California Consumer Privacy Notice

Last Updated Date: December 26, 2024

This California Consumer Privacy Notice (“Notice”) applies to “Consumers” as defined under the California Consumer Privacy Act, including as amended by the California Privacy Rights Act (together, the “CCPA”) and all laws implementing, supplementing or amending the foregoing, including regulations promulgated thereunder. Capitalized terms used but not defined in this Notice shall have the meanings given to them under the CCPA.

This Notice is designed to meet our obligations under the CCPA and supplements the general privacy policies of Essex Property Trust, Inc. and our affiliates (“Company,” “our,” “us,” or “we”) or including, without limitation, our Website Privacy Policy. In the event of a conflict between any other Company policy, notice, or statement and this Notice, this Notice will prevail as to Consumers unless stated otherwise.

The section titled “Notice of Data Practices” provides notice of our data practices, including our collection, use, disclosure, and sale of Consumers’ Personal Information or Personal Data (collectively, “PI”). It does not apply to our job applicants, current employees, former employees, or independent contractors (“Employees”). Our California Employees can learn about our data practices as relates to them in our California Employee Privacy Notice. The section titled “Your Consumer Rights and How to Exercise Them” provides information regarding Consumer rights and how you may exercise them. It also provides information regarding rights of our California Employees. The section titled “Additional Notices for California Residents” provides additional information for California residents, other than our Employees.

For California residents the term “Consumer” is not limited to data subjects acting as individuals regarding household goods and services and includes data subjects in a business-to-business context. This is not the case in the other states. 

Notice of Data Practices

The description of our data practices in this Notice covers the twelve (12) months prior to the Effective Date and will be updated at least annually. Our data practices may differ between updates, however, if materially different from this Notice, we will provide supplemental pre-collection notice of the current practices, which may include references to other privacy policies, notices, or statements. Otherwise, this Notice serves as our notice at collection.

We may Collect your PI directly from you; your devices; your email or social media accounts; service providers; data providers; utility management providers; analytics and marketing providers; public sources of data such as government databases; credit reporting agencies; or other businesses or individuals (e.g., friends or family).

Generally, we Process your PI to provide you services and as otherwise related to the operation of our business, including for one or more of the following Business Purposes: Providing Products and Performing Services; Managing Interactions and Transactions; Security; Debugging; Advertising & Marketing; Quality Assurance; Processing Interactions and Transactions; and Research and Development. For example, we may use your PI for the following purposes:

• Provide our services/communicate about our services: to provide you with info or services, to send you electronic newsletters (if you have elected to receive such), qualify you to enter into a lease at one of our communities; service calls to your apartment home; and ensure that you comply with lease terms
• Enable additional features of our sites: to enable you to participate in a variety of our site’s features, such as user profiles and content postings
• Contact You: to contact you about your use of our services and, in our discretion, changes to our services or our service’s policies
• Account management: to process your registration with our services, verify your info is active and valid, and manage your account
• Resident Service: to respond to any questions, comments, or requests you have for us or for other resident service purposes
• Payment: to facilitate rent and other payments
• Security/fraud prevention: to protect the security of Company, our services, or its users and to prevent and address fraud
• Content and offers customization: to customize your experience on our websites apps, or other services, or to serve you specific content and offers that are relevant to/customized for you
• Advertising, marketing, and promotions: to assist us in determining relevant advertising and the success of our advertising campaigns; to help us determine where to place our ads, including on other websites; for promotional activities such as running sweepstakes, contests, and other promotions.
• Research and analytics: to better understand how users access and use our services, both on an aggregated and individualized basis, to improve our services and respond to user preferences, and for other research and analytical purposes
• Market research and satisfaction surveys: to administer surveys and questionnaires, such as for market research or resident satisfaction purposes
• Compliance with legal obligations: to comply with legal obligations, as part of our general business operations, and for other business administration purposes
• Prevention of illegal activities, fraud, injury to others, or violation of our terms and policies: to investigate, prevent or take action if someone may be using info for illegal activities, fraud, or in ways that may threaten someone’s safety or violate of our terms or this Notice
• Purposes disclosed at PI collection: We may provide additional disclosures at the time of PI collection
• Related or compatible purposes: for purposes that are related to and/or compatible with any of the foregoing purposes

