Privacy Policy

Cardinal Group Holdings, LLC

Privacy Policy

Last Updated: April 03, 2024

Thank you for visiting an online service or site that posts a link to this Privacy Policy (“Service”) owned or operated by Cardinal Group Holdings, LLC. or one of its Affiliates (defined below) (“Cardinal”, “we”, or “us” or “our”). This Privacy Policy will provide you with information as to how Cardinal collects, uses, and discloses information about you, including the choices Cardinal offers with respect to that information, and applies to your use of any Service, regardless of how you access or use it. It does not apply to Cardinal’s data collection activities offline or otherwise outside of the Service (unless otherwise stated below or at the time of collection). For certain Services, there may be additional notices about information practices and choices. Please read those additional privacy disclosures to understand how they apply to you.

By visiting or otherwise using the Service, you agree to the Service’sTerms of Useand consent to Cardinal’s data collection, use, and disclosure practices, and other activities as described in this Privacy Policy, and any additional privacy statements that may be posted on an applicable part of the Service. If you do not agree and consent, please discontinue use of the Service, and uninstall any Service downloads and applications.

1. INFORMATION WE COLLECT
2. Information about You that You Provide.
   Cardinal, and/or its Service Providers (defined below), will collect information you provide directly to Cardinal and/or its Service Providers via the Service.

For example, Cardinal collects information when you apply for a residence on the Service, subscribe to notifications, post on the Service, participate in promotional activities, or communicate or transact through the Service. In addition, when you interact with Third-Party Services (defined below), you will provide information to those third parties.

Information that Cardinal, its Service Providers and/or Third-Party Services collects includes: (1) personally identifiable information, which is information that identifies you personally, such as your first and last name, e-mail address, phone number, address, Social Security number, government-issued identification number, education or employment information, criminal history, vehicle information, and full payment account number (“Personally Identifiable Information”or “PII”); (2) demographic information, such as your gender, age, and zip code (“Demographic Information”); and (3)commercial information such as your apartment preferences, desired budget, lease term, move-in date, and any additional information you wish to provide (“Commercial Information”).

Personally Identifiable Information, including, without limitation, Cardinal-Collected PII (defined below), once“De–identified”(i.e., the removal or modification of the personally identifiable elements, or the extraction of non-personally identifiable elements including through anonymization, pseudonymization, and/or hashing) is non-Personally Identifiable Information and may be used and shared without obligation to you, except as prohibited by applicable law. To the extent any non-Personally Identifiable Information, or PII collected outside of the Service, is combined by or on behalf of Cardinal with Personally Identifiable Information Cardinal itself collects directly from you on the Service (“Cardinal–Collected PII”), Cardinal will treat the combined data as Cardinal-Collected PII under this Privacy Policy. The definition of “personal information” under California law differs from the definition of PII used in this Privacy Policy. California consumers can learn more about their privacy rightsbelow.

1. Information Collected Automatically. Cardinal, its Service Providers, and/or Third-Party Services also automatically collect certain information about you when you access or use the Service (“Usage Information”). Usage Information includes IP address, device identifier, browser type, operating system, and similar information about your use of the Service. Except to the extent required by applicable law, or to the extent Usage Information is combined by or on behalf of Cardinal with Cardinal-Collected PII, Cardinal does not consider Usage Information (including, without limitation, unique device identifiers) to be Personally Identifiable Information or Cardinal-Collected PII.

The methods used on the Service to collect Usage Information include:

• Log Information: Log information is data about your use of the Service, such as IP address, browser type, Internet service provider, referring/exit pages, operating system, date/time stamps, and related data, and is stored in log files.
• Information Collected by Cookies and Other Tracking Technologies:Cookies, web beacons, pixels, embedded scripts, location-identifying technologies, device recognition technologies, device and activity monitoringand other tracking technologies now and hereafter developed (“Tracking Technologies”) will be used to collect information about interactions with the Service or e-mails, including information about your browsing behavior.

