Last Revised: June 18, 2020
2. Types of Information We Collect
3. How We Collect Information
4. How We Use Your Information
5. How We Respond to “Do Not Track” Signals
6. Communications with You
7. Information Sharing with Third Parties
9. Protection of Personal Information
10. Updating Your Information
11. Notice of Privacy Rights of California Residents
2. TYPES OF INFORMATION WE COLLECT
We may collect information that identifies, relates to, describes, is capable of being associated with, or could be reasonably linked, directly or indirectly, with you as an individual or with your particular household (“Personal Information”).
We may also collect information that does not personally identify the individual to whom the information relates, such as information that is aggregated by SCP or a third party, or information that is not linked to contact information or other personally identifiable information of an individual (“Non-Personally Identifying Information”).
Numerous examples of Personal Information are listed in the chart below. However, if and to the extent those examples of information are collected but cannot be reasonably linked to you or your household, they are considered Non-Personally Identifying Information. We may combine Personal Information we collect with other Non-Personally Identifying information that we obtain from any source and will treat any such combined information as Personal Information.
We or third parties may also collect information from you automatically from your usage of your cell phone, iPad, laptop or other electronic devices and the applications on those devices, or when you use the Sites or Wi-Fi Services (“Usage Information”). This information may include, without limitation, your IP address, Site usage statistics, time stamps, browsing history, and other information regarding your use of the Sites and Wi-Fi Services. Some Usage Information may be considered Personal Information if and to the extent it is linked to any information that reasonably identifies you.
Depending on how you have interacted with SCP, we may have collected certain information within the following categories of Personal Information from you in the last 12 months. Please note that we have not collected every type of Personal Information identified in the examples below, and the types of Personal Information we have collected on any consumer depends on the consumer’s interaction with us.
|Identifiers.||This category may include: name, postal address, unique personal identifiers, online identifiers, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers. Under the CCPA, “unique identifiers” or “unique personal identifier” means a persistent identifier that can be used to recognize a consumer, a family, or a device that is linked to a consumer or family, over time and across different services.||YES|
|Personal Information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).||This category may include: name, signature, Social Security number, physical characteristics, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education or employment information, financial account numbers, medical information, or health insurance information.||YES|
|Protected classification characteristics under California or federal law.||This category may include: age, race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex and gender information, veteran or military status, or genetic information.||YES|
|Commercial information.||This category may include: records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.||YES|
|Biometric information.||This category may include: imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a face print, a minutiae template, or a voiceprint, can be extracted.||NO|
|Internet or other electronic network activity information.||This category may include: browsing history, search history, and information regarding interactions with an Internet Web site, application, or advertisement.||YES|
|Geolocation data.||This category may include: physical location or movements.||NO|
|Sensory data.||This category may include: audio, electronic, visual, thermal, olfactory, or similar information.||YES|
|Professional or employment-related information.||This category may include: current or past job history or performance evaluations.||YES|
|Non-public education information||This category may include: education records directly related to a student maintained by an educational institution or party acting on its behalf (e.g., grades, schedules, student ID numbers).||NO|
|Inferences drawn from other Personal Information.||This category may include: inferences drawn from the above information that may reflect your preferences, characteristics, predispositions, behavior, or attitudes.||YES|
We may collect Personal Information and/or Non-Personally Identifying Information from you when you: visit the South Coast Plaza shopping center, use the Sites or register to receive emails or newsletters; use the Wi-Fi Services; contact, communicate or otherwise interact with SCP via the Sites or offline; make a payment to SCP; apply for a job at SCP; or register, enroll or participate in any events, promotions, sweepstakes, surveys, questionnaires, or other activities (collectively, “Activities”) that may be offered on the Sites or offline.
We may obtain Personal Information from third parties including, without limitation, the purveyors of usage information, the owners or operators of the websites or applications where our advertisements appear, and our affiliates, suppliers, vendors, merchants, licensors, Activities partners or sponsors, and other sources. Non-Personally Identifying Information may also be obtained through these sources, as well as from inferences based upon the Sites you visit; third party data; information you share on other sites, social media platforms and applications; and demographics derived from profiles or accounts that you create.
