Equinix, Inc. and its affiliated companies (“Equinix”, “we”, “us”, or “our”) in the United States and worldwide, in its three operating regions—the Americas, EMEA, and Asia-Pacific—are committed to respecting your privacy, and recognise the need for appropriate protection and management of any Personal Data that you may provide us.
This Privacy Statement explains our practices with respect to Personal Data we collect and process in connection with your relationship with us. This includes Personal Data we collect:
We encourage you to review this Privacy Statement to understand how we collect, process, use, share, and safeguard your Personal Data. If you have any questions, comments, or complaints about our practices, please contact us as outlined in the section “How to Contact Us or Submit a Request” at the end of this Privacy Statement.
Personal Data is any information that enables us to identify you and that is related to an identified or identifiable natural person (also known as a “Data Subject”), such as a name, an identification number, location data or an online identifier. In some jurisdictions (e.g. Switzerland), data protection and privacy laws also apply to identified or identifiable legal persons.
We may collect Personal Data from you and about you from a variety of sources. We strive to only collect Personal Data that is adequate, relevant, and limited to achieve the purpose(s) for which it was collected. In addition, we strive to keep all Personal Data accurate, complete, and reliable for its intended need, and we only retain your Personal Data for as long as necessary to achieve the purpose(s) for which it was collected, as explained more fully in the section “How Long We Retain Your Personal Data”. Finally, we may, from time to time, provide you with supplemental information at the time we collect your Personal Data to address unique or situational collection needs.
Examples of the ways in which we collect your Personal Data include:
You have choices about certain information we collect. When you are asked to provide your Personal Data, you may decline to do so; but if you choose not to provide your Personal Data that is necessary for us to provide any aspect of our services, you may not be able to use those services.
Moreover, to the extent that Personal Data you share with us is not your own (because, for example, you are a representative of an Equinix customer), you warrant that you have the right to provide such Personal Data, and you and the business with which you are associated shall be fully responsible for any liability arising from any such use of Personal Data, including indemnifying Equinix from any such liability. If you share Personal Data with us that is not your own, you agree to inform your agents, employees or any authorised personnel (e.g. contractors, partners or authorised third parties) (i) that their Personal Data may be processed by us; and (ii) of their rights regarding the processing of their Personal Data in accordance with this Privacy Statement and applicable data privacy and protection law.
Finally, we may collect data that is not identifiable to you or otherwise associated with you, such as aggregated data, which is not Personal Data. To the extent this data is stored or associated with your Personal Data, we will treat it as Personal Data; otherwise, it is not subject to this Privacy Statement.
We may use your Personal Data for one or more of the following business purposes:
In addition to the uses outlined above, you may also upload additional Personal Data to certain Equinix Portals, such as a photograph of yourself or other representatives from your organisation. This feature is completely voluntary, and Equinix will only use that Personal Data in connection with the purpose for which it was collected.
We will not disclose your Personal Data to any third party except as follows:
We do not sell your Personal Data to any third parties, whether for monetary or other valuable consideration and have not done so in the past 12 months. If we disclose your Personal Data as outlined above, we do so to facilitate the relevant services or our employment relationship with you and not for direct renumeration. Where we engage any service provider that will require access to and use of Personal Data to provide certain services for and under the instructions of Equinix, we take reasonable steps to make sure such service provider complies with applicable data protection and privacy laws.
Finally, we reserve the right to disclose your Personal Data if required to do so by law, in the good faith belief that such action is reasonably necessary to comply with applicable law, or to protect the rights, property, or safety of Equinix, its employees, customers or the public.
