Effective Date and Last Updated: December 8, 2020
Thank you for reviewing our Privacy Policy. At Student Brands, one of our core values is to act as your trusted partner. We respect privacy and your rights to control your personal data.
Our Privacy Policy describes how we collect, use and share your personal data when you make an online or offline purchase, or register on or use our browser-based or mobile applications (we refer to them together as “Apps”), or websites, connected products and services where our Privacy Policy is posted (we refer to all of these together as “Websites”). Our Privacy Policy also describes choices you can make about how we collect, use and share your personal data.
We are Barnes & Noble Education, Inc. and our family of affiliated companies, including Student Brands, LLC, Barnes & Noble College Booksellers, LLC, MBS Textbook Exchange, LLC (we refer to our family of companies here as “Student Brands,” “we,” “us,” or “our”). Student Brands provides a family of products, services, Websites, and Apps (we refer to all of these together as "Services").
While registration with us is optional, please keep in mind that you will not be able to use many features of our Services unless you register with us. Except as noted in our Privacy Policy, our Privacy Policy will take precedence over any conflicting privacy terms related to any other Services you may access or use. (Please note certain features or Services referenced in our Privacy Policy may not always be offered on all Services.) Depending on how you interact with our Services, you may provide us and our service providers with, and the Services may include, hyperlinks to websites, locations, platforms, applications or services operated by third parties (we refer to all of these together as “Third-Party Services”) requiring information, which may include:
We, our service providers, and Third-Party Services may automatically receive or collect certain information from you when you use the Services. This information may include:
Cookies make web-surfing and browsing easier for you by saving your preferences so we can use the saved information to facilitate and improve your use of the Services. You can adjust your Internet browsers to reject cookies. However, if you disable the cookies on your computer you may not be able to use certain features of the Services and disabling cookies may invalidate “opt outs” that rely on cookies to function. We may use cookies to improve the quality of our Services, store user preferences, store and retrieve login information on your system, and personalize content and offers of interest to you.
Note that your browser settings may allow you to automatically transmit a “Do Not Track” signal to websites and online services you visit. Such signals may prevent third parties from collecting information about your online activities over time and across different websites. California law requires us to disclose how the Services respond to these kinds of “Do Not Track” signals. Like many websites, the Services currently are not designed to respond to “Do Not Track” signals from visitors' browsers. To learn more about “Do Not Track” visit here. Please see our Cookie Disclosure at the end of our Privacy Policy for more information.
We will treat information that does not personally identify you as non-personal information, and
we may de-identify, anonymize or otherwise convert your personal information to non-personal information. As permitted by the law applicable to us, we reserve the right to use, process, share and otherwise make use of your non-personal information without limitation.
Depending on your personal device and App permission settings, when using the Apps, we may collect or have access to:
We may use your information to:
We may share your information:
Student Brands may implement Google's Invisible reCAPTCHA technology on our Websites to reduce spam and prevent abuse of our Websites. Your use of the Invisible reCAPTCHA is subject to Googles' privacy policy here and Google's terms of service here.
We may offer sweepstakes, contests, and other promotions (we refer to each of them as a “Promotion”), including any Promotion jointly sponsored or offered by third parties, which may require submitting your information. If you voluntarily choose to enter a Promotion, your information, including personal information, may be disclosed to Student Brands, Promotion co-sponsors, service providers, and other third parties, including for administrative purposes and as required by law (on a winners list, for example). By entering, you are agreeing to the official rules that govern that Promotion, which may include consent to additional or differing data practices that will take precedence over those contained in our Privacy Policy in case of a conflict. Please review those official rules carefully.
