Brook Furniture Rental, Inc.'s Privacy Policy Effective Date: November 30, 2020 Brook Furniture Rental, Inc. (“Brook,” “we,” “us” or “our”) is a leading US-based furniture rental company and publishes this Privacy Policy (the “Policy”) to enable users or viewers of our Website (defined below), together with other prospective and actual customers and stakeholders (referred to as “you,” “your,” or “User”), to better understand what information we collect, how we use it, and what choices you have regarding your information. We have designed our privacy and data protection policies and practices to earn and maintain your trust in us and to ensure our compliance with applicable law. Please read this Policy carefully, as your use of our Website(defined below) indicates to us that you have read and accepted our Policy and our privacy practices. This policy was last updated on November 30, 2020. In our discretion, we reserve the right to modify or update this Policy and/or the Privacy Policy Statement Addendum for California Residents, and in such case, any changes or modifications shall be effective upon posting to our Website; accordingly, if you do visit our site regularly, it is your responsibility to familiarize yourself with this Policy. If you do not agree with our Policy, please do not use our Website. Scope. This Policy informs you of our policies and procedures regarding the collection, use, and disclosure of information we receive from users on our website ( www.bfr.com ), as well as all related domains (individually and collectively, the "Website") and services, including but not limited to, our products, services, and user accounts (individually and collectively, the “Services”). Such Services shall be provided pursuant to additional terms and conditions (such as may be set forth in a lease agreement for a furniture rental from us), and in such case, the capitalized terms and additional terms and conditions of such agreement shall trump any more general description herein. Our Policy applies only to information which you provide to us in engaging us for Services and does not apply to information which you provide to any third party service provider whose services are related to or incorporated in our Services. We encourage you to consult with such third party with respect to their privacy practices and policies for information which such party gathers from you. Security Measures for Protecting Our Sites and Your Personal Information. We use customary and reasonable industry measures to safeguard our website and sensitive personal information, which measures are appropriate to the type of information maintains and are in accordance with applicable laws safeguarding such information under our control. In some areas of our website, we may use Secure Socket Layer (“SSL”) or Transport Layer Security (“TLS”) encryption technology to enhance data privacy and help prevent loss, misuse or alteration of information under our control. Nonetheless, we encourage you to use reasonable caution when disclosing information online. In many cases, you are in the best position to protect yourself online, including protecting your username and password from third party access and selecting and maintaining secure passwords. Information Collection Information Voluntarily Provided to us during Account Registration. As part of your visit to our Website, you may use one of our applications or registration forms for our Website. In such case, you shall create an “account,” which consists of a user profile registered with us through our Website. As of creation of an account, we collect “personal information,” which is information about a user that may be associated with an identified or identifiable person, such as name, address, telephone number, email address, financial account information (bank account, credit/debit card number), demographic information, social security number (or other government-issued identification number), and date of birth. We also collect information that you provide and upload to the Website through the submission of user content or through your communication with us. In processing your Account, we may also obtain your personal information from third parties, such as identity verification services, electronic database services, and credit reporting agencies. When you register for Services, we will need you to provide us with your email address to help us provide you with these Services. At that time, you will asked about your communications, including if you would like to opt-in to our marketing emails aimed at enhancing your customer experience, advising you about our promotions and informing you about new Services; thereafter, you will be given the opportunity to opt-out of such emails whenever you receive such emails from us. Information Automatically Collected by Us. We also collect automatically information such as your Internet Protocol (IP) address, browser-type and geographic location. We may collect information about how your device interacts with our Website, including pages accessed and links clicked by you. Collecting this information enables us to better understand our visitors, including what content interests them. We do so by placing a text file called a "cookie" in the browser files of your computer. Such cookies are small bits of data that are deposited on a user's hard drive. Cookies permit users to store their password and other user information without having to constantly re-enter this data. The cookie itself may not contain personal information, although it will enable us to relate your use of this site to