We are committed to respecting privacy and recognize the need for appropriate protection and management of any Personal Data that is Processed by us as part of an Interaction. As used in this Statement, “Personal Data” means any information, either alone or in combination with other information, which relates to an identified or identifiable natural person, which may include “Health Information” and “Special Category Information,” each as defined below. We may collect Personal Data from you directly, or indirectly through document(s) you upload to a Site or through a third-party, as discussed more fully in Section 3, below.

In some circumstances, you may choose whether or not to provide or disclose Personal Data in connection with your Interaction with us. If you choose not to provide the Personal Data we request, you may still visit and use parts of our Sites, but may be unable to access or use certain features, options, programs, products, and services. Due to safety and security concerns, your refusal to provide Personal Data may also prohibit you from entering our physical locations (including, without limitation, our locations) and may adversely impact our ability to do business with you or the organization you represent.

Our Sites may contain links to third-party websites, products, services, and advertisements that are not owned or controlled by White Stone Apartments. We are not responsible for the privacy practices or the content of those third-party websites, products, services, and advertisements, and you visit them at your own risk.

This Statement applies to, but is not limited to, Personal Data of the following individuals:

• Visitors to our Sites;
• Visitors to our property locations and other physical locations;
• Representatives of our past, current and prospective customers;
• Representatives of our past, current and prospective business partners, suppliers, and contractors;
• Our shareholders and/or their representatives; and
• Representatives of our joint venture partners and other stakeholders.

Our Interactions with you may require us to Process certain information which may contain Personal Data about you. This includes, but is not limited to:

• Personal and business demographic information such as name, address, date of birth, citizenship status and similar information;
• Information related to your professional qualifications, education and training;
• Information related to travel arrangements if you are visiting our property locations;
• Information related to shareholder tax and accounting matters, including tax calculation and withholding, bank information (for payment purposes), and taxpayer identification numbers;
• Information related to workplace safety, including training, accident and incident reports and investigations, first aid and other medical records, medical and other information related to workers compensation claims, and medical records related to hazardous exposure monitoring;
• Information collected via machinery or equipment you may operate while onsite at our physical locations; and
• Biometric data such as photographs, fingerprints and iris scans used for the issuance of security credentials or safety monitoring.

In certain circumstances, White Stone Apartments may Process Personal Data which includes information regarding your medical history or health ("Health Information"), or other information regarding your racial or ethnic origin, political opinions, philosophical or religious beliefs or affiliations, political, trade or professional associations, trade union memberships, sexual preferences or practices, or criminal records (collectively, with Health Information, "Special Category Information"). White Stone Apartments will not collect or Process Special Category Information unless it is necessary to do so, and if we have your consent or another lawful basis to do so under Applicable Data Privacy Laws. We may Process Health Information to:

• provide medical assistance and treatment in the event of a medical emergency; and
• otherwise comply with our health and safety obligations (including, without limitation, at our property locations), or as otherwise required or permitted by applicable law.

White Stone Apartments Processes certain information that may constitute Personal Data in the following ways:

(a) White Stone Apartments Business and Operations

White Stone Apartments may collect a range of Personal Data in connection with its business and operations including without limitation, your name, age, gender, job title, photo identification, email address, home or business address, telephone number, information contained within communications with you (including notes from meetings and telephone call recordings), feedback or survey responses, and financial and payment information. If you are visiting our property locations, we may also ask you to provide Health Information. If you provide us with Personal Data relating to someone else, you must ensure that they have consented to that disclosure or that it is otherwise lawful under Applicable Data Privacy Laws.

(b) Personal Data Collected by Third Parties

We may use certain third-party service providers to perform certain of our business operations. These providers may collect Personal Data about you in performing their services and/or functions on our behalf. For more information regarding our service providers, their business purposes, and their privacy practices, please review Section 5 of this Statement.

(c) Information Collected Automatically via our Sites

We collect certain information on our Sites automatically by means of various software tools. Automatically collected information includes: Log Files.

The information inside the log files includes internet protocol ("IP") addresses, type of browser, Internet Service Provider ("ISP"), date/time stamp, referring/exit pages, clicked pages and any other information your browser may send to us.

