National Apartment Association Privacy Policy

NAA is committed to protecting your privacy. This policy describes how we collect and use your personal data. It also describes the rights you have and control you can exercise in relation to it.

Effective Date: March 25, 2022

Last Updated: May 1, 2024

Who We Are

The National Apartment Association (“NAA”) envisions a world where rental housing is a valued partner in every community. NAA is the leading voice for the rental housing industry and as a trusted partner, valued connector and a powerful advocate, we are committed to serving 141 state, local and global affiliates, over 95,000 members and more than 11.6 million apartment homes globally. We lead the way home.

The terms "NAA" and “our organization" include the National Apartment Association, the National Apartment Association Education Institute (NAAEI), National Apartment Association Political Action Committee (NAAPAC), and NAA Services, LLC (“NAAS”) ("we"/"us"/"our"). Any reference to NAA’s "location" means our office at 4300 Wilson Blvd, Arlington, Virginia 22203.

Personal data is collected on each member of our organization. If you have any questions about NAA’s use of your personal data, please use the following contact:

Email: [email protected]

Mail: 4300 Wilson Blvd, Suite 800, Arlington, VA 22203

Application of this Policy

This Privacy Policy applies when you visit or use our websites or mobile applications, contact our customer service team, engage with us on social media, register for an event, communicate with us on behalf of a vendor or customer, purchase our products or services, or otherwise interact with us. This Privacy Policy does not apply to personal information collected in connection with an application for employment or your employment with us. BY USING THE SITES OR OTHERWISE PROVIDING US WITH YOUR PERSONAL INFORMATION, YOU ARE AGREEING TO THE PROCESSING OF INFORMATION IN ACCORDANCE WITH THIS PRIVACY POLICY. PLEASE READ IT CAREFULLY.

Data Collection and Usage

We will collect the following personal data:

Contact information: your name, company or organization, telephone (including mobile phone number where provided) as well as email and postal address;
Demographic Data: For certain volunteer positions and some NAAEI programs we may collect demographic data e.g. race, ethnicity, gender, etc.
Sensory data: When you speak with customer service, we record the conversation.
Business information: data identifying you in relation to matters on which you instruct us or in which you are involved;
Professional or employment-related information: Place of employment, position, and role.
Your logon ID and password: for access to NAA’s websites, portals, and other member services or platforms;
Information from public sources: e.g. LinkedIn and similar professional networks, directories or internet publications;
Attendance records: to record your attendance at our offices for security purposes;
Subscriptions/preferences: when you subscribe to receive updates or newsletters as well as consent preferences to help us identify which materials you are interested in receiving;
Events data: attendance at and provision of feedback forms in relation to our events;
Supplier data: contact details and other information about you or your company or organization where you provide services to NAA;
Social media: posts, likes, tweets and other interactions with our social media presence;
Technical information: when you access this website and our technology services being IP address, browser type and version (e.g. Internet Explorer, Firefox, Safari etc.), time zone setting, browser plug-in types and versions, operating system you are using (e.g. Vista, Windows XP, MacOS, etc), device type, hardware model, MAC address, unique identifiers and mobile network information;
Special categories of personal data: such as dietary, disability or similar requirements for events, meetings, and examinations. If you do not provide this information, we may not be able to respond to your particular needs or preferences;
Criminal record data: where permitted by national law and appropriate to do so, such as existence of prior criminal offences (or confirmation of clean criminal record)

The above data will be provided to us by you, your employer, NAA’s Affiliate Network, the company or organization who is our client or screening providers who assist us with our legal obligations to conduct under anti-money laundering, sanctions screening and regulatory checks.

Your Communications with Us

NAA also collects information that you choose to provide in communications with us. Please do not send us confidential information until we have confirmed in writing that we need it for a legitimate business interest as described below.

When you communicate with NAA staff, including members of the Legal Affairs department or NAA General Counsel, there is no lawyer client relationship created or established between you and NAA. Therefore, any emails that you send to NAA are not privileged and may be disclosed to others.

