Privacy Policy

Last Updated On: February 19, 2025

Welcome to the privacy policy of Kimco Realty Corporation ("KRC") and its affiliates. This policy applies to the websites owned or operated by KRC and its affiliates, including, Kimcorealty.com and Shopkimco.com (each a “Website,” and collectively, the “Websites”).

The personal information we collect relates principally to the representatives and employees of our past, current, or potential tenants, our current workforce, job applicants, and various categories of visitors to our corporate Websites. In very limited circumstances, we may collect or maintain email or other personal contact information related to visitors of our properties on behalf of individual facilities which we own or operate through separate affiliates. For information about those information practices, you should refer to the privacy policy associated with the individual property website.

When you contact us in relation to employment opportunities at KRC or one of our affiliates or properties, we collect certain information as part of the recruitment process (and if successful, your employment). You can learn more about this in our separate Candidate Privacy Notice or Employee Privacy Notice (available via private intranet to workforce only).

1. Personal Information Collection

   We have collected and may continue to collect personal identifiers including name, mailing address, online identifier, Internet Protocol address, email address, telephone number and other similar identifiers. In some situations we may ask you to voluntarily provide us with some personal identifiers. For example, we may ask you for this type of information when you sign up to receive emails or newsletters from us, to attend an event, provided by us from time to time, or contact us via the Website (in which cases we will collect information such as name, email address, organization, zip code, job title, telephone number(s), details of your comment or query).

   We also collect certain information using automated technologies, such as which pages of a Website you access, which web browser you use, and other Website usage metrics.

   At other times, KRC may collect anonymous or aggregated information that cannot be used to directly identify a natural person. This information may include statistical information about the types of classes of users on our Website. For example, we may aggregate non-identifying information, such as the number of visitors to a particular area of the Website. KRC will not use aggregated information in a way that can be linked directly back to individuals. This information may be provided to us by our advertising partners and third-party Service Providers (defined below).

2. How KRC Collects Personal Information

   For Website visitors, KRC may use tools to collect information about you, your computer access points, and the web browser that you use to connect to our Website. For example, cookies are tiny text files that we place on your computer’s hard drive when you visit our Website. We may use cookies to personalize your Website or retail experience. You do not have to accept our cookies, and browser settings can be used to prohibit the placement of cookies on your devices. You also may delete cookies after they have been placed on your hard drive. If you do not accept or choose to delete our cookies, some areas of our Website that you access may take more time to work, or may not function properly.

   KRC may also collect additional information from your web browser each time you visit our Websites. We may collect information on the pages that you visit, the promotions or advertisements that you click on, and other actions that you take while using our Website. This information may include your Internet Protocol ("IP") address or Media Access Control ("MAC") number, the type of browser, the time that your browser was used to access our Website, and the referring website address.

   Our Service Providers (defined below) may also use other standard web-based technologies to analyze your movements while accessing our Website or retail properties. The technologies may include, without limitation, web "beacons," "pixel tags," "clear gifs." These technologies help us ascertain the effectiveness of our promotional programs, allow us to customize the services offered on or through our Website and shopping centers and residential properties, and help determine the best use for Website content, and service offerings. Some of this information, including the IP address, may be stored on our Service Provider’s server logs, and may be available for extended periods of time.

   We may collect and process information relating to you as an individual (whether as a Website user or representative of one of our current, past or potential tenants) when you conduct business with Kimco as, or on behalf of, a tenant or prospective tenant, or as, or on behalf of, a vendor, supplier, consultant, professional adviser or other third party ("Tenant, Vendor or Business Partner Data"). We may collect and maintain records of the name, business phone numbers, business address, and photograph of our tenants, including if you attend or participate in any Kimco events. We may also have financial information (such as financial account information about individuals connected to a particular commercial tenant) or property ownership information relating to such individuals if needed to take payment or fulfill contractual obligations or for due diligence or related purposes.

   In connection with our leasing operations, we may receive personal information from third party sources such as background or credit check databases, employers, and other parties in the real estate sector such as real estate agents or brokers or financial institutions. Before any such checks are performed, we will confirm that the pertinent third parties either have your consent or are otherwise legally permitted or required to disclose your personal information to us.