• Do Not Track Signals

White Stone Apartments does not track users over time and across third-party websites to provide targeted advertising. Accordingly, we do not currently respond or take any action with respect to web browser “do not track” signals or other mechanisms that provide consumers the ability to exercise choice regarding the collection of Personal Data about an individual’s online activities over time and across third-party websites or online services.

• Analytics Services

We may use certain third-party analytics services to improve the functionality, features, or delivery of our Sites. We may also use these analytics services to record mouse clicks, mouse movements, scrolling activity, as well as any text that you type into our Sites. For example, we use Google Analytics on our Sites to track user trends and usage. For more information on Google Analytics’ processing of Personal Information as it relates to our Sites, please see http://www.google.com/policies/privacy/partners/. By using a browser plugin provided by Google (available at http://www.google.com/ads/preferences/plugin/), you can opt out of Google Analytics.

• Other Tracking Technologies

When you visit our Sites, we may collect your IP address for certain purposes such as, for example, to monitor the regions from which you navigate our Site. We may also use web beacons alone or in conjunction with cookies to compile information about your usage of our Sites and interaction with emails from us. Web beacons are clear electronic images that can recognize certain types of information on your computer, such as cookies, when you viewed a particular site tied to the web beacon. We may use web beacons to operate and improve our Sites.

If you submit, or we collect, Personal Data, then such Personal Data may be used to:

• Manage and operate our business, including negotiating contracts, managing business relationships with the entity you represent or are employed by, administering real property leases and licenses, managing accounts and records, facilitating payment for goods and services, managing a CRM database, keeping records and audit information relating to our customers and contacts, communicating with you and other third-party contacts, facilitating living quality in compliance with residential laws, and supporting corporate social responsibility activities;
• Manage our property locations, including compliance with security, and health and safety requirements;
• Manage and administer our shareholder relationships;
• Provide, analyze, administer, improve, and personalize our Sites;
• Contact you in connection with events, programs or offerings that you may have registered for;
• Send you updates and marketing materials;
• Identify and authenticate your access to the parts of the Sites that you are authorized to access;
• Administer our Sites and for internal operations, including data analysis and testing;
• Ensure the technical functionality and security of the Sites;
• Undertake internal investigations and audits; and
• Undertake and comply with our legal and regulatory obligations.

White Stone Apartments limits the Processing of Personal Data to that which is required for the intended purposes for which it was collected or authorized by the data subject, and takes reasonable steps to ensure that all Personal Data is reliable, accurate, complete and current. White Stone Apartments Processes Personal Data in accordance with applicable laws including, without limitation and to the extent relevant, the European Union’s General Data Protection Regulation ("GDPR"), the Australian Privacy Principles outlined in the Australian Privacy Act 1988 ("Australian Privacy Laws"), and applicable United States Federal and State laws (collectively, "Applicable Data Privacy Laws"). To the extent relevant under Applicable Data Privacy Laws, White Stone Apartments Processes Personal Data under a number of legal bases, including legitimate business interests, necessity for performance of a contract, consent, and compliance with White Stone Apartments’ legal and regulatory obligations.

We do not sell, lease, rent or otherwise disclose your Personal Data to third parties unless otherwise stated below or with your consent. We may disclose your Personal Data in the following circumstances:

(a) To Our Third-party Providers

We transfer Personal Data to our third-party service providers to perform certain tasks on our behalf. For example, we may share your Personal Data with service providers who assist us in processing invoices, or to direct a query that you have submitted to the relevant department within White Stone Apartments. We also use third parties for technical support of our Sites, application development, tracking and reporting functions, quality assurance, and other services. These entities are required to protect the confidentiality of this Personal Data and are restricted from using it for any purpose other than as set out in this Statement.

(b) To Our Affiliates and Joint Venture Partners

We may share your Personal Data with our affiliates and joint venture partners in connection with our business and operational purposes. These entities are required to protect the confidentiality of this Personal Data and are restricted from using it for any purpose other than as set out in this Statement.