The Services may permit you to post or submit User Generated Content (“UGC”) including, without limitation, written content, user profiles, audio or visual recordings, computer graphics, pictures, data, or other content, including personal information. If you choose to submit UGC to any public area of the Services, your UGC will be considered “public” and will be accessible by anyone, including Student Brands. Notwithstanding anything to the contrary, unless otherwise explicitly agreed by us, personal information included in UGC is not subject to our usage or sharing limitations, or other obligations, and may be used and shared by Student Brands and third parties to the fullest extent not prohibited by applicable law. We encourage you to exercise caution when making decisions about what you disclose in such public areas. For more information on how UGC is treated under the Services' Terms of Use click here.
California minors should read Section 11, “Minors,” about potential removal of certain UGC they have posted on the Services.
Third-Party Services may use their own Tracking Technologies to independently collect information about you and may solicit personal information from you. For example, Student Brands maintains its own branded pages on various social networks. When you visit these branded social media pages, the provider of the social network and other Third-Party Services may set Tracking Technologies on your browser or device.
Certain functionalities on the Services may permit interactions that you initiate between the Services and certain Third-Party Services, such as third-party social networks (“Social Features”). Examples of Social Features include: enabling you to send content such as contacts and photos between the Services and a Third-Party Services; “liking” or “sharing” Student Brands content; logging in to the Services using your Third-Party Services account (using Facebook Connect to sign- in to the Services, for example); and to otherwise connect the Services to a Third-Party Services (to pull or push information to or from the Services, for example). If you use Social Features, and potentially other Third-Party Services, information you post or provide access to may be publicly displayed on the Services (you can read more about in Section 6, “Information You Disclose Publicly or to Others,” or by the Third-Party Services that you use. If you post information on a third-party service that references the Services (by using a hashtag associated with our family of affiliated companies in a tweet or status update, for example), your post may be used on or in connection with the Services or otherwise by our family of affiliated companies. Student Brands and third parties may have access to certain information about you and your use of the Services and any Third-Party Services.
We may engage and work with service providers and other third parties to serve advertisements on the Services and Third-Party Services. Some of these ads may be tailored to your interest based on your browsing, across time, of the Services and elsewhere on the Internet, which may include use of data from cross-device usage, sometimes referred to as “interest-based advertising” and “online behavioral advertising” (“Interest-based Advertising”), which may include sending you an ad on a third-party service after you have left the Services (that is called “retargeting”). Please remember our advertisers' and ad networks' use of Tracking Technologies have their own privacy policies.
Regular cookies may generally be disabled or removed by tools available as part of most commercial browsers, and in some instances blocked in the future by selecting certain settings. Browsers offer different functionalities and options so you may need to set them separately. Also, tools from commercial browsers may not be effective with Flash cookies (also known as locally shared objects), HTML5 cookies, or other Tracking Technologies. For information on disabling Flash cookies, go to Adobe's website here.
Please be aware that if you disable or remove these technologies, some parts of the Services may not work and that when you revisit the Services your ability to limit browser-based Tracking Technologies is subject to your browser settings and limitations.
Some App-related Tracking Technologies in connection with non-browser usage (e.g., most functionality of a mobile app) can only be disabled by uninstalling the app. To uninstall an app, follow the instructions from your operating system or handset manufacturer. Apple and Google mobile device settings have settings to limit ad tracking, and other tracking, but these may not be completely effective.
Your browser settings may allow you to automatically transmit a “Do Not Track” signal to online services you visit. Note, however, there is no consensus among industry participants as to what “Do Not Track” means in this context. Like many online services, we currently do not alter our practices when we receive a “Do Not Track” signal from a visitor's browser. To find out more about “Do Not Track,” you can visit here, but please know we cannot take responsible for the completeness or accuracy of this or any third-party information. You have the right to request information from us about the Services that currently do not respond to "do not track" mechanisms featured in any Internet browser by contacting us (you can read Section 16, “How to Contact Us” to learn your options).
