its affiliates, subsidiaries and such retailers, at all times in compliance with applicable privacy laws.
  • Third-party service providers.
    We may hire service providers, which may be affiliates, to perform services on our behalf. This may include, but is not limited to, an individual or organization retained by Ivanhoé Cambridge to perform work on its behalf (e.g., provider of due diligence and financial crime prevention, provider of analysis and improvement of the customer experience, provider of cloud computing for data processing and storage, provider of surveys and electronic messaging, provider of it security solutions and services, provider of anonymous video analytics technology and provider of property management services). We provide them with a limited amount of information which is necessary in order for them to provide the services required and ensure that they have entered into contractual arrangements that provide adequate protection of your personal information. They are prohibited from using the information for purposes other than to carry out the services they have been engaged to provide. These service providers are not permitted to disclose the information to others.
  • As Permitted or Required by Law. 
    From time to time, Ivanhoe Cambridge may disclose your personal information if such disclosure is necessary for the establishment, exercise or defence of legal claims, as part of the administration of our loss prevention program, or as otherwise permitted by law, for instance if Ivanhoe Cambridge is compelled to disclose personal information in response to a law, regulation, court order, subpoena, valid summons, search warrant, government investigation, other legally valid request or investigation or if reasonably necessary to protect the rights, property and safety of others or ourselves. We may also disclose information to our accountants, auditors, agents and lawyers in connection with the enforcement or protection of our legal rights. We also reserve the right to report to law enforcement agencies any activities that we, in good faith, believe to be unlawful or to disclose information to law enforcement and emergency services providers, in an emergency or where required or permitted by law.
  • Business Transactions. 
    We may disclose personal information to a third party in connection with a corporate merger, acquisition, consolidation, the sale of a portion of our business, business unit or property, or other fundamental corporate change, whatever form it may take. However, in the event the transaction is completed, your personal information will remain protected by applicable privacy laws. In addition, we will only disclose your personal information to the extent that user information is necessary for these business operations, in which case we will comply with applicable legal requirements when processing user information. In the event the transaction is not completed, we will require the other party not to use or disclose your personal information in any manner whatsoever and to completely destroy such information.
  • Applicants.
    If you complete and submit an employment application (including an online application found on our websites), you hereby consent to the disclosure of your completed on-line employment application to: (a) Ivanhoe Cambridge personnel; and to (b) the retailer who is a tenant of our properties and to whom such application is being made.

9.  SECURITY

Ivanhoe Cambridge maintains reasonable administrative, technical and physical safeguards in an effort to protect against unauthorized access, use, modification and disclosure of personal information in our custody and control. Unfortunately, it is impossible to guarantee the security of information collected or transmitted over the Internet or other publicly accessible telecommunications networks. You acknowledge that: (i) there are Internet security and privacy limitations which are beyond the control of Ivanhoe Cambridge; (ii) the security, availability, integrity and privacy of any and all information and data exchanged between you and Ivanhoe Cambridge through our websites and mobile apps or when using our Wi-Fi cannot be guaranteed; and (iii) any such information and data may be viewed or tampered with in transit by a third party. Because of this, we cannot ensure or guarantee the security of any such information. In the event there is a security incident concerning any of your personal information collected and retained by Ivanhoe Cambridge under this Privacy Policy, we may contact you by email, letter, telephone or through other secure form of communication.

Ivanhoé Cambridge applies policies and practices that ensure the protection of your personal information. Depending on the volume and sensitivity of the information, the purposes for which it is used, and the format in which it is retained, we implement a combination of safeguards to protect your personal information, namely

  • Internal policies and procedures that define the roles and responsibilities of our employees throughout the information life cycle limit their access to information on a need-to-know basis;
  • If the information is collected or retained in electronic form, technical safeguards such as encryption, firewalls, passwords, anti-virus software and other similar measures;
  • A Privacy Officer has been appointed to oversee Ivanhoé Cambridge’s compliance with applicable privacy laws;
  • Training our employees in the protection and security of personal information;
  • Procedures for receiving, investigating and responding to complaints or inquiries regarding Ivanhoé Cambridge’s information processing practices or users’ privacy rights;
  • Contractual protections and other measures to ensure that service providers with whom we share personal information ensure adequate privacy protections and standards as noted above. We also try to monitor and audit their compliance with these requirements in a variety of ways (e.g., onsite inspections (where possible), surveys and interviews, proof of certification).

10. RETENTION OF PERSONAL INFORMATION

We have personal information retention processes and retention schedules designed so that we retain users’ personal information for no longer than reasonably necessary for the purposes stated in this Privacy Policy or to meet our legal obligations.

