Brook Furniture Rental, Inc.’s Privacy Policy

Effective Date:  January 1, 2023

Last Modified: January 6, 2023

 

Brook Furniture Rental, Inc. (“Brook,” “we,” “us” or “our”) is a leading US-based furniture rental company and publishes this Privacy Policy (the “Policy”) to enable users or viewers of our Website (defined below), together with other prospective and actual customers and stakeholders (referred to as “you,” “your,” or “User”), to better understand what information we collect, how we use it, and what choices you have regarding your information. We have designed our privacy and data protection policies and practices to earn and maintain your trust in us and to ensure our compliance with applicable law. 

Scope

This Policy governs the practices of Brook regarding the collection, use, and disclosure of information we receive from users on our websites, including www.bfr.com (individually and collectively, the “Website”), and from the provision of products, services, and user accounts (collectively “Services”).

Our Policy does not apply to information which you provide to any third-party service provider whose services are related to or incorporated in our Services.  This Policy does not apply to our employees, independent contractors, corporate officers, and directors, or to job applicants. We encourage you to consult with such third party with respect to their privacy practices and policies for information which such party gathers from you.  

 

This Policy is incorporated in any agreement executed between you and Brook. Please read this Policy carefully, as your use of our Website and/or Services indicates to us that you have read and accepted our Policy and our privacy practices. In our discretion, we reserve the right to modify or update this Policy, and in such case, any changes or modifications shall be effective upon posting to our Website; accordingly, please check our Website periodically for changes to this Policy. By using or accessing our Website, you consent to the terms of this Policy. If we make any changes which are unacceptable to you, you may cease access to or use of the Website. But if you continue to access or use the Website after we post any such changes to the Policy, you will be deemed to have accepted the changes.

Personal Information We Collect

We may collect various types of personal information from and about you depending on how you interact with the Website, as described below.

Categories of sources of personal information:  We may collect personal information directly from you, as well as automatically related to your use of our Website and Services, as well as from third parties.  For example, we collect personal information:

Categories of personal information we collect:  While the personal information we collect varies—as explained above—depending upon the nature of the services provided or used and our interactions with individuals, we may collect the following categories of personal information (subject to applicable legal requirements and restrictions):

Opting out of or into Communications: When you register for a user account, we will need you to provide us with your email address to help us provide you with this account.  At that time, you will be asked about your communications, including if you would like to opt-in to our marketing emails aimed at enhancing your customer experience, advising you about our promotions and informing you about new services.

If you wish to opt-out and stop receiving our materials and communication: click the “unsubscribe” link in the footer of the message and follow the on-screen directives.

Information Automatically Collected by Us: We may automatically collect personal information about your interactions with our Website and may aggregate this information with other information to customize your online experience with us. The personal information we automatically collect may include your Internet Protocol (IP) address, geographic location, browser and device characteristics, browsing behavior (e.g., date and time of visit, length of visit, clicks on product information or other content) and your response to our email campaigns (e.g., whether and when you open our email, the links you click).

We may automatically collect information about how your device interacts with our Website, including pages accessed and links clicked by you.  Collecting this information enables us to better understand our visitors, including what content interests them.  We do so by placing a text file called a “cookie” in the browser files of your computer. Such cookies are small bits of data that are deposited on a user’s hard drive. Cookies permit users to store their password and other user information without having to constantly re-enter this data. The cookie itself may not contain personal information, although it will enable us to relate your use of this site to personal information that you have knowingly provided us as part of your registration. We use cookies to track visitor usage. You can refuse cookies by turning them off in your browser. You do not need to have cookies turned on to use our Website.

We automatically collect information via Google Analytics, including referring site/ad source, user activity (e.g., what pages you visit and how long you visit such pages), IP address, browser and operating system, default language on your computer and geolocation.

Please see Google’s privacy policy here:  https://www.google.com/intl/en/policies/privacy/. 

Information Collected from Other Sources: We may also collect your personal information you voluntarily provide to other sources including public databases, data aggregators, and third-party vendors. We may collect this information so as to enable you to: (1) learn more about our Services or facilitate your registration for our Services, (2) submit requests or suggestions, provide feedback or otherwise communicate with us, (3) subscribe to our marketing communications about our Services, (4) submit inquiries to us, or (5) register for events.

