The Princeton Review and Tutor.com Privacy Policy

Personal Information (Including Sensitive Personal Information) We Collect

We may collect, and in the past 12 months have collected, the following categories of personal information:

• Identifiers (such as name, address, email address, cookies, IP address, machine ID, date of birth, student ID number, and library card number)
• Categories of personal information listed in the California Customer Records statute (such as phone number, credit card number, and education)
• Characteristics of protected classifications under California or federal law (such as military or veteran status and race)
• Commercial information (such as purchase or enrollment history)
• Internet or other electronic network activity information (such as interaction with our Sites)
• Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)) (such as test scores, GPA, course enrollments, and transcripts)
• Audio, electronic, visual, thermal, olfactory, or similar information (such as recorded voice, recorded video, and photos)
• Professional or employment-related information (such as employer information and job title)
• Inferences drawn from other categories of personal information to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes (such as likelihood of making a purchase based on internet or other electronic network activity).
• Sensitive personal information:
  • Social security number (which we may collect from consumers who are winners of giveaways and (if they choose to provide the information to us, even though we do not intend to collect such information) from consumers enrolled in our admissions counseling services)
  • Account log-in in combination with any required security or access code, password, or credentials allowing access to an account.
  • Financial account, debit card, or credit card number in combination with any required security or access code
  • Racial or ethnic origin
  • Religious or philosophical beliefs (which we may collect from consumers enrolled in our admissions counseling services and take into account in providing our admissions counseling services (if they choose to provide the information to us, even though we do not intend to collect such information))
  • Personal information collected and analyzed concerning a consumer’s health (which we may collect from consumers enrolled in our admissions counseling services and take into account in providing our admissions counseling services (if they choose to provide the information to us, even though we do not intend to collect such information))
  • Personal information collected and analyzed concerning a consumer’s sex life or sexual orientation (which we may collect from consumers enrolled in our admissions counseling services and take into account in providing our admissions counseling services)

Sources from which Personal Information (Including Sensitive Personal Information) is Collected

We collect personal information from the categories of sources listed below, as described in more detail in the “Information We Collect” section above:

• Consumers
• Third parties with whom we have a business relationship (such as our organizational customers, organizations that we have marketing agreements with, resellers, licensees, and franchisees)
• Other users who refer you to us
• College and universities who provide information for the purpose of conducting surveys
• Publicly and commercially available sources, including organizers of events you may attend
• Browsers and tracking technologies
• Our service providers and other vendors

Purposes for which Personal Information (Including Sensitive Personal Information) Will Be Collected or Used

We may collect or use personal information for the following purposes:

• provide you with and personalize our products and services;
• create and manage your account, process your orders, and provide you customer service;
• maintain our internal records, comply with legal requirements, and otherwise manage our business;
• send you newsletters and advertisements and otherwise correspond with you about products, services, events, and other organizations that we think may interest you;
• ask for your reviews and testimonials and send you surveys and questionnaires;
• include as content in our products and services and marketing materials if you have provided permission;
• improve our products, services, and Site;
• administer sweepstakes and other promotions;
• develop and display content and advertising tailored to your interests on our Site and other sites, provide our advertisements to you when you visit other sites, and analyze the effectiveness of our advertisements;
• perform research and analysis about your use of or interest in our products and services, the products or services offered by others, and our Site, and develop new products and services;
• detect, prevent, or investigate illegal activity or misuse of our products or services and enforce our legal rights; and
• perform functions as otherwise described to you at the time of collection.

We do not use sensitive personal information for purposes other than to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services.

Personal Information Sold

We may be deemed to sell personal information (but not sensitive personal information) to third parties who provide online advertising services to us for the purpose of cross-context behavioral advertising and may be deemed to have sold personal information of California consumers in the preceding 12 months to third parties who provide online advertising services to us for the purpose of cross-context behavioral advertising. The foregoing does not apply to consumers who visited www.tutor.com but not www.princetonreview.com. We do not currently sell the personal information of minors under 16 years of age and do not have actual knowledge that we sell the personal information of minors under 16 years of age. We do not have a process for those under 16 years of age to opt-in to such sharing.

Personal Information Shared with Third Parties

We have shared personal information (but not sensitive personal information) with third parties who provide online advertising services to us for the purpose of cross-context behavioral advertising in the preceding 12 months. The foregoing does not apply to consumers who visited www.tutor.com but not www.princetonreview.com. We do not currently share the personal information of minors under 16 years of age and do not have actual knowledge that we share the personal information of minors under 16 years of age. We do not have a process for those under 16 years of age to opt-in to such sharing.

Personal Information (Including Sensitive Personal Information) Disclosed for a Business Purpose

We may disclose personal information to a third party for a business purpose. In the preceding 12 months, we have disclosed the categories of personal information listed below:

• Identifiers
• Categories of personal information listed in the California Customer Records statute
• Characteristics of protected classifications under California or federal law
• Commercial information
• Internet or other electronic network activity information
• Non-public education information
• Audio, electronic, visual, thermal, olfactory, or similar information
• Professional or employment-related information
• Inferences drawn from other categories of personal information
• Sensitive personal information

We have disclosed some of the categories of personal information to organizations which arranged for consumers’ participation in our products and services as part of the services we provide to these organizations and to third parties whose products or services we resell. We have disclosed all of the categories of personal information listed above to our service providers and other vendors because they help deliver our products and services and otherwise help us operate our business.

We do not disclose sensitive personal information to third parties for purposes other than to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services.

Your Right to Know

You have the right to request that we disclose information to you about our collection, use, disclosure, sale, and sharing of your personal information. Once we receive and confirm your verifiable consumer request, then subject to exceptions provided under the California Privacy Law and based on your request, we will disclose to you:

• The categories of personal information we collected about you.
• The categories of sources from which we collected your personal information.
• The business or commercial purpose for collecting, selling, or sharing your personal information.
• The categories of third parties to whom we disclosed your personal information.
• The specific pieces of personal information we collected about you.
• If we sold or shared your personal information, the categories of personal information that we collected about you and that were sold or shared with each category of recipient.
• If we disclosed your personal information for a business purpose, the categories of personal information that we collected about you and that were disclosed to each category of recipient.

Your Right to Deletion

You have the right to request that we delete your personal information that we have collected, subject to exceptions provided under the California Privacy Law. Once we receive and confirm your verifiable consumer request, then unless an exception applies, we will delete your personal information from our records and direct our service providers and other vendors to delete your personal information from their records.

Your Right to Correct Inaccurate Personal Information

If we maintain inaccurate personal information about you, you have the right to request that we correct the inaccurate personal information, taking into account the nature of the personal information and the purposes of the processing of the personal information. Once we receive and confirm your verifiable consumer request, then unless otherwise provided by the California Privacy Law and subject to our receipt of documentation that we may request, we will correct your personal information in our systems and direct our service providers and other vendors to correct your personal information in their systems. Please note, however, that if we received the inaccurate personal information from an organization that arranged for your participation in one of our programs, then the organization may need to correct the inaccurate personal information in order for you to be able to continue to access the program.

Submitting Requests

To exercise your right to know, right to deletion, or right to correction described above, please submit a verifiable consumer request to us by:

• Calling us at 888-223-7737; or
• Completing and submitting the web form located at www.princetonreview.com/ccpa or www.tutor.com/ccpa.

You may only make a verifiable consumer request to know twice within a 12-month period.

You may authorize another person to act as your agent to submit requests on your behalf. Unless you provide the agent with power of attorney under the California Probate Code, you will need to provide the agent a written and signed authorization. You may also submit requests on behalf of your minor child.

Verification

We will verify your identity before fulfilling your request to know, to delete, or to correct. If you have an account with us, we will ask you to enter your username and password through a link we provide to verify your identity. If you do not have an account with us, we will ask you to provide us data points that we have about you to verify your identity.

If you authorize another person to act as your agent to submit requests on your behalf, then unless you provide the agent with power of attorney under the California Probate Code, we will ask the agent to provide us the written and signed authorization that you provided to the agent, we will confirm with you that you did provide the authorization, and we will verify your identity. If you submit a request on behalf of a minor child, we will ask you to provide us information about your child that allows us to determine that you are the parent or guardian of the child. If the child is under the age of 13, we will ask you to sign a form declaring under penalty of perjury that you are the parent or guardian of the child.

Our Response to Your Request

We endeavor to respond to a verifiable consumer request within 45 days of its receipt. If we reasonably require more time (up to 45 additional days), we will inform you of the reason in writing within 45 days of receipt of your request. We will deliver our written response by mail or electronically. If we are unable to comply with a request, our response will explain why.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Your Right to Opt Out of the Sale and Sharing of Personal Information

You have the right to opt out of the sale of your personal information and sharing of your personal information for cross context behavioral advertising. You can exercise this right by clicking on the following link: www.princetonreview.com/cpraoptout. You can also exercise this right by calling us at 888-223-7737.