Ivanhoé Cambridge will use reasonable efforts to maintain the accuracy, completeness and currency of employee personal information to the extent necessary to fulfill the purposes for which it was collected and is to be used. Ivanhoé Cambridge may, from time to time, ask you to confirm the accuracy of your personal information for this purpose.


11. LOCATION, STORAGE AND CROSS-BORDER TRANSFER

Your personal information is retained in secured locations and on servers controlled by Ivanhoé Cambridge or its service providers, located either at our facilities or at the facilities of our service providers. Notwithstanding the foregoing, Ivanhoé Cambridge and its third-party service providers may process or retain your personal information outside of Canada, including in the United States. In accordance with the laws of those countries, in certain circumstances your personal information may be accessed by foreign law enforcement, regulatory bodies or other authorities. For further information about transfers of personal information outside of the European Economic Area, please refer to the EU/UK Notice in Appendix A of this Privacy Policy. For further information about our practices and policies regarding the use of foreign service providers, please contact us as indicated in the Contacting Ivanhoe Cambridge section.


12. CHILDREN

Ivanhoe Cambridge recognizes the importance of safeguarding the privacy of children and encourages parents to regularly check and monitor their children’s use of online activities. Our services (including our websites, mobile apps and/or Wi-Fi) are not intended for children under the age of fourteen (14). If you are under the age of fourteen (14), please do not use our services (including our websites, mobile apps and/or Wi-Fi network) If you are over the age of fourteen (14) but under the age of majority in the province in which you reside, you should use our services (including our websites, mobile apps and/or Wi-Fi network) only with the involvement and permission of a parent or legal guardian. No personal information is deliberately or knowingly collected from children under the age of fourteen (14) by Ivanhoe Cambridge without parental consent. If we are informed that we have collected personal information of a child under the age of fourteen (14) or the applicable legal age in the country of residence of the child, we will delete any personal information related to such a child.


13. UPDATING AND ACCESSING YOUR INFORMATION

  • Your right of access: You have the right to ask us if we are using or retaining your personal information. You may also request copies of such personal information, including copies in a structured, commonly used technological format where required by law.
  • Your right to portability: You have the right to ask us, unless this would raise serious practical difficulties, to transfer your computerized personal information to a third party or to provide it directly to you in a structured and commonly used technological format.
  • Your right to rectification: You have the right to ask us to rectify personal information you deem equivocal or inaccurate and to complete information you deem incomplete. You may also have the right to request rectification of your personal information if the collection, disclosure or retention of such information is not authorized by law.
  • Additional rights in the EU/UK: If you are located in the European Union or in the United Kingdom, you may have additional rights which are described in the EU/UK Notice in Appendix A of this Privacy Policy.

To exercise your rights or to obtain further information about how Ivanhoé Cambridge processes your personal information, please contact our Privacy Officer at the telephone number or email address provided in the Contacting Ivanhoe Cambridge section below.


14. CONTACTING IVANHOÉ CAMBRIDGE

If you have any questions about this Privacy Policy or the privacy practices of Ivanhoé Cambridge in respect of how we collect, use and communicate your personal information, please address your inquiry to the Communications and Public Affairs Department of Ivanhoé Cambridge, 1001 rue du Square Victoria, Suite C-500, Montréal (Québec) H2Z 2B5, Canada, or contact us by email at privacy@ivanhoecambridge.com or by telephone at (514) 841-7600.


15. CHANGES TO PRIVACY POLICY

Ivanhoe Cambridge reserves the right to change this Privacy Policy at any time by notifying you of the existence of a new Privacy Policy. In accordance with Ivanhoé Cambridge’s requirements, the Policy is reviewed every three years. Such changes, modifications, additions or deletions shall be effective immediately upon notice thereof, which may be given by any means including, but not limited to, posting on our websites and our mobile apps. If the changes are significant, we will provide a more visible notice or obtain consent when required by law. Your continued use of our services, websites, mobile apps and/or Wi-Fi after such modifications will constitute your acknowledgement of the modified Privacy Policy and your agreement to abide and be bound by the modified Privacy Policy.

This version of this Policy does not substantively change the way we process personal information compared to the previous version of the Privacy Policy.


APPENDIX A – EU/UK NOTICE

This Appendix applies when the processing of your personal information is subject to the General Data Protection Regulation (GDPR) or the UK Data Protection Act 2018, for instance, because it is handled by an Ivanhoé Cambridge entity located in the European Union or the United Kingdom, or because you are located in a Member State of the European Union or in the United Kingdom.

We may rely on the following legal basis to process your personal information:

  • Where it is necessary to enter into or to perform obligations under a contract (for example, when you enter into a lease agreement with us);
  • when this is necessary for our legitimate interests or for the legitimate interests of a third party (for example, to ensure the security of our buildings, our staff and our property, to prevent fraud or to guarantee the security of our network and our computer systems);
  • Where you have given IC your consent (for example, when you subscribe to our marketing and commercial electronic messages);
  • Where it is necessary to comply with our legal obligations;
  • Where it is necessary to protect the vital interests of an individual.

