1. SCOPE OF OUR PRIVACY NOTICE
This privacy notice applies to our collection, use disclosure and other processing of personal information related to:
- The use of our Sites or Services that display or link to this Policy
- Former, current and prospective clients, brokers, independent agents, and consumers
- Other individuals who use our Sites or Services, whose personal information we received related to the Sites and Services
All collection, use, disclosure, and processing of personal information by BHH Affiliates, LLC about individuals will vary depending upon use of our Sites and Services. This policy is intended to provide our general practices and procedures. In some cases, different or additional notices about our data collection and processing may be provided and apply to certain personal information.
This policy does not apply to job applicants or candidates who apply for employment with our parent company, HSF Affiliates LLC or to our employees and independent agents.
2. COLLECTING INFORMATION
When you visit our consumer applications or purchase and/or sell real estate with one of BHH Affiliates, LLC’s franchisees, we may collect information about you that you share with us. We typically collect two kinds of information about you through our applications: (a) information that you provide that personally identifies you; and (b) information that does not personally identify you, which we automatically collect when you visit our applications or that you provide to us.
a. Personally Identifiable Information: This identification information may include, but is not limited to, your name, physical address, email address, telephone, mobile and fax numbers, details of your real estate, lending, title and insurance needs and references, and other details of your life (“Personal Information”).
b. Non-Personally Identifiable Information: Our definition of non-personally identifiable information (“Non-PII”) is any information that does not personally identify you. Non-PII can include certain personally identifiable information that has been de-identified; that is, information that has been rendered anonymous by a de-identification process. We obtain non-PII about you from information that you affirmatively provide to us, either separately or together with your personally identifiable information. We also automatically collect certain non-PII from you when you access any applications. This information can include, among other things, IP addresses, the type of browser you are using, the third-party website from which your visit originated, the operating system you are using, the domain name of your Internet service provider, the search terms you use on our applications, the specific web pages you visit, the duration and frequency of your visits, and location information.
You can manage how your preferences regarding third party ad company cookies set by this Site or Service by reading the cookie discussion above.
Please also see the cookie discussion above for information about the third parties we may work with to display targeted ads on third-party sites and to measure the success of our marketing and campaigns. You may also obtain more information about targeted or “interest-based advertising” and opt-out of many ad networks at the industry websites below:
3. BASIS FOR PROCESSING OF PERSONAL INFORMATION
Certain laws, including the EU General Data Protection Regulation (“GDPR”), requires that we inform applicable individuals of the legal basis for our use and other processing of personal information.
We process personal information for the follow bases:
Performance of contract: as necessary to enter into or carry out the performance of our contract
Compliance with laws: for compliance with legal obligations and/or defense against legal claims, including those in the area of labor and employment law, social security, and data protection, tax, and corporate compliance laws.
Our legitimate interests: in furtherance of our legitimate business interests including:
- Performance of contracts with our franchisees and other parties
- Implementation and operation of global support (e.g., IT) services for our business operations
- Customer relationship management and improving our services, including marketing and analytics
- Fraud prevention, including misuse of company IT systems or money laundering
- Physical, IT, and network perimeter security
- Internal investigations
- Mergers, acquisitions, and reorganization, and other business transactions
With your consent: where we have your consent (the GDPR (where it applies)) and other applicable laws give you the right to withdraw your consent, which you can do at any time by contacting us using the details at the end of this privacy notice. In some jurisdictions, your use of the Services may be taken as implied consent to the collection and processing of personal information as outlined in this privacy notice.
In addition, we may process your personal information where necessary to protect the vital interests of any individual.
4. HOW WE USE & SHARE INFORMATION COLLECTED
a. Personal Information: We primarily use the identification information you voluntarily share with us to:
- Customize your online and/or real estate transaction experiences and to carry out your online requests;
- Tell you about our products, services and other offerings;
- Contact you for a variety of reasons, such as providing you promotional or marketing information for our products or those of our affiliated companies;
- Put you in contact with one of our real estate broker franchisees so that they may provide you with information about properties for sale or rent;
- In certain instances, we may also share your personally identifiable information with our third-party vendors and marketing partners that, among other activities: perform functions on our behalf (or on behalf of our affiliated companies); administer our offerings; provide us marketing or promotional assistance; analyze our data; assist us with customer service; and offer other services and products that may be relevant to the purchase or sale of real estate. Our vendors agree to use this information, and we share information with them, only to carry out our requests. Under no circumstances do we share mobile telephone numbers with third party vendors or marketing partners without your express approval;
- On occasion, we use your identification information to validate your identity;
- As for usage tracking data, we primarily use that information to operate and improve our consumer applications, and to further our marketing efforts.
b. Non-PII: We use non-PII in a variety of ways, including to:
- Help analyze site traffic, understand customer needs and trends;
- Carry out targeted promotional activities;
- Improve our services and offerings.