In your browser settings or through a browser extension, you can also have your browser send an opt-out preference signal. We will process the signal at the browser level so that when we detect the signal from your browser, we will opt you out of the sale and sharing of your personal information so long as you are using the same browser with the opt-out preference signal enabled.

The foregoing does not apply to consumers who visit www.tutor.com but not www.princetonreview.com since we do not sell or share the personal information of such consumers.

Your Right to Non-Discrimination

You have the right not to receive discriminatory treatment by us for the exercise of the rights conferred by the California Privacy Law.

How Long We Retain Personal Information

The length of time that we retain each category of personal information is determined by various criteria, including maintaining our ability to provide our products and services and honor guarantees, contractual obligations, maintaining our ability to address complaints about our products and services and defend against or bring claims, maintaining records for audit purposes or as required by law, the type of relationship a consumer has with us and the duration of the relationship, and the retention policies and practices of, and features in the offerings provided by, our service providers and other vendors.

Processing of De-identified Data

We commit to maintaining and using de-identified data without attempting to re-identify the data.

Accessibility of this Privacy Policy

Commercially available screen reader programs should be able to read this Privacy Policy. As a web page, this Privacy Policy may be printed as a document.

Categories of Personal Data that We Have Collected or Processed

We have collected or processed the following categories of personal data:

• Name and date of birth
• Contact information (such as address, email address, and phone number)
• Online identifiers (such as cookies, IP address, and machine ID)
• Identification numbers (such as library card number and student ID number)
• Education and school information (such as test scores, course enrollments, graduation year, GPA, and transcripts)
• Payment information (such as credit card number)
• Commercial information (such as purchase or enrollment history)
• Online activity (such as interaction with our Sites)
• Audio or visual information (such as recorded voice, recorded video, and photos)
• Professional or employment-related information (such as employer information, job title, and military or veteran status)
• Sensitive data (such as personal data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life or sexual orientation, citizenship or citizenship status, and personal data of children under the age of 13)

Purposes for which the Categories of Personal Data Are Processed

The table below lists each category of personal data in the immediately preceding section and the purposes for processing the category of personal data based on the purposes listed under the “How We Use Information” section above.

Category of Personal Data	Purposes for Processing the Personal Data
Name and date of birth	Provide you with and personalize our products and services or resell to you the products and services of a third party; create and manage your account, process your orders, and provide you customer service; maintain our internal records, comply with legal requirements, and otherwise manage our business; send you newsletters and advertisements and otherwise correspond with you about products, services, events, and other organizations that we think may interest you; ask for your reviews and testimonials and send you surveys and questionnaires; include as content in our products and services and marketing materials if you have provided permission; improve our products, services, and Site; administer sweepstakes and other promotions; detect, prevent, or investigate illegal activity or misuse of our products or services and enforce our legal rights; perform functions as otherwise described to you at the time of collection
Contact information	Provide you with and personalize our products and services or resell to you the products and services of a third party; create and manage your account, process your orders, and provide you customer service; maintain our internal records, comply with legal requirements, and otherwise manage our business; send you newsletters and advertisements and otherwise correspond with you about products, services, events, and other organizations that we think may interest you; ask for your reviews and testimonials and send you surveys and questionnaires; administer sweepstakes and other promotions; detect, prevent, or investigate illegal activity or misuse of our products or services and enforce our legal rights; perform functions as otherwise described to you at the time of collection.
Online identifiers	Provide you with and personalize our products and services or resell to you the products and services of a third party; maintain our internal records, comply with legal requirements, and otherwise manage our business; improve our products, services, and Site; develop and display content and advertising tailored to your interests on our Site and other sites, provide our advertisements to you when you visit other sites, and analyze the effectiveness of our advertisements; perform research and analysis about your use of or interest in our products and services, the products or services offered by others, and our Site, and develop new products and services; detect, prevent, or investigate illegal activity or misuse of our products or services and enforce our legal rights; perform functions as otherwise described to you at the time of collection.
Identification numbers	Provide you with and personalize our products and services or resell to you the products and services of a third party; create and manage your account, process your orders, and provide you customer service; maintain our internal records, comply with legal requirements, and otherwise manage our business; detect, prevent, or investigate illegal activity or misuse of our products or services and enforce our legal rights; perform functions as otherwise described to you at the time of collection.
Education and school information	Provide you with and personalize our products and services or resell to you the products and services of a third party; create and manage your account, process your orders, and provide you customer service; maintain our internal records, comply with legal requirements, and otherwise manage our business; send you newsletters and advertisements and otherwise correspond with you about products, services, events, and other organizations that we think may interest you; include as content in our products and services and marketing materials if you have provided permission; perform functions as otherwise described to you at the time of collection.
Payment information	Provide you with and personalize our products and services or resell to you the products and services of a third party; create and manage your account, process your orders, and provide you customer service; maintain our internal records, comply with legal requirements, and otherwise manage our business; detect, prevent, or investigate illegal activity or misuse of our products or services and enforce our legal rights; perform functions as otherwise described to you at the time of collection.
Commercial information	Provide you with and personalize our products and services or resell to you the products and services of a third party; create and manage your account, process your orders, and provide you customer service; maintain our internal records, comply with legal requirements, and otherwise manage our business; send you newsletters and advertisements and otherwise correspond with you about products, services, events, and other organizations that we think may interest you; include as content in our products and services and marketing materials if you have provided permission; perform research and analysis about your use of or interest in our products and services, the products or services offered by others, and our Site, and develop new products and services; detect, prevent, or investigate illegal activity or misuse of our products or services and enforce our legal rights; perform functions as otherwise described to you at the time of collection.
Online activity	Provide you with and personalize our products and services or resell to you the products and services of a third party; create and manage your account, process your orders, and provide you customer service; maintain our internal records, comply with legal requirements, and otherwise manage our business; send you newsletters and advertisements and otherwise correspond with you about products, services, events, and other organizations that we think may interest you; improve our products, services, and Site; develop and display content and advertising tailored to your interests on our Site and other sites, provide our advertisements to you when you visit other sites, and analyze the effectiveness of our advertisements; perform research and analysis about your use of or interest in our products and services, the products or services offered by others, and our Site, and develop new products and services; detect, prevent, or investigate illegal activity or misuse of our products or services and enforce our legal rights; perform functions as otherwise described to you at the time of collection.
Audio or visual information	Provide you with and personalize our products and services; create and manage your account, process your orders, and provide you customer service; maintain our internal records, comply with legal requirements, and otherwise manage our business; include as content in our products and services and marketing materials if you have provided permission; improve our products, services, and Site; detect, prevent, or investigate illegal activity or misuse of our products or services and enforce our legal rights; perform functions as otherwise described to you at the time of collection.
Professional or employment-related information	Provide you with and personalize our products and services; create and manage your account, process your orders, and provide you customer service; maintain our internal records, comply with legal requirements, and otherwise manage our business; send you newsletters and advertisements and otherwise correspond with you about products, services, events, and other organizations that we think may interest you; include as content in our products and services and marketing materials if you have provided permission; detect, prevent, or investigate illegal activity or misuse of our products or services and enforce our legal rights; perform functions as otherwise described to you at the time of collection.
Sensitive data	Provide you with and personalize our products and services; create and manage your account, process your orders, and provide you customer service; maintain our internal records, comply with legal requirements, and otherwise manage our business; include as content in our products and services and marketing materials if you have provided permission; perform functions as otherwise described to you at the time of collection.

Your Rights under the CPA and How to Exercise Them

Subject to the CPA, you may exercise the following rights under the CPA:

• To opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data). You may authorize another person, acting on your behalf, to opt out of such processing of your personal data. We do not otherwise sell your personal data or process personal data for the purposes of profiling in furtherance of decisions that produce legal or similarly significant effects.  
• To confirm whether or not we are processing your personal data and to access such personal data. When exercising the right to access your personal data, you have the right to obtain the personal data in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance. You may exercise this right to access and obtain your personal data no more than 2 times per calendar year.
• To correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of your personal data.
• To delete personal data concerning you.

To exercise the opt out right described above, please submit a request to us by:

• Calling us at 888-223-7737; or
• Completing and submitting the online request form located at www.princetonreview.com/optout.

To exercise any of the other rights, please submit a request to us by:

• Calling us at 888-223-7737; or
• Completing and submitting the online request form located at www.princetonreview.com/stateprivacyrequests or www.tutor.com/stateprivacyrequests.

We will provide information in response to your request free of charge once during any 12-month period.

We will authenticate your identity before fulfilling your request (other than an opt out request). If you have an account with us, we will ask you to enter your username and password through a link we provide to authenticate your identity. If you do not have an account with us, we will ask you to provide us data points that we have about you to authenticate your identity. If you authorize another person to act as your agent to submit an opt out request on your behalf, then we will authenticate, with commercially reasonable effort, your identity and the authority of the other person to act on your behalf.

