Updated May 5, 2021
Here is a brief summary of some key facts. You will also find detailed information below.
• when you create a CF Account • when you contact us • when you interact with us at our buildings and shopping centres • when you use our websites and mobile apps
• to provide you with the services you request • to understand our customers to deliver better experiences • to offer personalized content, if you want it • to innovate and improve our business • to protect our properties, employees, tenants and visitors • other business purposes described under What types of personal information do we collect and use? and What types of online information do we collect automatically?
• our corporate group, such as The Cadillac Fairview Corporation Limited and Ravel by CF Inc. • technology service providers and other service providers who assist us in our business • retailers, tenants and promotional partners when we are providing services or promotions together • third parties when necessary for investigations, police reports, insurance claims, or emergencies • other third parties as described under Who do we share personal information with?
• technical measures and policies and procedures • contractual requirements in our agreements with service providers
• our operations are based in Canada • our main technology service providers are in Canada and the United States • we may also use service providers located in other countries
corporate website: www.cadillacfairview.com
shopping centre website: www.cfshops.com
gift card website: www.cfshopcard.ca
individual buildings and shopping centres
electronic communications with you (such as email, text/SMS, and push notifications)
Some of our services, mobile apps and websites may also have separate privacy notices. These privacy notices will provide you with specific information applicable to those services, mobile apps and websites.
Sometimes we provide links to other companies’ websites and services (like retail tenants in our shopping centres). Those companies have their own privacy and cookies policies. Information you give them will be governed by their rules and not ours.
What types of personal information do we collect and use?
What personal information we collect depends on how you interact with us.
Expand the sections below to understand the personal information we collect and use based on the most common types of interactions with us. For an explanation of what information we collect automatically when you use our online services, see What types of online information do we collect automatically?
Keep in mind that we may also collect other information as we develop new products, services and techniques for delivering improved or personalized services to you
If you make a request for customer assistance or services, we collect information that is necessary to respond to your request. This may include contact information, details of your request and our response.
When you create an account with us, including through our mobile applications, we may ask for your name, email address, password and information about your interests to create an account for you.
If you sign into our websites, mobile apps or wifi using a social media account (such as Facebook, Instagram or Pinterest), we will collect profile information from those accounts and other information that you have consented to sharing with us in order to create your CF Account.
We use account information to register and to authenticate you. We may also use information we collect and associate with your CF Account to tailor our products and services to your interests.
Subscriptions and contests
We may collect information when you subscribe to a newsletter, enter a contest, register for a service, or create an account with us. This information could include your contact information.
If you subscribe for email communications, we will collect your email address.
If you enter a contest or promotion, we will collect personal information from you to administer the contest or promotion.
We collect information such as your name, address and payment information if you purchase a CF SHOP! card® or rent equipment from us. We will also collect contact information to deliver communications and packages to you.
We track transactions and your account balance using your CF SHOP! card. If you register your CF SHOP! card with us or associate the CF SHOP! card with your CF Account, this information will be associated with you.
If you make a large purchase of CF SHOP! cards, we may collect additional information as part of our obligations and corporate best practices to combat money-laundering and other criminal activity.
Shopping lists and favourites
Depending on the mobile app or website you use, you may be able to create customized shopping lists, or plan your route through our properties. We will collect this information to store it with your CF Account. We use this information to provide you with the services you request and to learn about your preferences so that we can provide you with more relevant content in our mobile apps and on our websites.
Social media interactions
We may collect information if you interact with us on social media. We may view and share posts that mention us, our services or one of our properties. We only view and share this information if your privacy settings permit us to see your post. We use this information to understand trends and what visitors and tenants are saying about our properties and services.
Our properties are equipped with video surveillance cameras. These cameras may collect your image or vehicle (including licence plate) when you are at one of our properties. In limited cases, the field of cameras on our property may capture images of individuals who are near the perimeter of our properties.
Access to some areas of our properties are restricted. To access these areas, you may need to provide your name and other information. If you are visiting one of our employees in a restricted space, you may need to provide the name of the employee you are visiting, your name, your employer (if relevant) and your contact information.
If you are one of our contractors or if you are an employee or contractor of one of our tenants, we may issue you a physical or digital passcard to access our building and the tenant’s premises. We will collect information about you and the business authorizing us to issue you a passcard. Our passcard readers collect logs of the dates and times of your use of your passcard.
