EFFECTIVE DATE September 28, 2023 AND UPDATED DATE December 21, 2023:
At Barnes & Noble Education, we understand you care about how we collect, use, and disclose your personal information.
If you are a resident of California, please find additional information about your rights under the California Consumer Privacy Act, as amended, in the California Consumer Privacy Act Policy And Notice At Collection section, below.
TABLE OF CONTENTS
- Personal Information We Collect
- How We Use Your Personal Information
- How We Disclose Your Personal Information
- Business-to-Business and Wholesale Transactions
- External Services, Social Features, Advertising, And Analytics
- Your Choices
- User-Generated Content
- Sweepstakes, Contests, and Promotions
- California Consumer Privacy Act Policy and Notice at Collection
- Other State-Specific Rights
- Changes To This Policy
- Contact Us
PERSONAL INFORMATION WE COLLECT
a. Information You Provide. While registration with us is optional, please keep in mind that you will not be able to use certain features of our Services unless you register for an account. Depending on how you interact with our Services, you may provide us, our agents, our customers, BNED's service providers, such Fanatics Retail Group Fulfillment, LLC, Inc. ("Fanatics") and Fanatics Lids College, Inc. D/B/A "Lids" ("Lids"), licensees, and other third parties who perform services on our behalf (collectively, "Vendors") with the following personal information:
- your name, email address, username, password, address, phone number, date of birth, financial account number and other financial information, government-issued identifier, applicable billing and/or shipping address(es), gender, school attending, graduation year, school identifier, enrollment information, and other registration information;
- information about your preferences;
- transaction-related information, such as your orders for any Services or purchases, if any, that you make from us or our Vendors;
- information you otherwise provide us, such as when you contact us or our Vendors for assistance; and
- other information related to your use of our Services.
You must maintain the confidentiality of your access information and are responsible for controlling access to your account. If you ever use a public computer to visit your account, we strongly encourage you to log out at the conclusion of your session. BNED does not store your payment information unless you choose to include it in your account.
b. Information Collected Automatically. We and our Vendors may automatically collect certain information when you use our Services, including by automatically receiving or collecting certain information, which may include your:
- browser or operating system;
- manner of connecting to the Internet, including your device type, and the name of your Internet provider or wireless carrier;
- Internet protocol ("IP") address;
- data relating to malfunctions or problems, if any, that may occur when you use our Services;
- log file information, including your referring and exit pages and URLs, number of clicks and how you interact with links on our Services, domain names, landing pages, pages viewed, and other similar information;
- precise geolocation for some Services, and non-precise geolocation based on IP address for other Services;
- browsing and purchasing behavior; and
c. Information From External Sources. We may also collect personal information about you from external sources, including your friends, our Vendors, customers, applicable educational institution(s), and other third parties that provide information to us, including advertising networks, publicly available information and our affiliates that generally have shared management or ownership with us. This information may, as applicable, include your identification number for your applicable institutions' student information system(s) and/or learning management system(s), name, email, campus location, financial aid, term, course enrollment and courses.
HOW WE USE YOUR PERSONAL INFORMATION
We may use the personal information we collect for various purposes, including to:
- process your registration and transactions;
- manage your account, including your payment information and preferences;
- improve our Services;
- fulfill other purposes disclosed to you at the time you provide us, our customers, or our Vendors with your information or otherwise where we are legally permitted to do so;
- personalize content and offers, and serve advertising that may be of interest to you from us and third parties;
- respond to your inquiries;
- fulfill your request(s) for Services;
- provide you with updates and other information regarding our Services;
- understand your precise geolocation for some Services, and non-precise geolocation based on IP address for other Services;
- keep our Services safe and secure, and to prevent and detect fraud and abuse;
- comply with our legal obligations, policies, and procedures including, without limitation, our agreements with applicable educational institution(s); and
- administer and manage our Services, including content and layout, usage, troubleshooting, data analysis, testing, research, and for statistical and survey purposes.
