California Privacy Policy

Notice at Collection and Privacy Policy for California Residents

Effective Date: January 1, 2023

Last Revised/Reviewed on: January 1, 2023

This California Notice at Collection and Privacy Policy (“CCPA Disclosure”) explains how Starwood Property Trust, Inc. and its subsidiaries and affiliates (“we” “us”, “our”, or “Company”) (collectively, “Starwood”), collects, uses, discloses, and/or retains personal information (“Information Practices”) subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”). This CCPA Disclosure applies solely to California residents (“consumers” or “you”).

The CCPA does not apply to certain information collected by our financial services subsidiaries or affiliates, such as information subject to the Gramm-Leach-Bliley Act, the Fair Credit Reporting Act, and certain other state or federal privacy laws. For example, this CCPA Disclosure does not apply to information that we collect about individuals who seek, apply for, or obtain financial products and services for personal, family, or household purposes.

This CCPA Disclosure does not apply to information we collect in the context of an individual’s interaction with us as a job applicant, employee, contractor, or other role within Starwood. Please refer to our CCPA Workforce Disclosure.

Notice at Collection

The following notice identifies the categories of personal information to be collected from you and the purposes for which the personal information will be used, including whether that information is sold or shared.

General Personal Information

Categories of Personal Information	Purposes for Collection and Use
Identifiers: For example, a real name, postal address, unique personal identifier, Internet Protocol address, email address, account name, social security number, or other similar identifiers.	To fulfill or meet the reason for which the information is provided To verify your identity To improve our products and services To protect against security risks For advertising and marketing To conduct research, analytics, or other internal analysis To conduct business with you or your employer in your role with a third party that we do business with To operate, manage, and maintain our business To perform compliance activities or institutional risk control To carry out our legal and business purposes, such as complying with federal, state, and local laws or responding to lawsuits or investigations, or to exercise our legal rights At your direction or with your consent
Personal Information Categories from Cal. Civ. Code § 1798.80(e): For example, a name, signature, Social Security number, address, telephone number, driver’s license, education, employment, employment history, or any other financial information.
Characteristics of CA or Federal Protected Classifications: For example, race, religion, national origin), age (40 and over), gender, sexual orientation, medical condition, ancestry, pregnancy (includes childbirth, breastfeeding and/or related medical conditions), familial status, disability, veteran status, or genetic information. *We do not intentionally collect this information, but it may be revealed in identity data or other information we collect*
Commercial Information: For example, records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
Internet or Other Similar Network Activity: For example, browsing history, search history, and information regarding a consumer’s interaction with an Internet Web site or application.
Geolocation Data: For example, information that can be used to determine a device’s physical location.
Professional or Employment-Related Information: For example, compensation, evaluations, performance reviews, personnel files, and current and past job history.

We do not collect: biometric information, sensory or surveillance data, education information (as defined in the Family Education Rights and Privacy Act); or profile data.

Sensitive Personal Information

We do not use or disclose the below sensitive personal information for purposes other than those business purposes specifically enumerated under CCPA. As a result, we do not offer a right to limit our use or disclosure of these categories of sensitive personal information.

Categories of Sensitive Personal Information

Purposes for Collection and Use

Social Security Number, Driver’s License, State Identification Card, or Passport Number

- To perform services or provide goods you request and reasonably expect from us
- To detect, prevent, and investigate security incidents involving your information
- To investigate or curtail malicious, fraudulent, or illegal actions directed at us and to prosecute those responsible

- To perform services for our business needs such as maintaining accounts, providing customer service, providing financing, verifying customer information, processing payments, providing analytics services, storage, and to fulfill orders

- To collect or process sensitive personal information where such information is not being used to infer characteristics about you but may be used to provide a specific good or service based on the sensitive information you provided

Account log-in, financial account, password, or credentials allowing access to an account

To enhance your experience on our website in real time, so long as we do not disclose your information to a third party
To perform services for our business needs such as maintaining accounts, providing customer service, providing financing, verifying customer information, processing payments, providing analytics services, storage, and to fulfill orders
To ensure the quality or safety of a product, service, or device
To collect or process sensitive personal information where such information is not being used to infer characteristics about you but may be used to provide a specific good or service based on the sensitive information you provided

We do not collect: precise geolocation; racial or ethnic origin, religious or philosophical beliefs, or union membership; contents of a consumer’s mail, email, and text messages (unless we are the intended recipient of the communication); genetic data; biometric information for the purpose of unique identification; health information; information concerning sex life or sexual orientation.

We have not and do not sell any of your personal information or share with third parties for cross-context behavioral advertising (including any sensitive personal information).

Retention Periods

We retain information for different periods of time depending on the purposes for which we collect and use it. For example, if you have a commercial loan with us, we will retain your information for the life of the loan, plus any applicable legal requirements.

We will delete or de-identify information when it is no longer needed to fulfill the purposes listed for each category above, unless a longer retention period is required to comply with applicable laws. There may be technical or other operational reasons where we are unable to fully delete or de-identify your information. Where this is the case, we will take reasonable measures to prevent further processing your information.

