Privacy Policy

Barnes & Noble prioritizes the protection of user personal data as a foundational element of building stable, trustworthy relationships with its customer base. All user interactions, including website browsing, in-store visits, online purchases, digital service usage, membership enrollment and customer service communications, may involve the collection and processing of personal data to deliver high-quality products and comprehensive services. The brand adheres to responsible and transparent data management standards, implementing rigorous protective measures across all internal business operations to safeguard user information at every stage.

This privacy framework applies universally to all customer engagement channels and affiliated service ecosystems. User data may be gathered during account registration, merchandise checkout, mobile app usage, rewards program participation and customer service consultations, as well as through interaction with other platform features. The brand’s affiliated subsidiaries and cooperative service platforms follow unified data management specifications to ensure consistent information processing standards across the entire business system. These standardized practices enable customers to fully understand the complete process of personal data collection, processing, storage and protection during their interactions with the brand.

The scope of collected data varies based on the specific services customers utilize. Actively submitted user information covers personal names, contact methods, account login credentials, billing data and delivery addresses, all of which are essential for completing transaction processes and fulfilling service commitments. Meanwhile, the platform automatically captures technical data during user access to digital systems, including device attributes, browser parameters, online behavior records and network connection details. Such technical data supports stable website operation, optimizes service performance monitoring, identifies abnormal account activity and continuously improves the overall digital user experience.

All collected user information is applied to legitimate and standardized business scenarios. Core applications include order processing and fulfillment, daily account maintenance, customer inquiry responses, service delivery, transaction notification, product and digital function optimization, and platform security maintenance. When permitted by relevant regulations, user data may also be leveraged to provide personalized product recommendations, targeted promotional updates and exclusive membership benefits tailored to individual user preferences. Customers retain independent control over their message reception settings and can freely adjust the types of marketing content they receive according to personal needs.

The brand adopts a multi-dimensional protection system integrating technical encryption, standardized operational processes and hierarchical access permissions to secure customer data. Access to personal information is strictly limited to internal staff and third-party service providers with valid business authorization. The brand continuously optimizes security strategies by iterating technical tools and upgrading risk prevention mechanisms in response to technological updates, business expansion and evolving potential safety hazards. While no electronic data transmission or storage system can achieve absolute security under all circumstances, Barnes & Noble spares no effort in implementing comprehensive preventive measures to avoid unauthorized data access, leakage, modification and loss.

To support normal business operation, the brand may share user data with rigorously screened third-party service providers. These cooperative partners undertake core operational work including payment settlement, order delivery, technical system maintenance, customer service support, data analysis, risk monitoring and business communication. All shared data is strictly limited to the minimum content required for service execution. In addition, user information may be legally disclosed when complying with judicial procedures and regulatory requirements, or when necessary to protect the legitimate rights and interests of customers, employees, brand assets and other related parties.

Barnes & Noble always processes customer data in strict accordance with prevailing privacy laws and regulations, with full transparency serving as the core principle of data management. Depending on regional jurisdictional rules, users enjoy a series of legal privacy rights, including accessing stored personal data, correcting inaccurate information, applying for legal data deletion, and obtaining detailed explanations of data processing procedures. The specific exercisable rights and application workflows vary according to federal, state and international privacy regulatory provisions applicable to each user’s region.

Supplementary privacy rules apply to users in specific regions and countries. Customers residing in states with complete local privacy legislation can obtain targeted notifications covering exclusive privacy rights, optional settings and application channels. Similar protection mechanisms extend to overseas users, including individuals protected by privacy supervision systems in the European Union, the United Kingdom and Switzerland. The brand actively provides standardized explanations for cross-border data transmission rules, legal processing bases, user legitimate rights and right-exercising procedures for eligible overseas users.

The brand formulates special data protection specifications for minors and young users. It strictly abides by national and regional laws on minor information collection and usage, and deploys enhanced protective measures for minor user data. Guardians and eligible personnel can exercise corresponding management rights over minor-related personal information in accordance with legal provisions and actual usage scenarios.

User personal data is only retained for the shortest duration required to fulfill collection purposes, unless extended storage is mandated or permitted by law. The brand comprehensively considers transaction execution needs, daily account operation, legal compliance obligations, dispute resolution requirements, security maintenance and standardized file management rules to formulate reasonable data retention cycles. Once user data no longer serves business and legal purposes, the brand will complete data clearing, anonymization and standardized disposal in accordance with regulatory requirements.

Users with questions or objections regarding privacy rules, account information, message push and data processing methods can submit consultations and appeals through official customer service channels. All privacy right applications require strict identity verification to prevent illegal access and unauthorized disclosure of personal information. The brand formulates standardized response workflows and completes the handling of user requests within the time limit stipulated by relevant laws and regulations.

Barnes & Noble’s business ecosystem extends far beyond traditional offline book sales, covering digital reading services, mobile application tools, membership systems, audiobook resources, online original content, podcast programs, gift card services and diversified in-store experiences, all of which involve standardized data processing procedures. Each independent service module is equipped with targeted privacy instructions and personalized data management rules to clarify exclusive information processing standards.

Through standardized privacy specifications, rigorous security control and flexible user permission settings, the brand builds a safe and reliable environment for users to shop, read, manage accounts and participate in digital interactive activities. As business models, internet technologies, legal regulations and service content continue to iterate, the brand will regularly update its privacy policies. All revised clauses are formulated based on actual business changes, always adhering to the principle of standardized data management and fully respecting user privacy rights.