The Princeton Review Privacy Policy

The Princeton Review and Tutor.com Privacy Policy

Effective Date: September 23, 2024

Tutor.com, Inc. and its subsidiaries, including TPR Education, LLC d/b/a The Princeton Review (collectively, “we,” “us,” or “our”) take your privacy seriously and understand the importance of protecting your personal information. Therefore, this Privacy Policy provides information about our privacy practices.“Personal information” means, unless otherwise defined by applicable law, any information about, that identifies, that relates to, that is linked to or associated with, or that is reasonably linkable to or reasonably capable of being associated with an identified or identifiable individual. For clarity, this Privacy Policy does not apply to our employees, job applicants, and independent contractors.

By visiting the websites located at www.princetonreview.com and at www.tutor.com and other websites and mobile applications which link to this Privacy Policy (collectively, “Sites”) or using the products or services offered through this Site, you agree to this Privacy Policy, as it may be amended from time to time. This Privacy Policy is incorporated into the Terms of Use for this Site.

For Parents of Children under the Age of 13

For any user under the age of 13, we must have permission from such user’s parent or legal guardian (obtained by the user’s school or provided by the user’s school on behalf of the user’s parent or legal guardian if the user is using our program through the user’s school or obtained by us) before we collect any personal information of such user on the Site or use or disclose such personal information. You are welcome to contact us at 800-2REVIEW or prep@review.com to review any personal information we have collected about your child. You may request that we delete this information or specify that we collect no more of your child’s information. We will need to verify the identity of anyone requesting information about a child under the age of 13 to ensure that the person is in fact the child’s parent or legal guardian. We do not correspond with users under the age of 13 about products, services, and events of other organizations.

Information We Collect

We collect information through the sources described below.

Information You Provide to Us. We collect personal information and non-personal information from you (such as your or your parents’ or guardians’ name, address, email address, phone number, credit card number, school name, grade level, year of graduation, date of birth, GPA, the test that you are interested in preparing for, test scores, academic interests, transcripts, photos, essays, applications to schools, employer name and job title, library card number, accommodation requests, race, and military or veteran status) when you:

register or create an account on our Site;
call us;
purchase and use our products or services;
provide or send us messages, documents, and other files and content in the course of your use of our products or services;
enter sweepstakes or other promotions;
submit online forms or testimonials and respond to surveys or questionnaires;
register for or attend events we host, sponsor, or participate in; or
when you provide us information by other means.

Information from Third Parties.

We may collect personal and non-personal information about you (such as your name, email address, student ID number, username, grade level, school name, and courses you are taking) from third parties with whom we have a business relationship (such as our organizational customers, organizations that we have marketing agreements with, resellers, licensees, franchisees, and service providers and other vendors who provide lead generation services).

We may receive information about you from our users who refer you to us and from college and universities for the purpose of conducting surveys.

We may obtain personal and non-personal information from publicly and commercially available sources, including organizers of events you may attend.

Information Collected Automatically.

We collect information (such as your IP address, machine ID, your browser type, cookies, the referring website address, and operating system) from your browser when you visit our Site.

We, our service providers and other vendors, and our affiliates and third parties may use tracking technologies such as cookies to collect information about your online interactions with our Site and our emails.

We collect information when you purchase or use our products and services (such as when we record online sessions or presentations, produce transcripts of online tutoring sessions, and track the drills and practice tests that you take online).

We automatically record calls to our call center.

How We Use Information

We may use your personal information to:

provide you with and personalize our products and services;
create and manage your account, process your orders, and provide you customer service;
maintain our internal records, comply with legal requirements, and otherwise manage our business;
send you newsletters and advertisements and otherwise correspond with you about products, services, events, and other organizations that we think may interest you or, if an organizational customer arranged for your participation in our programs, send you newsletters and otherwise correspond with you about our products, services, and events that we think may interest you;
ask for your reviews and testimonials and send you surveys and questionnaires;
include as content in our products and services and marketing materials if you have provided permission;
administer sweepstakes and other promotions;
develop and display content and advertising tailored to your interests on our Site and other sites, provide our advertisements to you when you visit other sites, and analyze the effectiveness of our advertisements or, if an organizational customer arranged for your participation in our programs, develop and display content tailored to your interests on our Site;
perform research and analysis about your use of or interest in our products and services, the products or services offered by others, and our Site, and develop new products and services (unless an organizational customer arranged for your participation in our programs);
detect, prevent, or investigate illegal activity or misuse of our products or services and enforce our legal rights; and
perform functions as otherwise described to you at the time of collection.

We may use non-personal information for any lawful purpose.

Third Parties to whom We Disclose Information

We may disclose your information to third parties as described below. We do not disclose your personal information to third parties for their direct marketing purposes except as described under “Schools You are Interested in” and “Licensees and Franchisees” below. For clarity, we do not disclose the information that you provide to us when you opt in to receive marketing text messages to third parties for their own marketing purposes.

Organizations and Persons who Arrange for Your Participation in Our Programs

We work with schools, school districts, colleges and universities, local, state, and federal government agencies, businesses, and other organizations to provide programs such as tutoring, test preparation, and college admissions counseling. Your organization may arrange for your participation in these programs and negotiate a special price or trial offer, or purchase (or subsidize) products or services on your behalf. We may disclose your personal and non-personal information that we collect through your participation in these programs (such as test scores, transcripts or recordings of online tutoring and online class sessions, comments you leave in post-session surveys, and details regarding your usage of our programs) to the organization arranging for your access to these programs or to your parents or guardians. In addition, your school may require us to disclose such information to others legally entitled to access your academic records, such as your state department of education. If you use a promotion code at our Site to create an account or add products or services, we may let the source of that promotion code know that you used that code.

Service Providers and Other Vendors

We may disclose your personal information to our service providers and other vendors, such as those who provide tools for communicating and exchanging information with customers, help us manage our relationships with customers, process transactions (including providing payment options), license content to us, provide instruction, produce and deliver materials to customers, help us market our products and services, provide tools for online forms and surveys, analyze online activity, provide online hosting and storage services, and otherwise help deliver our products and services and operate our business.

Schools that Provide Classrooms for Courses

We may disclose your name to the school, as may be required by the school, that provides the classroom for the course in which you enroll.

Schools You are Interested in

You may direct the disclosure of your personal information to the schools on our Site for their direct marketing purposes by selecting “Connect with School” or “Request Info” next to the schools on our Site or selecting “Select All Schools” from the search results of schools that match your interests. If you do not want to direct the disclosure of your personal information to the schools, do not select the options listed above.

Licensees and Franchisees

If you are located outside the United States and Canada, we may disclose your personal information to our licensees and franchisees in your location who may market their products and services to you. If you uncheck “I’d like to receive promotional offers, informative content, product updates and more” under your account settings for The Princeton Review, then we will stop such disclosure, but licensees and franchisees who previously received your personal information may continue to market their products and services to you.

Affiliates

We may disclose your personal information to our subsidiaries.

Legally Compelled Disclosures and Safety

We may disclose personal information when compelled to do so by government authorities or otherwise as required or permitted by law, such as to respond to court orders and subpoenas. We may also disclose personal information to protect the safety of others and when we have reason to believe that someone is causing injury to or interfering with our rights or property or the rights or property of others.

