PRIVACY NOTICE

Effective Date: July 1, 2021

Version 3.0

This Privacy Notice describes our handling of Personal Information in connection with your activities in our locations or your use of our websites, mobile applications, or the services we provide.  By visiting our locations, websites, or mobile applications or using our services, you hereby consent to these terms.  

“Personal Information” refers to information that identifies you or that can be reasonably linked to you as an individual. We encourage you to read this Privacy Notice which describes how we collect, use, share, and protect your Personal Information, and the choices you have regarding your Personal Information. 

1.  Personal Information Collected and How We Collect It

Types of Personal Information that we may collect:

• Name and contact information such as postal address, email address, and phone number
• Digital information, including your device IDs, browsing history, referring URL, browser, operating system, and other activity on our websites or mobile apps (such as your activity on our site, including text entered and mouse movements)
• Your transaction information, including purchases of products and services
• Payment card number and other payment information
• Your Account Number or Loyalty Program ID

In certain situations, we may also collect things like:

• Driver's license number (for example, if you return a product)
• Location information (such as when you ask us to tell you about nearby stores or use our digital properties)
• Demographic and preference information (to help find products or services that may be of interest to you)
• Survey responses, chat sessions, and feedback (regarding products/services purchased, customer service interactions, and your customer experience)
• Advertising interactions (such as cookie IDs, device advertising IDs, which ad was served, and the URLs where the ads are served when you interact with our emails or online/mobile ads)
• Voice and CCTV recordings (for example, for quality assurance when contacting our call centers, or when visiting locations that use security cameras)
• School affiliation (based on program participation)
• Photos or graphic images and files (if you receive product deliveries or request certain services from us)
• Employer name and business contact information (if your company has a business relationship with us)
• Your postal mail (if you participate in that program with us)

We receive Personal Information from the following:

• Information You Provide Us Directly.  We collect Personal Information from you directly, for example, in connection with a purchase (in-person or via our websites or mobile apps), a service, a promotion/event, a customer service request, a survey, or an application for a membership program. When using our mobile apps, we may also ask you to grant us access to the camera, photo library, or microphone on your mobile device to enable certain features such as scanning bar codes and speech-enabled search.
• Information Collected Through Automated Technologies.  We and our third party service providers may use cookies, tags, web beacons and other technologies on our web properties and mobile applications to track and collect some Personal Information made available through your activity on our sites/apps, such as shopping/search activity and other interactions with our online services. We also use cookies to enable core site functionality, to analyze website usage so that we can measure and improve services and performance, and to serve ads that are relevant to your interests.  Cookies “remember” your device/browser when you return to a website and make your experience more user-friendly and allow us to better understand how our websites are used to improve the experience.

If you use a mobile device, your device may share location information (when you enable location services) with our websites, mobile applications, services, or our service providers. For example, precise geo-location can be used to help you find our nearby locations.

• Information We Receive from Other Parties.  We may obtain information about you from other sources for purposes such as prospecting, marketing, fraud detection, and/or enhancing the information you have provided, such as validating address formats.

Our sites and mobile applications may allow you to sign-in to our digital property using a social media network login and we may also include other social media features, such as a “share this” button. In these cases, we may receive information from the social media network, including your profile information, picture, user ID associated with your social media account, and other information you permit the social media network to share with third parties. The data we receive from these social media networks is dependent upon their policies and your privacy settings on that third party site. You should always review and, if necessary, adjust your privacy settings on these websites and services before utilizing these features.

Minors

Our programs, websites and mobile applications are not directed toward minors under 16 years of age.  We do not knowingly collect, share, or sell the Personal Information of minors.

2.  How We Use Personal Information

Personal Information may be used for the following purposes:

• To Provide and Improve our Products and Services.  We use Personal Information to process your orders, purchases, refunds/exchanges, and requests for products, services, or information.  We may also use your Personal Information to create and maintain your accounts, to enable order shipment tracking notifications, to provide customer service, to administer our credit card programs, to personalize your shopping experience, to identify your preferences, to provide you services across multiple devices, to improve the functioning and performance of our digital properties, to enable certain mobile app functionality (such as using your location to help you find our nearby locations), and to expand our product/service offerings.
• Marketing and Advertising.  We use Personal Information to communicate and/or administer promotions, contests, sweepstakes, surveys, and rewards programs and to make you aware of our products and services. We may use your Personal Information to better predict your product/service preferences or interests. We may also use your activity on websites/applications to serve you personalized advertising in order to show you content that is more likely to be of interest to you. (See section 4 below for additional information regarding our Marketing activities.)
• Other Uses.  We use Personal Information for other reasons, including conducting sales research and analysis; preventing or mitigating fraud and credit risk; and complying with legal matters, investigations, and applicable laws and regulations.

3.  How We Share Personal Information

We may share your Personal Information within our family of companies for purposes such as preference management, marketing, customer service functions, and improved user experiences.