If you are an xScale customer or contractor, the details of the Equinix legal entity (“Equinix Services”) and our partner (and its subsidiaries) (“Hyperscale Entities”) that are jointly responsible for the processing of Personal Data described in this notice will be set out in your customer or vendor contract. References to "Equinix" in this notice should be read as if they were references to Equinix Services and each Hyperscale Entity, and references to "premises" should be read as if they were references to xScale data centres. Equinix Services and each Hyperscale Entity is responsible for complying with its respective obligations under applicable data protection laws, guaranteeing the lawful transfer of your Personal Data, and fulfilling any request you may make in respect of your Personal Data. We recommend that you direct any request to the Equinix Privacy Office at PrivacyOffice@equinix.com. However, you may make such request to Equinix Services or to any Hyperscale Entity, regardless of which entity is processing your personal data.
Considering the global reach of our business, we may transfer your Personal Data between our affiliated companies in the Americas, EMEA, and Asia-Pacific regions, including locations where the data privacy legislation may differ from that in your country or jurisdiction. In addition, we may transfer your Personal Data to certain contracted service providers, as outlined in the section “Disclosure of Your Personal Data to Third Parties”, to a region where the data privacy legislation may differ from that in your country or jurisdiction.
However, we have in place appropriate transfer legitimisation measures to guarantee the validity of Personal Data transfers to countries in which there is not a similar level of protection as required under applicable data protection laws. Those transfer legitimisation measures include the implementation of Binding Corporate Rules (enacted October 2019), as defined under European Union regulations, and entry into appropriate inter-company data transfer agreements based on the European Standard Contractual Clauses.
We process your Personal Data for, or based on, one or more of the following legal bases:
We employ reasonable and appropriate physical, technical, and organisational safeguards designed to promote the security of our systems and protect the confidentiality, integrity, availability, and resilience of your Personal Data. Those safeguards include: (i) the encryption of personal information where we deem appropriate; (ii) the deployment of technical safeguards; (iii) taking steps to make sure Personal Data is backed up and remains available in the event of a security incident; and (iv) periodic testing, assessment, and evaluation of the effectiveness of our safeguards.
However, no method of safeguarding information is completely secure. While we use measures designed to protect your Personal Data, we, unfortunately, cannot guarantee that our safeguards will be effective or sufficient. In addition, you should be aware that Internet data transmission is not always secure, and we cannot warrant that information you transmit to us is or will be secure.
We retain your Personal Data for only as long as necessary to carry out the processing activities described in this Privacy Statement, including but not limited to: (i) to provide services to you or to the business with which you are associated; (ii) to enter into or perform contracts with you or with the business with which you are associated; (iii) to comply with applicable laws, regulations, rules, and requests of relevant law enforcement and/or other governmental agencies; and (iv) to protect our rights, property, or safety, and the rights, property, and safety of our customers, users, and other third parties.
For Equinix customers, upon the expiry or earlier termination of the business relationships, we will archive Personal Data to preserve evidence and/or fulfil retention requirements under applicable laws or regulations. At the end of such archiving period (namely at the expiry of applicable statutes of limitation and/or minimum record retention requirements), we will delete the Personal Data from our systems and records.
We reserve the right to change the terms of this Privacy Statement at any time. If we do make changes, though, we will take steps to indicate that the Privacy Statement has been updated on this website.
Some of our websites utilise “cookies” and other tracking technologies. A cookie is a small data file that certain websites place on your hard drive when you visit them. A cookie file can contain information such as a user ID, which the site uses to track the pages you’ve visited, but the only Personal Data a cookie can contain is information you supply yourself. A cookie cannot read data off your hard disk or read cookie files created by other sites. Some parts of our website use cookies to gather information about user browsing sessions so that we can analyse how our websites are used in order to make improvements to them, to personalise your browsing experience (including by offering you tailored help within a browsing session), or to serve advertising. You have choices in relation to the cookies which are used, as explained below. Equinix does not share this information or sell it to any third party.
When you first navigate to an Equinix website, you will be given the opportunity to consent to certain cookies used by us, based on the purposes for which those cookies are used. Please note that some cookies—known as “strictly necessary” cookies—are essential in order for the website to function properly, and it is not possible to refuse these cookies.