We endeavor to respond to a request after we have verified your identity within 45 days of receipt of the request. If we reasonably require more time (up to 45 additional days), we will inform you of the extension together with the reasons for the delay within 45 days of receipt of the request. If we do not take action on a request, we will provide the reasons for our decision within 45 days of the receipt of the request.

You may appeal our decision by completing and submitting an online appeals form located at www.princetonreview.com/stateprivacyappeals or www.tutor.com/stateprivacyappeals.

Within 45 days of our receipt of the appeal, we will inform you of any action taken or not taken in response to the appeal, along with a written explanation of the reasons in support of the response. If we reasonably require more time (up to 60 additional days), we will inform you of the extension together with the reasons for the delay within 45 days of our receipt of the appeal. If you have concerns about the results of the appeal, you may contact the Attorney General of Colorado.

Categories of Personal Data that We Share with Third Parties

We may share any of the personal data that we process with third parties.

Categories of Third Parties with whom We Share Personal Data

We share personal data with the categories of third parties listed under the “Third Parties to whom We Disclose Information” section above.

Targeted Advertising and Sale of Personal Data

We process personal data for targeted advertising. We do not sell personal data (unless processing personal data for targeted advertising is deemed a sale). You may opt out of such processing by submitting a request to us as described in the “Your Rights under the CPA and How to Exercise Them” section above.

In your browser settings or through a browser extension, you can also have your browser send an opt-out preference signal. We will process the signal at the browser level so that when we detect the signal from your browser, we will opt you out of the processing of your personal data for targeted advertising so long as you are using the same browser with the opt-out preference signal enabled.

The foregoing does not apply to consumers who visit www.tutor.com but not www.princetonreview.com since we do not process personal data of such consumers for targeted advertising.

Processing of De-identified Data

We commit to maintaining and using de-identified data only in a de-identified fashion and not attempting to re-identify the data.

Categories of Personal Data that We Have Processed

We have processed the following categories of personal data:

• Name and date of birth
• Contact information (such as address, email address, and phone number)
• Online identifiers (such as cookies, IP address, and machine ID)
• Identification numbers (such as library card number and student ID number)
• Education and school information (such as test scores, course enrollments, graduation year, GPA, and transcripts)
• Payment information (such as credit card number)
• Commercial information (such as purchase or enrollment history)
• Online activity (such as interaction with our Sites)
• Audio or visual information (such as recorded voice, recorded video, and photos)
• Professional or employment-related information (such as employer information, job title, and military or veteran status)
• Sensitive data (such as personal data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation, citizenship or immigration status, and personal data of children under the age of 13)

Purposes for which the Categories of Personal Data Are Processed

We may process personal data for the purposes listed under the “How We Use Information” section above.

Your Rights under the CTDPA and How to Exercise Them

Subject to the CTDPA, you may exercise the following rights under the CTDPA:

• To confirm whether or not we are processing your personal data and to access such personal data.
• To correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of your personal data.
• To delete personal data provided by or obtained about you.
• To obtain your personal data in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance.
• To opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data). You may authorize another person, acting on your behalf, to opt out of such processing of your personal data. A parent or guardian may also exercise this opt out right on behalf of their child. We do not otherwise sell your personal data or process personal data for the purposes of profiling in furtherance of solely automated decisions that produce legal or similarly significant effects.  

To exercise the opt out right described above, please submit a request to us by completing and submitting the online request form located at www.princetonreview.com/optout. To exercise any of the other rights described above or to revoke consent that you provided to the processing of your sensitive data by us (if you provided such consent previously), please submit a request to us by completing and submitting the online request form located at www.princetonreview.com/stateprivacyrequests or www.tutor.com/stateprivacyrequests.

We will provide information in response to your request free of charge once during any 12-month period. If your requests are manifestly unfounded, excessive, or repetitive, we may charge you a reasonable fee to cover the administrative costs of complying with the request or decline to act on the request.

We will verify your identity before fulfilling your request (other than an opt out request). If you have an account with us, we will ask you to enter your username and password through a link we provide to verify your identity. If you do not have an account with us, we will ask you to provide us data points that we have about you to verify your identity. If you authorize another person to act as your agent to submit an opt out request on your behalf, then we will verify, with commercially reasonable effort, your identity and the authority of the other person to act on your behalf.

We endeavor to respond to a request after we have verified your identity within 45 days of receipt of the request. If we reasonably require more time (up to 45 additional days), we will inform you of the extension together with the reasons for the delay within 45 days of receipt of the request. If we do not take action on a request, we will provide the reasons for our decision within 45 days of the receipt of the request. Notwithstanding the foregoing, if you revoke consent that you provided previously to our processing of your sensitive data, we will cease processing your sensitive data within 15 days after receiving the revocation.

You may appeal our decision by completing and submitting an online appeals form located at www.princetonreview.com/stateprivacyappeals or www.tutor.com/stateprivacyappeals.

Within 45 days of our receipt of the appeal, we will inform you of any action taken or not taken in response to the appeal, along with a written explanation of the reasons in support of the response. If we reasonably require more time (up to 60 additional days), we will inform you of the extension together with the reasons for the delay within 45 days of our receipt of the appeal. If you have concerns about the results of the appeal, you may contact the Attorney General of Connecticut at https://portal.ct.gov/AG/Common/Complaint-Form-Landing-page or 860-808-5420.

Categories of Personal Data that We Share with Third Parties

We may share any of the personal data that we process with third parties.

Categories of Third Parties with whom We Share Personal Data

We share personal data with the categories of third parties listed under the “Third Parties to whom We Disclose Information” section above.

Targeted Advertising and Sale of Personal Data

We process personal data for targeted advertising. We do not sell personal data (unless processing personal data for targeted advertising is deemed a sale). You may opt out of such processing by submitting a request to us as described in the “Your Rights under the CTDPA and How to Exercise Them” section above.

In your browser settings or through a browser extension, you can also have your browser send an opt out preference signal. We will process the signal at the browser level so that when we detect the signal from your browser, we will opt you out of the processing of your personal data for targeted advertising so long as you are using the same browser with the opt out preference signal enabled.

Categories of Personal Data that We Have Processed

We have processed the following categories of personal data:

• Name and date of birth
• Contact information (such as address, email address, and phone number)
• Online identifiers (such as cookies, IP address, and machine ID)
• Identification numbers (such as library card number and student ID number)
• Education and school information (such as test scores, course enrollments, graduation year, GPA, and transcripts)
• Payment information (such as credit card number)
• Commercial information (such as purchase or enrollment history)
• Online activity (such as interaction with our Sites)
• Audio or visual information (such as recorded voice, recorded video, and photos)
• Professional or employment-related information (such as employer information, job title, and military or veteran status)
• Sensitive data (such as personal data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation, status as transgender or nonbinary, citizenship or immigration status, and personal data of children under the age of 13)

Purposes for which the Categories of Personal Data Are Processed

We may process personal data for the purposes listed under the “How We Use Information” section above.

Your Rights under the DPDPA and How to Exercise Them

Subject to the DPDPA, you may exercise the following rights under the DPDPA:

• To confirm whether or not we are processing your personal data and to access such personal data, unless such confirmation or access would require us to reveal a trade secret.
• To correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of your personal data.
• To delete personal data provided by or obtained about you.
• To obtain your personal data in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance, where the processing is carried out by automated means, provided that we are not required to reveal any trade secret.
• To obtain a list of the categories of third parties to which we have disclosed your personal data.
• To opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data).  We do not otherwise sell your personal data or process personal data for the purposes of profiling in furtherance of solely automated decisions that produce legal or similarly significant effects. 

To exercise the opt out right described above, please submit a request to us by completing and submitting the online request form located at www.princetonreview.com/optout. To exercise any of the other rights described above or to revoke consent that you provided to the processing of your sensitive data by us (if you provided such consent previously), please submit a request to us by completing and submitting the online request form located at www.princetonreview.com/stateprivacyrequests or www.tutor.com/stateprivacyrequests.

We will provide information in response to your request free of charge once during any 12-month period. If your requests are manifestly unfounded, excessive, or repetitive, we may charge you a reasonable fee to cover the administrative costs of complying with the request or decline to act on the request.

A parent or legal guardian of a child under the age of 13 may submit requests on behalf of the child. A guardian or conservator may submit requests on behalf of another person subject to guardianship or conservatorship, respectively. You may authorize another person, acting on your behalf, to opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data).

We will verify your identity before fulfilling your request (other than an opt out request). If you have an account with us, we will ask you to enter your username and password through a link we provide to verify your identity. If you do not have an account with us, we will ask you to provide us data points that we have about you to verify your identity.

If you submit a request on behalf of your child or ward under the age of 13, we will ask you to provide us information about the child that allows us to determine that you are the parent or legal guardian of the child (unless our records indicate that you are the parent or legal guardian). If you are the guardian or conservator of another person subject to guardianship or conservatorship and submit a request on behalf of the other person, then we will use commercially reasonable efforts to verify the identity of the other person and your authority to act on behalf of the other person. If you designate an authorized agent, acting on your behalf, to opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data), then we will use commercially reasonable efforts to verify your identity and the authorized agent’s authority to act on your behalf.

