Privacy Policy

Our Privacy Policy

Updated May 5, 2021

We’re glad you are here. The Cadillac Fairview Corporation Limited and its affiliates work hard every day to earn your trust. This Privacy Policy helps you understand our approach to privacy.



Here is a brief summary of some key facts. You will also find detailed information below.

This Privacy Policy governs our collection, use and disclosure of personal information during the course of our business activities. It covers our:

Some of our services, mobile apps and websites may also have separate privacy notices. These privacy notices will provide you with specific information applicable to those services, mobile apps and websites. 

Sometimes we provide links to other companies’ websites and services (like retail tenants in our shopping centres). Those companies have their own privacy and cookies policies. Information you give them will be governed by their rules and not ours.

We have a separate privacy policy for our employees.

What personal information we collect depends on how you interact with us. 

Expand the sections below to understand the personal information we collect and use based on the most common types of interactions with us. For an explanation of what information we collect automatically when you use our online services, see What types of online information do we collect automatically?

Keep in mind that we may also collect other information as we develop new products, services and techniques for delivering improved or personalized services to you


If you make a request for customer assistance or services, we collect information that is necessary to respond to your request. This may include contact information, details of your request and our response.

CF Account

When you create an account with us, including through our mobile applications, we may ask for your name, email address, password and information about your interests to create an account for you. 

If you sign into our websites, mobile apps or wifi using a social media account (such as Facebook, Instagram or Pinterest), we will collect profile information from those accounts and other information that you have consented to sharing with us in order to create your CF Account. 

We use account information to register and to authenticate you. We may also use information we collect and associate with your CF Account to tailor our products and services to your interests.

Subscriptions and contests

We may collect information when you subscribe to a newsletter, enter a contest, register for a service, or create an account with us. This information could include your contact information. 

If you subscribe for email communications, we will collect your email address. 

If you enter a contest or promotion, we will collect personal information from you to administer the contest or promotion. 


We collect information such as your name, address and payment information if you purchase a CF SHOP! card® or rent equipment from us. We will also collect contact information to deliver communications and packages to you.

We track transactions and your account balance using your CF SHOP! card. If you register your CF SHOP! card with us or associate the CF SHOP! card with your CF Account, this information will be associated with you. 

If you make a large purchase of CF SHOP! cards, we may collect additional information as part of our obligations and corporate best practices to combat money-laundering and other criminal activity.

Shopping lists and favourites

Depending on the mobile app or website you use, you may be able to create customized shopping lists, or plan your route through our properties. We will collect this information to store it with your CF Account. We use this information to provide you with the services you request and to learn about your preferences so that we can provide you with more relevant content in our mobile apps and on our websites.

Social media interactions

We may collect information if you interact with us on social media. We may view and share posts that mention us, our services or one of our properties. We only view and share this information if your privacy settings permit us to see your post. We use this information to understand trends and what visitors and tenants are saying about our properties and services.

Building security

Our properties are equipped with video surveillance cameras. These cameras may collect your image or vehicle (including licence plate) when you are at one of our properties. In limited cases, the field of cameras on our property may capture images of individuals who are near the perimeter of our properties. 

Access to some areas of our properties are restricted. To access these areas, you may need to provide your name and other information. If you are visiting one of our employees in a restricted space, you may need to provide the name of the employee you are visiting, your name, your employer (if relevant) and your contact information. 

If you are one of our contractors or if you are an employee or contractor of one of our tenants, we may issue you a physical or digital passcard to access our building and the tenant’s premises. We will collect information about you and the business authorizing us to issue you a passcard. Our passcard readers collect logs of the dates and times of your use of your passcard.

We retain security guards to monitor and protect our buildings. If there is an incident, these security guards may collect information about the individuals involved in the incident, information from witnesses, and other information that they observe or are told.

We also retain third party services that scan social media and other sources of information for threats to our properties and personnel.

We use information we collect as part of building security programs to help secure and protect our property, to create a safe environment for our tenants, building occupants and visitors, to respond to emergencies, to investigate violations of our policies or laws, and to investigate claims (such as property damage or personal injury).


We may collect your vehicle make, model and licence plate number for the purposes of enforcing our parking regulations. If you have a reserved parking spot in one of our buildings, we collect registration information such as your name, contact information, employer, vehicle make and model and licence plate number for the purposes of providing and managing our parking services.

