B & H Foto & Electronics Corp ("B&H") is the largest non-chain photo, video and consumer electronics store in the United States. The business operates a retail store on 34^th St. and 9^th Avenue in New York City, along with their website (www.bhphotovideo.com) and mobile application.

Due to the nature of the retail and eCommerce business, B&H is often required to obtain Personal Information from our consumers, organizational sales customers, affiliates and vendors to successfully operate. B&H recognizes the need to maintain the confidentiality of private, confidential and proprietary information. This Privacy & Security Policy ("Policy") will offer a transparent breakdown of how B&H and our strategic partners protect the confidentiality of the information collected by B&H.

Note: B&H sites can contain links to external sites and social media pages, including those of photographers, artists, and other contributors. B&H does not assume responsibility and is not liable for your data privacy on any external sites. Please consult the privacy policy of the sites you visit.

This Policy should be read in conjunction with all the B&H Website Terms and Conditions and the B&H Cookie Policy.

Quick Links:

1. PURPOSE
2. NOTICE OF MONITORING
3. THE DATA WE COLLECT FROM YOU AND HOW WE USE IT
   1. PERSONAL INFORMATION YOU PROVIDE TO US
   2. PERSONAL INFORMATION WE COLLECT AUTOMATICALLY
   3. PERSONAL INFORMATION WE COLLECT FROM THIRD PARTIES
   4. OTHER PURPOSES WE MAY USE PERSONAL INFORMATION
4. DE-IDENTIFIED (ANONYMIZED) DATA
5. SHARING YOUR PERSONAL INFORMATION
   1. INFORMATION REGARDING PAYBOO PARTNERSHIP
   2. OTHER THIRD PARTY CONTROLLERS
6. COOKIES AND OTHER TRACKING TECHNOLOGIES
7. MANAGING YOUR COMMUNICATIONS PREFERENCES
   1. EMAIL MARKETING
   2. TARGETED ADVERTISING
   3. PUSH NOTIFICATIONS
8. RETENTION OF PERSONAL INFORMATION
9. HOW WE PROTECT YOUR INFORMATION
10. CHILDREN'S PERSONAL INFORMATION
11. REQUIRED DISCLOSURES
    1. PRIVACY RIGHTS
       Canada⁺⁺
       Colorado
       Connecticut
       Europe
       Montana
       Oregon
       Texas
       Utah
       Virginia
    2. MAKING A REQUEST
    3. VERIFYING YOUR IDENTITY
    4. AUTHORIZED AGENTS
    5. APPEALING OUR DECISION
12. ADDITIONAL CALIFORNIA NOTICES
    1. THE "LEGAL CATEGORIES" OF PERSONAL INFORMATION WE COLLECT ABOUT YOU
    2. SHINE THE LIGHT NOTIC
13. INTERNATIONAL CUSTOMERS
    1. EU-U.S. AND SWISS-U.S. DATA PRIVACY FRAMEWORKS
14. CHANGES TO THIS PRIVACY POLICY
15. CONTACT US
16. PERSONAL INFORMATION PRIVACY CHART

A. Purpose

This Policy covers B&H and its affiliated Partners. It explains the Legal Basis that B&H has in processing your Personal Information, how and what data we collect about you and what we do with that data. This policy will also inform you of your data privacy rights and how you can exercise those rights.

In this policy, when we talk about "Personal Information", we are referring to any information that relates to you, such as your name, email address, mailing address, telephone number, etc.

When we talk about the B&H Platform we mean the B&H websites, www.bhphotovideo.com and the B&H mobile application. This Policy also covers how B&H collects and uses your information offline. Please note, those laws that apply to the processing of personal data (including regulations, guidelines, government issued rules, and court opinions interpreting laws) (hereinafter collectively referred to as “data protection laws”) may require us to describe our processing using certain terms or in a specific way. Although we have tried to use terms consistent with data protection laws, we aren’t always able to use terms that may be used in your jurisdiction. If you have any questions about this Policy, please contact us at one of the methods described in the Contact Us section.

For specific information about B&H’s participation in the EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Framework, see EU, UK Extension, and Swiss Data Privacy Frameworks section below.

B. Notice of Monitoring

Please note that if you use the chat function on our website, all information you send and receive will be recorded. If you do not wish for us to record this information, please do not use the chat function on our website. By using our chat function you consent to B&H monitoring all communications.

C. The Data We Collect From You And How We Use It

We may collect Personal Information directly from you, using online tracking technologies, through in-store and other offline technologies, from our business partners, from social media platforms or otherwise when engage with our Platform or when you otherwise correspond with us. We also may collect Personal Information from you when you make a purchase in person in our store.

It is your choice whether to provide Personal Information to us, but it may be necessary in order to use our Services, such as setting up an account, conducting a transaction, commenting on a blog post or reviewing a product.

