Privacy Policy
Effective Date: March 27, 2026 | Last Updated: March 27, 2026
Matan Companies ("Matan," "we," "us," or "our") is committed to protecting the privacy of individuals who visit our website at www.mataninc.com (the "Site"), submit information through our contact forms, or otherwise engage with our services. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data in compliance with applicable privacy laws, including the Maryland Online Data Privacy Act ("MODPA"), the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), the European Union General Data Protection Regulation ("GDPR"), and the CAN-SPAM Act.
Matan Companies is a Maryland corporation located at 4600 Wedgewood Blvd., Suite A, Frederick, MD 21703.
1. Information We Collect
Information You Provide Directly
| Category | Data Elements | Source |
|---|---|---|
| Contact Information | Name, email address, phone number, company name, message content | Contact form submissions |
| Tenant Account Information | Username, email address, password, company and lease details | Tenant portal registration |
| Rent & Payment Information | Name, billing address, payment method details (processed securely through our third-party payment processor; we do not store full credit card numbers) | Credit card payment portal |
| Business Inquiries | Company name, contact details, space requirements, and other leasing or investment inquiry details | Leasing and investor inquiry forms |
Information Collected Automatically
| Category | Data Elements | Technology |
|---|---|---|
| Device & Browser Data | IP address, browser type and version, operating system, device type, screen resolution | Server logs; analytics cookies, subject to your choices |
| Usage Data | Pages visited, time on page, click paths, referring URL, entry/exit pages | Analytics cookies, subject to your choices |
| Location Data | Approximate geographic location (city/region level, derived from IP address) | Analytics cookies, subject to your choices |
| Cookie Identifiers | Session IDs, analytics identifiers, preference cookies | Cookies, local storage |
Information from Third-Party Sources
We do not currently collect personal data from third-party data enrichment providers. We may receive limited information from our payment processor (such as transaction confirmation data) or from our tenant portal authentication system when you log in using your credentials.
2. How We Use Your Information
We use the personal data we collect for the following purposes:
- Responding to inquiries: To reply to your contact form submissions, leasing inquiries, and business inquiries.
- Providing services: To deliver commercial real estate leasing, property management, asset management, development, and investment services.
- Tenant portal management: To create and manage your tenant account, process rent payments, and provide access to tenant resources.
- Processing payments: To process credit card rent payments and manage billing through our payment processor.
- Website improvement: To analyze site usage, identify trends, and improve user experience through analytics data, where you have allowed analytics cookies.
- Legal compliance: To comply with applicable laws, regulations, and legal processes.
- Security: To detect, prevent, and respond to fraud, unauthorized access, or other security incidents.
3. Cookies and Tracking Technologies
Our Site uses cookies and similar tracking technologies. A cookie is a small data file stored on your device when you visit a website. We use the following categories of cookies:
| Cookie Type | Purpose | Duration |
|---|---|---|
| Strictly Necessary | Essential for the Site to function, including session management, security, load balancing, and bot protection. These cookies cannot be disabled. A tag manager is used to manage tracking scripts across the Site; it loads without storing any personal data — your privacy choices determine what, if anything, is tracked. | Session / up to 1 year |
| Analytics & Performance | Help us understand how visitors interact with the Site, including page views, session duration, traffic sources, and user behavior. Data is collected pseudonymously. | Up to 2 years |
| Functional | Enable enhanced features such as interactive maps, embedded video content, and social sharing buttons. These services may set their own cookies when activated. | Up to 1 year |
We do not use advertising or retargeting cookies on this Site.
Cookie consent is managed through our consent management platform. You can review and change your choices at any time using the cookie preferences control on our Site. The banner lists every service we use by name, grouped under the categories above, and is the authoritative record of what is active on this Site. Your choices are remembered for 365 days, after which we will ask again.
Some pages on our Site may contain embedded content from third-party services not listed above, such as virtual property tours, construction progress cameras, or other media provided by external platforms. These services may set their own cookies independently. We recommend reviewing the privacy policies of those services for details on their data practices.
We honor the Global Privacy Control (GPC) signal and other universal opt-out preference signals. When we detect such a signal from your browser, we will treat it as a valid opt-out request for the sale of personal data and targeted advertising, as required under MODPA, CCPA/CPRA, and other applicable laws.
4. Legal Bases for Processing (GDPR)
If you are located in the European Economic Area (EEA) or the United Kingdom, we process your personal data under the following legal bases:
- Consent: For newsletter subscriptions, marketing emails, and non-essential cookies. You may withdraw consent at any time.
- Legitimate Interests: For responding to business inquiries, improving our website, and ensuring site security, where these interests are not overridden by your data protection rights.
- Contractual Necessity: To fulfill our obligations when you engage us for services.
- Legal Obligation: To comply with applicable EU or member state law.