Employment applications

We will collect personal information that you provide to us in connection with your employment application. This personal information may include previous work experience, education, and other relevant information. We use this information to assess your suitability for employment with us.

We automatically collect technical information and information about how you use our websites, website applications and mobile apps. Expand the headings below to learn more.

Our promises

  • Wherever technically feasible, we will give you the option of browsing or using our online services as a guest without logging in and identifying yourself but not all features may be available to you as a guest

  • If you are not logged into our services, we will not attempt to discover who you are by using online technical information

  • Wherever technically feasible, we will provide you with options to opt-out of personalized ads. See Online Advertising for details.

Online technical information

When you use our websites, website applications and mobile apps, our servers automatically collect information from your device or session. We collect this information as part of the normal process of delivering online content to your device. In some cases, we may also scan this information to detect cybersecurity threats.

Online technical information that we collect includes but is not limited to IP address, browser type and version, advertising IDs, app unique ID (if you are using one of our mobile apps) and operating system and device type in order to properly format information for your device.

You may see a pop-up asking to share your location. We ask for this permission to provide you with location-based services, such as showing you content from the nearest shopping centre. Even if you do not enable location-based services, we may still receive general city or country location information based on your IP address and from other information provided from third-party telecommunications services. 

For more information and the promises we make about location information, see location-based services

Usage information

Understanding how people use our websites, website applications and mobile apps helps us do a better job of meeting your needs and improving our business. 

For example, if a feature does not seem useful to our visitors, we learn that we need to improve it. If we detect that the search results for a particular search term are not helpful, we can try to make the results more relevant. 

Usage information also helps us understand what ads and promotional communications were effective. We also use usage information to tailor your experience and the ads that you see so that the information we provide to you is more relevant to your interests.

The usage information we collect includes how long you visited our websites, website applications and mobile apps, what pages you visited, what features you used, what search queries you entered, and your other activities using our services. 

To understand more about how we collect some of this usage information, see cookies and  pixel technologies.

Cookies are small text files that are stored on your device. Pixels are small image files that appear on our web pages or in advertisements. Cookies and pixels help us recognize you and also help us with Online Analytics. Expand the headings below to learn more.

Why do we use cookies and pixels?

We use these technologies for a variety of business purposes. Some examples include:

  • to remember your device the next time you visit one of our websites or web applications

  • to keep you signed into a web application or mobile app

  • to track how you are using our websites, website applications and mobile apps

  • to deliver online advertising

  • to find out if our emails have been read

  • to find out if links were clicked in our promotional email content and advertisements 

  • to store your location if you have given us permission to collect it

Third-party cookies and pixels

Some cookies and pixels are provided by third parties who share information with us. For example, we use Adobe Analytics to provide us with reports on where our website visitors are coming from and what web pages and mobile app features are useful. Another example is pixels provided by Facebook. If we advertise on Facebook, the advertisement and our website may contain pixels so that we understand that a visitor to our website saw the Facebook advertisement. This helps us know that the advertisement was useful and relevant.

Opting out

Some cookies are necessary, and some are optional. Necessary cookies are used to ensure that our digital services are working correctly and to track certain page analytics. Optional cookies include cookies that are used for advertising and to recognize you when you are using different devices.

See Online Advertising and Cross Device Tracking for how to opt out. You can also block or restrict cookies using your browser settings.

Data analytics means studying data to look for patterns. We use data analytics to gather insights about the effectiveness of our business strategies and to make decisions. We also use data analytics to predict what visitors to our websites, website applications and mobile apps will find interesting. Learn more by expanding the headings below.

Online analytics

Online analytics is the study of how our online services are used. 

Information collected by analytics services on our websites, website applications and mobile apps include date of session, session duration, pages and features viewed, operating system, device model, and geography. Although your IP address is collected, we anonymize your IP address when we use it for analytics purposes.

If you are using a browser to access online content, our analytics providers also collect the site you came from before landing on our website (such as the search engine you used to find us or the page you last visited when you came to our site). Third-party analytics services also collect the following information when you use our mobile apps: device model, first launch of the app, number of app opens and app updates. We use a randomly generated ID to identify your device. You can reset this ID by uninstalling and reinstalling the app. You can also adjust your browser settings to block or disable analytics cookies. Our mobile apps do not collect and store your MAC address.

