Tishman Speyer Properties L.P. (“TSP”) and Rockefeller Group, Inc. (“RGI”) and their affiliates, subsidiaries, and related companies (collectively, "the Company", “we” or “us” or “our”) are committed to protecting the privacy of your personal information. We created this Privacy Policy (“Policy”) to inform you how personal information is collected, stored, used and protected, and your rights related to your personal information, when you access this website, rockefellercenter.com (the “Site”), or visit or otherwise interact with Rockefeller Center, including in connection with your application for or employment with us, or your business interactions with us. Please read this Policy carefully before using the Sites or submitting personal information to us. This Policy is incorporated into and subject to theTerms & Conditions.

In connection with your use of the Site and/or your visit to or other interactions with Rockefeller Center, including in connection with your application for or employment with us, or your business interactions with us, we generally collect the following categories of personal information. We use this information to operate our Site, carry out our business, comply with applicable laws, and for other purposes described herein. (Please see the “Why We Collect Your Information” section below for additional information.) Identifiers and Contact Information. This category includes names, addresses, telephone numbers, mobile numbers, email addresses, signatures, account names, dates of birth, bank account information, and other similar contact information and identifiers. Protected Classification Information. This category includes characteristics of protected classifications under California or federal law. Commercial Information. This category includes, without limitation, products and services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. Education Information. This category includes, without limitation, information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. section 1232g, Sec. 1232g; 34 C.F.R. Part 99). Internet or Other Electronic Network Activity Information. This category includes, without limitation, browsing history, search history, or an individual’s interactions with a website, application, or advertisement. Geolocation Data. This category includes, without limitation, location information collected when using one of our apps, devices, or vehicles. Audio, Electronic, Visual, Thermal, Olfactory, or Similar Information. This category includes, without limitation, information collected from voicemail messages, while speaking with one of our representatives, and/or by video camera. Biometric Information. This category may include the use of biometric equipment, devices, or software to record your time worked, to enter or exit facilities or rooms, to access or use equipment, or for other business purposes. Professional and Employment-Related Information. This category includes, without limitation, information regarding job applications, information related to onboarding for payroll and benefits, and information needed for evaluating performance. Sensitive Personal Information. This category includes:

Consumer Profile. This category includes information drawn from any of the categories above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, and behaviors.

We use cookies, pixels, and other web technologies to collect and store certain types of information when you visit the Site. A cookie is a small file consisting of letters and numbers that automatically collects certain information from you. This file uniquely identifies and recognizes your browser or device and transmits information back to the server. Depending on the cookie type, it may perform functions such as remembering your user preferences, improving the quality of your visit, recording the website pages you view, remembering the name or address you entered during a visit, or delivering ads that are targeted to your interests and browsing activity.

Our Sites use essential, functional, and performance cookies to function and perform as designed; analytics cookies to understand how you use our Sites, improve our Sites’ functionality and other related purposes; and advertising cookies to help us with our advertising and marketing activities including showing you relevant ads when you visit our Sites or other websites. We and our third-party partners and service providers may collect and track information about your online activities over time and across different websites, applications, and devices. Embedded Content and Social Media Widgets. Our Sites contain embedded content (e.g., videos) and Social Media Widgets (e.g., Facebook, Twitter, Instagram). Embedded content may place third party cookies on your device that track your online activity to enhance your experience or assess the success of their application. Social Media Widgets allow us to integrate social media functions into our Sites. These widgets may place third party cookies on your device for tracking and advertising purposes. We have no direct control over the information these cookies collect, and encourage you to refer to the website privacy policies of the third parties operating the cookies for additional information. Controlling cookies. You may control cookies, including preventing or stopping the installation and storage of cookies, through your browser settings and other tools. Most browsers will allow you to block or refuse cookies. However, you may need to manually adjust your preferences each time you visit a site. For more information, see the Help section of your browser. Please note that if you block certain cookies, some of the services and functionalities of our Sites may not work. IMPORTANT: BY USING THE SITE, YOU CONSENT TO THE PROCESSING OF ANY PERSONAL INFORMATION FOR THE PURPOSES AND FUNCTIONS DESCRIBED ABOVE. Do Not Track. “Do Not Track” is a privacy preference that you can set in your Internet search browser that sends a signal to a website that you do not want the website operator to track certain browsing information about you. However, because our Site is not configured to detect Do Not Track signals from a user’s computer, we are unable to respond to Do Not Track requests. Cookies set when you visit our Sites may track you over time and across third party websites.

