PRIVACY POLICY

Effective Date and Last Updated: January 06, 2020

This Privacy Policy describes how Barnes & Noble Education, Inc. and its subsidiaries, including Barnes & Noble College Booksellers, LLC; MBS Textbook Exchange, LLC; Student Brands, LLC; or any of their affiliates or subsidiary companies (collectively, “BNED,” “we,” “us,” “our”), collect, use and process your information. When you purchase products from, register on or use BNED sites where this Privacy Policy is posted, certain of your information will be collected. This Privacy Policy applies to your use of the Services. Please review it carefully. This Privacy Policy will take precedence over any conflicting privacy terms related to any other BNED products or services you access and/or use.

Information Collected by Us.

Information You Provide.

BNED provides a family of products, Internet sites, services and browser-based and/or mobile applications (collectively, “Services”). BNED may collect information, including personal information, directly from you when you purchase products from us, register on or use the Services. For example, we collect information from you when you create a user account; make purchases through the Services; subscribe to receive emails or notifications; or otherwise communicate with us through the Services. “Personal Information” is information that identifies you specifically, and the types of Personal Information we collect may include your name, address, email address, phone number, grade, school and student identification number.

Information Collected Automatically.

Certain information about you may be collected automatically when you access or use the Services. This information may include Internet Protocol (“IP”) address, browser and device type, operating system characteristics, information about your use of the Services, and data regarding network-connected hardware (such as unique device identifiers, type, model, version, MAC address, device or session ID, functionality, performance data, and connection type). This information also may include clickstream data, which illustrates the page-by-page path(s) you take as you browse the Services.

  1. We may use “cookies” to collect information about you when you visit the Services. Cookies are small text files placed on visitors’ computers/devices to store information about their activities on the Services, such as their user preferences. In addition to cookies, tracking GIFs may be set by us or third parties to collect information about your use of the Services. Tracking GIFs are small image files embedded within the content of the Services to monitor which parts of the Services are visited and which content is of interest.
  2. Most web browsers are set to automatically accept cookies, but many provide options to allow you to stop accepting new cookies or to disable existing cookies. Please be aware that if you disable the cookies on your computer you may not be able to use certain features of the Services and disabling cookies may invalidate opt outs that rely on cookies to function.
  3. Note that your browser settings may allow you to automatically transmit a “Do Not Track” signal to websites and online services you visit; such signals may prevent third parties from collecting information about your online activities over time and across different websites. California law requires us to disclose how the Services respond to these kinds of “Do Not Track” signals. Like many websites, the Services currently are not designed to respond to “Do Not Track” signals from visitors’ browsers. To learn more about “Do Not Track” you may wish to visit this site.
  4. We will treat information that does not personally identify you as non-personal information, and we may de-identify, anonymize or otherwise convert your personal information to non-personal information. As permitted by applicable law, we reserve the right to use, process, share and otherwise exploit your non-personal information without limitation.
  5. See the Cookie Disclosure, below, for additional information.

Use of Your Information.

Our Use of Your Information.

We may use information we obtain about you for various purposes, including to:

  1. administer your account and respond to your requests, including service requests;
  2. customize and facilitate the effective delivery of content supplied to you based on your use of the Services;
  3. contact you regarding your use of the Services or, in our discretion, changes to our policies;
  4. connect you with other users’ profiles;
  5. perform and carry out our obligations under our bookstore management agreements with educational institutions;
  6. prevent, investigate, and deal with fraud, violations of intellectual property rights, and other laws, as well as unauthorized use of the Services or of your account;
  7. comply with legal requirements, industry standards, and our policies;
  8. maintain and improve the Services and to develop new content and products; and
  9. monitor and analyze trends, usage, and activities of visitors to the Services.

In addition, we may use information we obtain about you through your use of the Services as otherwise reasonable and appropriate to fulfill BNED’s legitimate business needs related to our operation of the Services and as otherwise permitted pursuant to our bookstore management agreements with educational institutions.

How We May Share Your Information.