Sources of Personal Information

NAA collects information in the following ways:

Directly from you. We collect personal information that you provide directly to us.
When you visit our locations. When you visit our offices or facilities, we also collect information such as contact information and audio/visual data via our security cameras.
Automatically. When you access our Sites, we collect personal information using tools like browser cookies.
From third parties. We may collect personal information from third parties including our vendors, clients, recruiters, and service providers.
From Affiliates. We may collect personal information from other entities in our organization.
Social media platforms. Depending on the information you choose to share and your privacy settings, we may collect contact information, identifiers, audio/visual data, personal characteristics or traits, geolocation data, commercial information, professional or employment information, internet or electronic usage data, and inferences. Based on the way you have set your privacy settings on your social media accounts, most social media platforms, like Facebook and Instagram, analyze data about how you interact with our Sites and combine it with information on other users to provide us information about you. In addition, we may receive information about you if other users interact with us on social media and information about you is visible to us, for example the fact that you are “friends” or other public-facing profile information.

How We Use Your Personal Data

We use your personal data for the following purposes:

NAA Affiliates, service providers, and other business relationships: managing and administering our relationship with you, your company or organization including keeping records about business contacts, services and payments so we can customize our offering for you, develop our relationship and target our marketing and promotional campaigns;
Marketing: sending emails, newsletters and other messages to keep you informed of legal developments, market insights and market our services, and to and to provide you with information about us, including personalized marketing communications;
Events: running meetings, webinars, roundtables and other events;
Education and Credentialing: to provided educational services, examinations, and credentials
Surveys and feedback: including events feedback as well as answering issues and concerns which may arise;
Legal compliance: due diligence (under anti-money laundering, sanctions screening and other crime prevention and detection laws and regulatory requirements) which may involve automated screening checks to ensure that members and contacts are genuine and to prevent fraud or crime; to comply with our legal obligations, including reporting requirements, and defend ourselves in legal proceedings, and protect our company and our property, employees, and others through legal proceedings;
Fraud Prevention: protect us, our affiliated companies, our employees, and others from fraud, theft, and other misconduct; conduct vendor due diligence; and detect and prevent fraud, theft, and misconduct including by verifying the identity of those we are conducting business with.
Website monitoring: to check the website and our other technology services are being used appropriately and to optimize their functionality;
Site security and performance: to provide security to our offices and other premises (normally collecting your name and contact details upon entry to our buildings);
Online security: protecting our information assets and technology platforms from unauthorized access or usage and to monitor for malware and other security threats;
Regulatory: compliance with our legal and regulatory obligations as an organization including auditing and reporting requirements ;
Managing suppliers: who deliver services to us;
Legitimate interest: to pursue the legitimate business interests.

Our Lawful Basis for Processing Special Category Data

Special category data refers to sensitive data such as your racial or ethnic origin, religious beliefs or health data. We may also collect data about criminal convictions. We will process this data where permitted by law in the relevant jurisdiction and:

We have your consent: for the particular processing;
This is necessary to protect your vital interests or those of another person: for example, in medical emergencies; you have manifestly made the data public: for example, where you have published it on social media;
This is necessary to deal with legal claims: for example, involving court proceedings; and
This is necessary for substantial public interest: for example to prevent or detect unlawful acts.

With Whom Do We Share Your Data?

We share your information as with others as follows:

Affiliate Network: who support our organizations mission and goals at the local and state level
Suppliers: who support our business including IT and communication suppliers, outsourced business support, marketing and advertising agencies;
Shared service centers: operated by NAA or third parties including for client on-boarding, IT services, marketing, risk management and office support services;
Law enforcement bodies and our regulators: or other competent authorities in accordance with legal requirements or good practice;
Appropriate parties in the event of emergencies: in particular to protect health and safety of our clients, staff and organizations;
Your company or organization: in relation to us providing you services;
Screening service providers: so that we can comply with legal obligations in relation to the prevention or protection of crime, ant-money laundering, sanctions screening and other required checks;
Advertising networks and analytics service providers: to support and display ads on our website, apps and other social media tools;
Third parties: in the context of the acquisition or transfer of any part of our business or in connection with the business reorganization;
Other delegates and stakeholders: where your name will appear on the attendee list for events where you have told us you plan to attend.
Business transfers: your personal information may be transferred to another entity (either an affiliated entity or an unrelated third party) in connection with a merger, reorganization, dissolution or similar corporate event. If such a transfer were ever to occur, the acquiring entity’s use of your personal information will still be subject to this Privacy Policy.

