Privacy Statement

Last Updated: March 2023

The National Association of Real Estate Investment Trusts, Inc. (dba Nareit) (“Nareit,” “we,” “ us,” or “our”) respects your privacy and is committed to protecting your personal information.

This Privacy Statement addresses Nareit’s practices regarding information collected from or about you through our website, reit.com, and any other website where this Privacy Statement is posted or linked (collectively, the “Site”); through our mobile applications (each, an “App”); through certain content, services, programs, products, or benefits we offer (collectively, our “ Products”); through your membership and publications, events, meetings, conferences, or forums we provide or host (each, an “ Event”); and through our offline interactions with you, including via telephone, text, facsimile, postal mail, or personal delivery (collectively, the “Offline Services”). The Site, our Apps, our Products, our Events, and Offline Services are collectively referred to as the “Services.”

This Privacy Statement is incorporated into our Terms and Conditions of Use by reference, as if set forth fully therein. Your access and use of the Services will be deemed to indicate your acceptance to both this Privacy Statement and all of such Terms and Conditions of Use.

For any questions, Nareit can be contacted at websupport@reit.com or by telephone at 202-739-9400.

1. INFORMATION COLLECTION

There are several ways we may obtain information about you, including: (A) directly from you; (B) automatically through the Site or an App; and (C) from third parties. The information we may obtain includes information that identifies you directly (i.e., your name) or is otherwise related to or linkable to you as an identified or identifiable individual ( i.e., information about your use of the Site or an App). In this Privacy Statement, this information is collectively referred to as “personal information.”

A. Information You Provide

Nareit collects personal information from you when you choose to share it with us. This may include when you use the Site or an App; register or create an online account on or through the Site or an App; register as a speaker, attendee, or sponsor of an Event; complete and submit any of our online forms (including registration and member forms); purchase our Products or other services; request information from us; sign up for our newsletters or our email list; use the Services; enter into sweepstakes or other promotions administered by us (or on our behalf); complete a survey administered by us (or on our behalf); contact us to request support; or otherwise communicate with or contact us.

The categories of personal information we may collect through the Services include:

• Identity Data, which includes your first and last name or other similar identifiers and title.
• Contact Data, which includes your physical address, email address, and telephone number(s).
• Financial Data, which includes your credit card, debit card, or other payment card details; bank routing numbers; and related information (such as CVV, expiration date, and billing address).
• Transaction Data, which includes details about payments to and from you.
• Profile and Preference Data, which includes your username and password; your dining interests, dietary restrictions, and food allergies; and any information that you provide regarding your preferences.
• Marketing and Communications Data, which includes your preferences in receiving marketing and promotional materials from us.
• Content Data , which includes any content which you post or upload to the Site or an App, such as comments/questions and other text or images that contain personal information.
• Audio and Visual Data , such as your voice and likeness as captured in photographs or video/audio recordings if you attend an in-person Event.
• Other Data , which includes any other information that you choose to provide during your interactions with us, including your responses to surveys administered by us or on our behalf or other feedback that you provide.

If you post in a public space on the Site or in an App (e.g., in blogs, social media platforms, on message boards, or in chat rooms) or otherwise choose to make information public, we may collect such information. If you choose to share personal information publicly, please understand that we cannot control the actions of third parties who also may have access to or collect this information. Please exercise caution when disclosing personal information in these public areas.

Providing your personal information is completely voluntary. However, if you do not wish to provide certain information through the Services, you may be unable to participate in certain programs, activities, or Events, or access or use certain areas of the Site or an App.

B. Information Automatically Collected

Whenever you visit or interact with the Site or our Apps (collectively, the “Online Services”), we (and our service providers and partners), may use a variety of technologies, such as cookies, web beacons, pixel tags, log files, or other technologies to automatically or passively collect certain information about your online activity. For information about our use of cookies and other similar technologies, you can read our Cookie Policy.