What are your rights?

In addition to the rights mentioned under the section entitled Updating and Accessing your Information, you may have the following rights:

  • Right to erasure: You have the right to ask us to erase your personal information on the grounds and within the limits established by law (for example, if it is no longer required to provide our services or if you have withdrawn your consent).
  • Right to object or restrict our processing: You have the right to request that IC stop processing all or some of your personal information (for instance if we use it for direct marketing purposes) or restrict its use (for example, if it is inaccurate).
  • Right not to be subject to an automated decision: You have the right not to be subject to a decision based exclusively on automated processing (for example, an algorithm) that is legally binding or that significantly affects you.
  • Right to data portability: You have the right to ask us, if technically feasible, to transfer your personal data to a third party or to provide it to you directly in a structured, commonly used and machine-readable format. Please note that this right is subject to certain restrictions.
  • Right to withdraw your consent: Where we process your personal information on the basis of your consent (e.g., email marketing), you may withdraw your consent, for instance, by clicking on the “Unsubscribe” link included in each commercial electronic communication.

Further, where French data protection law (la loi Informatique et Libertés) is applicable, you also have the right to set guidelines for the retention and disclosure of your personal information after your death.

If you wish to exercise any of these rights, please use the contact information provided in the Contacting Ivanhoe Cambridge. section. You also have the right to lodge a complaint before the supervisory authority of the country where you are located or where the relevant Ivanhoe Cambridge entity is established as detailed in Appendix B.

How do we secure your personal information transferred outside of the European Economic Area?

When we transfer your personal information outside the European Economic Area (including the United Kingdom), we enter into contractual arrangements to ensure the adequate protection of your personal information. For example, we rely on contracts that include standard contractual clauses approved by the European Commission or other legal mechanisms under the GDPR to transfer personal information related to our activities in the EU and the UK to countries outside the European Economic Area that are not affected by an adequacy decision.


APPENDIX B – IVANHOÉ CAMBRIDGE ENTITIES ACTING AS PERSONAL INFORMATION CONTROLLER

CountryIvanhoé Cambridge Entity acting personal information controllerAddressContact details
CanadaIvanhoé Cambridge Inc.1001 rue du Square Victoria, Suite C-500, Montréal, (Québec)
H2Z 2B5 Canada
Anne-Marie Côté
privacy@ivanhoecambridge.com
FranceIvanhoé Cambridge
Europe S.A.S.
28/32 avenue Victor
Hugo, 75116 Paris,
France
Semih Bayar Eden
privacy@ivanhoecambridge.com
United-KingdomIvanhoe Cambridge Holdings UK Limited.70 Broadwick Street, Soho, London, W1F 9KZSemih Bayar Eden
privacy@ivanhoecambridge.com
AustraliaIvanhoe Cambridge Australia Pty LimitedDeutsche Bank Place, Suite 2201
126 Phillip Street
Sydney NSW 2000
Anne-Marie Côté
privacy@ivanhoecambridge.com
IndiaIvanhoe Cambridge India Services Private LimitedUnit No. 71, 7th Floor, Maker Maxity, Drive IN Theatre 4 North Avenue, Bandra E, Mumbai-400051, Maharashtra, IndiaAnne-Marie Côté
privacy@ivanhoecambridge.com
SingaporeIvanhoe Cambridge Singapore Pte LtdOne Raffles Quay
#39-01 North Tower,
Singapore 048583
Anne-Marie Côté
privacy@ivanhoecambridge.com
ChinaIvanhoe Cambridge Retail Property Management (Shanghai) Limited CompanyRoom 1505, Corporate Avenue 1, No. 222 Hubin Road, Huangpu District, Shanghai, PRC, 200021Anne-Marie Côté
privacy@ivanhoecambridge.com
New YorkIC Industrial Management LLC, a Delaware limited liability company Registered Agent Solutions, Inc., 838 Walker Road, Suite 21-2, Dover, DE 19904Anne-Marie Côté
privacy@ivanhoecambridge.com
BrazilIvanhoe Cambridge Brasil Consultoria e Assessoria Ltda.Av. Brigadeiro Faria Lima 3477, 5th Floor, Suite 51, North Tower, Itaim Bibi, São Paulo, SP, Brazil 04538 133Anne-Marie Côté
privacy@ivanhoecambridge.com
GermanyIvanhoe Cambridge Germany Management GmbHKurfürstendamm 30, 10719 Berlin, GermanyAnne-Marie Côté
privacy@ivanhoecambridge.com