Business Transfer

If we or all or a portion of our business is acquired by one or more third parties as a result of an acquisition, merger, sale, reorganization, consolidation or liquidation, personal information may be included in the transferred assets.

Authorized Disclosure

We may disclose your personal information to third parties when you authorize the disclosure.

Non-Personal Information

We may disclose non-personal Information to any third party for any lawful purpose.

Your Access to Information

If you have an account with us, you may review and correct the information that is accessible to you under the settings for your account on our Site or by calling 800-2REVIEW.

Opting Out of Promotional Correspondence

You may elect not to receive promotional correspondence from us. If you have an account with us, you may make this request under the settings for your account by indicating which correspondence you would like to receive. You can also send an e-mail to prep@review.com. In this e-mail, please say whether: (i) you would like to opt out of receiving all e-mail promotional correspondence from us in general or (ii) if you would only like to opt out of certain of our e-newsletters or correspondence and if so which ones or (iii) you would like to opt out of receiving SMS or text messages. You may also opt out of our promotional e-mails by clicking on an opt-out link within the e-mail you receive.

Please understand that if you opt out of receiving promotional correspondence from us, we may still contact you in connection with your relationship, activities, transactions and communications with us.

Using Caution when Sharing Information with Others

When you contribute to a public area or feature of our Site, such as a chat room, bulletin board, list serve, blog, or wiki, the information that you submit will be made available to the general public. Therefore, we recommend that you do not submit any sensitive information to such areas of our Site, including your full name, home address, phone number, financial information or any other information that would enable other users to locate you or contact you.

Other Sites

When you are on our Site, you may be able to visit or link to other sites not operated by us. We do not control such sites and are not responsible for the information practices of these sites. This Privacy Policy does not address the information practices of those other websites, and we encourage you to read the posted privacy policies of such sites.

California Consumer Privacy Act and California Privacy Rights Act Rights

The information in this California Consumer Privacy Act and California Privacy Rights Act Rights section applies only to California consumers. Any terms defined in the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (“California Privacy Law”) have the same meaning when used in this California Consumer Privacy Act and California Privacy Rights Act Rights section.

Personal Information (Including Sensitive Personal Information) We Collect

We may collect, and in the past 12 months have collected, the following categories of personal information:

Identifiers (such as name, address, email address, cookies, IP address, machine ID, date of birth, student ID number, and library card number)
Categories of personal information listed in the California Customer Records statute (such as phone number, credit card number, and education)
Characteristics of protected classifications under California or federal law (such as military or veteran status and race)
Commercial information (such as purchase or enrollment history)
Internet or other electronic network activity information (such as interaction with our Sites)
Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)) (such as test scores, GPA, course enrollments, and transcripts)
Audio, electronic, visual, thermal, olfactory, or similar information (such as recorded voice, recorded video, and photos)
Professional or employment-related information (such as employer information and job title)
Inferences drawn from other categories of personal information to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes (such as likelihood of making a purchase based on internet or other electronic network activity)
Sensitive personal information:
- Social security number (which we may collect from consumers who are winners of giveaways and (if they choose to provide the information to us, even though we do not intend to collect such information) from consumers enrolled in our admissions counseling services)
- Account log-in in combination with any required security or access code, password, or credentials allowing access to an account.
- Financial account, debit card, or credit card number in combination with any required security or access code
- Racial or ethnic origin
- Religious or philosophical beliefs (which we may collect from consumers enrolled in our admissions counseling services and take into account in providing our admissions counseling services (if they choose to provide the information to us, even though we do not intend to collect such information))
- Personal information collected and analyzed concerning a consumer’s health (which we may collect from consumers enrolled in our admissions counseling services and take into account in providing our admissions counseling services (if they choose to provide the information to us, even though we do not intend to collect such information))
- Personal information collected and analyzed concerning a consumer’s sex life or sexual orientation (which we may collect from consumers enrolled in our admissions counseling services and take into account in providing our admissions counseling services)

Sources from which Personal Information (Including Sensitive Personal Information) is Collected

We collect personal information from the categories of sources listed below, as described in more detail in the “Information We Collect” section above:

Consumers
Third parties with whom we have a business relationship (such as our organizational customers, organizations that we have marketing agreements with, resellers, licensees, and franchisees)
Other users who refer you to us
College and universities who provide information for the purpose of conducting surveys
Publicly and commercially available sources, including organizers of events you may attend
Browsers and tracking technologies
Our service providers and other vendors

Purposes for which Personal Information (Including Sensitive Personal Information) Will Be Collected or Used

We may collect or use personal information for the following purposes:

provide you with and personalize our products and services;
create and manage your account, process your orders, and provide you customer service;
maintain our internal records, comply with legal requirements, and otherwise manage our business;
send you newsletters and advertisements and otherwise correspond with you about products, services, events, and other organizations that we think may interest you;
ask for your reviews and testimonials and send you surveys and questionnaires;
include as content in our products and services and marketing materials if you have provided permission;
improve our products, services, and Site;
administer sweepstakes and other promotions;
develop and display content and advertising tailored to your interests on our Site and other sites, provide our advertisements to you when you visit other sites, and analyze the effectiveness of our advertisements;
perform research and analysis about your use of or interest in our products and services, the products or services offered by others, and our Site, and develop new products and services;
detect, prevent, or investigate illegal activity or misuse of our products or services and enforce our legal rights; and
perform functions as otherwise described to you at the time of collection.

We do not use sensitive personal information for purposes other than to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services.

Personal Information Sold

We may be deemed to sell personal information (but not sensitive personal information) to third parties who provide online advertising services to us for the purpose of cross-context behavioral advertising and may be deemed to have sold personal information of California consumers in the preceding 12 months to third parties who provide online advertising services to us for the purpose of cross-context behavioral advertising. The foregoing does not apply to consumers who visited www.tutor.com but not www.princetonreview.com. We do not currently sell the personal information of minors under 16 years of age and do not have actual knowledge that we sell the personal information of minors under 16 years of age. We do not have a process for those under 16 years of age to opt-in to such sharing.

Personal Information Shared with Third Parties

We have shared personal information (but not sensitive personal information) with third parties who provide online advertising services to us for the purpose of cross-context behavioral advertising in the preceding 12 months. The foregoing does not apply to consumers who visited www.tutor.com but not www.princetonreview.com. We do not currently share the personal information of minors under 16 years of age and do not have actual knowledge that we share the personal information of minors under 16 years of age. We do not have a process for those under 16 years of age to opt-in to such sharing.

Personal Information (Including Sensitive Personal Information) Disclosed for a Business Purpose

We may disclose personal information to a third party for a business purpose. In the preceding 12 months, we have disclosed the categories of personal information listed below:

Identifiers
Categories of personal information listed in the California Customer Records statute
Characteristics of protected classifications under California or federal law
Commercial information
Internet or other electronic network activity information
Non-public education information
Audio, electronic, visual, thermal, olfactory, or similar information
Professional or employment-related information
Inferences drawn from other categories of personal information
Sensitive personal information

We have disclosed some of the categories of personal information to organizations which arranged for consumers’ participation in our products and services as part of the services we provide to these organizations. We have disclosed all of the categories of personal information listed above to our service providers and other vendors because they help deliver our products and services and otherwise help us operate our business.