We may also share your Personal Information outside our family of companies (for example, with third parties such as service providers, data processors, contractors, etc.) for various purposes such as:

• Providing the Products or Services you Requested: To process transactions or provide products or services on our behalf. Examples include fulfilling orders for products or services, delivering packages, sending communications, analyzing data, processing payments, transmitting content, managing credit risk, and providing customer service. We may also share your Personal Information with our business partners when you take part in certain programs.
• Marketing Purposes: To assess, develop, administer, and notify you of promotions and offers for products or services that may be of interest to you.
• Corporate Transactions: In connection with a merger, acquisition or sale involving all or a portion of our company. 
• Other Reasons: Such as to satisfy applicable law, regulations, legal processes, or valid governmental requests; enhance data and digital properties; enforce the terms of use applicable to our services; detect, prevent, or mitigate fraud, security, or technical issues; and protect against imminent harm to the rights, property or safety of our company, our customers or the public as required or permitted by law.
• With Your Consent: In circumstances other than those described above.

4.  How We Use Personal Information for Marketing

a. Digital Marketing

Interest Based Advertising

We participate in interest-based advertising, (sometimes called IBA or online behavioral advertising) to present you with online ads for our products and services that we believe may be of interest to you. We may partner with third party advertising companies to infer your preferences or interests and to show you ads tailored to your individual interests. As a result, you may see our ads on other websites based on your prior web browsing activities (for instance, an ad from us may be displayed to you on another website if you recently browsed for office supplies).

We sometimes allow third party companies to collect certain information when you visit our websites or use our mobile applications. This information is used to serve ads for products or services. These companies use this information (such as click stream information, browser type, time and date, subject of advertisements clicked or scrolled over, hardware/software information, cookie and session ID, static IP address) during your visits to many websites in order to provide advertisements about goods and services likely to be of greater interest to you.

We may also utilize third party services that allow us to associate your activity on our site with your activity on other sites in order to provide advertising to you on other websites and online platforms.

We may associate the various devices you utilize (such as, smartphones, tablets, and desktop computers where you may be logged into our online properties) while interacting with us on our websites and mobile apps, and combine that information with other information we have, such as your interaction with our locations and services. We use this data to provide you with more relevant ads and to provide you with a consistent online and mobile shopping experience across devices.

Cross-Context Behavioral Advertising

Our advertising may be based on your activity or search behavior obtained from other businesses, websites, applications, or services. We may merge this with data collected from our own websites and mobile apps.

Contextual and Look Alike Advertising

Contextual advertising is a form of advertising used to show relevant digital content.  Because these ads are based on the site visited, not your behavior on that site, you will still see “contextual” ads even if you opt out of interest-based ads. For example, you still may see an ad for one of our ink & toner brands while looking at paper products online on another site because it has been inferred that users of that site may be small business owners.

Unlike interest-based ads which are based on your specific-activity, these ads are presented to anyone visiting a particular site.  We analyze data to help us learn about general trends, habits, or characteristics from a group of consumers who all act similarly online and/or offline. By doing this, we can find and serve many others who “look like” those already in the group and thereby present what we believe will be relevant and beneficial product offers and information.

Social Media Advertising

Some of our sites use Facebook’s Advanced Matching feature which is a service they offer to advertisers. Through this service, we may securely send information to Facebook (e.g., email address) to identify a matched user on their platform.  This allows us to show our ads to customers that are also Facebook users.  Once a customer engages with an ad (i.e., clicks), the sites then use digital technologies, like cookies, to follow a customer’s journey from Facebook, through the ad, and then to activity on our site.  This strategy is used so that we can better target and measure the effectiveness of our advertising on Facebook’s platform.

We may also display ads to you through other social media platforms. These ads are sent to groups of people who share similar traits or interests. For example, we may advertise to certain social media users who have expressed an interest in shopping for office supplies, office furniture, cleaning supplies, etc. See the privacy policies of each social media platform for additional information about these types of ads.

b. Email Marketing

We may use your email address to deliver marketing information, product recommendations, and non-transactional communications about us via email.

c. Direct Mail Marketing

We may use your mailing address to deliver notices of new services/partnerships, offers/coupons, printed catalogs, etc. about us or our products or services via direct mail.

d. Text-Based Marketing (SMS)

We may send you promotional text messages (SMS) only when you affirmatively opt-in to receiving them.

5.  Your Choices Regarding Your Personal Information

a.  To Stop Certain Collection and Use of Your Personal Information:

Marketing Emails, Texts, and Mail

• You can stop promotional emails from us by using the “unsubscribe” link on our promotional emails.
• You can stop marketing text messages, by replying “STOP” to our promotional text messages.
• You can stop promotional postal mail by contacting us with your request as noted in the How to Contact Us  section below.

Please note that if you opt out of receiving promotional communications from us, we may still send you transactional communications, including emails about your online account, Rewards account, membership program, or purchases. If you have any questions regarding transactional communications, please Contact Us.

If you are receiving any other communications, have any questions, or continue to receive communications after opting out, please Contact Us.  Please include any relevant information such as a forwarding of the email received, specification of the order number in question, screenshot of the online message, scan of the mailed marketing artifact, etc.  Please note that you may continue to receive communications while we process your request.

If you have any questions regarding the above, please contact us at Privacy@Staples.com

Interest Based Advertising

Industry groups such as the Digital Advertising Alliance and the Network Advertising Initiative have developed services to help you manage your Interest Based Advertising preferences. Please note that if you opt-out of Interest-Based Advertising, you may still see ads from us, but they will not be as relevant to you.