3. Cookies and Other Tracking Technologies

   Most browsers accept cookies automatically, but you may be able to control the way in which your devices permit the use of cookies, web “beacons,” “pixel tags,” and “clear gifs.” If you so choose, you may block or delete our cookies from your browser; however, blocking or deleting cookies may cause some of our services, including certain features and general functionality, to work incorrectly. If you have questions regarding the specific information about you that we process or retain, as well as your choices regarding our collection and use practices, please contact us using the information listed below.

   Your browser settings may allow you to transmit a “do not track” signal, “opt-out preference” signal, or other mechanism for exercising your choice regarding the collection of your information when you visit various websites. Like many websites, our website is not designed to respond to such signals, and we do not use or disclose your information in any way that would legally require us to recognize opt-out preference signals. To learn more about “do not track” signals, you can visit http://www.allaboutdnt.com/. To learn more about Global Privacy Control, you can visit https://globalprivacycontrol.org/.

4. Our Use and Disclosure of Your Personal Information

   KRC may use your personal information as follows:

   • Respond to your inquiries or feedback (for example, if you’ve asked a question or submitted feedback via the site)
   • Provide you with information about KRC, its real estate holdings, or other information you have requested or which we feel may interest you, unless you tell us otherwise
   • Perform contracts entered into between you (or your employer) and us
   • Allow you to participate in any interactive features of the site
   • Notify you about changes to the Website or other non-promotional activities
   • Provide you with information, newsletters, or other information about our company or business where you’ve consented to receive by providing your contact information for this purpose
   • Ensure Website content is presented in the most effective manner for the device you’re accessing it from
   • Undertake data analytics to learn more about how you and others interact with our Websites and with our advertising
   • Detect and prevent misuse or abuse of this Website or KRC in its business

   KRC may share your information with other Kimco companies and also with any of our third party service providers who provide services such as website hosting, data analysis, information technology and related infrastructure provision, customer service, email delivery, auditing and other services ("Service Providers").

   KRC may also disclose your personal information as is necessary to: (a) comply with a subpoena or court order; (b) cooperate with law enforcement or other government agency; (c) establish or exercise our legal rights; (d) protect the property or safety of our company and employees, contractors, vendors, and suppliers; (e) defend against legal claims; (f) help with internal and external investigations; or (g) as otherwise required by law or permitted by law. We may disclose your information in connection with the sale or merger of KRC or any transaction that involves the sale or assignment of some or all of our assets.

5. Data Security

   KRC implements and maintains reasonable security measures designed to protect the information submitted to us from accidental loss and from unauthorized access, use, alteration, and disclosure.

   However, no physical or electronic security system is impenetrable, and there is no completely secure or error-free method of data transmission over the Internet. As such, KRC cannot and does not guarantee the security of your information, nor can KRC guaranty that information about you won't be intercepted while being transmitted to KRC over the internet or other networks.

6. Children and Data Collection

   This Website is a public website that is viewable by anyone without restriction. However, KRC’s Website content is neither directed toward minors nor children who are under the age of 13. We do not knowingly collect personal information from children under the age of 13 without parental consent. If KRC becomes aware that a minor or a child under the age of 13 has provided us with personal information without parental consent, that information will be deleted from our databases. Parents who have questions about personal information that may have been submitted by a child or on behalf of a child under the age of 13 should email us at policies@kimcorealty.com.

7. How You May Access and Change the Information That KRC Collects; Opting Out

   You may request to review your information at any time and make changes, corrections, or deletions by contacting policies@kimcorealty.com.

   Each commercial e-mail that we send to you will offer you the opportunity to opt-out of continuing to receive such messages. We may take up to ten (10) business days to process your opt-out requests. In some instances, we may have already disclosed your information to one of our marketing service providers before you changed your information preferences. In those cases, you may have to directly contact those third parties to opt-out of receiving their communications.

8. Additional Terms for California Residents

   This section explains how the legal entities listed above collect, use, and disclose personal information relating to California residents covered by the California Consumer Privacy Act of 2018 ("CCPA"). This notice is provided pursuant to the CCPA.