We may also use PI for “Additional Business Purposes” in a context that is not a Sale or Share under the CCPA, such as:

• Disclosing it to our Service Providers, Contractors, or Processors that perform services for us (“Vendors”);
• Disclosing it to the Consumer or to other parties at the Consumer’s direction or through the Consumer’s action;
• For the additional purposes explained at the time of collection (such as in the applicable privacy policy or notice);
• As required or permitted by applicable law; to the government or private parties to comply with law or legal process or protect or enforce legal rights or obligations or prevent harm;
• To assignees as part of an acquisition, merger, asset sale, or other transaction where another party assumes control over all or part of our business (“Corporate Transaction”).

Subject to restrictions and obligations under the CCPA, our Vendors may also use your PI for Business Purposes and Additional Business Purposes, and may engage their own vendors to enable them to perform services for us.

We may also use and disclose your PI under this Notice for Commercial Purposes, which may be considered a “Sale” or “Share” under applicable the CCPA, such as when Third-Party Digital Businesses (defined below) Collect your PI via third-party cookies, and when we Process PI for certain advertising purposes. In addition, we reserve the right to make your PI available to Third-Parties for their own use.

We provide more detail on our data practices in the chart that follows.

Your Consumer Rights and How to Exercise Them

As described below, subject to meeting the requirements for a Verifiable Consumer Request (defined below), Company provides Consumers and Employees the privacy rights described in this section.

To submit a request to exercise your privacy rights:

• To submit a request as a Consumer, use our Consumer Rights Request Portal or call us at (833) 591-5938, and respond to any follow-up inquiries we make.
• To submit a request as an Employee or Applicant, use our Employee Rights Request Portal or call us at (833) 591-5938, and respond to any follow-up inquiries we make.
• To submit a request as an authorized agent, use our Agents Request Portal or call us at (833) 591-5938, and respond to any follow-up inquiries we make.

Please be aware that we do not accept or process requests through other means (e.g., via fax, chats, social media etc.). More details on the request and verification process is in the section titled “How to Exercise Your Consumer Privacy Rights” below. The Consumer rights we accommodate are as follows:

Right to Limit Sensitive PI Processing

We only Process Sensitive PI for purposes that are exempt from Consumer choice under the CCPA.

Right to Know / Access

You are entitled to access PI up to twice in a 12-month period.

Categories

You have a right to submit a request for any of the following for the period that is 12-months prior to the request date:

• The categories of PI we have Collected about you.
• The categories of sources form which we Collected your PI.
• The Business Purposes or Commercial Purposes for our Collecting, Selling, or Sharing your PI.
• The categories of Third Parties to whom we have disclosed your PI.
• A list of the categories of PI disclosed for a Business Purpose and, for each, the categories of recipients, or that no disclosure occurred.
• A list of the categories of PI Sold or Share about you and, for each, the categories of recipients, or that no Sale or Share occurred.

Specific Pieces

You may request to confirm if we are Processing your PI and, if we are, to obtain a transportable copy, subject to applicable request limits, of your PI that we have collected and are maintaining. For your specific pieces of PI, as required by applicable the CCPA, we will apply the heightened verification standards as described below. We have no obligation to re-identify information or to keep PI longer than we need it or are required to by applicable law to comply with access requests.

Do Not Sell / Share

California has an opt-out from Selling and from Sharing for Cross-Context Behavioral Advertising (use of PI from different businesses or services to target advertisements). We may Sell or Share your PI, as these terms apply under the CCPA. However, we provide you an opt out of Sale/Sharing.