How We Use Your Personal Information

We may use your personal information to, among other things, improve our Website, maintain or service your accounts, provide customer service, process or fulfill orders and transactions, audit transactions, verify customer information, process payments, perform maintenance on and improve our Website, and for advertising or marketing.

We may also use your personal information to provide you with our Services, to satisfy legal obligations, administer our business, engage in marketing with our prospective and actual customers, process transactions, provide Services, identify you when you access and use our Services, respond to your inquires and fulfill your requests for information or Services, collect payment for your use of our Services, ensure compliance with legal requirements and protect our legal rights (including responding to requests from law enforcement authorities), manage risk and protect us from fraud, abuse and unlawful conduct, improve our customer experience, enhance and improve our Services, and market our Services.

Disclosure of Personal Information

We disclose the personal information we process as set forth in this section.

Purposes for Which We Disclose Personal Information

We may disclose your personal information for the following reasons:

We request those external service providers to implement and apply security safeguards to ensure the privacy and security of your personal information. These third parties have agreed to confidentiality restrictions and to use of any personal information we share with them or which they collect on our behalf solely for the purpose of providing the contracted service to us.

Categories of Personal Information Disclosed: Certain privacy laws require that we disclose the categories of personal information that we have disclosed for a business purpose as well as the categories that we have “sold” or “shared” (as those terms are defined under applicable privacy laws).  In general, we may disclose the following categories of personal information in support of our business purposes identified above:

We have disclosed the categories of personal information listed above to the following categories of third parties in the preceding twelve months: advertising networks, data analytics providers, service providers, and government entities.

No Sales or Shares of Personal Information: We do not provide your personal information to third parties in ways that could be considered a “sale” or “share” of such personal information under applicable privacy laws. 

Other Information

Data Retention: Brook retains your personal information for as long as necessary to fulfill the purposes described in this Policy, or as necessary to assert or defend against legal claims or to meet other legal obligations. When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it or, if this is not possible, such as when information is archived, we will securely store your personal information and isolate it from any further processing until deletion is possible.

Security Measures for Protecting Our Sites and Your Personal Information: We use commercially reasonable measures to safeguard our Website and your personal information.  However, we cannot ensure or warrant the security of any information you transmit to us or any information provided online, and you do so at your own risk.  We encourage you to use reasonable caution when disclosing information online. 

Children’s Data:  Our Website is not directed at children under age thirteen (13) and we do not knowingly collect personal information online from persons in this age group. If you are under age thirteen (13), you should not use the Website or submit personally identifiable information to us without the consent of your parent or guardian. We reserve the right to delete any personal information identified as having been provided by children under age thirteen (13) at our discretion.  If you believe that a child under the age of thirteen (13) has submitted personal information in connection with usage of our Website, please contact us at the email address at the end of this Policy.

Links to Third Party Sites:  Our Website may contain links to other third party sites (e.g., our Refer a Friend program operated by and through Extole, Inc.), which may have privacy policies that differ from our own. The information practices and the content of such other websites are governed by the privacy statements of such websites. We encourage you to regularly review the privacy statements of any such other websites to understand their privacy practices. We have no control over the content displayed on such site, nor over the measures, if any, taken by such sites to protect the privacy of your information by them.  We are not responsible for the activities and practices that take place on these sites and you would refer to those third party sites’ privacy policies for further information.

Please see Extole, Inc.’s privacy policy here:
https://www.extole.com/privacy-policy/#:~:text=Extole%20collects%20personal%20and%20non,last%20name%20and%20email%20address. 

Personal Information Collected by Third Parties: We use services provided by third parties, including Rakuten Advertising, which may collect your personal information when you interact with our Website or when we provide you Services. This information may include your IP addresses, digital identifiers, information about your web browsing and app usage and how you interact with our properties and ads. This Policy does not apply to any personal information that is collected or processed via Rakuten Advertising. 