• Cookies: A cookie is a small text file that is stored on a user’s device, such as session ID cookies or tracking cookies. Session cookies make it easier for you to navigate the Service and expire when you close your browser. Tracking cookies remain longer and help in understanding how you use the Service and enhance your user experience. Cookies may remain on your device for an extended period. To identify certain types of local shared objects on your device and adjust your settings, please visit:www.macromedia.com settings manager. The Service may associate some or all these types of cookies with your devices. To opt out of the collection of Personally Identifiable Information, you may also use our cookie manager here.

1. Information Cardinal Collects From Other Sources. Cardinal also obtains information about you from other sources, including Service Providers and Third-Party Services, and combine that with Cardinal-Collected PII. Notwithstanding anything to the contrary, except to the extent such data is combined by or on behalf of Cardinal with Cardinal-Collected PII, this Privacy Policy is not intended to limit Cardinal’s activities regarding such third party-sourced, or non-Service-sourced, information (including Personally Identifiable Information), and such data will only be treated as Cardinal-Collected PII to the extend it is combined with Cardinal-collected PII. Cardinal is not responsible or liable for the accuracy of the information provided by third parties or for third party policies or practices.

HOW WE USE THE INFORMATION WE OBTAIN

Cardinal uses information about you, including Cardinal-Collected PII and other Personally Identifiable Information, for any purposes not inconsistent with Cardinal’s statements under this Privacy Policy, or otherwise made by us in writing at the point of collection, and not prohibited by applicable law, including, without limitation, the following:

• Allow you to participate in the features we offer on the Service;
• Facilitate, manage, personalize, and improve your online experience;
• Process your application and manage your residence;
• Transact with you, provide services or information you request, respond to your comments, questions, and requests, serve you content and/or advertising, and send you notices;
• Cardinal Affiliates’ marketing;
• Improve the Service and for any other internal business purposes;
• Tailor our content, advertisements, and offers;
• Fulfill other purposes disclosed at the time you provide Personally Identifiable Information or otherwise where we are legally permitted or are required to do so;
• Provide additional Services you request, such as insurance, maintenance, or financial assistance, subject to your consent; and
• Prevent and address fraud, breach of policies or terms, and threats or harm.

Information we disclose to third parties

Except as restricted by applicable law, this Privacy Policy, or any other representation Cardinal makes to you, Cardinal shares non-Personally Identifiable Information, and Personally Identifiable Information that is not deemed Cardinal-Collected PII hereunder (provided that Cardinal is aware of no restrictions of Cardinal’s use, if any), with third parties and Cardinal parent, sibling, or subsidiary companies (each an “Affiliate”) for any purpose. Without limiting the generality of the foregoing, we and third parties may convert your Personally Identifiable Information, including Cardinal-Collected PII, to non-Personally Identifiable Information, including without limitation through hashing it or substituting a unique identifier for the Personally Identifiable Information and we and third parties use and share that data as permitted by applicable law, including to match data attributes to and from other sources. Any such third-party activities are subject to their privacy policies and practices. Cardinal’s sharing of Cardinal-Collected PII is subject to the following:

• Marketing: Subject to your communications choices and other privacy rights detailed herein and provided by applicable law, we will use your Personally Identifiable Information to send you marketing communications. Cardinal will not share your Cardinal-Collected PII with third parties, other than Affiliates, for their own direct marketing purposes, except in connection with Corporate Transactions (defined below) absent your consent (which may be by means of third party interaction described in the next bullet point).
• Transactional Communications: When you apply for a lease with Cardinal, an Affiliate, or a third party owner to whom Cardinal provides services, third parties assist with our communications to you, including by SMS (if you have opted-in to receive SMS communications) and email. You may opt out of some of those communications at any time as described below, but you may still receive communications about your lease or Services you request.
• Your Disclosure or Consent: When you request additional Services, we will share some of your PII with third party partners and Service Providers who assist us with those services. For example, if you request maintenance services, we will share your information with a Service Provider that coordinates our maintenance services; if you request insurance or financial assistance, such as a guarantor alternative, we will share your relevant PII with third parties and Service providers.Though we will notify you and procure any legally required consent at the time of such collection and sharing, such data receipt and collection is subject to the privacy and business practices of that other party, not Cardinal.

