Scholar Privacy Statement

Introduction

Who we are. When we refer to "us", "we", "our", or "Blackboard" in this Statement, we mean Blackboard T&L, LLC. and its subsidiaries and affiliates. When we refer to "you," we mean the user of Scholar.

We care about privacy. We believe that privacy is a fundamental right for all individuals. We take the obligations that are attached to this information very seriously.

We collect and use personal information to allow us to provide our products and services to our users.

We do not sell your personal information for profit.

Changes to this Statement. From time to time, we will need to update this Statement to reflect changes made to Scholar, the way we operate, or to meet new legal and regulatory requirements. You will find the latest version of this Statement at https://scholar.com/privacy.

For any other questions, you can contact us at privacy@scholar.com.

Scope of Notice

This Privacy Statement ("Statement") applies to personal information processed by us in connection with individuals' use of Scholar ("Scholar" or "Product") where we provide Scholar directly to you.

We are providing Scholar directly to you as the 'business' or 'data controller'. In these instances, we are directly responsible for data privacy compliance, and this Statement applies to how your personal information is used.

This Statement does not apply where Scholar is made available to you by an institution (e.g., a school, college, or university), where we are providing our products and services to you as a "service provider" or "processor" and process personal information under the terms of a contract with our institutional clients. For example, when we process Student Data on behalf of our client institution, we are acting as a service provider, or a "School Official" under FERPA, and we retain, use, and disclose the Student Data in accordance with our written agreement with the institutional client.

For the purposes of this Notice, personal information does not include:

• Publicly available information from government records
• Deidentified, aggregated or anonymized information that is maintained in a form that is not capable of being associated with or linked to you
• Information relating to our employees, contractors, and other personnel (which is governed by a separate privacy notice)

Any terms we use in this Notice that aren't defined in this Notice or our Privacy Statement will have the same meaning as in the applicable state data protection laws.

Personal Information Collection and Use

We collect the following categories of personal information in connection with individuals' use of Scholar:

Sensitive Information

Some of the categories of personal information we collect may be classified as "sensitive" under certain U.S. state privacy laws ("sensitive information"), including, health and disability information (e.g., Users uploading sensitive information into Scholar). We use this sensitive information only for the purposes described in our Statement or as disclosed at the time of collection, to the extent necessary to operate and provide Scholar, to comply with legal and regulatory requirements or as otherwise permissible for our own internal purposes consistent with laws.

De-identified Information

We may at times receive, or process personal information to create, deidentified information that can no longer reasonably be used to infer information about, or otherwise be linked to, a particular individual or household. Where we maintain deidentified information, we will maintain and use the information in deidentified form and not attempt to reidentify the information except as required or permitted by law.

Children's privacy

Scholar is intended for individuals 18 years of age or older. We do not knowingly collect or process personal information from individuals under 18.

Please contact us at privacy@scholar.com if you believe we have inadvertently collected personal information from a child under 18. This will allow us to delete such information as soon as possible.

Purposes for Collection

To provide features and functionality. We use your information to operate, maintain, and provide to you the features and functionalities of Scholar, as well as to communicate directly with you (for example, to send you email messages and push notifications), Typically, it will be necessary for us to use your information in this way in order to provide you with the service you request or because it is in our legitimate interests to ensure Scholar is being offered in a manner that meets our high standards.

Improve Scholar. We use information we gather through the product to understand and improve Scholar. We carry out research and analyze trends typically because it is in our legitimate interests to better understand how users are using Scholar, how we can further improve it and how useful the Products are. When we use information for these purposes, we will implement appropriate safeguards. This may include removing or hashing direct identifiers (e.g., your name, email address, and device ID) from the data set before carrying out research and analysis.

When you choose to participate in feedback programs, focus groups, or similar activities intended to help us better understand user needs and improve Scholar, we may use the personal information you provide to administer these activities, communicate with you about them, and analyze the feedback you share. These activities may include in-app messages, surveys, follow-up communications, and participation in live or recorded sessions (for example, video calls).