We endeavor to respond to a request after we have verified your identity within 45 days of receipt of the request. If we reasonably require more time (up to 45 additional days), we will inform you of the extension together with the reasons for the delay within 45 days of receipt of the request. If we do not take action on a request, we will provide the reasons for our decision within 45 days of the receipt of the request. Notwithstanding the foregoing, if you revoke consent that you provided previously to our processing of your sensitive data, we will cease processing your sensitive data within 15 days after receiving the revocation.

You may appeal our decision by completing and submitting an online appeals form located at www.princetonreview.com/stateprivacyappeals or www.tutor.com/stateprivacyappeals.

Within 60 days of our receipt of the appeal, we will inform you of any action taken or not taken in response to the appeal, along with a written explanation of the reasons for the decision. If we deny the appeal, you may contact the Delaware Department of Justice to submit a complaint at https://attorneygeneral.delaware.gov/fraud/cmu/complaint/.

Categories of Personal Data that We Share with Third Parties

We may share any of the personal data that we process with third parties.

Categories of Third Parties with whom We Share Personal Data

We share personal data with the categories of third parties listed under the “Third Parties to whom We Disclose Information” section above.

Targeted Advertising and Sale of Personal Data

We process personal data for targeted advertising. We do not sell personal data (unless processing personal data for targeted advertising is deemed a sale). You may opt out of such processing by submitting a request to us as described in the “Your Rights under the DPDPA and How to Exercise Them” section above.

In your browser settings or through a browser extension, you can also have your browser send an opt out preference signal. We will process the signal at the browser level so that when we detect the signal from your browser, we will opt you out of the processing of your personal data for targeted advertising so long as you are using the same browser with the opt out preference signal enabled.

Processing of De-identified Data

We commit to maintaining and using de-identified data without attempting to re-identify the data.

Categories of Personal Data that We Have Processed

We have processed the following categories of personal data:

• Name and date of birth
• Contact information (such as address, email address, and phone number)
• Online identifiers (such as cookies, IP address, and machine ID)
• Identification numbers (such as library card number and student ID number)
• Education and school information (such as test scores, course enrollments, graduation year, GPA, and transcripts)
• Payment information (such as credit card number)
• Commercial information (such as purchase or enrollment history)
• Online activity (such as interaction with our Sites)
• Audio or visual information (such as recorded voice, recorded video, and photos)
• Professional or employment-related information (such as employer information, job title, and military or veteran status)
• Sensitive data (such racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, and personal data of children under the age of 13)

Purposes for which the Categories of Personal Data Are Processed

We may process personal data for the purposes listed under the “How We Use Information” section above.

Your Rights under the ICDPA and How to Exercise Them

Subject to the ICDPA, you may exercise the following rights under the ICDPA:

• To confirm whether or not we are processing your personal data and to access such personal data.
• To delete personal data that you provided to us.
• To obtain a copy of your personal data that you provided to us in a portable and (to the extent technically practicable) readily usable format that allows you to transmit the data to another controller without hindrance, where the processing is carried out by automated means.
• To opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data). We do not otherwise sell your personal data.

A parent or guardian may exercise any of these rights on behalf of their child.

To exercise the opt out right described above, please submit a request to us by completing and submitting the online request form located at www.princetonreview.com/optout. To exercise any of the other rights described above, please submit a request to us by completing and submitting the online request form located at www.princetonreview.com/stateprivacyrequests or www.tutor.com/stateprivacyrequests.

We will provide information in response to your request free of charge twice during any 12-month period. If your requests are excessive, repetitive, technically infeasible, or manifestly unfounded, or we reasonably believe that the primary purpose in submitting the request was not to exercise a right under the ICDPA, then we may charge you a reasonable fee to cover the administrative costs of complying with the request or decline to act on the request.

We will verify your identity before fulfilling your request (other than an opt out request). If you have an account with us, we will ask you to enter your username and password through a link we provide to verify your identity. If you do not have an account with us, we will ask you to provide us data points that we have about you to verify your identity.

We endeavor to respond to a request after we have verified your identity within 90 days of receipt of the request. If we reasonably require more time (up to 45 additional days), we will inform you of the extension together with the reasons for the delay within 90 days of receipt of the request. If we do not take action on a request, we will provide the reasons for our decision without undue delay.

You may appeal our decision by completing and submitting an online appeals form located at www.princetonreview.com/stateprivacyappeals or www.tutor.com/stateprivacyappeals.

Within 60 days of our receipt of the appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decision. If we deny your appeal, you may contact the Attorney General of Iowa to submit a complaint at https://www.iowaattorneygeneral.gov/for-consumers/file-a-consumer-complaint/complaint-form.

Categories of Personal Data that We Share with Third Parties

We may share any of the personal data that we process with third parties.

Categories of Third Parties with whom We Share Personal Data

We share personal data with the categories of third parties listed under the “Third Parties to whom We Disclose Information” section above.

Targeted Advertising

We process personal data for targeted advertising. You may opt out of such processing by submitting a request to us as described in the “Your Rights under the ICDPA and How to Exercise Them” section above. We do not sell personal data (unless processing personal data for targeted advertising is deemed a sale).

In your browser settings or through a browser extension, you can also have your browser send an opt out preference signal. We will process the signal at the browser level so that when we detect the signal from your browser, we will opt you out of the processing of your personal data for targeted advertising so long as you are using the same browser with the opt out preference signal enabled.

Categories of Personal Data that We Have Processed

We have processed the following categories of personal data:

• Name and date of birth
• Contact information (such as address, email address, and phone number)
• Online identifiers (such as cookies, IP address, and machine ID)
• Identification numbers (such as library card number and student ID number)
• Education and school information (such as test scores, course enrollments, graduation year, GPA, and transcripts)
• Payment information (such as credit card number)
• Commercial information (such as purchase or enrollment history)
• Online activity (such as interaction with our Sites)
• Audio or visual information (such as recorded voice, recorded video, and photos)
• Professional or employment-related information (such as employer information, job title, and military or veteran status)
• Sensitive data (such as personal data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, information about a person’s sex life, sexual orientation, citizenship or immigration status, and personal data of children under the age of 13)

Purposes for Processing Personal Data

We may process personal data for the purposes listed under the “How We Use Information” section above.

Your Rights under the MCDPA and How to Exercise Them

Subject to the MCDPA, you may exercise the following rights under the MCDPA:

• To obtain confirmation as to whether we are processing your personal data and to access the personal data, unless such confirmation or access would require us to reveal a trade secret;
• To correct inaccuracies in your personal data, considering the nature of the personal data and the purposes of the processing of your personal data;
• To delete personal data about you;
• To obtain a copy of your personal data that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the personal data to another person without hindrance when the processing is carried out by automated means, provided that we are not required to reveal any trade secret; and
• To opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data). We do not otherwise sell your personal data or engage in profiling in furtherance of solely automated decisions that produce legal effects or similarly significant effects.

To exercise the opt out right described above, please submit a request to us by completing and submitting the online request form located at www.princetonreview.com/optout. To exercise any of the other rights described above or to revoke consent that you provided previously to the processing of your sensitive data by us, please submit a request to us by completing and submitting the online request form located at www.princetonreview.com/stateprivacyrequests or www.tutor.com/stateprivacyrequests.

We will provide information in response to your request free of charge once during any 12-month period.

A parent or legal guardian may submit requests on behalf of their child under the age of 13. A guardian or conservator of another person subject to guardianship, conservatorship, or other protective arrangement may submit requests on behalf of the other person. You may designate an authorized agent, acting on your behalf, to opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data).

We will verify your identity before fulfilling your request (other than a request to opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data)). If you have an account with us, we will ask you to enter your username and password through a link we provide to verify your identity. If you do not have an account with us, we will ask you to provide us data points that we have about you to verify your identity.

If you submit a request on behalf of your child or ward under the age of 13, we will ask you to provide us information about the child that allows us to determine that you are the parent or legal guardian of the child (unless our records indicate that you are the parent or legal guardian). If you are guardian or conservator of another person subject to guardianship, conservatorship, or other protective arrangement and submit a request on behalf of the other person, then we will use commercially reasonable efforts to verify the identity of the other person and your authority to act on behalf of the other person. If you designate an authorized agent, acting on your behalf, to opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data), then we will use commercially reasonable efforts to verify your identity and the authorized agent’s authority to act on your behalf.

We endeavor to respond to a request after we have verified your identity (or verified another person’s authority to act on your behalf) within 45 days of receipt of the request. If we reasonably require more time (up to 45 additional days), we will inform you of the extension together with the reasons for the extension within 45 days of receipt of the request. If we decline to take action with respect to a request, we will provide a justification for our decision within 45 days of receipt of the request. Notwithstanding the foregoing, if you revoke consent that you provided previously to our processing of your sensitive data, we will cease processing your sensitive data within 45 days after receiving the revocation.