The specific types of information we (and our service providers and partners) may collect automatically when you visit and interact with the Online Services include:

• Computer or Device Information , which includes the Internet Protocol (“IP”) address and/or other unique identifier(s) assigned to your computer or mobile device, the location of your computer or mobile device, and other information about your browser, device, and operating system.
• Usage Information , which includes information about your interaction with the Online Services (e.g., the date and time of your visit(s), the areas or pages that you visit; the files you download; the amount of time you spend viewing or using the Site or an App, the number of times you return to the Site or an App, the domain name from which you accessed the Site or an App, and other click-stream or site usage data) and the actions you take upon receipt of an email from us).

Third-Party Analytics

We use third parties’ analytics and tracking tools to better understand who is using the Online Services, how people are using the Online Services, how to improve the effectiveness of the Online Services and related content, and to help us or those third parties serve more targeted advertising to you across the Internet. These third-party analytics partners may use cookies, web beacons, pixel tags, log files, Flash cookies, HTML5 cookies, or other technologies to automatically collect and store your information.

For example, we use Google Analytics, a web analytics tools that may set cookies in your browser to help us understand how visitors engage with the Online Services. To learn more about Google Analytics’ data practices, please visit this page. To disable Google Analytics, please download and install the Google Analytics opt-out browser add-on, which is available here.

Please note that our third-party analytics providers may combine information they collect from your interaction(s) with the Online Services with information they collect from other sources.

C. Information Collected From Other Sources

We may acquire information about you from other sources, such as:

• Your employer or colleagues (when they share the information with us for registration or other similar purposes);
• Publicly-available sources, such as publications and other websites;
• Industry partners and event sponsors (when they share the information with us); and
• Other partners and service providers (including, for example, our analytics providers, social media platforms, advertising networks, and other advertising partners).

We use the information we receive from other sources to provide the Services and fulfill the purposes described in this Privacy Statement.

D. Combination of Information

We may combine the information we receive from and about you, including information you provide to us, information we automatically collect through the Online Services, and information we receive from third-party sources and use the combined information for the purposes described in this Privacy Statement.

2. INFORMATION USE

A. Providing the Services and fulfilling our business purposes

We use your personal information to provide the Services and as otherwise necessary or appropriate to accomplish our business purposes, including to:

• Provide, administer, and manage the Services;
• Respond to your inquiries and contact and communicate with you when necessary (for example, we may contact you regarding an Event for which you have registered, or with information concerning renewal notices or outstanding balances);
• Confirm and process your transactions (such as processing your registrations or purchases);
• Facilitate and promote our Events (for example, we may prepare and provide a list of attendees, speakers, and sponsors in an App or at an Event), or to identify our members or registered users on the Online Services;
• Enhance your online experience, including to remember your online profile and preferences for future visits, or to create site content that is relevant to your interests;
• Review the usage and operations of the Services, develop new products or services, and perform statistical analysis to enhance or improve our content, products, and services;
• Provide you with customized content (including advertisements), targeted offers, and communications through the Online Services; via email; or across other websites, mobile applications, social media, or online services;
• Send you information, newsletters, and promotional materials from Nareit or on behalf of our partners and affiliates;
• Maintain internal records relating to feedback or complaints or to fulfill our recordkeeping requirements;
• Invite you to participate in voluntary surveys or research;
• Protect the security or integrity of the Services, our business, and our systems and networks (for example, to identify potential hackers and other unauthorized users, detect and prevent fraud, unauthorized transactions, claims, and other liabilities and manage our risk exposure);
• Comply with applicable law and respond to requests and communications from law enforcement authorities or other government officials;
• Carry out business transactions in which personal information held by us is among the assets transferred or is otherwise relevant to the evaluation, negotiation, or completion of the transaction; and
• Fulfill other purposes disclosed at the time you provide your information or otherwise with your consent.

Without limiting the foregoing, Nareit reserves the right, but not the obligation, to monitor any and all communications submitted through the Services or posted on the Online Services. Such voluntary information provided or posted by you may be collected and used by Nareit in accordance with this Privacy Statement.

If you reside in the European Economic Area (EEA), Switzerland, or the United Kingdom (UK), please see the section below titled “Additional Disclosures for EEA, Switzerland, and UK Residents” for additional information, including our lawful basis for processing your personal information and your legal rights.

B. Interest-Based Advertising

We (and our partners) may use your personal information to deliver advertisements to you on the Online Services and/or across third-party online services that are tailored to your interests (and to measure the effectiveness of such advertisements).