If you give us Personal Information about someone else, including pictures of them, their name, their e-mail address, etc., on our social media Platforms, e-views and comments on our websites, you must do so only if you have that person's consent to provide us with that information. You should direct them to this Policy so that they are informed about how we collect, use, disclose, and retain their Personal Information. Please see our website user agreement for how we may use and retain any content submitted to us.

1. Personal Information You Provide to Us

We may collect the following Personal Information directly from you for the following purposes:

• Account Registration and Management: When you register for and use your account with us, we will collect your name, addresses, telephone numbers, email addresses, mobile device information, billing and account information, and a record of the products and services you have purchased and used. Processing is necessary for the performance of the contract.
• Purchases: When you make a purchase, we may collect your name, telephone number, email address, mailing address, and billing and other information in order to process your order and send you the items you purchased. If needed, information required to clear customs (such as Tax ID, partial Social Security number, or other identification numbers) and relevant postage information (such as tracking numbers and tracking updates) may be collected as well. For in-store pickup, we will also collect the legal name of the person picking up the order. For trading in gear, we will request your photo ID in person or contact information online. Processing is necessary for the performance of the contract with you.
  
  B&H does not store credit card or other financial information from you; that information is collected directly by our trusted third-party payment processing. On occasion, for some international customers B&H will require bank account information. For more information about how our third-party payment processors protect your Personal Information, please review their privacy policies at:
  • https://www.worldpay.com/en/privacy
  • https://www.tsys.com/privacy-policy
• Marketing: When you provide your Personal Information to register and use your account, make purchases from us, or otherwise interact with us, we may also use your Personal Information to send you advertisements, marketing materials, and other information on products and services we think may be of interest to you. We typically will use your name, email address, phone number, physical address, and other contact information you provide to us. When we process your Personal Information for marketing purposes, our processing is based on our legitimate interest in promoting and growing our business, otherwise it is based on your consent. You have the right to withdraw your consent at any time, without affecting the lawfulness of the processing based on consent prior to such withdrawal.
• Customer Service: We may collect your Personal Information from you when you contact us for customer services support or questions. Specifically, we may collect your name, email address, phone number, address, birth date, full or partial Social Security number or Social Insurance number, driver’s license number, purchase or service history, geolocation data, bank account information, recording of call, billing or account information, payment card information, and tax information, depending on the nature of your customer service inquiry and the requests you are making. Processing is necessary for the performance of the contract with you. Otherwise processing is based on your consent. You have the right to withdraw your consent at any time, without affecting the lawfulness of the processing based on consent prior to such withdrawal.
• Customer Satisfaction Surveys: We may ask you to complete surveys to tell us about your experiences with us. If you choose to fill out a survey, we will collect your name, email address, phone number, and the information you provide to us in your survey responses. The processing is based on our legitimate interest. When we rely on our legitimate interest, we will always assess whether your interests or fundamental rights and freedoms do not outweigh our interests. We carry out legitimate interest assessments in such cases.
• Communicating with Us: You may also provide us with additional information through a web form, by updating or adding information to your account, through your participation in blog posts, community discussions, and chats, or when you otherwise communicate with us regarding our Services. Processing is based on your consent. You have the right to withdraw your consent at any time, without affecting the lawfulness of the processing based on consent prior to such withdrawal.
• Website Chat: When you visit our website, you may choose to engage with us through our chat features. If you use our website chat feature, we will collect your name, order number, order information, email address, and any other information you choose to provide to us. Processing is based on your consent, and by using the chat, you consent to our collection and use of this information. You have the right to withdraw your consent at any time, without affecting the lawfulness of the processing based on consent prior to such withdrawal.
• Business to Business Transactions: When you share information with us on behalf of another business, we typically collect your name, company name, address, purchase history, account information, account contact information, account permissions and preferences, and any other information we use to service your account. Processing is necessary for the performance of the contract with you.
• Event Registration: You may provide us with your name and contact information when you register for one of our events that we host virtually, or in our store, such as trainings and demos. Processing is necessary for the performance of the contract with you.
• Authentication: We may also collect additional information we are required or authorized by applicable national laws to collect and process in order to authenticate or identify you or to verify the information we have collected. This may include, name, email address, phone number, address, birth date, full or partial Social Security number or Social Insurance number, driver’s license number, purchase or service history, precise geolocation data, bank account information, billing or account information, payment card information, and tax information. We collect only that information that is necessary to comply with a legal obligation to which we are subject.
• Used Item Sales: When selling a used item to B&H, it is required that B&H collect a copy of a valid government issued ID, which may include your name, birth date, government ID number (such as Social Security number or Social Insurance number), address, height, weight, and sex. We collect only that information that is necessary to comply with a legal obligation to which we are subject.

