INFORMATION FOR CALIFORNIA RESIDENTS: CALIFORNIA CONSUMER PRIVACY ACT (CCPA) POLICY

Effective as of March 14, 2023.

1. CALIFORNIA CONSUMER PRIVACY ACT

The California Consumer Privacy Act of 2018, as amended, (the “CCPA” for short) provides California residents certain rights with respect to their personal information, including, but not limited to the right to request disclosure of, delete (with exceptions), and control certain transfers of the personal information a business has collected about them. 

Our company, Boxed, LLC, which does business as Boxed ("Boxed"), provides products, services, and other features (the “Boxed Services”) to California residents through our mobile applications, Boxed.com, Boxed social media properties, other websites and blogs, and/or other software (the “Boxed Sites”). Here, we refer to California residents that use the Boxed Sites as “you” and “your”.  If you are a California resident, or will become one in the future, please read this policy, as well as our Privacy Policy, before using the Boxed Sites as they collectively govern our treatment of any information, including ”personal information”. The CCPA defines “personal information” as information that “identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household”.  It does not include publicly available, anonymized, aggregated or other information otherwise incapable of being associated with a person or household. The CCPA substantially limits the rights of our employees and those employees of entities with whom we transact business with respect to the information we collect in those contexts.  

2. WHAT ARE MY RIGHTS UNDER THE CCPA?

Right to Access (aka the Right to Know)

If you are a California resident, you have the right to request to know certain information about Boxed’s data practices in the twelve months prior to your request.  You can request the following:

• our information collection practices, including the categories of personal information we have collected, the categories of sources of such information, our business purposes for collecting, selling, or sharing such information, and the categories of third parties to whom we sold, and with whom we shared, such information, if any.
• our information sharing practices, including the categories of personal information that we disclosed for a business purpose and the categories of personal information “sold” (as defined broadly under the CCPA), and the associated categories of third parties to whom the information was sold.
• the specific pieces of personal information that we collected about you.
• the specific pieces of your personal information that we sell or share, if any.

Boxed will acknowledge receipt of your request, verify your identity and respond to your request with a downloadable report. You may request this information up to twice in a 12-month period.

You can request a report of your personal information in our possession or control by clicking this Request My Personal Information Report link and following the instructions to submit your request. 

Right to Deletion 

If you are a California resident, you have the right to request that Boxed delete your personal information that we have collected from you. You may make this request at any time.  Boxed will acknowledge receipt of your request, verify your identity and respond to your request. Deletion may include erasing, de-identifying or aggregating personal information so that it is no longer reasonably capable of identifying you or your household. 

Please note, however, that the CCPA allows us to retain certain personal information that may be subject to a valid deletion request, including for the following reasons:

• To complete a transaction you requested.
• To detect security incidents.
• To protect against deceptive, fraudulent, or illegal activity.
• To promote free speech.
• For scientific, historical or statistical research in the public interest.
• For internal uses of a company where such uses are reasonable and expected by you.
• To comply with a legal obligation. 

You can request that all or a portion of your personal information in our possession or control be deleted by clicking this Delete My Personal Information link and following the instructions to submit your request.  We will ask you to verify your request after it is submitted. Upon verifying your request, we will notify our service providers to also delete the information subject to your request.  

Right to Correct

If you are a California resident, you have the right to request that we correct any inaccurate personal information of yours that is in our possession.  We will promptly correct such information upon verifying your identity, or authority to make such request.

Right to Limit the Use and Disclosure of Sensitive Personal Information

Residents of California may, at any time, request that we cease using or disclosing any sensitive personal information that we have collected about them to only such uses or disclosures which are:

• necessary to perform the services or provide the goods which are reasonably expected by the average consumer requesting such goods or services.
• to help ensure the security and integrity of such information.
• for short-term, limited use, including, but not limited to, non-personalized advertising, provided we don’t disclose such information to a third party and it is not used to build a profile about you, or otherwise alter the your experience outside the current interaction with the business.
• to perform our own internal services, including, but not limited to, servicing accounts, fulfilling orders, and processing payments.
• to verify or maintain the quality or safety of our services or devices, and to improve, upgrade, or enhance our services or devices, and determining the proper scope of such activities.
• for determining any additional purposes for which we may use or disclose such information.
• to ensure the functionality of our operations.

Right to Opt-Out of Sale or Sharing of Your Personal Information

If you are a California resident, you have the right to opt-out of the “sale” or sharing of your personal information to third parties, including when we do so for cross-context behavioral advertising. We do not sell your information for monetary consideration, but we may share your information to a third party that provides us with services, such as helping us with advertising, data analysis, and security, which may technically fall under the definition of “for other valuable consideration,” which may be considered a “sale” under the broad terms of the CCPA. 

