Privacy statement
Our commitment to your privacy
At Oxford Properties Group, honesty and integrity are at the core of everything we do. We are committed to building and keeping your trust in all aspects of our operations, including how we handle your personal data. Throughout all operations we implement privacy practices designed to help keep your personal data safe, secure and used appropriately. We are providing this Privacy Statement to help you understand our approach to privacy.
This Privacy Statement applies to the collection, use and disclosure of personal data by Oxford Properties Group. This Privacy Statement does not apply to Oxford Employees, prospective Employees or Contractors as they are governed by OMERS Employee Privacy Statement.
This Privacy Statement does not apply to personal data collected by tenants or other third parties operating in our properties. Tenants and other third parties are independently responsible for managing such data in accordance with their own privacy notices.
Oxford Properties Group is a global real estate investor, developer and asset manager. Oxford has many lines of business. Oxford owns, invests in and manages shopping centres, apartment buildings, office buildings and other properties. We are property developers and property investors. The types of personal data that we collect and use depend on our lines of business and the purpose of your interaction with us. This Privacy Statement applies to all our lines of business.
To ensure you find the information pertinent to your needs, we encourage you to select the icon that corresponds with your interaction with us, as indicated in the sections of our Privacy Statement below.
When you read this Privacy Statement, please keep in mind that the words “Oxford”, “we” or “us” means Oxford Properties Group.
Our compliance framework is designed to safeguard personal data and ensure adherence to our Privacy Statement. This framework comprises various elements, including:
• Specific rules for personnel on handling personal data
• Mandatory training programs
• Procedures for addressing incidents
• Guidelines on data retention periods
• Processes for resolving complaints
• Protocols for responding to personal data access requests
Central to our compliance efforts is the Privacy Office, led by our Privacy Officer. The Privacy Office has several key responsibilities:
• Educating staff on privacy issues
• Providing guidance on handling personal data in new or significantly altered activities
• Advising on policies and procedures to protect personal data
• Managing complaints related to personal data handling
For further assistance or to address concerns, please contact the Privacy Office using the details in the Contact Us section.
If you reside in Quebec and we collect your personal data, please be aware that we may transmit that data outside of Quebec. This includes sharing data with our head office in Ontario, as well as other sites within Canada, the United States, and various international locations where our service providers or we operate.
If you reside in in the European Economic Area or the United Kingdom and we collect your personal data, please be aware that we may transmit that data to Canada, the United States, and various international locations where our service providers or we operate. Please also review our Special Information for residents of the European Economic Area and/or the United Kingdom.
The types of personal data that we collect and how we use it will depend on the nature of our activities and your interactions with us. We may combine personal data that we collect across your interactions with us and that we collect from third parties into a customer profile for you and use that customer profile for the purposes set out in this Privacy Statement. This Privacy Statement may be supplemented with additional privacy notices for specific services or to comply with local laws where our properties are located. These notices are available where the services are offered or the properties are located, and we encourage you to review them carefully to understand how your personal data is handled in those instances.
As our businesses evolve, we may collect data types or use data for purposes not listed here. In these cases, we will inform you about the data being collected and the reasons for its collection at the time of collection or before using it for a new purpose, unless legal provisions allow or require us to do so without your consent.
We want to offer visitors outstanding shopping experiences. When you visit our malls and other retail properties, we collect, combine and use personal data for the following purposes:
• Visitor Management and Concierge Services: Enhancing the overall visitor experience by receiving and responding to information and maintenance requests, handling lost and found items, providing mobility aid loan services (such as wheelchairs and scooters), managing special event bookings, providing tourist assistance, and collecting feedback.
• Consumer Transactions: Processing credit card, debit card and other payment methods for the purchase of gift cards, special events (such as Santa experiences), and of services such as paid or valet parking or deposits or non-return fees for mobility aid loan services.
• Parking Utilization and Enforcement: Analyzing parking usage to optimize space allocation, manage peak times, improve overall visitor convenience, and enforce parking rules.
• Visitor Analysis: Assessing the number of visitors, visit duration, visitor flow, and visitor characteristics.
• Wi-Fi Usage: Collecting data from Wi-Fi sign in, such as email address/username and postal code and network traffic to understand where visitors are visiting from and to manage and secure our Wi-Fi network.
• Communications: Communicating through our newsletters, offers, surveys, and event invitations, and responding to inquiries and requests and collecting consent, if applicable, to send these communications.
• Social Media Interactions: Responding to social media messages and interactions and monitoring mall social media mentions to gauge visitor sentiment and preferences.
• Contests and Promotions: Managing contest entries, promotions, and prize claims.
• Tailored Advertising: Collecting information to help make our advertisements and email communications better based on interests, location, and data provided to social media platforms, mobile applications, or websites.
• Innovation: Analyzing data we collect to identify insights to innovate and improve our business, including benchmarking our performance.
• Safety and Security: Implementing measures such as security cameras for closed-circuit video surveillance and gift card kiosk cameras, and security personnel patrols to ensure a safe shopping environment, respond to emergency incidents, protect employees, tenants, and visitors, and deter fraud and unauthorized activities.
• Risk Management: Conducting regular assessments and monitoring transactions to identify and address potential risks, ensuring the integrity of mall operations and safeguarding against fraud or other illegal activities.
• Legal Compliance: Maintaining necessary business records.
• Legal Obligations: Complying with legal requirements and directives.
• Property and Business Sales: Transferring records to a new property manager if the property is sold or no longer managed by Oxford.
• Other Consent-Based Purposes: Addressing other purposes for which you have given consent.
To support the purposes listed above, we collect the following types of personal data:
• Contact Information: Name, email address, phone number, and, in limited cases, home address if this contact information is necessary for the purposes listed above.
