Privacy Policy

Effective as of December 29, 2019.

This Privacy Policy describes how BXP, Inc. and Boston Properties Limited Partnership and their affiliates and subsidiaries (collectively, “BXP”, “we”, “us”, or “our”) collects, uses, and shares your personal information in connection with the following (collectively, the “Services”):

  • our websites, online services and social media properties to which we post this Privacy Policy;
  • our direct marketing communications; and
  • our events and in certain other offline activities where we have posted this Privacy Policy

On occasion, we may inform you that our use of your personal information is subject to a different privacy policy or different terms, in which case the different privacy policies or terms will apply instead of this Privacy Policy.

How to reach us. If you have any questions or concerns about our Privacy Policy, please contact us at pricacypolicy@bxp.com.

We provide important information for California residents here.

Table of contents

Personal information we collect

Information you provide to us. Personal information you provide to us through the Services or otherwise includes:

  • Contact data, such as your first and last name, email and mailing addresses, zip code, phone number, professional title and company name.
  • Your content, such as text, images, audio, and video, along with the metadata associated with the files you choose to upload to or provide through the Services.
  • Registration data, such as your username and password for an online account or other information that may be related to a service, an account or an event you register for.
  • Profile data, such as your photograph, interests, preferences or other information you include in an online account profile.
  • Communications, such as your questions, feedback, or correspondence that you send us.
  • Employment information, such as your work history, educational background, and resume.
  • Financial data, such as your stated income, disposable income, credit history, budgeting, economic standing, or financial account numbers.
  • Identification, such as numbers or scans of your driver’s license or other government-issued identification.
  • Transaction data, such as information about payments to and from you and other details of products or services you have purchased from us.
  • Marketing data, such as your preferences for receiving communications about our activities, events, and publications, and details about how you engage with our communications.
  • Other information that we may collect which is not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

Information we obtain from social media platforms. Information you provide when you interact with us on social media.

Automatic collection.  We, our service providers and third party partners may automatically log information about you, your computer or mobile device, and your activity over time on the Services and other online services, such as:

  • Device data, such as your computer or mobile device operating system type and version number, manufacturer and model, browser type, screen resolution, IP address, unique identifiers (e.g., Apple’s ID for Advertising or Google’s Advertising ID), MAC addresses, general location information (such as city or state), and precise geolocation (if you permit our Services to access it from your device settings).
  • Online activity data, such as the website you visited before browsing to our website, pages or screens you viewed on the Services, how long you spent on a page or screen, navigation paths between pages or screens, information about your activity on a page or screen, access times, and duration of access.
  • Location data, such as when you enter certain retail centers using Wi-Fi technologies with a Wi-Fi enabled mobile device or when you authorize your mobile device to access your location while using the Services.
  • Security data, such as information collected by keycard scanners or security cameras about your use of our offices or facilities.

Cookies.  Some of our automatic data collection is facilitated by cookies and similar technologies.  Cookies are small data files placed on your computer when you visit a site.  We may set cookies when you use the Services to track user trends and patterns, help you navigate between pages efficiently, remember your preferences and generally improve your browsing experience.  Cookies used on the Services may also be set by analytics service providers and advertising partners.  In addition to cookies, the Services and our emails may use pixel tags (also known as web beacons and clear GIFs) to compile statistics about use of the Services, measure the success of our marketing campaigns, and indicate whether recipients of our emails open or click links within them.

Data About Others.  Users of the Services may have the opportunity to refer friends or other contacts to us and share their contact information with us. Please do not refer someone to us or share their contact information with us unless you have their permission to do so.

