BNSF Railway Privacy Statement

BNSF is firmly committed to protecting your privacy and data while visiting our Internet site and using our services. The statement below provides details on the information we collect, our use of that information and our data security practices. Information collected by BNSF is used only for internal business purposes. BNSF does not, nor do we plan to, sell any information collected through our website. Further, BNSF does not plan to divulge information to any party other than BNSF affiliates, service providers and other third parties we use to help run our business.

This privacy statement explains what Personal Information we collect, what sources we used to collect it, how we use it, and how we disclose the information.

Information Collected

BNSF collects information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (“Personal Information”). Personal Information does not include publicly available information or information that is deidentified or aggregate consumer information.

BNSF may have collected the following categories of Personal Information within the last twelve months:

Use of Personal Information
In general, you can visit BNSF on the World Wide Web without telling us who you are or revealing any information about yourself. Our Web servers collect visitor domain names, not e-mail addresses or other personally identifying information. This information is compiled to measure the number of visits, average time spent on the site, pages viewed, and similar information. We use this information to measure the use of our site and to improve the user experience.

BNSF may also collect your location information, including your current latitude and longitude, when you access our website. We collect this information to personalize the content and functionality of the site and to help us understand how and where visitors are using our content and applications.

If you register for an account with the BNSF Customer Portal or enter into a separate agreement with us, BNSF may also collect, store, and use your biometric data to verify your identity and to keep an accurate record of your interactions with BNSF. The types of biometric data we may collect include, but are not limited to, a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. Any biometric data collected, stored, or used by BNSF shall be retained for a period of up to one year of your last interaction with the particular product or service with which you registered your information, at which point BNSF shall permanently destroy the biometric data in accordance with BNSF guidelines.

Additional information may be requested and collected to the extent you use our website, online tools, or otherwise interact with us as a part of your business relationship with BNSF. This information is necessary for BNSF to provide the services that you request and is used to respond to your inquiry, process your request, or validate authorization to grant access to specific account information. The amount of personal information you disclose to BNSF is at your discretion. The types of information we may collect is described below.

BNSF will only use your Personal Information as the law allows. BNSF may use or disclose the Personal Information we collect for one or more of the following purposes:

• Performing transactions and responding to your requests, including providing customer service and addressing inquiries.
• Making our Websites more intuitive and easy to use.
• Improving our services, including performing analysis and research and development.
• Protecting the security and effective functioning of our Websites and information technology systems.
• Providing relevant communications about BNSF services, to the extent we have obtained your consent.
• Addressing our compliance and legal obligations.
• Screening and selecting applicants for employment.
• Employment purposes (for example, benefits, administration and payroll).

BNSF will not collect additional categories of Personal Information or use the Personal Information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

Cookies
Some pages within www.bnsf.com use cookies so we can better serve you when you return to our site. You can set your browser to notify you when you receive a cookie, giving you the opportunity to decide whether to accept it or not.

Data Security
To prevent unauthorized access, maintain data accuracy, and ensure the correct use of Personal Information, we have put in place appropriate physical, electronic and managerial procedures to safeguard and secure the information we collect on our website, online tools, or other methods as a part of your business relationship with BNSF.

Selling or Sharing Personal Information
BNSF does not sell or share Personal Information for monetary value or for cross-context behavioral advertising. In order to perform a business purpose, BNSF may provide Personal Information collected to our affiliates, services providers, and other third parties we use to help run our business—such as vendors or website hosts.

When BNSF discloses Personal Information to an affiliate, service provider or other third party for a business purpose, we enter into a contract that describes the purpose and requires the recipient to both keep that Personal Information confidential and not use it for any purpose except for performing the contract. The service providers do not further collect, sell, or use the Personal Information except as necessary to perform the business purpose.

Retention of Personal Information
BNSF retains your Personal Information for as long as is necessary for the purposes described in this privacy statement, in accordance with applicable laws.

Your Rights
You may have rights under certain privacy and data protection laws such as the California Privacy Rights Act of 2020 (CPRA). BNSF is committed to protecting your data privacy and has provided the following information about your rights and how to exercise your rights:

Right to Know
You have the right to know:

• The categories of Personal Information we have collected about you;
• The categories of sources from which the Personal Information is collected;
• Our business or commercial purpose for collecting or selling Personal Information, if any;
• The categories of third parties with whom we share Personal Information, if any; and
• The specific pieces of Personal Information we have collected about you.