We do not disclose sensitive personal information to third parties for purposes other than to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services.

Your Right to Know

You have the right to request that we disclose information to you about our collection, use, disclosure, sale, and sharing of your personal information. Once we receive and confirm your verifiable consumer request, then subject to exceptions provided under the California Privacy Law and based on your request, we will disclose to you:

The categories of personal information we collected about you.
The categories of sources from which we collected your personal information.
The business or commercial purpose for collecting, selling, or sharing your personal information.
The categories of third parties to whom we disclosed your personal information.
The specific pieces of personal information we collected about you.
If we sold or shared your personal information, the categories of personal information that we collected about you and that were sold or shared with each category of recipient.
If we disclosed your personal information for a business purpose, the categories of personal information that we collected about you and that were disclosed to each category of recipient.

Your Right to Deletion

You have the right to request that we delete your personal information that we have collected, subject to exceptions provided under the California Privacy Law. Once we receive and confirm your verifiable consumer request, then unless an exception applies, we will delete your personal information from our records and direct our service providers and other vendors to delete your personal information from their records.

Your Right to Correct Inaccurate Personal Information

If we maintain inaccurate personal information about you, you have the right to request that we correct the inaccurate personal information, taking into account the nature of the personal information and the purposes of the processing of the personal information. Once we receive and confirm your verifiable consumer request, then unless otherwise provided by the California Privacy Law and subject to our receipt of documentation that we may request, we will correct your personal information in our systems and direct our service providers and other vendors to correct your personal information in their systems. Please note, however, that if we received the inaccurate personal information from an organization that arranged for your participation in one of our programs, then the organization may need to correct the inaccurate personal information in order for you to be able to continue to access the program.

Submitting Requests

To exercise your right to know, right to deletion, or right to correction described above, please submit a verifiable consumer request to us by:

Calling us at 888-223-7737; or
Completing and submitting the web form located at www.princetonreview.com/ccpa or www.tutor.com/ccpa

You may only make a verifiable consumer request to know twice within a 12-month period.

You may authorize another person to act as your agent to submit requests on your behalf. Unless you provide the agent with power of attorney under the California Probate Code, you will need to provide the agent a written and signed authorization. You may also submit requests on behalf of your minor child.

Verification

We will verify your identity before fulfilling your request to know, to delete, or to correct. If you have an account with us, we will ask you to enter your username and password through a link we provide to verify your identity. If you do not have an account with us, we will ask you to provide us data points that we have about you to verify your identity.

If you authorize another person to act as your agent to submit requests on your behalf, then unless you provide the agent with power of attorney under the California Probate Code, we will ask the agent to provide us the written and signed authorization that you provided to the agent, we will confirm with you that you did provide the authorization, and we will verify your identity. If you submit a request on behalf of a minor child, we will ask you to provide us information about your child that allows us to determine that you are the parent or guardian of the child. If the child is under the age of 13, we will ask you to sign a form declaring under penalty of perjury that you are the parent or guardian of the child.

Our Response to Your Request

We endeavor to respond to a verifiable consumer request within 45 days of its receipt. If we reasonably require more time (up to 45 additional days), we will inform you of the reason in writing within 45 days of receipt of your request. We will deliver our written response by mail or electronically. If we are unable to comply with a request, our response will explain why.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Your Right to Opt Out of the Sale and Sharing of Personal Information

You have the right to opt out of the sale of your personal information and sharing of your personal information for cross context behavioral advertising. You can exercise this right by clicking on the following link: www.princetonreview.com/cpraoptout. You can also exercise this right by calling us at 888-223-7737.

In your browser settings or through a browser extension, you can also have your browser send an opt-out preference signal. We will process the signal at the browser level so that when we detect the signal from your browser, we will opt you out of the sale and sharing of your personal information so long as you are using the same browser with the opt-out preference signal enabled.

The foregoing does not apply to consumers who visit www.tutor.com but not www.princetonreview.com since we do not sell or share the personal information of such consumers.

Your Right to Non-Discrimination

You have the right not to receive discriminatory treatment by us for the exercise of the rights conferred by the California Privacy Law.

How Long We Retain Personal Information

The length of time that we retain each category of personal information is determined by various criteria, including maintaining our ability to provide our products and services and honor guarantees, contractual obligations, maintaining our ability to address complaints about our products and services and defend against or bring claims, maintaining records for audit purposes or as required by law, the type of relationship a consumer has with us and the duration of the relationship, and the retention policies and practices of, and features in the offerings provided by, our service providers and other vendors.

Processing of De-identified Data

We commit to maintaining and using de-identified data without attempting to re-identify the data.

Accessibility of this Privacy Policy

Commercially available screen reader programs should be able to read this Privacy Policy. As a web page, this Privacy Policy may be printed as a document.

Colorado Privacy Act Rights

The information in this Colorado Privacy Act Rights section applies only to Colorado consumers. Any terms defined in the Colorado Privacy Act (“CPA”) have the same meaning when used in this Colorado Privacy Act Rights section.

Categories of Personal Data that We Have Collected or Processed

We have collected or processed the following categories of personal data:

Name and date of birth
Contact information (such as address, email address, and phone number)
Online identifiers (such as cookies, IP address, and machine ID)
Identification numbers (such as library card number and student ID number)
Education and school information (such as test scores, course enrollments, graduation year, GPA, and transcripts)
Payment information (such as credit card number)
Commercial information (such as purchase or enrollment history)
Online activity (such as interaction with our Sites)
Audio or visual information (such as recorded voice, recorded video, and photos)
Professional or employment-related information (such as employer information, job title, and military or veteran status)
Sensitive data (such as personal data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life or sexual orientation, citizenship or citizenship status, and personal data of children under the age of 13)

Purposes for which the Categories of Personal Data Are Processed

The table below lists each category of personal data in the immediately preceding section and the purposes for processing the category of personal data based on the purposes listed under the “How We Use Information” section above.