• Transaction Records: Records relating to purchases of gift cards and other paid products or services. In limited situations, this may include recording credit card, payment card or information from other payment methods.
• Communication Records: Emails, contact form submissions, chatbot interactions, other correspondence, and call recordings to address inquiries and gauge visitor sentiment.
• Special Event Data: Information on participation in mall-hosted events.
• Social Media Engagement: Mentions and interactions, including responses to surveys and ads, to understand visitor preferences and improve services.
• Wi-Fi Usage Data: Data collected from Wi-Fi log-in and data use, and other information necessary to provide and secure the Wi-Fi service.
• Digital Directory and Digital Advertising Interactions: Data from interactions with digital mall directories and in-mall digital advertising to understand search queries, advertising effectiveness and visitor demographics. This data is collected through our service provider, Cineplex Digital Media. For more information on these technologies, please visit: https://www.cdmexperiences.com/information-on-ava
• Foot-traffic Data: Data collected from mobile phone signals and from occupancy counters (which may use anonymous video or other sensor technologies) to analyze foot traffic patterns and dwell times in specific areas.
• Feedback and Survey Responses: Ratings, comments, suggestions, and information provided in response to our request to assess satisfaction levels and identify areas for service improvements.
• Security Monitoring Data: Closed-circuit video monitoring, body-worn cameras, and cameras embedded in gift card kiosks. We may also pilot or use other sensor-based technologies such as thermal imaging. We will post signage where we pilot or use these technologies.
• Parking Data: Data from photo and video cameras and license plate readers.
• Maintenance Requests: Details of maintenance or repair requests, including nature, date, and resolution status.
• Incident Reports Data: Details of incidents at mall properties, including locations and times, and particulars of individuals involved in the incident.
• Other Personal Identification Data: In limited cases, we collect other personal identification data, including date of birth and gender as part of health and safety incident response and investigations, and in some cases to screen high-value gift card transactions.
• Additional Relevant Information: Other data pertinent to our collection purposes that is collected lawfully.
Oxford owns and manages residential apartments and furnished suites. We collect, combine and use data from applicants, tenants and their visitors for the following purposes:
• Concierge and Building Services: Enhancing the overall tenant and visitor experience by responding to information requests, receiving packages, managing amenities and common elements, receiving and responding to maintenance requests, managing equipment rentals, and collecting feedback.
• Rental Applications: Assessing eligibility and suitability to rent one of our residential units.
• Lease Management: Preparation, execution and management of lease arrangements, including processing rental payments and payments for ancillary services.
• Parking Utilization and Enforcement: Analyzing parking usage to optimize space allocation and enforcing parking rules.
• Utility Management: Managing billing and related matters, including efficiency improvements, for utilities such as electricity, water consumption, bulk internet, and other similar services.
• Communications: Communicating through our newsletters, offers, surveys, and event invitations, and responding to inquiries and requests and collecting consent, if applicable, to send these communications.
• Social Media Interactions: Responding to social media messages and interactions and monitoring building social media mentions to gauge sentiment and preferences.
• Contests and Promotions: Managing contest entries, promotions, and prize claims.
• Innovation: Analyzing data we collect to identify insights to innovate and improve our business, including benchmarking our performance, rents and leases, and identifying and analyzing potential prospects for tenants.
• Safety and Security: Implementing measures such as surveillance cameras and security personnel patrols to ensure a safe environment, respond to emergency incidents, protect employees, tenants, and visitors, and deter unauthorized activities.
• Risk Management: Conducting regular assessments and monitoring transactions to identify and address potential risks, ensuring the integrity of building operations and safeguarding against fraud or other illegal activities.
• Legal Compliance: Maintaining necessary business records.
• Legal Obligations: Complying with legal requirements and directives.
• Property and Business Sales: Transferring records to a new property manager if the property is sold or no longer managed by Oxford.
• Other Consent-Based Purposes: Addressing other purposes for which you have given consent.
To support the purposes listed above, we collect the following types of personal data:
• Contact Information: Name, email address, and phone number. For applicants, we may collect home address and, for tenants, emergency contact information.
• Lease Data: Lease duration, payment history, rent increases, eligibility to use amenities, and other data related to the administration of your lease.
• Background Information: Details from applicants and tenants such as date of birth, government issued identification, current and previous employers, current and former addresses, rental history, income and other financial data, references, and credit scores.
• Banking and Payment Data: Bank account number, credit card, debit card or
other payment methods information from tenants to process payments, including automatic withdrawals, and to keep records of deposits, rent and other payments and any arrears and collections activity.
• Vehicle Information: License plate numbers, vehicle make and model, and
parking permit data for managing parking facilities, providing parking services, and enforcing parking regulations.
• Key Fob, Pass Card and Smart Locks Data: Access data from key fobs or smart locks to ensure security, manage building access, and, for amenities, analyze usage patterns for operational efficiency.
• Communication Records: Emails, contact form submissions, chatbot interactions, other correspondence, and call recordings to address inquiries.
• Maintenance Requests: Details of maintenance or repair requests, including nature, date, and resolution status.
• Package Delivery Information: Package information for packages received on behalf of residents.
• Visitor Logs: Where the tenant is not present to receive a visitor and other limited cases, names, dates, and times of visitors.
• Special Event Data: Information on participation in building-hosted events.
• Social Media Engagement: Mentions and interactions, including responses to surveys and ads, to understand tenant/ visitor preferences and improve services.
• Feedback and Survey Responses: Ratings, comments, suggestions, and information provided in response to our request to assess satisfaction levels and identify areas for service improvements.