We retain security guards to monitor and protect our buildings. If there is an incident, these security guards may collect information about the individuals involved in the incident, information from witnesses, and other information that they observe or are told.
We also retain third party services that scan social media and other sources of information for threats to our properties and personnel.
We use information we collect as part of building security programs to help secure and protect our property, to create a safe environment for our tenants, building occupants and visitors, to respond to emergencies, to investigate violations of our policies or laws, and to investigate claims (such as property damage or personal injury).
We may collect your vehicle make, model and licence plate number for the purposes of enforcing our parking regulations. If you have a reserved parking spot in one of our buildings, we collect registration information such as your name, contact information, employer, vehicle make and model and licence plate number for the purposes of providing and managing our parking services.
We will collect personal information that you provide to us in connection with your employment application. This personal information may include previous work experience, education, and other relevant information. We use this information to assess your suitability for employment with us.
What types of online information do we collect automatically?
We automatically collect technical information and information about how you use our websites, website applications and mobile apps. Expand the headings below to learn more.
Wherever technically feasible, we will give you the option of browsing or using our online services as a guest without logging in and identifying yourself but not all features may be available to you as a guest
If you are not logged into our services, we will not attempt to discover who you are by using online technical information
Wherever technically feasible, we will provide you with options to opt-out of personalized ads. See Online Advertising for details.
Online technical information
When you use our websites, website applications and mobile apps, our servers automatically collect information from your device or session. We collect this information as part of the normal process of delivering online content to your device. In some cases, we may also scan this information to detect cybersecurity threats.
Online technical information that we collect includes but is not limited to IP address, browser type and version, advertising IDs, app unique ID (if you are using one of our mobile apps) and operating system and device type in order to properly format information for your device.
You may see a pop-up asking to share your location. We ask for this permission to provide you with location-based services, such as showing you content from the nearest shopping centre. Even if you do not enable location-based services, we may still receive general city or country location information based on your IP address and from other information provided from third-party telecommunications services.
For more information and the promises we make about location information, see location-based services.
Understanding how people use our websites, website applications and mobile apps helps us do a better job of meeting your needs and improving our business.
For example, if a feature does not seem useful to our visitors, we learn that we need to improve it. If we detect that the search results for a particular search term are not helpful, we can try to make the results more relevant.
Usage information also helps us understand what ads and promotional communications were effective. We also use usage information to tailor your experience and the ads that you see so that the information we provide to you is more relevant to your interests.
The usage information we collect includes how long you visited our websites, website applications and mobile apps, what pages you visited, what features you used, what search queries you entered, and your other activities using our services.
To understand more about how we collect some of this usage information, see cookies and pixel technologies.
Cookies and pixel technologies
Cookies are small text files that are stored on your device. Pixels are small image files that appear on our web pages or in advertisements. Cookies and pixels help us recognize you and also help us with Online Analytics. Expand the headings below to learn more.
We use these technologies for a variety of business purposes. Some examples include:
to remember your device the next time you visit one of our websites or web applications
to keep you signed into a web application or mobile app
to track how you are using our websites, website applications and mobile apps
to deliver online advertising
to find out if our emails have been read
to find out if links were clicked in our promotional email content and advertisements
to store your location if you have given us permission to collect it
Third-party cookies and pixels
Some cookies and pixels are provided by third parties who share information with us. For example, we use Adobe Analytics to provide us with reports on where our website visitors are coming from and what web pages and mobile app features are useful. Another example is pixels provided by Facebook. If we advertise on Facebook, the advertisement and our website may contain pixels so that we understand that a visitor to our website saw the Facebook advertisement. This helps us know that the advertisement was useful and relevant.
Some cookies are necessary, and some are optional. Necessary cookies are used to ensure that our digital services are working correctly and to track certain page analytics. Optional cookies include cookies that are used for advertising and to recognize you when you are using different devices.
Data analytics means studying data to look for patterns. We use data analytics to gather insights about the effectiveness of our business strategies and to make decisions. We also use data analytics to predict what visitors to our websites, website applications and mobile apps will find interesting. Learn more by expanding the headings below.
Online analytics is the study of how our online services are used.