Data from other sources. We may combine personal information we receive from you with personal information we obtain from other sources, such as:

  • Data providers, such as information services and data licensors.
  • Public sources, such as social media platforms.
  • Business partners, such as joint marketing partners and event co-sponsors

How we use your personal information

We use your personal information for the following purposes:

Services Delivery.  We use your personal information to:

  • provide, operate and improve the Services
  • facilitate your authentication to the Services by logging into a third party platform, such as Facebook or Google
  • enable security features of the Services, such as by sending you security codes via email or SMS, and remembering devices from which you have previously logged in
  • facilitate social features of the Services, such as by identifying and suggesting connections with other users of the Services and providing chat or messaging functionality
  • communicate with you about the Services, including by sending you announcements, updates, security alerts, and support and administrative messages
  • understand your needs and interests, and personalize your experience with the Services and our communications
  • provide support and maintenance for the Services
  • to respond to your requests, questions and feedback

Research and development.  We may use your personal information for research and development purposes, including to analyze and improve the Services and our business.  As part of these activities, we may create aggregated, de-identified or other anonymous data from personal information we collect.  We make personal information into anonymous data by removing information that makes the data personally identifiable to you.  We may use this anonymous data and share it with third parties for our lawful business purposes, including to analyze and improve the Services and promote our business.

Marketing and advertising.  We and our third party advertising partners may collect and use your personal information for marketing and advertising purposes:

  • Direct marketing. We may send you BXP-related or other direct marketing communications as permitted by law.  You may opt-out of our marketing communications as described in the opt-out of marketing section below. 
  • Interest-based advertising.  We may contract with third-party advertising companies and social media companies to display ads on our Services and other sites. These companies may use cookies and similar technologies to try to tailor the ads you see online to your interests based on your activity over time across our Services and other sites, or your interaction with our emails. These ads are known as “interest-based advertisements.” You can learn more about your choices for limiting interest-based advertising, in the Advertising choices section below.

Compliance and operations.  We may use your personal information to:

  • operate our business;
  • comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities.
  • protect our, your or others’ rights, privacy, safety or property (including by making and defending legal claims);
  • enforce the terms and conditions that govern the Services; and
  • prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft.

For other purposes.  We may also use your personal information for other purposes described in this Privacy Policy or at the time we collect the information. 

How we share your personal information

We may share your personal information with the following parties and as otherwise described in this Privacy Policy or at the time of collection:

Affiliates.  Our corporate parent, subsidiaries, and affiliates, for purposes consistent with this Privacy Policy.

Service providers.  Unrelated companies and individuals that provide services on our behalf or help us operate the Services or our business (such as customer support, partner and investor support, hosting, payment processing, analytics, email delivery, marketing, and database management services). These third parties may use your personal information only as authorized under our contracts with them.

Partners. Third party partners who offer products and services that may be of interest to you. We may sometimes share your personal information with partners or enable partners to collect information directly via our Services, including when you have indicated your interest in certain products or services.

Advertising partners.  Third party advertising companies that collect information about your activity on the Services and other online services to help us advertise our services.

Other users. Other users of the Services or the public when you chose to make your profile or other personal information available to them through the Services, such as when you provide comments, reviews, survey responses, or other content.  We do not control how other users or third parties use any personal information that you make available to such users or the public. Please be aware that any information you post publicly can be cached, copied, screen captured or stored elsewhere by others (e.g., search engines) before you have a chance to edit or remove it.

Professional advisors. Professional advisors, such as lawyers, bankers, auditors and insurers, where necessary in the course of the professional services that they render to us.

Authorities and others. Law enforcement, government authorities, and private parties, when we believe in good faith it is necessary or appropriate for the compliance and operation purposes described above.

Business transferees.  Relevant participants in business transactions (or potential transactions) involving a corporate divestiture, merger, consolidation, acquisition, reorganization, sale or other disposition of all or any portion of the business or assets of, or equity interests in, BXP or our affiliates (including, in connection with a bankruptcy or similar proceedings).

For other purposes.  We may also share your personal information for other purposes described in this Privacy Policy or with your consent.

Your Choices

You have the following choices with respect to your personal information:

Opt-out of marketing communications.  You may opt out of marketing-related emails by following the opt-out or unsubscribe instructions at the bottom of the email, or by contacting us at privacypolicy@bxp.com.  You may continue to receive service-related and other non-marketing emails.