Third-Party digital businesses (“Third-Party Digital Businesses”) may associate cookies and other tracking technologies that Collect PI about you on our services, or otherwise Collect and Process PI that we make available about you, including digital activity information. We understand that giving access to PI on our services, or otherwise, to Third-Party Digital Businesses could be deemed a Sale and/or Share and thus we will treat such PI (e.g., cookie ID, IP address, and other online IDs and internet or other electronic activity information) collected by Third-Party Digital Businesses, where not limited to acting as our Service Provider (or Contractor or Processor), as a Sale and/or Share and subject to a Do Not Sell/Share opt-out request. We will not Sell your PI or Share your PI for Cross-Context Behavioral Advertising, if you make a Do Not Sell/Share opt-out request. 

Opt-out for non-cookie PI: If you want to opt-out of the Sale/Sharing of your non-cookie PI (e.g., your email address), make an opt-out request here.

Opt-out for cookie PI: If you want to opt-out of the Sale/Sharing of your cookie-related PI, you need to exercise a separate opt-out request on our cookie management tool here. This is because we have to use different technologies to apply your opt-out of cookie PI and to non-cookie PI. Our cookie management tool enables you to exercise such an opt-out request and enable certain cookie preferences on your device. You must exercise your preferences on each of our websites you visit, from each browser you use, and on each device that you use. Since your browser opt-out is designated by a cookie, if you clear or block cookies, your preferences will no longer be effective and you will need to enable them again via our cookie management tool. Beware that if you use ad blocking software, our cookie banner may not appear when you visit our services and you may have to use the link above to access the tool.

Opt-out preference signals (also known as global privacy control or GPC): The CCPA requires businesses to process GPC signals, which is referred to as opt-out preference signals (“OOPS”), which are signals sent by a platform, technology, or mechanism, enabled by individuals on their devices or browsers, that communicate the individual’s choice to opt-out of the Sale and Sharing of personal information. To use an OOPS/GPC, you can download an internet browser or a plugin to use on your current internet browser and follow the settings to enable the OOPS/GPC. We have configured the settings of our consent management platform to receive and process GPC signals on our website, which is explained by our consent management platform here. We process OOPS/GPC with respect to Sales and Sharing that may occur in the context of Collection of cookie PI by tracking technologies online by Third-Party Digital Businesses, discussed above, and apply it to the specific browser on which you enable OOPS/GPC. We currently do not, due to technical limitations, process OOPS/GPC for opt-outs of Sales and Sharing in other contexts (e.g., non-cookie PI). We do not: (1) charge a fee for use of our service if you have enabled OOPS/GPC; (2) change your experience with any product or service if you use OOPS/GPC; or (3) display a notification, pop-up, text, graphic, animation, sound, video, or any interstitial in response to the OOPS/GPC.

We do not knowingly Sell or Share the PI of Consumers under 16, unless we receive affirmative authorization (“opt-in”) from either the Consumer who is between 13 and 16 years old, or the parent or guardian of a Consumer who is less than 13 years old. If you think we may have unknowingly collected PI of a Consumer under 16 years old, please contact us at privacy@essex.com.

We may disclose your PI for the following purposes, which are not a Sale or Share: (i) if you direct us to disclose PI; (ii) to comply with a Consumer rights request you submit to us; (iii) disclosures amongst the entities that constitute Company as defined above, or as part of a Corporate Transaction; and (iv) as otherwise required or permitted by applicable law.

Right to Delete

Except to the extent we have a basis for retention under applicable law, you may request that we delete your PI. Our retention rights include, without limitation:

• to complete transactions and services you have requested;
• for security purposes;
• for legitimate internal Business Purposes (e.g., maintaining business records);
• to comply with law and to cooperate with law enforcement; and
• to exercise or defend legal claims.

Please also be aware that making a deletion request does not ensure complete or comprehensive removal or deletion of PI or content you may have posted.

Note also that, depending on where you reside (e.g., California and Utah), we may not be required to delete your PI that we did not Collect directly from you.