Cardinal will also share any information about you (including, without limitation, Cardinal-Collected PII) for any purposes not inconsistent with this Privacy Policy, or our written statements at the point of collection, and otherwise not prohibited by applicable law, including, without limitation:

• Cardinal’s contractors, vendors, consultants, and other service providers (collectively “Service Providers”) will receive, or be given access to, your information, including, without limitation, Personally Identifiable Information, Demographic Information, Commercial Information, and Usage Information, in connection with their work on Cardinal’s behalf, provided however, Cardinal does not authorize its Service Providers to use Cardinal-Collected PII provided by Cardinal to the Service Providers to send you direct marketing messages other than related to Cardinal and Cardinal Affiliates absent your consent.
• To comply with the law, law enforcement or other legal process, and, where permitted, in response to a government request; and
• If Cardinal believes your actions are inconsistent with Cardinal’s terms of use, lease, applicable terms or policies, or to protect the rights, property, life, health, security and safety of Cardinal, the Service or its users, or any third party.

In addition, Cardinal may disclose your Cardinal-Collected Personally Identifiable Information (as well as your other Personally Identifiable Information and your non-Personally Identifiable Information), in connection with or during negotiations of any proposed or actual financing of our business, or merger, purchase, sale, joint venture, or any other type of acquisition or business combination of all or any portion of Cardinal assets, or transfer of all or a portion of Cardinal’s business to another company, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding (each a “Corporate Transaction”).

Third-Party Services, Social Features, Advertising, And Analytics

The Service at times includes hyperlinks to, or include on or in connection with, the Service, such as plug-ins, websites, locations, platforms, applications, or services operated by third parties (“Third–Party Service(s)”). These Third-Party Services use their own cookies, web beacons, and other Tracking Technology to independently collect information about you and solicit Personally Identifiable Information from you.

Certain functionalities on the Service permit interactions that you initiate between the Service and certain third-party social networks (“Social Features”).If you use Social Features, and potentially other Third-Party Services, information you post or provide access to may be publicly displayed by the Third-Party Service that you use. Similarly, if you post information on a third-party service that references the Service (e.g., by using a hashtag associated with Cardinal or Cardinal Affiliates in a tweet or status update), your post may be used on or in connection with the Service or otherwise by Cardinal and Cardinal Affiliates. Also, both Cardinal and the third party may have access to certain information about you and your use of the Service and any Third-Party Service.

Cardinal uses Google Analytics or other Service Providers for analytics services. These analytics services use cookies and other Tracking Technologies to help Cardinal analyze Service users and how they use the Service. Information generated by these services (e.g., your IP address and other Usage Information) may be transmitted to and stored by these Service Providers on servers in the U.S. (or elsewhere) and these Service Providers use this information for purposes such as evaluating your use of the Service, compiling statistic reports on the Service’s activity, and providing other services relating to Service activity and other Internet usage.

Cardinal is not responsible for, and makes no representations regarding, the policies or business practices of any third parties, including, without limitation, analytics Service Providers and Third-Party Services associated with the Service, and encourages you to familiarize yourself with and consult their privacy policies and terms of use.

Data Security and Monitoring

Cardinal takes reasonable measures designed to protect Cardinal-Collected PII from loss, theft, misuse and unauthorized access, disclosure, alteration, and destruction. Nevertheless, transmission via the Internet and online digital storage are not completely secure and Cardinal does not guarantee the security of your information collected through the Service.

To help protect you and others, Cardinal and its Service Providers may (but make no commitment to) monitor use of the Service, and collect and use related information including Cardinal-Collected PII and other Personally Identifiable Information for all purposes not prohibited by applicable law or inconsistent with this Privacy Policy, including, without limitation, to identify fraudulent activities and transactions; prevent abuse of, and investigate and/or seek prosecution for, any potential threats to or misuse of the Service; ensure compliance with Terms of Useand this Privacy Policy; investigate violations of or enforce these documents; improve the Services and your Services experiences, and to protect the rights and property of Cardinal, third parties, and other users. Monitoring may result in the collection, recording, and analysis of online activity or communications through our Service.

