Privacy Policy
Last Updated: March 2023
1. Introduction
Starwood Capital Group (which includes relevant local entities) (“we“, “us“, or “our“) may collect and use information about you from which you can be identified (“personal data“).
This privacy policy provides information on: (i) the personal data we collect from you; (ii) the purposes for which the personal data is processed and our lawful basis for doing so; (iii) how long we will retain your personal data for; (iv) how your personal data is shared by us; and (v) your rights in relation to your personal data and how you can exercise them.
This privacy policy is supplemental to and should be read together with any terms of use that apply to the services or website which are presented to you. If you have any questions about this privacy policy or our processing activities, please contact us by email at [email protected]
2. What Data Do We Collect about You / How Do We Collect It
We collect your personal data directly when you engage with us including when you: (i) visit our website; and/or (ii) communicate with us, e.g. via email or telephone including via the email address on our website.
We may also receive your personal data indirectly, for example when (i) we are conducting due diligence and your personal data is uploaded to the data room / shared with us through other transaction processes; (ii) we receive personal data from our portfolio companies; and/or (iii) we collect Business Data from local company registries, professional sites (such as LinkedIn and Bloomberg) or international search databases.
We collect different categories of information which we have grouped together as follows:
| Category | Details |
|---|---|
| Identity data | Name, title, place and date of birth, nationality, country of residence/domicile and personal characteristics including age, passports or national identification card (as applicable) and proof of address. |
| Contact data | Name, title, billing/correspondence address, home address, email address, contents of communications (where this relates to you), telephone number and other professional contact details. |
| Profile Data | Information such as your survey responses, profiles we've built about you, information about enquiries you've submitted |
| Investment Data | Information about your investments |
| Browser or device generated information | Domain, IP address, date, time and duration of your visit, browser type, operating system, page visits, internet traffic and other information about your computer or device. |
We also use and share anonymised data such as statistical demographic data which is not reasonably likely to reveal your identity. If we combine or connect anonymised data with other data so that it can directly or indirectly identify you, the combined data is personal data which will be used in accordance with this privacy policy.
We generally do not collect or process special category personal data, but will inform you of this at the time if this changes.
3. Our Lawful Basis
Under data protection laws, we must have a lawful basis to process your personal data – this is set out in section 4 below. This will either be, necessity for performance of a contract (whether in anticipation of an arrangement with us e.g. exploring an investment or other business opportunity or where we have terms of business to provide a service to you), our legitimate interests, legal obligation and/or consent.
If you provide us with your consent to processing, you can withdraw it at any time and we will stop the processing activities based only on consent as a lawful basis. We may still process the data if we have another lawful basis for processing (this will be for more limited purposes e.g. back-up storage). Where we need to collect personal data due to a legal obligation, or for performance of a contract this will be indicated to you (i.e. with an *), and if you do not provide that data when requested, we may not be able to perform the contract we have or are trying to enter with you. We will notify you of this at the time.
4. Why We Collect Your Personal Data
We will generally process your personal data for the purposes outlined below, or for other purposes specified to you at the point of collecting your personal data. We will only process your personal data as necessary so that we can pursue these purposes. Where we process your personal data for our legitimate interests as a business, we do so only where we have concluded that our processing does not prejudice you or your privacy in a way that would override our legitimate interest in pursuing those purposes.
| Purpose | Type of Data | Lawful Basis | Retention Period |
|---|---|---|---|
| Internal operational matters e.g. operate, evaluate and improve our business (including developing new products and services; enhancing, improving and analysing our products and services; managing our communications; and performing accounting, auditing and other internal functions) |
|
| 6 years after the
collection of
personal data For cookies, see the duration in our cookie policy. |
| Anti-money laundering compliance and other verification checks |
|
| As required by the applicable law. |
| Manage our relationship with you |
|
| Generally, 6 years following the end of our relationship with you. |
| To conduct analyses and run surveys |
|
| Generally 2 years
following
collection. For cookies, see the duration in our cookie policy. |
| Marketing (e.g. promotional materials, newsletters, communications about participation in special events, programmes, offers). |
|
| Data will be processed for 2 years, unless consent is withdrawn or you have opted-out (as appropriate). |
| Protect and improve our website |
|
| Please see our cookie policy. |
| Comply with other relevant legal or regulatory obligations |
|
| As required by the applicable law. |
5. Marketing Communications
If you solicit certain information (e.g. you contact us to raise an enquiry via email), we will share that information which might including marketing communications.
Some privacy laws or marketing laws, as applicable, require us to have your consent to send direct electronic marketing that isn’t solicited (e.g. via emails or SMS or direct social media messages).