Correct Your PI

Consumers may bring inaccuracies they find in their PI that we maintain to our attention and we will act upon such a complaint as required by applicable law. You can also make changes to your online account in the account settings section of the account. That will not, however, change your information that exists in other places.

How to Exercise Your Consumer Privacy Rights

To submit a request to exercise your privacy rights:

• To submit a request as a Consumer, use our Consumer Rights Request Portal or call us at (833) 591-5938, and respond to any follow-up inquiries we make.
• To submit a request as an Employee, use our Employee Rights Request Portal or call us at (833) 591-5938, and respond to any follow-up inquiries we make
• To submit a request as an authorized agent, use our Agents Request Portal or call us at (833) 591-5938, and respond to any follow-up inquiries we make.

Please be aware that we do not accept or process requests through other means (e.g., via fax, chats, social media etc.).

Your Request Must be a Verifiable Consumer Request

As permitted or required by applicable the CCPA, any request you submit to us must be a Verifiable Consumer Request, meaning when you make a request, we may ask you to provide verifying information, such as your name, e-mail, phone number and/or account information. We will review the information provided and may request additional information (e.g., transaction history) via e-mail or other means to ensure we are interacting with the correct individual. We will not fulfill your Right to Know (Categories), Right to Know (Specific Pieces), Right to Delete, or Right to Correction request unless you have provided sufficient information for us to reasonably verify you are the Consumer about whom we collected PI. We do not verify opt-outs of Sell/Share or Limitation of Sensitive PI requests unless we suspect fraud.

We verify each request as follows:

• Right to Know (Categories): We verify your Request to Know Categories of PI to a reasonable degree of certainty, which may include matching at least two data points provided by you with data points maintained by us, which we have determined to be reliable for the purpose of verifying you. If we cannot do so, we will refer you to this Notice for a general description of our data practices.
• Right to Know (Specific Pieces): We verify your Request To Know Specific Pieces of PI to a reasonably high degree of certainty, which may include matching at least three data points provided by you with data points maintained by us, which we have determined to be reliable for the purpose of verifying you together with a signed declaration under penalty of perjury that you are the Consumer whose PI is the subject of the request. If you fail to provide requested information, we will be unable to verify you sufficiently to honor your request, but we will then treat it as a Right to Know Categories Request if you are a California resident.
• Do Not Sell/Share/Target & Limit SPI: No specific verification required unless we suspect fraud.
• Right to Delete: We verify your Request to Delete to a reasonable degree of certainty, which may include matching at least two reliable data points provided by you with data points maintained by us, or to a reasonably high degree of certainty, which may include matching at least three reliable data points provided by you with data points maintained by us, depending on the sensitivity of the PI and the risk of harm to the Consumer posed by unauthorized deletion. If we cannot verify you sufficiently to honor a deletion request, you can still make a Do Not Sell/Share and/or Limit SPI request.
• Correction: We verify your Request to Correct PI to a reasonable degree of certainty, which may include matching at least two reliable data points provided by you with data points maintained by us, or to a reasonably high degree of certainty, which may include matching at least three reliable data points provided by you with data points maintained by us, depending on the sensitivity of the PI and the risk of harm to the Consumer posed by unauthorized correction.

To protect Consumers, if we are unable to verify you sufficiently we will be unable to honor your request. We will use PI provided in a Verifiable Consumer Request only to verify your identity or authority to make the request and to track and document request responses, unless you also gave it to us for another purpose.

Agent Requests

You may use an authorized agent to make a request for you, subject to our verification of the agent, the agent’s authority to submit requests on your behalf, and of you. You can learn how to do this by visiting the agent section of our Consumer Rights Request Portal. Once your agent’s authority is confirmed, they may exercise rights on your behalf subject to the agency requirements of applicable the CCPA.