We will act on your request within 15 days of receipt, notify third parties receiving your information in the prior 90 days not to further sell or share your information, and notify you after we have instructed all such third parties. You may make this request at any time.

You can request that all or a portion of your personal information in our possession or control not be “sold” or “shared” by clicking this Do Not Sell or Share My Personal Information link and following the instructions to submit your request. 

Right to Opt-In Following Prior Opt-Out 

If you have previously elected to opt-out of the sale (as defined in the CCPA) or sharing of your personal information, you may elect to opt back in.  The opt-in process will require a two-step verification to confirm your election, and will be governed by the disclosures, policies, and procedures described here, in our Privacy Policy, and our Terms.  You can opt-in by e-mailing us at CCPA@boxed.com with “Opt-In to the Sale or Sharing of My Personal Information” in the subject line and your first and last name, email address and, if a Boxed account holder, current Boxed shipping address in the body of the e-mail or by clicking this Opt-In to the Sale or Sharing of My Personal Information link and following the instructions to submit your request.

Right to Portability

Under certain circumstances and to the extent technically feasible, you may, as a California resident, have the right to receive personal information we collected from you in a structured, commonly used, and machine-readable format so that you can provide that personal information to another entity. When you make a request to know specific pieces of information, the report we will provide will be in a structured, commonly used, and machine-readable format.

Right of Non-Discrimination

You have the right not to receive discriminatory treatment by us as a result of the exercise of your rights under the CCPA, including opting out of the sale of personal information.  Please note, however, that there could be a difference in the way the Boxed Sites or Boxed Services function related to deleting certain of your personal information (like reduced pricing for products shipped from location physically closer to you) or the inability to share personal information with certain partners or service providers (like auto-completing payment or shipping information or recommending items and discounts based on your purchase history).  These and similar differences are permitted under the CCPA.

3. ADDITIONAL INFORMATION ON EXERCISING YOUR RIGHTS

California residents may exercise their rights by submitting a request through our online forms, which are available through the links provided on this page, or by emailing us at CCPA@boxed.com. We will use the information you provide, and may request additional information, to confirm your identity.  Verification may require multi-step authentication procedures, such as email sent to the email address on record/provided, login to your Boxed account (if any), text message code verification, and/or a combination of the foregoing or related means. We do have the right to deny requests under certain circumstances. In such cases, we will notify you of the reasons.  We will not provide you with specific pieces of personal information if the disclosure creates a substantial, articulable, and unreasonable risk. 

You may submit a request through someone holding a valid Power of Attorney or an authorized agent acting on your behalf.  Authorized agents must have, and provide us with, written permission to make a request on your behalf and must provide necessary information to verify your own identity directly with us.  We will require any purported authorized agent to submit proof of authorization to make requests on your behalf.

If you are not a California resident, we may fulfill a request made on this page, but are not obligated to do so.  Boxed reserves the right to refuse to fulfill CCPA requests or elections in the event your California residency cannot be reasonably confirmed. 

4. NOTICE OF COLLECTION, SHARING, AND SALE

Boxed does not knowingly engage in the collection or disclosure for consideration of the personal information of minor children under the age of sixteen. The Boxed Sites and the features and services therein are not intended for use by those under eighteen years of age generally. 

Boxed may have disclosed and/or transferred for consideration certain personal information to third parties for certain business or commercial purposes, in the preceding twelve months. Such personal information included certain identifiers, commercial information, internet or other electronic network activity information, aspects of geolocation information, audio and visual information, and inferences from the foregoing categories of personal information. For more information about the categories of personal information that Boxed collects, and has collected over the preceding twelve months, please refer to the CCPA disclosure grid below.