HOW WE DISCLOSE YOUR PERSONAL INFORMATION
We may disclose your personal information to:
- BNED affiliates. We may disclose your personal information to our affiliates who may have content and offers of interest to you;
- Vendors and Institutions. We may disclose your personal information to applicable educational institution(s), and to our Vendors who assist with the delivery of our Services and the performance of our business operations, such as hosting, payment processing, marketing, which may include joint marketing with BNED customers and Vendors, analytics, customer support, and maintaining the security and integrity of our Services;
- Government and law enforcement authorities. We may disclose your personal information as required or permitted by law, such as in response to a verified request, e.g., court order, search warrant, or subpoena, relating to a criminal investigation or alleged illegal activity, or any other activity that may expose us, you, or any other party to legal liability;
- Security and safety. Where permitted by applicable law, we may disclose your personal information for the purpose of protecting the rights, property, life, health, security, and safety of BNED, our Services, our users, or any other party. We may also disclose your personal information if we have a good faith belief that a crime has been or is being committed by a user; and
- Business transactions. We may disclose your personal information in connection with, or during negotiations of, any proposed or actual business transaction, e.g., merger, purchase, sale, or any other type of business transaction regarding all or any portion of our assets, including transfer of all or any portion of our business to another party.
BUSINESS-TO-BUSINESS AND WHOLESALE TRANSACTIONS
BNED engages in business-to-business interactions, so our personnel interact with the personnel of our customers and Vendors. We collect limited information about such individuals, primarily consisting of name, basic contact information and professional or employment-related information, which we use to facilitate our business-to-business relationships.
EXTERNAL SERVICES, SOCIAL FEATURES, ADVERTISING, AND ANALYTICS
- External Services. Vendors and external services may use their own tracking technologies to independently collect information about you and may solicit personal information from you ("Tracking Technologies"). For example, BNED maintains its own branded pages on various social networks. When you visit these BNED-branded social media pages, the provider of the social network and other parties may set Tracking Technologies on your browser or device.
- Advertising. We may engage and work with Vendors, customers, and other parties to serve ads on our Services or on external services. Some of these ads may be tailored to your interest based on your browsing, across time, of our Services and elsewhere on the Internet, which may include use of data from cross-device usage, sometimes referred to as "interest-based advertising" or "online behavioral advertising" ("Interest-based Advertising"), which may include sending you an ad on external services after you have left our Services i.e., "retargeting". Our advertisers' and ad networks' use of Tracking Technologies are governed by their own privacy policies.
- Analytics. We may use Vendor tools, such as Google Analytics and Adobe Analytics, to help us analyze our performance, and to deliver Services and advertising to you. For example, we may use Remarketing with Google Analytics, Google Display Network Impression Reporting, the DoubleClick Campaign Manager and/or Google Analytics Demographics and Interest Reporting.
- We and our Vendors, such as Google, may use first-party cookies, such as the Google Analytics cookies, and third-party cookies together to report how your ad impressions, other uses of ad services, and your interactions with these ad impressions and ad services are related to visits to our Services.
- Additionally, some of the technologies used on our Services, e.g., session replay tools, allow us and our Vendors to monitor and analyze how visitors use our Services to better understand user behavior and improve our Services. When you interact with us online, information related to your browsing behavior may be collected by us and our Vendors.
Please note that any links to external services are provided for your convenience only. Since this Policy does not apply to the practices of companies that we do not own or control, if you wish to learn more about the privacy practices of any external services or certain Vendors, we encourage you to review their privacy policies directly.
When it comes to your personal information, you have options, and we want to make sure you are informed of your choices.
Your Communication and Marketing Preferences. You may opt out of commercial messages by clicking on the "opt out" or "unsubscribe" link provided at the bottom of each email we send. These preferences do not apply to transactional communications, such as those that are related to your registration with us, required or important notices related to your use of our Services, or the fulfillment of a specific transaction.
Review, Update, or Change your Information. If you have an account on our Services, you may review, update, and change the information you provide to us at any time by accessing your account settings.
Choices Regarding Tracking Technologies.