Category of Personal Data	Purposes for Processing the Personal Data
Name and date of birth	Provide you with and personalize our products and services; create and manage your account, process your orders, and provide you customer service; maintain our internal records, comply with legal requirements, and otherwise manage our business; send you newsletters and advertisements and otherwise correspond with you about products, services, events, and other organizations that we think may interest you; ask for your reviews and testimonials and send you surveys and questionnaires; include as content in our products and services and marketing materials if you have provided permission; improve our products, services, and Site; administer sweepstakes and other promotions; detect, prevent, or investigate illegal activity or misuse of our products or services and enforce our legal rights; perform functions as otherwise described to you at the time of collection
Contact information	Provide you with and personalize our products and services; create and manage your account, process your orders, and provide you customer service; maintain our internal records, comply with legal requirements, and otherwise manage our business; send you newsletters and advertisements and otherwise correspond with you about products, services, events, and other organizations that we think may interest you; ask for your reviews and testimonials and send you surveys and questionnaires; administer sweepstakes and other promotions; detect, prevent, or investigate illegal activity or misuse of our products or services and enforce our legal rights; perform functions as otherwise described to you at the time of collection.
Online identifiers	Provide you with and personalize our products and services; maintain our internal records, comply with legal requirements, and otherwise manage our business; improve our products, services, and Site; develop and display content and advertising tailored to your interests on our Site and other sites, provide our advertisements to you when you visit other sites, and analyze the effectiveness of our advertisements; perform research and analysis about your use of or interest in our products and services, the products or services offered by others, and our Site, and develop new products and services; detect, prevent, or investigate illegal activity or misuse of our products or services and enforce our legal rights; perform functions as otherwise described to you at the time of collection.
Identification numbers	Provide you with and personalize our products and services; create and manage your account, process your orders, and provide you customer service; maintain our internal records, comply with legal requirements, and otherwise manage our business; detect, prevent, or investigate illegal activity or misuse of our products or services and enforce our legal rights; perform functions as otherwise described to you at the time of collection.
Education and school information	Provide you with and personalize our products and services; create and manage your account, process your orders, and provide you customer service; maintain our internal records, comply with legal requirements, and otherwise manage our business; send you newsletters and advertisements and otherwise correspond with you about products, services, events, and other organizations that we think may interest you; include as content in our products and services and marketing materials if you have provided permission; perform functions as otherwise described to you at the time of collection.
Payment information	Provide you with and personalize our products and services; create and manage your account, process your orders, and provide you customer service; maintain our internal records, comply with legal requirements, and otherwise manage our business; detect, prevent, or investigate illegal activity or misuse of our products or services and enforce our legal rights; perform functions as otherwise described to you at the time of collection.
Commercial information	Provide you with and personalize our products and services; create and manage your account, process your orders, and provide you customer service; maintain our internal records, comply with legal requirements, and otherwise manage our business; send you newsletters and advertisements and otherwise correspond with you about products, services, events, and other organizations that we think may interest you; include as content in our products and services and marketing materials if you have provided permission; perform research and analysis about your use of or interest in our products and services, the products or services offered by others, and our Site, and develop new products and services; detect, prevent, or investigate illegal activity or misuse of our products or services and enforce our legal rights; perform functions as otherwise described to you at the time of collection.
Online activity	Provide you with and personalize our products and services; create and manage your account, process your orders, and provide you customer service; maintain our internal records, comply with legal requirements, and otherwise manage our business; send you newsletters and advertisements and otherwise correspond with you about products, services, events, and other organizations that we think may interest you; improve our products, services, and Site; develop and display content and advertising tailored to your interests on our Site and other sites, provide our advertisements to you when you visit other sites, and analyze the effectiveness of our advertisements; perform research and analysis about your use of or interest in our products and services, the products or services offered by others, and our Site, and develop new products and services; detect, prevent, or investigate illegal activity or misuse of our products or services and enforce our legal rights; perform functions as otherwise described to you at the time of collection.
Audio or visual information	Provide you with and personalize our products and services; create and manage your account, process your orders, and provide you customer service; maintain our internal records, comply with legal requirements, and otherwise manage our business; include as content in our products and services and marketing materials if you have provided permission; improve our products, services, and Site; detect, prevent, or investigate illegal activity or misuse of our products or services and enforce our legal rights; perform functions as otherwise described to you at the time of collection.
Professional or employment-related information	Provide you with and personalize our products and services; create and manage your account, process your orders, and provide you customer service; maintain our internal records, comply with legal requirements, and otherwise manage our business; send you newsletters and advertisements and otherwise correspond with you about products, services, events, and other organizations that we think may interest you; include as content in our products and services and marketing materials if you have provided permission; detect, prevent, or investigate illegal activity or misuse of our products or services and enforce our legal rights; perform functions as otherwise described to you at the time of collection.
Sensitive data	Provide you with and personalize our products and services; create and manage your account, process your orders, and provide you customer service; maintain our internal records, comply with legal requirements, and otherwise manage our business; include as content in our products and services and marketing materials if you have provided permission; perform functions as otherwise described to you at the time of collection.

Your Rights under the CPA and How to Exercise Them

Subject to the CPA, you may exercise the following rights under the CPA:

To opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data). You may authorize another person, acting on your behalf, to opt out of such processing of your personal data. We do not otherwise sell your personal data or process personal data for the purposes of profiling in furtherance of decisions that produce legal or similarly significant effects concerning Connecticut consumers.
To confirm whether or not we are processing your personal data and to access such personal data. When exercising the right to access your personal data, you have the right to obtain the personal data in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance. You may exercise this right to access and obtain your personal data no more than 2 times per calendar year.
To correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of your personal data.
To delete personal data concerning you.

To exercise the opt out right described above, please submit a request to us by:

Calling us at 888-223-7737; or
Completing and submitting the online request form located at www.princetonreview.com/optout.

To exercise any of the other rights, please submit a request to us by:

Calling us at 888-223-7737; or
Completing and submitting the online request form located at www.princetonreview.com/stateprivacyrequests or www.tutor.com/stateprivacyrequests.

We will provide information in response to your request free of charge once during any 12-month period.

We will authenticate your identity before fulfilling your request (other than an opt out request). If you have an account with us, we will ask you to enter your username and password through a link we provide to authenticate your identity. If you do not have an account with us, we will ask you to provide us data points that we have about you to authenticate your identity. If you authorize another person to act as your agent to submit an opt out request on your behalf, then we will authenticate, with commercially reasonable effort, your identity and the authority of the other person to act on your behalf.

You may appeal our decision by completing and submitting an online appeals form located at www.princetonreview.com/stateprivacyappeals or www.tutor.com/stateprivacyappeals.

Within 45 days of our receipt of the appeal, we will inform you of any action taken or not taken in response to the appeal, along with a written explanation of the reasons in support of the response. If we reasonably require more time (up to 60 additional days), we will inform you of the extension together with the reasons for the delay within 45 days of our receipt of the appeal. If you have concerns about the results of the appeal, you may contact the Attorney General of Colorado.

Categories of Personal Data that We Share with Third Parties

We may share any of the personal data that we process with third parties.

Categories of Third Parties with whom We Share Personal Data

We share personal data with the categories of third parties listed under the “Third Parties to whom We Disclose Information” section above.

Targeted Advertising and Sale of Personal Data

We process personal data for targeted advertising. We do not sell personal data (unless processing personal data for targeted advertising is deemed a sale). You may opt out of such processing by submitting a request to us described in the “ Your Rights under the CPA and How to Exercise Them” section above.

In your browser settings or through a browser extension, you can also have your browser send an opt-out preference signal. We will process the signal at the browser level so that when we detect the signal from your browser, we will opt you out of the processing of your personal data for targeted advertising so long as you are using the same browser with the opt-out preference signal enabled.

The foregoing does not apply to consumers who visit www.tutor.com but not www.princetonreview.com since we do not process personal data of such consumers for targeted advertising.

Processing of De-identified Data

We commit to maintaining and using de-identified data only in a de-identified fashion and not attempting to re-identify the data.

Connecticut Data Privacy Act Rights

The information in this Connecticut Data Privacy Act Rights section applies only to Connecticut consumers. Any terms defined in the Connecticut Act Concerning Personal Data Privacy and Online Monitoring, which is also referred to as the Connecticut Data Privacy Act (“CTDPA”) have the same meaning when used in this Connecticut Data Privacy Act Rights section.