Please note that Scholar will leverage third-party AI models in order to provide its different functionalities. Note that Blackboard is not involved in the training of the third-party models that power Scholar. These models are trained by the relevant third-party model provider (e.g. AWS Bedrock, Open AI and Anthropic). The third-party model providers will not use any inputs to or outputs to train the third-party models.

Who we share this information with

We share this information to provide Scholar to you, and to further improve it.

• Within Blackboard. Your information will be accessed only by those who have a need to know to provide Scholar. For instance, our technical teams and client support teams may have access to your information when software or database changes are required for support and maintenance purposes.
• Outside Blackboard. We use vendors to help us provide Scholar to you. Where we use third-party tools (for example, to understand how our Product is used), these third parties will have access to some of your personal information. This includes analytics tools.

Vendors & other types of disclosures

This section provides more information on how we protect your information when we engage vendors, and in which other scenarios we may share your information with third parties.

Vendors

We use vendors to help us provide Scholar. Where this requires access to personal information, we are responsible for the data privacy practices of the vendors. Our vendors must abide by our strict data privacy and security requirements and instructions. They are not allowed to use personal information they access or receive from us for any other purposes than as needed to carry out their work for us.

Other types of disclosures

We will also share your information where required in the following circumstances.

• Changes to our business structure. Where permitted by applicable law, we may disclose your information in the circumstances described below. We will seek to ensure that any successor entity continues to honor the commitments outlined in this Statement. If that is not possible, we will notify you and will not transfer personal information to a successor entity without your required authorization.
  • Corporate transactions such as merger, acquisition, sale of assets, and financing
  • Bankruptcy, dissolution or reorganization, or in similar transactions or proceedings
  • Steps related to the previous bullet points (for example, due diligence)
• Comply with law. We may need to disclose your information to comply with legal or regulatory requirements and to respond to lawful requests, court orders, and legal processes. We will always aim to limit the information we provide as much as possible.
• Enforce our rights, prevent fraud, and for safety. We may need to disclose your information to protect and defend the rights, property, or safety of us, or third parties, including enforcing contracts or policies or in connection with investigating and preventing fraud.
• De-identified information. We may disclose aggregate or de-identified information that is no longer associated with an identifiable individual for research or to enhance and promote Scholar. For example, we may share aggregated or de-identified information with our partners or others for business or research purposes, like partnering with a research firm or academics to explore how Scholar is being used and how such data can be used to enhance our functionalities and further help educational institutions. We will implement appropriate safeguards before sharing information, which may include removing or hashing direct identifiers (e.g., your name, email address, and device ID).

Marketing

Promotion of products and services. We may engage with you in marketing activities to promote Scholar, including events, educational content, and other communications that explain product features, benefits, and effective use cases.

Marketing preferences and opt-out. Our marketing emails will include a link so that you can change your preferences and opt-out of receiving marketing communications from us. You can do this by clicking on the "Unsubscribe" link in the email footer. You can also send us an email at unsubscribe@scholar.com to unsubscribe.

Data Retention

We retain personal information only as long as reasonably necessary to fulfill the purposes described in this Statement or as required by law. The exact retention period will vary depending on the nature of the data and the context of its collection:

• Account Information (like your profile and contact details) is kept for as long as your account remains active. If you delete your account or it becomes inactive, we will delete or de-identify this information after a period necessary to finalize account closure and as needed for legal or record-keeping purposes.
• Usage Data is retained for a limited period (for example, 24 months) for analytics and platform improvement, then either deleted or anonymized.
• Communications (emails, support tickets) are kept as long as needed to address your inquiry and for a period thereafter, in case you have follow-up questions, and to improve our customer service processes.
• Legal Obligations: If we are required to retain certain data longer to comply with laws or resolve disputes, we will do so in accordance with those obligations.

After the applicable retention period, we will either delete your personal information or anonymize it (so it can no longer be associated with you).

Security

We take your privacy seriously and are committed to maintaining the privacy and security of the personal information you provide to us. We employ a variety of physical, administrative, and technological safeguards designed to protect personal information against loss, misuse, and unauthorized access or disclosure. We have a dedicated information security program and work hard to continuously enhance our technical and operational security measures.