• Security Monitoring Data: Closed-circuit video monitoring. We may also pilot or use other sensor-based technologies such as thermal imaging. We will post signage where we pilot or use these technologies.
• Parking Data: Data from photo and video cameras, tenant and guest names, and guest check-in data.
• Incident Reports Data: Details of incidents at properties, including locations and times, and particulars of individuals involved in the incident.
• Other Personal Identification Data: In limited cases, we collect other personal identification data, including date of birth and gender as part of health and safety incident response and investigations, and background checks.
• Additional Relevant Information: Other data pertinent to our collection purposes that is collected lawfully.
We provide websites, mobile applications, and other digital services to enhance user experience and engagement. We collect, combine and use data from these platforms for the following purposes:
• Digital Security: Restricting access to certain websites, apps or digital services for registered users or those meeting age requirements, and identifying and responding to threats to the security of our websites, apps and digital services.
• Communications: Communicating through our newsletters, offers, surveys, and event invitations, and responding to inquiries and requests and collecting consent, if applicable, to send these communications.
• Contests and Promotions: Managing contest entries, promotions, and prize claims.
• Transactions: Processing payments for the purchase of gift cards, special events (such as Santa experiences), and of services such as paid or valet parking.
• Tailored Advertising: Collecting information to help make our advertisements and email communications better based on interests, location, and data provided to social media platforms, mobile applications, or websites.
• User Experience and Enhancement: Recording activities and custom settings to maintain a personalized experience across sessions and to customize and improve the user interface and overall digital experience.
• Accessibility Improvements: Using data to ensure digital offerings are accessible to all users, including those with disabilities.
• Community Engagement: Engaging users in forums, feedback sessions, or social media interactions to foster a community around the digital offerings.
• Innovation: Analyzing data we collect to identify insights to innovate and improve our business, including benchmarking our performance.
• Risk Management: Conducting regular assessments and monitoring transactions to identify and address potential risks, ensuring the integrity of website, mobile app and digital services operations and safeguarding against fraud or other illegal activities.
• Legal Compliance: Maintaining necessary business records.
• Legal Obligations: Complying with legal requirements and directives.
• Business Sales: Transferring records to a new property manager if the website, mobile app, digital service or associated property is sold or no longer managed by Oxford.
• Other Consent-Based Purposes: Addressing other purposes for which you have given consent.
You can use many of our digital offerings, such as our property websites, without providing us with your name or other directly identifying information. However, to support these activities listed above, we may collect:
• Contact Information: Addresses, emails, and phone numbers when reasonably
required for the purposes set out above.
• Communication Records: Emails, contact form submissions, and chatbot
interactions.
• Transaction Records: Records relating to purchases of gift cards and other paid products or services.
• Technical Data: Information about your digital connection, including IP address, browser type, access location, navigation history, device type, and visit timestamps.
• Usage Data: Details on how you interact with our websites, mobile apps and other digital services, including time spent on certain pages or features used.
• Social Media Engagement: Mentions and interactions, including responses to surveys and ads, to understand tenant/ visitor preferences and improve services.
• Social Media Login Data: Profile data from your social media account if you use your social media login credentials to register for an account for one of our digital offerings.
• Content and Advertising Interactions: Engagement data with our content and ads.
• Location Information: Inferred location from IP addresses or, with your consent, precise location using GPS.
• Accessibility Preferences: Information on the use of accessibility features.
• Feedback and Survey Responses: Ratings, comments, suggestions, and information provide in response to our request to assess satisfaction levels and identify areas for service improvements.
• Additional Relevant Information: Other data pertinent to our collection purposes that is collected lawfully.
Oxford owns and manages office, retail and industrial properties We collect, combine and use personal data when managing these properties for the following purposes:
• Concierge and Building Services: Enhancing the overall tenant and visitor experience by responding to information requests, receiving packages, managing amenities and common elements, receiving and responding to maintenance requests, managing equipment rentals, and collecting feedback.
• Leasing Applications: Assessing eligibility and suitability to lease commercial space.
• Lease Management: Preparation, execution and management of lease
arrangements, including processing rental payments and payments for ancillary services.
• Parking Utilization and Enforcement: Analyzing parking usage to optimize space allocation, manage peak times, improve overall visitor convenience, and enforcing parking rules.
• Utility Management: Managing billing and related matters, including efficiency improvements, for utilities such as electricity, water consumption, bulk internet, and other similar services.
• Wi-Fi Usage: Collecting data from Wi-Fi sign in, such as email address/username and postal code and network traffic to understand where visitors are visiting from and to manage and secure our Wi-Fi network.
• Communications: Communicating through our newsletters, offers, surveys, and event invitations, and responding to inquiries and requests and collecting consent, if applicable, to send these communications.
• Social Media Interactions: Responding to social media messages and
interactions and monitoring building social media mentions to gauge sentiment and preferences.
• Contests and Promotions: Managing contest entries, promotions, and prize
claims.
• Tailored Advertising: Collecting information to help make our advertisements and email communications better based on interests, location, and data provided to social media platforms, mobile applications, or websites.
• Innovation: Analyzing data we collect to identify insights to innovate and improve our business, including benchmarking our performance, rents and leases.
• Safety and Security: Implementing measures such as surveillance cameras and security personnel patrols to ensure a safe environment, respond to emergency incidents, protect employees, tenants, and visitors, and deter unauthorized activities.
• Risk Management: Conducting regular assessments and monitoring transactions to identify and address potential risks, ensuring the integrity of building operations and safeguarding against fraud or other illegal activities.
• Legal Compliance: Maintaining necessary business records.
• Legal Obligations: Complying with legal requirements and directives.