Information collected by analytics services on our websites, website applications and mobile apps include date of session, session duration, pages and features viewed, operating system, device model, and geography. Although your IP address is collected, we anonymize your IP address when we use it for analytics purposes.
If you are using a browser to access online content, our analytics providers also collect the site you came from before landing on our website (such as the search engine you used to find us or the page you last visited when you came to our site). Third-party analytics services also collect the following information when you use our mobile apps: device model, first launch of the app, number of app opens and app updates. We use a randomly generated ID to identify your device. You can reset this ID by uninstalling and reinstalling the app. You can also adjust your browser settings to block or disable analytics cookies. Our mobile apps do not collect and store your MAC address.
If you are using one of our mobile apps, we may offer you settings within our app to control the collection of data for analytics. Please see the privacy notice for the mobile app that you are using.
Location analytics involves collecting location data to understand where the users of our services are located.
We can derive location information from your IP address using third party services. When we do this, we anonymize your IP address after it is used to identify a geographic location (usually city and province level). For some of our websites and web applications, you may see a pop-up asking for permission to share your location.
If you accept, we will receive an inferred location for the device you are using. You can decline to share location. If you do, we will not be able to customize the site content to match the inferred location of your device.
For our mobile apps, we may also collect location information through location-based services. See location-based services for information on how you can control your location-based services settings in our mobile apps.
Foot traffic analytics
Foot traffic analytics uses de-identified information to understand when a device is in different zones in our properties. We use this information to measure traffic patterns. This helps us understand how our premises are used, what routes are common, and how many repeat visitors we get. Expand the headings below for more information.
How does it work?
Our service provider, Aislelabs, automatically transforms the MAC address of mobile devices into a special code. We cannot use that code to re-identify your MAC address even if you use our wifi services.
What’s a MAC address?
A media access control (MAC) address is broadcast by wifi-enabled devices when wifi is on.
Can I opt-out?
You can opt out of location-based analytics provided by Aislelabs by visiting http://optout.smart-places.org/.
This section explains some of your rights and how you can exercise them. To learn more about a right, expand the headings below.
Access and correction
You can ask to see the personal information that we have collected about you. You can also ask us to correct your personal information.
If you are using one of our mobile apps, you may be able to access your personal information by viewing your account settings.
If you want to access or correct other information, you’ll need to contact us. You must explain the details of what you want to access or correct, so that we can help find that personal information for you.
Sometimes we won’t grant access to or correct your personal information. If that happens, we will tell you why and what you can do about it if you are not satisfied.
Withdrawing consent and deletion
You can contact us to withdraw consent to using your personal information or to ask us to delete your personal information if we no longer need it. If you are using one of our mobile apps, see the mobile app privacy notice for how to withdraw consent and to delete your account or mobile app data.
Sometimes we will still need to retain your personal information after you have asked us to stop using it and to delete it. If that is the case, we will tell you. For example, the law may require us to keep your personal information or we may need the information for our accounting records. We also may keep information if we believe there is a risk of a legal dispute or the information related to an investigation. These are just some of the reasons.
If your information is in electronic form, it may be stored in our backup data. If that’s the case, then we will retain it until we replace or purge our backups.
Opting-out of email marketing
If you signed up for one of our email newsletters and no longer want to receive them, you can unsubscribe at any time. For the quickest results, please use the unsubscribe link in the latest email we sent to you. Alternatively, you can contact us and we will process your request.
We want to show you ads that are relevant to you. However, we recognize that some people don’t like to see personalized ads. Below are some tips and tools to help you control advertising that uses your online activity and personal information.
Website advertising opt-out options
To opt-out of personalized advertising content, please visit Digital Advertising Alliance of Canada Opt-Out Page, NAI Opt-Out Page and the Ad Choices Opt-Out Page.
These websites provide tools that identify member companies that have placed cookies on your browser and provide mechanisms to opt-out.
Please keep in mind that you will still receive other types of advertising.
Deleting browser cookies can remove your opt-out preferences, so you should use these tools periodically to ensure that your preferences are up-to-date.
Mobile device advertising options
You can also opt-out of the use of your mobile device’s advertising ID by adjusting your mobile device advertising preferences. For Android devices, open your Settings App > Google > Ads. For iOS devices, go to Settings > Privacy > Advertising.