Our Responses

Some PI that we maintain is insufficiently specific for us to be able to associate it with a verified Consumer (e.g., clickstream data tied only to a pseudonymous browser ID). We do not include that PI in response to those requests. If we deny a request, in whole or in part, we will explain the reasons in our response.

We will make commercially reasonable efforts to identify Consumer PI that we Process to respond to your Consumer request(s). In some cases, particularly with voluminous and/or typically irrelevant data, we may suggest you receive the most recent or a summary of your PI and give you the opportunity to elect whether you want the rest. We reserve the right to direct you to where you may access and copy responsive PI yourself. We will typically not charge a fee to fully respond to your requests; provided, however, that we may charge a reasonable fee, or refuse to act upon a request, if your request is excessive, repetitive, unfounded, or overly burdensome. If we determine that the request warrants a fee, or that we may refuse it, we will give you notice explaining why we made that decision. You will be provided a cost estimate and the opportunity to accept such fees before we will charge you for responding to your request.

Consistent with applicable the CCPA and our interest in the security of your PI, we will not deliver to you your Social Security number, driver’s license number, or other government-issued ID number, financial account number, any health or medical identification number, an account password, or security questions or answers in response to a Consumer privacy rights request; however, you may be able to access some of this information yourself through your account if you have an active account with us.

Non-Discrimination / Non-Retaliation

We will not discriminate or retaliate against you in a manner prohibited by applicable the CCPA for your exercise of your Consumer privacy rights. We may charge a different price or rate, or offer a different level or quality of good or service, to the extent that doing so is reasonably related to the value of the applicable PI.

Notice of Financial Incentive Programs

We do not currently offer discounts or rewards to Consumers for providing us PI, or set price or service differences related to the collection, retention, sale, or sharing of PI.  If we offer such programs in the future, we will update this Notice to describe such program(s), including how you may opt-in and how we value the PI required.

Our Rights and The Rights of Others

Notwithstanding anything to the contrary, we may collect, use and disclose your PI as required or permitted by applicable law and this may override your rights under the CCPA. In addition, we are not required to honor your requests to the extent that doing so would infringe upon our or another person’s or party’s rights or conflict with applicable law.

Additional Notices for California Residents

In addition to the CCPA, certain Californians are entitled to certain other notices, as follows:

This Notice provides information on our online practices and your California rights specific to our online services. Without limitation, Californians that visit our online services and seek to acquire goods, services, money or credit for personal, family or household purposes are entitled to the following notices of their rights:

California Minors

Although our services are intended for an audience over the age of majority, any California residents under the age of eighteen (18) who have registered to use our services, and posted content on the service, can request removal by contacting us at privacy@essex.com, detailing where the content is posted and attesting you posted it. We will then make reasonably good faith efforts to remove the post from prospective public view or anonymize it, so the minor cannot be individually identified to the extent required by applicable law. This removal process cannot ensure complete or comprehensive removal. For instance, third parties may have republished or archived content by search engines we do not control.

Shine the Light

California's “Shine the Light” law permits California residents to request certain information regarding our disclosure of “personal information” (as defined by the “Shine the Light” law) to third parties for their own direct marketing purposes. If you are a California resident, you may request information about our compliance with Shine the Light by contacting us at privacy@essex.com, or by sending a letter to us at Essex Property Trust, Attention Legal Department, 1100 Park Place, Suite 200, San Mateo, California 94403. Requests must include “California Privacy Rights Request” in the first line of the description and include your name, street address, city, state, and ZIP code. Please note that we are only required to respond to one request per customer each year. This right is different than, and in addition to, CCPA rights, and must be requested separately. However, a Do Not Sell/Share opt-out is broader and will limit our disclosure to third parties for their own direct marketing purposes without the need for making a separate Shine the Light request.

Contact Us

If you have any questions, comments, or concerns about our privacy practices, please contact us by e-mail at privacy@essex.com. Please note that e-mail communications will not necessarily be secure; accordingly, you should not include sensitive information in your e-mail correspondence with us.