If your browsers are configured to reject cookies when you visit these pages, or if you subsequently erase your cookies, use a different device, or change web browsers, your opt-out may become ineffective and may need to be repeated.

You may visit the following sites to become more familiar with these entities and their unsubscribe options:

• The Digital Advertising Alliance (DAA): https://digitaladvertisingalliance.org/
• The Network Advertising Initiative (NAI): https://optout.networkadvertising.org/?c=1
• The Interactive Advertising Bureau (IAB): https://www.iab.com/

Website Analytics

We use Google Analytics on our web sites to collect usage data, to analyze how users use the web sites and to provide advertisements to you on other websites. For more information about how to opt out of having your information used by Google Analytics, visit https://tools.google.com/dlpage/gaoptout/.

Mobile Apps

If you have granted our mobile apps access to your device’s camera, microphone, location, etc., you may revoke such access by configuring the permissions located in your device’s “Settings”.

With your consent, we may send promotional and non-promotional push notifications or alerts to your mobile device.  You can deactivate these messages at any time by changing the notification settings on your mobile device.

Cookies

If you want to prevent your browser from accepting cookies, if you want to be informed whenever a cookie is stored on your computer or if you want to delete cookies from your computer, please make the necessary changes in your Internet browser settings, typically under the sections “Help” or “Internet Options”. See links below:

• Internet Explorer : https://windows.microsoft.com/en-gb/internet-explorer/delete-manage-cookies#ie=ie-9
• FireFox : https://support.mozilla.org/en-US/kb/delete-cookies-remove-info-websites-stored
• Chrome : https://support.google.com/chrome/answer/95647
• Safari : https://www.apple.com/legal/privacy/en-ww/cookies/

Please note that if you clear all cookies on your browser, or use a different browser or computer, you will need to complete the opt-out procedure again.

To opt out from flash cookies, please go to: //www.adobe.com/privacy/opt-out.html.

Cookies are pieces of information that are transferred from websites to your computer’s hard drive, and they may serve a variety of purposes. Web beacons, flash cookies and other similar technologies may also be used for these purposes. For example, cookies “remember” your device/browser when you return to a website and make your experience more user-friendly. Cookies are also used to allow companies to better understand how their websites are used to improve their services.

The below chart outlines different types of cookies, how they are used, and the potential impact if the cookies are disabled:

Cookie Type	Purpose	Potential impact if disabled
Session Cookies	Used to support website functionality	Access to website content and features may be limited
Preference Cookies	Used to remember user preferences from one visit to the next	Preference will need to be reset on each visit to the website.  This may also disable the ability have websites “remember” you at time of login
Advertising Cookies	Used to serve you advertisements that may be relevant to you and your interests	Advertisements will still be displayed but will be more random and may be less relevant to you and your interests
Security Cookies	Used as a component of a website’s general security and user authentication processes	Access to website and features may be limited

Some of our web properties provide a cookie consent manager to help you control your cookie preferences. 

Do Not Track

Some browsers have a “Do Not Track” feature that lets you send a request to websites to not track your online activities.  Like many other companies, our web properties do not process those requests.  

b. To Change or Correct Your Personal Information

You can request that inaccuracies pertaining to your Personal Information be corrected.

You may contact us with changes as described in the How to Contact Us section.  To prevent unauthorized changes, we may ask for certain information to verify your identity before we process such requests.

We may not fulfill your request in some cases, for example, if it requires a disproportionate technical or practical cost or effort or if it conflicts with our legal obligations or business requirements.

6.  How We Protect Your Personal Information

We employ technical, physical, administrative, and organizational safeguards to help protect your Personal Information.

Our websites may contain links to other websites, services, social media platforms, etc. operated and maintained by third parties. We may also provide social media features that enable you to share information with social networks and to interact with us on various social media sites. Your use of these features may result in the third party collection or sharing of information about you, depending on the feature. These properties, which we do not control, operate independently, and have their own privacy and security practices and statements, which we encourage you to review to make sure you understand the information that may be collected, used, and shared by those sites and how it is protected.

Unfortunately, no e-commerce solution, website, mobile application, database, or system can be guaranteed to be 100% secure. As a result, while we strive to protect your Personal Information, we cannot guarantee or warrant the security of the information you transmit to or from us. You should also take steps to protect your personal information against unauthorized disclosure or misuse:

• We urge you to keep your passwords secure and confidential and not divulge them to anyone, use different and complex passwords for each account and consider using a commercially available Password Locker or Vault to generate and store your passwords.

• Remember to log off your account and close your browser window when you have finished your visit. This is to help ensure that others do not access your account, especially if you are sharing a computer with someone else or are using a computer in a public place.
• Other public online safety resources:

• https://staysafeonline.org/stay-safe-online/online-safety-basics/online-shopping/ (National Cyber Security Alliance)
• https://www.consumer.ftc.gov/topics/privacy-identity-online-security (FTC)
• https://www.aarp.org/technology/how-to-guides/info-04-2011/online-shopping-safety.html (AARP)
• https://www.bbb.org/article/tips/14040-bbb-tip-smart-shopping-online (Better Business Bureau)

If you think the Personal Information you provided to us has been improperly accessed or used, or if you suspect that unauthorized purchases have been made on our websites using your Personal Information, please Contact Us immediately.