If you are using one of our mobile apps, we may offer you settings within our app to control the collection of data for analytics. Please see the privacy notice for the mobile app that you are using.

Location analytics

Location analytics involves collecting location data to understand where the users of our services are located. 

We can derive location information from your IP address using third party services. When we do this, we anonymize your IP address after it is used to identify a geographic location (usually city and province level). For some of our websites and web applications, you may see a pop-up asking for permission to share your location. 

If you accept, we will receive an inferred location for the device you are using. You can decline to share location. If you do, we will not be able to customize the site content to match the inferred location of your device.

For our mobile apps, we may also collect location information through location-based services. See location-based services for information on how you can control your location-based services settings in our mobile apps.

Foot traffic analytics

Foot traffic analytics uses de-identified information to understand when a device is in different zones in our properties. We use this information to measure traffic patterns. This helps us understand how our premises are used, what routes are common, and how many repeat visitors we get. Expand the headings below for more information.

How does it work?

Our service provider, Aislelabs, automatically transforms the MAC address of mobile devices into a special code. We cannot use that code to re-identify your MAC address even if you use our wifi services. 

What’s a MAC address? 

A media access control (MAC) address is broadcast by wifi-enabled devices when wifi is on. 

Can I opt-out?

You can opt out of location-based analytics provided by Aislelabs by visiting

This section explains some of your rights and how you can exercise them. To learn more about a right, expand the headings below.

Access and correction

You can ask to see the personal information that we have collected about you. You can also ask us to correct your personal information. 

If you are using one of our mobile apps, you may be able to access your personal information by viewing your account settings. 

If you want to access or correct other information, you’ll need to contact us. You must explain the details of what you want to access or correct, so that we can help find that personal information for you. 

Sometimes we won’t grant access to or correct your personal information. If that happens, we will tell you why and what you can do about it if you are not satisfied.

Withdrawing consent and deletion

You can contact us to withdraw consent to using your personal information or to ask us to delete your personal information if we no longer need it. If you are using one of our mobile apps, see the mobile app privacy notice for how to withdraw consent and to delete your account or mobile app data.

Sometimes we will still need to retain your personal information after you have asked us to stop using it and to delete it. If that is the case, we will tell you. For example, the law may require us to keep your personal information or we may need the information for our accounting records. We also may keep information if we believe there is a risk of a legal dispute or the information related to an investigation. These are just some of the reasons.

If your information is in electronic form, it may be stored in our backup data. If that’s the case, then we will retain it until we replace or purge our backups. 

Opting-out of email marketing

If you signed up for one of our email newsletters and no longer want to receive them, you can unsubscribe at any time. For the quickest results, please use the unsubscribe link in the latest email we sent to you. Alternatively, you can contact us and we will process your request.

Online advertising

We want to show you ads that are relevant to you. However, we recognize that some people don’t like to see personalized ads. Below are some tips and tools to help you control advertising that uses your online activity and personal information.

Website advertising opt-out options

To opt-out of personalized advertising content, please visit Digital Advertising Alliance of Canada Opt-Out PageNAI Opt-Out Page and the Ad Choices Opt-Out Page

These websites provide tools that identify member companies that have placed cookies on your browser and provide mechanisms to opt-out. 

Please keep in mind that you will still receive other types of advertising.

Deleting browser cookies can remove your opt-out preferences, so you should use these tools periodically to ensure that your preferences are up-to-date. 

Mobile device advertising options

You can also opt-out of the use of your mobile device’s advertising ID by adjusting your mobile device advertising preferences. For Android devices, open your Settings App > Google > Ads. For iOS devices, go to Settings > Privacy > Advertising.

Social media advertising options

Social media platforms (such as Facebook and Instagram) allow us to show you advertisements based on the fact that you match characteristics of our target audience or to exclude you from advertisements because we don’t think they are relevant to you. This is called custom audiences. 

These custom audience tools also include the ability to include or exclude you from the custom audience based on whether your profile information for those platforms matches information that we have collected. This happens by converting information (such as your email address or phone number) into a unique code. We do not share your actual email address or phone number with these social media companies. 

You can use the ad settings in your social media account settings to control the ads you see and the use of your personal information for advertising, including custom audiences. You can also contact us to opt out of the use of your personal information for custom audiences. 