Certain of our BNED affiliates within our corporate family, agents, vendors, consultants, the educational institutions with which we have management agreements to perform retail bookstore services, and other service providers may have access to your Personal Information, such as name, address, email address, phone number, grade, school and student identification number, to carry out work on our behalf or to provide services or information to you. These third-party service providers and agents are prohibited from using your Personal Information for any purpose other than to provide this assistance. We also may share information about you for the following purposes:

  1. Disclosures as required by law or to prevent harm. BNED may share information with third parties (such as purchasers, potential purchasers and their advisers) if BNED or a portion of its assets is sold or offered for sale. We reserve the right to transfer any information we obtain about you through the Services in the event we sell or transfer all or a portion of our business or assets (including in the event of a merger, reorganization, or liquidation).
  2. In the event of corporate sale or merger. BNED may share information with third parties (such as purchasers, potential purchasers and their advisers) if BNED or a portion of its assets is sold or offered for sale. We reserve the right to transfer any information we obtain about you through the Sites in the event we sell or transfer all or a portion of our business or assets (including in the event of a merger, reorganization, or liquidation).
  3. Sharing with educational institutions. We may share your information with your educational institution in accordance with, and as permitted by, applicable law.

Information You Disclose Publicly or to Others.

The Services may permit you to post or submit User Generated Content (“UGC”) including, without limitation, written content, user profiles, audio or visual recordings, computer graphics, pictures, data, or other content, including Personal Information. If you choose to submit UGC to any public area of the Services, your UGC will be considered “public” and will be accessible by anyone, including BNED. Notwithstanding anything to the contrary, unless otherwise explicitly agreed by us, Personal Information included in UGC is not subject to our usage or sharing limitations, or other obligations, and may be used and shared by BNED and third parties to the fullest extent not prohibited by applicable law. We encourage you to exercise caution when making decisions about what you disclose in such public areas. For more information on how UGC is treated under the Services’ Terms of Use click here.

California minors should see the “Minors” section below regarding potential removal of certain UGC they have posted on the Services.

Accessing and Changing Information.

We may provide web page(s), or other mechanisms or processes allowing you to delete, correct, or update some of the Personal Information that we collect from you, and potentially certain other information about you (e.g., profile and account information). We will make good faith efforts to make requested changes in our then-active databases as soon as practicable, but it is not always possible to completely change, remove or delete all of your information or public postings from our databases and residual and/or cached data may remain archived thereafter. Further, we reserve the right to retain data: (a) as required by applicable law; and (b) for so long as reasonably necessary to fulfill the purposes for which the data is retained except to the extent prohibited by applicable law.

California minors should see the “Minors” section below regarding potential removal of certain UGC they have posted on the Services.

Minors.

Student Personal Information.

In order for students under 16 to access and use the Services, the student’s name and email address (collectively, “Student Personal Information”) is provided to us either by the student’s parent or guardian, or by the student’s educational institution, which is responsible for obtaining any required consent from the parent or guardian. The Student Personal Information provided to us will only be used for the purpose requested by the student’s parent, guardian or educational institution, and will be deleted after such use. Except as expressly set forth in this section, we do not knowingly collect Personal Information from children under the age of sixteen (16) and if we learn that we have received information from a user under the age of sixteen (16), we will delete this information in accordance with applicable law.

Minor CA Residents.

Any California residents under the age of eighteen (18) who have registered to use the Services, and who posted content or information on the Services, can request removal by contacting us in the manner described under the “How to Contact Us” section below, detailing where the content or information is posted and attesting that you posted it. We will then make reasonable, good faith efforts to remove the post from prospective public view or anonymize it so the minor cannot be individually identified to the extent required by applicable law. This removal process cannot ensure complete or comprehensive removal. For instance, third parties may have republished or archived content by search engines and others that we do not control.

Links and Other Sites.

This Privacy Policy applies only to our information practices on the Services. This Privacy Policy does not apply to the other websites and social media sites you access and use, including those you may access from the Services. You are subject to the privacy policies of such other websites and social media sites.

Change of Ownership.

In the event that our ownership was to change as a result of a merger, acquisition, or any transaction involving the transfer of some or all of our assets by another company, your Services information may be transferred. We will provide you notice prior to any such transfer of your Personal Information.

Security.

We take steps to help protect Personal Information. We require password protection physical, electronic, and procedural safeguards to protect Personal Information. We limit access to Personal Information to employees and authorized who need to know that information in order to operate, develop or improve our Services. However, we cannot guarantee that your information will never be disclosed in a manner inconsistent with this Privacy Policy (for example, as a result of unauthorized acts by third parties that violate applicable law or our policies).

Changes to this Privacy Policy.