- Browser Settings. Some browsers have incorporated "Do Not Track" features that can send a signal to websites you visit indicating that you do not wish to be tracked. Because there is no consensus on how to interpret "Do Not Track" signals, our Services do not currently respond to browser Do Not Track" signals. To find out more about "Do Not Track," you can visit http://www.allaboutdnt.com. You can control information collection and use by using other means, such as by clearing your browser cache history or by using the tools discussed below.
- Self-Regulatory Advertising Organizations. Certain Vendors that perform advertising-related services on our behalf participate in voluntary programs that provide tools to opt-out of interest-based advertising, such as the Digital Advertising Alliance's ("DAA") Self-Regulatory Program for Online Behavioral Advertising. We support this program, and we expect those ad networks we directly engage to serve you interest-based advertising will do so as well, although we cannot guarantee their compliance. To learn more about how you can exercise certain choices regarding interest-based advertising for DAA members, visit http://www.aboutads.info/choices/, and http://www.aboutads.info/appchoices for information on the DAA's opt-out program for mobile apps. Some of these companies are also members of the Network Advertising Initiative ("NAI"). To learn more about the NAI and opt-out options for their members, see http://www.networkadvertising.org/choices/. We are not responsible for the effectiveness of, or compliance with, any third party opt-out options or programs, nor the accuracy of their statements regarding their programs.
- Mobile Device Settings. You can use mobile device settings to limit mobile Tracking Technologies and associated activities. For instance, you can adjust or reset the advertising identifiers on your mobile device in the device settings. In some cases, you can also use mobile device settings to allow or restrict the sharing of location information. If you do not share your location information, some features of our Services may not be available for use, but we may still estimate your general location based on the IP address you use to access our Services. Additionally, you can also choose to uninstall mobile applications.
If you disable or remove these Tracking Technologies, some functionality on our Services may not be available nor function properly. If you use more than one browser or device, we recommend you make these choices in each browser or device to ensure your preferences are accounted for properly.
Please be aware that, even if you are able to opt out of certain kinds of Interest-based Advertising, you may continue to receive other types of ads. Opting out only means that those participating members should no longer deliver certain interest-based advertising to you, but does not mean you will no longer receive targeted content or ads from other ad networks.
In addition, we may serve ads on external services that are targeted to reach people on those services that are also identified on one of more of our databases ("Matched List Ads"). This is done by using Tracking Technologies, or by matching common factors between our databases and the databases of the third-party services. We are not responsible for these external services, including without limitation their data security. We are not responsible for their failure to comply with your or our opt-out instructions as they may not give us notice of opt-outs to our ads that you give to them, and they may change their options without notice to us or you.
Children under the age of 16 are not eligible to use our Services and must not submit any personal information to us. Our Services are not intended for children under the age of 16 and we do not knowingly collect personal information from children under the age of 16. If we become aware that we have obtained personal information from a child under the age of 16, we will delete such information in accordance with applicable law.
SWEEPSTAKES, CONTESTS, AND PROMOTIONS
We may offer sweepstakes, contests, and promotions (each, a "Promotion"), including any Promotion jointly or solely sponsored or offered by other parties, which may require submitting your personal information to such other parties. If you voluntarily choose to enter a Promotion, your personal information may be disclosed to BNED, Promotion co-sponsors or administrators, Vendors, and other parties, including for administrative purposes and as required by law, e.g., on a winners list. By entering, you are agreeing to the official rules that govern that Promotion, which may include consent to additional or differing privacy practices from those contained in this Policy. Please review those official rules carefully.
We take steps to help protect your personal information. We maintain appropriate administrative, technical, and physical safeguards designed to help protect personal information collected or received through our Services. Additionally, we limit access to personal information to employees and authorized parties who need to access that information to operate, develop, or improve our Services. Although we use reasonable efforts to safeguard personal information, transmission via the Internet is not completely secure and we cannot guarantee the security of your personal information collected through our Services.
CALIFORNIA CONSUMER PRIVACY ACT POLICY AND NOTICE AT COLLECTION
This California Consumer Privacy Act Policy and Notice at Collection (the "Notice") describes how we collect and use personal information, and the rights that the California Consumer Privacy Act, as amended (the "CCPA"), provides to California residents. Unless otherwise noted, the disclosures and practices contained within this Notice describe our current practices and our practices for the 12 months preceding the Effective Date, set forth at the beginning of this Policy.
This Notice does not apply to personal information collected from employees, contractors or job applicants. If you are an employee, contractor or job applicant, please refer to your respective notice.
This Notice supplements other parts of our Policy and provides additional information for California residents. In the event of a conflict between any other BNED policy, statement, or notice and this Notice, this Notice will prevail as to California residents' rights under the CCPA.
What Personal Information We Collect and Why We Collect It.
We collect the categories of personal information about California residents that are indicated in the chart below. Note that the specific pieces of personal information we collect about you may vary depending on the nature of your interactions with us and may not include all of the examples listed.
The disclosures in the chart below also apply to Colorado residents.
|Identifiers such as name, email address, postal address, phone number, date of birth, school identifier, government issued identifier, IP address or other similar identifiers
|Personal Information as described in Section 1798.80(e) of the California Civil Code such as a phone number and bank account number
|Commercial Information such as purchase history
|Internet or Other Electronic Network Activity Information such as IP address, mobile network provider, and other related information
|Inferences drawn from personal information collected to generate information about your likely preferences
|Sensitive Personal Information, including:
Account Access Credentials, such as your account username and password; and
Precise Geolocation (location within 1,850 feet)
Sources of Personal Information.
We collect personal information from:
- your devices and/or browsers;
- our affiliates;
- Applicable educational institution(s); and
- other external sources, including publicly available sources.
Categories of Recipients of Personal Information.
We may disclose each category of personal information and sensitive personal information, described herein, to these categories of recipients:
- our affiliates;
- Applicable educational institution(s); and
- governmental and law enforcement authorities.
Retention of Personal Information.
Except as otherwise permitted or required by applicable law or regulation, we will only retain your personal information (which includes the categories of personal information set forth in the charts and sections herein) for as long as necessary to fulfill the purposes we collected it for, as required to satisfy any legal obligations, or as necessary to resolve disputes. To determine the appropriate retention period for personal information, we consider applicable legal requirements, the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes we process your personal information for, and whether we can achieve those purposes through other means. We will maintain certain types of personal information for a limited duration.
Selling and Sharing of Personal Information.
We may sell and/or share with third parties for cross-context behavioral advertising the following categories of personal information:
- Internet or other electronic network activity information; and
- precise and non-precise geolocation data.
We sell and/or share this personal information for advertising purposes to third parties. The third parties to whom this personal information was sold and/or shared are advertisers and analytics vendors. When we use the term sell, sold, or sale, we mean for valuable consideration and not monetary value.
We offer you the ability to opt-out of these sales and sharing as set forth herein.
Your California Privacy Rights.
The CCPA gives California Consumers certain rights:
Right to Know
California consumers have the right to request more information about the following:
- The categories of personal information we have collected about you;
- The categories of sources from which the personal information was collected;
- Our business or commercial purposes for collecting, selling, or sharing your personal information;
- The categories of third parties to which we disclosed your personal information;
- The categories of personal information we sold or shared about you and the categories of third parties to which each category of personal information was sold or shared;
- The categories of personal information we disclosed about you for a business purpose and the categories of recipients to which it was disclosed; and
- The specific pieces of personal information we have collected about you.
Right to Request Deletion of Personal Information
You may request that we delete your personal information that we have collected directly from you and are currently maintaining. Please note, however, that we may have a legal basis for retaining certain personal information under the CCPA, despite your request. Requests of this nature may be made no more than twice in a twelve-month period.
Right to Opt-out of the Sale and Sharing of Personal Information
We engage in sales and/or sharing via Tracking Technologies. You have the right to opt out of the sale and sharing of your personal information in the context of Tracking Technologies. To opt out of sale and sharing via Tracking Technologies, please click on the link in the footer of our Services pertaining to your data privacy choices.
You may also opt out of the sale and/or sharing of your personal information via Tracking Technologies through an opt-out preference signal. In order to process your request through an opt-out preference signal, you must use a browser supporting the preference signal. If you choose to use an opt-out preference signal, you will need to turn it on for each browser and each device you use.
Right to Correct Personal Information
You may request that we correct personal information that we maintain about you if you believe such personal information is inaccurate. We may request documentation from you in connection with your request. We will also require you (or your agent) to be verified before honoring your correction requests. Upon receipt of a verifiable request to correct inaccurate personal information, we will use commercially reasonable efforts to correct the information as you direct.
Right to Limit Use of Your Sensitive Personal Information
You may direct us to limit the use and disclosure of your sensitive Personal Information to uses/disclosures that are reasonably necessary to provide our goods and services, or as needed: to ensure security and integrity; to prevent fraud or illegal activity; for physical safety; for short-term, transient use, including for non-personalized advertising; to perform services on behalf of the business; and to verify or maintain the quality or safety of a service or device owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance such services or devices. To limit our use of your sensitive Personal Information, please click on our privacy portal HERE.
Right to Non-discrimination for the Exercise of Your Privacy Rights
We will not discriminate against you if you choose to exercise any of the privacy rights described herein.
Exercise CCPA Rights.
You may submit CCPA-related requests to BNED for BNED-controlled sites via email at [email protected] on our privacy portal HERE or toll-free at 833-720-0427. THIS NUMBER IS MONITORED FOR PRIVACY SPECIFIC RIGHTS REQUESTS ONLY.
In order to fully exercise your rights under CCPA for each BNED-controlled site you use, please complete the BNED privacy portal webform from each browser, on each device, and on each such BNED-run website.
To exercise your privacy rights under CCPA with respect to personal information held by our service providers, Fanatics and Lids, regarding your use of or transactions with a bookstore's apparel and/or spirit shop provided by Fanatics and/or Lids (or as similarly noted on an applicable bookstore site), please submit your request directly to Fanatics and Lids HERE.
Shine the Light.
California law permits customers in California to request certain details about how their personal information is shared with third parties, and in some cases our affiliates, if personal information is shared for those third parties' or our affiliates' own direct marketing purposes. We do not share personal information with third parties or our affiliates for those third parties' or affiliates' own direct marketing purposes. Californians may request information about our compliance with this law by contacting us at [email protected] or by mailing:
Barnes & Noble Education, Inc.
120 Mountain View Boulevard
Basking Ridge, NJ 07920
Attention: Chief Privacy Officer
Any such request must include your name and "California Shine the Light Privacy Rights Request" in the first line of the description and, if sent by mail, must include your street address, city, state, and zip code.
Please note that "Shine the Light" rights and CCPA rights are granted by different laws and must be exercised separately.
California residents under the age of 18 who have registered to use our Services, and who have posted content or information on or through our Services, can request that such information be removed by contacting us in the manner described in the "Contact Us" section below stating that they personally posted such content or information and detailing where the content or information is posted.
We will make a reasonably good faith effort to remove the content from prospective public view or anonymize it so the minor cannot be individually identified. However, this removal process cannot ensure complete or comprehensive deletion from the Internet. For instance, other parties may have republished the content or archived copies of it may be stored by search engines or other parties that we do not control.
Notice of Financial Incentive.
By creating an account, signing up to receive our emails, or participating in other offers provided by BNED from time to time, you may be eligible, where indicated, for discounts, promotions, or similar incentive programs ("Programs"). The full terms and conditions of a Program will be set forth where the opportunity to sign up is offered. We collect identifiers, such as email addresses, phone numbers, and/or zip codes, that you provide to us when you sign up for a Program. The financial incentives that we offer are reasonably related to the value of the consumer's data. We have made a good faith estimate of the value of the consumers' data based on relevant expenses related to the collection and retention of consumers' personal information as part of each Program. You have the right to withdraw from a Program at any time, and you may do so by unsubscribing from our emails in the manner indicated in the emails, or otherwise discontinuing participation in the Program in the manner provided.
OTHER STATE-SPECIFIC RIGHTS
Your Rights Under Certain Other U.S. Privacy Laws.
This section applies to consumers residing in Connecticut, Colorado, Virginia, and Utah as defined by the Connecticut Data Privacy Act, the Colorado Privacy Act, the Virginia Consumer Data Protection Act, and the Utah Consumer Privacy Act, respectively (collectively, the "U.S. Privacy Laws"), that use our Services. "Personal information" includes "personal data" as defined by U.S. Privacy Laws.
You can learn more about the personal information we process in the "Personal Information We Collect" section and the purpose for processing such personal information in the "How We Use Your Personal Information" section. You can also learn more about our disclosure of personal information and the categories of external parties we disclose personal information to in the "How We Disclose Your Personal Information" section. Colorado residents can learn more about the purposes for which we process each category of personal information we collect in the "What Personal Information We Collect and Why We Collect It" section of our California Consumer Privacy Act Policy and Notice at Collection.
We also process your personal information for Targeted Advertising. You have the right to opt out of the processing of your personal information for Targeted Advertising, as described herein.
If you are a customer residing in Colorado, Connecticut, Virginia or Utah, subject to certain conditions and restrictions set out in the U.S. Privacy Laws and other applicable laws, you have the following rights with regard to your personal information:
Right to Access and Data Portability
You have the right to confirm whether we are processing your personal information, to access your personal information, and to obtain a copy of your personal information in a portable format.
Right to Correct
You have the right to request that we correct inaccuracies in your personal information, taking into account the nature of the personal information and our purposes for processing it.
Right to Delete
You have the right to request that we delete certain personal information that we have collected from or obtained about you, subject to certain exemptions.
Right to Opt Out of Sales
We do not "sell" your personal information for money, but some of the ways we disclose your personal information may be considered "sales" under certain U.S. Privacy Laws. You have the right to opt-out of the "sale" of personal information, which may overlap with your right to opt out of Targeted Advertising. To opt out, please click on the link in the footer of our Services pertaining to your data privacy choices.
Right to Opt Out of Targeted Advertising
You may request that we stop disclosures of your personal information for Targeted Advertising by clicking on the link in the footer of our Services pertaining to your data privacy choices.
Right to Opt Out of Profiling
You have the right to opt out of our processing of personal information for the purposes of profiling. We do not process personal information for the purposes of profiling, and as such this right is not applicable.
Right to Appeal
If you are unsatisfied with our actions related to the exercise of one of your privacy rights described herein, you may appeal our decision.
Consumers may submit their requests under U.S. Privacy Laws HERE for BNED-run sites. Please note that, depending on the nature of your request, you may be asked to provide information to verify your identity before your request can be processed. We will respond to your request as soon as we reasonably can and no later than as legally required.
If you choose to exercise any of the privacy rights described herein, we will not deny our Services to you, charge you different prices, or provide a different level or quality of Services to you unless those differences are related to the value of your personal information.
Your Nevada Privacy Rights.
Under Nevada privacy law, Nevada residents may opt out of the sale of certain "covered information" collected by operators of websites or online services. We currently do not "sell" covered information as "sale" is defined by such law, and we do not have plans to "sell" this information. However, if you would like to be notified if we decide in the future to sell personal information covered by this Nevada privacy law, please email your name and email address to [email protected].
Please review this Policy for more information about our information collection and sharing practices. We may share your information as explained in this Policy, such as to enhance your experiences and our Services, and those activities will be unaffected by a Nevada opt-out request.
CHANGES TO THIS POLICY
From time to time, we may update this Policy and indicate changes by updating the date at the top of the Policy. Your continued use of our Services after any update to this Policy will constitute your acceptance of the changes.
To the extent any provision of this Policy is found by a court of competent jurisdiction to be invalid or unenforceable, such provision shall be severed to the extent necessary for the remainder of this Policy to be valid and enforceable.
If you have any questions or concerns about this Policy or its implementation, you may contact us:
By email: [email protected]
Barnes & Noble Education, Inc.
120 Mountain View Boulevard
Basking Ridge, NJ 07920
Attention: Chief Privacy Officer