Sources of Personal Information

We collect personal information directly from you, from your device, and from other third party sources including background check or credit check providers.

Collection and Disclosure of Personal Information

Over the past 12 months, we or our affiliates may have collected and disclosed the following categories of personal information (including sensitive personal information, which is denoted by *) from or about covered California consumers:

• Identifiers, including their names, telephone numbers, fax numbers, email addresses, home or business mailing addresses, MAC addresses, and IP addresses.
• Personal information listed in the California Customer Records statute, Social Security Number*, including name and signature.
• Government identifiers*, including Social Security Number.
• Financial information, including bank account details, credit history, tax returns.
• Commercial information, including records of properties leased.
• Internet or other electronic activity information, including information about which pages of our Websites they access, which web browsers they use, Website usage metrics, clickstream data, the promotions or advertisements they click on, the time that their browsers were used to access our Website, and the referring website addresses through which they reached our Websites. We collect this information directly from the devices which access our Websites.
• Geolocation data, including information about location at the zip code level, which we derive from IP address, and which is collected directly from the connecting device.
• Audio, electronic, visual, thermal, olfactory, or similar information, including photographs.
• Professional or employment-related information, including the places of employment. We collect this information directly, for example, on the online forms expressing interest in leasing from a Kimco entity.

We collect California residents’ personal information for the purposes set out in Section IV, and also for the following purposes:

• To operate and improve the Websites and their functionality;
• To contact them via mail, email, or messaging in order to give them updates about KRC’s special events, new services, or other KRC promotions or commercial leasing opportunities that may be of interest to them;
• For security and verification purposes, including to prevent and detect fraudulent activity;
• To address and remediate technical issues and bugs.

We disclose all the above categories of personal information, for the purposes set out above, to the following types of entities:

• Our affiliates or others within our corporate group;
• Other companies that provide services on our behalf who are prohibited by contract from retaining, using, or disclosing personal information for any purpose other than for providing the services to us;
• Regulators, judicial authorities, and law enforcement agencies;

Entities that acquire all or substantially all of our business.

In the past 12 months, we have not sold or shared Personal Information of California residents within the meaning of "sold" and "share" in the CCPA. We do not have actual knowledge that we sell or share for targeted advertising purposes Personal Information of individuals under 16 years of age.

Data Retention

We will retain personal information only for as long as necessary to fulfill the purposes for which we collected it. To determine the appropriate retention period, we consider the amount, nature and sensitivity of your personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements. We will also retain and use your personal information to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our policies. Additionally, we retain the personal information collected during the leasing application process, and information about your application process, as part of your tenant records.

Your Privacy Rights

Depending on where you live, you may have some or all of the rights listed below in relation to information we have collected about you. However, please note that the rights are not absolute, and that exceptions may apply, particularly in light of the very limited nature of our collection or use of consumer information. If these rights apply to a person and there is no applicable exemption, to the extent applicable, they may have the right to:

• Request we disclose to them free of charge the following information covering the 12 months preceding their request:
  • The categories of personal information about them that we collected;
  • the categories of sources from which the personal information was collected;
  • the purpose for collecting personal information about them;
  • the categories of and specific pieces of personal information we have collected about you;
  • the categories of third parties to whom we disclosed personal information about them and the categories of personal information that was disclosed (if applicable) and the purpose for disclosing the personal information about them; and
  • the specific pieces of personal information we collected about them;
• Request we correct inaccurate personal information maintained about you;
• Request we delete personal information we collected from them;
• Request we limit our use and/or disclosure of sensitive personal information to only what is necessary to perform the services or provide the goods reasonably expected by an average consumer; and
• Be free from unlawful discrimination for exercising their rights including providing a different level or quality of services or denying goods or services to them when they exercise their rights.

We aim to fulfill all verified requests within the time allotted by law. If necessary, extensions for additional time will be accompanied by an explanation for the delay.

In addition, where applicable, we will provide the requestor with more information about our appeal process. When a person submits a request or launches an appeal, we will limit our collection of their information to only what is necessary to securely fulfil their request or process their appeal. We will not require them or their authorized agent to pay a fee for the verification of their request or appeal.

