California Privacy Notice

• We care about your privacy and have a dedicated data privacy program. Learn more about our approach to data privacy.

• This California Privacy Notice only applies to individual residents of the State of California and only where we act as ‘business’ (e.g., for our websites and marketing). Where we provide our products and services to consumers on behalf of an institution, we process that personal information as a service provided in accordance with our contractual agreements. In that case, the institution's privacy notice governs the use of personal information.

• We collect personal information from and about you for a variety of purposes and may disclose it to our service providers, business partners and other third parties as described below and in our Privacy Statement. Learn more about such disclosures of personal information.
• We do not sell your personal information for profit. However, we do engage in certain data disclosure activities that may be considered ‘sales’ under the broad definitions of the CCPA. Learn more about such disclosures of personal information and your choices to control this activity.
• As a California resident, you have rights in relation to your personal information. Learn more about your rights and how to exercise them.
• For any other questions, you can contact us at privacy@blackboard.com. More information on how you can contact us.

This CA Notice describes how we (as a ‘business’) collect, use, disclose, and otherwise process personal information of individual residents of the State of California, either online or offline, within the scope of the California Consumer Privacy Act of 2018 (CCPA).

Where we provide our products and services to consumers on behalf of our clients, we are considered a ‘service provider’ under CCPA. In this case, the client’s privacy notice governs the use of personal information. For example, when we process Student Data on behalf of our client institution, we are acting as a service provider and we retain, use and disclose the Student Data in accordance with our written agreement with the client. Accordingly, this Notice only reflects how we collect, use, disclose, and otherwise process personal information for our own purposes (e.g., for our websites and marketing).

For the purposes of this Notice, personal information does not include:

• Publicly available information from government records.

• Deidentified, aggregated or anonymized information that is maintained in a form that is not capable of being associated with or linked to you.

• Information relating to our employees, contractors and other personnel (which is governed by a separate privacy notice)

When we use terms that are defined in the CCPA, they have the same meaning as in the CCPA.

• To fulfill or meet the reason you provided the information. For example, if you share your name and contact information to ask a question about our products or services, we will use that personal information to respond to your inquiry.

• To communicate with you, including via email, text message, push notification and/or telephone calls.

• To operate, maintain, and provide to you the features and functionality of our websites (e.g. blackboard.com, Blackboard Community).

• To market to you, including through email, direct mail, phone or text message.

• To organize and conduct webinars, online meetings and in-person events

• To personalize your experience on our websites.

• To recognize you and remember your information when you return to our websites.

• To help maintain the safety, security, and integrity of our websites.

• For testing, research, analysis, and product development, including to develop and improve our services.

• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.

• For any other business and operational purpose described in our Privacy Statement, and

• as otherwise permitted or required by law.

In the last 12 months, we have collected and disclosed for a business purpose the following categories of personal information:

The categories of third parties to whom we have disclosed personal information for a business purpose include:

• Our service providers. We engage a number of third-party service providers that perform business or operational services for us or on our behalf, such as website hosting, infrastructure provisioning, IT services, email delivery services, marketing and advertising services, and other similar services. Our contracts with such third parties restrict the collection, use and disclosure of your personal information for any other commercial purpose;

• Third parties at your request. We share your personal information with third parties with your consent or at your direction, or with third parties with whom you chose to engage or interact through our services;

• Businesses as needed to provide services. We may share personal information with third parties you engage with through our services, or as needed to fulfil your request or transaction, including, for example, payment processing;

• Security providers. We may share your personal information with third-party security providers, for example, to detect, prevent, or otherwise address actual or suspected fraud, harassment, security or technical issues, violations of any law, rule, regulation or of our policies;

• Business partners. We may disclose personal information to third parties such as our resellers, technology partners, content partners or event sponsors, with whom we partner to provide events, webinars, joint promotional activities or similar marketing-related activities, and such disclosure is necessary to organize and manage these activities;

• Analytics providers. We work with third party analytics providers to better understand the demographics of our users and visitors, and to personalize, enhance and improve our services;

From time to time, we may also disclose personal information to third parties for other purposes, such as if reasonably necessary to comply with law or a legal or contractual obligation, or in the context of a corporate transaction. Please see our Privacy Statement to learn more.

We do not sell your personal information for profit. However, we do engage in certain data disclosure activities that may be considered ‘sales’ under the broad definitions of the CCPA.

In the previous 12 months, we have ‘sold’ personal information in the following ways:

• Disclosed identifiers (such as name, email address) and Professional/Employment Information (such as the name of the institution you are affiliated with) to our Business Partners and sponsors of events and webinars for B2B marketing and client engagement purposes.

• Disclosed identifiers (such as a hashed email address) to social media companies for the purpose of displaying personalized advertising and content to you on those social networks.

As is common practice among companies that operate online, we have permitted third party advertising networks, social media companies and other third party businesses to collect information directly from your browser or device through cookies or similar tracking technology when you visit or interact with our website, use our apps or otherwise engage with us online. For example, they may collect Internet/Network information, such as a cookie or device ID, browsing history and website usage, Geolocation Data, and Inferences generated from your browsing history and interactions with our services as well as other sites and services. These third parties use this personal information to serve targeted advertising or to personalize content and perform other advertising-related services such as reporting, attribution, analytics and market research. These third-party businesses may use such information for their own purposes in accordance with their own privacy statements, which may include reselling this information to additional third parties, including other advertising networks. To learn more, please see our Cookie Statement.

As a California resident, you can exercise the following rights in relation to your personal information (subject to certain limitations in the CCPA).

Please remember: If you are a user of our products and services that we provide on behalf of your institution, contact your institution to exercise your rights. They need to manage your request even if it relates to information that we store on behalf of your institution. We will support your institution as needed with your request.

To Exercise Your Right to Know or Right to Deletion

To exercise your Right to Know and/or your Right to Deletion, please submit a request by:

• Emailing privacy@blackboard.com with the subject line “California Rights Request,”

• Filling out our California Resident Rights Request Form, or

• Calling 877-918-2620 (Please note, response times may be faster if you submit your request through our California Resident Rights Request Form above or via email)

We will need to verify your identity before processing most requests, which may require us to obtain additional personal information from you or require you to log into your account, if you have one. We will only use such personal information to review and comply with your request.

In certain circumstances, we may decline or limit your request, particularly where we are unable to verify your identity or locate information in our systems, or as permitted by law.

You do not need to create an account with us to exercise your Right to Opt Out of Personal Information Sales. However, we may ask you to provide additional personal information so that we can identify you in our data systems and to track compliance with your opt-out request. We will only use such personal information to review and comply with the request. If you chose not to provide this information, we may only be able to process your request to the extent we are able to identify you in our data systems.

Please also refer to our Cookie Statement to learn more about how third party ad networks, social media companies and other third party businesses collect information from you when you visit our online Services and the opt-out choices you may have in relation to those activities.

The Right to Opt In for Minors Under Age 16. We do not sell the personal information of consumers we know to be less than 16 years of age, unless we receive affirmative authorization (the "Right to Opt In") from either the minor who is between 13 and 16 years of age, or the parent or guardian of a minor less than 13 years of age.

Shine the Light Law. California's "Shine the Light" law (Civil Code Section §1798.83) permits California residents that have an established business relationship with us to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes during the immediately preceding calendar year. To opt-out of having your personal information disclosed to third parties for their direct marketing purposes, please click Do Not Sell My Personal Information to be added to our suppression list.

Updates to this Notice. We will update this Notice from time to time. When we make changes to this Notice, we will change the "Last Updated" date at the beginning of this Notice. All changes shall be effective from the date of publication unless otherwise provided in the notification.