• Property and Business Sales: Transferring records to a new property manager if the property is sold or no longer managed by Oxford.
• Other Consent-Based Purposes: Addressing other purposes for which you have given consent.
To support the purposes listed above, we collect the following types of personal data:
• Contact Information: Name, email address, and phone number. For applicants, we may collect home address and, for tenants, emergency contact information.
• Background Information: Details from applicants and tenants such as date of birth, government issued identification, social insurance numbers (with your consent for credit checks), current and previous employers, current and former addresses, rental history, income and other financial data, references, and credit scores.
• Banking and Payment Data: Bank account number, credit card, debit card or
other payment methods information from tenants to process payments, including automatic withdrawals, and to keep records of deposits, rent and other payments and any arrears and collections activity.
• Vehicle Information: License plate numbers, vehicle make and model, and
parking permit data for managing parking facilities, providing parking services, and enforcing parking regulations.
• Key Fob, Pass Card and Smart Locks Data: Access data from key fobs or smart locks to ensure security, manage building access, and, for amenities, analyze usage patterns for operational efficiency.
• Biometric Data for Authentication: If applicable and with explicit consent, collecting biometric data such as facial recognition for secure access.
• Communication Records: Emails, contact form submissions, chatbot interactions, other correspondence, and call recordings to address inquiries.
• Maintenance Requests: Details of maintenance or repair requests, including nature, date, and resolution status.
• Package Delivery Information: Package information for packages received on behalf of tenants.
• Visitor Logs: Where the tenant is not present to receive a visitor and other limited cases, names, dates, and times of visitors.
• Special Event Data: Information on participation in building-hosted events.
• Social Media Engagement: Mentions and interactions, including responses to surveys and ads, to understand visitor preferences and improve services.
• Wi-Fi Usage Data: Data collected from Wi-Fi, including Wi-Fi login and data use, and other information necessary to provide and secure the Wi-Fi service.
• Digital Directory and Digital Advertising Interactions: Anonymous data from interactions with digital directories and in-property digital advertising to understand search queries, advertising effectiveness and visitor demographics.
• Foot-traffic Data: Anonymous data collected from mobile phone signals and from occupancy counters to analyze foot traffic patterns and dwell times in specific areas.
• Feedback and Survey Responses: Ratings, comments, suggestions, and
information provide in response to our request to assess satisfaction levels and identify areas for service improvements.
• Security Monitoring Data: Closed-circuit video monitoring. We may also pilot or use other sensor-based technologies such as thermal imaging. We will post signage where we pilot or use these technologies.
• Parking Data: Data from photo and video cameras and license plate readers.
• Incident Reports Data: Details of incidents at properties, including locations and times, and particulars of individuals involved in the incident.
• Other Personal Identification Data: In limited cases, we collect other personal identification data, including date of birth and gender as part of health and safety incident response and investigations.
• Additional Relevant Information: Other data pertinent to our collection purposes that is collected lawfully.
Our development and investment activities involve financing, buying, improving, or constructing a wide range of real estate properties.to deliver returns to our shareholders.
We collect, combine and use personal data for the following purposes:
• Communications: Communicating with business partners and prospective business partners. In addition, communicating through our newsletters, offers, surveys, and event invitations, and responding to inquiries and requests and collecting consent, if applicable, to send these communications.
• Due Diligence: Conducting evaluations of potential properties, financings, and business acquisitions, including comprehensive due diligence and background checks on management of the entities involved.
• Asset Management: Implementing monitoring and strategic management of our companies and investments to optimize performance and value.
• Safety and Security: Implementing measures at our developments such as surveillance cameras and security personnel patrols to ensure a safe environment, respond to emergency incidents, protect employees, tenants, and visitors, and deter unauthorized activities.
• Risk Management: Conducting regular assessments and monitoring transactions to identify and address potential risks, meet “Know Your Client” obligations, ensuring the integrity of our operations and safeguarding against fraud or other illegal activities.
• Legal Compliance: Maintaining necessary business records.
• Legal Obligations: Complying with legal requirements and directives.
• Property and Business Sales: Transferring records to a new property manager if the property is sold or no longer managed by Oxford.
• Other Consent-Based Purposes: Addressing other purposes for which you have given consent.
To support the purposes listed above, we collect the following types of personal data:
• Contact Information: Addresses, emails, and phone numbers when reasonably required for the purposes set out above.
• Diversity and Inclusion Data: Gender and other demographic details pertinent to supporting diversity and inclusion among our professional service providers, development partners, and co-owners.
• Background Information: Details such as date of birth, government issued identification (optionally for background checks), current and previous employers, current and former addresses, and other information relevant to background checks.
• Communication Records: Emails, contact form submissions, other correspondence, and call recordings to address inquiries.
• Employee Data: For acquisitions, lists including job titles, work histories, and salaries.
• Diligence Data: For acquisitions, customer or tenant lists, transaction histories, and additional data critical for assessing potential acquisitions or investments.
• Business Records: Business records of the business that we acquired or for reporting to us on our investment.
• Additional Relevant Information: Other data pertinent to our collection purposes that is collected lawfully.
We collect information that you provide to us directly after we ask for it or when you make a request or inquiry. For example, you may provide us with your contact information when you sign up for a newsletter or event, purchase gift cards or rent a residential, office, commercial or retail space. If we require information for Know Your Client and due diligence purposes, we may ask you to provide your identification and other information. We might also receive information about you from reputation and background check providers, references, publicly available sources, transaction counterparties and legal counsel as part of due diligence or closing processes or from our companies as part of our monitoring and oversight.