We may use your non-PII by itself or aggregate it with information we have obtained from others. We may share your non-PII with our affiliated companies and third parties to achieve these objectives and others, but remember that aggregate information is anonymous information that does not personally identify any individual, device, or household.
5. UPDATING INFORMATION
If you would like to review the information about you that we have collected through our consumer applications, or to change that information, you can make that request by following the procedure indicated below in Section 10. We may require that you verify your identity before we process your request.
6. PROCESSING LOCATION
We process your personal information in the United States. For users located outside of the United States, please see Sections 16 European Union / European Economic Area for more detailed information.
7. ANTI-FRAUD DISCLOSURE
Electronic communications such as email, text messages and social media messaging, are neither secure nor confidential. While BHH Affiliates, LLC has adopted policies and procedures to aid in avoiding fraud, even the best security protections can still be bypassed by unauthorized parties. BHH Affiliates, LLC will never send you any electronic communication with instructions to transfer funds or to provide nonpublic personal information, such as credit card or debit numbers or bank account and/or routing numbers.
YOU SHOULD NEVER TRANSMIT NONPUBLIC PERSONAL INFORMATION, SUCH AS CREDIT OR DEBIT CARD NUMBERS OR BANK ACCOUNT OR ROUTING NUMBERS, BY EMAIL OR OTHER UNSECURED ELECTRONIC COMMUNICATION. EMAILS ATTEMPTING TO INDUCE FRAUDULENT WIRE TRANSFERS ARE COMMON AND MAY APPEAR TO COME FROM A TRUSTED SOURCE.
If you receive any electronic communication directing you to transfer funds or provide nonpublic personal information, EVEN IF THAT ELECTRONIC COMMUNICATION APPEARS TO BE FROM BHH Affiliates, LLC or its affiliates or franchisees, do not respond to it and immediately contact your real estate agent or title closer. Such requests, even if they may otherwise appear to be from BHH Affiliates, LLC, are likely part of a scheme to defraud you by stealing funds from you or using your identity to commit a crime.
To notify BHH Affiliates, LLC of suspected fraud related to your real estate transaction, send an email to firstname.lastname@example.org.
9. DATA RETENTION
We will retain your personal information for the period necessary to fulfill the purposes outlined in this privacy notice unless a longer retention period is required or permitted by law. We may retain personal information for longer where required by our legal and regulatory obligations, professional indemnity obligations, or where we believe it is necessary to establish, defend or protect our legal rights and interests or those of others. With respect to the data and files we handle as a processor, we retain this personal information in accordance with our clients’ instructions.
10. RIGHTS AND “OPT-OUT”
Marketing. You may opt out from receiving marketing-related communications from us on a going-forward basis by contacting us or by using the unsubscribe mechanism contained in each email. We will try to comply with your request(s) as soon as reasonably practicable. Please note that if you opt out of receiving marketing-related emails from us, we may still send you important administrative messages, from which you cannot opt out.
Cookies and similar technologies. Please review your browser or device settings for certain cookies and see above to exercise certain choices regarding cookies.
Access, amendment and deletion. Under applicable privacy laws, you may have the right to request to review, make amendments, have deleted or otherwise exercise your rights over your personal information that we hold, subject to certain legal limitations and requirements. If you are subject to such a privacy law, you may submit a request to us related to your personal information by submitting a request to us here.
We follow applicable law to take steps to keep your personal information accurate, complete and up-to-date. In your request that is covered by an applicable privacy law, please make clear what personal information you would like to have changed, whether you would like to have your personal information suppressed from our database or otherwise let us know what limitations you would like to put on our use of your personal information. We may only implement requests (a) where required by applicable law and (b) with respect to the personal information associated with the particular email address that you use to send us your request, and we may need to verify your identity before implementing your request. We will try to comply with your request as soon as reasonably practicable.