The interest-based advertisements that you see may be based on personal information collected over time, including through the use of cookies, web beacons, pixel tags, and similar technologies. They may also be based on your contact data (e.g., your email address or telephone number) that has been hashed (i.e., converted into a unique string of numbers and letters) and shared with a social media platform so that it can be matched against the platform’s own data for the limited purpose of serving advertisements to you (and measuring the effectiveness of such advertisements).

We also may use personal information we collect through your use of the Services and information that we receive from our advertising partners and other third parties to deliver advertising that is targeted to individuals with similar interests or demographics. This is typically done through the Facebook or Twitter Custom Audience features or other similar business tools. These tools allow us to create groups based on actual or assumed shared interests, demographics, and/or factual characteristics.

We use your personal information for interest-based advertising purposes in accordance with applicable law. For information on your choices with respect to interest-based advertising, see the “Your Choices and Opt-Outs” section below.

3. INFORMATION SHARING

We may share your personal information with the following categories of information recipients:

• Our Service Providers : We share your personal information with third parties that provide business, professional, or technical support functions for us (including to the extent necessary to process a payment and conduct related transactions), help us operate our business and the Services, or administer activities on our behalf.
• Our Corporate Members : We share your personal information with our corporate members as necessary or appropriate to fulfill our business and operational purposes.
• Our Event Partners and Sponsors : We share your personal information with third parties, including other trade associations, that we partner with on an Event or that co-sponsor an Event you register for and/or attend for their marketing or other business purposes.
• Third parties in connection with sweepstakes, contests, and promotions : If you choose to enter into one of our sweepstakes, contests, or other promotions (“Promotion”), we will share your personal information with third parties or the public in connection with the administration of such Promotion, as required by law, as permitted by the Promotion’s official rules, or otherwise in accordance with the terms of this Privacy Statement.
• Our analytics providers : We share your personal information with parties that assist us in performing analytics and help us measure the effectiveness of the Services and our marketing and advertising efforts.
• Our marketing and advertising partners : We share your personal information with our marketing and advertising partners, including social media networks, third-party advertising networks, and other parties that assist us in serving and optimizing our advertisements.
• Government and public authorities : We share your personal information with government and public authorities in response to subpoenas, court order, judicial processes, government or regulatory requests, or other form of legal process or in connection with an investigation on matters related to public safety, in each case as permitted or required by law or if we have determined that such disclosure or distribution is necessary or appropriate to protect the life, health, safety, or property of Nareit or any other person or entity.
• Relevant third parties in connection with a sale or transfer of business or assets : We may sell or purchase assets during the normal course of our business. If another entity acquires us or any of our assets, your personal information may be transferred to such entity. In addition, if any bankruptcy or reorganization proceeding is brought by or against us, your personal information may be considered an asset of ours and may be sold or transferred to third parties. Should such a sale or transfer occur, we will seek commitments from the transferee to use the personal information that we share in a manner that is consistent with this Privacy Statement.
• Other third parties : We will share your personal information with certain third parties with your consent or at your direction. We will also share your personal information with relevant third parties as we believe necessary or appropriate either to: (i) respond to any claims or to prevent, investigate, identify persons or organizations potentially involved in, or take any action regarding suspected fraud, violations of our Terms and Conditions of Use, or other applicable terms; (ii) allow us to pursue available remedies or limit damages that we may sustain; or (iii) protect our rights, property, privacy, safety, and/or those of others.

We may share your personal information for other reasons that we will describe at the time of information collection or prior to disclosing your information.

Additionally, we may de-identify, anonymize, or aggregate information so that it will no longer be considered personal information and share such information with the categories of recipients listed above and/or other parties for purposes consistent with those described in this Privacy Statement.

4. INFORMATION SECURITY

We have put in place appropriate security measures designed to prevent the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal information. However, due to the inherent open nature of the Internet, we cannot ensure or warrant the security of any information provided online. We have put in place procedures to deal with any suspected data breach that might affect you and will notify you and any applicable regulator of a breach where we are legally required to do so.