Cross device tracking 

We use the services of the Adobe Marketing Cloud Device Co-op to understand when visitors are using different devices to browse our websites. We do not share or receive information that identifies you when we use the Adobe Marketing Cloud Device Co-op.

We use this service to understand how many unique visits to our websites and web applications we are receiving. This service also allows us to provide you with personalized content across all of the devices that you use.

We understand that not everyone wants a personalized experience across their devices. You can see what devices are linked and opt out using the Adobe Device Co-Op Privacy Control

Location-based services

Location-based services are features and functions of our websites, web applications and mobile apps that use your location in order to deliver relevant content. We also use location information for Data Analytics. Expand the headings to learn more about our promises to you, why we use location information, and how you can control location sharing.

Our promises

  • We will only collect foot traffic information in our shopping centres in a way that does not identify you

  • We do not track your movements outside of our shopping centres

  • If you use dynamic wayfinding services that could identify you, we will tell you in our mobile app privacy notice

Why do we use location information?

Sometimes we collect your location to provide you with services and to learn about how our shopping centres and other properties are used. For example:

  • If you enable location-based services on our websites, web applications or mobile apps, we can use that information to help you find the nearest shopping centre or show you offers, stores, products and shopping centre information that are relevant to the shopping centre you are at or that is near you.

  • If you log into our wifi services, we will recognize what shopping centre or office building you are at when you are logged in.

We also use location information for Data Analytics

Opting out

If you are using one of our mobile apps and have enabled location-based services, you can always opt-out using the permissions settings within the mobile app. 

You can also opt-out of location-based services by changing your device’s permissions. For Android devices, open your Settings App and choose Location > App permission or Security & location > Location. For iOS devices, choose Settings > Privacy > Location Services.  For more information or help, please refer to your device’s operating system user guide.

To learn about opting-out of using location for Data Analytics, please see Location Analytics and Foot Traffic Analytics.

Sometimes we share personal information with others. We share personal information between our related companies. We share information with our tenants about who is using passcards to enter their premises and in connection with an incident that affects them. We share information relating to personal injuries and damage to property with tenants and contractors and their insurers when we believe they are required to indemnify us or compensate us. We also share personal information about incidents in order to investigate the incident, file an insurance claim, report to or assist police in an investigation, and respond to or prevent a danger to health, life or property. 

Expand the headings below to understand our promises about sharing and who share personal information with. 

Our promises

  • We do not sell or rent your personal information to other companies

  • We will only provide information that identifies you to other companies for marketing purposes with your consent

  • If we provide aggregated or statistical information to other companies, such as retailers in our properties, we do so in a way that does not identify you

Related companies

Some of our services, websites, web applications and mobile apps are provided by The Cadillac Fairview Corporation Limited and others are provided by Ravel by CF Inc. These are related companies. We share information between these companies to develop a single view of individuals who use our services and to streamline customer service responses. 

Service providers

We use third parties to assist us with our business. These third parties may handle your personal information when performing services for us. Some types of service providers that we use include:

  • technology service providers who develop, host and manage our website, mobile apps and web applications and other information technology we use in our business

  • service providers who help run our CF SHOP! card® program

  • third party security guards

Usually, service providers are not permitted to use your personal information for their own purposes separate from providing and improving the services they are providing to us. There are exceptions. One exception is that we allow some service providers to create aggregated or statistical data or to use non-identifying data for their own use. Another exception are third parties who manage a service for us. For example

If we disclose identifiable information to a service provider for the service provider’s own use, we will usually notify you so that you understand that your information will be used in accordance with the service provider’s privacy notice. There are exceptions. For example, we rely on your implied consent to pass your payment card and transaction information to a payment network in order to process a credit or debit card payment. We will also rely on implied consent to pass your name and address to a courier company or Canada Post in order to ship something to you.


Sometimes we share personal information with tenants. Examples include:

  • if we have issued you a passcard that is used to access our tenant’s premises, we will share information about your use of the passcard with the tenant

  • if there is an accident or other incident that involves our tenant, we may share video surveillance footage, incident reports and other information with our tenant so that our tenant can investigate the accident or incident, seek legal advice and/or file an insurance claim

  • if you make a complaint about a tenant, we may share information with the tenant to investigate the complaint or to ask the tenant to address your concerns

See building security for more information about how we use personal information for building security and investigating incidents.