You may appeal our decision by completing and submitting an online appeals form located at www.princetonreview.com/stateprivacyappeals or www.tutor.com/stateprivacyappeals.

Within 60 days of our receipt of the appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decision. If you disagree with our decision, you may contact the Attorney General of Montana to submit a complaint at https://dojmt.gov/consumer/consumer-complaints/ or (800) 481-6896.

Categories of Personal Data that We Share with Third Parties

We may share any of the personal data that we process with third parties.

Categories of Third Parties with whom We Share Personal Data

We share personal data with the categories of third parties listed under the “Third Parties to whom We Disclose Information” section above.

Targeted Advertising

We process personal data for targeted advertising. We do not sell personal data (unless processing personal data for targeted advertising is deemed a sale). You may opt out of such processing by submitting a request to us as described in the “Your Rights under the MCDPA and How to Exercise Them” section above.

In your browser settings or through a browser extension, you can also have your browser send an opt-out preference signal. We will process the signal at the browser level so that when we detect the signal from your browser, we will opt you out of the processing of your personal data for targeted advertising so long as you are using the same browser with the opt-out preference signal enabled.

The foregoing does not apply to consumers who visit www.tutor.com but not www.princetonreview.com since we do not process personal data of such consumers for targeted advertising.

Processing of De-identified Data

We commit to maintaining and using de-identified data without attempting to re-identify the data.

Categories of Personal Data that We Have Processed

We have processed the following categories of personal data:

• Name and date of birth
• Contact information (such as address, email address, and phone number)
• Online identifiers (such as cookies, IP address, and machine ID)
• Identification numbers (such as library card number and student ID number)
• Education and school information (such as test scores, course enrollments, graduation year, GPA, and transcripts)
• Payment information (such as credit card number)
• Commercial information (such as purchase or enrollment history)
• Online activity (such as interaction with our Sites)
• Audio or visual information (such as recorded voice, recorded video, and photos)
• Professional or employment-related information (such as employer information, job title, and military or veteran status)
• Sensitive data (such as personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, and personal data of children under the age of 13)

Purposes for which Personal Data Are Processed

We may process personal data for the purposes listed under the “How We Use Information” section above.

Your Rights under the NDPA and How to Exercise Them

Subject to the NDPA, you may exercise the following rights under the NDPA:

• To confirm whether or not we are processing your personal data and to access such personal data.
• To correct in accuracies in your personal data.
• To delete personal data that you provided to us or obtained about you.
• If your personal data is available in a digital format, to obtain a copy of your personal data that you provided to us in a format that is portable and (to the extent practicable) readily usable, and allows you to transmit the data to another controller without hindrance.
• To opt out of the processing of your personal data for purposes of targeted advertising and sale of personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data). We do not otherwise sell your personal data or engage in profiling in furtherance of decisions that produce legal effects or similarly significant effects.

To exercise the opt out right described above, please submit a request to us by:

• Calling us at 888-223-7737; or
• Completing and submitting the online request form located at www.princetonreview.com/optout.

To exercise any of the other rights described above, please submit a request to us by:

• Calling us at 888-223-7737; or
• Completing and submitting the online request form located at www.princetonreview.com/stateprivacyrequests or www.tutor.com/stateprivacyrequests.

We will provide information in response to your request free of charge twice during any 12-month period. If your requests are excessive, repetitive, or manifestly unfounded, then we may charge you a reasonable fee to cover the administrative costs of complying with the request or we may decline to act on the request.

A parent or guardian may exercise any of these rights on behalf of their child. You may authorize another person, acting on your behalf, to opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data).

We will verify your identity before fulfilling your request (other than an opt out request). If you have an account with us, we will ask you to enter your username and password through a link we provide to verify your identity. If you do not have an account with us, we will ask you to provide us data points that we have about you to verify your identity.

If you submit a request on behalf of your child or ward, we will ask you to provide us information about the child that allows us to determine that you are the parent or legal guardian of the child (unless our records indicate that you are the parent or legal guardian). If you designate an authorized agent, acting on your behalf, to opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data), then we will use commercially reasonable efforts to verify your identity and the authorized agent’s authority to act on your behalf.

We endeavor to respond to a request after we have verified your identity within 45 days of receipt of the request. If we reasonably require more time (up to 45 additional days), we will inform you of the extension together with the reasons for the delay within 45 days of receipt of the request. If we do not take action on a request, we will provide the justification for our decision within 45 days of the receipt of the request.

You may appeal our decision by completing and submitting an online appeals form located at www.princetonreview.com/stateprivacyappeals or www.tutor.com/stateprivacyappeals.

Within 60 days of our receipt of the appeal, we will notify you of any action we take or do not take in response to the appeal, including the reasons for the decision. If we deny your appeal, you may contact the Attorney General of Nebraska to submit a complaint at https://www.nebraska.gov/apps-ago-complaints/?preSelect=CP_COMPLAINT.

Categories of Personal Data that We Share with Third Parties

We may share any of the personal data that we process with third parties.

Categories of Third Parties with whom We Share Personal Data

We share personal data with the categories of third parties listed under the “Third Parties to whom We Disclose Information” section above.

Targeted Advertising

We process personal data for targeted advertising. We do not sell personal data (unless processing personal data for targeted advertising is deemed a sale). You may opt out of such processing by submitting a request to us as described in the “Your Rights under the NDPA and How to Exercise Them” section above.

In your browser settings or through a browser extension, you can also have your browser send an opt out preference signal. We will process the signal at the browser level so that when we detect the signal from your browser, we will opt you out of the processing of your personal data for targeted advertising so long as you are using the same browser with the opt out preference signal enabled.

The foregoing does not apply to consumers who visit www.tutor.com but not www.princetonreview.com since we do not process personal data of such consumers for targeted advertising.

Processing of De-identified Data

We commit to maintaining and using de-identified data without attempting to re-identify the data.

Categories of Personal Data that We Have Processed

We have processed the following categories of personal data:

• Name and date of birth
• Contact information (such as address, email address, and phone number)
• Online identifiers (such as cookies, IP address, and machine ID)
• Identification numbers (such as library card number and student ID number)
• Education and school information (such as test scores, course enrollments, graduation year, GPA, and transcripts)
• Payment information (such as credit card number)
• Commercial information (such as purchase or enrollment history)
• Online activity (such as interaction with our Sites)
• Audio or visual information (such as recorded voice, recorded video, and photos)
• Professional or employment-related information (such as employer information, job title, and military or veteran status)
• Sensitive data (such as personal data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation, citizenship or immigration status, and personal data of children under the age of 13)

Purposes for which the Categories of Personal Data Are Processed

We may process personal data for the purposes listed under the “How We Use Information” section above.

Your Rights under the NHPA and How to Exercise Them

Subject to the NHPA, you may exercise the following rights under the NHPA:

• To confirm whether or not we are processing your personal data and to access such personal data, unless such confirmation or access would require us to reveal a trade secret.
• To correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of your personal data.
• To delete personal data provided by or obtained about you.
• To obtain your personal data in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance, where the processing is carried out by automated means, provided that we are not required to reveal any trade secret.
• To opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data). We do not otherwise sell your personal data or process personal data for the purposes of profiling in furtherance of solely automated decisions that produce legal or similarly significant effects.

To exercise the opt out right described above, please submit a request to us by completing and submitting the online request form located at www.princetonreview.com/optout. To exercise any of the other rights described above or to revoke consent that you provided to the processing of your sensitive data by us (if you provided such consent previously), please submit a request to us by completing and submitting the online request form located at www.princetonreview.com/stateprivacyrequests or www.tutor.com/stateprivacyrequests.

We will provide information in response to your request free of charge once during any 12-month period. If your requests are manifestly unfounded, excessive, or repetitive, we may charge you a reasonable fee to cover the administrative costs of complying with the request or decline to act on the request.

A parent or legal guardian of a child under the age of 13 may submit requests on behalf of the child. A guardian or conservator may submit requests on behalf of another person subject to guardianship or conservatorship, respectively. You may authorize another person, acting on your behalf, to opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data).

We will verify your identity before fulfilling your request (other than an opt out request). If you have an account with us, we will ask you to enter your username and password through a link we provide to verify your identity. If you do not have an account with us, we will ask you to provide us data points that we have about you to verify your identity.

If you submit a request on behalf of your child or ward under the age of 13, we will ask you to provide us information about the child that allows us to determine that you are the parent or legal guardian of the child (unless our records indicate that you are the parent or legal guardian). If you are the guardian or conservator of another person subject to guardianship, conservatorship, or other protective arrangement and submit a request on behalf of the other person, then we will use commercially reasonable efforts to verify the identity of the other person and your authority to act on behalf of the other person. If you designate an authorized agent, acting on your behalf, to opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data), then we will use commercially reasonable efforts to verify your identity and the authorized agent’s authority to act on your behalf.