In general, we will use the personal information we collect only for the purpose it was collected, for compatible purposes, as permitted or required by law, as necessary to carry out our contractual duties and obligations, and as otherwise provided in this Policy. For example, we may use your personal information in the following ways:

In general, we will not disclose your personal information except with your consent or as otherwise described in this Policy. We may disclose your personal information for the same reasons that we may use it, as described in this Policy, which includes disclosing it to our affiliates and non-affiliated third parties as we deem necessary to carry out those purposes. We endeavor to choose affiliates and non-affiliates with similar standards to ours regarding the protection of data. The following chart describes the categories of personal information we have collected or may collect about you and, for each category, identifies the categories of third parties to whom we may disclose that information.

We may provide links to websites or resources outside of our Sites for your informational purposes only. We may also provide links to third party integrations. Third party integrations are websites or platforms that synchronize with our Sites to provide you with additional functionality, tools, or services such as maps, sending you requested information, etc. You acknowledge and agree we are not responsible for the availability of third party sites, resources, or integrations and do not endorse and are not responsible or liable for any content, advertising, goods, services or other materials on, available through, or provided by such sites, resources, or integrations. We are not responsible for the privacy or other practices of such sites and cannot guarantee the security of personal information that you provide, or that is collected by, such sites. We encourage you to review the privacy policies and terms and conditions on those linked sites.

We take precautions to protect data and information under our control from misuse, loss or alteration. Our security measures include industry-standard physical, technical and administrative measures to prevent unauthorized access to or disclosure of your information, to maintain data accuracy, to ensure the appropriate use of information, and otherwise safeguard your personal information. However, no system for safeguarding personal or other information is 100% secure and although we have taken steps to protect your personal information from being intercepted, accessed, used or disclosed by unauthorized persons, we cannot fully eliminate security risks associated with personal information. Please recognize that protecting your personal information is also your responsibility. We ask you to be responsible for safeguarding the password, security questions and answers and other authentication information you use to access our Sites.

We make reasonable efforts to ensure that your personal information is kept accurate and up to date. However, it is up to you to update it with any changes. You may contact us via the information in the “Contact Us” section below to update personal information that you have provided to us. We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect. In responding to your request, we may seek information to verify your identity.

We will retain your personal information only for as long as is necessary for the purposes set out in this Policy. We will retain and use your personal information to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, enforce our legal agreements and policies, and other legitimate business needs. We will delete, deidentify, or aggregate your personal information when it is no longer reasonably required for the purposes described herein (or compatible purposes), or, where applicable, when you withdraw your consent or request erasure, to the extent that we are not legally required or otherwise permitted to continue to hold such data. To determine the appropriate retention period for your personal information, we consider various factors, such as the amount, nature, and sensitivity of your information; the potential risk of unauthorized access, use or disclosure; the purposes for which we collect or process your personal information; and applicable legal requirements.

Our Sites are not intended to attract children under 16. Accordingly, we do not knowingly solicit or collect personal information from anyone we know to be under 16 years of age. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact us. If we become aware that we have collected personal information from children without verification of parental consent, we will take steps to remove such information from our servers. No information should be submitted to us by users under the age of 16.

