YEARBOOK+

PRIVACY POLICY

INTRODUCTION
Jostens, Inc. ("Jostens," "we," "our," or "us") respects the privacy of your personal information. This Privacy Policy is designed to assist you in understanding the personal information that is collected when using Yearbook+ through the websites / web application on which this Privacy Policy appears (collectively, "YBK+"). This Privacy Policy also explains how we use, share, and safeguard your personal information. Any summaries of this Privacy Policy are provided for convenience only, and are not a replacement nor an addendum to this Privacy Policy.
From time to time, we may change this Privacy Policy. If we do, we will post an amended version on the YBK+ sites. Please review this Privacy Policy periodically.
Please also refer to our Terms of Use which sets out the terms governing your use of YBK+.
This Privacy Policy covers the following topics:
1. WHAT IS JOSTENS?
2. OUR COLLECTION OF PERSONAL INFORMATION
3. HOW WE USE YOUR PERSONAL INFORMATION
4. HOW WE SHARE YOUR PERSONAL INFORMATION
5. COOKIES
6. "DO NOT TRACK" SIGNALS
7. INTERNATIONAL DATA TRANSFERS
8. YOUR CHOICES AND RIGHTS
9. SECURITY
10. CHILDREN’S PRIVACY
11. ACCESSIBILITY
12. HOW TO CONTACT US

1. WHAT IS JOSTENS?
Jostens is a trusted partner in the academic and achievement channel, providing products, programs and services that help its customers celebrate moments that matter. The company’s products include yearbooks, publications, jewelry and consumer goods that serve the K-12 educational, college and professional sports segments. Founded in 1897 and based in Minneapolis, Minnesota, Jostens is owned by Platinum Equity.
Jostens’ offices are located at 7760 France Avenue South, Suite 400, Minneapolis, MN 55435. Jostens is the data controller of all personal information collected from residents of the European Economic Area (EEA) or the United Kingdom

2. OUR COLLECTION OF PERSONAL INFORMATION
As used in this notice, "personal information" means information that identifies, relates to, describes, or can be reasonably linked, directly or indirectly, to a specific person.
Information Collected from, or on behalf of, Your School
We collect the following types of personal information from, or on behalf of, your school:
Information Provided to Us by Schools
We provide YBK+ to schools pursuant to agreements with them to provide yearbook services. For schools in the United States, in our agreements, Jostens is designated as a "School Official" pursuant to the Family Educational Rights and Privacy Act of 1974, 20 U.S.C. § 1232g ("FERPA"). That designation allows schools to transfer certain information to us, and we agree to maintain such information in accordance with FERPA. For schools outside the United States, we enter into appropriate agreements to ensure for the legal transfer of personal information from schools to us.
The categories of information we receive from schools may include student names, student email addresses (school or personal), parent email addresses, yearbook photographs, class year, school name, and location (if the location appears in the name of the school). The type of information we receive will depend on what YBK+ features are available in your geographic location and the age of the student. For example, we do not collect email addresses of children under 13.
If you are part of your school’s yearbook staff, your school may provide us with your name and email address so that you can access YBK+’s yearbook staff platform.
Information You Provide
To access the "My Portrait," "My Year," or "School Life" features, you will need to verify your identity. If you are a high school student in the United States or Canada, you will be required to enter your email address, which we will use to send you a four-digit verification code to complete the verification process. For elementary and middle school students in the United States or for any student in a school outside of the United States, a parent or guardian will need to enter their email address, which we will use to send them a four-digit verification code to complete the verification process. Children under 13 are not permitted to use YBK+ or provide their own personal information to us.
When you upload pictures to "My Portrait," "My Year," or "School Life" from your device storage or camera feature, you will, as applicable, provide pictures of yourself, your student, and anyone else in the pictures. We use these pictures to create yearbooks and picture collections for you or your student and the school. All pictures that you upload may be made public. Do not upload any picture that contains offensive material, that may otherwise upset someone, or that you do not wish to be made public. If you submit a picture with a recognizable image of another student or individual, you are responsible for making sure that each individual in the picture has consented to the submission of the picture and that we can use the picture in accordance with this Privacy Policy. If you use the "Flag an Inappropriate Picture" feature, you will be asked to provide an email address and reason why you believe the picture is inappropriate. Your request will be sent to the subject school and/or school yearbook staff to process.
Please note that, depending on your geographic location, you may only have access to some of the YBK+ features.
Information Provided to Us by Other Third Parties
As part of the "My Year" or "School Life" features, users may upload pictures of other students or individuals, including you. We use these pictures to create user and school picture collections.