(c) In the Event of Merger, Sale, or Change of Control

We may transfer or assign this Statement and any Personal Data to a third-party that acquires or is merged (or which seeks to acquire or merge with us) with us as part of a merger, acquisition, sale, or other change of control, or which otherwise acquires (or seeks to acquire) all or substantially all of our assets.

(d) Aggregate Information

We may conduct research on user demographics, interests and behavior based on the Personal Data and other information provided to us. This research may be compiled and analyzed on an aggregate basis, and we may share this aggregated information with our affiliates, agents and business partners. This aggregate information does not identify a user personally. We may also disclose aggregated information to current and prospective business partners and to other third parties for other lawful purposes.

(e) Other Disclosures

We may disclose Personal Data about you if we believe that disclosure of such information is helpful or reasonably necessary to: (i) comply with any applicable law, regulation, legal process or governmental request; (ii) enforce our Terms of Use at https://wsapartment.com/terms-of-us/, including investigations of potential violations thereof; (iii) detect, prevent, or otherwise address fraud or security issues; or (iv) protect against harm to the rights, property or safety of White Stone Apartments or its affiliates and joint venture partners, our users, or the public.

White Stone Apartments will take reasonable measures to ensure Personal Data held about you is accurate, complete and up-to-date. We will update Personal Data promptly if it is determined that such Personal Data has changed or is inaccurate.

We shall retain any Personal Data as long as the Personal Data are needed to: (i) fulfill the purposes that are described in this Statement, or (ii) comply with applicable law.

If we receive any unsolicited Personal Data that is not required for a purpose described in Section 5 of this Statement, we will (if lawful and reasonable to do so) destroy the information or ensure that the information is de-identified as soon as practicable.

The privacy and security of Personal Data is very important to us. Considering the nature, scope, context and purposes of Processing Personal Data as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, White Stone Apartments has implemented appropriate technical and organizational measures to ensure and to be able to demonstrate that its Processing of Personal Data is performed in accordance with Applicable Data Privacy Laws. However, no method of transmission over the Internet, or method of electronic storage, is 100% secure. Therefore, while we strive to use commercially acceptable means to protect Personal Data, we cannot guarantee its absolute security. We report known security incidents to both regulators and affected individuals in accordance with Applicable Data Privacy Laws.

Our Sites and business operations do not target children and individuals under the age of 18 years of age.

You may choose not to receive future emails from us by selecting an unsubscribe link at the bottom of each email that you receive from us. Additionally, you may send a request specifying your communications preferences to privacy.desk@wsapartment.com. Please note that even if you opt out of receiving the foregoing emails, we may still send you a response to any "Contact" request as well as administrative, maintenance and operational emails (for example, in connection with a password reset request). You cannot opt out of receiving transactional emails, or other communications related to the operation of our business relationship.

This section applies solely to a Californian customer’ personal information processing (excluding our employees, applicants, staff and contractors). This section is intended to address the relevant notice requirements of the California Consumer Privacy Act of 2018 (the "CCPA"), and uses certain terms having the meaning given in the CCPA.

• Your information, sources and purposes: please refer to the sections above explaining what data we collect , how we use the personal data and the cookie collected for a description of the personal information we may collect about you (or have collected in the preceding 12 months) and the sources of such information (such as directly from you and your device or through certain third parties). These also describe the purposes for which we may use or have used such information
• Sharing your information: we may have shared your personal information with certain categories of third parties, this Privacy Policy explains above who process your personal data
• Selling your information: we have not sold personal information in exchange for monetary compensation. We may allow certain third parties (such as certain advertising partners) to collect your personal information via automated technologies on our platforms in an effort to serve you content and advertisements that may be of interest to you. You have the right to opt out of this disclosure of your information, as described in the cookie section
• Your rights: subject to exceptions under applicable law, you may have certain choices regarding our use and disclosure of your personal information, as described below:
• Access: you have the right to request, twice in a 12-month period, that we disclose to you the personal information we have collected about you during the past 12 months and details regarding our collection, use, disclosure of such information.
• Deletion: you have the right to request that we delete the personal information we have collected from you.
• Opt-Out: You have the right to manage the activation of the cookies as described in the cookie section.