Our measures consider the sensitivity of the information we collect, use, and store, and the current state of technology. Our security measures include data encryption at rest and in transit, firewalls, data use, and access limitations for our personnel and vendors and physical access controls to the respective data centers.

Data transfers

Blackboard is a global company headquartered in the United States. For Scholar we use a regional hosting strategy, but we may need to access your information from locations outside of your region and country for support and maintenance purposes where permitted under applicable law. We understand the importance of complying with data transfer requirements. We use approved data transfer mechanisms, such as the standard contractual clauses approved by the EU Commission ("SCCs") and the EU-U.S. Data Privacy Framework and the UK Extension to the EU-U.S. DPF to ensure the adequate protection of your information when it is transferred.

Your Rights

Depending on your state of residency and subject to certain legal limitations and exceptions, you may be able to exercise some or all of the following privacy rights.

The Right to Know

You have the right to confirm whether we are processing personal information about you, and under California law only, to obtain certain details about the personal information we have collected about you, including:

• The categories of personal information we have collected;
• The categories of sources of the personal information;
• The categories of personal information that we have disclosed to third parties for a business purpose, and the categories of recipients to whom this information was disclosed;
• The categories of personal information shared for targeted or cross-contextual advertising purposes (if any), and the categories of recipients to whom the personal information was disclosed; and
• The categories of personal information we have sold and the categories of third parties to whom the information was sold.

The Right to Access & Portability

You have the right to access the personal information we have collected about you and, where required by law, the right to obtain a copy of the personal information in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity.

The Right to Correction

You have the right to correct inaccuracies in your personal information, taking into account the nature of the personal information and the purposes of the processing of the personal information.

The Right of Control over Sensitive Information

You have the right to exercise control over our collection and processing of certain sensitive information.

The Right to Request Deletion

You have the right to request the deletion or erasure of personal information we have collected from you, subject to certain exceptions.

The Right to Opt Out of Data Sales

You have the right to direct us not to sell personal information we have collected about you to third parties.

The Right to Opt Out of Sharing for Targeted Advertising

You have the right to direct us not to use or share personal information for targeted advertising or cross-context behavioral advertising purposes.

The Right to Non-Discrimination

You have the right not to receive discriminatory treatment for exercising these rights.

However, please note that if exercising these rights limits our ability to process personal information (such as in the case of a deletion request), we may no longer be able to provide you our services or engage with you in the same manner.

To Submit Your Privacy Rights Request

You may submit a request to exercise your privacy rights through one of the mechanisms described below. We will need to verify your identity before processing most requests, which may require us to obtain additional personal information from you or require you to log into your account, if you have one. We will only use such personal information to review and comply with your request. In certain circumstances, we may decline or limit your request, particularly where we are unable to verify your identity or locate information in our systems, or as permitted by law.

To exercise your privacy rights, please submit a request by:

• Filling out our U.S. Resident Privacy Rights Request Form, or
• Emailing privacy@scholar.com with the subject line "Scholar U.S. Privacy Rights Request"

Authorized Agents

In certain circumstances, you may permit an authorized agent to submit requests on your behalf. The authorized agent must provide a letter signed by you confirming the agent has permission to submit a request on your behalf or must provide sufficient evidence to show that the authorized agent has been lawfully vested with power of attorney. For security purposes, we may need to verify your identity and confirm directly with you that you have provided the authorized agent permission to submit the request, and it may take additional time to fulfill agent-submitted requests. We may deny a request in the event we are not able to verify the authorized agent's authority to act on your behalf. Please note that for privacy and security reasons, we will direct future communications to the individual on whose behalf the request was made.

Appealing Privacy Rights Decisions

Depending on your state of residency, you may be able to appeal a decision we have made in connection with your privacy rights request. All appeal requests should be submitted via email to privacy@scholar.com.

Contact us

If you have any questions or concerns about our Statement or our own data privacy practices, contact us at privacy@scholar.com or write to us at the following address.