Effective Date and Last Updated: August 25, 2020

This Privacy Policy describes how Barnes & Noble Education, Inc. and its subsidiaries, including Barnes & Noble College Booksellers, LLC; MBS Textbook Exchange, LLC; Student Brands, LLC; or any of their affiliates or subsidiary companies (collectively, “BNED,” “we,” “us,” “our”), collect, use and process your information. When you purchase products from, register on or use BNED sites where this Privacy Policy is posted, certain of your information will be collected. This Privacy Policy applies to your use of the Services. Please review it carefully. This Privacy Policy will take precedence over any conflicting privacy terms related to any other BNED products or services you access and/or use.

Information Collected by Us.

Information You Provide.
BNED provides a family of products, Internet sites, services and browser-based and/or mobile applications (collectively, “Services”). BNED may collect information, including personal information, directly from you when you purchase products from us, register on or use the Services. For example, we collect information from you when you create a user account; make purchases through the Services; subscribe to receive emails or notifications; or otherwise communicate with us through the Services. “Personal Information” is information that identifies you specifically, and the types of Personal Information we collect may include your name, address, email address, phone number, grade, school and student identification number.

Information Collected Automatically.
Certain information about you may be collected automatically when you access or use the Services. This information may include Internet Protocol (“IP”) address, browser and device type, operating system characteristics, information about your use of the Services, and data regarding network-connected hardware (such as unique device identifiers, type, model, version, MAC address, device or session ID, functionality, performance data, and connection type). This information also may include clickstream data, which illustrates the page-by-page path(s) you take as you browse the Services.

1. We may use “cookies” to collect information about you when you visit the Services. Cookies are small text files placed on visitors’ computers/devices to store information about their activities on the Services, such as their user preferences. In addition to cookies, tracking GIFs may be set by us or third parties to collect information about your use of the Services. Tracking GIFs are small image files embedded within the content of the Services to monitor which parts of the Services are visited and which content is of interest.
2. Most web browsers are set to automatically accept cookies, but many provide options to allow you to stop accepting new cookies or to disable existing cookies. Please be aware that if you disable the cookies on your computer you may not be able to use certain features of the Services and disabling cookies may invalidate opt outs that rely on cookies to function.
3. Note that your browser settings may allow you to automatically transmit a “Do Not Track” signal to websites and online services you visit; such signals may prevent third parties from collecting information about your online activities over time and across different websites. California law requires us to disclose how the Services respond to these kinds of “Do Not Track” signals. Like many websites, the Services currently are not designed to respond to “Do Not Track” signals from visitors’ browsers. To learn more about “Do Not Track” you may wish to visit this site.
4. We will treat information that does not personally identify you as non-personal information, and we may de-identify, anonymize or otherwise convert your personal information to non-personal information. As permitted by applicable law, we reserve the right to use, process, share and otherwise exploit your non-personal information without limitation.
5. See the Cookie Disclosure, below, for additional information.

Use of Your Information.

Our Use of Your Information.
We may use information we obtain about you for various purposes, including to:

1. administer your account and respond to your requests, including service requests;
2. customize and facilitate the effective delivery of content supplied to you based on your use of the Services;
3. contact you regarding your use of the Services or, in our discretion, changes to our policies;
4. connect you with other users’ profiles;
5. perform and carry out our obligations under our bookstore management agreements with educational institutions;
6. prevent, investigate, and deal with fraud, violations of intellectual property rights, and other laws, as well as unauthorized use of the Services or of your account;
7. comply with legal requirements, industry standards, and our policies;
8. maintain and improve the Services and to develop new content and products; and
9. monitor and analyze trends, usage, and activities of visitors to the Services.

In addition, we may use information we obtain about you through your use of the Services as otherwise reasonable and appropriate to fulfill BNED’s legitimate business needs related to our operation of the Services and as otherwise permitted pursuant to our bookstore management agreements with educational institutions.

How We May Share Your Information.
Certain of our BNED affiliates within our corporate family, agents, vendors, consultants, the educational institutions with which we have  management agreements to perform retail bookstore services, and other service providers may have access to your Personal Information, such as name, address, email address, phone number, grade, school and student identification number, to carry out work on our behalf or to provide services or information to you. These third-party service providers and agents are prohibited from using your Personal Information for any purpose other than to provide this assistance.

We also may share information about you for the following purposes:

1. Disclosures as required by law or to prevent harm. We may disclose IP addresses, mobile device identifiers, or any other information we collect to identify users, in our discretion and without notice to you, for purposes of cooperating with copyright owners, Internet service providers, wireless service providers, or law enforcement agencies.
2. In the event of corporate sale or merger. BNED may share information with third parties (such as purchasers, potential purchasers and their advisers) if BNED or a portion of its assets is sold or offered for sale. We reserve the right to transfer any information we obtain about you through the Services in the event we sell or transfer all or a portion of our business or assets (including in the event of a merger, reorganization, or liquidation).
3. Sharing with educational institutions. We may share your information with your educational institution in accordance with, and as permitted by, applicable law.