5. Data Sharing and Third Parties
We do not sell your personal data. We do not share your personal data with third parties for their own independent marketing purposes, and we do not use it for targeted advertising.
We share personal data only with the following categories of service providers who process data on our behalf under written agreements:
| Service Provider Category | Purpose | Data Shared |
|---|---|---|
| Web Analytics & Tag Management | Website traffic analysis, performance reporting, and consent-based management of analytics tags | IP address (anonymized where required), usage data, device and browser information, consent preferences |
| Mapping Services | Interactive property and contact page maps | IP address, browser data, map interaction data (consent-gated) |
| Embedded Media & Social Sharing | Embedded video playback and social sharing features | IP address, browser information, interaction data (consent-gated) |
| Payment Processing | Secure credit card rent payment processing | Billing name, address, and payment method (handled directly by the processor; we do not store card numbers) |
| Tenant Portal & Property Management | Tenant account authentication, lease administration, and service requests | Username, email address, company and lease details |
| Web Hosting & Infrastructure | Website hosting, content delivery, and bot mitigation | Server logs, IP address |
We may also disclose personal data when required by law, to respond to legal process, to protect our rights, or in connection with a merger, acquisition, or sale of assets (in which case you will be notified).
6. Data Retention
We retain personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. Specifically:
- Contact and leasing inquiry submissions: Retained for up to 3 years from last interaction, unless an ongoing business relationship exists.
- Tenant portal account data: Retained for the duration of your active tenancy and for a reasonable period following lease termination.
- Billing and transaction records: Retained for a minimum of 7 years to comply with financial recordkeeping requirements.
- Analytics data: Retained according to the retention period configured in our analytics platform (up to 26 months).
- Business and legal records: Retained as required for legal, tax, audit, or real estate regulatory purposes.
When personal data is no longer needed, we securely delete or anonymize it.
7. Your Privacy Rights
Depending on your location, you may have some or all of the following rights regarding your personal data:
- Right to Know / Access: Request confirmation of whether we process your personal data and obtain a copy of it.
- Right to Correct: Request correction of inaccurate personal data.
- Right to Delete: Request deletion of your personal data, subject to legal exceptions.
- Right to Portability: Receive your personal data in a portable, commonly used format.
- Right to Opt Out: Opt out of the sale of personal data, targeted advertising, or profiling.
- Right to Restrict Processing: Request that we limit how we use your data.
- Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.
- Right to Non-Discrimination: Exercise your rights without receiving discriminatory treatment.
To exercise any of these rights, please contact us at privacy@mataninc.com. We will respond to verifiable requests within 45 days (or 30 days for GDPR requests). If we need additional time, we will notify you of the extension and the reason.
Appeals Process
If we deny your privacy rights request, you have the right to appeal. To submit an appeal, email privacy@mataninc.com with the subject line "Privacy Rights Appeal." We will respond to your appeal within 60 days. If your appeal is denied, we will provide you with information on how to contact the applicable regulatory authority, including the Maryland Attorney General's Consumer Protection Division or other supervisory authority.
8. Maryland Online Data Privacy Act (MODPA) Rights
If you are a Maryland resident, the Maryland Online Data Privacy Act (effective October 1, 2025; enforcement begins April 1, 2026) provides you with specific privacy rights. Under MODPA, you have the right to:
- Confirm whether we are processing your personal data.
- Access the personal data we have collected about you.
- Correct inaccuracies in your personal data.
- Obtain a copy of your personal data in a portable, readily usable format.
- Obtain a list of the categories of third parties to which we have disclosed your personal data.
- Opt out of the processing of your personal data for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects.
MODPA Sensitive Data Protections: Under MODPA, we do not collect, process, or share "sensitive data" (as defined by Maryland law) unless strictly necessary to provide a product or service you have specifically requested. We do not sell sensitive personal data under any circumstances.
How to Exercise MODPA Rights
Submit your request by emailing privacy@mataninc.com. We will verify your identity and respond within 45 days. You may also designate an authorized agent to submit requests on your behalf. If we deny your request, you may appeal the decision, and we will provide instructions for contacting the Maryland Attorney General's Consumer Protection Division.
Universal Opt-Out Mechanism
We recognize and honor universal opt-out preference signals (such as Global Privacy Control) as valid opt-out requests under MODPA. When detected, we will cease processing your data for targeted advertising and any sale of personal data.
9. California Privacy Rights (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, provides you with additional rights regarding your personal information.
Your CCPA/CPRA Rights
- Right to Know: Request the categories and specific pieces of personal information we have collected, the sources, purposes of collection, and categories of third parties with whom we share it.
- Right to Delete: Request deletion of your personal information.
- Right to Correct: Request correction of inaccurate personal information.
- Right to Opt Out of Sale/Sharing: We do not sell or share your personal information for cross-context behavioral advertising.
- Right to Limit Use of Sensitive Personal Information: Request that we limit the use of sensitive personal information to only what is necessary.