Social media advertising options
Social media platforms (such as Facebook and Instagram) allow us to show you advertisements based on the fact that you match characteristics of our target audience or to exclude you from advertisements because we don’t think they are relevant to you. This is called custom audiences.
These custom audience tools also include the ability to include or exclude you from the custom audience based on whether your profile information for those platforms matches information that we have collected. This happens by converting information (such as your email address or phone number) into a unique code. We do not share your actual email address or phone number with these social media companies.
You can use the ad settings in your social media account settings to control the ads you see and the use of your personal information for advertising, including custom audiences. You can also contact us to opt out of the use of your personal information for custom audiences.
Cross device tracking
We use the services of the Adobe Marketing Cloud Device Co-op to understand when visitors are using different devices to browse our websites. We do not share or receive information that identifies you when we use the Adobe Marketing Cloud Device Co-op.
We use this service to understand how many unique visits to our websites and web applications we are receiving. This service also allows us to provide you with personalized content across all of the devices that you use.
We understand that not everyone wants a personalized experience across their devices. You can see what devices are linked and opt out using the Adobe Device Co-Op Privacy Control.
Location-based services are features and functions of our websites, web applications and mobile apps that use your location in order to deliver relevant content. We also use location information for Data Analytics. Expand the headings to learn more about our promises to you, why we use location information, and how you can control location sharing.
We will only collect foot traffic information in our shopping centres in a way that does not identify you
We do not track your movements outside of our shopping centres
If you use dynamic wayfinding services that could identify you, we will tell you in our mobile app privacy notice
Why do we use location information?
Sometimes we collect your location to provide you with services and to learn about how our shopping centres and other properties are used. For example:
If you enable location-based services on our websites, web applications or mobile apps, we can use that information to help you find the nearest shopping centre or show you offers, stores, products and shopping centre information that are relevant to the shopping centre you are at or that is near you.
If you log into our wifi services, we will recognize what shopping centre or office building you are at when you are logged in.
We also use location information for Data Analytics.
If you are using one of our mobile apps and have enabled location-based services, you can always opt-out using the permissions settings within the mobile app.
You can also opt-out of location-based services by changing your device’s permissions. For Android devices, open your Settings App and choose Location > App permission or Security & location > Location. For iOS devices, choose Settings > Privacy > Location Services. For more information or help, please refer to your device’s operating system user guide.
Who do we share personal information with?
Sometimes we share personal information with others. We share personal information between our related companies. We share information with our tenants about who is using passcards to enter their premises and in connection with an incident that affects them. We share information relating to personal injuries and damage to property with tenants and contractors and their insurers when we believe they are required to indemnify us or compensate us. We also share personal information about incidents in order to investigate the incident, file an insurance claim, report to or assist police in an investigation, and respond to or prevent a danger to health, life or property.
Expand the headings below to understand our promises about sharing and who share personal information with.
We do not sell or rent your personal information to other companies
We will only provide information that identifies you to other companies for marketing purposes with your consent
If we provide aggregated or statistical information to other companies, such as retailers in our properties, we do so in a way that does not identify you
Some of our services, websites, web applications and mobile apps are provided by The Cadillac Fairview Corporation Limited and others are provided by Ravel by CF Inc. These are related companies. We share information between these companies to develop a single view of individuals who use our services and to streamline customer service responses.
We use third parties to assist us with our business. These third parties may handle your personal information when performing services for us. Some types of service providers that we use include:
technology service providers who develop, host and manage our website, mobile apps and web applications and other information technology we use in our business
service providers who help run our CF SHOP! card® program
third party security guards
Usually, service providers are not permitted to use your personal information for their own purposes separate from providing and improving the services they are providing to us. There are exceptions. One exception is that we allow some service providers to create aggregated or statistical data or to use non-identifying data for their own use. Another exception are third parties who manage a service for us. For example
we collect information from Adobe and other analytics providers
If we disclose identifiable information to a service provider for the service provider’s own use, we will usually notify you so that you understand that your information will be used in accordance with the service provider’s privacy notice. There are exceptions. For example, we rely on your implied consent to pass your payment card and transaction information to a payment network in order to process a credit or debit card payment. We will also rely on implied consent to pass your name and address to a courier company or Canada Post in order to ship something to you.