Cookies.  Most browsers let you remove or reject cookies.  To do this, follow the instructions in your browser settings.  Many browsers accept cookies by default until you change your settings.  Please note that if you set your browser to disable cookies, the Services may not work properly.  For more information about cookies, including how to see what cookies have been set on your browser and how to manage and delete them, visit www.allaboutcookies.org.

Advertising choices.  You may opt-out of receiving targeted online advertising on websites through members of the Network Advertising Initiative by clicking here or the Digital Advertising Alliance by clicking here. You may opt out of receiving targeted advertising in mobile apps through participating members of the Digital Advertising Alliance in the AppChoices mobile app, available here. Please note that we also may work with companies that offer their own opt-out mechanisms and may not participate in the opt-out mechanisms linked above.  In addition, your mobile device settings may provide functionality to limit use of the advertising ID associated with your mobile device for targeted online advertising purposes.  If you choose to opt out of targeted online advertisements, you will still see advertisements online but they may be less relevant to you. Not all companies participate in these opt-out programs, so even after opting out through them, you may still receive some cookies and interest-based from other companies.

Do Not Track.  Some Internet browsers may be configured to send “Do Not Track” signals to the online services that you visit.  We currently do not respond to “Do Not Track” or similar signals.  To find out more about “Do Not Track,” please visit http://www.allaboutdnt.com.

Wi-Fi/Location Information.  We employ Wi-Fi technologies across our locations.  When you enter one of our locations with a Wi-Fi enabled mobile device we may collect the MAC address, Internet Protocol address and OS device name of Wi-Fi enabled devices.  This information is automatically collected if your device’s Wi-Fi is enabled, even if you are not connected to a Wi-Fi network.  We may also collect your email address if you give explicit permission upon logging into the location’s Wi-Fi network.

Our vendor, Presence Aware, uses the MAC addresses we collect at our Prudential Center retail location to provide us a number of performance metrics such as average linger time in store, number of visitors in store, conversion of passing trade to customers, number of return customers and average time between visits.  Such MAC addresses are hashed and salted before being stored within Presence Aware’s servers.

Presence Aware should treat such information in accordance with its privacy policy. We encourage you to review the Presence Aware privacy policy.

If you do not wish for us to collect your device’s MAC address, Internet Protocol address or OS device name, turn off your device’s Wi-Fi.  If you would like to exclude your Wi-Fi enabled device from location tracking, you may do so through a simple opt-out form, available here.

Choosing not to share your personal information. If you do not provide information that we need to provide the Services, we may not be able to provide you with the Services or certain features.  We will tell you what information you must provide to receive the Services when we request it.

Third party platforms. Social media platforms or other third party platforms that you connect to the Service and where you authorize us to share your information with them (such as when you use options to access the Service by logging into the third party platform).

Other sites and services

The Services may contain links to websites and other online services operated by third parties.  These links are not an endorsement of, or representation that we are affiliated with, any third party.  In addition, our content may be included on web pages or other online services that are not associated with us. We do not control websites or other online services operated by third parties, and we are not responsible for their actions.  Other websites and online services follow different rules regarding the collection, use and sharing of your personal information.  We encourage you to read the privacy policies of the other websites and online services you use.

Security practices

We employ a number of technical, organizational, and physical safeguards designed to protect the personal information we collect.  However, security risk is inherent in all internet and information technologies and we cannot guarantee the security of your personal information.

International data transfers

We are headquartered in the United States and may use service providers in other countries.  Your personal information may be transferred to the United States or other locations where privacy laws may not be as protective as those in your state, province, or country.

Children

Our sites and online services are not intended for use by children under 16 years of age. If we learn that we have collected personal information from a child under 16 without the consent of the child’s parent or guardian as required by law, we will delete it.