We or our service providers also collect some information automatically through technological means, such as technical and usage information of our digital offerings, and, in some of properties, anonymous video analytics and other foot traffic measurement tools.
If you provide us with personal data about another person such as ownership information of the company you work for, you represent that you have all necessary authority and/or have obtained all necessary consents from that individual to enable us to collect, use and disclose that personal data.
We collect and combine data across our different business activities and our different interactions with you.
We share personal data with our affiliates and service providers who assist us with our business operations.
Oxford and its affiliates are part of a corporate family that includes the legal owners of the properties we manage, develop or invest in. Personal data is shared between these entities for any of the purposes listed in this Privacy Statement. Our reasons for sharing this personal data include:
• Operational Efficiency: Ensuring the efficient management and operation of properties, including maintenance, tenant services, and security.
• Investment Analysis and Decision Making: Collaborating on investment strategies, property acquisitions, and divestitures to optimize our investment portfolio.
• Marketing and Customer Service: Developing targeted marketing campaigns and providing personalized tenant services across our properties.
• Technology Infrastructure and Support: Collaborating on the development and maintenance of technology infrastructure, including shared services and platforms, to improve operational efficiencies and cybersecurity measures across the group.
• Financial Management and Reporting: Coordinating financial operations, including investment performance tracking, financial reporting, and budgeting across the corporate group to ensure financial health and strategic growth.
• Innovation and Development: Sharing insights and data to drive innovation in property development, exploring new market opportunities, and enhancing property features to meet evolving tenant needs.
• Legal Compliance and Risk Management: Coordinating efforts to adhere to legal obligations, manage risks, and ensure the security of tenant and property data.
In addition, we share personal data with third parties such as the following:
• Technology Service Providers: Companies providing the technology infrastructure and services that support our applications, including cloud hosting, software services, and communications tools (such as chatbots) and service providers offering data analytics, machine learning, business intelligence, and AI services.
• Payment and Financial Services: Entities processing payments or providing financial services.
• Event and Promotional Partners: Collaborators on events and promotional activities.
• Marketing and Advertising Agencies: To promote our business activities and properties.
• Advertising Networks and Publishers: Digital advertising platforms, including social media platforms where our ads appear.
• Customer Relationship Management (CRM) Providers: Providers that manage customer, tenant and prospect data.
• Email Marketing Services: Platforms that manage and execute email campaigns, promotions, and communications.
• Social Media Management Tools: Services that help manage interactions and content across social media platforms, streamlining engagement and content distribution.
• Feedback and Survey Platforms: Tools that collect and analyze tenant feedback, aiding in service improvement and tenant satisfaction strategies.
• Background Check Services: Agencies providing credit reporting, reputation, and background verification services.
• Analytics Service Providers: Firms offering data analytics services.
• Insurance Companies: Providers of insurance coverage related to our operations.
• Security Personnel, Law Enforcement and Government Agencies: Security personnel, police and other governmental authorities in compliance with legal obligations and to aid in ensuring our properties are safe for employees, customers, and tenants.
• Professional Advisors: Lawyers, auditors, and management consultants offering legal, financial, or strategic advice.
With your permission or if we are allowed or required by law, we may also share your personal data with other third parties not listed below.
Additional examples of third parties we may share your personal data with or receive your personal data from include:
• Gift Card Issuer, Gift Card Manager and Merchants: The financial institution issuing Oxford gift cards (and our third-party gift card program manager will receive and process your personal information when you participate in our gift card program). You have a direct relationship with the gift card issuer and the merchants where you use your gift card. The privacy policies of these organizations will apply and not this Privacy Statement.
• Visitor Analytics Firms: Organizations specializing in measuring and analyzing visitor data, such as through anonymous video analytics and mobile phone analytics.
• Security Personnel: Contracted security firms and their personnel.
Additional examples of third parties we may share your personal data with or receive your personal data from include:
• References: Third parties you have authorized us to collect information from as part of processing your rental application.
• Real Estate Brokers and Agents: When they are used by us or a prospective tenant to show a property or negotiate a lease.
• Utility Providers: Utility providers if we are involved in setting up or managing utility services for a rental.
• Cleaning and Building Maintenance Service Providers: For the upkeep, cleaning, and repair of property facilities, ensuring a safe and welcoming environment for tenants and visitors.
• Rental Boards and Courts: Landlord and tenant boards and courts for the purposes of enforcing or defending our rights.
• Collections Agencies: Third party collection agencies for the purpose of collecting amounts owing to us.
• Consumer Reporting Agencies: Consumer reporting agencies for the purposes of reporting tenant debts in addition to performing credit checks.
• Security Personnel: Contracted security and concierge services firms and their personnel.
Additional examples of third parties we may share your personal data with or receive your personal data from include:
• Digital Analytics Providers: Services that help analyze usage of our digital offerings, enabling us to improve functionality and user experience.
• Ad Tech Providers: Platforms and various social media tools that assist in identifying and targeting specific audiences for our marketing campaigns.
Additional examples of third parties we may share your personal data with or receive your personal data from include:
• References: Third parties you have authorized us to collect information from as part of processing your leasing application.
• Real Estate Brokers and Agents: When they are used by us or a prospective tenant to show a property or negotiate a lease.
• Utility Providers: Utility providers if we are involved in setting up or managing utility services for a leased premises.
• Cleaning and Building Maintenance Service Providers: For the upkeep, cleaning, and repair of property facilities, ensuring a safe and welcoming environment for tenants and visitors.
• Courts: Courts for the purposes of enforcing or defending our rights.
• Collections Agencies: Third party collection agencies the purpose of collecting amounts owing to us.
• Credit Reporting Agencies: Credit reporting agencies for the purposes of reporting tenant debts in addition to performing credit checks.