Information You Disclose Publicly or to Others.

The Services may permit you to post or submit User Generated Content (“UGC”) including, without limitation, written content, user profiles, audio or visual recordings, computer graphics, pictures, data, or other content, including Personal Information.  If you choose to submit UGC to any public area of the Services, your UGC will be considered “public” and will be accessible by anyone, including BNED.  Notwithstanding anything to the contrary, unless otherwise explicitly agreed by us, Personal Information included in UGC is not subject to our usage or sharing limitations, or other obligations, and may be used and shared by BNED and third parties to the fullest extent not prohibited by applicable law.  We encourage you to exercise caution when making decisions about what you disclose in such public areas.  For more information on how UGC is treated under the Services’ Terms of Use click here.

California minors should see the “Minors” section below regarding potential removal of certain UGC they have posted on the Services.

Information You Disclose Publicly or to Others.

We may provide web page(s), or other mechanisms or processes allowing you to delete, correct, or update some of the Personal Information that we collect from you, and potentially certain other information about you (e.g., profile and account information).  We will make good faith efforts to make requested changes in our then-active databases as soon as practicable, but it is not always possible to completely change, remove or delete all of your information or public postings from our databases and residual and/or cached data may remain archived thereafter.  Further, we reserve the right to retain data: (a) as required by applicable law; and (b) for so long as reasonably necessary to fulfill the purposes for which the data is retained except to the extent prohibited by applicable law.

California minors should see the “Minors” section below regarding potential removal of certain UGC they have posted on the Services.

Minors.

Student Personal Information.
In order for students under 16 to access and use the Services, the student’s name and email address (collectively, “Student Personal Information”) is provided to us either by the student’s parent or guardian, or by the student’s educational institution, which is responsible for obtaining any required consent from the parent or guardian. The Student Personal Information provided to us will only be used for the purpose requested by the student’s parent, guardian or educational institution, and will be deleted after such use. Except as expressly set forth in this section, we do not knowingly collect Personal Information from children under the age of sixteen (16) and if we learn that we have received information from a user under the age of sixteen (16), we will delete this information in accordance with applicable law.

Minor CA Residents.
Any California residents under the age of eighteen (18) who have registered to use the Services, and who posted content or information on the Services, can request removal by contacting us in the manner described under the “How to Contact Us” section below, detailing where the content or information is posted and attesting that you posted it.  We will then make reasonable, good faith efforts to remove the post from prospective public view or anonymize it so the minor cannot be individually identified to the extent required by applicable law. This removal process cannot ensure complete or comprehensive removal. For instance, third parties may have republished or archived content by search engines and others that we do not control.

Links and Other Sites.

This Privacy Policy applies only to our information practices on the Services. This Privacy Policy does not apply to the other websites and social media sites you access and use, including those you may access from the Services. You are subject to the privacy policies of such other websites and social media sites.

Change of Ownership.

In the event that our ownership was to change as a result of a merger, acquisition, or any transaction involving the transfer of some or all of our assets by another company, your Services information may be transferred. We will provide you notice prior to any such transfer of your Personal Information.

Security.

We take steps to help protect Personal Information. We require password protection physical, electronic, and procedural safeguards to protect Personal Information. We limit access to Personal Information to employees and authorized who need to know that information in order to operate, develop or improve our Services. However, we cannot guarantee that your information will never be disclosed in a manner inconsistent with this Privacy Policy (for example, as a result of unauthorized acts by third parties that violate applicable law or our policies).

Changes to this Privacy Policy.

We may update this Privacy Policy from time to time. If this Privacy Policy changes, the revised Policy will be posted on our website. Therefore, you should review our Privacy Policy periodically. If there are significant changes to our information practices, you will be provided with appropriate online notice. You may be provided other privacy-related information in connection with your use of offerings from us, as well as for special features and services not described in this Privacy Policy that may be introduced in the future. Your continued use of this website or our Services and/or continued provision of Personal Information to us will be subject to the terms of the then-current Privacy Policy.

How to Contact Us.

If you have any questions or concerns about our Privacy Policy or its implementation, or if you believe there are inaccuracies in your account information you may contact us as follows:

By email:
CaliforniaPrivacy@BNED.com

By mail:
Barnes & Noble Education, Inc.
120 Mountain View Blvd.
Basking Ridge, NJ 07920
Attention: Chief Privacy Officer

Jurisdiction-Specific Terms.