We may also enter into co-marketing initiatives with our tenants or provide services to our tenants to help them in their business. When we engage in these activities, we may share relevant personal information with them.


We share information with our insurers when there is an incident at one of our properties and the information is reasonably required to make an insurance claim or report. This may include video surveillance, incident reports and other relevant data that may include your personal information. 


Sometimes we need to share personal information with the police. If there has been a criminal incident at one of our properties, we may share personal information with the police that is related to that incident. We may also share relevant personal information as part of filing a police report or in response to a police request.

Business transactions

We may share personal information if we sell all or part of our business or if it is relevant to a business transaction.

Other third parties

We will also share personal information with third parties if we are required to do so by a law, a court order or a similar requirement. 

We may also share personal information in an emergency affecting or threatening to affect someone’s health or life or if there is a threat to ours or someone else’s property.

Although we take care to secure your information, no system of safeguards can provide you with a guarantee of security.

The security of your information is also a shared responsibility. Expand the headings below to learn what we are doing to keep your personal information safe and what you can do to help.

How do we protect your personal information?

We employ administrative, technical and physical safeguards to protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification. 

The types of safeguards that we employ and that our service providers employ depend on the sensitivity of the information. Examples of how we protect your personal information include:

  • employee privacy and security training

  • restricting access to personal information to employees who need access to it

  • technical measures such as encrypted connections, strong passwords, multifactor authentication (where feasible), firewalls and other technical security tools

  • physical measures such as locked storage areas and restricted access to our offices and other areas where personal information is stored

  • background checks of employees in line with the sensitivity of the information those employees will be handling and provincial laws governing when we can do background checks

  • requiring service providers who will handle your personal information on our behalf to commit to safeguard your personal information when they enter into contracts with us

What do you need to do?

You have a shared responsibility to keep your personal information secure when you use our websites, mobile apps and web applications. Please take the following steps to help secure your personal information:

  • install the latest security updates and anti-virus software on your device to help prevent malware and viruses

  • use the latest version of browsers

  • change your account password frequently

  • use complex passwords to lock your device and mobile applications. Complex passwords include capital letters, numbers and special symbols

  • do not use the same password for multiple sites

  • do not share your password with others

We do not ask you for sensitive personal information over email. Sensitive personal information includes passwords, bank account or payment card information, your social insurance number, or similar information by email. We might ask for proof of identify if you want to make a request to access or delete your personal information, but we will give you the option of coming to one of our properties to present your ID.

Our preference is to store and use your personal information in Canada. However, this is not always feasible. Our service providers may be located outside of Canada or they may store and process data outside of Canada. If that is the case, then your personal information may be transferred to other countries. 

Although we employ contractual protections when we transfer personal information to other countries and we consider the protections offered under the laws of the other country, we cannot guarantee that your personal information will receive equivalent protection when transferred. In certain circumstances, your personal information may be accessible under the laws of those other countries by foreign law enforcement, regulatory bodies or other authorities.

No, we do not use facial recognition technologies. Facial recognition technologies match an image to a database in order to identify an individual. We do not use these technologies.

We may offer mobile apps and special web applications to provide you with special services. Examples include:

  • LiVE by CF – a mobile app that helps you find exactly what you want and where to buy it all before you arrive at a CF shopping centre. Search for stores, find the products and offers you want and save your favourites for later.

  • CF Eats - order delivery or pickup from your favourite Cadillac Fairview restaurants.

  • Event registration sites, such as to reserve a visit with Santa or another special event.

These mobile apps and web applications may have their own privacy notices or additional disclosures that supplement this Privacy Policy and explain how personal information is collected, used and disclosed through those mobile apps and web applications. You will be able to find the relevant privacy notice on the web application or inside the mobile app or in our Google Play or Apple App Store listing. 

We are innovating with new apps and special web applications all the time. Not all of these apps and web applications will be listed in this Privacy Policy.

We have appointed a Chief Privacy Officer to oversee compliance with this Privacy Policy. 

You can contact our privacy office in writing to ask a question or make a complaint. You may also contact our privacy office to request access or correction to your personal information or to request deletion of data that you believe we no longer need to retain. We may need to see identification to check that you are who you say you are.

Privacy Office The Cadillac Fairview Corporation Limited & Affiliates 20 Queen Street West Suite 500 Toronto, ON M5H 3R4