 

Please see Rakuten Advertising's privacy policy here: 

https://rakutenadvertising.com/legal-notices/services-privacy-policy/

Your rights related to Rakuten Advertising: 

https://rakutenadvertising.com/legal-notices/services-privacy-rights-request-form/ 

 

Optimizing Visits to our Website:  We use Hotjar, Meta pixels and chat boxes in order to better understand our users’ needs and to optimize our services and our website users’ experience. These are technology services that help us better understand our users’ experience (e.g., how much time they spend on which pages, which links they choose to click, what users do and don’t like, etc.) and this enables us to build and maintain our service with user feedback. Hotjar and Meta use cookies and other technologies to collect data on our users’ behavior and their devices. This includes a device’s IP address (processed during your session and stored in a de-identified form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), and the preferred language used to display our website. Hotjar and Meta store this information on our behalf in a pseudonymized user profile. Hotjar and Meta do not sell any of the data as that term is defined by the applicable privacy laws collected on our behalf.  This Policy does not apply to any personal information that is collected or processed via Hotjar or Meta.

 

Please see Hotjar’s privacy policy here: https://www.hotjar.com/legal/policies/privacy/

 

Please see Meta’s privacy policy here: https://www.facebook.com/privacy/policy/

 

Correcting Your Personal Information:  You may request to review, correct, modify and/or delete any of the personal information that you have previously provided us through our website, applications or otherwise. With respect to our outbound emails, we will remove your name from our marketing contact lists if you opt-out or otherwise notify us of your desire to be removed from such lists. Requests to access, change, or delete your information will be addressed within a commercially reasonable timeframe.

Additional Information for Residents in Certain Jurisdictions

California Residents. 

For users residing in California, we provide the following information as required under the California Consumer Privacy Act (“CCPA”).

The CCPA defines personal information as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you. Personal Information does not include information that is aggregated or information that cannot be reasonably linked to you.

Once we receive and confirm from you a verifiable consumer request, we will disclose to you the following that we collected during the past 12-months:

Consistent with the CCPA, the section above entitled “Personal Information We Collect From You” generally describes the categories of personal information about California residents that we collect and disclose to third parties for business purposes. We collect these categories of personal information from the sources described above the purpose described in the Section above entitled “How we Use your Personal Information.”

Sharing of your information to government entities: We may share your personal information with government entities, including law enforcement, in circumstances that include: (1) when required to do so as a matter of law; (2) to assist in the investigation of a potential crime impacting Brook, its employees, its customers, or the communities we serve; or (3) when required in response to legal process (e.g., subpoena, warrant).

Verifying Your Privacy Requests:  To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to your personal information or complying with your request. If you have an account with us, we may verify your identity by requiring you to sign into your account. If you request access to or deletion of your personal information and do not sign into an account with us, we require you to provide the following information: name, email address, phone number, and postal address. In addition, if you do not have an account and you ask us to provide you with specific pieces of personal information, we reserve the option to require you to sign a declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request. If you designate an authorized agent to make an access, deletion or opt-out of sale request on your behalf (1) we may require you to provide the authorized agent written permission to do so, and (2) for access and deletion requests, we may require you to verify your own identity directly with us (as described above).

Right to non-discrimination: The CCPA prohibits discrimination against California residents for exercising their rights under the CCPA. Discrimination may exist where a business denies or provides a different level or quality of goods or services, or charges (or suggests that it will charge) different prices, rates, or penalties on residents who exercise their CCPA rights, unless doing so is reasonably related to the value provided to the business by the residents’ data.

Correcting Your Personal Information:  You may request to review, correct, modify and/or delete any of the personal information that you have previously provided us through our Website, applications or otherwise. With respect to our outbound emails, we will remove your name from our marketing contact lists if you opt-out or otherwise notify us of your desire to be removed from such lists. Requests to access, change, or delete your information will be addressed, unless an exception applies.

We may deny your deletion request if retaining the information is necessary for us to:

The Right to Limit Use and Disclosure of Sensitive Personal Information: You have the right to request that we limit or do not share your sensitive personal information to third parties. Sensitive Personal Information is that type of information that requires special precautions to protect from unauthorized use, access, disclosure, modification, loss, or deletion. Sensitive personal information may include your social security number, driver’s license number, passport number, or state ID card numbers, payment card information, exact geolocation, your race, religious, or ethnicity, membership, or your genetic and biometric data.

