Privacy Policy

Last Updated: November 2025

1. Introduction

Welcome to MedalistREIT.com ("we," "our," or "us"). We respect your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website.

Medalist Diversified REIT, Inc. is headquartered in Virginia with operations in California. We comply with applicable federal and state privacy laws, including the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).

Please read this Privacy Policy carefully. If you do not agree with the terms of this Privacy Policy, please do not access the site.

2. Information We Collect

2.1 Personal Information You Provide

We collect personal information that you voluntarily provide to us when you:

  • Fill out forms on our website

  • Request offering materials or information

  • Submit a contact form or inquiry

  • Subscribe to communications

  • Contact us by phone or email

This information may include:

  • Name

  • Email address

  • Phone number

  • Mailing address

  • Professional affiliation (e.g., financial advisor, CPA)

  • Accredited investor status

  • Other information you choose to provide

If you request DST offering materials, we may collect information to verify your status as an accredited investor, as required by securities regulations.

2.2 Information Collected Automatically

When you visit our website, we automatically collect certain information about your device and browsing activity, including:

  • IP address

  • Browser type and version

  • Operating system

  • Device type

  • Access times and dates

  • Pages viewed and time spent on pages

  • Referring website addresses

  • Click patterns and navigation paths

2.3 Information from Cookies and Tracking Technologies

We use cookies, pixel tags, and similar technologies to collect information about your browsing activity. See Section 6 (Cookies and Tracking Technologies) for more details.

2.4 Information Shared with Third Parties

If you request offering materials or express interest in a DST investment, your information may be shared with:

  • Realta Wealth, Member FINRA/SIPC, our broker-dealer of record, to facilitate your inquiry and comply with securities regulations

  • Service providers who assist with our operations (see Section 5)

3. How We Use Your Information

We use the information we collect for the following purposes:

  • Respond to your inquiries and provide customer support

  • Provide information about DST offerings and investment opportunities

  • Process and manage requests for offering materials

  • Verify accredited investor status as required by law

  • Send administrative communications (e.g., confirmations, updates)

  • Send marketing and promotional communications (with your consent)

  • Operate, maintain, and improve our website

  • Analyze website usage and user behavior

  • Detect, prevent, and address technical issues or security threats

  • Comply with securities regulations and legal requirements

  • Enforce our Terms of Use and protect our rights

4. Legal Bases for Processing

We process your personal information based on the following legal grounds:

  • Consent: When you voluntarily provide information or opt in to communications

  • Legitimate Interests: To operate our business, improve our services, and communicate with prospects

  • Legal Compliance: To comply with securities laws, tax regulations, and other legal obligations

  • Contractual Necessity: To fulfill requests you have made or services you have requested

5. How We Share Your Information

We may share your personal information with the following categories of third parties:

Service Providers: Companies that provide services on our behalf, such as website hosting, email delivery, analytics, and customer relationship management. These providers are contractually required to protect your information.

Broker-Dealer: Realta Wealth, Member FINRA/SIPC, to process investment inquiries and comply with securities regulations.

Professional Advisors: Legal, accounting, and other professional advisors as needed for business operations.

Legal and Regulatory: Government agencies, regulators, or other parties when required by law, subpoena, court order, or to protect our legal rights.

Business Transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred to the successor entity.

We do not sell your personal information for monetary consideration.

Some sharing of information with analytics or advertising partners may constitute a "sale" or "share" under California law. See Section 9 (California Privacy Rights) for your opt-out rights.

6. Cookies and Tracking Technologies

6.1 What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help websites remember your preferences and understand how you use the site.

6.2 How We Use Cookies

We use cookies and similar technologies to:

  • Keep you signed in (if applicable)

  • Remember your preferences

  • Understand how you use our website

  • Analyze website traffic and performance

  • Improve our website content and functionality

6.3 Types of Cookies We Use

  • Essential Cookies: Required for basic website functionality

  • Analytics Cookies: Help us understand website usage (e.g., Google Analytics)

  • Marketing Cookies: Used to deliver relevant content and measure advertising effectiveness

6.4 Google Analytics

We use Google Analytics to analyze website traffic. Google Analytics uses cookies to collect information about your use of our website, which is transmitted to and stored by Google. For more information, visit Google's Privacy Policy. You can opt out of Google Analytics by installing the Google Analytics Opt-Out Browser Add-on.

6.5 Google Tag Manager

We use Google Tag Manager to manage tracking tags on our website. Google Tag Manager facilitates the deployment of other analytics and marketing services.

6.6 Your Cookie Choices

You can control cookies through your browser settings. Most browsers allow you to:

  • View cookies stored on your device

  • Delete some or all cookies

  • Block all cookies or only third-party cookies

  • Set preferences for certain websites

Please note that disabling cookies may affect website functionality.

7. Data Security

We implement reasonable administrative, technical, and physical security measures to protect your personal information from unauthorized access, alteration, disclosure, or destruction.