If you make a purchase or receive a gift from SCP, we may obtain Personal Information, and/or Non-Personally Identifying Information about you from you (for example, you may be asked to present the receipt from your purchase) or from the payment method provider used for the purchase. Please review the privacy policies for your payment method provider before using it to make a purchase from SCP.
We also may collect information using cookies, web beacons, pixels, gifs, tags or other technologies (“Collection Technology”), or through third parties using similar technologies. Collection Technology may operate as a piece of data stored on your browser or device, or may identify, compile, aggregate and/or collect information through other means. When you visit the Site or use the Wi-Fi Services, your web browser may use Collection Technology to better enable you to navigate the Site during your visit and upon your return. You may use the Site even if you choose to reject or delete certain Collection Technology. Collection Technology also may be used by some of the other websites for which a link is placed on the Site.
The Sites may use Google Analytics. Google Analytics uses Collection Technology to collect and store anonymous information about you, which may include Usage Information and other Non-Personally Identifying Information described above. For more information about Google Analytics follow this link. You can opt-out from being tracked by Google Analytics in the future by downloading and installing Google Analytics’ Opt-out Browser Add-on for your current web browser by following this link. The Sites may use certain features of Google Analytics based on Display Advertising, such as:
- “Demographics and Interest Reporting” to analyze information regarding the interests and demographics of users of the Sites. We use such Non-Personally Identifying Information in the same manner as we use other Non-Personally Identifying Information as described below.
- “Remarketing with Google Analytics” to place ads on other sites directed to people who have visited the Sites.
- “Google Display Network Impression Reporting” to report how people’s interactions with our ads relate to their visits to the Sites.
- Integrated services that require Google Analytics to collect data via advertising cookies and identifiers.
4. HOW WE USE YOUR INFORMATION
We may use the information we collect:
- To provide information to third parties that may provide you with general or personalized content and advertising about their stores, restaurants, Activities, products and services.
- To alert you to new features, terms, Activities, stores, restaurants, products or services.
- To send emails or newsletters, and to provide you with general or personalized content in the newsletters.
- To monitor and analyze information regarding your browsing and viewing preferences.
- To analyze our users’ and visitors’ demographics and interests.
- To plan, improve, and administer Activities.
- To process and respond to your inquiries.
- To administer, support, operate or improve the Sites or the Wi-Fi Services.
- To promote and improve the services we offer.
- To monitor activity at the South Coast Plaza shopping center.
- For the purposes for which you provided the information.
- For fraud prevention, security, internal operations, legal compliance, and other public purposes.
- To alert you to other information regarding SCP or any of the foregoing via email, direct mail, telephone or other means.
In addition to the uses discussed above, SCP may use Non-Personally Identifying Information in any manner so long as SCP uses such information in its de-identified form. These uses may include, without limitation, uses for administration of the Sites; analysis of website trends and how the Sites are used; improving navigation of the Sites; analysis of the performance of the Sites and diagnosis of problems; improving the services we offer; analysis and developing advertisements and advertising campaigns; and providing you with special offers and promotions and determining the effectiveness of same.
5. HOW WE RESPOND TO “DO NOT TRACK” SIGNALS
You authorize SCP to transmit email, or postal mail to you, or to telephone you in order to respond to your communications, promote our services and administer Activities. By participating in Activities you agree and authorize us to contact you by telephone, send you information, documents, and prizes to you by email or postal mail, and publish the names of prize winners; see applicable rules for more details. If we send any emails to promote our services, instructions to unsubscribe will be included in each such promotional email from SCP. Please note that such requests may take up to 10 days to become effective. You may not opt out of receiving communications regarding your dealings with SCP, the Wi-Fi Services, or the Sites or technical information about the same.