Many advertisers and service providers that perform advertising-related services for us and third parties participate in voluntary programs that provide tools to opt-out of such interest-based advertising such as the Digital Advertising Alliance's (“DAA”) Self- Regulatory Program for Online Behavioral Advertising. To learn more about how you can exercise certain choices regarding Interest-based Advertising for DAA members, visit here and here for information on the DAA's opt-out program for mobile apps. Some of these companies also are members of the Network Advertising Initiative (“NAI”). To learn more about the NAI and your opt-out options for their members, see here. You can also go to here to adjust your advertising preferences with our service provider, NextRoll, Inc. (which used to be called AdRoll).
Please be aware that, even if you can opt out of certain kinds of Interest-based Advertising, you may continue to receive other types of ads. Opting out only means that those selected, participating members should no longer deliver certain Interest-based Advertising to you but does not mean you will no longer receive any targeted content and/or ads (from other ad networks, for example). Also, if your browsers are configured to reject cookies when you visit these opt-out webpages, or you subsequently erase your cookies, use a different device or web browser or use a non-browser-based method of access (mobile app, for example), your browser-based opt-out may not, or may no longer, be effective.
We support the ad industry's 2009 Self-regulatory Principles for Online Behavioral Advertising you can read here and expect ad networks we directly engage that serve you Interest-based Advertising to do so as well, although we cannot guaranty their compliance. We are not responsible for the effectiveness of, or compliance with, any third-parties' opt-out options or programs or the accuracy of their statements regarding their programs.
In addition, we may serve ads on Third-party Services that are targeted to reach people on those services that are also identified on one of more of our databases (“Matched List Ads”). This is done by using Tracking Technologies, or by matching common factors between our databases and the databases of the Third-Party Services. We are not responsible for these Third-Party Services, including without limitation their security of the data. We are not responsible for such third parties' failure to comply with your or our opt-out instructions as they may not give us notice of opt-outs to our ads that you give to them, and they may change their options without notice to us or you.
We may use Third-Party Services such as Google Analytics and Sailthru to help us analyze our performance and our delivery of Services and advertising to you. For example, we may use Remarketing with Google Analytics, Google Display Network Impression Reporting, the DoubleClick Campaign Manager and Google Analytics Demographics and Interest Reporting.
You may exercise your choices regarding the use of cookies by Google Analytics by using the Google Analytics Opt-out Browser Add-on or by going to here and following the instructions.
You may exercise your choices regarding the use of cookies by our other analytics vendor, Sailthru, by clicking here and following the instructions.
We and third-party vendors, including Google, may use first-party cookies (such as the Google Analytics cookies) and third-party cookies (such as the DoubleClick cookie) together to report how your ad impressions, other uses of ad services, and interactions with these ad impressions and ad services are related to visits to our Websites.
You can make choices about how your information may be used by us to provide information and offers to you. You may opt out of commercial messages by clicking on the "opt out" or "unsubscribe" link provided with each message. These preferences do not apply to transactional communications, such as those that are related to your registration with us, required or important notices related to your use of our Services, or the fulfillment of a specific transaction.
You may be able to enable or disable certain permissions features (allowing the App to read, modify, or delete the contents of your USB storage; take pictures and videos; or view Wi-Fi connections, for example) by adjusting the permissions in your device. If you no longer want to provide any information to us through the Apps, you may uninstall them from your device.
We may provide web pages, other mechanisms or processes allowing you to delete, correct, or update some of the personal information that we collect from you, and potentially certain other information about you (profile and account information, for example). We will make good faith efforts to make requested changes in our then-active databases as soon as practicable, but it is not always possible to completely change, remove or delete all your information or public postings from our databases and residual and/or cached data may remain archived thereafter. We reserve the right to retain data: (a) as required by laws that apply to us; and (b) except when the laws that apply to us do not allow, for so long as we need it to reasonably achieve the purposes for which your data is maintained.
California minors should read Section 11.B., “Minor CA Residents” about potentially removing certain UGC they have posted on the Services.
Children under 16 should not use the Services and children under 16 must not give any us any personal information.