We endeavor to respond to a request after we have verified your identity within 45 days of receipt of the request. If we reasonably require more time (up to 45 additional days), we will inform you of the extension together with the reasons for the delay within 45 days of receipt of the request. If we do not take action on a request, we will provide the reasons for our decision within 45 days of the receipt of the request. Notwithstanding the foregoing, if you revoke consent that you provided previously to our processing of your sensitive data, we will cease processing your sensitive data within 15 days after receiving the revocation.

You may appeal our decision by completing and submitting an online appeals form located at www.princetonreview.com/stateprivacyappeals or www.tutor.com/stateprivacyappeals.

Within 60 days of our receipt of the appeal, we will inform you of any action taken or not taken in response to the appeal, along with a written explanation of the reasons for the decision. If you have concerns about the results of the appeal, you may contact the Attorney General of New Hampshire at https://www.doj.nh.gov/citizens/consumer-protection-antitrust-bureau/consumer-complaints.

Categories of Personal Data that We Share with Third Parties

We may share any of the personal data that we process with third parties.

Categories of Third Parties with whom We Share Personal Data

We share personal data with the categories of third parties listed under the “Third Parties to whom We Disclose Information” section above.

Targeted Advertising and Sale of Personal Data

We process personal data for targeted advertising. We do not sell personal data (unless processing personal data for targeted advertising is deemed a sale). You may opt out of such processing by submitting a request to us as described in the “Your Rights under the NHPA and How to Exercise Them” section above.

In your browser settings or through a browser extension, you can also have your browser send an opt out preference signal. We will process the signal at the browser level so that when we detect the signal from your browser, we will opt you out of the processing of your personal data for targeted advertising so long as you are using the same browser with the opt out preference signal enabled.

Processing of De-identified Data

We commit to maintaining and using de-identified data without attempting to re-identify the data.

Categories of Personal Data that We Process

We have processed the following categories of personal data:

• Name and date of birth
• Contact information (such as address, email address, and phone number)
• Online identifiers (such as cookies, IP address, and machine ID)
• Identification numbers (such as library card number and student ID number)
• Education and school information (such as test scores, course enrollments, graduation year, GPA, and transcripts)
• Commercial information (such as purchase or enrollment history)
• Online activity (such as interaction with our Sites)
• Audio or visual information (such as recorded voice, recorded video, and photos)
• Professional or employment-related information (such as employer information, job title, and military or veteran status)
• Sensitive data (such as personal data revealing racial or ethnic origin, religious beliefs, mental or physical health condition, treatment, or diagnosis, financial information (including financial account number or credit or debit card number in combination with any required security code or access code), sex life or sexual orientation, citizenship or immigration status, status as transgender or non-binary, and personal data of children under the age of 13)

Purposes for which the Categories of Personal Data Are Processed

We may process personal data for the purposes listed under the “How We Use Information” section above.

Your Rights under the NJDPA and How to Exercise Them

Subject to the NJDPA, you may exercise the following rights under the NJDPA:

• To confirm whether or not we are processing and accessing your personal data, unless such confirmation would require us to reveal a trade secret.
• To correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of your personal data.
• To delete personal data concerning you.
• To obtain your personal data in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance, provided that we are not required to reveal any trade secret.
• To opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data). We do not otherwise sell your personal data or process personal data for the purposes of profiling in furtherance of decisions that produce legal or similarly significant effects.

To exercise the opt out right described above, please submit a request to us by completing and submitting the online request form located at www.princetonreview.com/optout. To exercise any of the other rights described above or to revoke consent that you provided to the processing of your sensitive data by us (if you provided such consent previously), please submit a request to us by completing and submitting the online request form located at www.princetonreview.com/stateprivacyrequests or www.tutor.com/stateprivacyrequests.

We will provide information in response to your request free of charge once during any 12-month period. If your requests are manifestly unfounded, excessive, or repetitive, we may charge you a reasonable fee to cover the administrative costs of complying with the request or decline to act on the request.

You may authorize another person, acting on your behalf, to opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data).

We will verify your identity before fulfilling your request (other than an opt out request). If you have an account with us, we will ask you to enter your username and password through a link we provide to verify your identity. If you do not have an account with us, we will ask you to provide us data points that we have about you to verify your identity.

If you designate an authorized agent, acting on your behalf, to opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data), then we will use commercially reasonable efforts to verify your identity and the authorized agent’s authority to act on your behalf.

We endeavor to respond to a request after we have verified your identity within 45 days of receipt of the request. If we reasonably require more time (up to 45 additional days), we will inform you of the extension together with the reasons for the delay within 45 days of receipt of the request. If we do not take action on a request, we will provide the reasons for our decision within 45 days of the receipt of the request. Notwithstanding the foregoing, if you revoke consent that you provided previously to our processing of your sensitive data, we will cease processing your sensitive data within 15 days after receiving the revocation.

You may appeal our decision by completing and submitting an online appeals form located at www.princetonreview.com/stateprivacyappeals or www.tutor.com/stateprivacyappeals.

Within 45 days of our receipt of the appeal, we will inform you of any action taken or not taken in response to the appeal, along with a written explanation of the reasons for the decision. If you have concerns about the results of the appeal, you may contact the New Jersey Division of Consumer Affairs in the Department of Law and Public Safety at https://njconsumeraffairs.state.nj.us/file-a-complaint/.

Categories of Personal Data that We Share with Third Parties

We may share any of the personal data that we process with third parties.

Categories of Third Parties with whom We Share Personal Data

We share personal data with the categories of third parties listed under the “Third Parties to whom We Disclose Information” section above.

Targeted Advertising and Sale of Personal data

We process personal data for targeted advertising. We do not sell personal data (unless processing personal data for targeted advertising is deemed a sale). You may opt out of such processing by submitting a request to us as described in the “Your Rights under the NJDPA and How to Exercise Them” section above.

In your browser settings or through a browser extension, you can also have your browser send an opt out preference signal. We will process the signal at the browser level so that when we detect the signal from your browser, we will opt you out of the processing of your personal data for targeted advertising so long as you are using the same browser with the opt out preference signal enabled.

Processing of De-identified Data

We commit to maintaining and using de-identified data without attempting to re-identify the data.

Categories of Personal Data that We Have Processed

We have processed the following categories of personal data:

• Name and date of birth
• Contact information (such as address, email address, and phone number)
• Online identifiers (such as cookies, IP address, and machine ID)
• Identification numbers (such as library card number and student ID number)
• Education and school information (such as test scores, course enrollments, graduation year, GPA, and transcripts)
• Payment information (such as credit card number)
• Commercial information (such as purchase or enrollment history)
• Online activity (such as interaction with our Sites)
• Audio or visual information (such as recorded voice, recorded video, and photos)
• Professional or employment-related information (such as employer information, job title, and military or veteran status)
• Sensitive data (such as personal data revealing racial or ethnic background, national origin, religious beliefs, mental or physical condition or diagnosis, sexual orientation, status as transgender or non-binary, status as a victim of crime, citizenship or immigration status, and personal data of children under the age of 13)

Purposes for Processing Personal Data

We may process personal data for the purposes listed under the “How We Use Information” section above.

Your Rights under the OCPA and How to Exercise Them

Subject to the OCPA, you may exercise the following rights under the OCPA:

• To obtain confirmation as to whether we are processing or have processed your personal data and to obtain the categories of personal data that we are processing or have processed;
• To obtain, at our option, a list of specific third parties, other than natural persons, to which we have disclosed your personal data or any personal data;
• To obtain a copy of all of your personal data that we have processed or are processing in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the personal data to another person without hindrance;
• To correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of your personal data;
• To delete personal data about you; and
• To opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data). We do not otherwise sell your personal data or engage in profiling in furtherance of decisions that produce legal effects or effects of similar significance. 

To exercise the opt out right described above, please submit a request to us by completing and submitting the online request form located at www.princetonreview.com/optout. To exercise any of the other rights described above or to revoke consent that you provided to the processing of your sensitive data by us (if you provided such consent previously), please submit a request to us by completing and submitting the online request form located at www.princetonreview.com/stateprivacyrequests or www.tutor.com/stateprivacyrequests.

We will provide information in response to your request free of charge once during any 12-month period.

A parent, legal guardian, or conservator may submit requests on behalf of their child under the age of 13, the child under the age of 13 for whom the guardian has legal responsibility, or the consumer under the age of 13 who is subject to conservatorship, respectively. You may authorize another person, acting on your behalf, to opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data).

We will verify your identity before fulfilling your request, other than a request to opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data). If you have an account with us, we will ask you to enter your username and password through a link we provide to verify your identity. If you do not have an account with us, we will ask you to provide us data points that we have about you to verify your identity.