We may update this Privacy Policy from time to time. If this Privacy Policy changes, the revised Policy will be posted on our website. Therefore, you should review our Privacy Policy periodically. If there are significant changes to our information practices, you will be provided with appropriate online notice. You may be provided other privacy-related information in connection with your use of offerings from us, as well as for special features and services not described in this Privacy Policy that may be introduced in the future. Your continued use of this website or our Services and/or continued provision of Personal Information to us will be subject to the terms of the then-current Privacy Policy.

How to Contact Us.

If you have any questions or concerns about our Privacy Policy or its implementation, or if you believe there are inaccuracies in your account information you may contact us as follows:

By email:
CaliforniaPrivacy@BNED.com

By mail:
Barnes & Noble Education, Inc.
120 Mountain View Blvd.
Basking Ridge, NJ 07920
Attention: Chief Privacy Officer

Jurisdiction-Specific Terms.

Your California Privacy Rights.

The California Consumer Privacy Act (“CCPA”), which provides California Consumers certain rights regarding their Personal Information as those terms are defined in the CCPA, became effective on January 1, 2020. As of that date, the California Attorney General had not completed the rule making process to establish the regulations for businesses to implement the law.

In the meantime, we are providing you with notice of the personal information we collect and our purposes for that collection for data that may be subject to the CCPA (“CCPA Notice”). This CCPA Notice does not cover information that is outside of the scope of the CCPA. This notice also does not apply to data collected from employees, applicants or contractors or to data collected from individuals acting as representatives of another business in connection with business communications or transactions.

We collect and share the following personal information that may be subject to the CCPA for the following purposes:

Category of PI Sources of PI Purposes for Collection Categories of Third Parties with whom PI is shared Purposes of Third Parties Receiving PI
Identifiers and Personal Records
(e.g., Name, Phone Number, Email Address, I.P. Address)
You, Your Education Institution (“Education Institutions”) Providing our services, improving our services, quality assurance, research and development Our service providers and agents who perform services on our behalf (“Vendors”); Education Institutions Providing services on our behalf, debugging, detecting security incidents, prevention of fraud and illegal activity, quality assurance
Customer Account Details / Commercial Information
(e.g., your order history)
You, Education Institutions Providing our services, improving our services, quality assurance, research and development Vendors; Education Institutions Providing services on our behalf, quality assurance, research and development
Internet Usage Information
(e.g., information regarding your interaction with our online services)
You, your devices Providing our services, debugging, improving our services, improving our services, quality assurance, prevention of fraud and illegal activity, research and development Vendors, Education Institutions Providing services on our behalf, detecting security incidents, prevention of fraud and illegal activity, quality assurance
Inferences from PI Collected
(e.g., your preferences, your performance)
You, your devices, our internal systems Providing our services, improving our services Vendors, Education Institutions Providing services on our behalf, improving services, quality assurance, research and development

If you are a California Consumer and would like to register a request under your “right to know about personal information collected, disclosed or sold” (including right to obtain copies of specific pieces and/or information about categories of personal information practices), “right to request deletion of personal information,” or “right to opt-out of the sale of personal information,” you can contact us at CaliforniaPrivacy@BNED.com or toll-free at 833-729-0427, and we will respond to your request as and when we have regulatory guidance on how to properly verify you and respond to your requests in accordance with CCPA.

We will revise this CCPA Privacy Notice from time to time as implementing regulations further develop and come into effect and we are able to provide you with better information on your CCPA rights and how to exercise them.

Your Nevada Privacy Rights.

Under Nevada law, Nevada residents may opt out of the sale of certain “covered information” collected by operators of websites or online services. We currently do not sell covered information, as “sale” is defined by such law, and we don’t have plans to sell this information. However, if you would like to be notified if we decide in the future to sell Personal Information covered by this Nevada law, please email your name and email address to NevadaPrivacy@bned.com to provide your name and email address. You are responsible for updating any change in your email address by the same method and we are not obligated to cross-reference other emails you may have otherwise provided us for other purposes. We will maintain this information and contact you if our plans change. At that time, we will create a process for verifying your identity and providing an opportunity to verified consumers to complete their opt-out. Please become familiar with our data practices as set forth in this privacy policy. We may share your data as explained in this privacy policy, such as to enhance your experiences and our services, and those activities will be unaffected by a Nevada do not sell request. You may also have other choices regarding our data practices as set forth elsewhere in this privacy policy.

Effective Date and Last Updated: January 06, 2020