Information Collected as You Navigate YBK+
Most personal information we collect about you is collected directly from, or on behalf of, your school in our capacity as a service provider to your school (or, in the United States, a “School Official”). In such circumstances, we only collect, use and disclose your personal information as authorized by your school. However, we also automatically collect the following information as you navigate YBK+:
• Usage Information. Information such as which of the pages on YBK+ you access, the frequency of access, and what you click on while on YBK+.
• Device Information. Information about the device you are using, such as hardware model, operating system, application version number, and browser.
• Mobile Device Information. In addition to the Device Information listed above, when you access YBK+ via a browser on your mobile device, we collect and aggregate information about whether you are accessing YBK+ via a mobile device or tablet, device type, and carrier.
• Location Information. Location information from YBK+ visitors is collected on a city-regional basis.
Such information is not collected on behalf of your school, nor is such information shared with your school. We collect this information directly and use it to understand how YBK+ is being used and to maintain and improve it. For example, if we identify a distinct drop-off in usage from a particular area, that could be an indication of an issue with YBK+ that needs to be investigated.

3. HOW WE USE YOUR PERSONAL INFORMATION
In addition to the uses identified above, we may use the personal information to provide YBK+’s services, improve YBK+, provide support, defend our legal rights and the rights of others, efficiently maintain our business, and comply with applicable law.
YBK+’s "Explore" feature allows users to quickly access images stored on YBK+’s database by hovering a smartphone or tablet camera over certain images in the physical yearbook. If a match is identified, YBK+ will display any additional content linked to that particular image. This feature uses key point detection to match the image in your physical yearbook to the same image in YBK+’s database. Key point detection is a technique based on finding "key points" in the image. A key point is a pixel in the image where surrounding pixels change substantially in intensity (color). Key point detection takes the key points and compares them with key points in the images captured in the Explore experience to determine the matching image. Key point detection does not use facial detection or facial recognition technology.
YBK+ automatically reviews pictures for offensive or inappropriate content through a service provided by WebPurify. WebPurify uses AI technology to conduct the review. It does not use facial detection or facial recognition technology. Schools also may elect to have a manual review of pictures conducted by WebPurify’s staff.

4. HOW WE SHARE YOUR PERSONAL INFORMATION
In addition to the disclosures stated above, we may share the information that we collect in the following ways:
• With schools and school yearbook staff so that they can curate the pictures and screen them for offensiveness;
• With Amazon Web Services to store and process the pictures. Amazon Web Services’ privacy notice is available here;
• With WebPurify to conduct reviews of the pictures for offensiveness. WebPurify’s privacy policy is available here;
• To the extent that we are required to do so by law;
• In connection with any legal proceedings or prospective legal proceedings;
• To establish, exercise, or defend our legal rights, including providing information to others for the purposes of fraud prevention;
• To any other person or entity as part of any business or asset sale; and
• To any other person or entity where you consent to the disclosure.