International Transfer

Cardinal is based in the U.S. and the information Cardinal and its Service Providers collect is governed by U.S. law. If you are inthe European Union (EU), European Economic Area (EEA), and/or Switzerland, please note that Company does not intend to offer goods and services (including the Services) to EU, EEA, or Swiss individuals. If you are accessing the Service from outside of the U.S., please be aware that information collected through the Service will be transferred to, processed, stored, and used in the U.S. Data protection laws in the U.S. may be different from those of your country of residence. Your use of the Service or provision of any information therefore constitutes your consent to the transfer to and from, processing, usage, sharing, and storage of your information, including Personally Identifiable Information, in the U.S. as set forth in this Privacy Policy.

Children’s Privacy

The Service is intended for a general audience and not directed to children less than sixteen (16) years of age. We do not knowingly collect Personal Information from children under the age of sixteen (16) without authorization by a holder of parental responsibility. If you believe we have Personal Information of your child without your consent as prescribed by COPPA, please contact us immediately.

Choices: Tracking and Communications Options

Tracking Technologies Generally. Regular cookies may generally be disabled or removed by tools available as part of most commercial browsers, and in some instances blocked in the future by selecting certain settings. Browsers offer different functionalities and options, so you may need to set them separately. Also, tools from commercial browsers may not be effective with regard to Flash cookies (also known as locally shared objects), HTML5 cookies, or other Tracking Technologies. For information on disabling Flash cookies, go to Adobe’s websitehelpx.adobe.com/. Please be aware that if you disable or remove these technologies, some parts of the Service may not work and that when you revisit the Service your ability to limit browser-based Tracking Technologies is subject to your browser settings and limitations.

Your browser settings may allow you to automatically transmit a “Do Not Track” signal to online services you visit. Like many online services, Cardinal currently does not alter Cardinal’s practices when Cardinal receives a “Do Not Track” signal from a visitor’s browser. To find out more about “Do Not Track,” you can visitwww.allaboutdnt.com.For specific information on some of the choice options offered by third party analytics and advertising providers, see the next section.

Analytics and Advertising Tracking Technologies. You can exercise choices regarding the use of cookies from Google Analytics by going toAnalytics Opt Outor downloading the Google Analytics Opt-out Browser Add-on. You can exercise choices regarding the use of cookies from Adobe Analytics by going toAdobe Opt Outunder the section labeled “Website Preferences.”

You may choose whether to receive some Interest-based Advertising by submitting opt-outs. Some of the advertisers and Service Providers that perform advertising-related services on the Service may participate in the Digital Advertising Alliance’s (“DAA”) Self-Regulatory Program for Online Behavioral Advertising. To learn more about how you can exercise certain choices regarding Interest-based Advertising, including use of Cross-device Data for serving ads, visitaboutads.info/choices, andaboutads.info/appchoicesfor information on the DAA’s opt-out program specifically for mobile apps (including use of precise location for third party ads). Some of these companies may also be members of the Network Advertising Initiative (“NAI”). To learn more about the NAI and your opt-out options for their members, seenetworkadvertising.org/choices/. Please be aware that, even if you opt out of certain kinds of Interest-based Advertising, you may continue to receive other types of ads. Opting out only means that those selected members should no longer deliver certain Interest-based Advertising to you but does not mean you will no longer receive any targeted content and/or ads (e.g., from other ad networks). Also, if your browsers are configured to reject cookies when you visit these opt-out webpages, or you subsequently erase your cookies, use a different device or web browser or use a non-browser-based method of access (e.g., mobile app), your NAI / DAA browser-based opt-out may not, or may no longer, be effective.Cardinal is not responsible for effectiveness of, or compliance with, any third-parties’ opt-out options or programs or the accuracy of their statements regarding their programs.