Please note that we are not required to:

• Retain any Personal Information about you that was collected for a single one-time transaction if, in the ordinary course of business, that information about you is not retained;
• Reidentify or otherwise link any data that, in the ordinary course of business, is not maintained in a manner that would be considered Personal Information; or
• Provide the Personal Information to you more than twice in a 12-month period.

In connection with any Personal Information we may sell or disclose to a third party for a business purpose, you have the right to know:

• The categories of Personal Information about you that we sold or disclosed and the categories of third parties to whom the Personal Information was sold or disclosed; and
• The categories of Personal Information that we sold or disclosed about you for a business purpose.

Right to Delete
Subject to certain exceptions set out below, on receipt of a verifiable request from you, we will:

• Delete your Personal Information from our records; and
• Direct any service providers to delete your Personal Information from their records.

Please note that we may not delete your Personal Information if it is necessary to:

• Complete the transaction for which the Personal Information was collected, provide a service requested by you, or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract between you and us;
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity;
• Debug to identify and repair errors that impair existing intended functionality;
• Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law;
• Comply with the California Electronic Communications Privacy Act or other similar laws;
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when our deletion of the information is likely to render impossible or seriously impair the achievement of such research, provided we have obtained your informed consent;
• Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us;
• Comply with an existing legal obligation; or
• Otherwise use your Personal Information, internally, in a lawful manner that is compatible with the context in which you provided the information.

Right to Correct
You have the right to request that inaccurate Personal Information collected by BNSF be corrected.

Right to Limit
Subject to certain exceptions, you have the right to request that BNSF limit the use of your Sensitive Personal Information. BNSF does not collect Sensitive Personal Information for the purpose of inferring characteristics about you.

Right to Non-Discrimination
You have the right to not be discriminated against by us because you exercised any of your rights under the CPRA or other laws. This means we cannot, based solely upon your elections regarding Personal Information:

• Deny goods or services to you;
• Charge different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties;
• Provide a different level or quality of goods or services to you; or
• Suggest that you will receive a different price or rate for goods or services or a different level or quality of goods or services.

Please note that Personal Information may be required as necessary to provide a rate and perform transportation or other services.

How to Contact Us
If you would like to exercise any of your rights as described in this Privacy Statement, please:

• Call us, toll-free, at 1-800-388-0120; or
• Email us at E-mail.

Please note that you may only make a data access or data portability disclosure request twice within a 12-month period.
Response Timing
When you make a request exercising your CPRA rights, BNSF will confirm receipt of your request within 10 business days and respond to a verifiable request within 45 or 90 days.

Verifying Your Identity
If you choose to contact us directly by email or phone, you will need to provide us with:

• Enough information to identify you including:
• Your full name,
• Address,
• Email,
• Phone number, and
• Customer or matter reference number (if applicable).
• Proof of your identity (e.g., a copy of your driver’s license or passport and a recent utility or credit card bill or BNSF transaction information); and
• A description of what right you want to exercise (such as disclosure or deletion rights) and the information to which your request relates.

We are not obligated to make a data access or data portability disclosure if we cannot verify that the person making the request is the person about whom we collected information, or is someone authorized to act on such person’s behalf.

Any Personal Information we collect from you to verify your identity in connection with you request will be used solely for the purposes of verification.

Changes to this Privacy Statement
We may update this Privacy Statement from time to time as our business (including privacy and security practices) changes, or as required by law.
The effective date of this Privacy Statement is provided below, and we encourage you to visit our site periodically to stay informed about our privacy and security practices.

We will post the most current version of our Privacy Statement on our site and ask for your consent to the changes if legally required.

Third Party Links
We also link to a number of third-party external sites. The inclusion of any link does not imply our endorsement of the external site company, its website, or the products and services it promotes or sells. We are not responsible or liable for the independent privacy policies of these third-party sites. You should consult the privacy policies at these sites to determine how your information may be used.

Effective Date:  December 20, 2019
Last Revised:    January 1, 2023