Any California residents under the age of 18 who have registered to use the Services, and who posted content or information on the Services, can request removal by contacting us (as described in Section 16, “How to Contact Us”) and including where the content or information is posted and affirming that you posted it. We will then make reasonable, good faith efforts to remove the post from prospective public view or anonymize it so the minor cannot be individually identified to the extent required by the law that applies to us. This removal process cannot ensure complete or comprehensive removal. For example, third parties may have republished or archived content by search engines and others that we do not control.
Our Privacy Policy applies only to our information practices on the Services. Our Privacy Policy does not apply to the other websites and social media websites you access and use, including those you may access from the Services; then the privacy policies of the other websites and social media websites.
If our ownership were to change because of a business merger, acquisition, or any transaction involving the transfer of some or all our assets by another company, your information may be transferred. We will provide you notice prior to any such transfer of your personal information.
We take steps to help protect your personal information. We require password protection as well as physical, electronic, and procedural safeguards to protect personal information. We limit access to personal information to employees and authorized users who need to know that information to operate, develop or improve our Services. However, we cannot guarantee that your information will never be disclosed in a manner inconsistent with our Privacy Policy (because of unauthorized acts by third parties that violate law applicable to us or our policies, for example).
We will likely update our Privacy Policy from time to time, so please review our Privacy Policy from time to time, too. If our Privacy Policy changes, we will post the revised Privacy Policy on our Websites. If there are significant changes to our practices, we will give you notice online. You may be provided other privacy-related information in connection with your use of the Services, as well as for special features and services not described in our Privacy Policy that may be introduced in the future. Your continued use of our Websites or Services, and/or continued provision of personal information to us will be subject to the terms of our then-current Privacy Policy.
If you have any questions or concerns about our Privacy Policy or its implementation, or if you believe there are inaccuracies in your account information, please contact us:
Student Brands, LLC
523 W 6th St. Suite 1234
Los Angeles, CA 90014
The controller of your personal data under our Privacy Policy is Student Brands, LLC, with an address of 523 W 6th St. Suite 1234, Los Angeles, CA 90014, Attention: Chief Privacy Officer. Our representative, VeraSafe Ireland Ltd., can be reached at Unit 3D North Point House, North Point Business Part, New Mallow Road, Cork T23AT2P, Ireland.
We process your personal data only if we have a legal basis to do so, including:
The purpose for which we use and process your information and the legal basis on which we carry out each type of processing is further explained here:
| Purposes for processing the information | Legal basis for processing the information |
|---|---|
| To deliver Services and features you desire. | It is necessary for us to process your personal data to deliver the Services and process transactions according to the applicable contract between us. |
| To improve our Services to you. | It is necessary for us to process your personal data to improve our Services to you according to the applicable contract between us. |
| To personalize content and offers and serve you advertising that may be of interest to you. | We will personalize content and offers to you and serve you advertising based on your interests and online activities if you have consented to this processing. |
| To respond to your inquiries. | It is necessary for us to process your personal data in this manner to respond to your inquiries according to the applicable contract between us. |
| To fulfill your request for products or Services. | It is necessary for us to process your personal data to fulfill your request for products or Services according to the applicable contract between us. |
| To use your login user ID and password to register you on your behalf and to give you access to Websites and Services as part of a “single sign-on” feature by our family of affiliated companies. | It is necessary for us to process your personal data to use carry out these activities according to the applicable contract between us. |
| To provide you with updates and other information regarding the Services. | It is necessary for us to process your personal data to provide you with updates and other information regarding the Services according to the applicable contract between us. |
| To share your information with the third party that employed you, engaged you, or authorized you to access and use the Services. | It is in the legitimate interests of the third party that employed you, engaged you, or authorized you to access and use the Services. We consider this use to be proportionate and will not be prejudicial or detrimental to you. |