7. INFORMATION SHARING WITH THIRD PARTIES
SCP may share or disclose the Personal Information and/or Non-Personally Identifying Information we collect about you: (i) to affiliates, merchants, licensors, Activities partners or sponsors, and other third parties for their own direct marketing purposes, such as to provide information to you about their stores, restaurants, Activities, products, services and other information; (ii) to third parties to provide analytics for advertising purposes or to confirm or update information provided by you; (iii) to our suppliers, vendors, service providers, payment processors, insurance carriers, brokers, agents, and others who help facilitate and manage SCP’s internal business operations; (iv) to third parties in order to analyze usage of the Sites, perform services on our Sites or others’ sites, and to improve our services and your user experience; (v) to third parties in the event of any reorganization, merger, sale, joint venture, assignment, transfer or disposition of all or any portion of SCP’s business or operations (including without limitation in connection with bankruptcy or any similar proceedings); or (vi) as otherwise authorized by you.
The Sites may also contain plugins for social media websites, such as Facebook, Twitter, Instagram, WeChat and Weibo. We recommend reviewing the privacy policies that apply to these plugins, prior to clicking on such plugins.
9. PROTECTION OF PERSONAL INFORMATION
SCP uses reasonable administrative, physical and electronic security measures to protect against the loss, misuse and alteration of Personal Information. No transmission of data over the internet is guaranteed to be completely secure. It may be possible for third parties not under the control of SCP to intercept or access transmissions or private communications unlawfully. While we strive to protect Personal Information, neither SCP nor our service providers can ensure or warrant the security of any information you transmit to us over the internet. Any such transmission is at your own risk.
Information collected by SCP may be stored and processed by or for SCP, or shared with third parties, in the United States in accordance with the laws of the United States, or in other jurisdictions. By using the Sites or Wi-Fi services, or by submitting your Personal Information to SCP online or offline, you expressly consent to the storage, processing and sharing of your Personal Information in the United States in accordance with the laws of the United States, or in other jurisdictions.
You are responsible for keeping your information current. You may update your information by contacting us at email@example.com. We will use reasonable efforts to process any change you make; provided, however, that requests to delete information are subject to SCP’s internal reporting, processing and retention policies and all applicable legal obligations.
11. NOTICE OF PRIVACY RIGHTS OF CALIFORNIA RESIDENTS
If you are a California resident, the California Consumer Privacy Act (“CCPA”) provides you with specific rights with respect to our collection and use of your Personal Information over the past 12 months. This Section 11 applies solely to residents of California, and any terms not defined in this Section 11 have the same meanings as defined in the CCPA.
A. Right to Know About Personal Information Collected, Disclosed, or Sold
If you are a California resident, you have the right to request that we provide certain information to you about our collection and use of your Personal Information over the past 12 months. Upon the submission of a verifiable consumer request for the Personal Information that SCP has collected about you, subject to exceptions under applicable law, we will disclose to you:
- the categories of Personal Information we collected about you;
- the categories of sources from which Personal Information was collected;
- the business or commercial purpose for collecting your Personal Information;
- the business or commercial purpose for disclosing or selling your Personal Information;
- the categories of third parties with whom we sold or disclosed the category of Personal Information for a business purpose; and
- the specific pieces of Personal Information we have collected about you.
B. Right to Request Deletion of Personal Information
If you are a California resident, you also have the right to request that we delete any of your Personal Information that we collect or maintain about you, subject to certain exceptions. Once we receive and confirm your verifiable consumer request to delete your Personal Information, we will conduct a reasonable search of our records in order to locate any Personal Information we have collected about you that is eligible for deletion, and delete such Personal Information. To the extent we have shared with service providers any Personal Information collected about you that is eligible for deletion, we will direct those service providers to delete that Personal Information as well. SCP may not be able to comply entirely with your request to delete all of your Personal Information as set forth under the CCPA. Specifically, we are not required to delete any Personal Information we have collected about you that is necessary for us and our service provider(s) to:
- Complete the transaction for which the Personal Information was collected, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, provide a good or service requested by you, or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract between SCP and you.
- Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity.