In addition, to protect your personal information, never share your password with anyone, and if you feel that your password has been discovered, you should change it immediately by logging on to the Online Services and accessing your profile to change your password, or by contacting us at websupport@reit.com or by telephone at 202-739-9400.

5. INFORMATION RETENTION

We will retain your personal information for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information; the potential risk of harm from unauthorized use or disclosure of the information; the purposes for which we process the information; whether we can achieve those purposes through other means; and the applicable legal requirements.

6. ADDITIONAL DISCLOSURES FOR EEA, SWITZERLAND, AND UK RESIDENTS

The following disclosures are provided for individuals located in the EEA, Switzerland, and the UK, in accordance with applicable data protection law.

Our legal basis for processing your personal information

Below are the legal bases that we will rely on to process your personal information:

• Legitimate interests : We may rely on one or more of our legitimate interests to process your personal information, provided that our interests are not overridden by your interests or fundamental rights and freedoms. In particular, we may collect and use your personal information in reliance on a legitimate interest in managing our relationship with you; conducting and managing our business; developing and enhancing the Services; detecting and preventing fraud and other harmful activities; and monitoring and maintaining the security of our information, systems, and networks.
• Contractual necessity : We may process your personal information where it is either necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.
• Consent : We may rely on the consent that you provide us at the point of information collection or disclosure to process your personal information.
• Compliance with a legal obligation : We are subject to various legal requirements in the jurisdictions in which we operate, and we may process your personal information if necessary for us to comply with a legal or regulatory obligation to which we are subject.

Your legal rights

Under applicable law and subject to relevant exceptions, you may have the right to:

• Request confirmation as to whether we are processing your personal information, and if so, to request access to the personal information and details regarding our processing.
• Request correction of inaccurate or incomplete personal information that we hold about you.
• Request deletion of your personal information (subject to applicable exceptions).
• Object to our processing of your personal information under certain circumstances.
• Request that we restrict our processing of your personal information in certain circumstances.
• Request that we transmit your personal information to a third party (where technically feasible).
• Withdraw the consent you have provided us to process your personal information (without affecting the lawfulness of any processing carried out before you withdrew your consent).
• Lodge a complaint about the way we handle or process your personal information with your national data protection regulator.

You will not have to pay a fee to access your personal information (or to exercise any of your other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

In order to protect your privacy and confirm that you are entitled to exercise the above-listed rights, we may need to request specific information from you to help us confirm your identity. Where applicable, we will use the requested information for verification purposes only. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests as soon as practicable and within one month. Occasionally it may take us longer than a month if your request is particularly complex, or you have made a number of requests. In this case, we will notify you and keep you updated.

To exercise your rights, please contact us at websupport@reit.com or by telephone at 202-739-9400.

7. YOUR CHOICES AND OPT-OUTS

A. Cookies and Other Similar Technologies and Tracking

Certain parts of the Online Services require cookies. You are free to adjust your device or Internet browser settings to limit certain tracking or to decline cookies, but by doing so, you may not be able to use certain features on the Online Services or take full advantage of all of our offerings. Please refer to your device’s settings or your Internet browser’s “Help” section for more information on how to manage cookies and limit tracking on your device or browser. For more information about cookies, please visit our Cookie Policy.

Our system may not respond to Do Not Track requests or headers from Internet browsers.

B. Interest-Based Advertising Choices

Some browsers, websites/platforms, and mobile devices allow you to exercise certain choices with respect to interest-based advertising. Additional details can be found below.

Web browser opt-out : You may be able to opt out of receiving interest-based advertisements using the browser opt-out tools and consumer choice mechanisms provided by interest-based advertising self-regulatory groups by following the links below:

• Digital Advertising Alliance (DAA) : http://www.aboutads.info/choices .
• European Interactive Digital Advertising Alliance (EDAA) : http://www.youronlinechoices.eu/ .
• Network Advertising Alliance (NAI) : http://www.networkadvertising.org/choices/ .

