Privacy Policy - American Assets Trust

PRIVACY POLICY

(Effective January 1, 2023)

PLEASE READ THE FOLLOWING PRIVACY POLICY CAREFULLY:

You have reached a website owned and operated by American Assets Trust, Inc. (collectively, including its affiliates and subsidiaries, AAT , or we , or us , or our ). By accessing and using our website and related links ( Website ), you agree to be bound to the following privacy policy.

Privacy Notice

This notice reflects our good faith understanding of the law and our data practices as of the effective date posted (set forth above), but the California Consumer Privacy Act ( CCPA ) implementing regulations are not yet final and there remain differing interpretations of the law. Accordingly, we may from time-to-time and at least annually update information in this and other notices regarding our data practices and your rights, modify our methods for responding to your requests, and/or supplement our response to your requests, as we continue to develop our compliance program to reflect the evolution of the law and our understanding of how it relates to our data practices.

This California Privacy Notice ( Notice ) applies to Consumers as defined by the CCPA as a supplement to American Assets Trust, Inc. s (collectively, including its affiliates and subsidiaries, AAT , or Company or we , or us , or our ) other privacy policies or notices. In the event of a conflict between any other Company policy, statement or notice including, without limitation, the Terms of Use, and this Notice, this Notice will prevail as to California Consumers and their rights under the CCPA. Please see also any privacy policy or notice of general applicability posted or referenced on our websites, leases, community handbooks and properties including, without limitation, www.americanassetstrust.com.

This Notice covers the collection, use, disclosure, sale, and sharing for cross-context behavioral advertising of California Consumers Personal Information (or PI ) as defined by the CCPA, except to the extent such PI is exempt from the notice obligations of the CCPA. This Notice also covers rights California Consumers have under the CCPA, as well other notices to Californians required by other laws. Publicly available information is not treated as PI under the CCPA, so this notice is not intended to apply to that data and your Consumer privacy rights do not apply to that data.

Terms defined in the CCPA that are used in this Notice shall have the same meaning as in the CCPA.

PI We Collect

Over the last twelve months, we have collected PI about California Consumers, including the following:

Category of PI	Examples of PI	Sources of PI	Business or Commercial Purposes for PI Collection
Identifiers	This may include but is not limited to: name, driver s license or state ID number, postal address, Internet Protocol address, Social Security number or national identification number and details, passport number, email address, prior address, signature, or other similar identifiers.	You Your email and social media accounts; Your devices; From other individuals, such as friends or family; Publicly-available information; Consumer reporting agencies; Third parties (e.g., data brokers, background check services); Vendors.	Delivering products or services; Analytics; Marketing; Security and fraud prevention; Debugging; Research and development; Quality assurance.
Personal Records	This may include information such as: account number and password, application and claims history, financial account information, resident names, contact information, payment card number, credit history, criminal history, date of birth, driving citations, emergency contact details, insurance policy information, or social media account details, status as victim of domestic violence, assault, or stalking.	You; Business partners; Your email and social media accounts; Chat logs; From other individuals, such as friends or family; Publicly-available information; Consumer reporting agencies; Contractors or consultants; Third parties (e.g., data brokers, background check services); Vendors.	Delivering products or services; Analytics; Marketing; Security and fraud prevention; Debugging.
Protected Consumer Characteristics	This may include, but is not limited to: age, citizenship status, disability or medical condition, gender, gender identity and gender expression, marital status, military or veteran status.	You; Business partners (non-vendors); Contractors or consultants; Publicly-available government data; Third parties (e.g., data brokers, background check services); Vendors.	Delivering products or services; Analytics; Marketing; Security and fraud prevention; Legal Compliance; Debugging.
Customer Account Details / Commercial Information	This may include, but is not limited to: account profiles, records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	You.	Delivering products or services; Analytics; Marketing; Research and development.
Internet Usage Information	This may include, but is not limited to: website history, browsing time, and information regarding your interaction with an Internet Web site, application, or advertisement.	You; Your email and social media accounts; Chat logs; Vendors.	Delivering products or services; Debugging; Security and fraud prevention; Analytics; Marketing.
Professional or Employment Information	This may include, but is not limited to: benefits and entitlements data, bonus payments, business unit / division, company / entity, compensation data, contract type - fixed term / temporary / permanent etc., corporate credit or debit card numbers, hours of work, job application details (e.g. application form, interview notes, references), job title / role, line / reporting manager, office location, personnel number, previous work history, qualifications / certifications, reference or background checks, salary / wage, salary / wage expectation, start date.	You; Consumer reporting agencies; Your email or social media accounts; Chat logs; Publicly-available government data; Third parties (e.g., data brokers, background check services)	Delivering products or services; Analytics; Advertising; Quality assurance.
Inferences from PI Collected	This may include, but is not limited to: inferences about abilities, attitudes, behavior, characteristics, predispositions, preferences.	You; Your email and social media accounts; Chat logs; From other individuals, such as friends or family.	Delivering products or services; Analytics; Marketing; Quality assurance; Research and development.