We may also share your information with others if you are a student of NAAEI. The information that we may share with others is as follows:

Corporate Trainers, Non-profits, College & Universities, or Other Course Providers: sothat they may access student information and have the abilityto create student accounts, pay for student materials, run reports of students in their class, or verify completion of training courses that students are in
Employer (non-trainer): so that they have the ability to pay for bulk renewals and to verify credentials via Public Credential Registry
Public Credential Registry: to include first and last name, city, state, country, credential program name, date earned and expiration date/date of last, program status.

Personal Data About Others

In some cases, you may provide personal data to us about other people (such as your customers, directors, officers, shareholders or beneficial owners). You must ensure that you have given those individuals appropriate notice that you are providing their information to us and have obtained their consent to that disclosure.

Security

We have implemented reasonable physical, technical and administrative security measures to protect personal information. However, the transmission of information via the internet is not completely secure. Although we will take reasonable measures to protect your personal information, we cannot guarantee the security of your information transmitted and any transmission is at your own risk. You are solely responsible for maintaining the secrecy of any passwords or other account information. In addition, other Internet sites or services that may be accessible through our site have separate data and privacy practices independent of us, and therefore we disclaim any responsibility or liability for their policies or actions. Please contact those vendors and others directly if you have any questions about their privacy policies.

Where Will Your Information Be Held?

Please be aware that information we obtain about you will be processed in the United States or in other jurisdictions by our service providers or us. By using the Sites or our services, you acknowledge your personal information may be transferred to and processed in jurisdictions outside your own, as described in this Privacy Policy. Please be aware that the data protection laws and regulations that apply to your personal information transferred to the United States or other jurisdictions may be different from the laws in your country of residence. The United States may not afford the same level of protection as laws in your own country.

How Long Do We Keep Your Data?

We generally keep your information as needed to provide our services. This will depend on a number of factors such as whether you or your company or organization are a member or have interacted with recent marketing or bulletins or attended recent events. We will retain your information as necessary to comply with legal, accounting or regulatory requirements. We use the following criteria to determine retention periods:

how long the information is needed to provide our services and operate our business;
whether there are contractual or legal obligations that exist that require us to retain the information for period of time;
whether any law, statute, or regulation allows for a specific retention period;
whether an individual has agreed to a longer retention period;
whether the data is considered to be sensitive data, and
what the expectation for retention was at the time the data was provided to us.

Direct Marketing

We may use the information you give us on our website or other means for direct marketing purposes to provide emails, newsletters and other messages to keep you informed of industry developments, market insights and of our services including events that we think may interest you. Any data that we collect for this purpose will be stored in compliance with local regulations and in accordance with our privacy policy.

You can opt-out of receiving direct marketing from us at any time. You can do this by using the "unsubscribe" link or mechanism noted in communications you receive from us. You may also request to opt out of marketing or advertising emails by contacting us at [email protected] Once we process your request, we will cease using the information for such purposes at no charge to you. If you opt out of getting marketing messages, you will continue to receive messages from us about your relationship with us where permitted by law.

California Residents

This section applies to you only if you are a resident of the state of California. All terms and phrases used under this heading shall have the same meaning as those defined under the California Consumer Privacy Act of 2018 and all related amendments and regulations (“CCPA”).

Your Rights Under the CCPA.

Subject to certain exceptions and limitations, the CCPA affords California consumers the following rights:

You have the right to request that we tell you (i) what personal information we have collected about you, (ii) the sources of that information, (iii) the business or commercial purposes for collecting, selling or sharing the personal information; and (iv) the categories of third-parties to whom we have disclosed personal information.
You have the right to request that we provide you with a copy of your personal information.
You have the right to request that we delete personal information that we have collected from you.
You have the right to opt-out of the sale of your personal information.
You have the right to opt out of the sharing of your personal information for cross-context behavioral advertising.
You have the right to direct us to limit the use or disclosure of your sensitive personal information to only the purposes specified in the CCPA.
You have the right to correct inaccurate personal information that we hold about you.