Sometimes we share personal information with tenants. Examples include:
if we have issued you a passcard that is used to access our tenant’s premises, we will share information about your use of the passcard with the tenant
if there is an accident or other incident that involves our tenant, we may share video surveillance footage, incident reports and other information with our tenant so that our tenant can investigate the accident or incident, seek legal advice and/or file an insurance claim
if you make a complaint about a tenant, we may share information with the tenant to investigate the complaint or to ask the tenant to address your concerns
See building security for more information about how we use personal information for building security and investigating incidents.
We may also enter into co-marketing initiatives with our tenants or provide services to our tenants to help them in their business. When we engage in these activities, we may share relevant personal information with them.
We share information with our insurers when there is an incident at one of our properties and the information is reasonably required to make an insurance claim or report. This may include video surveillance, incident reports and other relevant data that may include your personal information.
Sometimes we need to share personal information with the police. If there has been a criminal incident at one of our properties, we may share personal information with the police that is related to that incident. We may also share relevant personal information as part of filing a police report or in response to a police request.
We may share personal information if we sell all or part of our business or if it is relevant to a business transaction.
Other third parties
We will also share personal information with third parties if we are required to do so by a law, a court order or a similar requirement.
We may also share personal information in an emergency affecting or threatening to affect someone’s health or life or if there is a threat to ours or someone else’s property.
Keeping your personal information safe
Although we take care to secure your information, no system of safeguards can provide you with a guarantee of security.
The security of your information is also a shared responsibility. Expand the headings below to learn what we are doing to keep your personal information safe and what you can do to help.
How do we protect your personal information?
We employ administrative, technical and physical safeguards to protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification.
The types of safeguards that we employ and that our service providers employ depend on the sensitivity of the information. Examples of how we protect your personal information include:
employee privacy and security training
restricting access to personal information to employees who need access to it
technical measures such as encrypted connections, strong passwords, multifactor authentication (where feasible), firewalls and other technical security tools
physical measures such as locked storage areas and restricted access to our offices and other areas where personal information is stored
background checks of employees in line with the sensitivity of the information those employees will be handling and provincial laws governing when we can do background checks
requiring service providers who will handle your personal information on our behalf to commit to safeguard your personal information when they enter into contracts with us
What do you need to do?
You have a shared responsibility to keep your personal information secure when you use our websites, mobile apps and web applications. Please take the following steps to help secure your personal information:
install the latest security updates and anti-virus software on your device to help prevent malware and viruses
use the latest version of browsers
change your account password frequently
use complex passwords to lock your device and mobile applications. Complex passwords include capital letters, numbers and special symbols
do not use the same password for multiple sites
do not share your password with others
We do not ask you for sensitive personal information over email. Sensitive personal information includes passwords, bank account or payment card information, your social insurance number, or similar information by email. We might ask for proof of identify if you want to make a request to access or delete your personal information, but we will give you the option of coming to one of our properties to present your ID.
Where do we store and use your personal information?
Our preference is to store and use your personal information in Canada. However, this is not always feasible. Our service providers may be located outside of Canada or they may store and process data outside of Canada. If that is the case, then your personal information may be transferred to other countries.
Although we employ contractual protections when we transfer personal information to other countries and we consider the protections offered under the laws of the other country, we cannot guarantee that your personal information will receive equivalent protection when transferred. In certain circumstances, your personal information may be accessible under the laws of those other countries by foreign law enforcement, regulatory bodies or other authorities.
Do we use facial recognition technology?
No, we do not use facial recognition technologies. Facial recognition technologies match an image to a database in order to identify an individual. We do not use these technologies.
Our mobile apps and web applications
We may offer mobile apps and special web applications to provide you with special services. Examples include:
LiVE by CF – a mobile app that helps you find exactly what you want and where to buy it all before you arrive at a CF shopping centre. Search for stores, find the products and offers you want and save your favourites for later.
CF Eats - order delivery or pickup from your favourite Cadillac Fairview restaurants.
Event registration sites, such as to reserve a visit with Santa or another special event.
You can contact our privacy office in writing to ask a question or make a complaint. You may also contact our privacy office to request access or correction to your personal information or to request deletion of data that you believe we no longer need to retain. We may need to see identification to check that you are who you say you are.
Privacy Office The Cadillac Fairview Corporation Limited & Affiliates 20 Queen Street West Suite 500 Toronto, ON M5H 3R4 firstname.lastname@example.org