Communications. You can opt out of receiving certain promotional communications (emails or text messaging) from Cardinal at any time by (i) for promotional e-mails, following the instructions provided in emails to click on the unsubscribe link, or if available by changing your communication preferences by logging onto your account; (ii) for text messages, following the instructions provided in text messages from Cardinal; and (iii) for app push notifications turn off push notifications on the settings of your device and/or the app, as applicable. Please note that your opt-out is limited to the e-mail address or phone number used and will not affect subsequent subscriptions. If you opt-out of only certain communications, other subscription communications may continue. Even if you opt out of receiving promotional communications, Cardinal may, subject to applicable law, continue to send you non-promotional communications, such as those about your lease, transactions, or maintenance.

California Residents

This California Privacy Notice (“Notice”) is provided pursuant to the California Consumer Privacy Act, as amended (the “CCPA”), and describes how and why Cardinal, its affiliates, and subsidiaries (collectively, “Cardinal”) collects, uses, and discloses Personal Information of California consumers (“you”), the rights afforded to you by the CCPA, and how to exercise those rights. This Notice does not apply to California job applicants, current and former employees, contractors, or beneficiaries. If you are a California consumer and interacted with us in one of these capacities, please contact us as provided below for more information.

As used in this Notice, the term “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you, excluding information that might only relate to your household. Personal information does not include information that is publicly available, de-identified, or aggregated.

Unless otherwise noted, the disclosures in this Notice cover our activities in the twelve (12) months prior to July 1, 2023, as well as our current practices. California law defines a “sale” as disclosing a California resident’s personal information to a third party for monetary or other valuable consideration. Where such disclosure is for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, it qualifies as “sharing” under California law. The table below describes how we “sell” and “share” personal information.

Collection, Use, and Disclosure of Personal Information

Cardinal collects, uses, and discloses Personal Information for business purposes consistent with applicable laws as identified below. Where we transfer applicable Personal Information to third-party recipients, such as our service providers and clients, we do so for the same business purposes described below.

Sources of Personal Information

We collect the Personal Information identified above from the following sources:

• Directly from you. For example, during the purchase or rental application process, through our websites or online systems, and other processes where you submit Personal Information to us.
• Automatically when using our digital services or visiting our premises. For example, when you use our websites or online services, and when you access our buildings.
• Cardinal Affiliates. For example, we receive Personal Information from our Affiliates, as permitted, to enable us to manage our business.
• Party to a Corporate Transaction. As permitted by law, we may receive Personal Information as part of a Corporate Transaction.
• Business partners. We receive information about you from service providers, business partners, building owners, or vendors.

Disclosing Your Personal Information

We disclose each of the categories of Personal Information identified above to the respectively identified categories of recipients for operational or business purposes consistent with the purposes for collection or use designated, as is reasonably necessary and proportionate to achieve those purposes, or for another purpose that is compatible with the context in which the Personal Information was collected including, but not limited to:

• Auditing ads;
• Helping to ensure security and integrity;
• Debugging, repairing, and improving functionality;
• Short-term, transient use;
• Performing services on our behalf;
• Providing advertising and marketing services, as applicable;
• Internal research for technological development; and
• Verifying quality and/or safety.

In addition to the other purposes for collection, use, and disclosure of Personal Information described in this Notice, we collect, use, and disclose Personal Information as required by law, regulation or court order; to respond to governmental and/or law enforcement requests; to identify, contact or bring legal action against someone who may be causing injury to or interfering with our or others’ rights or property; to support any actual or threatened claim, defense or declaration in a case or before any jurisdictional and/or administrative authority, arbitration or mediation panel; or in connection with disciplinary actions/investigations. Likewise, we may use and disclose Personal Information to other parties in connection with a sale or assets or stock, assignment, merger, reorganization, or other transfer of Cardinal.

Data Retention

We generally maintain Personal Information according to our retention obligations and policies, operational business purposes, and other legal and regulatory requirements. We discard this Personal Information when reasonably practicable.

