ACADIA REALTY TRUST PRIVACY NOTICE

Last updated December 2025

Index

Personal Information We Collect and Use
Cookies Notice
How We Share Personal Information
California Privacy Notice
European Privacy Notice
How We Protect Your Personal Information
Changes to This Notice
Contact Us
California Privacy Chart

This is the Data Privacy Notice (“Privacy Notice”) of Acadia Realty Trust and its affiliate and subsidiary entities (“Acadia” or the “Company”). We maintain a website to provide services to you. This website may ask for and collect your personal information to provide our services, enhance your experience, and provide you with other relevant information about our offerings. This Privacy Notice applies to activities Acadia engages in on its website and activities that are offline or unrelated to its website. We are providing this notice to explain our information practices and the choices you can make about the way your information is collected and used.

This Privacy Notice governs our treatment of personal information. We expect all of our employees and those with whom we share personal information to adhere to this Privacy Notice.

Acadia is committed to protecting the information that our investors, business partners, employees, suppliers, and others have entrusted to us.

This Privacy Notice applies to all personal information collected by Acadia, relating to all investors, business partners, suppliers, and others who do business with us.

Information for California residents can be found in the section below titled California Privacy Notice.

Information for residents of the European Economic Area can be found in the section below titled European Privacy Notice.

If you are outside the United States, by using our website or providing your information to us, your personal information will be transferred to and through, and stored in, the United States.

1. PERSONAL INFORMATION WE COLLECT AND USE

Personal Information You Provide
We only collect personal information that you provide to us or that we are authorized to obtain by you or by law. The types of personal information we collect will depend on how you are interacting with us through our website or in person. For example, we may collect different information from you through recruiting than if we are exploring a new business relationship or venture with you. Depending on our interactions, we may have collected the following categories of personal information in the past 12 months:

When you contact us with questions: We may collect your name, email address, and phone number from you to respond to your questions;
When we need to make a payment or distribution: We may collect your name, bank account number, and routing number from you in order to make the payment or distribution;
When you become an Investor: We may collect your name, title, signature, address, Social Security number or Tax Identification number, phone number, email address, bank account number, routing number, ABA number, fax number, investment amount, customer list information including name and contract amount, and qualified status information from you or your attorney to perform diligence, to comply with legal obligations, to communicate with you, to prepare our tax information, and to comply with reporting requirements;
When we register you for events: We may collect your name and email address from you to register you for the event;
When you apply for a job: We may collect your name, education history, address, phone number, email, and employment history from you or from third party recruiters or databases, social and professional networking sites;
When we perform diligence on potential investment opportunities: We may collect your name, location, and copies of any leases, financing documentation and other typical diligence materials, as applicable, with respect to the potential investment opportunity (e.g., property tax bills);
When we perform background checks: We may collect your name, address, phone number, date of birth, email address, government identification numbers, sex or gender, insurance numbers, Social Security number, criminal records, driving records, and employment information from our background search vendors;
If you sign a lease with us as a signatory or guarantor, we may collect your name, address, personal financial statements, tax returns, bank statements, and signature;
If you provide services for our business, we may collect your name, business information, address, phone number, and W-9 information for diligence purposes;
If you ask us to contact you via email, we may collect your name and email address;
To send you marketing information about opportunities and events, we may collect your name and email address;

Information Collected From Your Devices
We may collect the following information automatically from your devices when you use our website or services:

For data analytics, including to audit, research, and conduct analysis in order to maintain and improve our services and to protect people who use our services, we may use cookies and similar technologies to collect log information (including IP address, browser type, domain names, access times, referring website addresses, app usage, events that occur within the app, performance data, and download sources) and device information (including computer or mobile device used to access the website, hardware model, operating system, and device identifiers). When we send you marketing communications, we may also collect information about the actions you take with the email, including whether you opened it, the country where you opened it, whether you clicked on it, or whether you unsubscribed from marketing communications; and
When you interact with us through our website: We may collect your IP address, information regarding your interaction with our website, or network location based on your IP address.

Personal Information Provided by Others
When you use our website or services, we may collect the following information from third parties:

In the process of purchasing or selling real estate, we will collect information from brokers, tenants, retailers, and others, including names, phone numbers, email addresses, physical addresses, financial background information, and other information related to the purchase or sale specific to your role in the transaction.
When we perform background checks: We may collect your name, address, phone number, date of birth, email address, government identification numbers, sex or gender, insurance numbers, Social Security number, and employment information from our background search vendors.