5. COOKIES
How We Use Cookies
Like many other companies, we use cookies, which are small files of information that are stored by your web browser software on your computer hard drive, mobile or other devices (e.g., smartphones or tablets). We use cookies to estimate audience size and usage patterns and compile aggregate data about YBK+ traffic and interactions to resolve issues and offer better experiences and tools in the future. If you are accessing YBK+ from the EEA, you will be asked to consent to our use of cookies, other than strictly necessary cookies.
The only cookies YBK+ uses relate to Google Analytics, a web analytics service provided by Google, Inc. Google Analytics uses cookies or other tracking technologies to help us analyze how users interact with YBK+, compile reports on their activity, and provide other services related to their activity and usage. The technologies used by Google may collect information such as your IP address, time of visit, whether you are a returning visitor, and any referring website. The technologies used by Google Analytics do not gather information that personally identifies you. The information generated by Google Analytics will be transmitted to and stored by Google and will be subject to Google’s privacy policies. To learn more about Google’s partner services and to learn how to opt-out of tracking of analytics by Google, click here.
We also use local storage for authentication purposes once you log in to YBK+.
How You Can Opt-Out of Cookies
Browser Settings
Cookies can be blocked by changing your Internet browser settings to refuse all or some cookies.
You can find out more about cookies and how to manage them by visiting www.AboutCookies.org or www.allaboutcookies.org.
Advertising Industry Resources
You can understand which entities have currently enabled cookies for your browser or mobile device and how to opt-out of some of those cookies by accessing the Network Advertising Initiative’s website or the Digital Advertising Alliance’s website. For more information on mobile specific opt-out choices, visit the Network Advertising Initiative’s Mobile Choices website.
Please note that these opt-out mechanisms are specific to the device or browser on which they are exercised. Therefore, you will need to opt out on every browser and device that you use.

6. "DO NOT TRACK" SIGNALS
Some internet browsers incorporate a "Do Not Track" feature that signals to websites you visit that you do not want to have your online activity tracked. Given that there is not a uniform way that browsers communicate the "Do Not Track" signal, YBK+ does not currently interpret, respond to or alter its practices when it receives "Do Not Track" signals.

7. INTERNATIONAL DATA TRANSFERS
For YBK+ users located outside of the United States, we store your pictures in Canada. Those pictures may be accessed by Jostens in the United States to produce hardcopy yearbooks. If you are located outside of the United States, please be aware that information we collect, including personal information, may be transferred to, processed in, and stored in the United States. The data protection laws in the United States differ from those of the country in which you are located, and your personal information can be subject to access requests from governments, courts, or law enforcement in the United States according to the laws of the United States. By using YBK+ or providing us with any personal information, you explicitly consent to the transfer, processing, and storage of your personal information in the United States. For residents of the European Economic Area and United Kingdom, you further acknowledge that you have been informed of the possible risks of such transfers due to the absence of an adequacy decision by the European Commission with respect to transfers of personal information to the United States. You are also consenting to the application of United States federal and Minnesota state law in all matters concerning YBK+ and this Policy.
In certain circumstances, we may receive the personal information of residents of EEA through data controllers such as schools. For example, we may receive parent email addresses from schools in the EEA so that we can verify the parent’s identity before loading a picture into My Portrait. In those circumstances, we enter into appropriate agreements with schools.
For any transfers of personal information that we make to other entities as described in this Privacy Policy, we enter into appropriate agreements to ensure for the lawful processing and transfer of the information. To obtain a copy of the safeguards, or if you have any other question with respect to the transfer of your personal information outside your jurisdiction of residence, please contact us at privacy@jostens.com.