7.  Customer Specific Disclosures

a. Contract or Business Customers

If you are a contract customer and would like to opt-out of receiving promotional postal mail and/or email from us, please notify your Account Manager. You may still receive promotional postal mail or email from other affiliated companies and third parties if they have received your email or postal address from other sources or as a result of their own transactions or experiences with you.

If you are a business entity receiving unsolicited communications, please Contact Us.

b. Nevada Residents

Under Nevada SB 220, Nevada residents may submit an opt-out request regarding the sale of their Personally Identifiable Information (PII) collected through a website or online service.  You may submit your request to Opt-Out of the sale of Personal Information to third parties by submitting an online request at: Do Not Sell My Personal Information

c. California Residents

1. California Consumer Privacy Act of 2018

The following section describes:

1. Categories of Personal Information We Collect
2. Examples of Specific Personal Information that may be Collected
3. Categories of Sources from which Personal Information is Collected
4. Purpose of Collecting the Personal Information
5. Categories of Other Parties to whom Personal Information may be Disclosed
6. Categories of Third Parties to whom Personal Information is Sold and the Purpose of Sale

Not all categories or examples of specific Personal Information may be collected about you depending on how you interact with us.

Categories of Personal Information We Collect	Examples of Specific Personal Information that may be Collected	Categories of Sources from which Personal Information is Collected	Purpose of Collecting Personal Information	Categories of Other Parties to whom Personal Information may be Disclosed	Categories of Third Parties to whom Personal Information is Sold and the Purpose of Sale
Identifiers	Names, Account/Loyalty Program IDs, Emails, Addresses, Phone Numbers, IP Addresses, Other Device Identifiers, Tax Exempt Numbers, Driver’s License	From You, Your Devices (when you visit our sites or use our apps), Service Providers (e.g., data brokers, fraud prevention companies), Business Partners, Social Networks	To identify you in support of business activities such as fulfilling a transaction, communicating with you (order notification, etc.), personalizing your experience, fraud prevention	Advertising Networks and Service Providers/Business Partners such as cloud service providers, payment processing companies, fraud prevention companies, delivery companies, and product manufacturers	Advertising Networks for the purpose of Marketing and improving their products and services
Commercial Information	Products or Services Purchased, Price or Service Quotations, Credit Card or other Financial Information, Chat Sessions, Feedback/Survey Responses, Copy/Print Materials	From You (when you transact with us or participate in any of our programs)	To support a business transaction, communicating with you (surveys about your purchase, customer service, order notification, etc.), improve our products and services	Advertising Networks and Service Providers/Business Partners such as cloud service providers, fraud prevention companies, payment processing companies, delivery companies, and product manufacturers	Advertising Networks for the purpose of Marketing and improving their products and services (We do not sell credit card or other financial information.)
Biometrics	N/A	N/A	N/A	N/A	N/A
Characteristics of Protected Classifications	Demographic information such as age ranges, marital status, etc.	From You and Service Providers (e.g., data brokers, survey vendors, fraud prevention companies)	To protect against fraud, enable you to apply for a company credit card, demographically understand our customers to improve our products and services	Advertising Networks and Service Providers/Business Partners such as cloud service providers and marketing/sales analytics companies	N/A
Internet or Other Electronic Network Activity	Browsing activity, searches, and other interactions on our websites or mobile apps, your interactions with our ads	From You, Your Devices (when you access our websites or mobile apps) and fraud prevention companies	To send marketing to you, improve our products and services, fraud prevention, etc.	Advertising Networks and Service Providers/Business Partners such as cloud service providers, fraud prevention companies, and eCommerce analytics companies	Advertising Networks for the purpose of Marketing and improving their products and services
Geolocation Data	Location based on IP address or mobile device location information	From You, Your Devices (when you access our websites or mobile apps), Service Providers (e.g., data analytics providers, fraud prevention companies)	To personalize your experience, display store locations near you, fulfill your orders, analyze web/app traffic, fraud prevention	Advertising Networks and Service Providers/Business Partners such as cloud service providers and eCommerce functionality vendors	N/A
Recordings (e.g., audio, visual)	Voice and CCTV Recordings	From You (when you call customer service or visit one of our locations), Service Providers (e.g., call record software providers)	For quality and training purposes when you call customer service, improve our products and services, fraud prevention	Service Providers/Business Partners such as cloud service providers and customer service call recording companies	N/A
Professional or Employment-Related Information	Employer Name and Job Title	From You (e.g., when you inquire about our programs), Service Providers (e.g., data brokers), Business Partners	To send you marketing, personalize your experience, enroll you in certain programs at your request	Advertising Networks and Service Providers/Business Partners such as cloud service providers and program administrators	N/A
Education Information	School Affiliations	From You (when you participate in certain programs such as Classroom Rewards)	To administer certain programs	Advertising Networks and Service Providers/Business Partners such as cloud service providers and program administrators	N/A
Inferences	Product and Service Preferences	From You (when you tell us what products and service are of interest), by analyzing other data we have about you, Service Providers (e.g., advertising networks, fraud prevention companies), Social Networks	To provide you personalized experiences and marketing, group you into segments with other similar customers, improve our products and services	Advertising Networks and Service Providers/Business Partners such as cloud service providers and marketing/ eCommerce analytics companies	N/A

The above categories are intended to encompass the Personal Information described in subdivision (e) of Section 1798.80 of the CCPA.