If you submit a request on behalf of your child under the age of 13 or a child under the age of 13 for whom you have legal responsibility or for whom you are the conservator, we will ask you to provide us information about the child that allows us to determine that you are the parent, guardian, or conservator of the child. (unless our records indicate that you are the parent, guardian, or conservator of the child). If you authorize another person, acting on your behalf, to opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data), then we will use commercially reasonable efforts to verify your identity and the authorized agent’s authority to act on your behalf.

We endeavor to respond to a request after we have verified your identity within 45 days of receipt of the request. If we reasonably require more time (up to 45 additional days), we will inform you of the extension together with the reasons for the extension within 45 days of receipt of the request. If we decline to take action with respect to a request, we will provide a justification for our decision within 45 days of receipt of the request. Notwithstanding the foregoing, if you revoke consent that you provided previously to our processing of your sensitive data, we will cease processing your sensitive data within 15 days after receiving the revocation.

You may appeal our decision by completing and submitting an online appeals form located at www.princetonreview.com/stateprivacyappeals or www.tutor.com/stateprivacyappeals.

Within 45 days of our receipt of the appeal, we will approve or deny the appeal and notify you of the decision and the reasons for the decision. If you disagree with our decision, you may contact the Attorney General of Oregon to submit a complaint at 877-877-9392 or https://justice.oregon.gov/consumercomplaints/.

Categories of Personal Data that We Share with Third Parties

We may share any of the personal data that we process with third parties.

Categories of Third Parties with whom We Share Personal Data

We share personal data with the categories of third parties listed under the “Third Parties to whom We Disclose Information” section above.

Targeted Advertising

We process personal data for targeted advertising. We do not sell personal data (unless processing personal data for targeted advertising is deemed a sale). You may opt out of such processing by submitting a request to us as described in the “Your Rights under the OCPA and How to Exercise Them” section above.

In your browser settings or through a browser extension, you can also have your browser send an opt-out preference signal. We will process the signal at the browser level so that when we detect the signal from your browser, we will opt you out of the processing of your personal data for targeted advertising so long as you are using the same browser with the opt-out preference signal enabled.

The foregoing does not apply to consumers who visit www.tutor.com but not www.princetonreview.com since we do not process personal data of such consumers for targeted advertising.

Processing of De-identified Data

We commit to maintaining and using de-identified data without attempting to re-identify the data.

Categories of Personal Data that We Have Processed

We have processed the following categories of personal data:

• Name and date of birth
• Contact information (such as address, email address, and phone number)
• Online identifiers (such as cookies, IP address, and machine ID)
• Identification numbers (such as library card number and student ID number)
• Education and school information (such as test scores, course enrollments, graduation year, GPA, and transcripts)
• Payment information (such as credit card number)
• Commercial information (such as purchase or enrollment history)
• Online activity (such as interaction with our Sites)
• Audio or visual information (such as recorded voice, recorded video, and photos)
• Professional or employment-related information (such as employer information, job title, and military or veteran status)
• Sensitive data (such as personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sex life, sexuality, citizenship or immigration status, and personal data of children under the age of 13)

Purposes for which Personal Data Are Processed

We may process personal data for the purposes listed under the “How We Use Information” section above.

Your Rights under the TDPSA and How to Exercise Them

Subject to the TDPSA, you may exercise the following rights under the TDPSA:

• To confirm whether or not we are processing your personal data and to access such personal data.
• To correct in accuracies in your personal data.
• To delete personal data that you provided to us or obtained about you.
• If your personal data is available in a digital format, to obtain a copy of your personal data that you provided to us in a format that is portable and (to the extent practicable) readily usable, and allows you to transmit the data to another controller without hindrance.
• To opt out of the processing of your personal data for purposes of targeted advertising and sale of personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data). We do not otherwise sell your personal data or engage in profiling in furtherance of decisions that produce legal effects or effects of similar significance. 

A parent or guardian may exercise any of these rights on behalf of their child. You may authorize another person, acting on your behalf, to opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data).

To exercise the opt out right described above, please submit a request to us by:

• Calling us at 888-223-7737; or
• Completing and submitting the online request form located at www.princetonreview.com/optout.

To exercise any of the other rights described above, please submit a request to us by:

• Calling us at 888-223-7737; or
• Completing and submitting the online request form located at www.princetonreview.com/stateprivacyrequests or www.tutor.com/stateprivacyrequests.

We will provide information in response to your request free of charge twice during any 12-month period. If your requests are excessive, repetitive, or manifestly unfounded, then we may charge you a reasonable fee to cover the administrative costs of complying with the request or we may decline to act on the request.

We will verify your identity before fulfilling your request (other than an opt out request). If you have an account with us, we will ask you to enter your username and password through a link we provide to verify your identity. If you do not have an account with us, we will ask you to provide us data points that we have about you to verify your identity. If you authorize another person to act as your agent to submit an opt out request on your behalf, then we will verify, with commercially reasonable effort, your identity and the authority of the other person to act on your behalf.

We endeavor to respond to a request after we have verified your identity within 45 days of receipt of the request. If we reasonably require more time (up to 45 additional days), we will inform you of the extension together with the reasons for the delay within 45 days of receipt of the request. If we do not take action on a request, we will provide the justification for our decision within 45 days of the receipt of the request.

You may appeal our decision by completing and submitting an online appeals form located at www.princetonreview.com/stateprivacyappeals or www.tutor.com/stateprivacyappeals.

Within 60 days of our receipt of the appeal, we will notify you of any action we take or do not take in response to the appeal, including the reasons for the decision. If we deny your appeal, you may contact the Attorney General of Texas to submit a complaint at https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint.

Categories of Personal Data that We Share with Third Parties

We may share any of the personal data that we process with third parties.

Categories of Third Parties with whom We Share Personal Data

We share personal data with the categories of third parties listed under the “Third Parties to whom We Disclose Information” section above.

Targeted Advertising

We process personal data for targeted advertising. We do not sell personal data (unless processing personal data for targeted advertising is deemed a sale). You may opt out of such processing by submitting a request to us as described in the “Your Rights under the TDPSA and How to Exercise Them” section above.

In your browser settings or through a browser extension, you can also have your browser send an opt out preference signal. We will process the signal at the browser level so that when we detect the signal from your browser, we will opt you out of the processing of your personal data for targeted advertising so long as you are using the same browser with the opt out preference signal enabled.

The foregoing does not apply to consumers who visit www.tutor.com but not www.princetonreview.com since we do not process personal data of such consumers for targeted advertising.

Processing of De-identified Data

We commit to maintaining and using de-identified data without attempting to re-identify the data.

Categories of Personal Data that We Have Processed

We have processed the following categories of personal data:

• Name and date of birth
• Contact information (such as address, email address, and phone number)
• Online identifiers (such as cookies, IP address, and machine ID)
• Identification numbers (such as library card number and student ID number)
• Education and school information (such as test scores, course enrollments, graduation year, GPA, and transcripts)
• Payment information (such as credit card number)
• Commercial information (such as purchase or enrollment history)
• Online activity (such as interaction with our Sites)
• Audio or visual information (such as recorded voice, recorded video, and photos)
• Professional or employment-related information (such as employer information, job title, and military or veteran status)
• Sensitive data (such as personal data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation, citizenship or immigration status, and personal data of children under the age of 13)

Purposes for which the Categories of Personal Data Are Processed

We may process personal data for the purposes listed under the “How We Use Information” section above.

Your Rights under the UCPA and How to Exercise Them

Subject to the UCPA, you may exercise the following rights under the UCPA:

• To confirm whether or not we are processing your personal data and to access such personal data.
• To delete personal data that you provided to us.
• To obtain a copy of your personal data that you provided to us in a format that (to the extent technically feasible) is portable, (to the extent practicable) is readily usable, and (where the processing is carried out by automated means) allows you to transmit the data to another controller without impediment.
• To opt out of the processing of your personal data for purposes of targeted advertising.

A parent or guardian may exercise any of these rights on behalf of their child.

To exercise the opt out right described above, please submit a request to us by completing and submitting the online request form located at www.princetonreview.com/optout. To exercise any of the other rights described above, please submit a request to us by completing and submitting the online request form located at www.princetonreview.com/stateprivacyrequests or www.tutor.com/stateprivacyrequests.

We will provide information in response to your request free of charge once during any 12-month period. If your requests are excessive, repetitive, technically infeasible, or manifestly unfounded, or we reasonably believe that the primary purpose in submitting the request was something other than exercising a right under the UCPA, or the request (individually or as part of an organized effort) harasses, disrupts, or imposes undue burden on the resources of our business, then we may charge you a reasonable fee to cover the administrative costs of complying with the request or refuse to act on the request.

We will verify your identity before fulfilling your request (other than an opt out request). If you have an account with us, we will ask you to enter your username and password through a link we provide to verify your identity. If you do not have an account with us, we will ask you to provide us data points that we have about you to verify your identity. If you authorize another person to act as your agent to submit an opt out request on your behalf, then we will verify, with commercially reasonable effort, your identity and the authority of the other person to act on your behalf.