Mobile application opt-out : You have the ability to control whether you see interest-based advertisements on your mobile device(s) in the following ways:

• Your device operating system may provide mechanisms that allow you to opt in or opt out of the use of information about your use of mobile apps to deliver interest-based advertising to your mobile device. For more information, consult your device settings.
• The DAA offers a tool for opting out of the collection of cross-app data on mobile devices for interest-based advertising. To exercise your choices with respect to participating companies, please download the AppChoices tool at www.aboutads.info/appchoices.

Please note that you will need to opt out separately on all of your browsers and devices, as each opt-out will apply only to the specific browser or device from which you opt out. If you delete or reset your cookies or mobile identifiers, change browsers, or use a different device, any opt-out cookie or tool may no longer work and you will have to opt out again. Please also note that even if you choose to opt out of receiving interest-based advertising, you may still receive advertising, but the advertisements you see may be less relevant to you.

Some of our advertising partners may provide you with additional choices with respect to interest-based advertising. For example, certain social media platforms may allow you to control your advertising preferences directly through their services. Please review the privacy statements of the third-party services you use for more information.

C. Marketing Choices

As noted above, we may send you periodic marketing and promotional emails, and we will obtain your consent to do so, where required by law. If you no longer wish to receive marketing and promotional emails from us, you can unsubscribe by following the unsubscribe instructions in any such email or by contacting us by email at websupport@reit.com or by telephone at 202-739-9400. Please note that even if you opt out of receiving marketing and promotional emails from us, we may still send you administrative and transactional messages from which you cannot opt out.

8. THIRD-PARTY LINKS AND SERVICES

The Online Services may include links to third-party websites, plug-ins, and applications or connections to social media platforms. Clicking on those links or enabling connections to other services may allow third parties to collect or share information about you.

This Privacy Statement does not address, and we are not responsible for, the privacy or other practices of any third parties. Any information that you provide to a third party or that you post to a third-party service is governed by the applicable party’s terms and privacy statement. We encourage you to read the privacy statements of every service with which you interact.

9. CHILDREN’S PRIVACY

The Services are not intended for or directed to children under the age of 18, and Nareit does not knowingly collect personal information online from children under the age of 18. You must be at least 18 years of age in order to use the Online Services and to provide information through the Online Services. By using the Online Services, you represent to Nareit that you are 18 years of age or older.

10. CROSS-BORDER TRANSFERS

The Services are hosted and operated in the United States. As a result, depending on your country of residence, your personal information may be transferred to countries and regions with data protection and privacy laws that differ from those in your country of residence.

By using the Services, you acknowledge that your personal information may be transferred outside of your country of residence. You also understand that your personal information may be stored in the United States and may be subject to lawful requests by the courts or law enforcement authorities in the United States.

If you are situated in the EEA, Switzerland, or the UK, please note that whenever we transfer your personal information to countries or regions that have not been recognized by the European Commission and/or the Swiss or the UK government as providing an adequate level of protection for personal information, we ensure appropriate and suitable safeguards are in place to protect your information. In particular, we may use government-approved contracts that provide appropriate safeguards for personal information that is transferred to countries that have not been recognized as providing an adequate level of protection.

11. YOUR CALIFORNIA PRIVACY RIGHTS

If you are a California resident, California Civil Code Section 1798.83 provides you with the right to request certain information regarding our disclosure of your personal information to third parties for their direct marketing purposes during the immediately preceding calendar year, including a description of the categories of personal information disclosed.

To make such a request, please send an email to websupport@reit.com or write us at the postal address below. This request may be made no more than once per calendar year. We will respond to your request in accordance with applicable law.

12. UPDATES TO THIS PRIVACY STATEMENT

Nareit may update or make changes to this Privacy Statement at any time in its sole discretion and without notice. The “Last Updated” date at the top of this page indicates when this Privacy Statement was last revised. Any changes to this Privacy Statement will become effective when we post a revised version on this page unless otherwise specified. We encourage you to review this Privacy Statement periodically to remain informed about our information handling and privacy practices.

13. CONTACT US

If you have any questions or comments regarding this Privacy Statement or our information handling practices, please contact our General Counsel using the details set out below.

Full name of legal entity: Nareit

Name or title: General Counsel

Email address: websupport@reit.com

Postal address: 1875 I ST NW, Suite 500, Washington DC, 20006 United States of America

Telephone number: (+1) 202-739-9400