You can also set most browsers to notify you if you receive a cookie or you may choose to block cookies with your browser. Please know, though, if you choose to delete or block your cookies, you will lose the ability to save certain preferences, such as your username and password. If you delete or block your cookies, you will, for example, need to re-enter your log-in credentials to gain access to certain parts of our website upon each visit.
Tracking technologies may record information such as Internet domain and host names, IP addresses, browser software and operating system types, clickstream patterns, user journey / path analysis, abandon rates, conversion rates, and dates and times that our site is accessed. We may also record and watch user browsing sessions on our websites to understand how our websites are used. Our use of cookies and other tracking technologies allows us to improve our website and your online experience. We may also analyse information that does not contain Personal Data for trends and statistics. To read more about cookies, please read our Cookie Notice.
Depending on applicable data protection and privacy laws, you may be entitled to a variety of legal rights regarding the collection and processing of your Personal Data. You may exercise these rights, to the extent they apply to you, by contacting us as outlined in the section “How to Contact Us or Submit a Request” at the end of this Privacy Statement or by following instructions provided in communications sent to you.
Note, however, that we may request certain reasonable additional information (that may include Personal Data) to help us authenticate your identity, your request and/or to clarify or understand the scope of such requests.
These rights vary depending on the particular laws of the jurisdiction applicable to you, but may include:
Where required by applicable law, we will respond to a valid request relating to your rights within one month of receipt, or within three months where a request is complex or challenging.
We respect your rights, and we will never discriminate or retaliate against you or the business with which you are associated as a result of your exercise of any right outlined in this Privacy Statement or afforded to you under applicable law.
You have choices about how we communicate with you and how we process certain Personal Data about you.
If you are a California resident, you have the right to request and obtain from us a list of what personal information we have disclosed to third parties for their own direct marketing purposes in the preceding calendar year, but please note that we do not disclose your Personal Data, protected under the law, to third parties for their own direct marketing purposes.
To facilitate our compliance with applicable data privacy and protection laws, such as the EU’s General Data Protection Regulation or the California Consumer Privacy Act, and to ensure strong and consistent support for our privacy practices within Equinix globally, we have established a Privacy Office to manage privacy compliance for Equinix and to coordinate support for our customers on privacy matters.
If you have any query or complaint about this Privacy Statement or our privacy practices, or if you wish to exercise any of your rights, you may contact us at any time using the following contact information:
If you are located in the European Union or European Economic Area, and you wish to raise a concern regarding our privacy practices, you have the right to do so with your local supervisory authority or with our lead supervisory authority, the Autoriteit Persoonsgegevens in the Netherlands, via its website https://autoriteitpersoonsgegevens.nl/en.
Equinix, Inc. (the “Company”, “we” or “us”) takes measures to ensure that its proprietary and confidential information remains private, and is committed to state-of the-art, in-house physical access security, which includes best-in-class processes and procedures and cutting-edge technology. To that end, we maintain a security system for access to our secure locations, such as one of our International Business Exchange Centres (“IBX Centres”). The system limits access to such locations to authorised employees, customers, agents, contractors, vendors and third-party business partners of the Company (“Authorised Person”).
The Company’s security system utilises certain data that may be considered biometric data under applicable laws for the purpose of authenticating some Authorised Persons’ identity and allowing those Authorised Persons access to a Company secure location. The Company has developed and published this policy to provide notice to Authorised Persons and ensure that such potentially biometric data is reasonably safeguarded and not retained for longer than necessary. This policy governs the collection, use, retention and destruction of the potentially biometric data we may collect in Illinois and is available to all Company employees and the public in the Privacy Policy section at the Company’s U.S. website.
Because such potentially biometric data is collected during the identity verification and authentication process, this policy is intended to comply with applicable federal, state and local laws, including but not limited to the Illinois Biometric Information Privacy Act.
Collection of Potentially Biometric Data.