How Certain U.S. Residents Can Exercise Their Rights

A resident for whom these rights apply may exercise their rights, if any, with respect to their personal information by contacting us at policies@kimcorealty.com or via our toll-free number at 1-800-764-7114. Alternatively, they may mail a request to: Attn: Legal Department, 500 North Broadway, Suite 201, Jericho, NY 11753. We may need to collect information from you to verify your identity, such as your email address, government issued ID or date of birth, before providing a substantive response to the request. You may designate, in writing or through a power of attorney document, an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require that the agent provide proof you have authorized them to act on your behalf, and we may need you to verify your identity directly with us.

9. Changes to This Policy

   We will post any future changes to this policy on this page. Please check back frequently to see any updates or changes to this policy. If we make material changes to the way in which we use or disclose information we collect, we will use reasonable efforts to notify you (such as by emailing you at the last email address you provided us, by posting notice of such changes on our site, or by other means consistent with applicable law) and will take additional steps as required by applicable law. If you do not agree to any updates to this policy, please do not continue using or accessing the Services.

10. Contact Us

    Please feel free to contact us with any questions or comments regarding this policy or our information practices. You can contact us by email at policies@kimcorealty.com, by telephone at 1-800-764-7114, or by postal mail at:

    Kimco Realty Corporation
    500 North Broadway
    Suite 201
    Attn: Legal Department
    Jericho, NY 11753

    516-869-9000

    policies@kimcorealty.com

KRC Candidate Privacy Policy

Last Updated February 19, 2025

1. Introduction

   Kimco Realty Corporation ("KRC", "our", "we") provides this policy, which sets out the basis on which we will process any information that job applicants ("you" or "your") provide to us through our applicant tracking system or otherwise via e-mail or the KRC communications platform during the recruitment process (collectively the "Candidate Portal").

2. The Types of Data We Receive and How We Receive It

   • Information you provide as part of your application. This includes information you provide when you use the Candidate Portal such as your username, name, contact information, work experience, and educational qualifications. At your option, we may collect characteristics of protected classifications under California or federal law (such as race or gender).
   • Information from third parties. We receive information from third parties in connection with your application, such as recruiting firms, background check providers, your past employers, and references you provide, which we use to evaluate your application and verify your credentials. For instance, external recruiters may (with your consent) provide us information about you if you express to that recruiter an interest in one of our postings.

3. How We Use Your Information

   We use information about you as follows:

   • Assessing your skills, qualifications and interests against our career opportunities;
   • Verifying your information and carrying out reference checks and/or conducting background checks (where applicable) if you are offered a job;
   • Communicating with you about potential employment at KRC or one of its affiliates;
   • Making improvements to our processes including improving our recruitment practices; and/or
   • Complying with applicable laws, regulations, legal processes or enforceable governmental requests.

4. How We Disclose Your Information

   We disclose your information with companies who perform services on our behalf. These companies are prohibited from retaining, using, or sharing your information for any purpose other than providing their services to us. These categories of recipients include portal providers, IT service providers, and background check providers (collectively, “Service Providers”).

5. Additional Terms for Certain California Residents

   This section explains how the legal entities listed above collect, use, and disclose personal information relating to California residents covered by the California Consumer Privacy Act of 2018 ("CCPA") who use the Candidate Portal. This notice is provided pursuant to the CCPA. Please note that the rights described below are not absolute, and that exceptions may apply, particularly in light of the very limited nature of our collection or use of information.

Sources of Personal Information

We collect personal information about you from the sources detailed in Section II.