Please review our Privacy Policy below.

Privacy Policy

The purpose of this privacy policy is to provide you with a comprehensive description of our online and offline practices regarding our collection, use, disclosure, and retention of personal information and of your rights as it relates to our Information Practices and how you can exercise those rights.

The following table includes disclosures for the preceding 12 months of: categories of personal information we have collected about consumers, the categories we have disclosed for a business purpose, and categories of third parties with whom we shared the personal information during that period.

General Personal Information

Category	In the preceding 12 months this category was:		Business or Commercial Purpose for Collection & Disclosure	Categories of third parties to whom the information was disclosed
Category	Collected	Disclosed
Identifiers	☒	☒	For our operational purposes or the operational purposes of our service provider or contractors Keeping track of visitors to our website and monitoring the effectiveness of our advertising, including auditing relating to counting ad impressions of unique visitors, verifying positioning and quality, and auditing compliance. Ensuring security and integrity of personal information as needed and as reasonably necessary and proportionate for this purpose Debugging to identify and repair errors that impair existing functionality Short-term, transient use Performing services on behalf of the business, including maintaining or servicing accounts, providing products or services, providing customer service, processing orders or transactions, verifying customer information, processing payments, providing financing, providing analytic services, storage, or other similar services. Providing advertising and marketing services, except for cross-contextual advertising. Undertaking internal research for technological development. Undertaking activities to verify or maintain quality or safety of a service or device and to improve or enhance a service or device.	Service Providers who assist us in offering a product or service to you Law enforcement, or other legal authorities Government entities Service providers who assist our business in operations, such as cloud storage providers, cybersecurity providers, operating and management companies
Personal Information Categories from Cal. Civ. Code § 1798.80(e)	☒	☒		Service Providers who assist us in offering a product or service to you Law enforcement, or other legal authorities Government entities Service providers who assist our business in operations, such as cloud storage providers, cybersecurity providers, operating and management companies
Characteristics of CA or Federal Protected Classifications	We do not intentionally collect this information but it may be revealed in identity data or other information we collect	☐		N/A
Commercial Information	☒	☒		Service Providers who assist us in offering a product or service to you Law enforcement, or other legal authorities Government entities Service providers who assist our business in operations, such as cloud storage providers, cybersecurity providers, operating and management companies
Internet or Other Similar Network Activity	☒	☒		Service Providers who assist us in offering a product or service to you Law enforcement, or other legal authorities Government entities Service providers who assist our business in operations, such as cloud storage providers, cybersecurity providers, operating and management companies Web analytics providers Web hosting service providers
Geolocation Data	☒	☒		Service Providers who assist us in offering a product or service to you Law enforcement, or other legal authorities Government entities Service providers who assist our business in operations, such as cloud storage providers, cybersecurity providers, operating and management companies Web analytics providers Web hosting service providers
Professional or Employment-Related Information	☒	☒		Service Providers who assist us in offering a product or service to you Law enforcement, or other legal authorities Government entities Service providers who assist our business in operations, such as cloud storage providers, cybersecurity providers, operating and management companies

We do not collect: biometric information, sensory or surveillance data, education information (as defined in the Family Education Rights and Privacy Act); or profile data.

Sensitive Personal Information

Category	In the preceding 12 months this category was:		Business or Commercial Purpose for Collection & Disclosure	Categories of third parties to whom the information was disclosed
Category	Collected	Disclosed
Social Security Number, Driver’s License, State Identification Card, or Passport Number	☒	☒	To perform services or provide goods you request and reasonably expect from us To detect, prevent, and investigate security incidents involving your information To investigate or curtail malicious, fraudulent, or illegal actions directed at us and to prosecute those responsible To perform services for our business needs such as maintaining accounts, providing customer service, providing financing, verifying customer information, processing payments, providing analytics services, storage, and to fulfill orders To collect or process sensitive personal information where such information is not being used to infer characteristics about you but may be used to provide a specific good or service based on the sensitive information you provided	Service Providers who assist us in offering a product or service to you Law enforcement, or other legal authorities Government entities Service providers who assist our business in operations, such as cloud storage providers, cybersecurity providers, operating and management companies
Account log-in, financial account, password, or credentials allowing access to an account	☒	☒	To enhance your experience on our website in real time, so long as we do not disclose your information to a third party To perform services for our business needs such as maintaining accounts, providing customer service, providing financing, verifying customer information, processing payments, providing analytics services, storage, and to fulfill orders To ensure the quality or safety of a product, service, or device To collect or process sensitive personal information where such information is not being used to infer characteristics about you but may be used to provide a specific good or service based on the sensitive information you provided	Service Providers who assist us in offering a product or service to you Law enforcement, or other legal authorities Government entities Service providers who assist our business in operations, such as cloud storage providers, cybersecurity providers, operating and management companies

The categories identified as collected in the tables above were collected from the following categories of sources:

You directly

Credit Reporting Agencies
Appraisers
Insurance Companies
Employers
Real Estate Brokers
Internet service providers
Data analytics providers
Government entities
Operating systems and platforms

What we Sell or Share and Right to Opt-Out

We have not and do not sell any of your personal information or share with third parties for cross-context behavioral advertising (including any sensitive personal information). We do not have actual knowledge that we sell the personal information of minors under 16 years of age.