8. YOUR CHOICES AND RIGHTS
You may flag or report a picture by using the "Flag an Inappropriate Picture" feature in YBK+. Each school is responsible for reviewing these requests. If a picture is flagged by two or more individuals, it will not be displayed on YBK+ until it is reviewed and approved by the applicable school. You should contact the responsible individual at your school for more information.
Depending on the jurisdiction in which you are located, you may have additional rights with respect to your personal information. We discuss some of those jurisdictions and rights below. For example, you may have the rights to access, delete, update, or correct your personal information. You also may have the right to object to or opt out of direct marketing from us. If you would like to exercise your legal rights, please contact your school or email us at privacy@jostens.com. We will process your request in accordance with any applicable legal requirements.
If the processing of your personal information was based on your consent, you also may have the right to withdraw your consent, subject to legal or contractual restrictions and reasonable notice. However, without such consent, we may not be able to provide you with our products and services if the processing of your personal information is necessary for us to be able to provide them.
Notice to Nevada Residents
Nevada law allows Nevada residents to opt-out of the sale of certain types of personal information. Subject to several exceptions, Nevada law defines "sale" to mean the exchange of certain types of personal information for monetary consideration to a person for the person to license or sell the information to additional persons. We do not currently sell personal information as defined in the Nevada law. However, if you are a Nevada resident, you still may submit a verified request to opt-out of sales and we will record your instructions and incorporate them in the future if our policy changes. Opt-out requests may be sent to privacy@jostens.com.
Notice to California Residents
We do not disclose personal information obtained through YBK+ to third parties for their direct marketing purposes. Accordingly, we have no obligations under California Civil Code § 1798.83.
If you are a California resident under the age of 18 and a registered user of YBK+, California Business & Professions Code § 22581 permits you to request and obtain removal of content or information posted on YBK+ by you. If you wish to make a request, please contact us at privacy@jostens.com. Please be aware that removal does not ensure complete or comprehensive removal of the content or information posted on YBK+ by you and there may be legal reasons for denying your request.
The California Consumer Privacy Act (CCPA), California Civil Code § 1798.100, et seq., provides California residents with certain rights regarding their personal information. These are the right to request that a business disclose what personal information it collects, uses, discloses and sells; the right to request deletion of personal information; the right to opt out of the sale of personal information by a business; and the right to not have a business discriminate against you for exercising these rights.
Jostens offers YBK+ exclusively to schools. When doing so, Jostens acts as a "service provider" under the CCPA and our collection of any personal information is completed on behalf of those schools. You should consult with the applicable school to determine whether it qualifies as "business" under the CCPA. Any request to access or delete your personal information under the CCPA, if applicable, should be directed to the school with whom you have a relationship. Jostens does not sell the personal information collected by YBK+.
Notice to Residents of the European Economic Area and United Kingdom
If you are in a country in the European Economic Area (EEA) or in the United Kingdom, you are entitled to the following explanation of the legal bases we rely on to process your personal information and a description of your privacy rights.
Legal Basis for Processing Your Personal Information
The legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it:
Consent
We may process your personal information based on your consent such as when you upload photographs. You have the right to withdraw your consent at any time without affecting the lawfulness of the processing based on consent before its withdrawal.
Our Legitimate Interests
We may process your personal information if doing so is necessary for our legitimate interests and your rights as an individual do not override those legitimate interests. For example, when we process your personal information to verify your identity, increase network and information security, expand our business activities and improve YBK+.
To Perform a Contract
We may process your personal information to administer and fulfill contractual obligations to you or your school.
To Enable Us to Comply with a Legal Obligation
We may process your personal information to comply with legal obligations to which we are subject. This may include any requirement to produce audited accounts and to comply with legal process.
Necessary for the Exercise or Defense of Legal Claims
If you bring a claim against us or we bring a claim against you, we may process your personal information in relation to that claim.
If you have any questions about or need further information concerning the legal basis on which we collect and use your personal information for any specific processing activity, please contact us using the "How to Contact Us" section below.
Your Rights
Access Your Personal Information
You have the right to obtain from us confirmation as to whether or not we are processing personal information about you and, if so, the right to be provided with the information contained in this Privacy Policy. You also have the right to receive a copy of the personal information undergoing processing.
Rectify Your Personal Information
You have the right to ask us to rectify any inaccurate personal information about you and to have incomplete personal information completed.
Restrict Our Use of Your Personal Information
You have the right to ask us to place a restriction on our use of your personal information if one of the following applies to you:
• You contest the accuracy of the information that we hold about you, while we verify its accuracy;
• We have used your information unlawfully, but you request us to restrict its use instead of erasing it;
• We no longer need the information for the purpose for which we collected it, but you need it to deal with a legal claim; or
• You have objected to us using your information, while we check whether our legitimate grounds override your right to object.
Object to Our Use of Your Personal Information
You have the right to object to our use of your personal information where our reason for using it is based on our legitimate interests or your consent (rather than when the reason for using it is to perform an obligation due to you under a contract with us).
Delete Your Personal Information
You can ask us to delete your personal information if:
• We no longer need it for the purposes for which we collected it;
• We have been using it with no valid legal basis;
• We are obligated to erase it to comply with a legal obligation to which we are subject;
• We need your consent to use the information and you withdraw consent;
• You object to us processing your personal information where our legal basis for doing so is our legitimate interests and there are no overriding legitimate grounds for the processing.
However, this right is not absolute. Even if you make a request for deletion, we may need to retain certain information for legal or administrative purposes, such as record keeping, maintenance of opt-out requirements, defending or making legal claims, or detecting fraudulent activities. We will retain information in accordance with the "Retention of Your Personal Information " section below.
If you do exercise a valid right to have your personal information deleted, please keep in mind that deletion by third parties to whom the information has been provided might not be immediate and that the deleted information may persist in backup copies for a reasonable period (but will not be available to others).
Transfer Your Personal Information to Another Service Provider
You may request that we transfer some of the personal information you have provided to you or another service provider in electronic copy. This applies to personal information we are processing to service a contract with you and to personal information we are processing based on your consent.
To exercise any of these rights, please contact us as described in the "How to Contact Us" section below.
Make a Complaint
If you have any concerns or complaints regarding our processing of your personal information, please contact us as described in the "How to Contact Us" section below and we will do our best to answer any question and resolve any complaint to your satisfaction.
If, for whatever reason, you feel we do not meet the standards you expect of us, you are also entitled to make a complaint to your local supervisory authority:
EU Data Protection Authorities (DPAs)
Swiss Federal Data Protection and Information Commissioner (FDPIC)
Information Commissioner’s Office (United Kingdom)
Notice to Canadian Residents
Access Your Personal Information
You have the right to obtain from us confirmation as to whether or not we are collecting, using or disclosing personal information about you. You also have the right to receive a copy of the personal information undergoing processing.
Update Your Personal Information
You have the right to ask us to update any inaccurate personal information about you and to have incomplete personal information completed.
Withdrawing Consent
Subject to certain circumstances, you generally have the right to withdraw your consent to our collection, use and/or disclosure of your personal information. [NTD: Lets discuss how Jostens will operationalize this.]
To exercise any of these rights, please contact us as described in the "How to Contact Us" section below.