We endeavor to respond to a request after we have verified your identity within 45 days of receipt of the request. If we reasonably require more time (up to 45 additional days), we will inform you of the extension together with the reasons for the delay within 45 days of receipt of the request. If we do not take action on a request, we will provide the reasons for our decision within 45 days of the receipt of the request.

Categories of Personal Data that We Share with Third Parties

We may share any of the personal data that we process with third parties.

Categories of Third Parties with whom We Share Personal Data

We share personal data with the categories of third parties listed under the “Third Parties to whom We Disclose Information” section above.

Targeted Advertising

We process personal data for targeted advertising. You may opt out of such processing by submitting a request to us as described in the “Your Rights under the UCPA and How to Exercise Them” section above. We do not sell personal data.

In your browser settings or through a browser extension, you can also have your browser send an opt out preference signal. We will process the signal at the browser level so that when we detect the signal from your browser, we will opt you out of the processing of your personal data for targeted advertising so long as you are using the same browser with the opt out preference signal enabled.

Categories of Personal Data that We Have Processed

We have processed the following categories of personal data:

• Identifiers (such as name, address, email address, phone number, cookies, IP address, machine ID, date of birth, student ID number, and library card number)
• Financial information (such as credit card number)
• Characteristics of protected classifications under federal law (such as military or veteran status and race)
• Commercial information (such as purchase or enrollment history)
• Internet or other electronic network activity information (such as interaction with our Sites)
• Audio or visual information (such as recorded voice, recorded video, and photos)
• Professional or employment-related information (such as employer information and job title)
• Education information (such as test scores, course enrollments, graduation year, GPA, and transcripts)
• Sensitive data (such as personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, and personal data collected from a child known to be under the age of 13)

Purposes for Processing Personal Data

We may process personal data for the purposes listed under the “How We Use Information” section above.

Your Rights under the VCDPA and How to Exercise Them

Subject to the VCDPA, you may exercise the following rights under the VCDPA:

• To confirm whether or not we are processing your personal data and to access such personal data;
• To correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of your personal data;
• To delete personal data provided by or obtained about you;
• To obtain a copy of your personal data that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance, where the processing is carried out by automated means; and
• To opt out of the processing of the personal data for purposes of targeted advertising. We do not engage in the sale of your personal data or in profiling in furtherance of decisions that produce legal or similarly significant effects. 

To exercise the opt out right described above, please submit a request to us by completing and submitting the online request form located at www.princetonreview.com/optout. To exercise any of the other rights described above, please submit a request to us by completing and submitting the online request form located at www.princetonreview.com/stateprivacyrequests or www.tutor.com/stateprivacyrequests.

You may only make a request twice annually.

A parent or legal guardian who is known to us may submit requests on behalf of their child or ward under the age of 13.

We will verify your identity before fulfilling your request. If you have an account with us, we will ask you to enter your username and password through a link we provide to verify your identity. If you do not have an account with us, we will ask you to provide us data points that we have about you to verify your identity.

If you submit a request on behalf of a child or ward under the age of 13, we will ask you to provide us information about the child or ward that allows us to determine that you are the parent or guardian of the child or ward (unless our records indicate that you are the parent or guardian).

We endeavor to respond to a request after we have verified your identity within 45 days of receipt of the request. If we reasonably require more time (up to 45 additional days), we will inform you of the extension together with the reasons for the extension within 45 days of receipt of the request. If we decline to take action with respect to a request, we will provide a justification for our decision within 45 days of receipt of the request.

You may appeal our decision by completing and submitting an online appeals form located at www.princetonreview.com/stateprivacyappeals or www.tutor.com/stateprivacyappeals.

Within 60 days of our receipt of the appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decision. If you disagree with our decision, you may contact the Attorney General of Virginia to submit a complaint at www.oag.state.va.us or 800-552-9963.

We do not charge a fee to respond to your requests unless your requests are manifestly unfounded, excessive, or repetitive. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Categories of Personal Data that We Share with Third Parties

We may share any of the personal data that we process with third parties.

Categories of Third Parties with whom We Share Personal Data

We share personal data with the categories of third parties listed under the “Third Parties to whom We Disclose Information” section above

Targeted Advertising

We process personal data for targeted advertising. You may opt out of such processing by submitting a request to us as described in the “Your Rights under the VCDPA and How to Exercise Them” section above.

Processing of De-identified Data

We commit to maintaining and using de-identified data without attempting to re-identify the data.

The Categories of Personal Information that We Have Collected

We have collected or processed the following categories of personal information:

• Name and date of birth
• Contact information (such as address, email address, and phone number)
• Online identifiers (such as cookies, IP address, and machine ID)
• Identification numbers (such as library card number and student ID number)
• Education and school information (such as test scores, course enrollments, graduation year, GPA, and transcripts)
• Payment information (such as credit card number)
• Commercial information (such as purchase or enrollment history)
• Online activity (such as interaction with our Sites)
• Audio or visual information (such as recorded voice, recorded video, and photos)
• Professional or employment-related information (such as employer information, job title, and military or veteran status)
• Sensitive personal information (such as personal information revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life or sexual orientation, citizenship or citizenship status)

Means by which Personal Information is Collected

We may collect personal information by the means described in the “Information We Collect” section above.

Sources from which Personal Information is Collected

We collect personal information from the categories of sources listed below, as described in more detail in the “Information We Collect” section above:

• Individuals
• Third parties with whom we have a business relationship (such as our organizational customers, organizations that we have marketing agreements with, resellers, licensees, and franchisees)
• Other users who refer you to us
• College and universities who provide information for the purpose of conducting surveys
• Publicly and commercially available sources, including organizers of events you may attend
• Browsers and tracking technologies
• Our service providers and other vendors

Purposes for which the Categories of Personal Information Is Collected

We may collect personal information for the purposes listed under the “How We Use Information” section above.

Categories of Third Parties with whom We Share Personal information

We share personal information with the categories of third parties listed under the “Third Parties to whom We Disclose Information” section above.

Retention of Personal information

We retain your personal information for as long as necessary to fulfil the purposes for which the information was collected or to satisfy legal or record retention requirements, To determine the appropriate retention period, we consider various criteria, including maintaining our ability to provide our products and services and honor guarantees, contractual obligations, maintaining our ability to address complaints about our products and services and defend against or bring claims, maintaining records for audit purposes or as required by law, the type of relationship you have with us and the duration of the relationship, and the retention policies and practices of, and features in the offerings provided by, our service providers and other vendors.

Places where We Keep Personal Information

We and our service providers and other third parties to whom your personal information is disclosed under this policy operate outside Quebec and Canada. Your personal information will therefore be used and stored securely in other provinces and other countries, including the United States.

Information Security

We use appropriate physical, technical and procedural safeguards for the purpose of preventing unauthorized access, use, disclosure, theft or loss of your personal information. The measures adopted in our security program include:

• Protecting the infrastructure through physical and logical security measures such as network segmentation, border control firewalls, secure access to our premises and equipment locations, etc.
• Limiting access to your personal information. This means that only personnel who need to know your information to carry out their duties have access to it.
• Enforcing password management and multi-factor authentication.
• Conducting employee privacy and data security training

Your Rights under the Quebec Privacy Act and How to Exercise Them

Subject to the QPA, you may exercise the following rights under the QPA:

• To confirm whether or not we have collected your personal information and to access such personal information by requesting a copy of the personal information we hold about you.
• To rectify inaccuracies in your personal information.
• To withdraw your consent to the communication or use of your personal information that was collected.

To exercise any of these rights, please submit a request to us by completing the on-line request form located at www.princetonreview.com/qpa or www.tutor.com/qpa.

We will verify your identity before fulfilling your request. If you have an account with us, we will ask you to enter your username and password through a link we provide to verify your identity. If you do not have an account with us, we will ask you to provide us data points that we have about you to verify your identity.

If you wish to request access to or rectification of personal information about another person, we will need proof that you are a representative, heir, successor, liquidator of the estate, beneficiary of life insurance or death compensation, or holder of parental authority of the person whose personal information we collected or the spouse or close relative of the person whose personal information we collected who is deceased. We will ask you to upload such proof when you submit your request form.

We endeavor to respond to a request for access or rectification after we have verified your identity (or received proof of your relationship to the other person on whose behalf you submitted your request) within 30 days of receipt of the request. If we decline to take action with respect to a request, we will provide a justification for our decision within 30 days of receipt of the request and include the provision of the law on which our decision is based, the remedies available to you and the time limit in which they can be exercised.

In case you disagree with our decision, you have the right to file an Application for the Examination of a Disagreement regarding our decision at the Access to information Commission within 30 days following said decision.

We do not charge a fee to respond to your requests except in limited cases. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Person Responsible for the Protection of Personal Information

The person responsible for overseeing the protection of personal information is our Security Officer.

If you have any questions about this policy, concerns or complaints about our handling of your personal information, or other requests, you can contact us by email at securityofficer@review.com.