• Security Personnel: Contracted security and concierge services firms and their personnel.
If you are an employee of a tenant in one of our buildings, we may share information about you with the tenant. For example, we may share information about your use of your key fob or pass card to enter the tenant’s premises or information about a security incident or property damage.
Additional examples of third parties we may share your personal data with or receive your personal data from include:
• Financial Institutions and Lenders: Banks, mortgage companies, and private lenders involved in financing property purchases and development projects.
• Investment Partners and Co-Investors: Entities participating in joint ventures or investment syndicates for property development and investment.
We do not knowingly collect personal data of children under the age of 14 without the consent of a parent or legal guardian, except in limited situations or where permitted by law without consent. For example, in our residential properties, we collect the name and age of all residents who are minors as part of our safety and security program. In addition, if children in our residential properties are permitted to use building and unit smart locks, these technologies will collect information about the use of those technologies by the children. Our digital offerings are not intended for children under the age of 14. If you are over the age of 14 but under the age of majority in the jurisdiction in which you reside, you may use our services only with permission of a parent or legal guardian.
Oxford and our service providers may incorporate artificial intelligence and machine learning tools to process your personal data, including using it to train and refine algorithms. These tools help us, and our service providers, in internal business activities, such as automating tasks, evaluating data, developing new products and services, securing business systems, and other business purposes. Oxford is committed to the ethical use of your personal data and has developed processes and oversight for the development and use of these tools. This may require that Oxford evaluate an artificial intelligence or machine learning tool for its appropriateness, the sensitivity of the personal data processed, the impact on the rights and freedoms of individuals, and the potential for bias in the tools if they are being used to assist in decision-making.
Cookies are small data files we place on your internet browser when you visit our websites. These are essential for ensuring our websites operate efficiently and remember your preferences (like language or login details) for future visits. Cookies also help us analyze site usage—tracking visitor numbers, traffic patterns, and assessing website performance. Additionally, we use cookies to identify potential interest in our advertisements, allowing us to show our ads to you on social media platforms and other websites.
Some cookies are necessary to ensure that our digital services are working correctly. On your first visit to an Oxford website, you will encounter a banner allowing you to set your cookie preferences for optional cookies. You can adjust your cookie settings anytime by accessing the "Cookie Preferences" link at the bottom of any Oxford web page.
We may use pixels on our websites and in emails to gain insights into how you interact with our content. A pixel, often referred to as a "tracking pixel" or "web beacon," is a tiny image file that is embedded within an email or webpage. When you open an email or visit a webpage containing a pixel, it communicates with the server, allowing our service providers to track certain activities such as whether you have opened an email, clicked on links within it, or how you engage with our website content or advertising. This data helps us to improve your browsing experience and customize our advertising to better match your interests. You can prevent tracking by disabling automatic image loading in your email settings or employing browser extensions designed to block tracking technologies.
Our websites may provide links to websites that are operated by third parties external to Oxford. This Privacy Statement does not describe the privacy policies of any third-party websites or their respective privacy practices. We are not responsible for how such third parties collect, use, or disclose your personal data, so it is important to familiarize yourself with their privacy policies before providing them with your personal data.
We try to keep your data safe and secure. We use technical measures and policies and procedures that are designed to keep your personal data secure. These technical measures, policies and procedures take into account the sensitivity of the personal data.
Our security measures will depend on the sensitivity of the personal data. Examples of security measures are:
• Physical Protections: Secure access to premises and data storage areas.
• Technical Safeguards: Firewalls and, for sensitive data, secure data transmission and encryption.
• Policy and Training: Employee training programs.
• Risk Management: Assessment and mitigation of reasonably foreseeable and likely security risks.
• Incident Response: Protocols for addressing and recovering from data breaches.
• Data Management: Principled data collection, retention, and secure destruction practices.
• Third-Party Oversight: Standards for third party service providers.
You have a shared responsibility to protect your personal data when you use our websites mobile apps and online services. You should ensure your device is up to date and protected by anti-virus and anti-malware software. You should use the latest version of browsers. If you are using one of our online services that requires an account, you should not use the same password you are using on other sites. Keep your password secure and do not share your password with others.
Your personal data may transferred, stored or accessed by our staff or our service providers outside of the jurisdiction in which it has been collected. Transfers of personal data will be made in compliance with applicable data protection legislation and will only be made where there are suitable safeguards in place.
When a transfer takes place, personal data may be subject to the laws of those other jurisdictions, and in certain circumstances, the courts, law enforcement agencies, regulatory agencies or security authorities in those other jurisdictions may be entitled to access your personal data.
We try to ensure that the personal data we collect about you is accurate, complete and up to date. However, we rely on you to provide accurate data in the first instance, and to notify us when there is a change in your personal data. In certain circumstances we may verify personal data or obtain additional personal data through third parties.
In some jurisdictions you have, subject to some legal limitations, the following rights respecting your personal data:
• Right of access. You have the right to access and obtain a copy of your personal data.
• Right to rectification. You have the right to obtain rectification of any inaccurate or incomplete personal data we hold about you without undue delay.
• Right to deletion/erasure. You have the right to require us to delete/erase your personal data without undue delay if the continued processing of that personal data is not justified.
• Right of portability. You may have the right to receive a copy of the personal data you have provided to us in a structured, commonly used, machine-readable format that supports re-use, or to request the transfer of your personal data to another person. (Applicable only in the United Kingdom, the European Economic Areas and certain other jurisdictions.)
• Right to restriction. You may have the right to require us to limit the purposes for which we process your personal data if the continued processing of the personal data in this way is not justified, such as where the accuracy of the personal data is contested by you. (Applicable only in the United Kingdom, the European Economic Areas and certain other jurisdictions.)