As outlined below, if you are a California resident or if you are in the European Union/European Economic Area, you may have additional rights.
Deactivation. You can deactivate your account at any time by contacting us at the email address at the bottom of this page. However, you will not be able to access many of the services to deactivate your account. Please note that even if you request deactivation of your account, it may take some time to fulfill this request.
Responding to Requests. Please note that we may need to retain certain information for recordkeeping purposes and/or to complete any transactions that you began prior to requesting a change or deletion. There may also be residual information that will remain within our databases and other records, which will not be removed. We may not always be able to fully address your request, for example if it would impact the duty of confidentiality we owe to others, or if we are legally entitled to deal with the request in a different way.
Additional information for certain jurisdictions. We are committed to respecting the privacy rights of individuals under all privacy laws applicable to us. Some privacy laws require that we provide specific information about individual rights to applicable consumers, which we have set forth at the end of this privacy notice:
California: if you are a California resident, you have certain rights, under California privacy laws, regarding your personal information as set forth in Section 15 below.
EU/EEA: if you are in the European Union / European Economic Area, we provide further details about your rights under the GDPR in Section 16 below.
The Services are not intended or directed to children under the age of 18, and we do not knowingly collect any personal information, or knowingly track the use of our Services, from children. If we have actual knowledge that personal information about a child under 18 years old has been collected, then we will take appropriate steps to try and delete such personal information.
12. THIRD-PARTY WEBSITES
13. EFFECTIVE DATE OF THIS POLICY
You may contact us regarding privacy matters by mail at the address below or by selecting the CONTACT US button here or the link in the footer at the bottom of this page.
Berkshire Hathaway HomeServices Stephan Real Estate
400 Boston Post Rd.
Sudbury, MA 01776 US
15. CALIFORNIA PRIVACY RIGHTS
In this section, we provide information for California residents, as required under California privacy laws, including the California Consumer Privacy Act (“CCPA”), which requires that we provide California residents certain specific information about how we handle their personal information, whether collected online or offline. This section does not address or apply to our handling of publicly available information made lawfully available by state or federal governments or other personal information that is subject to an exemption under the CCPA.
Categories of personal information that we collect. Our collection, use and disclosure of personal information about a California resident will vary depending upon the circumstances and nature of our interactions or relationship with such resident. The table below sets out generally the categories of personal information (as defined by the CCPA) about California residents that we collect, sell, and disclose to others for a business purpose. We collect these categories of personal information from the sources described and for the purposes also detailed below.
A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver's license number, passport number, or other similar identifiers.
B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).
A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories.
C. Protected classification characteristics under California or federal law.
Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).
D. Commercial information.
Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
E. Biometric information.
Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.
F. Internet or other similar network activity.
Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement.
G. Geolocation data.
Physical location or movements.
H. Sensory data.
Audio, electronic, visual, thermal, olfactory, or similar information.
I. Professional or employment-related information.
Current or past job history or performance evaluations.
J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).
Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.
K. Inferences drawn from other personal information.
Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
Personal information does not include:
Publicly available information from government records.
De-identified or aggregated consumer information.
Information excluded from the CCPA's scope, like:
- Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;
- Personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994.
We obtain the categories of personal information listed above from the following categories of sources:
- Information from you that you actively provide: We collect this information from sources including from online forms, e-mail, and via telephone.
- Information from you that you provide passively from your use of your sites and services: We collect this information from sources including from a web browser, e-mail, app, or smartphone.
- Third Parties (information we collect about you from third party sources): We collect this from sources including marketing partners, lead generators, and website and app vendors.
Use of Personal Information. We may use or disclose the personal information we collect for one or more of the following business purposes:
- To fulfill or meet the services for which the information is provided.
- To provide you with information, products or services that you request from us.
- To provide you with email alerts, event registrations and other notices concerning our products or services, or events or news, that may be of interest to you.
- To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collections.
- To improve our website and present its contents to you.
- For testing, research, analysis and product development.
- As necessary or appropriate to protect the rights, property or safety of us, our clients or others.
- To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
- As described to you when collecting your personal information or as otherwise set forth in the CCPA.
- To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us is among the assets transferred.
We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.
Sharing Personal Information. We may disclose your personal information to a third party for a business purpose. When we disclose personal information for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract.
In the preceding twelve (12) months, we have disclosed the following categories of personal information for a business purpose:
Category A: Identifiers.