You have the right to not be discriminated against for exercising any of your CCPA rights. We will not discriminate against you, deny you services, charge you a different price, or provide you with a lesser quality of services if you exercise any of your CCPA rights.

Submit a Request.

To exercise any of your rights, please use our webform or contact us at 1-833-86-MYNAA (1-833-866-9622). For all requests, you must provide us with your name, email address, phone number, and mailing address. We will verify your identity by matching the information we have collected against the information you have provided. Failure to provide the foregoing information may prevent us from processing your request. If you have requested that we correct your personal information, we may contact you to request additional information about the personal information that you believe is inaccurate, including supporting documentation. In order to designate an authorized agent to act on your behalf, you may forward a signed, written authorization to us at [email protected].

Opting-Out of Cross-Context Behavioral Advertising.

We engage in online advertising practices (and certain analytics or similar activities), which may be considered a “sale” or “share” for cross-context behavioral advertising. In addition to submitting the form above, you may need to disable sharing through cookies set by third parties on our Sites. To manage your cookie preferences, please click the Cookie Preferences link at the bottom of our page and ensure that all analytics and advertising cookies are disabled.

If you have enabled Global Privacy Control or an opt-out preference signal on your browser or extension, we will honor such requests that can be recognized by our Sites by disabling Analytics and Advertising cookies. Please note that we may not be readily able to associate an opt-out preference signal with other personal information such as your email address. You will also only be opted out of online sales or sharing of personal information and will need to turn it on for each browser you use. Refer to the “Exercising Your Rights” above if you would like to extend your opt-out request beyond the online advertising practices described above.

Notice of Collection and Disclosure for a Business Purpose.

Below is a list of the categories of personal information we have collected about California residents over the last twelve months, including: (1) where we collect it from; (2) the purpose for its collection; and (3) who we share it with, including any disclosures for a business purpose.

Category	How we collect it	Why we collect it	With whom we disclose for a business purpose
Identifiers, such as name, mailing address, email address, phone number, and other contact information. For more information please see the Data collection and usage section.	Collected online or offline when you directly provide it to us, through your use of our Services, or from third parties.	We collect this information for the purposes listed in the How we use your personal data section.	Shared with our affiliates, partners, vendors, and service providers as described in the With whom do we share your data section.
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)), such as name, mailing address, email address, phone number, and contact information.	Collected online or offline when you directly provide it to us, through your use of our Services, or from third parties.	We collect this information for the purposes listed in the How we use your personal data section.	Shared with our affiliates, partners, vendors, and service providers as described in the With whom do we share your data section.
Protected classification characteristics under California or federal law, such as age and gender. For more information please see the Data collection and usage section.	Collected online or offline when you directly provide it to us, through your use of our Services, or from third parties.	We collect this information for the purposes listed in the How we use your personal data section.	Shared with our affiliates, partners, vendors, and service providers as described in the With whom do we share your data section.
Commercial information, such as transactional information such as the products or services purchased. For more information please see the Data collection and usage section.	Collected online or offline when you directly provide it to us, through your use of our Services, or from third parties.	We collect this information for the purposes listed in the How we use your personal data section.	Shared with our affiliates, partners, vendors, and service providers as described in the With whom do we share your data section.
Biometric information Not Collected	N/A	N/A	N/A
Internet or other similar network activity, such as IP address, browser type and version, browser plug-in types and versions, operating system and platform, device type and device identifiers For more information please see the Data collection and usage section.	Collected online when you directly provide it to us, through your use of our Services, or from third parties	We collect this information for the purposes listed in the How we use your personal data section.	Shared with our affiliates, partners, vendors, and service providers as described in the With whom do we share your data section.
Geolocation data Collected via IP address. For more information please see the Data collection and usage section.	Collected online when you directly provide it to us, through your use of our Services, or from third parties.	We collect this information for the purposes listed in the How we use your personal data section.	Shared with our affiliates, partners, vendors, and service providers as described in the With whom do we share your data section.
Sensory data When you speak with customer service, we record the conversation. For more information please see the Data collection and usage section.	Collected when you directly provide it to us.	We collect this information for the purposes listed in the How we use your personal data section.	Shared with our affiliates, partners, vendors, and service providers as described in the With whom do we share your data section.
Professional or employment-related information Place of employment and position. For more information please see the Data collection and usage section.	Collected online or offline when you directly provide it to us, through your use of our Services, or from third parties.	We collect this information for the purposes listed in the How we use your personal data section.	Shared with our affiliates, partners, vendors, and service providers as described in the With whom do we share your data section.
Non-public education information Not Collected	N/A	N/A	N/A
Inferences drawn from other personal information Information generated from your use of our Services reflecting your preferences	Collected online or offline when you directly provide it to us, through your use of our Services, or from third parties	We collect this information for the purposes listed in the How we use your personal data section.	Shared with our affiliates, partners, vendors, and service providers as described in the With whom do we share your data section.