personal information that you have knowingly provided us as part of your registration. We use cookies to track visitor usage. You can refuse cookies by turning them off in your browser. You do not need to have cookies turned on to use our Website. We collect information via Google Analytics, including referring site/ad source, user activity (e.g., what pages you visit and how long you visit such pages), IP address, browser and operating system, default language on your computer and geolocation. You can review Google’s privacy policy at: https://www.google.com/intl/en/policies/privacy/. Information Voluntarily Provided to us Outside the Web. We may also collect your personal information you provide to us voluntarily as our personnel participate in workshops or events or otherwise interact with our partners, suppliers, and customers. Such information may be collected to enable you to: (1) learn more about our Services or facilitate your registration for our Services, (2) submit requests or suggestions, provide feedback or otherwise communicate with us, (3) subscribe to our marketing communications about our Services, (4) submit inquiries to us, or (5) register for events. Why we do collect and retain Personal Information? We do not sell your personal information for commercial purposes to any third parties. Internally, we may share user pattern information to improve our websites, and we may share aggregated information on a limited basis with outside parties to further our business operating necessities. We collect and retain Personal Information to fulfill our legal and regulatory obligations as well as other business purposes, such as fulfilling our contracts with customers or timely responding to your requests (such as participating in one of our programs, download one of our applications or learn more about our products or services). At the relevant point of interaction with you, we will let you know why we are requesting such information from you, but in general, such information is necessary to fulfill our contracts with you or enable us to timely respond to your requests. Data Retention. We retain personal information we collect from you where we have an ongoing, legitimate business need to do so, such as providing you with a requested Service or complying with applicable legal requirements. When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it or, if this is not possible, such as when information is archived, we will securely store your personal information and isolate it from any further processing until deletion is possible. How we use Personal Information. We use personal information to provide you with our Services, to satisfy legal obligations, administer our business, and engage in marketing with our prospective and actual customers. Such information is typically used to process transactions, provide Services, identify you when you access and use our Services, respond to your inquires and fulfill your requests for information or Services, collect payment for your use of our Services, ensure compliance with legal requirement and protect our legal rights (including responding to requests from law enforcement authorities), manage risk and protect us from fraud, abuse and unlawful conduct, improve our customer experience, enhance and improve our Services, and market our Services. Children's Data. We do not knowingly collect or solicit personal information from anyone under the age of eighteen (18). If we learn that we have inadvertently obtained personal information from a child under the age of 18, we will delete the information as soon as practicable. If you believe that a child under the age of eighteen (18) has submitted personal information in connection with usage of our Website, please contact us at the email address at the end of this Policy. Links to Third Party Sites. Our Website may contain links to other third party sites (such as those of our marketing partners), which may have privacy policies that differ from our own. The information practices and the content of such other websites are governed by the privacy statements of such websites. We encourage you to regularly review the privacy statements of any such other websites to understand their privacy practices. We have no control over the content displayed on such site, nor over the measures, if any, taken by such sites to protect the privacy of your information by them. We are not responsible for the activities and practices that take place on these sites. Correcting Your Personal Information. You may request to review, correct, modify and/or delete any of the personal information that you have previously provided us through our website, applications or otherwise. With respect to our outbound emails, we will remove your name from our marketing contact lists if you opt-out or otherwise notify us of your desire to be removed from such lists. Requests to access, change, or delete your information will be addressed within a commercially reasonable timeframe. Privacy Statement for California Residents. If you are a California resident, we publish a policy statement addendum specific to you to align with the California Consumer Privacy Act. See “Privacy Policy Statement Supplement for California Residents.” Contacting Us. You can always contact us in order to update your personal information or change your preferences with respect to marketing contacts by emailing us at: dpo@bfr.com, or to the extent available, updating such account information online. If you have any other questions about our Privacy Policy, please contact us via email at: privacy@bfr.com or write us