These measures include:

  • Secure socket layer (SSL) encryption for data transmission

  • Access controls limiting who can view personal information

  • Regular security assessments

However, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security of your information.

8. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Factors we consider in determining retention periods include:

  • The nature of the information and our relationship with you

  • Legal and regulatory requirements

  • Statute of limitations for potential claims

  • Business needs for record-keeping

When personal information is no longer needed, we securely delete or anonymize it.

9. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).

9.1 Your California Rights

Right to Know: You have the right to request that we disclose:

  • The categories of personal information we have collected about you

  • The categories of sources from which we collected it

  • The business or commercial purpose for collecting or selling it

  • The categories of third parties with whom we share it

  • The specific pieces of personal information we have collected about you

Right to Delete: You have the right to request that we delete personal information we have collected from you, subject to certain exceptions (e.g., legal compliance, completing transactions).

Right to Correct: You have the right to request that we correct inaccurate personal information we maintain about you.

Right to Opt-Out of Sale or Sharing: You have the right to opt out of the "sale" or "sharing" of your personal information for cross-context behavioral advertising. We do not sell personal information for monetary consideration. However, some sharing with analytics or advertising partners may constitute a "sale" or "share" under California law.

Right to Limit Use of Sensitive Personal Information: If we collect sensitive personal information, you have the right to limit its use to what is necessary for providing our services.

Right to Non-Discrimination: We will not discriminate against you for exercising any of your California privacy rights. You will not receive different prices, quality of service, or other penalties for exercising your rights.

9.2 Categories of Personal Information Collected

In the past 12 months, we have collected the following categories of personal information:

Identifiers: Name, email, phone, mailing address, IP address

Personal Information (CA Civil Code §1798.80): Name, address, phone number

Commercial Information: Investment inquiries, offering materials requested

Internet/Network Activity: Browsing history, pages visited, referring URLs

Geolocation Data: General location based on IP address

Professional/Employment Information: Financial advisor affiliation, firm name

Inferences: Preferences based on browsing activity

9.3 Categories of Sources

We collect personal information from:

  • Directly from you (forms, emails, phone calls)

  • Automatically from your device (cookies, browsing activity)

  • Third-party service providers (analytics platforms)

9.4 Business Purposes for Collection

We collect personal information for the purposes described in Section 3, including:

  • Responding to inquiries

  • Providing information about offerings

  • Website analytics and improvement

  • Marketing communications

  • Legal and regulatory compliance

9.5 Categories of Third Parties

We may share personal information with:

  • Service providers (website hosting, analytics, CRM)

  • Broker-dealer (Realta Wealth)

  • Professional advisors

  • Government/regulatory bodies (when required)

9.6 How to Exercise Your California Rights

To exercise your rights, please contact us:

Email: Solutions@MedalistREIT.com (include "California Privacy Request" in subject line)

Phone: (949) 415-6633

Mail: Medalist Diversified REIT, Inc. Attn: Privacy Request P.O. Box 8436 Richmond, VA 23226

To Opt Out of Sale/Sharing: Email Solutions@MedalistREIT.com with subject line: "Do Not Sell or Share My Personal Information"

Verification: We will verify your identity before processing your request. This may require you to provide information that matches what we have on file.

Authorized Agent: You may designate an authorized agent to make a request on your behalf. We may require written authorization and verification of your identity.

Response Time: We will respond to verifiable requests within 45 days. If we need additional time, we will notify you of the reason and extension (up to 90 days total).

9.7 California "Shine the Light" Law

California Civil Code Section 1798.83 permits California residents to request information about disclosure of personal information to third parties for direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes.

9.8 Do Not Track Signals

Some browsers offer a "Do Not Track" (DNT) feature. Our website does not currently respond to DNT signals. However, you can exercise your opt-out rights as described in this section.

10. Other State Privacy Rights

Residents of other states (including Virginia, Colorado, Connecticut, and Utah) may have similar privacy rights under applicable state laws. To exercise any privacy rights available to you, please contact us using the information provided in Section 13.

11. Children's Privacy

Our website is not directed to individuals under the age of 18. We do not knowingly collect personal information from children. Our services are intended for accredited investors, who must meet certain income and net worth requirements.

If you believe we have inadvertently collected information from a child, please contact us immediately at Solutions@MedalistREIT.com. We will promptly delete such information.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

When we make material changes, we will:

  • Update the "Last Updated" date at the top of this page

  • Post the revised Privacy Policy on our website

  • Notify you by email if we have your contact information (for significant changes)

We encourage you to review this Privacy Policy periodically. Your continued use of our website after changes are posted constitutes acceptance of the revised Privacy Policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

Medalist Diversified REIT, Inc.

Email: Solutions@MedalistREIT.com Phone: (949) 415-6633

Mailing Address: P.O. Box 8436 Richmond, VA 23226

Website: www.medalistreit.com

For California privacy requests, please include "California Privacy Request" in the subject line of your email or letter.

Last updated: November 2025