Categories of Personal Data that We Have Processed

We have processed the following categories of personal data:

Name and date of birth
Contact information (such as address, email address, and phone number)
Online identifiers (such as cookies, IP address, and machine ID)
Identification numbers (such as library card number and student ID number)
Education and school information (such as test scores, course enrollments, graduation year, GPA, and transcripts)
Payment information (such as credit card number)
Commercial information (such as purchase or enrollment history)
Online activity (such as interaction with our Sites)
Audio or visual information (such as recorded voice, recorded video, and photos)
Professional or employment-related information (such as employer information, job title, and military or veteran status)
Sensitive data (such as personal data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation, citizenship or immigration status, and personal data of children under the age of 13)

Purposes for which the Categories of Personal Data Are Processed

We may process personal data for the purposes listed under the “How We Use Information” section above.

Your Rights under the CTDPA and How to Exercise Them

Subject to the CTDPA, you may exercise the following rights under the CTDPA:

To confirm whether or not we are processing your personal data and to access such personal data.
To correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of your personal data.
To delete personal data provided by or obtained about you.
To obtain your personal data in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance.
To opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data). You may authorize another person, acting on your behalf, to opt out of such processing of your personal data. A parent or guardian may also exercise this opt out right on behalf of their child. We do not otherwise sell your personal data or process personal data for the purposes of profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning Connecticut consumers.

To exercise the opt out right described above, please submit a request to us by completing and submitting the online request form located at www.princetonreview.com/optout. To exercise any of the other rights described above or to revoke consent that you provided to the processing of your sensitive data by us (if you provided such consent previously), please submit a request to us by completing and submitting the online request form located at www.princetonreview.com/stateprivacyrequests or www.tutor.com/stateprivacyrequests.

We will provide information in response to your request free of charge once during any 12-month period. If your requests are manifestly unfounded, excessive, or repetitive, we may charge you a reasonable fee to cover the administrative costs of complying with the request or decline to act on the request.

We will verify your identity before fulfilling your request (other than an opt out request). If you have an account with us, we will ask you to enter your username and password through a link we provide to verify your identity. If you do not have an account with us, we will ask you to provide us data points that we have about you to verify your identity. If you authorize another person to act as your agent to submit an opt out request on your behalf, then we will verify, with commercially reasonable effort, your identity and the authority of the other person to act on your behalf.

We endeavor to respond to a request after we have verified your identity within 45 days of receipt of the request. If we reasonably require more time (up to 45 additional days), we will inform you of the extension together with the reasons for the delay within 45 days of receipt of the request. If we do not take action on a request, we will provide the reasons for our decision within 45 days of the receipt of the request. Notwithstanding the foregoing, if you revoke consent that you provided previously to our processing of your sensitive data, we will cease processing your sensitive data within 15 days after receiving the revocation.

You may appeal our decision by completing and submitting an online appeals form located at www.princetonreview.com/stateprivacyappeals or www.tutor.com/stateprivacyappeals.

Categories of Personal Data that We Share with Third Parties

We may share any of the personal data that we process with third parties.

Categories of Third Parties with whom We Share Personal Data

We share personal data with the categories of third parties listed under the “Third Parties to whom We Disclose Information” section above.

Targeted Advertising and Sale of Personal Data

We process personal data for targeted advertising. We do not sell personal data (unless processing personal data for targeted advertising is deemed a sale). You may opt out of such processing by submitting a request to us as described in the “Your Rights under the CTDPA and How to Exercise Them” section above.

Montana Consumer Data Privacy Act Rights

The information in this Montana Consumer Data Privacy Act Rights section applies only to Montana consumers. Any terms defined in the Montana Consumer Data Privacy Act (“MCDPA”) have the same meaning when used in this Montana Consumer Data Privacy Act Rights section.

Categories of Personal Data that We Have Processed

We have processed the following categories of personal data:

Name and date of birth
Contact information (such as address, email address, and phone number)
Online identifiers (such as cookies, IP address, and machine ID)
Identification numbers (such as library card number and student ID number)
Education and school information (such as test scores, course enrollments, graduation year, GPA, and transcripts)
Payment information (such as credit card number)
Commercial information (such as purchase or enrollment history)
Online activity (such as interaction with our Sites)
Audio or visual information (such as recorded voice, recorded video, and photos)
Professional or employment-related information (such as employer information, job title, and military or veteran status)
Sensitive data (such as personal data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, information about a person’s sex life, sexual orientation, citizenship or immigration status, and personal data of children under the age of 13)

Purposes for Processing Personal Data

We may process personal data for the purposes listed under the “How We Use Information” section above.

Your Rights under the MCDPA and How to Exercise Them

Subject to the MCDPA, you may exercise the following rights under the MCDPA:

To obtain confirmation as to whether we are processing your personal data and to access the personal data, unless such confirmation or access would require us to reveal a trade secret;
To correct inaccuracies in your personal data, considering the nature of the personal data and the purposes of the processing of your personal data;
To delete personal data about you;
To obtain a copy of your personal data that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the personal data to another person without hindrance when the processing is carried out by automated means, provided that we are not required to reveal any trade secret; and
To opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data). We do not otherwise sell your personal data or engage in profiling in furtherance of solely automated decisions that produce legal effects or similarly significant effects.

To exercise the opt out right described above, please submit a request to us by completing and submitting the online request form located at www.princetonreview.com/optout . To exercise any of the other rights described above or to revoke consent that you provided previously to the processing of your sensitive data by us, please submit a request to us by completing and submitting the online request form located at www.princetonreview.com/stateprivacyrequests or www.tutor.com/stateprivacyrequests .

We will provide information in response to your request free of charge once during any 12-month period.

A parent or legal guardian may submit requests on behalf of their child under the age of 13. A guardian or conservator of another person subject to guardianship, conservatorship, or other protective arrangement may submit requests on behalf of the other person. You may designate an authorized agent, acting on your behalf, to opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data).

We will verify your identity before fulfilling your request (other than a request to opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data)). If you have an account with us, we will ask you to enter your username and password through a link we provide to verify your identity. If you do not have an account with us, we will ask you to provide us data points that we have about you to verify your identity.

If you submit a request on behalf of your child or ward under the age of 13, we will ask you to provide us information about the child that allows us to determine that you are the parent or legal guardian of the child. If you are guardian or conservator of another person subject to guardianship, conservatorship, or other protective arrangement and submit a request on behalf of the other person, then we will use commercially reasonable efforts to verify the identity of the other person and your authority to act on behalf of the other person. If you designate an authorized agent, acting on your behalf, to opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data), then we will use commercially reasonable efforts to verify your identity and the authorized agent’s authority to act on your behalf.

We endeavor to respond to a request after we have verified your identity (or verified another person’s authority to act on your behalf) within 45 days of receipt of the request. If we reasonably require more time (up to 45 additional days), we will inform you of the extension together with the reasons for the extension within 45 days of receipt of the request. If we decline to take action with respect to a request, we will provide a justification for our decision within 45 days of receipt of the request. Notwithstanding the foregoing, if you revoke consent that you provided previously to our processing of your sensitive data, we will cease processing your sensitive data within 45 days after receiving the revocation.

You may appeal our decision by completing and submitting an online appeals form located at www.princetonreview.com/stateprivacyappeals or www.tutor.com/stateprivacyappeals .

Within 60 days of our receipt of the appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decision. If you disagree with our decision, you may contact the Attorney General of Montana to submit a complaint at https://dojmt.gov/consumer/consumer-complaints/ or (800) 481-6896.