Your California Privacy Rights.

The California Consumer Privacy Act (“CCPA”), which provides California Consumers certain rights regarding their Personal Information (“PI”) as those terms are defined in the CCPA, became effective on January 1, 2020. We are providing you with notice of the PI we collect and our purposes for that collection for data that may be subject to the CCPA (“CCPA Notice”). This CCPA Notice does not cover information that is outside of the scope of the CCPA. This notice also does not apply to data collected from employees, applicants or contractors or to data collected from individuals acting as representatives of another business in connection with business communications or transactions.

We collect PI directly from you, your device or browser, your education institution, our service providers and suppliers, and our corporate affiliates. We use and share PI for the following business purposes:

• to provide requested products and services;
• to advertise and offer new products and services;
• to improve our products and services;
• for quality assurance;
• for research and development; and
• for prevention of fraud and illegal activity.

We may also collect, use and share PI for our operational purposes as set forth in this Privacy Policy.

We collect the following categories of PI from Consumers which we share with our service providers, agents and licensees who perform services on our behalf, with our affiliates, and with your education institution:

• identifiers (e.g., name, phone number, email address, I.P. address);
• personal records (e.g., name, phone number, email address);
• customer account details / commercial information (e.g., your order history);
• internet usage information (e.g., information regarding your interaction with our online services); and
• inferences from PI collected (e.g., your preferences, your performance).

If you are a California Consumer and would like to register a request under your “right to know about personal information collected, disclosed or sold” (including right to obtain copies of specific pieces and/or information about categories of PI practices), “right to request deletion of personal information,” or “right to opt-out of the sale of personal information,” you can contact us at CaliforniaPrivacy@BNED.com or toll-free at 833-720-0427. You have the right to not receive discriminatory treatment in a manner prohibited by the CCPA because of exercising your rights under the CCPA.

To fulfill your CCPA request, we may require you to provide sufficient information to reasonably verify you are the Consumer about whom we collected PI. This verification process includes providing us at least two (2) unique data points, depending on the type of request.

Consumers have the right to exercise CCPA privacy rights via an authorized agent who meets the agency requirements of the CCPA. Authorized agent requests must include a copy of the agency agreement between the authorized agent and the consumer. We will ask the consumer to independently confirm the agency relationship.

The Right to Know

• Categories: You have the right, subject to statutory exceptions, to send us a request, no more than twice in a twelve-month period, for any of the following for the period that is twelve months prior to the request date:
  • The categories of PI we have collected about you.
  • The categories of sources from which we collected your PI.
  • The business or commercial purposes for our collecting or selling your PI.
  • The categories of third parties to whom we have shared your PI.
  • A list of the categories of PI disclosed for a business purpose in the prior 12 months, or that no disclosure occurred.
• Specific Pieces: You have the right, subject to statutory exceptions, to make or obtain a transportable copy, no more than twice in a twelve-month period, of your PI that we have collected in the period that is 12 months prior to the request date and are maintaining.

The Right to Deletion

You have the right, subject to statutory exceptions, to request that we delete your PI that we have collected directly from you and are maintaining. Note also that we are not required to delete your PI that we did not collect directly from you.

You may alternatively exercise more limited control of your PI by instead by canceling or modifying our email marketing communications you receive from us. You can do so by following the instructions contained within our promotional emails.

The Right to Opt Out of Sale of Personal Information

We do not “sell” PI that we collect from you, including PI of minors under the age of 16, in accordance with the definition of “sell” in the CCPA. We treat all PI that we collect from you as subject to a “do not sell” request.

We are not responsible for the completeness, accuracy or effectiveness of any third-party programs, tools or frameworks, or the information they provide.

Your Nevada Privacy Rights.

Under Nevada law, Nevada residents may opt out of the sale of certain “covered information” collected by operators of websites or online services.  We currently do not sell covered information, as “sale” is defined by such law, and we don’t have plans to sell this information.  However, if you would like to be notified if we decide in the future to sell Personal Information covered by this Nevada law, please email your name and email address to NevadaPrivacy@bned.com to provide your name and email address.  You are responsible for updating any change in your email address by the same method and we are not obligated to cross-reference other emails you may have otherwise provided us for other purposes.  We will maintain this information and contact you if our plans change. At that time, we will create a process for verifying your identity and providing an opportunity to verified consumers to complete their opt-out. Please become familiar with our data practices as set forth in this privacy policy.  We may share your data as explained in this privacy policy, such as to enhance your experiences and our services, and those activities will be unaffected by a Nevada do not sell request.  You may also have other choices regarding our data practices as set forth elsewhere in this privacy policy.

Effective Date and Last Updated: August 25, 2020