Privacy Policy/
EFFECTIVE DATE: December 19, 2023
At Barnes & Noble Education, we understand you care about how we collect, use, and disclose your personal information.
This Privacy Policy (“Policy”) describes how Barnes & Noble Education, Inc. and our subsidiaries, including Barnes & Noble College Booksellers, LLC; and MBS Textbook Exchange, LLC (collectively, “BNED”, “we”, “us”, “our”), collect, use and disclose your personal information, which applies: (i) online where this Policy is posted; (ii) in person in our stores and at our events; (iii) through our customer service channels; and (iv) in other online and offline interactions with you. This Policy applies to the BNED-run family of products, websites, services, and browserbased and/or mobile applications (collectively, our “Services), where this BNED privacy policy is posted in compliance with applicable law and/or our contractual obligations. This Policy does not apply to the practices of companies we do not own or control.
If you are a resident of California, please find additional information about your rights under the California Consumer Privacy Act, as amended, in the California Consumer Privacy Act Policy And Notice At Collection section, below California Consumer Privacy Act Policy And Notice At Collection.
The Services are intended for use by United States (“U.S.”) residents in accordance with laws in the U.S., this Privacy Policy, and the applicable Terms of Use. Any personal information we collect about you may be transferred to the U.S. or to other countries by our Vendors. The data protection laws in these countries may provide a lower standard of protection for your personal information than your country of residence, and data stored in the U.S. may be subject to lawful requests by the courts or law enforcement authorities in the U.S. By using our Services, you acknowledge the terms of this Privacy Policy and the collection, use, maintenance, transfer to and processing of your personal information in the U.S. or other countries or territories.
TABLE OF CONTENTS
1. Personal Information We Collect
2. How We Use Your Personal Information
3. How We Disclose Your Personal Information
4. External Services And Analytics
5. Your Choices
6. Minors
7. Security
8. California Consumer Privacy Act Policy and Notice at Collection
9. Other State-Specific Rights
11. Contact Us
1. PERSONAL INFORMATION WE COLLECT
a. Information You Provide. While registration with us is optional, please keep in mind that you will not be able to use certain features of our Services unless you register for an account. Depending on how you interact with our Services, you may provide us, our agents, our customers, and BNED’s service providers, licensees, and other third parties who perform services on our behalf (collectively, “Vendors”) with the following personal information:
- your name, email address, username, password, address, phone number, date of birth, financial account number and other financial information, government-issued identifier, applicable billing and/or shipping address(es), school attending, graduation year, school identifier, enrollment information, and other registration information;
- information about your preferences;
- transaction-related information, such as your orders for any Services or purchases, if any, that you make from us or our Vendors;
- information you otherwise provide us, such as when you contact us or our Vendors for assistance; and
- other information related to your use of our Services.
You must maintain the confidentiality of your access information and are responsible for controlling access to your account. If you ever use a public computer to visit your account, we strongly encourage you to log out at the conclusion of your session. BNED does not store your payment information unless you choose to include it in your account.
b. Information Collected Automatically. We and our Vendors may automatically collect certain information when you use our Services, including by automatically receiving or collecting certain information, which may include your:
- browser information and/or operating system information;
- manner of connecting to the Internet, including your device type, and the name of your Internet provider or wireless carrier;
- Internet protocol (“IP”) address;
- data relating to malfunctions or problems, if any, that may occur when you use our Services;
- log file information, including your referring and exit pages and URLs, number of clicks and how you interact with links on our Services, screen resolution, domain names, landing pages, pages viewed, and other similar information;
- non-precise geolocation based on IP address;
- browsing and purchasing behavior; and
- preferences.
c. Information From External Sources. We may also collect personal information about you from external sources, including your friends, our customers, applicable educational institution(s), and other third parties that provide information to us, including publicly available information, Vendors, and our affiliates that generally have shared management or ownership with us. This information may include but is not limited to your identification number for your applicable institution’s student information system(s) and/or learning management system(s), name, email, campus location, financial aid, term, course enrollment and courses.
2. HOW WE USE YOUR PERSONAL INFORMATION
We may use the personal information we collect for various purposes, including to:
- process your registration and transactions;
- manage your account, including your payment information and preferences;
- improve our Services;
- fulfill other purposes disclosed to you at the time you provide us with your information or otherwise where we are legally permitted to do so;
- personalize content;
- respond to your inquiries;
- fulfill your request(s) for Services;
- provide you with reminders, updates and other information regarding our Services;
- understand your non-precise geolocation based on IP address;
- keep our Services safe and secure, and to prevent and detect fraud and abuse;
- comply with our legal obligations, policies, and procedures including, without limitation, our agreements with applicable educational institution(s); and
- administer and manage our Services, including content and layout, usage, troubleshooting, data analysis, testing, research, and for statistical and survey purposes.
3. HOW WE DISCLOSE YOUR PERSONAL INFORMATION
We may disclose your personal information to:
- BNED affiliates. We may disclose your personal information to our affiliates who may have content and offers of interest to you.
- Vendors and Institutions. We may disclose your personal information to applicable educational institution(s), and to our Vendors who assist with the delivery of our Services and the performance of our business operations, such as hosting, payment processing, analytics, customer support, and maintaining the security and integrity of our Services;
- Government and law enforcement authorities. We may disclose your personal information as required or permitted by law, such as in response to a verified request, e.g., court order, search warrant, or subpoena, relating to a criminal investigation or alleged illegal activity, or any other activity that may expose us, you, or any other party to legal liability;
- Security and safety. Where permitted by applicable law, we may disclose your personal information for the purpose of protecting the rights, property, life, health, security, and safety of BNED, our Services, our users, or any other party. We may also disclose your personal information if we have a good faith belief that a crime has been or is being committed; and
- Business transactions. We may disclose your personal information in connection with, or during negotiations of, any proposed or actual business transaction, e.g., merger, purchase, sale, or any other type of business transaction regarding all or any portion of our assets, including transfer of all or any portion of our business to another party.
4. EXTERNAL SERVICES AND ANALYTICS
- External Services. External services may use their own tracking technologies to independently collect information about you and may solicit personal information from you (“Tracking Technologies”).
- Analytics. We may use Vendor tools, such as Adobe Analytics, to help us analyze our performance, and to deliver Services and advertising to you.
Please note that any links to external services are provided for your convenience only. Since this Policy does not apply to the practices of companies that we do not own or control, if you wish to learn more about the privacy practices of any external services or certain Vendors, we encourage you to review their privacy policies directly.
5. YOUR CHOICES
When it comes to your personal information, you have options, and we want to make sure you are informed of your choices.
Your Communication and Marketing Preferences. You may opt out of commercial messages by clicking on the “opt out” or “unsubscribe” link provided at the bottom of each email we send. These preferences do not apply to transactional communications, such as those that are related to your registration with us, required or important notices related to your use of our Services, or the fulfillment of a specific transaction.
Review, Update, or Change your Information. If you have an account on our Services, you may review, update, and change the information you provide to us at any time by accessing your account settings.
Choices Regarding Tracking Technologies
We do not use tracking technologies except for performance analytics via Adobe Analytics
6. MINORS
Children under the age of 16 are not eligible to use our Services and must not submit any personal information to us. Our Services are not intended for children under the age of 16 and we do not knowingly collect personal information directly from children under the age of 16. If we become aware that we have obtained personal information directly from a child under the age of 16, we will delete such information in accordance with applicable law.
7. SECURITY
We take steps to help protect your personal information. We maintain appropriate administrative, technical, and physical safeguards designed to help protect personal information collected or received through our Services. Additionally, we limit access to personal information to employees and authorized parties who need to access that information to operate, develop, or improve our Services. Although we use reasonable efforts to safeguard personal information, transmission via the Internet is not completely secure and we cannot guarantee the security of your personal information collected through our Services.
8. CALIFORNIA CONSUMER PRIVACY ACT POLICY AND NOTICE AT COLLECTION
This California Consumer Privacy Act Policy and Notice at Collection (the “Notice”) describes how we collect and use personal information, and the rights that the California Consumer Privacy Act, as amended (the “CCPA”), provides to California residents. Unless otherwise noted, the disclosures and practices contained within this Notice describe our current practices and our practices for the 12 months preceding the Effective Date, set forth at the beginning of this Policy.
This Notice does not apply to personal information collected from employees, contractors or job applicants. If you are an employee, contractor or job applicant, please refer to your respective notice.
This Notice supplements other parts of our Policy and provides additional information for California residents. In the event of a conflict between any other BNED policy, statement, or notice and this Notice, this Notice will prevail as to California residents’ rights under the CCPA.
What Personal Information We Collect and Why We Collect It.
We collect the categories of personal information about California residents that are indicated in the chart below. Note that the specific pieces of personal information we collect about you may vary depending on the nature of your interactions with us and may not include all of the examples listed.
The disclosures in the chart below also apply to Colorado residents.
| Category of PI | Purposes for Collection, Use, and Disclosure |
|---|---|
| Identifiers such as name, email address, postal address, phone number, date of birth, school identifier, government issued identifier, IP address or other similar identifiers |
|
| Personal Information as described in Section 1798.80(e) of the California Civil Code such as a phone number and bank account number |
|
| Commercial Information such as purchase history |
|
| Geolocation |
|
| Internet or Other Electronic Network Activity Information such as IP address, mobile network provider, and other related information |
|
| Inferences drawn from personal information collected to generate information about your likely preferences |
|
Sources of Personal Information.
We collect personal information from:
- you;
- your devices and/or browsers;
- our affiliates;
- Vendors;
- Applicable educational institution(s); and
- other external sources, including publicly available sources.
Categories of Recipients of Personal Information.
We may disclose each category of personal information and sensitive personal information, if any, described herein, to these categories of recipients:
- our affiliates;
- Vendors;
- Applicable educational institution(s); and
- governmental and law enforcement authorities.
Retention of Personal Information.
Except as otherwise permitted or required by applicable law or regulation, we will only retain your personal information (which includes the categories of personal information set forth in the charts and sections herein) for as long as necessary to fulfill the purposes we collected it for, as required to satisfy any legal obligations, or as necessary to resolve disputes. To determine the appropriate retention period for personal information, we consider applicable legal requirements, the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes we process your personal information for, and whether we can achieve those purposes through other means. We will maintain certain types of personal information for a limited duration.
Selling and Sharing of Personal Information.
We do not sell or share personal information as those terms are defined under the CCPA.
Your California Privacy Rights.
The CCPA gives California Consumers certain rights:
Right to Know
California consumers have the right to request more information about the following:
- The categories of personal information we have collected about you;
- The categories of sources from which the personal information was collected;
- Our business or commercial purposes for collecting, selling, or sharing your personal information;
- The categories of third parties to which we disclosed your personal information;
- The categories of personal information we sold or shared about you and the categories of third parties to which each category of personal information was sold or shared;
- The categories of personal information we disclosed about you for a business purpose and the categories of recipients to which it was disclosed; and
- The specific pieces of personal information we have collected about you.
Right to Request Deletion of Personal Information
You may request that we delete your personal information that we have collected directly from you and are currently maintaining. Please note, however, that we may have a legal basis for retaining certain personal information under the CCPA, despite your request. Requests of this nature may be made no more than twice in a twelve-month period.
Right to Opt-out of the Sale and Sharing of Personal Information
We do not sell personal information or share it for cross-context behavioral advertising. As such, this right does not apply.
Right to Correct Personal Information
You may request that we correct personal information that we maintain about you if you believe such personal information is inaccurate. We may request documentation from you in connection with your request. We will also require you (or your agent) to be verified before honoring your correction requests. Upon receipt of a verifiable request to correct inaccurate personal information, we will use commercially reasonable efforts to correct the information as you direct.
Right to Limit Use of Your Sensitive Personal Information
We do not use or disclose sensitive personal information, if any, for purposes to which the right to limit use and disclosure applies under the CCPA.
Right to Non-discrimination for the Exercise of Your Privacy Rights
We will not discriminate against you if you choose to exercise any of the privacy rights described herein.
Exercise CCPA Rights.
You may submit CCPA-related requests to BNED for BNED-controlled sites via email at CaliforniaPrivacy@bned.com, on our privacy portal HERE, or toll-free at 833-720-0427.
Shine the Light.
California law permits customers in California to request certain details about how their personal information is shared with third parties, and in some cases our affiliates, if personal information is shared for those third parties’ or our affiliates’ own direct marketing purposes. We do not share personal information with third parties or our affiliates for those third parties’ or affiliates’ own direct marketing purposes. Californians may request information about our compliance with this law by contacting us at CaliforniaPrivacy@bned.com or by mailing:
Barnes & Noble Education, Inc.
120 Mountain View Boulevard
Legal Department
Basking Ridge, NJ 07920
Attention: Chief Privacy Officer
Any such request must include your name and “California Shine the Light Privacy Rights Request” in the first line of the description and, if sent by mail, must include your street address, city, state, and zip code.
Please note that “Shine the Light” rights and CCPA rights are granted by different laws and must be exercised separately.
9. OTHER STATE-SPECIFIC RIGHTS
Your Rights Under Certain Other U.S. Privacy Laws.
This section applies to consumers residing in Connecticut, Colorado, Virginia, and Utah as defined by the Connecticut Data Privacy Act, the Colorado Privacy Act, the Virginia Consumer Data Protection Act, and the Utah Consumer Privacy Act, respectively (collectively, the “U.S. Privacy Laws”), that use our Services. “Personal information” includes “personal data” as defined by U.S. Privacy Laws.
You can learn more about the personal information we process in the “Personal Information We Collect” section and the purpose for processing such personal information in the “How We Use Your Personal Information” section. You can also learn more about our disclosure of personal information and the categories of external parties we disclose personal information to in the “How We Disclose Your Personal Information” section. Colorado residents can learn more about the purposes for which we process each category of personal information we collect in the “What Personal Information We Collect and Why We Collect It” section of our California Consumer Privacy Act Policy and Notice at Collection.
If you are a customer residing in Colorado, Connecticut, Virginia or Utah, subject to certain conditions and restrictions set out in the U.S. Privacy Laws and other applicable laws, you have the following rights with regard to your personal information:
Right to Access and Data Portability
You have the right to confirm whether we are processing your personal information, to access your personal information, and to obtain a copy of your personal information in a portable format.
Right to Correct
You have the right to request that we correct inaccuracies in your personal information, taking into account the nature of the personal information and our purposes for processing it.
Right to Delete
You have the right to request that we delete certain personal information that we have collected from or obtained about you, subject to certain exemptions.
Right to Opt Out of Sales
We do not sell your personal information, and as such this right is not applicable.
Right to Opt Out of Targeted Advertising
We do not disclose your personal information for Targeted Advertising, and as such this right is not applicable.
Right to Opt Out of Profiling
We do not process personal information for the purpose of profiling, and as such this right is not applicable.
Right to Appeal
If you are unsatisfied with our actions related to the exercise of one of your privacy rights described herein, you may appeal our decision.
Consumers may submit their requests under U.S. Privacy Laws HERE for BNED-run sites. Please note that, depending on the nature of your request, you may be asked to provide information to verify your identity before your request can be processed. We will respond to your request as soon as we reasonably can and no later than as legally required.
If you choose to exercise any of the privacy rights described herein, we will not deny our Services to you, charge you different prices, or provide a different level or quality of Services to you unless those differences are related to the value of your personal information.
Your Nevada Privacy Rights.
Under Nevada privacy law, Nevada residents may opt out of the sale of certain “covered information” collected by operators of websites or online services. We currently do not “sell” covered information as “sale” is defined by such law, and we do not have plans to “sell” this information. However, if you would like to be notified if we decide in the future to sell personal information covered by this Nevada privacy law, please email your name and email address to nevadaPrivacy@bned.com.
Please review this Policy for more information about our information collection and sharing practices. We may share your information as explained in this Policy, such as to enhance your experiences and our Services, and those activities will be unaffected by a Nevada opt-out request.
10. CHANGES TO THIS POLICY
From time to time, we may update this Policy and indicate changes by updating the date at the top of the Policy. Your continued use of our Services after any update to this Policy will constitute your acceptance of the changes.
To the extent any provision of this Policy is found by a court of competent jurisdiction to be invalid or unenforceable, such provision shall be severed to the extent necessary for the remainder of this Policy to be valid and enforceable.
11. CONTACT US
If you have any questions or concerns about this Policy or its implementation, you may contact us:
By email: privacy@bncollege.com
By mail:
Barnes & Noble Education, Inc.
120 Mountain View Boulevard
Legal Department
Basking Ridge, NJ 07920
Attention: Chief Privacy Officer