Sensitive PI	This may include, but is not limited to: PI that reveals government IDs; information providing access to a financial account; racial or ethnic origin; PI collected and analyzed concerning a consumer s health, sex life, or sexual orientation.	You; Business partners (non-vendors); Contractors or consultants; Publicly-available government data; Third parties (e.g., data brokers, background check services); Vendors.	Delivering products or services; Analytics; Marketing; Security and fraud prevention; Debugging; Research and development; Quality assurance.

As permitted by applicable law, we do not treat deidentified data or aggregate consumer information as PI and we reserve the right to convert, or permit others to convert, your PI into deidentified data or aggregate consumer information. We have no obligation to re-identify such information or keep it longer than we need it to respond to your requests.

Sources of PI

We may collect your PI directly from you, your devices, your email or social media accounts, or from business partners (non-vendors), consumer reporting agencies, contractors or consultants, other individuals, such as friends or family, third parties (e.g., data brokers, background check services), and vendors, as well as public sources of data such as government databases. For more specifics tied to each category of PI, see the chart above.

Collection and Use of PI

Generally, we collect, use and disclose your PI to provide you services and as otherwise related to the operation of our business. For more specific detail on our disclosures of PI, see the next section, Sharing of PI. We may collect, use and disclose the PI we collect for one or more of the following business purposes:

Providing Products or Services;

Processing Interactions and Transactions;

Managing Interactions and Transactions;

Research and Development;

Quality Assurance;

Security; and

Debugging.

Subject to restrictions and obligations of the CCPA, our vendors may also use your PI for some or all of the above listed business purposes.

We may collect, use and disclose your PI as required or permitted by applicable law. For more specifics tied to each category of PI, see the chart above.

Disclosure of PI and Retention Period

Over the last twelve (12) months, we may have disclosed PI with our service providers, and others, including without limitation as follows:

Category of PI	Categories of Third Parties	Business or Commercial Purpose for Disclosure	Retention Period
Identifiers	Legal counsel. Public authorities / government bodies. Service Providers	Delivering products or services (to perform services on behalf of AAT); Marketing; Analytics; Legal compliance; Quality assurance.	Records are retained for as long as is sufficient for the purpose for which is was collected as described herein, and complying with all applicable legal requirements.
Personal Records	Legal counsel; Public authorities / government bodies; Service Providers	Delivering products or services (to perform services on behalf of AAT); Marketing; Analytics; Legal compliance; Quality assurance.	Records are retained for as long as is sufficient for the purpose for which is was collected as described herein, and complying with all applicable legal requirements.
Protected Consumer Characteristics	Legal counsel; Public authorities / government bodies; Service Providers	Delivering products or services (to perform services on behalf of AAT); Marketing; Analytics; Legal compliance.	Records are retained for as long as is sufficient for the purpose for which is was collected as described herein, and complying with all applicable legal requirements.
Internet Usage Information	Service Providers	Delivering products or services (to perform services on behalf of AAT); Marketing; Analytics.	Records are retained for as long as is sufficient for the purpose for which the information was collected as described herein, to comply with all applicable legal requirements.
Geolocation Data	Service Providers	Delivering products or services (to perform services on behalf of AAT); Marketing; Analytics; Quality assurance.	Records are retained for as long as is sufficient for the purpose for which the information was collected as described herein, to comply with all applicable legal requirements
Sensory Data	Legal counsel; Service Providers	Delivering products or services (to perform services on behalf of AAT); Marketing; Analytics; Legal compliance; Quality assurance.	Records are retained for as long as is sufficient for the purpose for which the information was collected as described herein, to comply with all applicable legal requirements
Professional or Employment Information	Public authorities / government bodies; Legal counsel; Service Providers	Delivering products or services (to perform services on behalf of AAT); Quality assurance Research and Development; Marketing.	Records are retained for as long as is sufficient for the purpose for which the information was collected as described herein, to comply with all applicable legal requirements
Inferences from PI Collected	Legal Counsel Service Providers	Delivering products or services (to perform services on behalf of AAT); Marketing; Analytics; Quality assurance.	Records are retained for as long as is sufficient for the purpose for which the information was collected as described herein, to comply with all applicable legal requirements

