Privacy Policy

Last Updated: January 1, 2020

I. ABOUT OUR PRIVACY POLICY

This Privacy Policy (the “Policy”) describes the types of information that Steadfast Companies

and its family of companies, including Steadfast Management Company, Inc., and their subsidiaries, affiliates, and related companies (collectively, “Steadfast,” “we,” “us,” or “our”), may receive and collect from you through our websites, applications that run on mobile devices and tablets, advertising technology, and other aspects of our business, including offline and in-person communications (collectively, the “Services”). This Policy also describes the types of personal information that we collect about you and our practices for using, maintaining, sharing, and protecting it.

Steadfast Companies is an integrated, multifaceted real estate investment, development, and

operating company that owns and/or operates a diverse portfolio of real estate assets across

the United States and Mexico. Steadfast Companies is driven by its mission to pursue real

estate investment, development, and management opportunities responsibly and with integrity for the benefit of our investors, partners, tenants, associates, and the community.

Steadfast respects your privacy and is committed to ensuring the protection of your personal

information. As a leading provider of property management services for its apartment

communities, Steadfast Management Company, Inc., doing business as Steadfast Living

(www.steadfastliving.com), may receive and collect certain personal information about you in

connection with providing those services. Steadfast Living strives to protect the privacy of your personal information as much as reasonably possible while still allowing us to use that personal information to provide you valuable services and hopefully to have you as a resident of one of the apartment communities that we manage. This Policy does not alter or change any written agreement (such as a lease) that you may have with Steadfast or the owner of one of the apartment communities that we manage.

Our privacy practices and the rights and choices you may have with respect to your personal

information may vary among the states in which we operate to comply with legal requirements.

We have developed this Policy with the recognition that applicable laws regarding privacy and personally identifying information are evolving and changing rapidly. Accordingly, this Policy may change from time to time, and Steadfast expressly reserves the right to modify the terms of the Policy at any time and in our reasonable discretion. We will identify the date this Policy was last modified at the top of this Policy.

II. ACCEPTANCE OF OUR PRIVACY POLICY

By using or accessing the Services, you signify your acceptance of this Policy and acknowledge

your awareness of its terms. If you do not accept this Policy, you are not authorized to use or

access the Services and must immediately discontinue using or accessing them.

III. THIRD-PARTY WEBSITES AND LINKS

When using the Services, you may have the opportunity to link to websites or interact with

features (such as advertisements and banners) from third-parties that operate independently

from Steadfast. We have no control over and are not responsible for the privacy practices of

these third-parties or the content provided thereon. This Policy does not apply to any third-party

websites or features that you may access through the Services. We recommend that you

familiarize yourself with the privacy practices of these third-parties. In addition, the inclusion of any linked websites or features on our websites does not necessarily imply a recommendation or endorsement by Steadfast of their nature or content.

IV. PROTECTION AND RETENTION OF PERSONAL INFORMATION

Steadfast takes commercially reasonable measures to secure and protect your personal

information from unauthorized access, use, and disclosure. We use industry-standard,

appropriate, and technically feasible physical, technical, organizational, and administrative

safeguards and security measures based on the type of personal information that we receive

and collect and how we are using this information. We limit access to personal information to

employees who we believe reasonably need to receive such information to provide our services or to do their jobs, and we take the precautions we deem reasonable to protect the security of your personal Information.

Please be aware, however, that no method of transmitting data over the Internet or storing

data on software, hardware, or networks is completely secure. We cannot guarantee the

complete security of any personal information that you share with us, and except as expressly

required by law, we are not responsible for the theft, destruction, loss, or inadvertent

disclosure of your personal information. You therefore disclose personal information to us at

your own risk.

Steadfast generally retains your personal information and our records only as long as necessary and required for or the business purposes for which we obtained it, for reasonable business purposes, or to satisfy legal requirements.

V. TYPES OF INFORMATION WE COLLECT

A. Personal Information

When you use or access the Services, Steadfast receives and collects certain personal

information for lawful purposes in the operations and conduct of our business. Personal

information means any information relating to an identified or identifiable individual or can be

used to identify you personally. Personal information may include, without limitation, your full

name, street address, home and mobile telephone number, email address, birthdate, Social

Security number, driver’s license number, bank account information, lines of credit information, credit score, employment history, log-in credentials for our websites and applications, size of your household, marital status, and gender.