To learn about potential business opportunities with investors, we may collect information from third parties about investors, including name, email, and phone number.
When you engage with us on social media, we may collect your social media usernames, posts, and media (video, audio, images) from the social media platform.
Cookies and browsing data: Depending on how you interact with our website, we may collect cookies and browsing data from our service providers. This includes online activity information and browsing and usage information.
When you apply for a job via a third party platform or website, we may collect any information you authorize that platform to provide, including name, email address, phone number, address, work experience, education information, and resume.
Third party websites and social media services. Our website may include links to third party websites or social media services where you may be able to post comments, reviews, or other information. We may monitor comments and reviews regarding us, our products, or our website that you publicly post on social media or customer review sites. In addition, please note that your use of these third party websites or social media services may result in those sites collecting information about you. We are not responsible for these third party websites or social media services and you should review their privacy policies to make sure you understand the information that may be collected, used, and shared by those sites.

Other Ways We Use The Information We Collect
In addition to the uses we identified above, we may also use any of the information for the following purposes:

To enforce our agreements, including agreements with you when you use our website and services;
To operate, evaluate, and improve our business, including improving and personalizing the experience for you and others, to complete and maintain records of transactions with individual customers following use of our website or services;
For safety and security, by making sure third parties protect your information, monitoring the technical functioning and security of our network;
For legal and compliance purposes, including complying with applicable laws, regulations, and legal obligations; and
To protect the rights or property of the Company, its employees, and people who use its website or services.

Children’s Privacy
Our website and services are not intended for or targeted to children under the age of 13, and we do not knowingly collect personal information from children under the age of 13. If you become aware that your child has provided personal information without your consent, please contact us at ProtectPrivacy@AcadiaRealty.com.

2. COOKIES NOTICE

This cookie notice will give you information about:

The different types of cookies
The cookies that are required on our websites (Essential Cookies)
The cookies that you can reject (Non-Essential Cookies)
The cookies we use
How to manage your cookie preferences

Cookies
“Cookies” are small files which enable us to store individual information related to your computer or other device used to access our website. Cookies help us, for example, to determine the frequency of use and the number of people visiting our website and to make our services as comfortable and efficient as possible for you.

Classes of Cookies
There are two types of cookies: session cookies, and persistent cookies.

Session cookies make it easier for you to navigate the websites. They expire and disappear from your device when you close your browser.
Persistent cookies remain longer and help in understanding how you use the websites and enhancing your user experience. They stay on your device even after you close your device’s browser or end your session. Persistent cookies may remain on your hard drive for an extended period of time.

Sources of Cookies
Cookies also come from different sources – Acadia (these would be “first party cookies” because Acadia places the cookies itself), and other third parties (these are “third party cookies” because they are not placed by Acadia).

First party cookies are set by the website you are visiting, and they can only be read by that site.
Third party cookies are not set by the owner of the website you are visiting, but by a different organization. For example, advertisers and other third parties may use their own cookies when you click on an advertisement or link on our website, or we might engage a third-party analytics company that will set their own cookie to perform this service.

Types of Cookies
The different types of cookies can be categorized as follows:

Essential Cookies:
There are certain cookies that we have to include in order for certain web pages to function. For this reason, they do not require your consent. In particular:

Strictly Necessary cookies are cookies that are required for the operation of our website, such as to ensure security. Other necessary cookies allow us to provide features or services that you expressly request. These cookies do not require your consent and cannot be switched off (although in some cases you can change your requests). You can set your browser to block or alert you about these cookies, but some parts of our website may not work if you block these types of cookies.
Functional cookies are used to provide certain functionalities to you by recording your choices and settings regarding our services, maintaining your preferences over time and recognizing you when you return to our website so that we can offer you a better experience.

Non-Essential Cookies:
This website is not currently using Non-Essential cookies.

Managing Cookies
When you visit this website, a pop up will appear to inform you about our use of cookies.