California residents have the following rights:

1. The Right to Opt-Out of the Sale of Personal Information to Third Parties
2. The Right to Disclosure of Personal Information Collected, Used, Disclosed, and Sold
3. The Right to Deletion of Personal Information
4. The Right to not be Discriminated Against Based on Exercising any of the Above Rights

California residents may submit your request to Opt-Out of the Sale of your Personal Information to third parties by:

1. Submitting an online request here: Do Not Sell My Personal Information
2. Clicking the “Do Not Sell My Personal Information” button on our website

California residents may submit a Data Disclosure request by:

1. Submitting an online request here: Data Disclosure Request
2. Submitting a phone request by calling 1-800-333-0333

California residents may submit a Data Deletion request by:

1. Submitting an online request here: Data Deletion Request
2. Submitting a phone request by calling 1-800-333-0333

We will take reasonable steps to verify your identity prior to fulfilling the above requests. For purposes of verifying your identity, we will request that you provide personal information we already have on file including your first and last name, email address, and phone number. We may also request mailing address and, if applicable, your account number, login ID for our websites, and rewards/loyalty number to ensure that we have a verified match.

Authorized Agents may submit requests on behalf of a California resident using the above processes and ensuring the appropriate verification and documentation can be provided.

The following section describes consumer rights submission metrics for requests we received from January 1, 2020 through December 31, 2020 for Company business units (not limited to California residents):

Disclosure Requests	Number of Requests Received	18
	Number of Requests Denied	1
	(Jan – June) Number of Days to Resolve Requests (Median)	80
	(July – Dec) Number of Days to Resolve Requests (Median)	40
Deletion Requests	Number of Requests Received	82
	Number of Requests Denied	0
	(Jan - June) Number of Days to Resolve Requests (Median)	188
	(July – Dec) Number of Days to Resolve Requests (Median)	44
Do Not Sell My Personal Information Requests	Number of Requests Received	3623
	Number of Requests Denied	1
	Number of Days to Resolve Requests (Median)	5

Minors:

Our programs, websites and mobile applications are not directed toward minors under 16 years of age.  We do not knowingly collect, share, or sell the Personal Information of minors.

Notice of Financial Incentive:

We may provide price discounts, coupons, services, and other perks for members of our loyalty programs. Through these offerings, you may provide us with Personal Information depending on how you choose to interact with us when and after you opt-in to our programs. There is no obligation to opt-in, and you may opt-out at any time. The details of the programs are contained in the program offerings. We offer these programs, among other things, to enhance our relationship with you so you can enjoy more of our products/services at a lower price. While we invest in our marketing and brands, consumer data is more valuable to our business when it is combined with a sufficient amount of other consumer data and after it is enhanced by our efforts described in this Privacy Notice. The value to our business of any individual consumer’s data is dependent on several factors, including, for example, whether and to what extent you take advantage or opt out of any offerings and whether we are able to enhance the data through our efforts described in this Privacy Notice. While we do not calculate the value of consumer data in our accounting statements, we provide this good faith summary for California residents. To the extent we create overall business value from our programs that could be directly or reasonably related to the value of consumer data, the method for calculating the value would include: a) costs related to maintaining the program including but not limited to IT infrastructure, delivery of offers, and marketing activities to enhance consumer data; b) whether the sales generated by the program exceeds the cost to us of offering the program including value of discounts to consumer; and c) value of the insights we are able to create based upon aggregate data.

Non-Discrimination:

We will not discriminate against you for exercising any of your CCPA Rights and we will not deny you goods or services, charge you a different price, or provide you with a lesser quality of goods or services if you exercise any of your CCPA Rights.

As an additional resource, you may also contact us at ConsumerRightsRequest@Staples.com for any additional questions related to the rights granted under the California Consumer Privacy Act (CCPA).

If you are a data controller with a consumer rights request for us, please contact us at ConsumerRightsRequest@Staples.com

2. California Shine the Light Law

Under California Civil Code sections 1798.83–1798.84, California residents may request a notice disclosing the categories of personal information we have shared with third parties, for the third parties’ direct marketing purposes, during the preceding calendar year. If you are a California resident and would like to make such a request, please Contact Us. Please allow 30 days for a response.

d. Canadian Residents

We consider "personal information" to be information about an identifiable individual. We do not consider public information found in directories and listings, or business names, addresses and/or contact numbers to be personal information. 
As applicable to Canadian residents, we recognize the 10 personal information privacy principles stated in the Canadian Standards Association (CSA Group) Model Code for the Protection of Personal Information. The 10 principles are:

1. Accountability
2. Reason for Collection
3. Consent
4. Limiting Collection
5. Limiting User, Disclosure and Retention
6. Accuracy
7. Safeguards
8. Openness
9. Individual Access
10. Challenging Compliance

Interest-Based Advertising:

Some of our websites support Interest Based Advertising efforts by third parties. In Canada industry groups such as the Digital Advertising Alliance of Canada have developed services to help you manage your Interest Based Advertising preferences.  