Notice of Sale or Sharing of Personal Information.

We do not sell the personal information of California residents for monetary compensation. But our website runs analytics that collect certain data when you visit our site. In the preceding 12 months, we have “sold” or “shared” (as those terms are defined in the CCPA) with the vendors of the analytic programs that runs on our website the following categories of personal information: identifiers, commercial information, geolocation data, and internet or electronic usage data.. We have no actual knowledge of selling information of California residents under the age of 16.

Use or Disclosure of Sensitive Personal Information.

In the preceding 12 months, we have not used or disclosed sensitive personal information for purposes to which the right to limit use and disclosure applies under the CCPA.

Shine The Light.

If you are a California resident, this section applies to you. The California Shine the Light law (Cal. Civ. Code § 1798.83) permits residents of California to request certain details about how their information is shared with third parties for the third-parties’ direct marketing purposes. If you are a California resident and would like to make such a request, you may use our webform or contact us at [email protected]. If you elect to email us, please include “CA Shine the Light” in the subject line of your email.

Other U.S. State Privacy Rights

This section applies to residents of Virginia, Colorado, Utah, and Connecticut.

Your Rights.

Depending on your state of residence and subject to certain limitations and exceptions, you may have the following rights with respect to your personal data:

You have the right to request that we confirm whether or not we are processing your personal data and to access your personal data.
You have the right to obtain a copy of your personal data in a portable and, to the extent technically feasible, readily usable format that allows data portability.
You have the right to correct inaccurate personal data that we hold about you, taking into account the nature of the personal data and the purposes of the processing of the data.
You have the right to request that we delete personal information that we have collected from you or obtained about you.
You have the right to opt-out of the processing of your personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) automated decision-making or profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

Submit a Request.

EU Resident Rights

This section applies to residents of the European Economic Area (EEA) and Switzerland.

Lawful Basis For Processing Your Personal Data

We will process your personal data for a number of reasons:

You have given us consent: for example, where you share details for particular purposes;
This is necessary to comply with legal or regulatory obligations: for example, anti-money laundering and mandatory member and contactscreening checks or disclosure to law enforcement.
Processing is necessary for our legitimate business interests or those of a third party: provided this does not override any interests or rights that you have as an individual. Our legitimate interests are listed in the next section.
Processing is necessary to deal with legal claims

Disclosure and Cross-Border Transfer.

Personal information that is shared as described in this Privacy Policy is done pursuant to contracts that include the requisite protections under applicable data protection laws. In accordance with these laws, transfers of personal information outside of the European Economic Area are conducted in accordance with compliant arrangements such as data transfer agreements that contain standard contractual clauses adopted by the European Commission that provide safeguards for such transfers or legally recognized certifications and adequacy decisions. In certain circumstances, courts, law enforcement agencies, regulatory agencies or security authorities in those other countries may be entitled to access your personal information.

Segmentation and Automated Decision Making.

We do not use segmentation or automated decision-making without human intervention, including profiling.

Your Rights Over Your Personal Information.

Subject to certain exceptions and limitations, you have the right to:

Ask us to confirm whether we are processing your personal information.
Ask us to provide you or a third party that you designate with certain of your personal information in a commonly used, machine readable format. Please note, however, that data portability rights apply only to personal information that we have obtained directly from you and only where our processing is based on consent or the performance of a contract.
Request that we update or correct your personal information when it is inaccurate or incomplete.
Request that we delete your personal information in certain circumstances.
Request that we limit processing or stop processing your personal information in certain circumstances including for marketing activities and profiling for marketing activities and profiling for statistical purposes and, subject to certain exceptions, where such processing is based on our legitimate business interests.
Withdraw or revoke consent previously granted to the extent permitted by law.