Cookies and Browser Settings
You can disable cookies by changing your website browser settings to reject cookies. How to do this will depend on the browser you use. Rejecting cookies will prevent your browser from accepting new cookies, as well as (depending on the sophistication of your browser software) allow you to decide on acceptance of each new cookie in a variety of ways. You can also delete all cookies that are already on your device. If you do this, however, you may have to manually adjust some preferences every time you visit this website. Modern browsers should allow you to change your cookie settings, typically by going to the ‘options’ or ‘preferences’ menu of your browser. Use the ‘Help’ option in your browser for more details.

Blocking all cookies (including necessary cookies) will have a negative impact upon the usability of many websites, including ours. If you block necessary cookies, you may not be able to use all the features on this website. You can also delete cookies already stored on your computer. However, deleting cookies might have a negative impact on the usability of many websites, including ours.

To find out more about cookies, visit www.aboutcookies.org or www.allaboutcookies.org.

3. HOW WE SHARE PERSONAL INFORMATION

We may share information about you to third parties as indicated below:

Affiliates, Subsidiaries, and Investors: We may share your personal information with our different affiliates, subsidiaries, and investors. If we share your information, we will share only the information that is necessary and we will take reasonable steps to make sure that third parties take prudent steps to protect your information.

Investment Subject Matter Experts: We may share your personal information with different subject matter experts in the course of a financial transaction or investment, including attorneys, brokers, investment bankers, accounting firms, banks, lenders, environmental specialists, insurance specialists, appraisers, and market or technology consultants, among others. These people will only use your information to the extent necessary to undertake diligence and consummate the transaction.

Social Media: When you interact with us regarding environmental sustainability, we may share photos on our website and/or social media accounts.

Service Providers, Suppliers, Agents, and Business Partners: Other companies sometimes provide certain services to us or on our behalf (e.g., maintenance, IT support, analysis, development, security, background checks, technical solutions for transactions). Unless we tell you differently or as described elsewhere in this Privacy Notice, our service providers are not permitted to use your information except to assist us.

Government-Required Filings: We have obligations to make regular filings with the SEC and other government entities as part of our business, and we may share your personal information only if and to the extent it is needed as part of these government filings.

Compliance with Legal Obligations: We may need to disclose certain information to auditors, government authorities, law enforcement, regulatory agencies, our legal counsel, third party litigants and their counsel, or other authorized individuals in order to comply with laws that apply to us, or other legal obligations such as contractual requirements.

Changes in Business Structure/Ownership: We may disclose or transfer your personal information to a third party in the event of any reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of the Company’s business, assets, or ownership interest (including any bankruptcy or similar proceedings).

Acadia does not sell any individuals’ personal information, including children under 16, to anyone and does not share personal information with third parties for those parties’ commercial use.

4. CALIFORNIA PRIVACY NOTICE

“Legal Categories” of Personal Information
The law requires us to tell you about the personal information we collect about you in a certain way – specifically, we need to tie it back to “legal categories” of personal information that are listed in the law. To do this, we bundled up the information we gave you above in this Privacy Notice and matched the different types of personal information we collect about you with the legal category. To make things easier to understand, we’ve put this information in a chart that shows you five things:

The legal category of personal information,
Examples of the types of personal information included in each legal category,
The source(s) from which we collect this type of personal information,
The purpose for why we collect and use your personal information for each legal category; and
The business purposes for which we share your personal information and with whom.

We’ve included these things in the California Privacy Chart at the end of this Privacy Notice. At the end of the California Privacy Chart, we also included a list of Information We Disclose for a Business Purpose.

Your Rights and Choices in the U.S. (including California)
For all personal information that we collect about you, you may have the following rights or choices that we will accommodate where your requests meet legal and regulatory requirements and do not risk making our other data less secure or changing our other data. You may also designate an authorized agent to make a request on your behalf.