Please review the privacy policies on our Canadian sites for more comprehensive information.

e. European Union (EU) and United Kingdom (UK) Residents

Our companies are based in the United States (U.S.) and the information we collect is governed by U.S. law. If you are accessing the services from outside of the U.S., please be aware that information collected through the services may be transferred to, processed, stored, and used in the U.S. Data protection laws in the U.S. may be different from those of your country of residence. Your use of the services or provision of any information therefore constitutes your consent to the transfer to and from, processing, usage, sharing, and storage of your information, including Personal Information, in the U.S. as set forth in this Privacy Notice. 

As residents of the EU or UK, you will have certain additional rights with respect to your Personal Data under the General Data Protection Regulation including:

1. The right to be informed.
2. The right of access.
3. The right to rectification.
4. The right to erasure.
5. The right to restrict processing.
6. The right to data portability.
7. The right to object.
8. The right to restrict automated decision making and profiling.

To exercise any of these rights, please Contact Us per the section below.  We will respond to your request within 30 days of receipt. We must verify your identity in order to honor your request.

Lawful Bases of Processing – Where we are acting as a data controller that determines the purposes and means of processing your personal data, such as when we collect, use, and share personal data as described in the sections above, we must have a lawful basis for processing for doing so. Our lawful bases for processing personal data include:

• To conclude or perform a contract with you, for example to:
  • process your purchases of or requests for products and services, including delivering gift cards in accordance with your instructions;
  • communicate with you about orders, purchases, returns, services, accounts, programs, contests, and sweepstakes.
• For our legitimate business purposes, including to:
  • respond to your customer service inquiries and requests for information;
  • maintain, improve, and analyze our websites, mobile applications, ads, and the products and services we offer;
  • detect, prevent, or investigate security breaches or fraud; and
  • facilitate the functionality of our websites and mobile applications.
• To comply with our legal obligations, for example to maintain appropriate records for internal administrative purposes and as required by applicable law, and provide important product safety information and notice of product recalls; and
• On the basis of your consent, for example to send you via email and other electronic means personalized promotions and special offers or informing you about our brands, products, events, or other promotional purposes.

Interest-Based Advertising:

Some of our websites support Interest-Based Advertising efforts by third parties. In Europe industry groups such as the European Interactive Digital Advertising Alliance have developed services to help you manage your Interest Based Advertising preferences.  

We will retain your EU/UK Personal Information for as long as your account is active, as needed to provide you services and to fulfill the purposes for which the data was collected, and as necessary to comply with our legal obligations and fulfill our business needs.

Complaints – If you have any issues with our compliance, EU residents have the right to lodge a complaint with an EEA supervisory authority (https://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm) and UK residents may lodge a complaint with the Information Commissioner’s Office (https://ico.org.uk/make-a-complaint/). We would, however, appreciate the opportunity to first address your concerns and would welcome you directing an inquiry first to us per the Contact Us section 8 below.

8.  How to Contact Us

This Privacy Notice applies to Staples, Inc., and its affiliated companies. 

Please direct any questions, complaints or concerns regarding this Privacy Notice and our treatment of your Personal Information to any of the following:

Primary contact by email:                   privacy@staples.com

Alternate contact by phone:                (+1) 800-333-3330 (US only)

or by writing to:                       

Staples

Privacy and Compliance

500 Staples Drive

Framingham, MA 01702 US

Upon receiving a written request, we will contact you directly, investigate your request, and work to address your concerns. We reserve the right to take reasonable steps to verify your identity prior to granting access or processing changes or corrections.

9.  Privacy Notice Updates 

This Privacy Statement may change from time to time, and we will post on our websites any updated Privacy Notice.  Recent changes to the Privacy Notice are documented below.  Each version of this Privacy Notice will be identified by its effective date displayed at the top of this Privacy Notice. 

What has changed:

V3.0	July 1, 2021	Added 2020 CCPA metrics Updated general information
V2.0	January 01, 2020	Added California Consumer Privacy Act (CCPA) rights. Expanded Canadian Residents section with information provided previously in a separate document. Changed the title of this document from Privacy Policy to a Privacy Notice, reflecting trend to use the word “Notice” when referring to public notifications while using the term “Policy” for internal communications. Updated the Nevada resident opt-out instructions
V1.1	October 1, 2019	Addition of language addressing the Nevada Data Privacy Law
V1.0	May 25, 2018	Reorganization and Standardization of Privacy Policy and Introduction of the Privacy Resource Center
V0.1	March 23, 2017	Removed references to the US-EU and US-Swiss Safe Harbor programs which have or will be discontinued.

California Consumer Privacy Act of 2018

The following section describes:

1. Categories of Personal Information We Collect
2. Examples of Specific Personal Information that may be Collected
3. Categories of Sources from which Personal Information is Collected
4. Purpose of Collecting the Personal Information
5. Categories of Other Parties to whom Personal Information may be Disclosed
6. Categories of Third Parties to whom Personal Information is Sold and the Purpose of Sale

Not all categories or examples of specific Personal Information may be collected about you depending on how you interact with us.