Among the measures taken by the Company to protect its secure locations is the use of hand or finger scanning devices, which, along with an Authorised Person’s unique passcode, authenticate the Authorised Person’s identity. We collect hand or finger scan data to enrol you and provide you with biometrically authenticated access.
Depending on the security system in operation at the IBX Centre, the scanning technology measures certain aspects of an Authorised Person’s hand or finger, which are then immediately converted to an encrypted mathematical file (template) based on the distinct characteristics of the hand or finger. The template will then either be stored on a smart card, which we will issue to you, or we will store it on a secure database owned and maintained by the Company. No handprints or fingerprints are retained after we create the template.
Before collecting an Authorised Person’s hand or finger scan data and creating a template, the Company obtains a signed consent and written release from the Authorised Person or the Authorised Person’s legally authorised representative to obtain and use the hand or finger scan data as outlined in this policy. The Company will consider requests from an Authorised Person on an individual basis for accommodation or exemption, in whole or in part, from this policy.
Use of Potentially Biometric Data.
Where required to access an IBX Centre, an Authorised Person must present their unique personalised passcode and provide a non-intrusive hand or finger scan, or the smart card that contains the template, as applicable to the security system in operation at the IBX Centre. The Company will use the associated template solely for the purposes of authenticating an Authorised Person’s identity to access one of our secure locations. The template derived from the Authorised Person’s hand or finger scan is compared with the template associated with the Authorised Person’s passcode during the initial enrolment process to verify and authenticate the Authorised Person’s identity.
How We Provide Access to Potentially Biometric Data.
The Company utilises software and hardware in connection with its security system sourced from third-party vendors; however, no third party has access to the templates except as otherwise detailed in this policy. The Company will not sell, lease, trade or otherwise profit from an Authorised Person’s templates. Likewise, the Company will not disclose, re-disclose or otherwise disseminate templates without an Authorised Person’s consent unless required: (1) by any state law, federal law or municipal ordinance; or (2) by valid warrant or valid subpoena issued by a court of competent jurisdiction.
How We Store Potentially Biometric Data.
The data obtained from an Authorised Person’s hand scan are converted to an encrypted mathematical file that is then securely retained on applications and infrastructure owned and maintained by the Company. All templates obtained from an Authorised Person’s finger scan are stored on a smart card, which we will issue to you, and are not stored by the Company.
How We Retain, Safeguard and Destroy Potentially Biometric Data.
Unless otherwise required by law, the Company will retain an Authorised Person’s templates until the earlier of the following occurs:
The Company will permanently destroy an Authorised Person’s template upon expiry of the above-outlined time periods.
During the time of retention, the Company will store and safeguard the Authorised Person’s template using the reasonable standard of care within the industry and in a manner equally protective as that in which the Company stores, transmits and protects other confidential and sensitive data.
How to Contact Us.
If you have questions or concerns about this policy, please contact the site manager or the Equinix Security Desk, who will refer the question to the appropriate Company representative, or contact us at PrivacyOffice@equinix.com or on +1.866.977.3749.
Updates to this Policy.
The Company reserves the right to amend this policy at any time for any reason.
If any provision of this policy or any part thereof contravenes any appliable law, or if the operation of any provision is determined by applicable law or otherwise to be unenforceable, then such offending provision or part thereof shall be severed and the remaining provisions given full force and effect.
Any legal disputes, claims, controversies or disagreements arising out of or relating to this Illinois Biometric Data Policy or the Company’s procedures relating to the Authorised Person’s biometric data (“Claim”) shall be resolved by binding arbitration instead of the courts. All Claims may be brought only in the User’s individual capacity and not as Plaintiff, claimant or class member in a class, collective or other representative or joint proceeding. Arbitration is the exclusive form for the resolution of such Claims, and both the Company and Authorised Persons mutually waive their respective right to a trial before a judge or jury in federal or state court. The binding arbitration will be administered by the American Arbitration Association (“AAA”) in accordance with its rules and procedures then in effect and shall be confidential.