Categories of Personal Data that We Share with Third Parties

We may share any of the personal data that we process with third parties.

Categories of Third Parties with whom We Share Personal Data

We share personal data with the categories of third parties listed under the “Third Parties to whom We Disclose Information” section above.

Targeted Advertising

We process personal data for targeted advertising. We do not sell personal data (unless processing personal data for targeted advertising is deemed a sale). You may opt out of such processing by submitting a request to us as described in the “Your Rights under the MCDPA and How to Exercise Them” section above.

In your browser settings or through a browser extension, you can also have your browser send an opt-out preference signal. We will process the signal at the browser level so that when we detect the signal from your browser, we will opt you out of the processing of your personal data for targeted advertising so long as you are using the same browser with the opt-out preference signal enabled.

The foregoing does not apply to consumers who visit www.tutor.com but not www.princetonreview.com since we do not process personal data of such consumers for targeted advertising.

Processing of De-identified Data

We commit to maintaining and using de-identified data without attempting to re-identify the data.

Nevada Privacy Rights

We do not sell the personal information of Nevada consumers without their authorization, but Nevada consumers may submit an email to prep@review.com to request that we do not sell their personal information in the future.

Oregon Consumer Privacy Act Rights

The information in this Oregon Consumer Privacy Act Rights section applies only to Oregon consumers. Any terms defined in Oregon Senate Bill 619, which is referred to as the Oregon Consumer Privacy Act (“OCPA”), have the same meaning when used in this Oregon Consumer Privacy Act Rights section.

Categories of Personal Data that We Have Processed

We have processed the following categories of personal data:

Name and date of birth
Contact information (such as address, email address, and phone number)
Online identifiers (such as cookies, IP address, and machine ID)
Identification numbers (such as library card number and student ID number)
Education and school information (such as test scores, course enrollments, graduation year, GPA, and transcripts)
Payment information (such as credit card number)
Commercial information (such as purchase or enrollment history)
Online activity (such as interaction with our Sites)
Audio or visual information (such as recorded voice, recorded video, and photos)
Professional or employment-related information (such as employer information, job title, and military or veteran status)
Sensitive data (such as personal data revealing racial or ethnic background, national origin, religious beliefs, mental or physical condition or diagnosis, sexual orientation, status as transgender or non-binary, status as a victim of crime, citizenship or immigration status, and personal data of children under the age of 13)

Purposes for Processing Personal Data

We may process personal data for the purposes listed under the “How We Use Information” section above.

Your Rights under the OCPA and How to Exercise Them

Subject to the OCPA, you may exercise the following rights under the OCPA:

To obtain confirmation as to whether we are processing or have processed your personal data and to obtain the categories of personal data that we are processing or have processed;
To obtain, at our option, a list of specific third parties, other than natural persons, to which we have disclosed your personal data or any personal data;
To obtain a copy of all of your personal data that we have processed or are processing in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the personal data to another person without hindrance;
To correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of your personal data;
To delete personal data about you; and
To opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data). We do not otherwise sell your personal data or engage in profiling in furtherance of decisions that produce legal effects or effects of similar significance concerning you.

To exercise the opt out right described above, please submit a request to us by completing and submitting the online request form located at www.princetonreview.com/optout . To exercise any of the other rights described above or to revoke consent that you provided to the processing of your sensitive data by us (if you provided such consent previously), please submit a request to us by completing and submitting the online request form located at www.princetonreview.com/stateprivacyrequests or www.tutor.com/stateprivacyrequests .

We will provide information in response to your request free of charge once during any 12-month period.

A parent, legal guardian, or conservator may submit requests on behalf of their child under the age of 13, the child under the age of 13 for whom the guardian has legal responsibility, or the consumer under the age of 13 who is subject to conservatorship, respectively. You may authorize another person, acting on your behalf, to opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data).

We will verify your identity before fulfilling your request, other than a request to opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data). If you have an account with us, we will ask you to enter your username and password through a link we provide to verify your identity. If you do not have an account with us, we will ask you to provide us data points that we have about you to verify your identity.

If you submit a request on behalf of your child under the age of 13 or a child under the age of 13 for whom you have legal responsibility or for whom you are the conservator, we will ask you to provide us information about the child that allows us to determine that you are the parent, guardian, or conservator of the child. If you authorize another person, acting on your behalf, to opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data), then we will use commercially reasonable efforts to verify your identity and the authorized agent’s authority to act on your behalf.

We endeavor to respond to a request after we have verified your identity within 45 days of receipt of the request. If we reasonably require more time (up to 45 additional days), we will inform you of the extension together with the reasons for the extension within 45 days of receipt of the request. If we decline to take action with respect to a request, we will provide a justification for our decision within 45 days of receipt of the request. Notwithstanding the foregoing, if you revoke consent that you provided previously to our processing of your sensitive data, we will cease processing your sensitive data within 15 days after receiving the revocation.

You may appeal our decision by completing and submitting an online appeals form located at www.princetonreview.com/stateprivacyappeals or www.tutor.com/stateprivacyappeals .

Within 45 days of our receipt of the appeal, we will approve or deny the appeal and notify you of the decision and the reasons for the decision. If you disagree with our decision, you may contact the Attorney General of Oregon to submit a complaint at 877-877-9392 or https://justice.oregon.gov/consumercomplaints/.

Categories of Personal Data that We Share with Third Parties

We may share any of the personal data that we process with third parties.

Categories of Third Parties with whom We Share Personal Data

We share personal data with the categories of third parties listed under the “Third Parties to whom We Disclose Information” section above.

Targeted Advertising

We process personal data for targeted advertising. We do not sell personal data (unless processing personal data for targeted advertising is deemed a sale). You may opt out of such processing by submitting a request to us as described in the “Your Rights under the OCPA and How to Exercise Them” section above.

In your browser settings or through a browser extension, you can also have your browser send an opt-out preference signal. We will process the signal at the browser level so that when we detect the signal from your browser, we will opt you out of the processing of your personal data for targeted advertising so long as you are using the same browser with the opt-out preference signal enabled.

The foregoing does not apply to consumers who visit www.tutor.com but not www.princetonreview.com since we do not process personal data of such consumers for targeted advertising.

Processing of De-identified Data

We commit to maintaining and using de-identified data without attempting to re-identify the data.

Texas Data Privacy and Security Act Rights

The information in this Texas Data Privacy and Security Act Rights section applies only to Texas consumers. Any terms defined in the Texas Data Privacy and Security Act (“TDPSA”) have the same meaning when used in this Texas Data Privacy and Security Act Rights section.

Categories of Personal Data that We Have Processed

We have processed the following categories of personal data:

Name and date of birth
Contact information (such as address, email address, and phone number)
Online identifiers (such as cookies, IP address, and machine ID)
Identification numbers (such as library card number and student ID number)
Education and school information (such as test scores, course enrollments, graduation year, GPA, and transcripts)
Payment information (such as credit card number)
Commercial information (such as purchase or enrollment history)
Online activity (such as interaction with our Sites)
Audio or visual information (such as recorded voice, recorded video, and photos)
Professional or employment-related information (such as employer information, job title, and military or veteran status)
Sensitive data (such as personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sex life, sexuality, citizenship or immigration status, and personal data of children under the age of 13)

Purposes for which Personal Data Are Processed

We may process personal data for the purposes listed under the “How We Use Information” section above.