Your Right to Know

You have the right to request that we disclose any of the following:

the categories of personal information we have collected about you
the categories of sources from which the personal information is collected
the business or commercial purpose for collecting, selling, or sharing with third parties for cross context behavioral advertising (e.g. targeted advertising)
the categories of third parties to whom we disclose personal information
the specific pieces of personal information we have collected about you

You can do this through a verified consumer request. That process is described below in the section, “Submitting a Verified Consumer Request.”

Your Right to Request Correction of Inaccurate Personal Information

You have the right to request correction of inaccurate personal information maintained by us. We may request documentation from you to determine the accuracy of the information. If you provide us documentation either upon our request or through your own initiative, that documentation will only be used for the purpose of correcting your personal information and complying with our recordkeeping requirements. We may deny your request if we have previously denied your same request to correct an alleged inaccuracy in the past six (6) months, unless you provide new or additional documentation that the information at issue is inaccurate.

As an alternative to correction, we may delete the inaccurate information if it does not negatively impact you or if you consent to this deletion. We reserve the right to deny this request if allowed under law, or if we determine that the contested information is more likely than not accurate, based on the totality of circumstances. You can submit a correction request through a verified consumer request. That process is described below in the section, “Submitting a Verified Consumer Request.”

Your Right to Request Deletion of Your Personal Information

You have the right to request that we delete any of your personal information collected by us, subject to certain exceptions. You can do this through a verified consumer request. That process is described below in the section, “Submitting a Verified Consumer Request.”

There may be scenarios where we deny your deletion request. If that occurs, we will provide you with an explanation as to why we could not delete all or some of your personal information.

Submitting a Verified Consumer Request

You have the right to submit verified consumer requests to know information, to correct information, or for deletion.

You may submit a request to know information, to correct information, or for deletion by providing your name, address, and email address, along with description of the type of request you are seeking, by emailing us at sptlegal@starwood.com, by writing us at 2340 Collins Ave., Suite 700, Miami Beach, Florida 33139, or by calling us toll free at 1-833-431-1245. Your request will be verified by matching the information you provide to information that we have collected.

The response to a request to know will provide all personal information collected and maintained about you since January 1, 2022, unless doing so proves impossible or would involve disproportionate effort. Please note that we are not required to provide personal information to you more than twice in a 12-month period. We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

If you submit a request that is not through one of these designated methods or is deficient in some manner unrelated to verification, we will provide you with information on how to submit the request or remedy any deficiencies.

Once we receive your verifiable consumer request, we will confirm receipt of the request within 10 business days. We will respond to your request within 45 calendar days, if we are able to verify your identity. Requests for deletion will require a separate confirmation that you want your information deleted.

Requests to Know or Delete for Child Under the Age of 13: We do not knowingly collect information of minors under the age of 13.

Using an Authorized Agent to Submit a Request

Only you, or a natural person or a business entity registered with the Secretary of State to conduct business in California that you have authorized to act on your behalf, may make a verifiable consumer request related to your personal information. If you use an authorized agent, you may provide a power of attorney executed pursuant to California Probate Code sections 4000 to 4465. If a power of attorney that meets the above provisions is not submitted, you will be required to provide the authorized agent signed permission to submit a request, verify your identity directly with us, and directly confirm with us that you provided the authorized agent permission to submit the request.

If you’re an authorized agent making a request, you must email us at sptlegal@starwood.com or write us by post at 2340 Collins Ave., Suite 700, Miami Beach, Florida 33139 and:

1. Provide the power of attorney provided to you by the consumer pursuant to Probate Code sections 4000 to 4465; or

Provide proof of signed permission along with a copy of your ID and have the consumer e-mail us or write us at the same address listed above to directly confirm with us that they provided you permission to submit the request.

Your Right to Non-Discrimination for the Exercise of a Privacy Right

We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

Deny you goods or services.
Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
Provide you a different level or quality of goods or services.
Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Other California Privacy Rights

We do not respond to Web browser “do not track” signals or other mechanisms.

Changes to Our Privacy Notice

We reserve the right to amend this privacy notice at our discretion and at any time. When we make changes to this privacy notice, we will post the updated notice on the Website and update the notice’s effective date. Your continued use of our Website following the posting of changes constitutes your acceptance of such changes.

Contact for More Information

If you have any questions or comments about this notice, the ways in which we collect and use your information, your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us at:

Phone: 1-833-431-1245
Email: sptlegal@starwood.com
Postal Address: Starwood Property Trust, Inc.

2340 Collins Ave., Suite 700

Miami Beach, FL 33139

Attn: SPT Legal – CCPA Notices