Sensitive PI	Legal Counsel Service Providers	Delivering products or services (to perform services on behalf of AAT); Marketing; Analytics; Quality assurance.	Records are retained for as long as is sufficient for the purpose for which the information was collected as described herein, to comply with all applicable legal requirements

We do not disclose or use Sensitive PI outside of the permissible uses identified within the CCPA.

Notwithstanding anything to the contrary in our other privacy notices, we restrict use of your PI that is governed by the CCPA s Consumer rights provisions and is shared with our vendors for business purposes.

Sale and Share Under the CCPA

We do not sell or share (for cross-context behavioral advertising) your PI.

In addition, for more information about cookies and ways you can exercise preferences with respect to cookies, including certain types of interest-based advertising, see the Cookies section of our Privacy Policy above.

California Privacy Rights

We provide California Consumers the privacy rights described in this section. You have the right to exercise these rights via an authorized agent who meets the agency requirements of the CCPA and related regulations. You may appoint an authorized agent by following the instructions described in the section below, Authorized Agents. As permitted by the CCPA, any request you submit to us is subject to an identification and residency verification process ( Verifiable Consumer Request ), which will be further explained as part of the request process. We will not fulfill your CCPA request unless you have provided sufficient information for us to reasonably verify you are the Consumer about whom we collected PI. Please follow the instructions on Appendix I Consumer Rights Request Form attached hereto and respond to any follow up inquires we may make. You may also obtain information on how to make, and may submit, a request by asking a manager at any of our multifamily leasing offices.

If we cannot comply with a request, we will explain the reasons in our response. You are not required to create an account with us to make a Verifiable Consumer Request, but you may use your account to do so. We will use PI provided in a Verifiable Consumer Request only to verify your identity or authority to make the request and to track and document request responses, unless you also gave it to us for another purpose.

We will make commercially reasonable efforts to identify Consumer PI that we collect, process, store, disclose and otherwise use and to respond to your California Consumer privacy rights requests. In some cases, particularly with voluminous and/or typically irrelevant data, we may suggest that you receive the most recent or a summary of your PI and give you the opportunity to elect whether you want the rest or not. We reserve the right to direct you to where you may access and copy responsive PI yourself. We will typically not charge a fee to fully respond to your requests; provided, however, that we may charge a reasonable fee, or refuse to act upon a request, if your request is excessive, repetitive, unfounded or overly burdensome. If we determine that the request warrants a fee, or that we may refuse it, we will give you notice explaining why we made that decision. You will be provided a cost estimate and the opportunity to accept such fees before we will charge you for responding to your request.

Consistent with the CCPA and our interest in the security of your PI, we will not deliver to you your Social Security number, driver s license number or other government-issued ID number, financial account number, an account password, or security questions or answers in response to a CCPA request; however, you may be able to access some of this information yourself through your account if you have an active account with us.

Your California Consumer privacy rights are as follows:

The Right to Know/Information Rights

You have the right to send us a request, no more than twice in a twelve-month period, for any of the following for the period that is twelve months prior to the request date:

The categories of PI we have collected about you.

The categories of sources from which we collected your PI.