Steadfast receives and collects personal information about you whenever you transact business with us, use our products or services, rent, lease, or apply for an apartment, request

information or materials, create or update a resident profile, place work orders, communicate

with us or the on-site staff, make rent payments, visit our websites, or use our applications.

The type of personal information we receive and collect about you will depend upon what we

may need to provide you with the product or service that you are interested in. For example, a

prospective resident, current resident, and individual interested in applying for employment

will not all be asked to provide the same personal information, but rather only for the

information that we may need to provide them with the product or service that they are

interested in.

B. Non-Personal Information

When you use or access the Services, Steadfast receives and collects certain non-personal

information for lawful purposes in the operations and conduct of our business. We may use

and disclose non-personal information for any purpose, except where we are required to do

otherwise under applicable law. Non-personal information helps us improve and personalize

your experience on our websites, defend against and detect fraudulent activity or cyberattacks, and maintain the security of our services.

Non-personal information refers to data and information that does not personally identify you

as the individual to whom the data or information relates. Non-personal information includes

data and information that is aggregated or de-identified and thus not linked to personal contact information. Non-personal information does not personally identify the individual to whom the information or data collected relates. When you use or access our websites and applications, we may receive and collect certain non-personal information from your browser and device, including, without limitation, your Internet Protocol address, data collection technology, device information, the operating system you used, the type of browser you used, and your general geographic location. We may also receive and collect certain non-personal information regarding your activities while using or accessing this web site, including, without limitation, the web pages that you visit, the amount of time that you spend on those web pages and applications, and the content you view.

Steadfast may from time to time share aggregate user information with business partners,

service providers, or other third parties to identify or share trends, usage statistics, and similar

matter. Sharing data in an aggregate form means that no personally identifiable information,

which would allow the recipient of the data to identify you personally, will be shared.

1. IP Addresses

An Internet Protocol address (“IP address”) is a numerical label assigned to each device

connected to a computer network that uses the Internet Protocol for communication. An IP

address serves two main functions: host or network interface identification and location

addressing. As permitted by law, Steadfast collects aggregate user information sitewide,

including IP addresses, for the purposes of system administration, gathering and analyzing

aggregated information, creating a better experience for users, and auditing the use of our site.

Absent the potential need to defend against or investigate fraudulent activity, cyberattacks, or

criminal conduct, we do not link IP addresses to anything personally identifiable. This means

that a user’s session may be tracked, but the user will be and remain anonymous.

2. Cookies and Other Data Collection Technology

Non-personal information may be collected in a variety of ways, including data

collection technology. Data collection technology refers to, among other things, cookies, web

beacons, pixels, gifs, tags, and other technologies that collect information in similar ways. Data collection technology helps us to improve your experience on this website by providing us with non-personal information for compiling statistics about the use and access of our web pages and analyzing technical and navigational information about our web pages.

A cookie is a small text file that is sent to or accessed from your web browser or your computer’s hard drive. A cookie typically contains the name of the domain (Internet location)

from which the cookie originated, the “lifetime” of the cookie (when it expires), and a randomly

generated unique number or some other identifier. A cookie may also contain information

about your computer, such as user settings, browsing history, and activities conducted while

using this web site. A cookie cannot be read by any website other than the one that set up the

cookie.

Cookies enable this website to recognize the information that you have consented to give to us and to help us provide you with a better website by enabling us to monitor the pages that you find useful. Other than the data and information that you choose to share with us, a cookie

does not provide us with access to your computer or any personally identifiable information

about you. We do not use cookies to examine your web surfing behavior before or after

leaving this website.

By showing how and when users use a website, cookies help us see which areas are popular

and which are not popular. Many improvements and updates to the website are based on such data as the total number of visitors and pages viewed. This information is most easily tracked with cookies. We use the information from cookies only to provide services better tailored to your needs and for the protection of our website and users from potential harm.