| To analyze statistically Website usage and to customize our Website's content, layout and services. | It is in our legitimate interests to process your personal data to analyze our Website usage and to customize our Website's content, layout and services. We consider this use to be proportionate and will not be prejudicial or detrimental to you. |
| To enable our family of affiliated companies, and trusted third-party businesses that we do business with, who may have content and offers of interest to you. | It is in our legitimate interests to process your personal data to enable our family of affiliated companies who may have content and offers of interest to you. We process your personal data to enable our family of affiliated companies and trusted third-party businesses to send you offers and market to you only if you have consented to these activities. |
| To enable our service providers to perform certain activities on our behalf. | It is necessary for us to process your personal data in this manner to deliver the Services and process transactions according to the applicable contract between us. It is also in our legitimate interest to enable our service providers to perform certain activities on our behalf. We consider this use to be proportionate and will not be prejudicial or detrimental to you. |
| To offer you the opportunity to use our invitation service and application so that you can tell your friends about the Services. | We process your data for these activities only if you have given your consent to do so. |
| To administer our Websites, including troubleshooting, data analysis, testing, research, statistical and survey purposes; and to improve our Websites to ensure that consent options are presented in the most effective manner for you and your computer, device or other item of hardware through which you access the Websites. | For all these categories, it is in our legitimate interest to continually monitor and improve our Services and your experience of the Websites and to ensure network security. We consider this use to be proportionate and will not be prejudicial or detrimental to you. |
|
To keep our Websites safe and secure and to prevent detect fraud and abuse; and to comply with our legal obligations, policies, and procedures. We may process your personal data to respond to:
|
We conduct this processing to comply with our legal obligations and to protect the public interest. |
| To process otherwise for internal administrative and analytics purposes. | It is in our legitimate interest to process your personal data for internal administrative or analytics purposes. We consider this use to be proportionate and will not be prejudicial or detrimental to you. |
Some of our processing of your data will involve transferring your data outside the EEA. Some of our service providers are also based outside of the EEA, and their processing of your personal data will involve a transfer of data outside the EEA. This specifically includes to the United States. Where personal data is transferred to and stored in a country not determined by the European Commission as providing adequate levels of protection for personal data, we take steps to provide appropriate safeguards to protect your personal data, including entering into standard contractual clauses approved by the European Commission, obliging recipients to protect your personal data.
Student Brands will retain your personal data only for as long as necessary for the purposes it was retained, such as to enable you to use the Websites and your products or to provide Services to you. In some instances, we may retain data for longer periods to comply with applicable laws (including those regarding document retention), resolve disputes with any parties, and otherwise as necessary to allow us to conduct our business. All personal data we retain will be subject to our Privacy Policy and our internal retention guidelines.
You have the following rights:
To exercise any of these rights, please contact us according to Section 16, “How to Contact Us,” here. Please note that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under the applicable law apply.
We are providing you with notice of the PI we collect, and our purposes for that collection of data that may be subject to the CCPA (“CCPA Notice”). This CCPA Notice does not cover information that is outside of the scope of the CCPA. This notice also does not apply to data collected from employees, applicants or contractors or to data collected from individuals acting as representatives of another business in connection with business communications or transactions.
We collect PI directly from you, your device or browser, your education institution and/or the third party that employed you, engaged you, or authorized you to access and use the Services, service providers and suppliers, and our family of affiliated companies. We use and share PI for the following business purposes:
We may also collect, use and share PI for our operational purposes as set forth in our Privacy Policy
If you are a California Consumer and would like to register a request under your “right to know about personal information collected, disclosed or sold” (including the right to obtain copies of specific pieces of information about categories of PI practices), “right to request deletion of personal information,” or “right to opt-out of the sale of personal information,” you can contact us at CaliforniaPrivacy@BNED.com or toll-free at 833-720-0427. You have the right to not receive discriminatory treatment in a manner prohibited by the CCPA because of you exercising your rights under the CCPA.