The business or commercial purposes for our collecting or selling your PI.

The categories of third parties to whom we have shared your PI.

The specific pieces of PI we have collected about you.

A list of the categories of PI disclosed for a business purpose in the prior 12 months, or that no disclosure occurred.

To make a request, please follow the instructions on Appendix I Consumer Rights Request Form attached hereto and email the form to This email address is being protected from spambots. You need JavaScript enabled to view it. or call us toll free at (833) 501-0005. If you are disabled and need reasonable accommodations to facilitate your request, please let us know. As permitted by the CCPA, any request you submit to us is subject to an identification and verification process. We will verify your identity based on matching information you provided with data we have maintained on you in our systems. This data could include, but is not limited to, email address, mailing address, phone number, date of birth, address of an AAT apartment in which you live or address of an AAT office or retail space leased to you, had lived or desired to live, apartment number, lease start date, and date on which you first contacted us. If we are not satisfied that we have sufficiently verified your identity, we may direct you to this Notice for information on our PI practices generally. For your specific pieces of information, as required by the CCPA, we will apply the heightened verification standards set forth in subsection (ii) below.

Please note that PI is retained by us for various time periods, so we may not be able to fully respond to what might be relevant going back 12 months prior to the request date.

Obtaining Copies of PI

You have the right to make or obtain a transportable copy, no more than twice in a twelve-month period, of your PI that we have collected and are maintaining in the period that is 12 months prior to the request date. To make a request, please follow the instructions on Appendix I Consumer Rights Request Form attached hereto and email it to This email address is being protected from spambots. You need JavaScript enabled to view it. or call us toll free at (833) 501-0005. If you are disabled and need reasonable accommodations to facilitate your request, please let us know. As permitted by the CCPA, any request you submit to us is subject to an identification and verification process. We will verify identity based on matching information you provided with data we have maintained on you in our systems and we require that at least three of the data elements you provide match to data we already maintain on you. This data could include, but is not limited to, email address, mailing address, phone number, date of birth, address of an AAT apartment for which you live, had lived or desired to live, apartment number, or address of an AAT office or retail space leased to you, lease start date, and date for which you first contacted us. If we are not satisfied that we have sufficiently verified your identity, we may direct you to this Notice for information on our PI practices generally.

Please note that PI is retained by us for various time periods, so we may not be able to fully respond to what might be relevant going back 12 months prior to the request.

Correcting PI

You have the right to request correction of any incorrect PI. You may do that by accessing your account and making changes to your PI in the account settings. You may also make a request by following the instructions on Appendix I Consumer Rights Request Form attached hereto and emailing the form to us at This email address is being protected from spambots. You need JavaScript enabled to view it. or call us toll free at (833) 501-0005. If you are disabled and need reasonable accommodations to facilitate your request, please let us know. As permitted by the CCPA, any request you submit to us is subject to an identification and verification process. We will verify identity based on matching information you provided with data we have maintained on you in our systems and we require that at least three of the data elements you provide match to data we already maintain on you. This data could include, but is not limited to, email address, mailing address, phone number, date of birth, address of an AAT apartment for which you live, had lived or desired to live, apartment number, or address of an AAT office or retail space leased to you, lease start date, and date for which you first contacted us. If we are not satisfied that we have sufficiently verified your identity, we may direct you to this Notice for information on our PI practices generally.

Please note we will use commercially reasonable efforts to correct inaccurate personal information, taking into the account the nature of the personal information and the purpose for our processing.

Delete

Subject to certain exceptions, you may request that we delete your PI that we have collected directly from you and are maintaining. If we do not fully honor your request to delete, we will let you know the reasons why. Note also that we are not required to delete your PI that we did not collect directly from you. To make a request, please follow the instructions on Appendix I Consumer Rights Request Form attached hereto and email it to This email address is being protected from spambots. You need JavaScript enabled to view it. or call us toll free at (833) 501-0005. If you are disabled and need reasonable accommodations to facilitate your request, please let us know. As permitted by the CCPA, any request you submit to us is subject to an identification and verification process. We will verify identity based on matching information you provided with data we have maintained on you in our systems and we require that at least three of the data elements you provide match to data we already maintain on you. This data could include, but is not limited to, email address, mailing address, phone number, date of birth, address of an AAT apartment in which you live, had lived or desired to live, apartment number, or address of an AAT office or retail space leased to you, lease start date, and date on which you first contacted AAT. If we are not satisfied that we have sufficiently verified your identity, we may direct you to this Notice for information on our PI practices generally.

