Important Information for Brazilian Residents

Cengage is providing this supplemental privacy notice to give individuals in Brazil the additional information required by Federal Law No. 13,709/2018 - General Data Protection Law of Brazil ("LGPD"). These provisions, together with the statements in the Cengage Privacy Notice, explain our practices for personal data subject to LGPD (“Brazilian Data”).

This notice is being given by Cengage in the United States (as the controller), for itself and its affiliates.

Cengage, Inc.
Privacy Office
200 Pier 4 Boulevard, Suite 400
Boston, MA. 02210

Email: [email protected]

Rua Werner Siemens, 111
Prédio 11 – Torre A – CJ. 12
Lapa de Baixo
05069-900 São Paulo
Brazil

The Cengage Privacy Notice explains the reasons why we process Brazilian Data. We only process Brazilian Data when we have a legal basis for the processing, such as for the following types of processing activities:

• To fulfill a contract with you and for closely-related purposes, such as payment processing and financial account management, contract management, website administration, business continuity and disaster recovery, security and fraud prevention, corporate governance, reporting and legal compliance,
• With your consent (or provided you have not objected, as may be applicable), such to provide you with marketing communications.

We may also process your personal data for the purposes of our legitimate interests (or for the legitimate interests of the educational institutions we serve), provided that such processing shall not outweigh your rights and freedoms. In particular, we may process Brazilian Data as needed to:

• Protect you, us or others from threats, such as security threats, fraud or cheating,
• Comply with the laws that are applicable to us around the world,
• Enable or administer our business, such as for quality control, consolidated reporting, and customer service,
• Manage corporate transactions, such as mergers or acquisitions, and
• Understand and improve our business or customer relationships generally.

We may use profiling and analytics to understand how individuals interact with our educational materials, such as assess engagement and improve learning outcomes, and product development purposes. For example, we may use analytics to study the amount of time that individuals spend on specific content items and we may infer engagement from this process. These analytics also help us understand and improve our materials, as we can determine what materials are more or less accessible to students. We may also use analytics for course integrity purposes, such as to identify individuals that may be cheating.

We will not make automated-decisions that significantly affect the individual, unless (1) the decision is necessary as part of a contract that we have with you, or (2) we are required by law to use the technology.

In most cases, you are not required by law to provide any personal data to Cengage. You are required to provide certain personal data to enable us to send you an offer or to enter into a contract with you so that you can use our products and services. Some data elements are required for our contracts. If you do not provide these data elements, we cannot do business with you.

As noted in Cengage’s Privacy Notice, you always have the right to object to our marketing communications. To opt-out of emails, simply click the link labeled “unsubscribe” at the bottom of any email we send you.

Cengage also respects the rights of Brazilian residents to access, correct and request erasure or restriction of their personal data as required by LGPD. This means:

• You have a right to know if Cengage maintains your personal data
• If we do have your personal data, you have the right to have access to the data
• You have the right ask us to correct or update incomplete, inaccurate or outdated information
• You have the right to ask us to anonymize, block or eliminate any unnecessary or excessive personal data, or any personal data processed in non-compliance with LGPD
• You have the right to data portability, in accordance with national authority regulations
• You have the right to receive information about the public and private entities with which we have shared your personal data

If we are processing your personal data on the basis of your consent, you also have the right to (1) be informed about the possibility of not providing consent and consequences of not providing consent, (2) revoke your consent, and (3) ask us to delete your personal data, subject to our rights to retain data as provided by LGPD.

To exercise these rights, please email [email protected] or write to us at the address above, and a member of our Privacy Team will assist you. Please understand that we may need to verify your identity before we can process your request. Additionally, your rights may be subject to some limitations as provided by LGPD. If we deny your request, will explain the reasons for the denial.

If you believe that we have processed your personal data in violation of applicable law, you may file a complaint with Cengage’s Data Protection Officer via email to [email protected] or with the supervisory authority.

As noted in the Cengage Privacy Notice, we only share Brazilian Data:

• With our affiliates, who use the personal data for the purposes set forth above.
• With our service providers (data processors) or others as needed to provide the services to you, such as when we share your data with online store sellers, for fulfillment of your orders
• With your consent, such as when you take advantage of a partner offer, or
• As permitted by LGPD (such as in connection with the sale of business assets) or required by law.

As stated in the Cengage Privacy Notice, your personal data may be transferred to, stored at or processed in the United States and other countries which may not have equivalent privacy or data protection laws. However, Cengage provides that Brazilian Data are always processed in compliance with LGPD.

Cengage generally uses standard contractual clauses to assure that Brazilian Data are adequately protected when it is transferred out of Brazil, but we may also make transfers to recipients with approved global corporate rules or as otherwise permitted by law.

We retain Brazilian Data for as long as the information is needed for the purposes set forth above and for any additional period that may be required or permitted by law. If you would like to request deletion of your personal data, email [email protected] or write to us at the address above. If we do not have a legal basis for retaining your information, we will delete it in accordance with applicable law.

Please contact us if you have any questions or comments about our privacy practices or this Privacy Notice. You can always reach us via email to [email protected]. You can also reach us via mail to the addresses given above