Personal, family and household clients: In addition, under California Civil Code Section 1798.83, if you are a California resident and your business relationship with us is primarily for personal, family or household purposes, you may request certain data regarding our disclosure, if any, of personal information to third parties for the third parties’ direct marketing purposes. To make such a request, please send an e-mail message to our e-mail address below. You may make such a request up to once per calendar year. If applicable, we will provide you, by e-mail, a list of the categories of personal information disclosed to third parties for their direct marketing purposes during the immediately preceding calendar year, along with the third parties’ names and addresses. Please note that not all personal information sharing is covered by Section 1798.83’s requirements.

White Stone Apartments is an international company with affiliates located in several countries. Our Sites and databases currently reside on servers in the United States and other countries and we cooperate with various sub-contracted data processors in countries around the world, including, but not limited to, our property locations in East Africa. Accordingly, White Stone Apartments may transfer Personal Data we collect to third parties in countries other than the country in which the Personal Data was initially collected. These countries may not have the same data protection laws that apply to the data subject or in which the Personal Data was initially collected. When we transfer Personal Data to recipients in other countries, we will protect it as described in this Statement.

Applicable Data Privacy Laws may give you certain rights with respect to Personal Data. These rights differ by country/region, but may include the right to request:

• Access to your Personal Data: You may have the right to obtain from us confirmation as to whether or not Personal Data concerning you is being processed, and, where that is the case, to request access to the Personal Data. This access information includes the purposes of the processing, the categories of Personal Data concerned, and the recipients or categories of recipient to whom the Personal Data have been or will be disclosed. You may have the right to obtain a copy of the Personal Data undergoing processing. For further copies requested by you, we may charge a reasonable fee based on administrative costs.
• Rectification: You may have the right to obtain from us the rectification of inaccurate Personal Data concerning you. Depending on the purposes of the processing, you may have the right to have incomplete Personal Data completed, including by means of providing a supplementary statement.
• Erasure: You may have the right to obtain from us the erasure of Personal Data concerning you and we may be obliged to erase such Personal Data.
• Restriction of Processing: You may have the right to obtain from us a restriction of Processing your Personal Data. In such cases, the respective data will be marked and may only be Processed by us for certain purposes.
• Data portability: You may have the right to receive the Personal Data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, and you may have the right to transmit those data to another entity without hindrance from us.
• Object: You may have the right to object, on grounds relating to your particular situation, at any time to the processing of your Personal Data by us, and we can be required to no longer process your Personal Data. If you have a right to object and you exercise this right, your Personal Data will no longer be processed for such purposes by us. However, such a right to object may in particular not exist if the processing of your Personal Data is necessary to take steps prior to entering into a contract or to perform a contract already concluded.

(a) How to Exercise Your Rights

To exercise your rights, described above, you can send an email to privacy.desk@wsapartment.com or write to us:

The Head of Customer Privacy,

KG 13 Avenue, N60 KGL.

Nyarutarama, Kigali.

Rwanda.

Depending on where you live, you may have the right to lodge a complaint with a supervisory authority or other regulatory agency if you believe that we have violated any of your rights concerning your Personal Data. We encourage you to first reach out to us at privacy.desk@wsapartment.com, so we have an opportunity to address your concerns directly before you do so.

White Stone Apartments shall cooperate with the relevant data protection authorities for the purpose of handling any unresolved complaints regarding Personal Data concerns. Personnel may engage their local data protection authority and White Stone Apartments shall respond directly to such authorities with regard to investigations and resolution of complaints.

As our organization changes over time, this Statement is expected to change as well. We reserve the right to amend the Statement at any time, for any reason, without notice to you, other than the posting of the amended Statement on our Sites. We may e-mail periodic reminders of our notices and terms and conditions, but you should check our Sites to see the current Statement that is in effect and any changes that may have been made to it.

All questions, comments or complaints regarding this Statement or White Stone Apartments’ Processing practices can be mailed or emailed to:

The Head of Customer Privacy,

White Stone Apartments Limited,

KG 13 Avenue, N60 KGL.

Nyarutarama, Kigali.

Rwanda.

privacy.desk@wsapartment.com