at Brook Furniture Rental, Inc., 100 N. Field, Suite 220, Lake Forest, IL 60045. Brook Furniture Rental, Inc.’s Privacy Policy Statement Supplement for California Residents Effective Date: November 30, 2020 Privacy Policy Statement Addendum for California Residents. For users residing in California, Brook Furniture Rentals, Inc. (“we,” “our,” or “us”) publish this “Addendum”, which is intended to supplement our Privacy Policy in furtherance of our compliance with the California Consumer Privacy Act (“CCPA”). Capitalized terms shall have the meaning ascribed to them in the CCPA, except as defined herein. Collection and Disclosure. “Personal Information” for the purposes of this CCPA Notice is defined as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you. Personal Information does not include information that is aggregated or information that cannot be reasonably linked to you. During the 12-month period prior to the effective date of this Addendum, we may have: a. Collected the following categories of personal information about you: Identifiers: identifiers such as a real name, alias, postal address, unique personal identifier (such as customer number, unique pseudonym, or user alias), email address, account name, social security number, driver’s license number, and other similar identifiers, physical characteristics or description, state identification card number, and signature; Identifiers (Online): a device identifier; cookies, beacons, pixel tags, mobile ad identifiers and similar technology; other forms of persistent or probabilistic identifiers, and Internet Protocol address; Other Financial Information: bank account number, credit card number, debit card number, and other financial information; Information Related to Characteristics Protected Under California or Federal Law: characteristics of protected classifications under California or federal law, such as race, color, national origin, religion, age, sex, gender, gender identity, gender expression, sexual orientation, marital status, ancestry, genetic information, disability, citizenship status, and military and veteran status; Commercial Information: including records of personal property, products or services purchased, obtained, or considered, and other purchasing or consuming histories or tendencies; Internet and Other Electronic Network Activity Information: including, but not limited to, browsing history, search history, and information regarding your interaction with websites, applications or advertisements; Geolocation Data; Sensory Information: Audio, electronic, visual, thermal, and similar information Professional or Employment-Related Information; Education Information; Profile Inferences: inferences drawn from any of the information identified above to create a profile about you reflecting your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. b. Collected personal information about you for the following business or commercial purposes: Performing services you have purchased from or contracted for with us, including maintaining or servicing accounts (e.g., your Brooks’ account), as well as providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing advertising or marketing services, providing analytics services, or providing similar services; Auditing related to a current interaction with you and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance; Short-term, transient use, including, but not limited to, the contextual customization of ads shown as part of the same interaction; Detecting and responding to security incidents, protecting against and responding to malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity; Debugging to identify and repair errors that impair existing intended functionality; Undertaking internal research for technological development and demonstration; Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us; Customizing your experience on our digital properties; Processing liability claims; Complying with and enforcing applicable legal requirements, relevant industry standards and our policies. c. Shared your personal information with the following categories of third parties: our affiliates; our joint marketing partners; our business partners; social media networks; third-party marketing partners; and government entities, including law enforcement authorities. d. Sold (as defined under California law) the following categories of personal information: (i) identifiers (online) associated with a device used to interact with our digital properties or advertisements (such as a device identifier; cookies, beacons, pixel tags, mobile ad identifiers and similar technology); and (ii) Internet and other electronic network activity information associated with a device used to interact with Digital Properties or advertisements. We do not sell the personal information of consumers under the age of 18 if we have actual knowledge of the individual’s age. We do not sell personal information as the term is traditionally understood, versus the definition under the CCPA — for example, we do not exchange for money personal information to data brokers or third parties for their marketing purposes independent of us. e. Disclosed for a business purpose the following categories of personal information about you: Identifiers Identifiers (Online) Other Financial Information Information Related to Characteristics Protected Under California or Federal Law Commercial Information Biometrics Internet and Other Electronic Network Activity Information Geolocation Data Sensory Information Professional or Employment-Related Information Education