By using or accessing our websites, you agree to our use of cookies and other data collection

technology in the following ways, as well as other similar purposes:

Analytics;
Marketing;
Preserving your preferences;
Personalizing your experience;
Understanding where our website traffic is originating; and
Ensuring the security and availability of our website

You have the right to decide whether a website can store cookies on your web browser or your computer. Depending on the web or mobile browser that you use, you may be able to view, manage, delete, and disable cookies through your browser’s preferences. Most web and mobile browsers automatically accept or decline cookies. Some web and mobile browsers provide settings that allow you to control or reject cookies or alert you when a cookie is placed on your computer or device. You may also be able to reject mobile device identifiers by activating the appropriate setting on your mobile device. Although you are not required to accept cookies or mobile device identifiers, if you choose to delete cookies or to not allow us to use cookies, some features on this website may not work properly and you may have to manually adjust some preferences every time that you visit this website.

3. Third-Party Analytics Services

Our websites may use analytics services provided by third parties. These analytics services use cookies and other data collection technology to collect and store information about your use of our websites. Analytics services may also offer certain advertising features that this website may utilize.

Steadfast uses Google Analytics to analyze browsing activity, to better understand the behavior of visitors to this website, and for certain advertising features that it offers. Google Analytics uses cookies and other data collection technology to gather website statistical data and help analyze how users use this website. Google will use this information to monitor your use of this website, compile reports on website activity for website operators, and provide other services related to website activity and Internet usage. Google may transfer this information to third parties where required by law, or where such third parties process information on Google’s behalf.

For more information about Google’s privacy policy with respect to Google Analytics, please

visit https://support.google.com/analytics/topic/2919631?hl=en&ref_topic=1008008. You can

opt-out from being tracked by Google Analytics by installing the Google Analytics Opt-Out

Browser Add-On at https://tools.google.com/dlpage/gaoptout. You can opt-out of Google

Analytics for Display Advertising and customize Google Display Network ads by changing the ad settings https://www.google.com/settings/ads.

VI. COLLECTION OF PERSONAL INFORMATION

A. From You or With Your Permission

Steadfast collects personal information from and about you when you provide it to us directly,

when we request it from you, and when you give us permission to get it from a third-party. We

may collect personal information from you or with your permission when you:

Apply for, lease, renew a lease for, transfer from, or move-out of an apartment at one
of our communities;
Apply for employment at Steadfast;
Complete paperwork for matters arising from or relating to your employment withSteadfast;
Contact us through the Services;
Register for an online resident account;
Make payments or maintenance requests;
Contact the resident hotline;
Use our internal customer relationship management system and databases;
Meet or communicate with us in person or offline;
Post on our social media sites;
Authorize social media companies, search engines, and third-party company websites
to share your personal information with us;
Send us communications through email, U.S. mail, or other delivery service (such as
UPS, Federal Express, etc.); and
Participate in surveys, promotions, or contests.

B. From Our Service Providers

Steadfast retains service providers to assist us with our business and providing the Services,

including the following:

Processing rental applications and resident screening;
Managing leases;
Property management and accounting services;
Processing payments;
Utility billing;
Maintaining our resident portal, resident hotline, and other customer service tools;
Hosting our websites and applications;
Processing employment applications and employee screening;
Payroll processing;
Employee workforce and benefits management; and
Marketing the Services.

We may obtain personal information about you when you provide it to our service provider

directly, when our service provider requests it from you, and when you give us permission to

get it from our service provider. For most, if not all, of these services, you will move away from

www.steadfastcompanies.com and/or www.steadfastliving.com when engaging in those

services, and those websites will have their own privacy policy unique to those websites. This

Policy does not apply to those websites, and we recommend that you familiarize yourself with

their privacy policy before using them.

VII. USE OF PERSONAL INFORMATION

Steadfast uses the personal information that we collect and maintain to help us provide,

operate, improve, understand, customize, support, and market the Services. We may also use

the personal information that we collect and maintain for other purposes where permitted by

law. We may use your personal information for the following purposes:

Managing your residency at one of our communities;
Processing your application to reside at one of our communities;
Carrying out our obligations and enforcing our rights arising from contracts entered
into between you and us;
Communicating with you and responding to your inquiries, comments, and
suggestions;
Providing you with, customizing, and improving our products and Services;
Carry out the specific purpose for which you provided us with the personal
information;
Administering and processing payments;
Completing tasks relating to your transactions and interactions with Steadfast;
Marketing our products and Services;
Managing your employment with us;
Processing your application for employment with us;
Authenticating use and detecting potential fraudulent use;
Anonymizing and aggregating information for analytics and reporting; and
For any other purpose with your consent.