This Policy is governed by the internal substantive laws of New York without regard to its conflict of laws principles. Jurisdiction for any claims arising under or out of this Privacy Policy shall lie exclusively with the state and federal courts within New York. If any provision of this Policy is found to be invalid by a court having competent jurisdiction, the invalidity of such provision shall not affect the validity of the remaining provisions of this Policy, which shall remain in full force and effect.

When you access or use our Sites, we may transfer your personal information to other countries where we conduct business. Such countries may be located outside of the country or jurisdiction where you are located and may have data protection laws that are less protective than the laws of the jurisdiction in which you reside. If you do not want your information transferred to or processed or maintained outside of the country or jurisdiction where you are located, please do not use our Sites or provide us your personal information.

This California Privacy Rights section applies only to California residents. This section supplements and amends the information contained in the Policy with respect to California residents. The other provisions of the Policy continue to apply except as modified in this California section. California Consumer Privacy Act (CCPA). These CCPA provisions (“CCPA Section”) describe our policies and practices regarding the collection, use, and disclosure of personal information we collect about you including information we obtain when you access or use our Sites or through other channels (e.g., visiting one of our properties, phone and email conversations, social media interactions or through our authorized services providers) in accordance with the CCPA. Any terms defined within the CCPA have the same meaning when utilized within this CCPA Section. The other provisions of the Policy continue to apply except as modified in this CCPA Section. Please read this CCPA Section carefully before using our Sites or submitting information to us. By accessing or visiting our Sites, or otherwise submitting personal information to us, you indicate your understanding that the collection, use, and disclosure of your information is subject to the terms of this CCPA Section and our Terms of Use. Except as otherwise noted, any capitalized terms not defined in the CCPA Section have the meaning set forth in the Policy and Terms of Use. IF YOU DO NOT CONSENT TO THE COLLECTION, USE, AND DISCLOSURE OF YOUR INFORMATION AS DESCRIBED IN THIS CCPA SECTION, PLEASE DO NOT PROVIDE US WITH SUCH INFORMATION. Personal Information Categories We Collect. Please refer to the “Information We Collect About You” section above. PI does not include:

Purposes for Which We Collect Your Personal Information. We collect your personal information for the business and commercial purposes described in the “Why We Collect Your Information” section above. Sources of Personal Information. We collect your personal information through the sources described in the “Sources of Information We Collect About You” section above. Disclosing Personal Information. We may disclose your personal information to the parties and for the purposes set forth in the “Disclosure of Your Information” section above. CCPA Privacy Rights. If you are a California resident, you have rights in relation to your personal information; however, your rights are subject to certain exceptions. For instance, in response to a request to know, we cannot disclose to you certain specific pieces of personal information, such as your social security number, financial account number, or biometric information; we may deny a request to correct contested personal information if we determine it is, more likely than not, accurate; and we may deny a request to delete personal information that we use internally in a lawful manner that is compatible with the context in which you provided it. • Right Against Discrimination. You have the right not to be discriminated against for exercising any of the rights described in this CCPA Section. For example, we generally will not provide you a different level or quality of goods or services if you exercise your rights under the CCPA. • Right to Know. You have the right to request the Company disclose to you the information below upon receipt of your verifiable consumer request (see below):

Our response will cover all personal information we collected and maintain about you during the 12-month period preceding our receipt of your verifiable request. You may request that we provide personal information we collected beyond this 12-month period, so long as (a) it was collected on or after January 1, 2022, and (b) doing so would not be impossible or involve disproportionate effort. In the event we deny your request, in whole or in part, we will explain the bases for that denial. • Right to Delete. You have the right to request that the Company delete your PI from its records, subject to certain exceptions. Upon receipt of a verifiable consumer request (see below), and as required by the CCPA, we will delete and direct applicable service providers and contractors to delete your PI from our or their records. The Company is not required to comply with your request to delete your PI if it is necessary for the Company (or its service provider or contractor) to maintain your PI in order to:

You have the right to opt-out of having your personal information sold or shared. To provide you more relevant content and ads, we may disclose your personal information to third parties like Google and Meta in contexts which may be considered “selling” or “sharing” of personal information under the CCPA. We do not sell personal information under the more commonly understood meaning of that word – i.e., providing personal information to third parties in exchange for money. Nor do we have actual knowledge of selling or sharing personal information of minors under the age of 16. To opt-out of the selling and/or sharing of your personal information, please click this link:(https://www.rockefellercenter.com/contact/)
Note: We also treat Global Privacy Control browser signals as opt-out of sale/sharing requests and process these requests in a “frictionless manner” (as defined under the CCPA). To opt-out via the Global Privacy Control, please follow the instructions available here. The Digital Advertising Alliance also enables global opt-outs; instructions are available here. Right to Limit Use or Disclosure of Sensitive Personal Information. You have the right, subject to certain exceptions, to request that we limit the use and disclosure of your sensitive personal information, as that term is defined in the CCPA. However, we do not collect or process sensitive personal information for the purpose of inferring characteristics about the subjects of that information and, accordingly, the sensitive personal information we collect is not subject to requests to limit. Right to Correct. You have the right, subject to certain limitations, to request that we correct any inaccurate personal information we maintain about you. Upon receipt of a verifiable consumer request, and as required by the CCPA, we will take appropriate steps to respond to your request. To submit a CCPA request to know, correct, or delete, please contact us at (webmaster@tishmanspeyer.com) or by toll-free phone at 833-430-2169. Verification. We reserve the right to only respond to verifiable consumer requests. A verifiable consumer request is one made by: a) the consumer who is the subject of the request, b) a consumer on behalf of the consumer’s minor child, or c) a natural person or business entity authorized to act on behalf of a consumer. To verify your identity, we may ask you to verify personal information we already have on file for you. If we cannot verify your identity from the information we have on file, we may request additional information from you, which we will only use to verify your identity, and for security or fraud-prevention purposes. Making a verifiable consumer request does not require you to create an account with us. Additionally, you will need to describe your request with sufficient detail to allow us to review, understand, assess, and respond. Authorized Agents. You may authorize a natural person or business entity to act on your behalf with respect to your rights under this CCPA Section. Unless you have provided the authorized agent with a qualifying power of attorney, you must provide your authorized agent written permission (signed by you) to act on your behalf and verify the authorized agent’s identity with us. We reserve the right to deny requests from persons or businesses claiming to be authorized agents that do not submit sufficient proof of their authorization. We may not be able to respond to your request or provide you with PI if we cannot verify your identity or authority to make the request and confirm the PI relates to you. Our Response. We reserve the right to charge a fee to process or respond to your request if it is excessive, repetitive, or manifestly unfounded. If we determine that a request warrants a fee, we will attempt to notify you as to why we made that decision and provide a cost estimate before completing your request. We will endeavor to respond to a verifiable consumer request within forty-five (45) calendar days of receipt, but we may require an extension of up to forty-five (45) additional calendar days to respond, in which case we will notify you of the need for the extension. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. Shine the Light. California Civil Code Section 1798.83 permits you to request information regarding the disclosure of your personal information by us to third parties for the third parties’ direct marketing purposes. Such requests must be submitted to us in accordance with the instructions in the Contact Us section of this Policy. Please mention when contacting us that you are making a “California Shine the Light” inquiry. Within 30 days of receiving such a request, we will provide a list of the categories of personal information disclosed to third parties for third-party direct marketing purposes during the immediately preceding calendar year, along with the names and addresses of these third parties. This request may be made no more than once per calendar year. We reserve our right not to respond to requests submitted other than in accordance with the instructions specified in this paragraph. Eraser Law. If you are a California resident under the age of 18, and a registered user of any site where this policy is posted, California law permits you to request and obtain removal of content or information you have publicly posted. You may submit your request using the contact information at the end of this Policy. Please be aware that such request does not ensure complete or comprehensive removal of the content or information you have posted and that there may be circumstances in which the law does not require or allow removal even if requested.