9. Retention of Your Personal Information
We will retain your personal information for as long as necessary to fulfill the purposes for which we collect it and as set out in this Privacy Policy and for the purpose of satisfying any legal, accounting, or reporting requirements that apply to us.

10. SECURITY
We maintain commercially reasonable security measures to protect the personal information we collect and store from loss, misuse, destruction, or unauthorized access. However, no security measure or modality of data transmission over the Internet is 100% secure. Although we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security. Further, as noted, all pictures that you upload may be made public.

11. CHILDREN'S PRIVACY
YBK+ is not intended for children under 13 years of age. We do not knowingly collect, use, or disclose personal information from children under 13. YBK+ is intended for use by parents or guardians of children under 13. As per our Terms of Use, children under 13 are not permitted to use YBK+ or provide their own personal information to us.

12. ACCESSIBILITY
We are committed to ensuring YBK+, including this Privacy Policy, is accessible to individuals with disabilities. Select the accessibility button in the bottom right corner of any page of YBK+ to open the accessibility interface, powered by accessiBe. Alternatively, please contact us as described below if you wish to access this Privacy Policy in an alternative format.

13. HOW TO CONTACT US
To contact us for questions or concerns about our privacy policies or practices please email us at privacy@jostens.com or write to our Privacy Officer at Jostens, Inc., 7760 France Avenue South, Suite 400, Minneapolis, MN 55435.