Know, Erase: You may have the right to know what information is being collected about you, and to know whether your personal information is disclosed and to whom. You also may request that we erase your information. If you have questions about your information or want to ask us to erase your information, please contact us using the methods in the “Contact Us” section below.
Correct: If you believe that any of your personal information collected by us is inaccurate, you may have the right to have that information corrected, depending upon the nature of the personal information and the purpose for its processing. You can make a request using the methods in the “Contact Us” section.
Opt Out of Sale, Targeted Advertising, or Profiling: You may have the right to ask us not to sell your personal information, to ask us not to use your personal information for targeted advertising, and to ask us not to use your personal information for profiling. We do not sell your personal information, and we do not use it for profiling or targeted advertising, but if you wish to make a request using the methods in the “Contact Us” section below, we are happy to confirm that we do not sell your personal information or use it for targeted advertising or profiling.
Access: If you would like to request that we provide a copy of your information to you, please contact us using the methods in the “Contact Us” section below.
Portability: If you would like us to send your personal information to another business or organization, please contact us using the methods in the “Contact Us” section below.
Non-Discrimination: You have the right not to receive discriminatory treatment by Acadia because you exercise your privacy rights. If you have any questions, please contact us using the methods in the “Contact Us” section below.

How to Make a Request: If you would like to make a request, please contact us using the information in the “Contact Us” section of this Privacy Notice. Please include your name, email, phone number, the address for the property you are associated with, the state you live in, and the specific type of request you would like to make (a request to know, erase, opt out of sale, correct, or access).

Responding to Requests: We will evaluate your request to determine whether the requested change meets legal regulatory requirements and does not risk making our other data less secure or changing our other data. If we aren’t able to honor any part of your request, we will tell you that in our response, as well as the reason(s) we cannot do so.

Verifying Your Identity: To protect you and your information, we may ask you to confirm certain information before we honor your request. For example, if you make a request, we will ask you to confirm your email address and phone number. For certain requests, we will use a combination of your email address, phone number, and zip code of the property you are associated with to verify your identity, so that we can help protect your information. If you designate an authorized agent to make a request on your behalf, we may require you to verify your identity and provide the authorized agent’s identity and contact information to us.

5. EUROPEAN PRIVACY NOTICE

This section of our Privacy Notice applies to residents of the European Economic Area (EEA) and the United Kingdom (UK).

International Data Transfers
Acadia stores the personal information we collect in the United States. To facilitate Acadia’s operations, staff who work for Acadia and/or our service providers may transfer and access such personal information as part of our business or as needed to provide services to us. This will involve transferring your personal information outside the EEA or the UK after we collect it.

We will take all steps reasonably necessary to ensure that your personal information is treated securely and in accordance with this Privacy Notice.

Whenever we transfer your personal information out of the EEA or the UK, we will ensure one of the following safeguards is implemented:

We will only transfer your personal information to countries that have been deemed to provide an adequate level of protection for personal information by the European Commission; or
We may use specific contracts approved by the European Commission which give personal information the same protection it has in Europe; or
We will ensure there is some other protection in place which has been approved by the European Commission as giving personal information the same protection it has in Europe.

Your Privacy Rights
Under certain circumstances, individuals within the European Economic Area have rights under data protection laws in relation to your personal information as set out below:

Request access to your personal information, to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
Request correction of the personal information that we hold about you if it is inaccurate or incomplete.
Request erasure of your personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal information to comply with local law.
Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and you feel it impacts your fundamental rights and freedoms. You also have the right to object where we are processing your personal information for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
Request restriction of processing of your personal information if: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
Request the transfer of your personal information to you or to a third party in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
Complain to a government regulator if you are not satisfied with our response, depending on your location.

Legal Bases For Processing
This section describes some of the legal bases we rely on to process your personal information. We may process your personal information for more than one legal basis depending on the specific purpose(s) for which we are using your personal information, including the following legal bases:

Contracts. Where we need to perform the contract we are about to enter into or have entered into with you, including to provide you services.
Legitimate Interests. Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. The following are non-exhaustive examples of where Acadia relies on legitimate interest to process personal information:
- Acadia has a legitimate interest in processing personal information relating to our existing companies and investors in order to manage our business relationship and provide communications and information.
- Acadia has a legitimate interest in using cookies as outlined in this Privacy Notice.
Legal Obligations. Where we need to comply with a legal or regulatory obligation.

Generally we do not rely on consent as a legal basis for processing your personal information.

6. HOW WE PROTECT YOUR PERSONAL INFORMATION

We strive to take appropriate security measures to help safeguard your personal information from unauthorized access, use, and disclosure. For example, only authorized employees are allowed to access personal information, and they may only access it for permitted business functions. We also use technology to protect your information, including firewalls and other technical and administrative measures.