Your Rights under the TDPSA and How to Exercise Them

Subject to the TDPSA, you may exercise the following rights under the TDPSA:

To confirm whether or not we are processing your personal data and to access such personal data.
To correct in accuracies in your personal data.
To delete personal data that you provided to us or obtained about you.
If your personal data is available in a digital format, to obtain a copy of your personal data that you provided to us in a format that is portable and (to the extent practicable) readily usable, and allows you to transmit the data to another controller without hindrance.
To opt out of the processing of your personal data for purposes of targeted advertising and sale of personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data). We do not otherwise sell your personal data or engage in profiling in furtherance of decisions that produce legal effects or effects of similar significance concerning you.

A parent or guardian may exercise any of these rights on behalf of their child. You may authorize another person, acting on your behalf, to opt out of the processing of your personal data for purposes of targeted advertising and the sale of your personal data (if the processing of personal data for purposes of targeted advertising is deemed to be a sale of personal data).

To exercise the opt out right described above, please submit a request to us by:

Calling us at 888-223-7737; or
Completing and submitting the online request form located at www.princetonreview.com/optout .

To exercise any of the other rights described above, please submit a request to us by:

Calling us at 888-223-7737; or
Completing and submitting the online request form located at www.princetonreview.com/stateprivacyrequests or www.tutor.com/stateprivacyrequests .

We will provide information in response to your request free of charge twice during any 12-month period. If your requests are excessive, repetitive, or manifestly unfounded, then we may charge you a reasonable fee to cover the administrative costs of complying with the request or we may decline to act on the request.

You may appeal our decision by completing and submitting an online appeals form located at www.princetonreview.com/stateprivacyappeals or www.tutor.com/stateprivacyappeals .

Within 60 days of our receipt of the appeal, we will notify you of any action we take or do not take in response to the appeal, including the reasons for the decision. If we deny your appeal, you may contact the Attorney General of Texas to submit a complaint at https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint.

Categories of Personal Data that We Share with Third Parties

We may share any of the personal data that we process with third parties.

Categories of Third Parties with whom We Share Personal Data

We share personal data with the categories of third parties listed under the “Third Parties to whom We Disclose Information” section above.

Targeted Advertising

We process personal data for targeted advertising. We do not sell personal data (unless processing personal data for targeted advertising is deemed a sale). You may opt out of such processing by submitting a request to us as described in the “Your Rights under the TDPSA and How to Exercise Them” section above.

In your browser settings or through a browser extension, you can also have your browser send an opt out preference signal. We will process the signal at the browser level so that when we detect the signal from your browser, we will opt you out of the processing of your personal data for targeted advertising so long as you are using the same browser with the opt out preference signal enabled.

The foregoing does not apply to consumers who visit www.tutor.com but not www.princetonreview.com since we do not process personal data of such consumers for targeted advertising.

Processing of De-identified Data

We commit to maintaining and using de-identified data without attempting to re-identify the data.

Utah Consumer Privacy Act Rights

The information in this Utah Consumer Privacy Act Rights section applies only to Utah consumers. Any terms defined in the Utah Consumer Privacy Act (“UCPA”) have the same meaning when used in this Utah Consumer Privacy Act Rights section.

Categories of Personal Data that We Have Processed

We have processed the following categories of personal data:

Name and date of birth
Contact information (such as address, email address, and phone number)
Online identifiers (such as cookies, IP address, and machine ID)
Identification numbers (such as library card number and student ID number)
Education and school information (such as test scores, course enrollments, graduation year, GPA, and transcripts)
Payment information (such as credit card number)
Commercial information (such as purchase or enrollment history)
Online activity (such as interaction with our Sites)
Audio or visual information (such as recorded voice, recorded video, and photos)
Professional or employment-related information (such as employer information, job title, and military or veteran status)
Sensitive data (such as personal data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation, citizenship or immigration status, and personal data of children under the age of 13)

Purposes for which the Categories of Personal Data Are Processed

We may process personal data for the purposes listed under the “How We Use Information” section above.

Your Rights under the UCPA and How to Exercise Them

Subject to the UCPA, you may exercise the following rights under the UCPA:

To confirm whether or not we are processing your personal data and to access such personal data.
To delete personal data that you provided to us.
To obtain a copy of your personal data that you provided to us in a format that (to the extent technically feasible) is portable, (to the extent practicable) is readily usable, and (where the processing is carried out by automated means) allows you to transmit the data to another controller without impediment.
To opt out of the processing of your personal data for purposes of targeted advertising.

A parent or guardian may exercise any of these rights on behalf of their child.

To exercise the opt out right described above , please submit a request to us by completing and submitting the online request form located at www.princetonreview.com/optout . To exercise any of the other rights described above, please submit a request to us by completing and submitting the online request form located at www.princetonreview.com/stateprivacyrequests or www.tutor.com/stateprivacyrequests .

We will provide information in response to your request free of charge once during any 12-month period. If your requests are excessive, repetitive, technically infeasible, or manifestly unfounded, or we reasonably believe that the primary purpose in submitting the request was something other than exercising a right under the UCPA, or the request (individually or as part of an organized effort) harasses, disrupts, or imposes undue burden on the resources of our business, then we may charge you a reasonable fee to cover the administrative costs of complying with the request or refuse to act on the request.

Categories of Personal Data that We Share with Third Parties

We may share any of the personal data that we process with third parties.

Categories of Third Parties with whom We Share Personal Data

We share personal data with the categories of third parties listed under the “Third Parties to whom We Disclose Information” section above.

Targeted Advertising

We process personal data for targeted advertising. You may opt out of such processing by submitting a request to us as described in the “Your Rights under the UCPA and How to Exercise Them” section above. We do not sell personal data.

Virginia Consumer Data Protection Act Rights

The information in this Virginia Consumer Data Protection Act Rights section applies only to Virginia consumers. Any terms defined in the Virginia Consumer Data Protection Act (“VCDPA”) have the same meaning when used in this Virginia Consumer Data Protection Act Rights section.

Categories of Personal Data that We Have Processed

We have processed the following categories of personal data:

Identifiers (such as name, address, email address, phone number, cookies, IP address, machine ID, date of birth, student ID number, and library card number)
Financial information (such as credit card number)
Characteristics of protected classifications under federal law (such as military or veteran status and race)
Commercial information (such as purchase or enrollment history)
Internet or other electronic network activity information (such as interaction with our Sites)
Audio or visual information (such as recorded voice, recorded video, and photos)
Professional or employment-related information (such as employer information and job title)
Education information (such as test scores, course enrollments, graduation year, GPA, and transcripts)
Sensitive data (such as personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, and personal data collected from a child known to be under the age of 13)

Purposes for Processing Personal Data

We may process personal data for the purposes listed under the “How We Use Information” section above.

Your Rights under the VCDPA and How to Exercise Them

Subject to the VCDPA, you may exercise the following rights under the VCDPA:

To confirm whether or not we are processing your personal data and to access such personal data;
To correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of your personal data;
To delete personal data provided by or obtained about you;
To obtain a copy of your personal data that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance, where the processing is carried out by automated means; and
To opt out of the processing of the personal data for purposes of targeted advertising. We do not engage in the sale of your personal data or in profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

You may only make a request twice annually.