However, you may alternatively exercise more limited control of your PI by instead exercising one of the following more limited opt-outs: opting out of marketing communications, editing your personal information associated with your AAT prospect account or deleting that account, or by following the instructions on Appendix I Consumer Rights Request Form attached hereto.

Non-Discrimination and Financial Incentive Programs

We will not discriminate against you in a manner prohibited by the CCPA because you exercise your CCPA rights. We do not currently offer financial incentive programs or charge a different price or rate, or offer a different level or quality of good or service that relates to your data. If this policy changes, the material aspects of that policy will be explained and described in its program terms in accordance with the CCPA.

Authorized Agents

You may designate an agent to exercise your CCPA rights on your behalf. To exercise your rights via an agent, your agent must (1) show proof of power of attorney; or (2) submit a written authorization of his or her authority to act on your behalf. Once such authorization is submitted, you will receive an email at your email address asking you to verify the agent s authority to submit a Consumer Rights Request on your behalf, and, unless your agent has power of attorney, to verify yourself. If you are an authorized agent making a request, please follow the instructions on Appendix II Consumer Rights Request Form for Agents attached hereto and email the form to This email address is being protected from spambots. You need JavaScript enabled to view it..

Limitation on Rights

Notwithstanding anything to the contrary, we may collect, use and disclose your PI as required or permitted by applicable law and this may override your CCPA rights. In addition, we need not honor any of your requests to the extent that doing so would infringe upon our or any other person or party s rights or conflict with applicable law.

Additional California Notices

In addition to CCPA rights, certain Californians are entitled to certain other notices, including:

Third Party Marketing and Your California Privacy Rights

Separate from your CCPA Do Not Sell rights you have the following additional rights regarding disclosure of your information to third parties for their own direct marketing purposes:

We provide qualifying California residents with the option to opt-in or opt-out to sharing of personal information as defined by California s Shine the Light law with third parties, for such third parties own direct marketing purposes. California residents may exercise that opt-out, and/or request information about our compliance with the Shine the Light law, and obtain a disclosure of third parties we have shared information with in accordance with the law for their direct marketing purposes absent your choice and the categories of information shared, by contacting us This email address is being protected from spambots. You need JavaScript enabled to view it. or by sending a letter to us at American Assets Trust, Inc., Attention Legal Department, 3420 Carmel Mountain Road, Suite 100, San Diego, CA 92121. Please include California Privacy Rights Request in the first line of the description and include your name, street address, city, state, and ZIP code. Please note that we are only required to respond to one request per customer each year.

As these rights and your CCPA rights are not the same and exist under different laws, you must exercise your rights under each law separately.

Online Privacy Practices

For more information on our online practices and your California rights specific to our online services see our Terms of Use. Without limitation, Californians that visit our online services and seek or acquire goods, services, money or credit for personal, family or household purposes are entitled to the following notices of their rights:

Tracking and Targeting

When you visit our online services, we and third parties may use tracking technologies to collect usage information based on your device for a variety of purposes, including serving you advertising, based on your having visited our services. For more information on tracking and targeting and your choices regarding these practices, see our online Privacy Policy, above.

California Minors

Any California residents under the age of eighteen (18) who have registered to use our online services and who posted information on the service can request removal by contacting us This email address is being protected from spambots. You need JavaScript enabled to view it., detailing where the information is posted and attesting that you posted it. We will then make reasonably good faith efforts to remove the information or anonymize it, so the minor cannot be individually identified to the extent required by applicable law. This removal process cannot ensure complete or comprehensive removal.

Contact Us on Your California Privacy Rights

For more information on your California privacy rights contact us toll free at (833) 501-0005 or email us at This email address is being protected from spambots. You need JavaScript enabled to view it. and follow the instructions on Appendix I Consumer Rights Request Form attached hereto. This email address is being protected from spambots.