Changes to this Privacy Policy

We may modify this Privacy Policy at any time. If we make material changes to this Privacy Policy, we will notify you by updating the effective date of this Privacy Policy and posting the modified Privacy Policy on the Services. We may also provide notification of changes via email if we have your email address, through the Services or in another manner that we believe is reasonably likely to reach you.

Any modifications to this Privacy Policy will be effective when posted (or as otherwise indicated at the time of posting). In all cases, your continued use of the Services after the posting of any modified Privacy Policy indicates your acceptance of the modified Privacy Policy.

Information for California Residents

Effective as of January 1, 2020.

The following sections apply only to California residents.  They describe how we collect, use and share the Personal Information of California residents in operating our business, and their rights with respect to that Personal Information.  For the purposes of this section, “Personal Information” has the meaning given in the California Consumer Privacy Act of 2018 (CCPA) but does not include information excluded from the scope of the CCPA.

Your California privacy rights

As a California resident, you have the rights listed below.  However, these rights are not absolute, and in certain cases we may decline your request as permitted by law.

  • Information.  You can request the following information about how we have collected and used your Personal Information during the past 12 months:
    • The categories of Personal Information that we have collected.
    • The categories of sources from which we collected Personal Information.
    • The business or commercial purpose for collecting and/or selling Personal Information.
    • The categories of third parties with whom we share Personal Information.
    • Whether we have disclosed your Personal Information for a business purpose, and if so, the categories of Personal Information received by each category of third party recipient.
    • Whether we’ve sold your Personal Information, and if so, the categories of Personal Information received by each category of third party recipient.
  • Access.  You can request a copy of the Personal Information that we have collected about you during the past 12 months.
  • Deletion.  You can ask us to delete the Personal Information that we have collected from you.
  • Opt out of sales.  If we sell your Personal Information, you can opt-out. In addition, if you direct us not to sell your Personal Information, we will consider it a request pursuant to California’s “Shine the Light” law to stop sharing your personal information covered by that law with third parties for their direct marketing purposes.
  • Opt-In.  If we know that you are younger than 16 years old, we will ask for your permission (or if you are younger than 13 years old, your parent’s or guardian’s permission) to sell your Personal Information before we do so.
  • Nondiscrimination. You are entitled to exercise the rights described above free from discrimination in the form of a legally prohibited increase in the price or decreasing in the quality of the Services.

How to exercise your rights

You may exercise your California privacy rights as follows:

Right to information, access and deletion

You may exercise the information, access and deletion rights by submitting a verifiable request to us by:

Verification

We reserve the right to confirm your California residency to process your requests and will need to confirm your identity to process your requests to exercise your information, access or deletion rights.  Government identification may be required. Consistent with California law, you may designate an authorized agent to make a request on your behalf. In order to designate an authorized agent to make a request on your behalf, you must provide a valid power of attorney, the requester’s valid government-issued identification, and the authorized agent’s valid government issued identification.  We cannot process your request if you do not provide us with sufficient detail to allow us to understand and respond to it.

Personal information we collect, use and disclose

This section summarizes how we collect, use and disclose Personal Information by reference to the categories specified in the CCPA, and describes our practices during the 12 months preceding the effective date of this Privacy Policy.

  • Identifiers, such as names, addresses, telephone numbers, email addresses, Internet Protocol addresses, MAC addresses, telephone numbers, and other similar identifiers.
  • Commercial Information, such as records of products or services purchased or obtained.
  • Financial information, such as bank account number, debit or credit card numbers, insurance policy numbers and other financial information.
  • Online identifiers, such as Internet Protocol addresses, cookies and other similar technology.
  • Internet or network information, such as browsing history.
  • Protected classification characteristics, such as age, gender, race or marital status.
  • Biometric information, such as facial imagery and voice recordings.

We do not sell Personal Information.  The business/commercial purposes for which we collect and use this information are described in the section above entitled How we share your personal information.

The categories of third parties and other recipients to which we disclose this information for business/commercial purposes are described in the section above entitled How we share your personal information.