Categories of Personal Information We Collect	Examples of Specific Personal Information that may be Collected	Categories of Sources from which Personal Information is Collected	Purpose of Collecting Personal Information	Categories of Other Parties to whom Personal Information may be Disclosed	Categories of Third Parties to whom Personal Information is Sold and the Purpose of Sale
Identifiers	Names, Account/Loyalty Program IDs, Emails, Addresses, Phone Numbers, IP Addresses, Other Device Identifiers, Tax Exempt Numbers, Driver’s License	From You, Your Devices (when you visit our sites or use our apps), Service Providers (e.g., data brokers, fraud prevention companies), Business Partners, Social Networks	To identify you in support of business activities such as fulfilling a transaction, communicating with you (order notification, etc.), personalizing your experience, fraud prevention	Advertising Networks and Service Providers/Business Partners such as cloud service providers, payment processing companies, fraud prevention companies, delivery companies, and product manufacturers	Advertising Networks for the purpose of Marketing and improving their products and services
Commercial Information	Products or Services Purchased, Price or Service Quotations, Credit Card or other Financial Information, Chat Sessions, Feedback/Survey Responses, Copy/Print Materials	From You (when you transact with us or participate in any of our programs)	To support a business transaction, communicating with you (surveys about your purchase, customer service, order notification, etc.), improve our products and services	Advertising Networks and Service Providers/Business Partners such as cloud service providers, fraud prevention companies, payment processing companies, delivery companies, and product manufacturers	Advertising Networks for the purpose of Marketing and improving their products and services (We do not sell credit card or other financial information.)
Biometrics	N/A	N/A	N/A	N/A	N/A
Characteristics of Protected Classifications	Demographic information such as age ranges, marital status, etc.	From You and Service Providers (e.g., data brokers, survey vendors, fraud prevention companies)	To protect against fraud, enable you to apply for a company credit card, demographically understand our customers to improve our products and services	Advertising Networks and Service Providers/Business Partners such as cloud service providers and marketing/sales analytics companies	N/A
Internet or Other Electronic Network Activity	Browsing activity, searches, and other interactions on our websites or mobile apps, your interactions with our ads	From You, Your Devices (when you access our websites or mobile apps) and fraud prevention companies	To send marketing to you, improve our products and services, fraud prevention, etc.	Advertising Networks and Service Providers/Business Partners such as cloud service providers, fraud prevention companies, and eCommerce analytics companies	Advertising Networks for the purpose of Marketing and improving their products and services
Geolocation Data	Location based on IP address or mobile device location information	From You, Your Devices (when you access our websites or mobile apps), Service Providers (e.g., data analytics providers, fraud prevention companies)	To personalize your experience, display store locations near you, fulfill your orders, analyze web/app traffic, fraud prevention	Advertising Networks and Service Providers/Business Partners such as cloud service providers and eCommerce functionality vendors	N/A
Recordings (e.g., audio, visual)	Voice and CCTV Recordings	From You (when you call customer service or visit one of our locations), Service Providers (e.g., call record software providers)	For quality and training purposes when you call customer service, improve our products and services, fraud prevention	Service Providers/Business Partners such as cloud service providers and customer service call recording companies	N/A
Professional or Employment-Related Information	Employer Name and Job Title	From You (e.g., when you inquire about our programs), Service Providers (e.g., data brokers), Business Partners	To send you marketing, personalize your experience, enroll you in certain programs at your request	Advertising Networks and Service Providers/Business Partners such as cloud service providers and program administrators	N/A
Education Information	School Affiliations	From You (when you participate in certain programs such as Classroom Rewards)	To administer certain programs	Advertising Networks and Service Providers/Business Partners such as cloud service providers and program administrators	N/A
Inferences	Product and Service Preferences	From You (when you tell us what products and service are of interest), by analyzing other data we have about you, Service Providers (e.g., advertising networks, fraud prevention companies), Social Networks	To provide you personalized experiences and marketing, group you into segments with other similar customers, improve our products and services	Advertising Networks and Service Providers/Business Partners such as cloud service providers and marketing/ eCommerce analytics companies	N/A

 

The above categories are intended to encompass the Personal Information described in subdivision (e) of Section 1798.80 of the CCPA.

California residents have the following rights:

1. The Right to Opt-Out of the Sale of Personal Information to Third Parties
2. The Right to Disclosure of Personal Information Collected, Used, Disclosed, and Sold
3. The Right to Deletion of Personal Information
4. The Right to not be Discriminated Against Based on Exercising any of the Above Rights

California residents may submit your request to Opt-Out of the Sale of your Personal Information to third parties by:

1. Submitting an online request here: Do Not Sell My Personal Information
2. Clicking the “Do Not Sell My Personal Information” button on our website

California residents may submit a Data Disclosure request by:

1. Submitting an online request here: Data Disclosure Request
2. Submitting a phone request by calling 1-800-333-0333

California residents may submit a Data Deletion request by:

1. Submitting an online request here: Data Deletion Request
2. Submitting a phone request by calling 1-800-333-0333

We will take reasonable steps to verify your identity prior to fulfilling the above requests. For purposes of verifying your identity, we will request that you provide personal information we already have on file including your first and last name, email address, and phone number. We may also request mailing address and, if applicable, your account number, login ID for our websites, and rewards/loyalty number to ensure that we have a verified match.

Authorized Agents may submit requests on behalf of a California resident using the above processes and ensuring the appropriate verification and documentation can be provided.

Minors:

Our programs, websites and mobile applications are not directed toward minors under 16 years of age.  We do not knowingly collect, share, or sell the Personal Information of minors.

