Last Revised: December 27, 2019
2. Types of Information We Collect
3. How We Collect Information
4. How We Use Your Information
5. How We Respond to “Do Not Track” Signals
6. Communications with You
7. Information Sharing with Third Parties
9. Protection of Personal Information
10. Updating Your Information
11. Notice of Privacy Rights of California Residents
We may collect Personal Information from you, such as non-public information about you that helps SCP identify you, refers to your name or contact information, or other information that is maintained in a manner that links the information to your name or contact information. This information may include, without limitation, first and last name, birth date, email address, home address, telephone number, credit card number or other payment method information, Social Security number, driver’s license number and issuing jurisdiction, identification number or other identifying information issued by a government agency, your likeness and actions as may be photographed, recorded and live streamed (see Photography Policy), and other information that is not otherwise publicly available. We also may collect Non-Personally Identifying Information about you, such as information regarding your use of the Sites, your IP address, MAC address, Site usage statistics, time stamps, browsing history, general geographic location, type of device you use to connect to the Sites or Wi-Fi Services and information identifying your device, type of operating system you use (e.g., Microsoft Windows, Google Chrome OS or Mac OS), the type of browser you use (e.g., Firefox, Chrome, Internet Explorer, Safari), the domain name of your internet service provider, and your Internet location when you see SCP’s digital ads and whether you click on such ads. “Non-Personally Identifying Information” refers to information that does not personally identify the individual to whom the information relates, such as information that is aggregated by SCP or a third party, or information that is not linked to contact information or other personally identifiable information of an individual. In addition, we may collect information from or about you, such as your password, preferences and interests, income, education level, occupation, ethnicity, marital status, homeowner status, shopping habits, Site and Wi-Fi usage, age and gender, purchase and cash or credit payment information, participation in SCP promotions, and visits to South Coast Plaza.
Depending on how you have interacted with SCP, we may have collected certain information within the following categories of Personal Information from you in the last (12) months. Please note that we have not collected every type of Personal Information identified in the examples below, and the types of Personal Information we have collected on any consumer depends on the consumer’s interaction with us.
|Identifiers.||This category may include: name, postal address, unique personal identifiers, online identifiers, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers. Under the CCPA, “unique identifiers” or “unique personal identifier” means a persistent identifier that can be used to recognize a consumer, a family, or a device that is linked to a consumer or family, over time and across different services.||YES|
|Personal Information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).||This category may include: name, signature, Social Security number, physical characteristics, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education or employment information, financial account numbers, medical information, or health insurance information.||YES|
|Protected classification characteristics under California or federal law.||This category may include: age, race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex and gender information, veteran or military status, or genetic information.||YES|
|Commercial information.||This category may include: records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.||YES|
|Biometric information.||This category may include: imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a face print, a minutiae template, or a voiceprint, can be extracted.||NO|
|Internet or other electronic network activity information.||This category may include: browsing history, search history, and information regarding interactions with an Internet Web site, application, or advertisement.||YES|
|Geolocation data.||This category may include: physical location or movements.||NO|
|Sensory data.||This category may include: audio, electronic, visual, thermal, olfactory, or similar information.||YES|
|Professional or employment-related information.||This category may include: current or past job history or performance evaluations.||YES|
|Non-public education information||This category may include: education records directly related to a student maintained by an educational institution or party acting on its behalf (e.g., grades, schedules, student ID numbers).||NO|
|Inferences drawn from other Personal Information.||This category may include: inferences drawn from the above information that may reflect your preferences, characteristics, predispositions, behavior, or attitudes.||YES|
3. HOW WE COLLECT INFORMATION
We may collect Personal Information and/or Non-Personally Identifying Information from you when you: visit the South Coast Plaza shopping center, use the Sites or register to receive emails or newsletters; use the Wi-Fi Services; contact, communicate or otherwise interact with SCP via the Sites or offline; make a payment to SCP; apply for a job at SCP; or register, enroll or participate in any events, promotions, sweepstakes, surveys, questionnaires, or other activities (collectively, “Activities”) that may be offered on the Sites or offline.