You may also receive indirect marketing from us by way of online advertisements (e.g. adverts on third party websites that aren’t targeted to particular individuals) or general marketing communications from us- (e.g. postal mail) on the basis of our legitimate interest to undertake advertising activities linked to investment opportunities and to develop, deliver and maintain relevant services and marketing communications.
You can withdraw your consent or ask us to stop sending you direct marketing messages at any time by contacting us at [email protected], then we will no longer conduct any direct electronic marketing unless you opt-in again at a later point.
6. Who We Share Your Data With
We share your personal data with the parties set out below:
- Internal third parties – we are part of a group enterprise and share your personal data with other companies in that group.
- External third parties – we share your personal data with external third parties namely:
- System administration service providers (including IT and data storage providers, CRM provider and data management platform providers);
- Other service providers such as software providers, data analysis providers, customer service and email delivery, auditing and other similar services;
- Any party who has a legal need to conduct due diligence, for example financial institutions;
- Regulators, local authorities and government bodies, including the police and taxation authorities, to comply with any legal or regulatory requirements or formal/informal investigations;
- Courts, parties to litigation and professional advisers where we reasonably deem it necessary in connection with the establishment, exercise or defence of legal claims;
- A purchaser or parties interested in purchasing or investing in any part of our business (and professional advisers supporting on the transaction); and
- Professional advisers such as lawyers, accountants, auditors, insurance claims managers, facility management providers and insurance companies (including brokers).
7. International Transfers
As we are a US headquartered firm and use third parties on a global basis for the purposes listed above, your information will be transferred outside of the EU/UK to countries such as the United States.
Certain countries in which recipients and data processors may be located and to which your information may be transferred may not have the same level of protection of personal data as the one afforded in the UK or Luxembourg. Where personal data is going to the United States, we will verify if the international organisation ensures an adequate level of protection recognised by the Information Commissioner/ European Commission, pursuant to the EU-US Data Privacy Framework and the UK-US Data Bridge. If this is not the case, or if Personal Data is transferred to countries outside of the UK and / or EEA we will ensure it is protected by other appropriate safeguards, such as the EU Standard Contractual Clauses approved by the European Commission and the UK’s International Data Transfer Agreement or other legally permitted mechanisms, to ensure that the level of data protection afforded in the UK and the EEA is not undermined. You may obtain a copy of such safeguards by using the contact details below.
8. How Long We Keep Your Personal Information
We apply a general rule of keeping personal data only for as long as required to fulfil the purposes for which it was collected. In general, we retain your personal data for a period of time corresponding to a statute of limitation setting out the period during which legal claims may be filed in court. For example, we’ll retain your personal data during the statute of limitation period, to maintain an accurate record of your dealings with us and, as applicable, assert or defend against a legal claim.
More specific retention periods are outlined in section 4 above. Following the expiry of the retention periods outlined in section 4 we dispose of your information by deleting data from our document management system.
9. Your Rights
Under data protection laws, you have various rights which are set out below. The rights available to you depend on our reason for processing your personal data and where you are based (see Annex 1 of this policy if you are a California resident).
You are not required to pay any charge for exercising your rights, although we may charge a reasonable fee if your request is unfounded, repetitive or excessive. We have one month to respond to you (unless you have made a number of requests or your request is complex, in which case we may take up to an extra two months to respond but we will inform you where this is the case). Please note that, where we ask you for proof of identification, the one-month time limit does not begin until we have received this. If we require any clarification and/or further information on the scope of the request, the one-month deadline is paused until we receive that information.
RIGHT TO OBJECT TO PROCESSING. You can object to processing of your personal data where we are relying on a legitimate interest at any time. If you object, we must stop that processing unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or we need to process the personal data for the establishment, exercise or defence of legal claims. Where we rely upon legitimate interest as a basis for processing, we believe that we can demonstrate such compelling legitimate grounds, but we will consider each case on an individual basis.
You can also object to processing of your personal data for direct marketing purposes at any time. If you object, we will stop that processing.
- Right of access. You can ask us for copies of your personal data. There are some exemptions, which means you may not always receive all the information we process. These exemptions include situations where the information requested also includes personal data about somebody else.
- Right to rectification. You can ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
- Right to erasure. You can ask us to erase your personal data in certain circumstances.
- Right to restriction of processing. You can ask us to restrict the processing of your information in certain circumstances.
- Right to withdraw consent. Where we are relying on consent to process your personal data, you can withdraw it at any time. This will not affect the lawfulness of any processing carried out before you withdraw your consent.
- Right to data portability. This only applies to information you have given us. You can ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on performance of a contract and/or your consent.
You also have the right to make a complaint at any time to a supervisory authority, including your local authority.