To fulfill your CCPA request, we may require you to provide sufficient information to reasonably verify you are the California Consumer about whom we collected PI. This verification process includes providing us at least two unique data points, depending on the type of request.
California Consumers have the right to exercise CCPA privacy rights via an authorized agent who meets the agency requirements of the CCPA. Authorized agent requests must include a copy of the agency agreement between the authorized agent and the California Consumer. We will ask you to independently confirm the agency relationship if this section applies to you.
Categories. You have the right, subject to statutory exceptions, to send us a request, no more than twice in a twelve-month period, for any of the following, for the period that is twelve months prior to the request date:
Specific Pieces. You have the right, subject to statutory exceptions, to make or obtain a transportable copy, no more than twice in a twelve-month period, of your PI that we have collected in the period that is 12 months prior to the request date and are maintaining.
You have the right, subject to statutory exceptions, to request that we delete your PI that we have collected directly from you and are maintaining. Note also that we are not required to delete your PI that we did not collect directly from you.
You may alternatively exercise more limited control of your PI by instead canceling or modifying our email marketing communications you receive from us. You can do so by following the instructions contained within our promotional emails.
We do not “sell” PI that we collect from California Consumers, including PI of minors under the age of 16, in accordance with the definition of “sell” in the CCPA. We treat all PI that we collect from you as subject to a “do not sell” request.
We work with service providers and partner with advertising companies that use Tracking Technologies to collect information about your visits to Websites and Third-Party Services, and then use that information to deliver advertisements relevant to your interests. There is not yet a consensus as to whether third party cookies and/or other Tracking Technologies associated with our Websites and Apps constitute a “sale” of your PI as defined by the CCPA. You may opt out of Interest-based Advertising using ad industry opt out tools by visiting here or here. To effectively manage cookies via this cookie settings tool, you must set cookie preferences on all browsers and all devices that you use. If you clear the cookies on your device, you may need to set your cookie preferences again.
We are not responsible for the completeness, accuracy or effectiveness of any third-party programs, tools or frameworks, or the information they provide.
If you are a California resident, in addition to the rights set forth above, California's “Shine the Light” law permits customers in California to request certain details about how their personal information is shared with third parties and, in some cases, their affiliates if that personal information is shared for those third parties' and their affiliates' own direct marketing purposes. We do not share personal information with third parties or their affiliates for those third parties' or their affiliates' own direct marketing purposes. Californians may request information about our compliance with this law by contacting us at CaliforniaPrivacy@BNED.com or Barnes & Noble Education, Inc., 120 Mountain View Blvd., Basking Ridge, NJ 07920, Attention: Chief Privacy Officer.
To make a request, please provide sufficient information for us to determine if this applies to you, attest to the fact that you are a California resident, and provide your current California address to which we will send our response. Your inquiry must specify “California Privacy Rights Request” in the subject line of the email or the first line of the letter and include your name, street address, city, state, and ZIP code. Please note that we are only required to respond to one request per customer each year.
Under Nevada law, Nevada residents may opt out of the sale of certain “covered information” collected by operators of websites or online services. We currently do not sell covered information, as “sale” is defined by such law, and we do not have plans to sell this information. However, if you would like to be notified if we decide in the future to sell Personal Information covered by this Nevada law, please email your name and email address to NevadaPrivacy@bned.com. You are responsible for updating any change in your email address by the same method and we are not obligated to cross-reference other emails you may have otherwise provided us for other purposes. We will maintain this information and contact you if our plans change. At that time, we will create a process for verifying your identity and providing an opportunity to verified consumers to complete their opt-out. Please become familiar with our Privacy Policy. We may share your data as explained in our Privacy Policy, such as to enhance your experience and our Services, and those activities will be unaffected by a Nevada do not sell request. You may also have other choices regarding our data practices as set forth elsewhere in our Privacy Policy.
Effective Date and Last Updated: December 8, 2020