We keep the categories of Personal Information described above for as long as is necessary for the purposes described in this Notice or otherwise authorized by law. This generally means holding the information for as long as one of the following apply:

• Your Personal Information is reasonably necessary to manage our operations, to manage your relationship with us, or to satisfy another purpose for which we collected it;
• Your Personal Information is reasonably necessary to carry out a disclosed purpose that is reasonably compatible with the context in which it was collected;
• Your Personal Information is reasonably required to protect or defend our rights or property (which will generally relate to applicable laws that limit actions in a particular case);
• We are otherwise required or permitted to keep your Personal Information by applicable laws or regulations.

Where your Personal Information is used for more than one purpose, we will retain it until the purpose with the latest period expires.

Sales and Sharing of Personal Information

In the above chart, we disclose our sale and sharing of Personal Information, as defined under the CCPA, in the past 12 months.

We sell and/or share Personal Information with third parties for advertising purposes. The third parties to whom this Personal Information is sold and/or shared are advertisers and analytics vendors.

California residents may opt out of sales and sharing of your Personal Information as set forth in the “Right to Opt Out of Sales and Sharing of Personal Information” section below.

We do not have actual knowledge that we sell or share the personal information of consumers under sixteen (16) years of age.

California Privacy Rights

If you are a resident of California, you have the right to submit certain requests relating to your Personal Information as described below. To exercise any of these rights, please email us atdataprivacyrequest@cardinalgroup.com, at this webform, or call us at 303-407-4500.

If you make a privacy request, we may take steps to verify your identity before responding to your request. You may designate an authorized agent to make a request on your behalf. You may make such a designation by providing the agent with written permission to act on your behalf. As permitted by law, we may take steps to verify your own identity in response to a request even if you choose to use an agent.

Right to Know.You have the right to know what categories of Personal Information we have collected about you, sources of that information, business purposes for such collection and selling and/or sharing, categories of any Personal Information sold or shared, categories of recipients of your Personal Information, and the specific pieces of Personal Information we have collected about you.

Right to Delete Your Personal Information.You have the right to request that we delete Personal Information we collected from you, subject to certain exceptions prescribed by law.

Right to Correct Inaccurate Information.If you believe the Personal Information we maintain about you is inaccurate, you have the right to request that we correct that information.

Right to Opt Out of Sales and Sharing of Personal Information.You have the right to opt out of the sale of your Personal Information and to request that we do not share your Personal Information for cross-context behavioral advertising. To opt out, see here.

Right to Limit Use and Disclosure of Sensitive Personal Information.We do not use or disclose sensitive Personal Information for purposes to which the right to limit use and disclosure applies under the CCPA.

Right to Non-Discrimination for the Exercise of Your Privacy Rights.If you choose to exercise any of your privacy rights under the CCPA, you also have the right not to receive discriminatory treatment by us.

Right to Access. You have the right to access the Personal Information that we or our Service Providers hold about you, in a readily useable format that allows the consumer to transmit your Information to another entity.

Third Party Marketing and Your California Privacy Rights

California’s “Shine the Light” law permits California residents to request certain information regarding our disclosure of Personal Information to third parties or affiliates for their own direct marketing purposes. We do not share Personal Information with third parties or affiliates for those third parties’ or affiliates’ own direct marketing purposes. Californians may request information about our compliance with this law by contacting us as provided below.

Changes to This Privacy Policy

We reserve the right to change this Privacy Policy prospectively effective upon the posting of the revised Privacy Policy. We will change the “Last Updated” date above and may notify you using other means such as through your account or via email. Your use of our Service indicates your consent to the privacy policy posted at the time of use. However, we will not treat your previously collected Cardinal-Collected PII, to the extent it is not collected under the new privacy policy, in a manner materially different than represented at the time it was collected without your consent.

Contact Us

For more information on our privacy practices, please email us atdataprivacyrequest@cardinalgroup.com, call us at 303-407-4500, or write to us at:

Cardinal Group Holdings, LLC

Attn: Privacy

4100 E Mississippi Ave, #700

Denver, CO 80246

© Cardinal Group Holdings, LLC 2024. All Rights Reserved.