VIII. SHARING AND DISCLOSURE OF PERSONAL INFORMATION

Except as set forth in this Policy, Steadfast does not sell, share, or disclose the personal

information that we have collected and maintained about you to third-parties without your

consent. We may share and disclose non-personal information with third-parties for any

purpose, except where we are required to do otherwise under applicable law.

A. Affiliated or Subsidiary Companies

We may share personal information with our affiliated or subsidiary companies who require access to personal information for legitimate business purposes related to your tenancy or to process any application, request, inquiry, or other information or personal information you submit to us through the Services. This includes the owner of any community where you may apply or lease an apartment, as well as the management company for such community.

B. Service Providers and Business Partners

Steadfast retains third-party service providers to assist us with our business and providing the Services. We may share your personal information with service providers to help us operate, provide, improve, understand, customize, support, and market our products and Services. These service providers perform services on our behalf or on behalf of the owner of one of our communities and who may use this personal information for their own purposes, including sending advertising to you. This includes, without limitation, service providers that send or receive communications, process payments, analyze data, assist with utility billing, provide credit or criminal background checks, resident screening, employment screening, or collection services, provide marketing assistance, or create, host, and/or provide customer service tools on our behalf. In most instances, these service providers are required to use the personal information only to provide their service to us and are prohibited from using it for their own purposes.

We also may share personal information with our business partners in order to provide services and offerings to you, such as for renter’s insurance, cable and Internet services, parcel delivery services, dry cleaning and laundry services, off-site storage or moving services, or similar service providers in the residential living space. These third-parties may have access to certain personal information in order to provide these services to us or on our behalf.

C. Legal and Safety Reasons

Steadfast respects and complies with our legal obligations and may share personal information that we have collected and maintained about you as required by law. We may share such information in response to or to cooperate with law enforcement authorities, government inquiry or audit, and legal process (such as a court order or subpoena).

We may share personal information that we have collected and maintained about you (1) to establish or exercise our legal rights or defend against legal claims; (2) to detect, investigate, prevent, and address fraud and other illegal activity, security, or technical issues; and/or (3) to protect our or others’ rights, property, or safety.

We may share personal information that we have collected and maintained about you to

prevent physical injury or other harm to any person or entity, including you and members of the general public. For example, we may share your personal information with disaster relief agencies, first responders, and other individuals to facilitate disaster or emergency response efforts.

D. Business Transactions

Steadfast may share certain personal information that we have collected and maintained about you with the relevant participants or successor in business transactions or potential business transactions, including any reorganization, merger, acquisition, consolidation, dissolution, sale, or other transfer of all or any portion of our business. For example, if we sell a property and/or stop managing a property, we may share certain personal information that we have collected and maintained about you to the new owner and/or property manager of the property, such as your tenant file.

E. Equal Employment Opportunity Reporting

In connection with laws and regulations enforced by the Equal Employment Opportunity

Commission (“EEOC”), the Office of Federal Contract Compliance Programs (“OFCCP”) and similar state and local regulatory agencies, we may ask you to provide us with self-identifying information (such as veteran status, gender, and ethnicity). Providing such self-identifying information is voluntary, but if you do provide us with such information, we may submit that information to the EEOC, the OFCCP, and similar state and local regulatory agencies or otherwise use or disclose it for business-related purposes, including, without limitation, responding to information requests, fulfilling regulatory reporting requirements, and defending against employment-related complaints.

IX. PRIVACY OF MINORS

The Services are not directed at or intended to be used by minors. We do not knowingly collect or maintain personal information from or about minors, unless required by law and

except for certain limited personal information that may be provided by a parent or guardian in connection with their housing or application for housing. For example, we maintain records

regarding the identities of those who reside in an apartment. If you provide personal

information to us, you represent and warrant to Steadfast that you are not a minor. If we

discover that we have collected personal information from a minor, we will take reasonable

measures to delete such information from our systems. If you are a parent or guardian and

believe that your minor may have provided personally identifiable information through the

Services, please contact us by using the information in the “Questions or Comments” section

below.