The Right to Opt Out of Personal Information Sharing: You have the right to opt out of our sharing of your personal information for purposes of interest-based advertising. To exercise this right under applicable privacy laws, please contact us using one of the methods in the additional information: section below or click on the link on the Website that says “Do Not Share My Personal Information” or “Limit the Use of My Sensitive Personal Information.”

 

Response Timing and Format: We will assess the validity of your opt out request or request to limit the sharing of your personal information under applicable law and endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt.  If we require more time, we will inform you of the reason and extension period in writing.  Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt.  The response we provide will also explain the reasons we cannot comply with a request, if applicable.  For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded.  If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Requests by Authorized Agents: An authorized agent can make a request on a California resident’s behalf by providing a power of attorney valid under California law, or providing: (1) proof that the consumer authorized the agent to do so; (2) verification of their own identity with respect to a Right to Know categories, Right to Know specific pieces of personal information, or Requests to Delete which are outlined above; and (3) direct confirmation that the consumer provided the authorized agent permission to submit the request.

Virginia Residents.

In this section, we provide information for Virginia residents as required under the Virginia Consumer Data Protection Act (the “VCDPA”).

Categories of Personal Information That We Collect, Disclose and Share: Our collection, use and disclosure of personal information about a Virginia resident will vary depending upon the circumstances and nature of our interactions or relationship with such resident. Consistent with the VCDPA, the Section above entitled “Personal Information We Collect From You” generally describes the categories of personal information about California residents that we collect and disclose to third parties for business purposes. We collect these categories of personal information from the sources described above the purpose described in the Section above entitled “How we Use your Personal Information.”

 

If you are a Virginia resident, the VCDPA grants you the following rights with respect to the personal data we collect about you: 

 

 

 

 

 

 

If you are a Virginia resident and would like to make a request to exercise any of these rights, please contact us at dpo@bfr.com and insert “Virginia Privacy Rights Request” in the subject line.  Please allow forty-five (45) days for a response.

 

If we do not take action on a request to exercise any of the rights described above, you may appeal our decision not to take action. You may submit an appeal of our refusal to act on a request by submitting your name, email, phone number, and a copy of your data subject request and a copy of the response we provided in which we refused to act.  Please submit to us via email at dpo@bfr.com.  We may need to contact you for additional information.  We will provide a written response to your appeal within a reasonable time, but no later than 60 days after our receipt of your appeal.

 

For more information about our privacy practices, you may contact us as set forth in the Section below entitled “Contact Us.”

Connecticut Residents (Effective July 1, 2023).

In this section, we provide information for Connecticut residents as required under the Connecticut Data Privacy Act  (the “CTDPA”), which goes into effect July 1, 2023.

 

Categories Of Personal Information That We Collect, Disclose And Share: Our collection, use and disclosure of personal information about a Connecticut resident will vary depending upon the circumstances and nature of our interactions or relationship with such resident. Consistent with the CTDPA, the Section above entitled “Personal Information We Collect From You” generally describes the categories of personal information about California residents that we collect and disclose to third parties for business purposes. We collect these categories of personal information from the sources described above the purpose described in the Section above entitled “How we Use your Personal Information.”

 

If you are a Connecticut resident, the CTDPA grants you the following rights with respect to the personal data we collect about you: 

 

 

 

 

 

 

If you are a Connecticut resident and would like to make a request to exercise any of these rights, please contact us at dpo@bfr.com and insert “Connecticut Privacy Rights Request” in the subject line.  Please allow forty-five (45) days for a response.

 

If we do not take action on a request to exercise any of the rights described above, you may appeal our decision not to take action. You may submit an appeal of our refusal to act on a request by submitting your name, email, phone number, and a copy of your data subject request and a copy of the response we provided in which we refused to act.  Please submit to us via email at dpo@bfr.com.  We may need to contact you for additional information.  We will provide a written response to your appeal within a reasonable time, but no later than 60 days after our receipt of your appeal.

 

For more information about our privacy practices, you may contact us as set forth in the Section below entitled “Contact Us.”

Contact Us.

If you have any questions or concerns regarding this Policy, you may contact us by email at: dpo@bfr.com, via telephone at 1-800.765.8563, or write us at: Brook Furniture Rental, Inc., 100 N. Field, Suite 220, Lake Forest, IL 60045.