Category B: California Customer Records personal information categories.
Category C: Protected classification characteristics under California or federal law.
Category D: Commercial Information
Category I: Professional or employment-related information.
We disclose your personal information for a business purpose to the following categories of third parties:
- Our affiliates.
- Our real estate broker franchisees.
- Service providers.
- Third parties to whom you or your agents authorize us to disclose your personal information in connection with products or services we provide to you.
Categories of Personal Information Sold. The CCPA defines a “sale” as disclosing or making available to a third-party personal information in exchange for monetary or other valuable consideration. While we do not disclose personal information to third parties in exchange for monetary compensation from such third parties, we do disclose or make available the categories of personal information that we collect to our affiliate and subsidiary companies. We also may make certain categories of personal information available to third parties, in order to receive certain services or benefits from them (such as when we allow third party tags to collect browsing history and other information on our Services to improve and measure our ad campaigns), including:
- Category A. Identifiers.Name, contact information and other identifiers
- Category B. Personal information categories listed in the California Customer Records statute.Customer Records, Profiles and inferences
- Category C. Protected classification characteristics under California or federal law. Customer Records, Profiles and inferences.
- Category D. Commercial Information.Usage data, records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
Rights of California residents. California law grants California residents certain rights and imposes restrictions on particular business practices as set forth below.
Do-Not-Sell: California residents have the right to opt-out of our sale of their personal information Opt-out rights can be exercised by clicking on the “Do Not Sell My Personal Information” (or similar link) at the bottom of this page or the homepage of our website. We do not sell personal information about residents who we know are younger than 16 years old without opt-in consent.
Initial Notice: We are required to notify California residents, at or before the point of collection of their personal information, the categories of personal information collected and the purposes for which such information is used.
Request to Delete: California residents have the right to request deletion of their personal information that we have collected about them and to have such personal information deleted, except where an exemption applies. We will respond to verifiable requests received from California residents as required by law.
Request to Know: California residents have the right to request and, subject to certain exemptions, receive a copy of the specific pieces of personal information that we have collected about them in the prior 12 months and to have this delivered, free of charge, either (a) by mail or (b) electronically in a portable and, to the extent technically feasible, readily useable format that allows the individual to transmit this information to another entity without hindrance. California residents also have the right to request that we provide them certain information about how we have handled their personal information in the prior 12 months, including:
- categories of personal information collected;
- categories of sources of personal information;
- business and/or commercial purposes for collecting and selling their personal information;
- categories of third parties/with whom we have disclosed or shared their personal information;
- categories of personal information that we have disclosed or shared with a third party for a business purpose;
- categories of personal information collected;
- categories of third parties to whom the residents’ personal information has been sold and the specific categories of personal information sold to each category of third party.
California residents may make a Request to Know up to twice every 12 months. We will respond to verifiable requests received from California residents as required by law.
- Right to non-discrimination: The CCPA prohibits discrimination against California residents for exercising their rights under the CCPA. Discrimination may exist where a business denies or provides a different level or quality of goods or services, or charges (or suggests that it will charge) different prices, rates, or penalties on residents who exercise their CCPA rights, unless doing so is reasonably related to the value provided to the business by the residents’ data.
- Financial incentives: A business may offer financial incentives for the collection, sale or deletion of California residents’ personal information, where the incentive is not unjust, unreasonable, coercive or usurious, and is made available in compliance with applicable transparency, informed consent, and opt-out requirements. California residents have the right to be notified of any financial incentives offers and their material terms, the right to opt-out of such incentives at any time, and may not be included in such incentives without their prior informed opt-in consent. We do not offer any such incentives at this time.
Submitting Requests. Do-Not-Sell (Opt-out) Requests, Requests to Know, and Requests to Delete may be submitted:
- By clicking on the “Do Not Sell My Personal Information” at the bottom of the homepage of our website.
- Submitting a request to us online.
- Telephoning us at: 800-999-1120
We will respond to verifiable requests received from California residents as required by law. For more information about our privacy practices, contact us as set forth in the “Contact Us” section above.
You may only make a verifiable consumer request to know information twice within a 12-month period. We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm that the personal information relates to you. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.
Once we receive your verifiable consumer request, we will send you an acknowledgement letter within 10 days which will describe our verification process. We will respond to your request within 45 days, if we are able to verify your identity. Requests for deletion will require a separate confirmation that you want your information deleted.