CATEGORIES OF PERSONAL INFORMATION COLLECTED	CATEGORIES OF BUSINESS PURPOSES FOR USE	CATEGORIES OF SOURCES	CATEGORIES OF THIRD PARTIES WITH WHOM INFORMATION WHICH MAY BE SHARED	CATEGORIES OF THIRD PARTIES TO WHOM INFORMATION WHICH MAY BE SOLD
Identifiers, such as shipping, payment, account, profile, device, and network information	Display products and services; process orders; identity verification; legal and regulatory compliance; marketing, advertising, and customer care; security; fraud prevention, and investigation; site and services improvement; recruiting and hiring.	You; parties placing orders for You; marketing, advertising, fulfillment, and business partners; law enforcement and government entities; financial services providers; security, fraud prevention, and investigation services; web, mobile, network applications, and partners.	Household members, parties placing orders for You or Your ordering group for group orders; delivery, fulfillment, marketing, analytics, technology, and business partners; security, fraud prevention, and investigation services; law enforcement and government entities; insurance and financial services providers.
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).	Display products and services; process orders; identity verification; legal and regulatory compliance; marketing, advertising, and customer care; security; fraud prevention, and investigation; site and services improvement; recruiting and hiring.	You; parties placing orders for You; marketing, advertising, fulfillment, and business partners; law enforcement and government entities; financial services providers; security, fraud prevention, and investigation services; web, mobile, network applications, and partners.	Household members, parties placing orders for You or Your ordering group for group orders; delivery, fulfillment, marketing, analytics, technology, and business partners; security, fraud prevention, and investigation services; law enforcement and government entities; insurance and financial services providers.
Protected classifications under other laws	Identity/age verification in connection with order; display products and services, including those that are age-restricted; recruiting and hiring purposes; legal and regulatory compliance purposes.	You; marketing and business partners; security, fraud prevention, and investigation services; law enforcement and government entities; delivery partners; household members, parties placing orders for You or Your ordering group for group orders; recruiting and hiring services.	Law enforcement and government entities when lawfully requested.
Commercial, including order/sales information such as identifiers and products purchased.	Order processing, verification, and fulfillment/tracking; administering reward program; legal and regulatory compliance; internal research and development; site and services improvement; marketing, customer care and communications; security; security, fraud prevention, and investigation.	You; third parties such as those placing orders for You, product manufacturers, security, fraud prevention, and investigation services, law enforcement and government entities, web-enabled devices, and marketing, business, delivery, and marketplace partners.	Marketing, delivery, advertising, business and marketplace partners; product manufacturers; security, fraud prevention, and investigation services; law enforcement and government entities; household members, those placing orders for You or Your ordering group for group orders.
Internet or other electronic network activity, including browsing, site interaction and network activity; cookie information, such as cookies on the Boxed Sites, third-party websites, and other digital markers.	Site functionality and performance; internal research and development; discounts and promotions; marketing and advertising; legal and regulatory compliance; product availability; security; fraud prevention, and investigation.	You; Your activity on our site or systems; third parties, such as marketing and business partners, including marketplaces, security, fraud prevention, and investigation services, law enforcement and government entities; internet service providers; web, mobile, and network applications and partners.	Household members or Your ordering group for group orders; marketing, advertising, business, and marketplace partners; security, fraud prevention, and investigation services; law enforcement and government entities; operators and internet service providers; web, mobile, and network applications and partners.
Geolocation, including device location when accessing the Boxed Sites.	Display products and services; local offers/content; locations for product purchase or pick up; site functionality and performance; internal research and development.	You; Your activity on our site or systems; third parties such as marketing, advertising, and business partners; security, fraud prevention, and investigation services; law enforcement and government entities; web, mobile, and network applications and partners.	Marketing and business partners; security, fraud prevention, and investigation services; law enforcement and government entities.
Audio, electronic, visual, augmented reality, or spatial, such as voicemails or pictures.	Security, fraud prevention, and investigation; staff training and quality control; customer care and communications; legal and regulatory compliance; perform augmented reality functions; advertising activities.	You; Your activity on our sites and premises; third parties such as marketing, advertising, business, and marketplace partners; security, fraud prevention, and investigation services; law enforcement and government entities; web, mobile, and network applications and partners.	Marketing, advertising, business, and marketplace partners; security, fraud prevention, and investigation services; law enforcement and government entities; delivery partners; product manufacturers; web, mobile, and network applications and partners; media outlets.
Professional or Employment-Related, including work history and credentials. Education, including degree and other background.	Recruiting, hiring, and employment; training and retention.	You; or third parties such as employment agencies and background check services; Your references; government entities; networking sites; educational/trade institutions.	Third parties such as employment agencies and background check services; Your references; government entities; business partners; educational/trade institutions.
Sensitive[MJ1]  Personal Information such as a social security or passport number, racial or ethnic information, or health data
Inferences, including preferences based on profile activity, and order history and demographic information.	Customization; to create a profile reflecting your preferences and characteristics; product, services and recommendations; research and development.	The categories of personal information disclosed above.	Marketing, advertising, business, and marketplace partners, household members, those placing orders for You or Your ordering group for group orders; law enforcement and government entities; web, mobile, and network applications and partners.

5. RETENTION OF PERSONAL INFORMATION

We keep your personal information to enable your continued use of the Boxed Sites, for as long as it is required in order to fulfill the relevant purposes described in this CCPA Notice and our Privacy Policy, as permitted or as may be required by law, or as otherwise communicated to you. For example, we retain your transaction history so that you can review past purchases (and repeat orders if desired) and what addresses you have shipped orders to, and to improve the relevance of products and content we recommend.

6. WHAT IF I HAVE QUESTIONS?

If you cannot find the information you are looking for on this page, in our Privacy Policy or Terms, then please email us at CCPA@boxed.com and we will be in touch. 

7. GENERAL PRIVACY POLICY

To review our Privacy Policy, please click HERE.