Exercising Your Rights.

To exercise any of your rights, please contact us at [email protected]. We will respond to all such requests within 30 days of our receipt of the request, unless there are extenuating circumstances, in which event we may take up to 60 days to respond. We will inform you if we expect our response to take longer than 30 days. Please note, however, that certain personal information may be exempt from such rights pursuant to applicable data protection laws. In addition, we will not respond to any request unless we are able to appropriately verify the requester's identity.

You also have the right to lodge a complaint with a data protection authority for your country or region or where an alleged infringement of applicable data protection laws occurs. For the EEA, a list of the national data protection authorities can be found at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

Representative Information Coming Soon

Cookies and Tracking Technology

When you access the website, we (and third-party companies we work with) may collect and store certain information by using technologies such as server logs, cookies, web beacons, clear gifs, tags, e-tags, flash cookies, log files, pixels, code, Javascript packages, mobile advertising IDs (such as Facebook cookies or Google's Advertising ID), cross-device linking, and similar technologies. The information collected includes information about your activities on our Sites, IP address, browser or operating system type and version, device IDs, and demographic or inferred-interest information, as well as information or communications you have submitted to us through the Sites.

We use this information to understand general usage and volume statistics, how users navigate to and around our Sites, what content is viewed or accessed, and which products and services have been obtained. We also use these technologies to keep track of your preferences and profile information. We also use these technologies to allow third-parties to provide analytics and advertising services and serve advertisements on our behalf across the Internet and in mobile applications. For example, our advertising partners may use the fact that you visited our Site to target advertising to you on other websites and mobile apps on your current device or on other devices you use. They may match your browsers or devices if you log into the same online service on multiple devices. These third-parties may use this information for our and their own advertising, analytics, attribution, and reporting purposes.

To learn more about interest-based advertising, tracking technologies, and how to opt out, please visit http://www.aboutads.info/choices. You can disable the sharing of your personal information for cross-contextual behavioral advertising or targeted advertising through online cookies and tracking technology by clicking the Cookie Preferences link in our website footer and changing your cookie preferences to ensure that analytics and advertising cookies are disabled.

Do Not Track Signals

Some browsers have a “do not track” feature. It lets you tell websites you visit that you do not want them to track your online activity. These features are not yet uniform across browsers. Our Sites are thus not currently set up to respond to these signals. For more information on Do Not Track signals, please visit https://allaboutdnt.com/.

Google Analytics

We use analytics services provided by Google Analytics. If you would like more information on how Google uses data when you visit or use our Sites, please visit www.google.com/policies/privacy/partners. If you would like to opt-out, Google provides a an opt-out tool which is available at https://tools.google.com/dlpage/gaoptout.

Postings To Our Websites

Our websites are provided as a service for the members of the National Apartment Association. NAA reserves the right to evaluate and remove comments that are defamatory, abusive, profane, threatening, vulgar, offensive or illegal in nature. NAA also reserves the right to terminate access to any user who does not abide by these guidelines.

Links To Third Party Websites

Our website, newsletters, email updates and other communications may, from time to time, contain links to and from the websites of others. The personal data that you provide through these websites is not subject to this privacy notice and the treatment of your personal data by such websites is not our responsibility.

If you follow a link to any other websites, please note that these websites have their own privacy notices which will set out how your information is collected and processed when visiting those sites.

Children

We do not knowingly collect information from children or other persons who are under 16 years old. If you are under 16 years old, you may not submit any personal data to us. If you are a parent or guardian and believe we may have inadvertently collected personal information from your child, please notify us immediately by sending an email to [email protected].

Changes To This Notice

From time to time we may change our privacy policy. We will notify you of any material changes to our privacy policy as required by law. We will also post an updated copy on the website where this appears. Please check our website periodically for updates. The “Last Updated” legend above indicates when this Privacy Policy was last revised. Any changes will become effective when we post the revised Privacy Policy on any of our websites or mobile applications.

How To Contact Us

If you would like more information about the way we manage personal data that we hold about you please contact us as set out at the top of this notice.