• Right to object. You may have a right to object to any processing based on our legitimate interests where there are grounds relating to your particular situation. There may be compelling reasons for continuing to process your personal data, and we will assess and inform you if that is the case. You can object to marketing activities for any reason. (Applicable only in the United Kingdom, the European Economic Areas and certain other jurisdictions.)
If you would like to exercise any of these rights, contact our Privacy Office. See “Who can you contact with questions or concerns?” Not all rights are available in all jurisdictions.
You may also have a right to complain to the privacy commissioner or data protection authority in the place where you interact with us. Before exercising that right, we encourage you to write to our Privacy Officer to permit us to investigate your concerns and address them if they are well-founded.
You can control the collection and use of your personal data in the following ways:
• Opting Out of Marketing Communications: You have the option to unsubscribe from our marketing emails by following the unsubscribe instructions in any marketing email you receive. To opt out of promotional text messages, reply with "STOP". Opting out does not apply to non-promotional messages.
• Managing Mobile Location Analytics: You can opt-out of our foot-traffic data collection that uses mobile analytics by visiting https://smart-places.org/.
• Interest-Based Advertising and Analytics: You can set preferences through the Cookie Settings link in each of our website’s footers. You can also use your browser settings to manage cookies. You can also opt-out of personalized
advertising content, by visiting Digital Advertising Alliance of Canada Opt-Out Page (Canada), and the Ad Choices Opt-Out Page (United States), https://youronlinechoices.eu/ (Europe/UK). You can opt out of Google Analytics at: https://tools.google.com/dlpage/gaoptout/.
Our data retention practices are designed to ensure we only store personal data for as long as necessary to achieve the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements in the jurisdictions in which we do business. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and applicable legal requirements.
As our business activities change or legal rules change, the way in which we collect, use, and disclose personal data may change. When this happens, we will update our Privacy Statement to reflect the changes. You can review our updated Privacy Statement at any time by visiting our website https://www.oxfordproperties.com/home/privacy-policy, or by requesting a copy from our Privacy Officer.
We have appointed a Privacy Officer who is responsible for overseeing our compliance with applicable privacy laws. If you have any comments or questions about our Privacy Statement, or if you believe that we have not complied with our Privacy Statement, please contact our Privacy Officer as follows:
Oxford Properties Group
ATTN: Privacy Officer
900-100 Adelaide Street West
Toronto, ON M5H 0E2
Email: privacy@oxfordproperties.com
As a resident of the European Economic Area and/ or the United Kingdom you are entitled to additional information about our data processing practices for personal data we collect from you in the European Economic Area and/or the United Kingdom. You also have additional privacy rights with respect to that personal data. If you have questions about any of these rights, please feel free to reach out to our Privacy Officer at privacy@oxfordproperties.com. This Special Information section does not apply to the personal data that we collect in our properties in Canada if you are a visitor to one of our properties.
The controller of your personal data will vary according to the Oxford Properties Group entity that is processing your personal data and the location of that entity. See the chart below to identify the controller responsible for your personal data.
| Region | Corporate Entity | Address of Corporate Office | Privacy Contact |
|---|---|---|---|
| UK | Oxford Properties Management (UK) Limited | The Leadenhall Building, 122 Leadenhall Street, London, United Kingdom, EC3V 4AB | Oxford Privacy Officer: privacy@oxfordproperties.com |
| Germany | Oxford Properties Management (Germany) GmbH | Kemperplatz 1, 10785 Berlin | DPO: Dr. Antje D. Johst |
| Forum Event Management GMBH | Kemperplatz 1, 10785 Berlin | DPO: Dr. Antje D. Johst | |
| France | Oxford Properties Management (France) SAS | 25 boulevard Malesherbes, 75008 Paris | Oxford Privacy Officer: privacy@oxfordproperties.com |
| Luxembourg | CPG Commercial Re Europe S.A.R.L. | 6 rue Jean Monnet, Luxembourg L-2180 | Oxford Privacy Officer: privacy@oxfordproperties.com |
| Personal Data | Type of Processing | Legal Basis for Processing |
|---|---|---|
| Contact Information Name, email address, and other contact details |
Responding to inquiries and requests | The processing is necessary for our legitimate interests, namely dealing with inquiries and requests |
| Promotional communications | The processing is necessary for our legitimate interests, namely marketing In some cases the processing is based on your consent | |
| Transaction fulfillment | The processing is necessary for the performance of our contractual obligations to you | |
| Communications and Service Requests Responding to your inquiries and requests |
Fulfilling your requests for assistance | The processing is necessary for our legitimate interests, namely dealing with inquiries and requests |
| Transaction Data Transaction details from purchases of our goods and services and lease payments, including banking data and other financial information |
Processing payments | The processing is necessary for the performance of our contractual obligations to you |
| Records of our transaction | The processing is necessary to comply with our legal obligations to retain purchase records | |
| Social Media Engagement Mentions and interactions in your social media feed |
Analyzing customer sentiment Developing and delivering interest-based advertising |
The processing is necessary for our legitimate interests, namely business improvement and marketing |
| Subscriptions and Events Data Preferences for promotional communications and event invitations |
Promoting our properties, brand and products and services | The processing is necessary for our legitimate interests, namely marketing and recording of your preferences |
| Survey Data Responses to our surveys |
Analyzing customer sentiment | The processing is necessary for our legitimate interests, namely business improvement and marketing |
| Wi-Fi Usage Data Login credentials, data use, and device information |
Providing Wi-Fi services Securing Wi-Fi services Analyzing usage |
The processing is necessary for our legitimate interests, namely securing our services |
| Digital Account Data User name and password and activities in your account and information shared by your social media provider if you use a social login |
Securing our digital offerings | The processing is necessary for our legitimate interests, namely securing our services |
| Fulfilling your requests | The processing is necessary for the performance of our contractual obligations to you | |
| Digital Usage Data Click-stream data from your use of our websites and mobile apps and interactions with our digital advertising Location data from GPS location services or inferences from IP addresses |