Notice of Financial Incentive:

We may provide price discounts, coupons, services, and other perks for members of our loyalty programs. Through these offerings, you may provide us with Personal Information depending on how you choose to interact with us when and after you opt-in to our programs. There is no obligation to opt-in, and you may opt-out at any time. The details of the programs are contained in the program offerings. We offer these programs, among other things, to enhance our relationship with you so you can enjoy more of our products/services at a lower price. While we invest in our marketing and brands, consumer data is more valuable to our business when it is combined with a sufficient amount of other consumer data and after it is enhanced by our efforts described in this Privacy Notice. The value to our business of any individual consumer’s data is dependent on several factors, including, for example, whether and to what extent you take advantage or opt out of any offerings and whether we are able to enhance the data through our efforts described in this Privacy Notice. While we do not calculate the value of consumer data in our accounting statements, we provide this good faith summary for California residents. To the extent we create overall business value from our programs that could be directly or reasonably related to the value of consumer data, the method for calculating the value would include: a) costs related to maintaining the program including but not limited to IT infrastructure, delivery of offers, and marketing activities to enhance consumer data; b) whether the sales generated by the program exceeds the cost to us of offering the program including value of discounts to consumer; and c) value of the insights we are able to create based upon aggregate data.

Non-Discrimination:

We will not discriminate against you for exercising any of your CCPA Rights and we will not deny you goods or services, charge you a different price, or provide you with a lesser quality of goods or services if you exercise any of your CCPA Rights.

As an additional resource, you may also contact us at ConsumerRightsRequest@Staples.com for any additional questions related to the rights granted under the California Consumer Privacy Act (CCPA).

If you are a data controller with a consumer rights request for us, please contact us at ConsumerRightsRequest@Staples.com

Effective Date: February 1, 2021

1. Introduction

Staples is committed to ensuring the security of our customers and the information they share with us via our online platforms and services. We also recognize the valuable efforts that security researchers play in highlighting cybersecurity vulnerabilities and concerns. The purpose of this policy is to provide clear guidelines for conducting vulnerability discovery activities and to convey how to submit discovered vulnerabilities.

2. Compliance

If you comply with this policy during your security research, and you discover and report security vulnerabilities in accordance with this policy, we will not take legal action against you. We reserve all legal rights in the event of any non-compliance with this policy.

3. Requirements

This policy requires that you:

• Notify us as soon as possible after you discover a real or potential security issue;
• Make every effort to avoid privacy violations, degradation of user experience, disruption to systems and destruction or manipulation of data;
• Only use exploits to the extent necessary to confirm a vulnerability’s presence — do not use an exploit to collect, modify or delete data, establish persistent access or access and/or test other systems, networks or applications; and
• Do not disclose the details of any alleged vulnerability to third parties without express written consent from Staples — unauthorized disclosure will deem the submission as noncompliant with this policy.

Once you’ve established that a vulnerability exists or encounter any confidential or sensitive data (including personal information, financial information, or proprietary information), you must stop your test, notify us immediately and not disclose this data to anyone else.

4. Test Methods

The following test methods are not authorized:

• Denial of service (DoS or DDoS) tests or other tests that stress-test or have the potential to impair access to or damage systems, networks, applications or data, even if temporarily 
• Accessing, downloading or modifying data residing in an account that does not belong to you
• Testing in a manner that would result in sending unsolicited or unauthorized junk mail, spam, e-mail notices, phone calls, text messages or other forms of unsolicited messages to other parties — including Staples associates, customers or partners
• Social engineering, including but not limited to misrepresenting Staples or its personnel • Trespassing or other tests with a physical security aspect
• Posting, transmitting, uploading, linking to, sending or storing any malicious software
• Testing third-party systems, networks, applications, and services, even if operated on behalf of Staples

5. Scope

This policy applies to the following Staples family websites and services:

• Staples.com
• StaplesConnect.com
• StaplesAdvantage.com
• StaplesPromotionalProducts.com
• Quill.com
• HiTouchBusinessServices.com

Though we develop and maintain other Internet-accessible systems and services, research and testing under this policy is restricted to the systems and services listed in this section. If there is a particular system or service not in scope that you think merits testing, please contact us to discuss. We may change the scope of this policy over time.

6. Reporting a Vulnerability

We accept vulnerability reports via email to vulnerabilityreport@staples.com. Reports may be submitted anonymously.

What we would like to see from you

In order to help us triage and prioritize submissions, we recommend that your report:

• Describes full details of the vulnerability and its location;
• Provides step-by-step instructions for us to be able to validate and reproduce the finding; and
• Includes any proof of concept scripts or resulting artifacts, such as screen captures.

What you can expect from us

If you submit a valid security vulnerability in compliance with this policy, we will:

• Acknowledge the receipt of the report within 5 business days;
• Communicate with you to understand and validate the issue as necessary; and
• Address the submitted vulnerability as appropriate, as deemed by Staples.

Note that Staples does not operate a bug bounty program and we make no offer of compensation in exchange for submitting potential issues.

Staples may modify the terms of this policy or terminate this policy at any time.

7. Questions 

If you are in doubt about the scope, acceptable test methods or any other provisions of this policy, you are encouraged to contact us first at vulnerabilityreport@staples.com. We also invite you to contact us with suggestions for improving this policy.