While we cannot guarantee that loss, misuse, or alteration will never occur, we use reasonable efforts to prevent it. Please keep in mind that no method of storage or transmission over the Internet is completely secure, so your use of our services and provision of information to us is at your own risk.

Our website may contain links to other sites on the Internet that are owned and operated by third parties. The information practices of those websites linked to our website are not covered by this Privacy Notice. We are not responsible for the privacy policies of other websites to which our website links.

Data Retention
In general, we keep your information for as long as we need it to carry out the purposes described in this Privacy Notice, and as necessary to comply with our records-management policies and laws that apply to us, up to 7 years after our relationship with you ends. We also keep your information when we need to comply with other legal obligations we might have, such as in connection with a lawsuit, complaint, or investigation.

7. CHANGES TO THIS NOTICE

We reserve the right to modify or change this Privacy Notice at any time. When we make a material change to this Privacy Notice, we will inform you by changing the date on this page noting when the Privacy Notice was last updated.

8. CONTACT US

For questions regarding this Privacy Notice or to submit any of the requests mentioned above relating to your personal information, contact us using any of the following options:

Mail
Acadia Realty Trust
411 Theodore Fremd Avenue, Suite 300
Rye, NY 10580
Attention: Legal Department

Email
ProtectPrivacy@AcadiaRealty.com

Telephone
914-288-8100

9. California Privacy Chart

Legal Category*	Examples of Information Collected	Source	Purpose for Collection	Sharing with Third Parties for a Business Purpose
A. Identifiers.	Real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers.	Directly from you Automatically from your devices	Communications Distributions and Payments Investors Fund Financials Asset Management Events Candidate Search Diligence Background Checks SEC Compliance	Affiliates, Subsidiaries, and Investors Service Providers Compliance with Legal Obligations Changes in Business Structure/Ownership Government-Required Filings
B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).	Name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories.	Directly from you From third parties	Communications Distributions and Payments Investors Fund Financials Asset Management Events Candidate Search Diligence Background Checks SEC Compliance	Affiliates, Subsidiaries, and Investors Service Providers Compliance with Legal Obligations Changes in Business Structure/Ownership Government-Required Filings
C. Protected classification characteristics under California or federal law.	Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).	Directly from you	Candidate Search Diligence	Service Providers Marketing Recipients
D. Commercial information.	Purchasing or consuming histories or tendencies.	Directly from you Automatically from your devices	Diligence	Affiliates, Subsidiaries, and Investors Service Providers
E. Biometric information	Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints.	Not collected	Not collected	Not collected
F. Internet or other similar network activity.	Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.	Directly from you Automatically from your devices From third parties	Analytics Website	Affiliates, Subsidiaries, and Investors Service Providers
G. Geolocation data.	Physical location or movements.	Not collected	Not collected	Not collected
H. Sensory data	On-site security cameras, pictures, video and audio recordings.	Not collected	Not collected	Not collected
I. Professional or employment-related information	Current or past job history or performance evaluations, criminal history, credit history, I-9 information, and emergency contact information.	Directly from you From third parties	Candidate Search Diligence Background Checks	Affiliates, Subsidiaries, and Investors Service Providers
J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99))	Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.	Directly from you From third parties	Candidate Search Diligence Background Checks	Affiliates, Subsidiaries, and Investors Service Providers
K. Inferences drawn from other personal information.	Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	Not collected	Not collected	Not collected
L. Sensitive personal information as defined in §1798.140(ae) of the California Privacy Rights Act	Social security number, driver’s license number, state ID card, passport number, precise geolocation, racial or ethnic origin, union membership, and health and genetic data	Directly from you	Purchase/Lease	Affiliates, Subsidiaries, and Investors Service Providers Compliance with Legal Obligations NOTE: We only share sensitive information where absolutely necessary to provide services to you.

*We may also collect your information to comply with laws or regulations or with legal requests that don’t fit into one of the categories we’ve described for you, or to enforce our rights, prevent fraud, and protect our systems, users, and customers.
In the preceding twelve (12) months, we have shared or disclosed the following categories of personal information for a business purpose:

Category A: Identifiers
Category B: California Customer Records personal information categories
Category C: Protected classification characteristics under California or federal law
Category D: Commercial information
Category F: Internet or similar network activity
Category I: Professional or employment-related information
Category J: Non-public education information
Category L: Sensitive personal information