X. QUESTIONS OR COMMENTS

Steadfast welcomes your questions about this Policy and the ways in which we collect and use your personal information. Please contact us by using the information below, and we will

respond to you as soon as reasonably possible.

By Mail: Steadfast Companies

Attn: Privacy Policy

18100 Von Karman Avenue, Suite 500

Irvine, CA 92612

By Email: privacy@steadfastcompanies.com

XI. SUPPLEMENTAL PRIVACY NOTICE FOR CALIFORNIA RESIDENTS

The contents of this section supplement the Privacy Policy set forth above and apply solely to

California residents. If there are any conflicts between this section and any other provision of

this Policy and you are a California resident, the portion that is more protective of your

personal information shall control.

California residents are afforded certain rights regarding their personal information under the

California Consumer Privacy Act of 2018 (“CCPA”). For purposes of this section, “personal

information” has the meaning given to it in the CCPA, but it does not include certain de-identified or aggregated information, information publicly available in government records, or certain information excluded from the CCPA’s scope.

A. Your CCPA Rights

1. Right to Know

You have the right to request a description of the following personal information that we have collected about you during the past twelve (12) months:

Categories of personal information we have collected about you;
Categories of sources from which that personal information was collected;
Purpose for collecting or selling your personal information; and
Categories of third-parties with whom we have shared your personal information. If we have disclosed your personal information for a business purpose over the past twelve (12) months, we will identify the categories of personal information shared with each category of third-party recipient.

2. Right to Access

You have the right to request specific pieces of personal information that we have collected about you during the past twelve (12) months.

3. Right to Delete

You have the right to request that we delete the personal information that we have collected from you.

This right is not absolute and is subject to certain exceptions. For example, we may deny your

deletion request if we need your personal information for a reason related to:

Completing a transaction, providing goods or services requested by you, or otherwise performing a contract with you;
Detecting and resolving issues related to security or functionality;
Complying with legal obligations and exercising or defending legal claims;
Conducting research in the public interest;
Using de-identified or aggregated consumer information;
Exercising free speech or ensuring another’s exercise of free speech; and
Using the information for internal purposes that you might expect based on our relationship with you.

4. Right to Opt-Out

Except as set forth in this Policy, Steadfast does not sell, share, or disclose the personal

information that we have collected and maintained about you to third-parties without your consent. The CCPA, however, broadly defines “sale” in a way that could include providing your personal information to certain service providers or business providers. You have the right to request that we stop selling (as defined by the CCPA) your personal information and refrain from doing so in the future by visiting the following link: Do Not Sell My Info

B. Exercising Your CCPA Rights

To protect the privacy of your personal information, Steadfast is required to verify your identity and California residency to process your request under the CCPA. We cannot process your request if you do not provide us with sufficient detail to allow us to verify your identity and understand and respond to the request. A California resident can empower an “authorized agent” to submit requests on their behalf. We will require the authorized agent to have written authorization confirming that authority.

To exercise your CCPA rights, you must send us a request that:

(1) Provides sufficient information to allow us to verify that you are the person about whom we have collected the personal information; and

(2) Describes your request in sufficient detail that allows us to properly understand,

evaluate, and respond to it.

Each request that meets these criteria will be considered a “Valid Request.” We may not

respond to requests that do not meet these criteria. We will work to complete your request within forty-five (45) days of our receipt of a Valid Request. We will not charge you a fee for making a Valid Request.

All personal information provided to us in connection with a Valid Request will be used only to verify you and complete your request. Please do not provide your complete Social Security Number in any electronic communication to us when exercising your CCPA rights.

You may submit a Valid Request using either one of the following methods:

By Email: CCPA@steadfastcompanies.com

By Toll-Free Telephone Number: (877) 789-7264

C. Right to Non-discrimination

You have the right not to be discriminated against for exercising any of your rights under the CCPA. You thus will not be denied goods or services, charged different prices, or provided a different level or quality of service by exercising an of your rights under the CCPA. Steadfast does not offer any financial incentive or price or service difference in exchange for the retention or sale of your personal information.