- Debug to identify and repair errors that impair existing intended functionality.
- Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law.
- Comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code.
- Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when our deletion of the information is likely to render impossible or seriously impair the achievement of such research, if you have provided informed consent.
- Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us.
- Comply with a legal obligation, such as retaining records for a period of time as set out in local, state, or federal laws.
- Otherwise use your Personal Information, internally, in a lawful manner that is compatible with the context in which you provided your information.
Following a deletion request, any Personal Information about you that was not deleted from our systems due to the above exceptions will only be used for the purposes provided for by the applicable exceptions.
C. Right to Opt-Out of Sale of Personal Information
If you are a California resident and SCP sells or discloses Personal Information about you to third parties, you may have the right to request that SCP not sell your Personal Information.
To exercise the right to opt-out, you (or your authorized representative) may submit a request to us by visiting the following Internet Web page link: Do Not Sell My Personal Information
Once you make a verified opt-out request, we will wait at least 12 months before asking you to reauthorize Personal Information sales. However, if at a later time, you wish to allow us to sell your Personal Information to third parties, you must opt-in to such sharing, and may be do so by contacting us at 1.800.782.8888. If a transaction requires the sale or transmission of your Personal Information in order to complete the transaction, we will notify you and provide instructions on how you can opt-in.
D. Right to Non-Discrimination for the Exercise of a Consumer’s Privacy Rights
We will not discriminate against you for exercising any of your privacy rights. Unless permitted by applicable law, we will not: (i) deny you goods or services; (ii) charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties; (iii) provide you a different level or quality of goods or services; or (iv) suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.
E. Exercising Your California Privacy Rights
You do not need to create an account with us to exercise your CCPA rights. To exercise the CCPA rights described above, please submit a verifiable consumer request to us by either:
Calling us at 1.800.782.8888 or through our online request portal
Only you, the person to whom you have given power of attorney, or an otherwise authorized agent registered with the California Secretary of State, may make a verifiable consumer request related to your Personal Information. However, you may make a verifiable consumer request on behalf of your minor child. Additionally, you may only make a verifiable consumer request for your Personal information twice within a 12-month period.
Your verifiable consumer request must provide sufficient information that allows us to reasonably verify that you are the person about whom we collected Personal Information or an authorized representative. We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. While we may ask for Personal Information to verify the requestor or consumer’s identity when making a request, we will only use that Personal Information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.
F. Response Timing and Format
We will make our best effort to respond to a verifiable consumer request within 45 calendar days of its receipt. If we require more time (up to 90 calendar days), we will inform you of the reason and extension period in writing. Within 10 business days of receiving the request, we will confirm receipt and provide information about our verification and processing of the request. SCP will maintain records of consumer requests made pursuant to CCPA as well as our response to said requests for a period of at least 24 months.
If you have an account with us, we may require you to take delivery of our written response through that account. If you do not have an account with us, we will deliver our written response electronically, though you may alternatively choose to receive delivery by mail. The response will also explain the reasons we cannot comply with a request, if applicable. Requests for the specific pieces of information that we have collected about you will be sent in a portable, readily useable format that you may transmit to another entity without hindrance.
We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
G. Your Rights under “Shine the Light”
California residents who have provided Personal Information to a business may be entitled by law to request certain information regarding the businesses’ disclosure of their Personal Information to third parties for the third parties’ direct marketing purposes (“Disclosure Request”). Please note, however, that SCP has adopted a policy of not sharing your Personal Information with third parties for their direct marketing purposes if you request that we do not do so (“Opt-Out Policy”). Due to this Opt-Out Policy, we are entitled by law to respond to your Disclosure Request by notifying you of your right to prevent the disclosure of your Personal information pursuant to our Opt-Out Policy.
To make an opt-out request send us an email at firstname.lastname@example.org. When contacting us, please indicate your name, address, email address, and what Personal Information you do not want us to share with third parties for their direct marketing purposes. Please note that there is no charge for controlling the sharing of your Personal Information or for processing this request.