We may obtain Personal Information and/or Non-Personally Identifying Information from third parties such as the owners or operators of the websites or applications where our advertisements appear, and our affiliates, suppliers, vendors, merchants, licensors, or Activities partners or sponsors, and other sources (e.g., offline records or publicly available information). Non-Personally Identifying Information may also be obtained through these other sources, as well as from inferences based upon the sites you visit; third party data; information you share on other sites, social media platforms and applications; or demographics derived from profiles or accounts that you create.
If you make a purchase or receive a gift from SCP, we may obtain Personal Information and/or Non-Personally Identifying Information about you from you (for example, you may be asked to present the receipt from your purchase) or from the payment method provider used for the purchase. Please review the privacy policies for your payment method provider before using it to make a purchase from SCP.
We may combine Personal Information we collect with information that we obtain from the owners or operators of the websites or applications where our advertisements appear, as well as from our affiliates, suppliers, vendors, merchants, licensors, or Activities partners or sponsors, and other sources (e.g., offline records or publicly available information). We will treat any such combined information as Personal Information.
SCP automatically receives and records Non-Personally Identifying Information on our server logs from your browser as well as through other analysis of the Sites. We also may collect information using cookies, web beacons, pixels, gifs, tags or other technologies (“Collection Technology”), or through third parties using similar technologies. Collection Technology may operate as a piece of data stored on your browser or device, or may identify, compile, aggregate and/or collect information through other means. When you visit the Site or use the Wi-Fi Services, your web browser may use Collection Technology to better enable you to navigate the Site during your visit and upon your return. You may use the Site even if you choose to reject or delete certain Collection Technology. Collection Technology also may be used by some of the other websites for which a link is placed on the Site. We may combine this Non-Personally Identifying Information with personally identifiable information, and, if so, will treat the combined information as personally identifiable information obtain personally identifiable and/or Non-Personally Identifying Information from third parties such as our affiliates, service providers, brokers, tenants, suppliers, vendors, merchants, licensors, or other sources (e.g., offline records or publicly available information). We may combine Personal Information we collect with information that we obtain from our affiliates, brokers, tenants, suppliers, vendors, merchants, licensors, or other sources (e.g., offline records or publicly available information). We will treat any such combined information as Personal Information.
SCP automatically receives and records Non-Personally Identifying Information on our server logs from your browser as well as through other analysis of the Sites. We also may collect information using cookies, web beacons, pixels, gifs, tags or other technologies (“Collection Technology”), or through third parties using similar technologies. Collection Technology may operate as a piece of data stored on your browser or device, or may identify, compile, aggregate and/or collect information through other means. When you visit a Site, your web browser may use Collection Technology to better enable you to navigate the Sites during your visit and upon your return. You may use the Sites even if you choose to reject or delete certain Collection Technology. Collection Technology also may be used by some of the other websites for which a link is placed on a Site. We may combine this Non-Personally Identifying Information with Personal Information, and, if so, will treat the combined information as Personal Information.
The Sites may use Google Analytics. Google Analytics uses Collection Technology to collect and store anonymous information about you, which may include the Non-Personally Identifying Information described above. For more information about Google Analytics follow this link. You can opt-out from being tracked by Google Analytics in the future by downloading and installing Google Analytics’ Opt-out Browser Add-on for your current web browser by following this link. The Site may use certain features of Google Analytics based on Display Advertising, such as:
- “Demographics and Interest Reporting” to analyze information regarding the interests and demographics of users of the Site. We use such Non-Personally Identifying Information in the same manner as we use other Non-Personally Identifying Information as described below.
- “Remarketing with Google Analytics” to place ads on other sites directed to people who have visited the Site.
- “Google Display Network Impression Reporting” to report how people’s interactions with our ads relate to their visits to the Site.
- Integrated services that require Google Analytics to collect data via advertising cookies and identifiers.
- To provide information to third parties that may provide you with general or personalized content and advertising about their stores, restaurants, Activities, products and services.
- To alert you to new features, terms, Activities, stores, restaurants, products or services.
- To send emails or newsletters, and to provide you with general or personalized content in the newsletters.
- To monitor and analyze information regarding your browsing and viewing preferences.
- To analyze our users’ and visitors’ demographics and interests.
- To plan, improve, and administer Activities.
- To process and respond to your inquiries.
- To administer, support, operate or improve the Sites or the Wi-Fi services.
- To promote and improve the services we offer.
- To monitor activity at the South Coast Plaza shopping center.