Third Party Privacy Policies

Our privacy policy does not apply to any third-party web sites that may be reached through links provided on this Website for your convenience, and visitors are encouraged to contact such third party sites directly for information regarding their privacy policies.

Modifications to Privacy Policy

At any time, we reserve the right to add to, modify or remove portions of this Privacy Policy. Please check back to this page from time to time to determine if any revisions have been made. Your continued use of this Website after any revisions have been made will constitute acceptance of the new Privacy Policy.

How to Contact Us About this Privacy Policy

If you have any questions regarding this Privacy Policy, or if you would like to exercise any of your rights, please send an email to the address below. For additional correspondence, please send to:

American Assets Trust, Inc.

3420 Carmel Mountain Road, Suite 100,

San Diego, CA 92121

Phone: (833) 501-0005

Facsimile: (858)350-2620

Email: This email address is being protected from spambots. You need JavaScript enabled to view it.

Use of this Website constitutes your acceptance of our Terms of Use and Privacy Policy.

Appendix I

Consumer Rights Request Form

Please use this form if you wish to submit a request related to your personal information stored and managed by American Assets Trust, Inc., (including its affiliates and subsidiaries) in accordance with your privacy rights as a California resident. This form can be used to exercise Right to Know (requesting the personal information that we store about you), Right to Correct (to correct inaccurate information) or Right to Delete (requesting that we delete personal information which we collected from you) as defined in the California Consumer Privacy Act (CCPA). If you are an Agent or Legal Representative submitting on behalf of a consumer, please use our Consumer Rights Request for Agents Form (Appendix II).

To submit this form, please email it to This email address is being protected from spambots. You need JavaScript enabled to view it..

Are you a California resident? (Required)

Yes / No

I am a (Required)

Current resident at an American Assets Trust apartment

Former resident at an American Assets Trust apartment

Prospect who expressed interest in leasing an American Assets Trust apartment

Current tenant at an American Assets Trust office or retail property

Former tenant at an American Assets Trust office or retail property

Prospect who expressed interest in leasing an American Assets Trust property

Requester, who is not a resident or tenant or a prospect, but has or had another kind of relationship with American Assets Trust

Select request type(s) (Required)

I want to know the categories of personal information you have about me.

I want to receive a copy of the specific personal information you have about me.

I want to correct the information that you have about me.

I want you to delete any personal information that you have about me.

Contact Information (Required)

First and Last Name:

Personal Email Address:

Phone Number:

Work Email Address:

Any other information you want to provide us about your request:

Appendix II

Consumer Rights Request for Agents Form

This form is for an agent or a legal representative who is submitting the request on behalf of a consumer. If you are a consumer and want to make a request for yourself, use the Appendix I form.

Are you an agent or a legal representative acting on behalf of a consumer? (Required)

I am an agent.

I am a legal representative.

Is the Customer you are representing a California resident? (Required)

Yes / No

Agent or legal representative s information (All Required)

Agent or legal representative s first and last Name:

Agent or legal representative s email address:

Agent or legal representative s phone number:

Consumer s Information (All Required):

The consumer is a:

Current resident at an American Assets Trust apartment

Former resident at an American Assets Trust apartment

Prospect who expressed interest in leasing an American Assets Trust apartment

Current tenant at an American Assets Trust office or retail property

Former tenant at an American Assets Trust office or retail property

Prospect who expressed interest in leasing an American Assets Trust property

Requester, who is not a resident or tenant or a prospect, but has or had another kind of relationship with American Assets Trust

The consumer wants to:

Know the categories of personal information that American Assets Trust has about him/her.

Receive a copy of the specific personal information that American Assets Trust has about him/her.

Correct personal information that American Assets Trust has about him/her.

Wants American Assets Trust to delete any personal information that they have about him/her.

Contact Information (Required)

First and Last Name:

Personal Email Address:

Phone Number:

Work Email Address:

Date when the consumer first contacted American Assets Trist:

Any other information you want to provide us about the request: