PRIVACY POLICY

Last Updated: 4/14/23

Bookshop.org, including all of its features and content and related or commonly-owned or controlled websites(“Website”), is a service made available by Bookshop, Inc. (“Bookshop.org”), a public benefit corporation that provides independently owned booksellers, industry partners, and conscious consumers with a direct-to-consumer e-commerce solution competitive to that of major retailers.

Quick Guide to Contents
1. How This Privacy Policy Applies
2. What Information Bookshop.org Collects and Receives
3. How Bookshop.org Uses the Information It Collects
4. How Bookshop.org Shares the Information It Collects
5. Tracking and Other Technologies
6. Your Rights
7. Links to Other Websites and Services
8. Data Retention
9. Cross-Border Data Transfers
10. Children’s Privacy
11. Security
12. Updates to this Privacy Policy
13. Contact Us

1. How This Privacy Policy Applies

By using the Website and any SMS Service you opt into to receive messages via text (“SMS Service”), you are accepting the practices described in this PrivacyPolicy (including new versions of this Privacy Policy when and as they go into effect) and Bookshop.org’s Terms of Use (“Terms ofUse”), which governs this Privacy Policy applies to those persons or entities who (i) purchase products on the Website, (ii) receive communications fromBookshop.org, (iii) sell products on the Website through Bookshop.org’s Platform Seller Program(each, a “Platform Seller”), and (vi) participate in Bookshop.org’s Affiliate Program (each, an “Affiliate”)(collectively, “Users,” and each, a “User”, “you” or “your”). Capitalized words not defined in this Privacy Policy are defined in the Terms of Use. In the event of a conflict between this Privacy Policy and the terms and conditions applicable to the Platform Seller Program and the Affiliate Program, respectively, such terms and conditions applicable to the Platform Seller Program and the Affiliate Program shall apply respectively.

This Privacy Policy describes the information Bookshop.org collects from you through the Website and SMS Service, how Bookshop.org uses that information, and its legal basis for doing so. It also covers whether and how that information may be shared and your rights and choices regarding such information. For residents of the European Economic Area, Bookshop.org is the data controller responsible for your information.

2. What Information Bookshop.org Collects and Receives

In order for you to use the Website or the SMS Service, Bookshop.org needs tocollect and process certain information, which depending on how you use theWebsite, may include the following.

A. Information You Provide

(i) Bookshop.org collects information you provide by using the Website, such as when:
• Platform Sellers post Content (as such terms are defined in the Terms of Use).
• Users complete forms on or through the Website or subscribe to our newsletters or emails. The information you provide may include your name, email address, mailing address, or telephone number.
• Users make a request or transaction through the Website. Bookshop.org andPlatform Sellers offer products for sale through the Website, and Bookshop.org and its payment processor will need to collect and use information such as your name, mailing address, billing address, email address, telephone number, and payment card information to process these requests and transactions.
• Users communicate with Bookshop.org, such as when you request support, submitcomments or questions, or report a problem to Bookshop.org.

(ii) Through the use of the SMS Service, Bookshop.org will receive the following personal information:
• Your mobile phone number when you send a text message to us.
• Any user or screen name you select in connection with the SMS Service.
• The text of messages that you send to other users of the SMS Service.
• Any comments or feedback regarding the SMS Service or other personalinformation you send to Bookshop.org.

B. Information Automatically Collected

Bookshop.org also automatically or passively collects information that relates to your usage of the Website or that is necessary for the proper functioning or improvement of the Website, including:
• Times and dates and the extent of your usage of the Website.
• Time zone, language, screen resolution, and other usage preferences you select when using the Website.
• Device keyboard settings.
• Usage history such as areas and pages within the Website that you access or use and/or which buttons on the Website you click on.
• The search terms you entered into a search engine that may have led you tothe Website.
• The Internet service provider (ISP) or mobile platform you use.
• Other device and Website access information such as your browser type,operating system, Internet Protocol (IP) address, referring/exit pages, andother unique device identifiers.

Bookshop.org also collects and maintain aggregated, anonymized, orpseudonymized information to protect the safety and security of the Website,improve the Website, or comply with its legal obligations.

You may decline to provide Bookshop.org with some or all of your information.However, doing so will limit your ability to use the Website.

3. How Bookshop.org Uses the Information It Collects

(i) Bookshop.org uses the information it collects from and about you for the following purposes:
• To enable Bookshop.org to provide you and other Users with the Website, and to improve, protect, and promote the Website and services;
• To address inquiries and respond to customer service requests, questions, and comments;
• To contact you with newsletters, offers, promotions, and other product specials or to customize your experience on the Website;
• To track and analyze use of the Website and Bookshop.org’s services, such as to identify trends, conduct data analysis, and determine the effectiveness of marketing and promotion efforts, and other service offerings, so that Bookshop.org can improve its performance and provide Users with the best experience possible;
• To maintain security and to enforce the Terms of Use and comply with applicable law; and
• For other purposes that Bookshop.org believes are necessary to protect its rights and the rights of others, or as otherwise described to you at the time of collection.

(ii) With respect to the SMS Service, Bookshop.org uses personal information to(a) provide you with the SMS Service, (b) process and respond to inquiries, (c)improve the SMS Service, (d) if necessary, contact you with importantannouncements, or messages, (e) conduct research, and (f) provide anonymousreporting for internal and external clients and partners.

Each message that you send through the SMS Service is stored on our servers. We retain these messages on our servers.  Bookshop.org utilizes servers owned by third parties.

4. How Bookshop.org Shares the Information It Collects

Bookshop.org may share the information it collects from and about you in thefollowing ways:

• Service Providers: Bookshop.org may share your information with certain service providers to help provide, improve, promote, or protect the Website, process payments, or manage ads on other websites. Bookshop.org requires those service providers use your information only for the purposes Bookshop.org has authorized and protect your personal information at least to the same standards as Bookshop.org does.
• Affiliates and Platform Sellers: Bookshop.org may share your contact information with an Affiliate if you visited Bookshop.org’s website via thatAffiliate’s referral link, or you shopped from the Affiliate’s book lists or a Platform Seller’s page on our Website. We will only share your information withPlatform Seller from whom you purchase.
• Legal Matters; Safety: Bookshop.org reserves the right to discloseinformation Bookshop.org collects from or about you when doing so is reasonablynecessary to comply with the law or law enforcement, to prevent fraud or abuse,or to protect the legal rights, property, or the safety of Bookshop.org, Users,or others.
• Sale or Transfer of Assets: In the event that Bookshop.org is acquired by or merged with a third-party entity, or sells all or substantially all of its assets, Bookshop.org reserves the right, in any of these circumstances, to transfer or assign the information it has collected from and about Users aspart of such merger, acquisition, sale, or other change of control. In the unlikely event of bankruptcy, insolvency, reorganization, receivership, or assignment for the benefit of creditors, or the application of laws or equitable principles affecting creditors’ rights generally, Bookshop.org may not be able to control how your personal information is treated, transferred, or used.
• Aggregate or Anonymous Information: Bookshop.org may also share informationthat is aggregated or anonymized in a way that it does not directly identifyyou.
• Publicly Available Information: When Platform Sellers post Content, all Userswill be able to view such Content. Platform Sellers should not post anyinformation, including personal information, that they do not want to bepublicly accessible.

The above excludes the sharing of any personal information collected by the SMSService, which shall not be shared with any third parties.

5. Tracking and Other Technologies

A. Types of Cookies Bookshop.org Utilizes

Bookshop.org uses the following types of cookies and other technologies:

• User Information: Bookshop.org will store a logged-in User’s information to remember the customer information you gave us so that you do not have to re-enter it when making additional purchases.
• Shopping Cart Contents: Bookshop.org also uses cookies to keep track of items you put into your shopping cart including when you have abandoned your cart and this information is used to determine when to send cart reminder messages via the SMS Service
• Security: Bookshop.org secures the Website with cookies that facilitate security features and allow Bookshop.org to detect activity that might violate the Terms of Use, such as unauthorized access or activity.
• Localization: Some cookies help Bookshop.org provide localized experiences, such as displaying the Website in the local language.
• Site Features and Services: Certain cookies provide greater functionality to the Website and help Bookshop.org deliver our products and services.
• Performance: Bookshop.org uses performance cookies to help route traffic between servers and understand how the Website is performing so Bookshop.org can provide Users with the best experience possible.
• Analytics and Research: Cookies and other technologies also help Bookshop.org to understand, improve, and research features and content on the Website. These types of cookies include Google Analytics, which you can opt out of at https://tools.google.com/dlpage/gaoptout.

B. Limiting or Blocking Cookies and Our Do Not Track Policy

Your browser may give you the ability to control cookies, which may depend on the type of cookie, and browsers can be set to reject browser cookies. However, blocking or deleting cookies may prevent you from using most of the Website.Some browsers have “do not track” features that allow you to tell a website not to track you. These features are not all uniform. If you block cookies, certain features on the Website may not work. If you block or reject cookies, not all of the tracking described in this Privacy Policy will necessarily stop. Note that certain options you select are specific to certain browsers and devices.Our system may not recognize Do Not Track requests or headers from some or all browsers.

C. Web Beacons

The Website may contain electronic images known as web beacons (sometimes called single-pixel gifs) and are used along with cookies to compile aggregated statistics to analyze how the Website is used. Bookshop.org uses third parties to gather information about how you and others use the Website. For example,Bookshop.org will know how many Users access a specific page and what WebsiteContent they clicked on. Bookshop.org uses this aggregated information to understand and optimize how the Website is used.

D. Social Media Plug-Ins

Bookshop.org may use certain social media plug-ins (e.g., Facebook, Twitter,YouTube) to allow you to communicate with such services and interact (e.g., “like”or “comment”) with various Website content. The social media plug-in will enable a direct communication between your end user device and the servers of the applicable social media provider, allowing the applicable social media provider to communicate with you and collect information about you browsing theWebsite. If you decide to use a social media plug-in, Bookshop.org may transfer your information to the social media provider, whether or not you have a registered user account with the applicable social media provider. Bookshop.org is not responsible for the content and the data collection on respective third-party websites or apps and that Bookshop.org neither controls the extent of personally information collected by the respective plug-in provider nor knows the processing’s purpose or the period your personally information will be retained. For further information as to how and for what purpose certain social network providers process your data, please see the relevant privacy policies of the applicable social media provider.

6. Your Rights

A. Information for California Residents

California residents may also take advantage of the following rights under theCalifornia Consumer Privacy Act (CCPA) as amended by the California PrivacyRights Act (CPRA). Subject to certain limitations, the CCPA and CPRA provide you with the following rights: The Right to Know. You may request that we disclose to you the categories of personal information we have collected, used, disclosed, or “sold” within the meaning of the CCPA, including:
‍
·      Specific pieces of information that we have collected about you
·      Categories of personal information we have collected about you
·      Categories of sources from which the personal information is collected
·      Categories of personal information about you that We have sold, shared, or disclosed for a business purpose
·      Categories of third parties to whom the personal information was sold, shared or disclosed for a business purpose
·      The business or commercial purpose for collecting, selling, or sharing personal information (collectively, the “Right to Know”)

The Right to Delete. You have the right to request that we delete personal information about you that we have collected from you (the “Right to Delete”).

The Right to Correct. You have the right to request that we correct any incorrect personal information that we collect or retain about you, subject to certain exceptions.

Exercising Your Rights. To exercise your Right to Know, Right to Delete, or Right to Correct contact us at [email protected] (800) 484-6309

Right to Opt Out. You have the right to direct us to not sell or share your personal information at any time(the “Right to Opt Out”). To exercise your right to opt out contact us at [email protected] (800) 484-6309.

Verification. In order to exercise these rights, you will need to verify your identity to protect your security and personal information, which may include providing certain information. Note that even if we honor your request to delete your information, We may retain certain information as required or permitted by law.

Authorized Agent. You may elect to have an agent exercise your rights for you. Even if you choose to use an agent,We may, as permitted by law, require:
‍
·      The authorized agent to provide proof that the consumer gave the authorized agent signed permission to submit the request;
·      The consumer to verify their identity directly with the business;
·      The consumer to directly confirm with us that they provided the authorized agent permission to submit the request.

Non-Discrimination. We may not discriminate against you because of your exercise of any of your privacy rights, or any other rights under the CCPA, including by:
‍
·      Denying you goods or services
·      Charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties
·      Providing you a different level or quality of goods or services
·      Suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services

In addition to the information provided throughout this Privacy Policy, we make the following disclosures:
‍
·      We collected the following categories of personal information within the previous 12 months: identifiers/contact information, commercial information, internet or other electronic network activity information, geolocation, and inferences drawn from the above.
·      We disclosed the following categories of personal information for a business purpose within the previous 12 months: identifiers/contact information, commercial information, internet or other electronic network activity information, geolocation, and inferences drawn from the above. We disclosed this personal information to the service providers, Affiliates and Platform Sellers described in Section 4, above.

B. Information for Nevada Residents

Under Nevada law (SB 220), Nevada residents are permitted to opt-out of the sale of certain kinds of personal information. The term “sale” is used here to mean the transfer of your personal information to third parties for monetary consideration so the third parties can then re-sell or license the sold personal information. If you are a Nevada resident, you have the right to request that we not sell your personal information for monetary consideration to certain other parties.  This right applies even if your personal information is not currently being sold.  If you are a Nevada resident and wish to exercise this right, please contact us at [email protected] or(800) 484-6309.  We value your privacy and will not discriminate in response to your exercise of your privacy rights.

C. Information for Virginia Residents

If you are a resident of Virginia, this section provides information about your privacy rights under the VirginiaConsumer Data Protection Act (VCDPA).Subject to certain limitations, theVCDPA provides you the following rights:
·      To confirm whether we are processing your personal information, and to access that personal information;
·      To receive your personal information in a portable and readily usable format;
·      To correct inaccuracies in your personal information;
·      To delete your personal information;
·      To opt out of the processing of your personal information for targeted advertising, sale to third parties, or profiling where there is a legal or similarly significant effect on you.

You may exercise these rights by contacting us at [email protected].

If Bookshop.org declines your request for any reason, we will notify you. You can appeal this decision by contacting us at [email protected].We value your privacy and will not discriminate in response to your exercise of your privacy rights.

D. Information for EuropeanEconomic Area Residents

If you are a resident of the European Economic Area and would like to gain access to, update, erase, or restrict or withdraw any consent to the processing of certain information collected from and about you through the Website, please contact us at [email protected].

In addition, residents of the European Economic Area also have the right to object to the processing of such information and, in some instances, the right to request that we export, in a structured, commonly used, machine readable, and interoperable format, and transmit to another controller, such information.

The European Union’s General Data Protection Regulation (GDPR) requires a“lawful basis” for collecting and retaining personal information from citizens or residents of the European Economic Area. Bookshop.org’s lawful bases include:

• Consent: In certain cases, you have affirmatively provided Bookshop.org with your consent to collect your personal information for a specific purpose, such as providing your name and email address when you register for an Account.
• Contract: Bookshop.org may need your personal information to comply with contractual obligations to deliver the Website, such as fulfilling transactions for Merchandise.
• Legal Obligations: Sometimes the law requires the collection and use of your information. For example, applicable tax laws may require Bookshop.org to retain records of payments made through the Website.
• Legitimate Interests: This is a technical term that means Bookshop.org has a good and fair reason to use your information and in ways that do not harm your interests and rights, such as in a way that might reasonably be expected aspart of running our business and that does not materially impact your rights, freedom, or interests. For example, Bookshop.org uses identity, device, and location information to prevent fraud and abuse and to keep the Website secure.We may also send you promotional communications about the Website and services subject to your right to opt out, as well as analyze how Users interact with the Website so Bookshop.org can understand better what elements do or do not work well, thereby facilitating improvements and developments in the quality of the online experience for all Users.

C. Email Notifications

Bookshop.org wants to communicate with you only if you want to hear from us.Bookshop.org will send you emails relating to your transactions on or through the Website, as well as service-related announcements when necessary. You may also elect to receive marketing emails, in accordance with your preferences, and from which you may opt out at any time by adjusting your notification settings.Bookshop.org will try to keep emails to a minimum and give you the ability to opt in to any marketing communications.

7. Links to Other Websites and Services

The Website may include links to other websites or services whose privacy practices may differ from the privacy practices as described in this PrivacyPolicy. When you click or otherwise use a link to an external website or service, the privacy policy and data processing disclosures for that website or service govern.

8. Data Retention

Bookshop.org will retain the information collected from or about you as long as necessary to provide you with the Website or Bookshop.org’s services, as otherwise set forth in this Privacy Policy, and to the extent necessary to comply with Bookshop.org’s legal obligations, resolve disputes, enforce our agreements, and protect our legal rights. Additionally, Bookshop.org may retain indefinitely any aggregated or anonymized information, and may from time to time transfer or merge your information collected off-line to our online databases or store off-line information in an electronic format.

9. Cross-Border Data Transfers

Bookshop.org is based in the United States so your information will be collected and processed in the United States, which has its own laws governing data protection and access to it, including by the government. If you reside outside of the United States, be advised that the rules that protect your personal information under United States federal, state, and local law may differ from those of your home country. With respect to any personal information that may be originally collected and stored in the EuropeanEconomic Area, if and when Bookshop.org transfers your personal information to countries outside the European Economic Area, it will do so under the EuropeanCommission’s model contracts for the transfer of personal information to third countries (i.e., standard contractual clauses) pursuant to 2004/915/EC or2010/87/EU (as appropriate). For a copy of these Standard Contractual Clauses, please contact Bookshop at [email protected].

10. Children’s Privacy

The privacy of children is of the utmost importance, and Bookshop.org is committed to complying with applicable privacy law, including the federalChildren’s Online Privacy Protection Act (COPPA), the California ConsumerPrivacy Act (CCPA), and the European Union’s General Data Protection Regulation(GDPR). Bookshop.org does not knowingly collect or process personal information from children under the age of sixteen (16). If Bookshop.org ever discovers that it has inadvertently collected or processed personal information from a child under the age of sixteen (16) on or through the Website, Bookshop.org will take steps to delete such personal information from its records as soon as possible. We do not knowingly sell the personal information of minors under the age of sixteen (16) without such persons’ affirmative authorization as required by applicable law.

11. Security

Bookshop.org takes security seriously, and the security of your personal data is important to us. Bookshop.org follows industry-standard practices to protect the data Bookshop.org collects and maintains, including using Transport LayerSecurity (TLS) to encrypt information as it travels over the Internet. However, the nature of security risks is constantly evolving, as are the technical and organizational industry standards relating to management of those risks, andBookshop.org cannot guarantee the complete security of any information it collects, stores, or uses.

12. Updates to this Privacy Policy

Bookshop.org may change the terms of this Privacy Policy at any time. WheneverBookshop.org makes a material change, Bookshop.org will provide appropriate notice to you. The effective date of the most recent version of this PrivacyPolicy will appear at the top of this page.

13. Contact Us

Questions or comments about this Privacy Policy should be sent by email to [email protected] or mail to Bookshop.org, Inc., 463 Lincoln Place#200 Brooklyn, NY 11238. You also have the right to submit feedback to the applicable supervisory authority in your jurisdiction of residence.

Privacy Notice

© 2023Bookshop.org. All rights reserved