- If you are based in Luxembourg, this will be the National Commission for Data Protection, who can be contacted here: National Commission for Data Protection, 15, Boulevard du JazzL-4370 Belvaux. Helpline number: (+352) 26 10 60-1, https://cnpd.public.lu/en/support/contact/contact-prive.html
- If you are based in the UK, this will be the Information Commissioner’s Office, who can be contacted here: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline number: 0303 123 1113 https://www.ico.org.uk
We would appreciate the chance to deal with your concerns before
10. Changes To This Privacy Policy
We will make changes to this privacy policy from time to time, e.g. to keep it up to date or to comply with legal requirements or changes in the way we operate our business. Any changes or updates we may make will be posted on this page in advance so that you are aware of the impact to our data processing activities before you continue to engage. If we have your contact details on file, we will notify you in advance of any significant changes that are material. Please check back frequently to see the latest version on our website.
Annex 1 – Your California Privacy Rights
Under California Civil Code Section 1798.83, individuals who reside in California and who have an existing business relationship with us may request information about our disclosure of certain categories of personal information to third parties for the third parties’ direct marketing purposes, if any.
To make such a request, send an email with the subject heading “California Privacy Rights” to [email protected]. In your request, please attest to the fact that you are a California resident and provide a current California address for our response. Please be aware that not all information sharing is covered by these California privacy rights requirements and only information on covered sharing will be included in our response. This request may be made no more than once per calendar year.
Pursuant to applicable California law, including the California Consumer Privacy Act (CCPA), Starwood makes the following disclosures regarding the personal information it has collected within the last 12 months:
| Categories of Personal Information | Category of Source from Which Data is Collected | Purpose of Collection | Category of Third Parties to Whom Data is Disclosed |
|---|---|---|---|
| Contact information such as name, postal and email addresses and telephone numbers | Directly from user | To create and manage your account and investments | Service Providers |
| Date of birth, Social Security number, citizenship status | Directly from user | Entity management | Service Providers |
| Automatically-collected information, such as your location; IP address; device type; browser type; operating system or platform; name of Internet Service Provider; referring website; exiting website; pages visited on our website; frequency, time, data, and duration of your visit on our website; whether you open emails from us; links you click on in our emails and on our website, including ads; whether you access our website from multiple devices; other interaction you may have on our website; Device Unique Device Identifier (e.g., Unique Device Identifier (UDID) or International Mobile Equipment Identity (IMEI)); mobile device MAC or IP address; information about your mobile device’s operating system; information about your mobile carrier | Cookies and other tracking technologies | To perform data analyses to improve our business | N/A |
Starwood has not sold consumers’ personal information in the twelve (12) months preceding the Effective Date of this Privacy Policy.
If you are a California resident, pursuant to the CCPA, you have the right to request:
- the categories of personal information Starwood has collected about you;
- the categories of sources from which your personal information is collected;
- the business or commercial purpose of collecting or selling your personal information;
- the categories of third parties with whom Starwood shares your personal information;
- the specific pieces of personal information Starwood has collected about you;
- the categories of personal information that Starwood has sold about you and the categories of third parties to whom the personal information was sold, if applicable;
- deletion of your personal information; and
- an opt out of having your personal information disclosed or sold to third parties.
To submit a request, or designate an authorized agent to make a request under the CCPA on your behalf, please email us at [email protected], call us at (203) 422-7700 or write to us at 2340 Collins Avenue, Miami Beach, FL 33139. To verify your identity when you submit a request, we will match the identifying information you provide us to the personal information we have about you.
However, Starwood will not be required to comply with your request to delete your information if it is necessary for Starwood to maintain your personal information in order to:
complete the transaction for which the personal information was collected, provide a good or service requested by you, or reasonably anticipated within the context of Starwood’s ongoing business relationship with you, or otherwise perform a contract between you and Starwood;
- detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity;
- debug to identify and repair errors that impair existing intended functionality;
- exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law;
- comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code;
- engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when Starwood’s deletion of the information is likely to render impossible or seriously impair the achievement of such research, if you have provided informed consent;
- to enable solely internal uses that are reasonably aligned with your expectations based on your relationship with the Starwood;
- comply with a legal obligation; or
- otherwise use your personal information, internally, in a lawful manner that is compatible with the context in which you provided the information.
Starwood will not discriminate against you in the event you exercise any of the aforementioned rights under CCPA, including, but not limited to, by:
- denying goods or services to you;
- charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties;
- providing a different level or quality of goods or services to you; or
- suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services.
This policy is available to consumers with disabilities. To access this policy in an alternative downloadable format, please click here.