- Right to Non-Discrimination: We will not discriminate against you for exercising your rights.
Categories of Personal Information Collected (Past 12 Months)
| CCPA Category | Collected | Sold | Disclosed for Business Purpose |
|---|---|---|---|
| Identifiers (name, email, IP address) | Yes | No | Yes |
| Internet/Network Activity (browsing, click paths) | Yes | No | Yes |
| Geolocation Data (approximate, from IP) | Yes | No | Yes |
| Commercial Information (lease/payment records) | Yes | No | No |
| Professional/Employment Information (company name, role provided by inquirer) | Yes | No | No |
To submit a request, email privacy@mataninc.com or call (301) 694-9200. We will verify your identity before processing your request and respond within 45 days.
10. European Economic Area (GDPR) Rights
If you are located in the EEA or UK, you have additional rights under the GDPR, including:
- Right to Lodge a Complaint: You may file a complaint with your local data protection supervisory authority.
- Right to Restrict Processing: You may request that we restrict the processing of your personal data under certain conditions.
- Right to Object: You may object to the processing of your personal data based on our legitimate interests.
- Right to Data Portability: You may request that we transfer your data to another controller in a structured, commonly used format.
- Automated Decision-Making: You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or significant effects. We do not currently engage in such automated decision-making.
For GDPR requests, we will respond within 30 days. Contact us at privacy@mataninc.com.
11. Universal Opt-Out and Do Not Sell
We do not sell personal data and we do not process personal data for targeted advertising. We nonetheless honor universal opt-out preference signals, including the Global Privacy Control (GPC). When we detect a GPC or similar signal from your browser or device, we will:
- Treat the signal as a valid request to opt out of the sale of personal data (as applicable under MODPA and CCPA/CPRA).
- Refrain from any targeted advertising based on your personal data.
- Apply the opt-out to the browser or device from which the signal is sent.
You can also manage your cookie choices at any time using the cookie preferences control on our Site, or contact us at privacy@mataninc.com.
12. Email Communications & CAN-SPAM Compliance
We comply with the CAN-SPAM Act of 2003. When we send you commercial emails, we will:
- Clearly identify the message as an advertisement or solicitation when applicable.
- Include our valid physical mailing address in every email.
- Provide a clear and conspicuous unsubscribe mechanism in every commercial email.
- Process unsubscribe requests within 10 business days.
- Not use deceptive subject lines or misleading header information.
To unsubscribe from our marketing emails, click the "Unsubscribe" link at the bottom of any email or contact privacy@mataninc.com. Please note that even after unsubscribing from marketing emails, you may continue to receive transactional emails related to active service engagements.
13. Sensitive Data
We do not intentionally collect sensitive personal data, which may include (depending on jurisdiction) racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, sex life or sexual orientation, citizenship or immigration status, social security or government ID numbers, financial account information, precise geolocation, or personal data of children.
In compliance with the Maryland Online Data Privacy Act, we do not collect, process, or share sensitive data unless strictly necessary to provide a specific product or service you have requested, and we do not sell sensitive personal data under any circumstances.
If we inadvertently collect sensitive data, we will promptly delete it unless legally required to retain it.
14. Data Protection Assessments
In accordance with the Maryland Online Data Privacy Act and other applicable privacy laws, we conduct Data Protection Assessments for processing activities that present a heightened risk of harm to consumers. These assessments evaluate the benefits and risks of processing activities, including those involving targeted advertising, the sale of personal data, profiling, sensitive data processing, and any use of algorithms that may produce legal or similarly significant effects on consumers.
Our Data Protection Assessments are maintained internally and may be made available to the Maryland Attorney General's Office upon request, as required by MODPA.
15. Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit (TLS/SSL), access controls, regular security assessments, and employee training on data protection. However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.
In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the applicable regulatory authorities as required by law.
16. International Data Transfers
Matan Companies is based in the United States. If you are visiting our Site from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States, where our servers and central database operate.
For personal data transferred from the EEA or UK, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms, to ensure that your data is afforded an adequate level of protection consistent with GDPR requirements.
17. Children's Privacy
Our Site and services are directed exclusively to business and professional audiences and are not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without parental consent, we will take immediate steps to delete that information. If you believe we have collected information from a child, please contact us at privacy@mataninc.com.
18. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last Updated" date at the top of this page and, where required by law, provide additional notice (such as a banner on our Site or an email notification). We encourage you to review this policy periodically.
19. Contact Us
If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about how your data is handled, please contact us:
Matan Companies
Attn: Privacy Inquiries
4600 Wedgewood Blvd., Suite A
Frederick, MD 21703
Email: privacy@mataninc.com
Phone: (301) 694-9200
For Maryland residents: If you are unsatisfied with our response to your privacy request, you may contact the Maryland Attorney General's Consumer Protection Division at www.marylandattorneygeneral.gov.