Collection and Disclosure of Personal Information

Over the past 12 months, we have collected and disclosed for a business purpose the following categories of personal information and sensitive personal information (denoted by *) about you:

• Identifiers, including names, telephone numbers, email addresses, home address, MAC addresses, and IP addresses. We have disclosed this category of personal information with our Service Providers.
• Personal information categories listed in the California Consumer Records statute, including name, signature, social security number*, physical characteristics or description, address, telephone number, passport number*, driver’s license or state identification card number*. We have disclosed this category of personal information with our Service Providers.
• Protected classification characteristics under California or federal law*, including race, color, religion or creed, national origin or ancestry, sex (including gender, pregnancy, sexual orientation, and gender identity), age, physical or mental disability, veteran status, and citizenship*. We have disclosed this category of personal information with our Service Providers.
• Internet or other electronic activity information, including information about which pages of our Candidate Portal are accessed, web browser details, Candidate Portal usage metrics, and clickstream data. We have disclosed this category of personal information with our Service Providers.
• Geolocation data, including information about location at the zip code level, which we derive from IP address, and which is collected directly from the connecting device. We have disclosed this category of personal information with our Service Providers.
• Professional or employment-related information, including the places of employment, title of profession, employer, and professional background. We have disclosed this category of personal information with our Service Providers.
• Non-public education information collected by certain federally funded institutions, including education records. We have disclosed this category of personal information with our Service Providers.
• Government identifiers*, including Social Security, driver’s license, state identification card, or passport number. We have disclosed this category of personal information with our Service Providers.

We collect personal information for the following purposes described above in Section III.

KRC may also disclose personal information as is necessary to: (a) comply with a subpoena or court order; (b) cooperate with law enforcement or other government agency; (c) establish or exercise our legal rights; (d) protect the property or safety of our company and employees, contractors, vendors, and suppliers; (e) defend against legal claims; (f) help with internal and external investigations; or (g) as otherwise required by law or permitted by law. We may disclose your information in connection with the sale or merger of KRC or any transaction that involves the sale or assignment of some or all of our assets.

We do not collect, use, or disclose personal information for purposes other than those specified in this policy. In the past 12 months, we have not sold or shared personal information of California residents within the meaning of "sold" or "share" in the CCPA. We do not have actual knowledge that we sell or share for targeted advertising purposes Personal Information of individuals under 16 years of age.

Data Retention

We will retain personal information only for as long as necessary to fulfill the purposes for which we collected it. To determine the appropriate retention period, we consider the amount, nature and sensitivity of your personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements. We will also retain and use your personal information to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our policies. Additionally, we retain the personal information collected during the application process, and information about your application process, as part of your employee records (if applicable).

Rights Under the CCPA

As a California resident, you may have the rights listed below in relation to personal that we have collected about you. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law to:

• Request we disclose to them free of charge the following information covering the 12 months preceding their request:
  • the categories of personal information about them that we collected;
  • the categories of sources from which the personal information was collected;
  • the purpose for collecting personal information about them;
  • the categories of and specific pieces of personal information we have collected about you;
  • the categories of third parties to whom we disclosed personal information about them and the categories of personal information that was disclosed (if applicable) and the purpose for disclosing the personal information about them; and
  • the specific pieces of personal information we collected about them;
• Request we correct inaccurate personal information maintained about you;
• Request we delete personal information we collected from them, unless the CCPA recognizes an exception;
• Request we limit our use and/or disclosure of sensitive personal information to only what is necessary to perform the services or provide the goods reasonably expected by an average consumer; and
• Be free from unlawful discrimination for exercising their rights including providing a different level or quality of services or denying goods or services to them when they exercise their rights under the CCPA.

We aim to fulfill all verified requests within 45 days pursuant to the CCPA. If necessary, extensions for an additional 45 days will be accompanied by an explanation for the delay.

In addition, where applicable, we will provide the requestor with more information about our appeal process. When a person submits a request or launches an appeal, we will limit our collection of their information to only what is necessary to securely fulfil their request or process their appeal. We will not require them or their authorized agent to pay a fee for the verification of their request or appeal.

How California Residents Can Exercise Their Rights

A California resident for whom the CCPA applies may exercise their rights, if any, with respect to their personal information by contacting us at policies@kimcorealty.com or via our toll-free number at 1-800-764-7114. Alternatively, they may mail a request to: Attn: Legal Department, 500 North Broadway, Suite 201, Jericho, NY 11753. We may need to collect information from you to verify your identity, such as your email address, government issued ID or date of birth, before providing a substantive response to the request. You may designate, in writing or through a power of attorney document, an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require that the agent provide proof you have authorized them to act on your behalf, and we may need you to verify your identity directly with us.