- For the purposes for which you provided the information.
- For Fraud prevention, security, internal operations, legal compliance, and other public purposes.
- To alert you to other information regarding SCP or any of the foregoing via email, direct mail, telephone or other means.
In addition to the uses discussed above, SCP may use Non-Personally Identifying Information in any manner so long as SCP uses such information in its de-identified form. These uses may include, without limitation, uses for administration of the Sites; analysis of website trends and how the Sites are used; improving navigation of the Sites; analysis of the performance of the Sites and diagnosis of problems; improving the services we offer; analysis and developing advertisements and advertising campaigns; and providing you with special offers and promotions and determine the effectiveness of same.
5. HOW WE RESPOND TO “DO NOT TRACK” SIGNALS
SCP does not alter the practices detailed herein based upon your selection of the “Do Not Track” setting or other “opt-out” setting or feature that may be offered by your browser; however, SCP reserves the right to do so in the future.
6. COMMUNICATIONS WITH YOU
You authorize SCP to transmit email to you to respond to your communications, promote our services and administer Events. If we send any emails to promote our services, instructions to unsubscribe will be included in each such promotional email from SCP. Please note that such requests may take up to ten (10) days to become effective. You may not opt out of receiving communications regarding your dealings with SCP, or the Sites or technical information about the same.
7. INFORMATION SHARING WITH THIRD PARTIES
We also may use and share Non-Personally Identifying Information with third parties. Additionally, we may take Personal Information and de-identify it and share it in a de-identified or aggregated form with advertisers, business partners, and/or third parties. If we do so, we will ask our contracting parties to agree to keep the data in its de-identified form.
The site may also contain plugins for social media websites, such as Facebook, Twitter, Instagram, WeChat and Weibo. We recommend reviewing the privacy policies that apply to these plugins, prior to clicking on such plugins. purposes.
9. PROTECTION OF PERSONALLY IDENTIFIABLE INFORMATION
SCP uses reasonable administrative, physical and electronic security measures to protect against the loss, misuse and alteration of Personal Information. No transmission of data over the internet is guaranteed to be completely secure. It may be possible for third parties not under the control of SCP to intercept or access transmissions or private communications unlawfully. While we strive to protect Personal Information, neither SCP nor our service providers can ensure or warrant the security of any information you transmit to us over the internet. Any such transmission is at your own risk.
Information collected by SCP may be stored and processed by or for SCP, or shared with third parties, in the United States in accordance with the laws of the United States, or in other jurisdictions. By using the Sites or Wi-Fi services, or by submitting your Personal Information to SCP online or offline, you expressly consent to the storage, processing and sharing of your Personal Information in the United States in accordance with the laws of the United States, or in other jurisdictions.
10. UPDATING YOUR INFORMATION
You are responsible for keeping your information current. You may update your information by contacting us at email@example.com. We will use reasonable efforts to process any change you make; provided, however, that requests to delete information are subject to SCP’s internal reporting, processing and retention policies and all applicable legal obligations.
11. NOTICE OF PRIVACY RIGHTS OF CALIFORNIA RESIDENTS
- Right to know about Personal Information collected, disclosed, or sold
You have the right to request that we provide certain information to you about our collection and use of your Personal Information over the past twelve (12) months. Specifically, you have the right to request disclosure of the categories of Personal Information and specific pieces of Personal Information we have collected about you over the last 12 months. Upon the submission of a verifiable consumer request we will disclose to you:
- the categories of Personal Information we collected about you;
- the categories of sources from which Personal Information was collected;
- the business or commercial purpose for collecting Personal Information;
- the business or commercial purpose for disclosing or selling Personal Information; and
- the categories of third parties with whom we sold or disclosed the category of Personal Information for a business purpose.
We will also provide the specific pieces of Personal Information we collected about you, subject to certain exceptions under applicable law, if you also request access to such information.
- Right to request deletion of Personal Information
If you are a California resident, you also have the right to request that we delete any of your Personal Information that we collect or maintain about you, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will conduct a reasonable search of our records in order to locate any Personal Information we have collected about you that is eligible for deletion, and delete such Personal Information. To the extent we have shared any Personal Information collected about you with service providers that is eligible for deletion, we will direct those service providers to delete that Personal Information as well. SCP may not be able to comply entirely with your request to delete all of your Personal Information as set forth under the CCPA. Specifically, we are not required to delete any Personal Information we have collected about you that is necessary for us and our service provider(s) to:
- Complete the transaction for which the Personal Information was collected, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, provide a good or service requested by you, or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract between SCP and you.
- Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity.
- Debug to identify and repair errors that impair existing intended functionality.
- Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law.
- Comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code.
- Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when our deletion of the information is likely to render impossible or seriously impair the achievement of such research, if you have provided informed consent.
- Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us.
- Comply with a legal obligation, such as retaining records for a period of time as set out in local, state, or federal laws.
- Otherwise use your Personal Information, internally, in a lawful manner that is compatible with the context in which you provided your information.
Following a deletion request, any Personal Information about you that was not deleted from our systems due to the above exceptions will only be used for the purposes provided for by the applicable exceptions.
- Right to opt-out of sale of Personal Information
If you are a California resident and SCP sells or discloses Personal Information about you to third parties, you may have the right to request that SCP not sell your Personal Information.
To exercise the right to opt-out, you (or your authorized representative) may submit a request to us by visiting the following Internet Web page link:
Once you make a verified opt-out request, we will wait at least twelve (12) months before asking you to reauthorize Personal Information sales. However, if at a later time, you wish to allow us to sell your Personal Information to third parties, you must opt-in to such sharing, and may be do so by contacting us at firstname.lastname@example.org. If a transaction requires the sale or transmission of your Personal Information in order to complete the transaction, we will notify you and provide instructions on how you can opt-in.
- Right to non-discrimination for the exercise of a consumer’s privacy rights
We will not discriminate against you for exercising any of your privacy rights. Unless permitted by applicable law, we will not: (i) deny you goods or services; (ii) charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties; (iii) provide you a different level or quality of goods or services; or (iv) suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.
- Exercising your California privacy rights
You do not need to create an account with us to exercise your CCPA rights. To exercise the CCPA rights described above, please submit a verifiable consumer request to us by either:
- Calling 1-800-782-8888 or Emailing email@example.com.
Only you, the person to whom you have given power of attorney, or an otherwise authorized agent registered with the California Secretary of State, may make a verifiable consumer request related to your Personal Information. However, you may make a verifiable consumer request on behalf of your minor child. Additionally, you may only make a verifiable consumer request for access twice within a 12-month period.
Your verifiable consumer request must provide sufficient information that allows us to reasonably verify that you are the person about whom we collected Personal Information or an authorized representative. We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. While we may ask for Personal Information to verify the requestor or consumer’s identity when making a request, we will only use that Personal Information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.
- Response timing and format
We will make our best effort to respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. Within ten (10) days of receiving the request, we will confirm receipt and provide information about our verification and processing of the request. SCP will maintain records of consumer requests made pursuant to CCPA as well as our response to said requests for a period of at least twenty-four (24) months.
If you have an account with us, we may require you to take delivery of our written response through that account. If you do not have an account with us, we will deliver our written response electronically, though you may alternatively choose to receive delivery by mail. The response will also explain the reasons we cannot comply with a request, if applicable. Requests for the specific pieces of information that we have collected about you will be sent in a portable, readily useable format that you may transmit to another entity without hindrance.
We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
- Your rights under “Shine the Light”
In addition to your rights under the CCPA, California Civil Code Section 1798.83 permits California residents to request information regarding our disclosure, if any, of their Personal Information to third parties for their direct marketing purposes. If this applies, you may obtain the categories of Personal Information shared and the names and addresses of all third parties that received Personal Information for their direct marketing purposes during the immediately prior calendar year (e.g., requests made in 2020 will receive information about 2019 sharing activities). You may also request that we do not share your Personal Information with third parties for their direct marketing purposes. To make such requests, send an email to firstname.lastname@example.org, specifying that you seek your “California Customer Choice Privacy Notice.” Please allow thirty (30) days for a response. Please note that not all information sharing is covered by the “Shine the Light” law requirements and only information on covered sharing will be included in our response.
When contacting us, please indicate your name, address, email address, and what Personal Information you do not want us to share with third parties for their direct marketing purposes. Please note that there is no charge for controlling the sharing of your Personal Information or for processing this request.