Analyzing the use of our digital properties Developing and delivering interest-based advertising Security our digital offerings |
The processing is necessary for our legitimate interests, namely security our services, business improvement and marketing |
| Due Diligence Data Background, credit and reputation checks |
Processing large value transactions | The processing is necessary for our legitimate interests, namely reputation management and mitigating money laundering risks |
| Evaluating applicants for leasing | The processing is necessary for our legitimate interests, namely evaluating your suitability to lease from us | |
| Complying with Know Your Client obligations | The processing is necessary to comply with legal obligations | |
| Occupancy Data Foot traffic and other occupancy counters |
Understanding the number of unique visitors to our properties and patterns of use of our properties | The processing is necessary for our legitimate interests, namely reputation management and mitigating money laundering risksThe processing is necessary for our legitimate interest, namely to inform our business operations and improvements to our business. |
| Video data, security and other incident reports CCVS and security guard records |
Securing our premises and investigating incidents | The processing is necessary for our legitimate interests, namely the security of our premises and enforcement of our legal rights |
| Diversity and Inclusion Data Information collected for our diversity and inclusion programs |
To benchmark and improve our diversity and inclusion initiatives | The processing is based on your optional consent |
This California Privacy Statement supplements the information contained in our Privacy Statement and applies solely to individual residents of the State of California.
Collection and Use of Personal Information
We collect personal information for a variety of purposes. Please refer to "What type of personal data do we collect and how do we use it?" in our Privacy Statement for more information. We do not have actual knowledge that we sell the personal information of minors under 16 years of age.
In the last 12 months, we have collected the following categories of personal information:
• contact information, such as your name, address, phone number, email address
• identifiers, such as your passport, government identification number, driver’s license or utility bill, and information relevant to our screening for compliance and background checking purposes
• communications records, including call records, email, chatbots and other communications with us
• transaction information, such as if you use our services (including parking, Wi-Fi, websites, mobile apps and other services), attend our events, enter our contests or sweepstakes, lease with us or enter into a business investment or development with us
• protected classification characteristics, such as age and gender for the purposes of due diligence for business transactions
• internet/network information, such as your IP address, or browser or device information
• geolocation data, such as information about your physical location collected from geolocation features on your device, including your IP address
• sensory information, such as closed-circuit video of you
• passcard data, such as data about your use of passcards, fobs, or smart locks
• professional or employment information, such as your employing entity, business unit, manager and management reporting structure, job title, function and the nature or your duties and responsibilities
• other personal information, such as responses to surveys, participating in events, interactions through social media, and other information you provide to us
• network advertising data, such as information about whether, when and how you interacted with our advertising
• inferences, including information generated from your use of our websites reflecting predictions about your interests and preferences
• incident reports, such as data relation to security and health and safety incidents
Sources of Collecting Personal Information
We collect this information from a variety of sources including, but not limited to:
• directly from you
• from your browser or device
• from information generated from your online browsing and usage activity
• service providers
• third parties we use to conduct background, credit checks or other investigations or that you direct to share information with us
Purposes for Collecting Personal Information
We may collect, use or disclose personal information about you for one or more of the following purposes:
• To fulfill or meet the reason you provided the information. For example, if you share your name and contact information to ask a question about our services, we will use that personal information to respond to your inquiry.
• To deal with enquiries, requests and complaints made by or about you relating to our services.
• To communicate with you, including through email to provide you updates, alerts, news and mailings relating to seminars or events that we think may be of interest to you.
• To operate, maintain, and provide to you the features and functionality of our services.
• To market to you, including through email.
• To send you statements and invoices in relation to any agreement between us to provide you with any part of the services.
• To better understand the demographics of our users.
• To personalize your experience and to deliver custom content and product and service offerings relevant to your interests, including targeted offers and ads through our website, third-party sites, or on other devices you may use.
• To recognize you and remember your information when you return to our websites and services.
• To help maintain the safety, security, and integrity of our services, technology assets, and business.
• To protect the health and safety of our personnel and visitors to our premises.
• For testing, research, analysis, and product development, including to develop and improve our services.
• To assist you in sharing content from our services, or your experiences on our services, with your friends, followers or contacts on a social network.
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
Disclosure of Personal Information
We do not sell personal information of California residents for money or valuable consideration.
In the previous 12 months, we have disclosed all of the categories of personal information we collect to third parties for a business purpose. The categories of third parties can be found in "Is your personal data shared with third parties?" in our Privacy Statement.
Your Privacy Choices
Please see :What are your rights respecting your personal data?" for a description of your rights.
How to Exercise Your Privacy Rights
If you would like to exercise any of these rights, contact our Privacy Officer at:
Oxford Properties Group
ATTN: Privacy Officer
900-100 Adelaide Street West
Toronto, ON M5H 0E2
Email: privacy@oxfordproperties.com
We will need to verify your identity before processing your request. In order to verify your identity, we will generally require the matching of sufficient information you provide us to the information we maintain about you in our systems. We may decline a request to exercise the right to know and/or right to deletion in certain instances, particularly where we are unable to verify your identity. If we are unable to comply with all or a portion of your request, we will explain the reasons for declining to comply with the request.