We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
Please note we are unable to disclose or provide you with your Social Security Number, Driver’s License Number, or other government issued identification number, financial account number, any health insurance or medical identification number, an account password, or security questions and answers.
Rights Under California Shine the Light law. California residents may request from businesses with whom they have an established business relationship (1) a list of categories of personal information , such as name, address, e-mail address, and the type of services provided to the customer, that a business has disclosed to third parties during the immediately preceding calendar year for the third parties' direct marketing purposes and (2) the names and addresses of all such third parties. To request the above information please contact us by writing to us under the “Contact Us” section above. We will respond to such requests within 30 days of receipt.
Changes to Our Privacy Notice. BHH Affiliates, LLC reserves the right to amend this privacy notice at our discretion and at any time. When we make changes to this privacy notice, we will post the updated notice on the Website and update the notice’s effective date. Your continued use of our Website or Services following the posting of changes constitutes your acceptance of such changes.
16. EUROPEAN UNION / EUROPEAN ECONOMIC AREA
Individuals in the European Union (EU) and the European Economic Area (EEA) have the following rights, under the GDPR, regarding their personal information:
Right of access: You have the right to obtain from us confirmation as to whether or not personal information concerning you is being processed, and where that is the case, to request access to the personal information. The accessed information includes – among others - the purposes of the processing, the categories of personal information concerned, and the recipients or categories of recipient to whom the personal information have been or will be disclosed. You have the right to obtain a copy of the personal information undergoing processing. For further copies requested by you, we may charge a reasonable fee based on administrative costs.
Right to rectify and complete personal information: you can request the rectification of inaccurate data and the completion of incomplete data. We will inform relevant third parties to whom we have transferred your data about the rectification and completion if we are legally obliged to do so.
Right to erasure (right to be forgotten): You have the right to obtain from us the erasure of personal information concerning you in limited circumstances where:
- it is no longer needed for the purposes for which it was collected; or
- you have withdrawn your consent (where the data processing was based on consent); or
- following a successful right to object; or
- it has been processed unlawfully; or
- the data has to be erased in order to comply with a legal obligation to which we are subject.
We are not required to comply with your request to erase personal information if the processing of your personal information is necessary for:
- compliance with a legal obligation; or
- the establishment, exercise or defense of legal claims.
Right to restriction of processing: You have the right to obtain from us restriction of processing your personal information. In this case, the respective data will be marked and only be processed by us for certain purposes. This right can only be exercised where:
- the accuracy of your personal information is contested, to allow us to verify its accuracy; or
- the processing is unlawful, but you do not want the personal information erased; or
- it is no longer needed for the purposes for which it was collected, but you still need it to establish, exercise or defend legal claims; or
- you have exercised the right to object, and verification of overriding grounds is pending.
We can continue to use your personal information following a request for restriction, where:
- we have your consent; or
- to establish, exercise or defend legal claims; or
- to protect the rights of another natural or legal person.
Right to data portability: You have the right to receive the personal information concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you have the right to transmit those data to another entity without hindrance from us, but in each case only where the processing is (a) based on your consent or on the performance of a contract with you, and (b) also carried out by automated means.
Right to object: You have the right to object at any time to any processing of your personal information which has our legitimate interests as its legal basis. You may exercise this right without incurring any costs. If you raise an objection, we have an opportunity to demonstrate that we have compelling legitimate interests which override your rights and freedoms. The right to object does not exist, in particular, if the processing of your personal information is necessary to take steps prior to entering into a contract or to perform a contract already concluded.
Right to object to our use of your personal information for direct marketing purposes: You can request that we change the manner in which we contact you for marketing purposes. You can request that we not transfer your personal information to unaffiliated third parties for the purposes of direct marketing or any other purposes.
Right to withdraw consent: if you have given us your consent for the processing of your personal information, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Right to obtain a copy of safeguards: you can ask to obtain a copy of, or reference to, the safeguards under which your personal information is transferred outside the EU/EEA. We may redact data transfer agreements to protect commercial terms.
Right to lodge a complaint with your local supervisory authority: You have a right to lodge a complaint with your local supervisory authority if you have concerns about how we are processing your personal information. We ask that you please attempt to resolve any issue with us first, although you have a right to contact your supervisory authority at any time.