A parent or legal guardian who is known to us may submit requests on behalf of their child or ward under the age of 13.

We will verify your identity before fulfilling your request. If you have an account with us, we will ask you to enter your username and password through a link we provide to verify your identity. If you do not have an account with us, we will ask you to provide us data points that we have about you to verify your identity.

If you submit a request on behalf of a child or ward under the age of 13, we will ask you to provide us information about the child or ward that allows us to determine that you are the parent or guardian of the child or ward.

You may appeal our decision by completing and submitting an online appeals form located at www.princetonreview.com/stateprivacyappeals or www.tutor.com/stateprivacyappeals .

Within 60 days of our receipt of the appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decision. If you disagree with our decision, you may contact the Attorney General of Virginia to submit a complaint at www.oag.state.va.us or 800-552-9963.

We do not charge a fee to respond to your requests unless your requests are manifestly unfounded, excessive, or repetitive. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Categories of Personal Data that We Share with Third Parties

We may share any of the personal data that we process with third parties.

Categories of Third Parties with whom We Share Personal Data

We share personal data with the categories of third parties listed under the “Third Parties to whom We Disclose Information” section above.

Targeted Advertising

We process personal data for targeted advertising. You may opt out of such processing by submitting a request to us as described in the “Your Rights under the VCDPA and How to Exercise Them” section above.

Processing of De-identified Data

We commit to maintaining and using de-identified data without attempting to re-identify the data.

Quebec Privacy Act Rights

The information in this Quebec Privacy Act Rights section applies only to Quebec residents. Any terms defined in the Quebec Act Respecting the Protection of Personal Information in the Private Sector (“Quebec Privacy Act” or “QPA”) have the same meaning when used in this Quebec Privacy Act Rights section.

The Categories of Personal Information that We Have Collected

We have collected or processed the following categories of personal information:

Name and date of birth
Contact information (such as address, email address, and phone number)
Online identifiers (such as cookies, IP address, and machine ID)
Identification numbers (such as library card number and student ID number)
Education and school information (such as test scores, course enrollments, graduation year, GPA, and transcripts)
Payment information (such as credit card number)
Commercial information (such as purchase or enrollment history)
Online activity (such as interaction with our Sites)
Audio or visual information (such as recorded voice, recorded video, and photos)
Professional or employment-related information (such as employer information, job title, and military or veteran status)
Sensitive personal information (such as personal information revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life or sexual orientation, citizenship or citizenship status)

Means by which Personal Information is Collected

We may collect personal information by the means described in the “Information We Collect” section above.

Sources from which Personal Information is Collected

We collect personal information from the categories of sources listed below, as described in more detail in the “Information We Collect” section above:

Individuals
Third parties with whom we have a business relationship (such as our organizational customers, organizations that we have marketing agreements with, resellers, licensees, and franchisees)
Other users who refer you to us
College and universities who provide information for the purpose of conducting surveys
Publicly and commercially available sources, including organizers of events you may attend
Browsers and tracking technologies
Our service providers and other vendors

Purposes for which the Categories of Personal Information Is Collected

We may collect personal information for the purposes listed under the “How We Use Information” section above.

Categories of Third Parties with whom We Share Personal information

We share personal information with the categories of third parties listed under the “Third Parties to whom We Disclose Information” section above.

Retention of Personal information

We retain your personal information for as long as necessary to fulfil the purposes for which the information was collected or to satisfy legal or record retention requirements, To determine the appropriate retention period, we consider various criteria, including maintaining our ability to provide our products and services and honor guarantees, contractual obligations, maintaining our ability to address complaints about our products and services and defend against or bring claims, maintaining records for audit purposes or as required by law, the type of relationship you have with us and the duration of the relationship, and the retention policies and practices of, and features in the offerings provided by, our service providers and other vendors.

Places where We Keep Personal Information

We and our service providers and other third parties to whom your personal information is disclosed under this policy operate outside Quebec and Canada. Your personal information will therefore be used and stored securely in other provinces and other countries, including the United States.

Information Security

We use appropriate physical, technical and procedural safeguards for the purpose of preventing unauthorized access, use, disclosure, theft or loss of your personal information. The measures adopted in our security program include:

Protecting the infrastructure through physical and logical security measures such as network segmentation, border control firewalls, secure access to our premises and equipment locations, etc.
Limiting access to your personal information. This means that only personnel who need to know your information to carry out their duties have access to it.
Enforcing password management and multi-factor authentication.
Conducting employee privacy and data security training

Your Rights under the Quebec Privacy Act and How to Exercise Them

Subject to the QPA, you may exercise the following rights under the QPA:

To confirm whether or not we have collected your personal information and to access such personal information by requesting a copy of the personal information we hold about you.
To rectify inaccuracies in your personal information.
To withdraw your consent to the communication or use of your personal information that was collected.

To exercise any of these rights, please submit a request to us by completing the on-line request form located at www.princetonreview.com/qpa or www.tutor.com/qpa.

If you wish to request access to or rectification of personal information about another person, we will need proof that you are a representative, heir, successor, liquidator of the estate, beneficiary of life insurance or death compensation, or holder of parental authority of the person whose personal information we collected or the spouse or close relative of the person whose personal information we collected who is deceased. We will ask you to upload such proof when you submit your request form.

We endeavor to respond to a request for access or rectification after we have verified your identity (or received proof of your relationship to the other person on whose behalf you submitted your request) within 30 days of receipt of the request. If we decline to take action with respect to a request, we will provide a justification for our decision within 30 days of receipt of the request and include the provision of the law on which our decision is based, the remedies available to you and the time limit in which they can be exercised.

In case you disagree with our decision, you have the right to file an Application for the Examination of a Disagreement regarding our decision at the Access to information Commission within 30 days following said decision.

We do not charge a fee to respond to your requests except in limited cases. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Person Responsible for the Protection of Personal Information

The person responsible for overseeing the protection of personal information is our Security Officer.

If you have any questions about this policy, concerns or complaints about our handling of your personal information, or other requests, you can contact us by email at securityofficer@review.com.

Users Outside of the United States

By providing personal information to this Site, you understand and consent to the collection, maintenance, processing and transfer of such information in and to the United States and other countries and territories, in accordance with applicable law. We operate in and market to individuals primarily in the United States and Canada, and we do not operate in or market to individuals in the European Economic Area or the United Kingdom. The processing by us of personal information of individuals outside of the United States or Canada is generally incidental. We do, however, recognize the privacy-related rights of individuals in countries which provide such rights, and therefore, request that any such individuals who have questions about or requests related to the personal information we collect to contact us at privacy@review.com.

Changes to this Privacy Policy

We will update this Privacy Policy from time to time. When we post changes to this Privacy Policy, we will revise the “Effective Date” at the top of this Privacy Policy. We recommend that you check our Site from time to time to inform yourself of any changes in this Privacy Policy or any of our other policies.

Contact Us

If you have any questions or comments regarding this Privacy Policy or our privacy practices, you may contact us by email or mail at the following address:

The Princeton Review and Tutor.com
110 E. 42nd Street, 7th Floor
New York, NY 10017

Attention: Legal Department

privacy@review.com