Information Profile Inferences f. Collected personal information about you from the following sources: (i) you, (ii) Brook, (iii) devices you used and (iv) service providers. g. Information we share with third parties: 3rd Party Categories Personal Information Categories Our Affiliates Our Joint Marketing Partners Our Business Partners Social Media Networks Third-party Marketing Partners Government Entities, Including Law Enforcement *See Disclamer Below Identifiers Yes Yes Yes Yes Yes Yes Identifiers (Online) Yes No No Yes Yes Yes Other Financial, Medical and Health Information No No No No No Yes Information Related to Characteristics Protected Under California or Federal Law No No No No No Yes Commercial Information Yes Yes Yes No No Yes Biometrics No No No No No Yes Internet and Other Electronic Network Activity Information Yes No No Yes Yes Yes Geolocation Data No Yes No Yes Yes Yes Sensory Information No No No No No Yes Professional or Employment Related Information No No No No No Yes Education Information No No No No No Yes Profile Inferences Yes No No Yes Yes Yes *We share Personal Information with government entities, including law enforcement, only in the following circumstances: (1) when required to do so as a matter of law; (2) to assist in the investigation of a potential crime impacting Brook, its employees, its customers, or the communities we serve; or (3) when required in response to legal process (e.g., subpoena, warrant). California Consumer Privacy Rights. You have certain rights regarding our use and disclosure of your personal information, as described below. Know and Access: You have the right to submit a verifiable request, twice in a 12-month period, that we disclose to you the personal information related to you which we have collected during the past 12 months. This may include: Categories and specific pieces of personal information we have collected about you; Categories of sources from which we collected the personal information; The business or commercial purpose for which we collected or sold the personal information; Categories of third parties with whom we shared the personal information; Categories of personal information about you that we sold or disclosed for a business purpose, and the categories of third parties to whom we sold or disclosed that information for a business purpose. Deletion: You have the right to request that we delete certain personal information we have collected from you. Certain exceptions apply. Opt-Out of Sale: You have the right to opt-out of the sale of your personal information. How You Can Opt-Out of the Sale of Personal Information to Third Parties: We do not sell your personal information to third parties for monetary consideration for any purpose but we may disclose or make available the personal information identified earlier in this policy for limited reasons. To opt-out of the sale of your personal information, please contact us: Via our online verifiable consumer request submission form located on our California Consumer Privacy Rights page; or By calling us at 1.800.765.8563 Shine the Light Request. You also may have the right to request that we provide you with (a) a list of certain categories of personal information we have disclosed to third parties for their direct marketing purposes during the immediately preceding calendar year and (b) the identity of those third parties. How to Submit a Request. You may submit an access request, deletion request, Shine-the-Light Request or otherwise seek to opt out of the sale of your personal information. In such case, please contact us via email at CCPA@bfr.com or contact us via telephone at 1-800.765.8563. Verifying Your Privacy Requests. To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to your personal information or complying with your request. If you have an account with us, we may verify your identity by requiring you to sign into your account. If you request access to or deletion of your personal information and do not sign into an account with us, we require you to provide the following information: name, email address, phone number, and postal address. In addition, if you do not have an account and you ask us to provide you with specific pieces of personal information, we reserve the option to require you to sign a declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request. If you designate an authorized agent to make an access, deletion or opt-out of sale request on your behalf (1) we may require you to provide the authorized agent written permission to do so, and (2) for access and deletion requests, we may require you to verify your own identity directly with us (as described above). Additional Information. If you choose to exercise any of your rights under the CCPA, you have the right not to receive, and will not receive, discriminatory treatment by us. To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request. Employees and contractors are provided notice via different statements. This Statement is available in alternative formats upon request. Please contact dpo@bfr.com to request this Statement in an alternative format. Last updated: November 30, 2020. Furniture Living Dining Bedroom Decor & Accessories Electronics Home Office Professional Office Services Rent for Home Rent for Office Student Packages Temporary Assignment Home Staging Commercial Staging GSA About Us How it Works Why Brook Service Area & Locations How We Protect You Sustainability Blog Careers Contact & Legal FAQ Contact Us Make a Payment Log In Privacy Policy Terms of Use 800.933.7368 ©2021 Brook Furniture Rental, Inc. LOGIN LOCATIONS