2. Personal Information We Collect Automatically

We may collect the following Personal Information from your device or browser for the following purposes:

• Advertising and Behavioral Profiling: We collect information about your interaction with our Services, your advertising preferences and your communications with us. This is information we receive from devices (including mobile devices) you use when you access our Services. This information could include the following: Device ID or unique identifier, device type, ID for advertising and a unique device token, preferences, purchase / service history, cookie IDs, device identifiers, IP address, precise geolocation, tracking data on behavior across websites, and postal or country code. The processing is based on our legitimate interest. When we rely on our legitimate interest, we will always assess whether your interests or fundamental rights and freedoms do not outweigh our interests. We carry out legitimate interest assessments in such cases. Otherwise, processing is based on your consent.
• Advertising Analytics: For advertising analytics, we may collect computer and connection information such as statistics on your page views, traffic to and from the sites, referral URL, ad data, your IP address, your browsing activity, history and your web log information. The processing is based on our legitimate interest. When we rely on our legitimate interest, we will always assess whether your interests or fundamental rights and freedoms do not outweigh our interests. We carry out legitimate interest assessments in such cases. Otherwise, processing is based on your consent.
• Website Chat: We collect information from you automatically when you use the chat function on our website. The information we collect automatically from you includes your device information (such as IP address), browser type, browser settings (such as preferred browser language), location, and referring URL. The processing is based on our legitimate interest. When we rely on our legitimate interest, we will always assess whether your interests or fundamental rights and freedoms do not outweigh our interests. We carry out legitimate interest assessments in such cases. Otherwise, processing is based on your consent.
• Website / Mobile App Use Analytics & Marketing: When you visit and use our Platform, we collect information automatically from your devices to evaluate and improve our website performance, as well as for marketing purposes. This includes your IP address, cookie IDs, device identifiers, location data, information about how you use our website, preferences and trends, and purchase and service history. If you are paying us for products or services, we will also collect your billing / account information and payment card information to complete the transaction. The processing is based on our legitimate interest. When we rely on our legitimate interest, we will always assess whether your interests or fundamental rights and freedoms do not outweigh our interests. We carry out legitimate interest assessments in such cases. Otherwise, processing is based on your consent.
• Security and Safety: When you visit us in-store, we use CCTV technologies to ensure the security and safety of our customers, personnel and business. Where we use CCTV, we comply with laws applicable to B&H within the local jurisdiction where our store is located. When we rely on our legitimate interest, we will always assess whether your interests or fundamental rights and freedoms do not outweigh our interests. We carry out legitimate interest assessments in such cases. Otherwise, processing is based on your consent.

To learn more about how we use Cookies and Other Tracking technologies, please review our Cookie Policy, including to opt out of the sale or sharing of your personal data for profiling, targeted marketing, or cross-context behavioral advertising. Alternatively, you can exercise your privacy choices by visiting the Making a Request section of this Policy. California residents can click on the Your Privacy Choices button in the footer of our website.

3. Personal Information We Collect From Third Parties

We may collect the following Personal Information from third parties for the following purposes:

• Marketing and Promotions: On occasion we might collect Personal Information from third parties such as from tradeshows marketing and advertising partners, and partnerships with third parties who help to administer promotions, giveaways or sweepstakes. This information is usually limited to name, email address and address. The processing is based on our legitimate interest. When we rely on our legitimate interest, we will always assess whether your interests or fundamental rights and freedoms do not outweigh our interests. We carry out legitimate interest assessments in such cases. Otherwise, processing is based on your consent.
• Processing Transactions: When you make a purchase, our third party payment processor may share with us your name, billing address, transaction information (i.e., amount of transaction, time of transaction, and transaction ID), payment method and other information in order for us to process your order and send you the items you purchased. Processing is necessary for the performance of the contract with you.
  B&H does not store credit card or other financial information from you; that information is collected directly by our trusted third-party payment processing. On occasion, for some international customers B&H will require bank account information. For more information about how our third-party payment processors protect your Personal Information, please review their privacy policies at:
  • https://www.worldpay.com/en/privacy
  • https://www.tsys.com/privacy-policy
• Communicating Via Social Media: When you communicate with us or otherwise engage with us through the use of social media, such as Facebook, Instagram or X (formerly Twitter), we may receive information related to your engagement with us via social media. Generally, we may receive information such as name, social media handle, and other information about your profile which you may have made public. We may also receive any images or other content that you have tagged us in. We do not use this information outside of our engagement with you on social media. Processing is based on your consent. You have the right to withdraw your consent at any time, without affecting the lawfulness of the processing based on consent prior to such withdrawal.
• Website Chat: B&H offers a chat feature on its website which you can use to communicate with us and to resolve issues or questions. This chat feature is operated by a third party, so when you provide information in the course of the chat, such as your name, email address, and details about your inquiry, we may ultimately collect that information from the third party chat operator. Processing is based on your consent, and by using the chat, you consent to our collection and use of this information. You have the right to withdraw your consent at any time, without affecting the lawfulness of the processing based on consent prior to such withdrawal.

4. Other Purposes We May Use Personal Information

We may also use any of the Personal Information we listed above for the following purposes:

• To operate and evaluate our business, including improving and personalizing the experience for you and others;
• To advertise and market to you, including sending you advertising and marketing communications, and information about our products and services that we think you will be interested in, and customizing the information and advertisements you receive from us;
• To maintain and improve our services, including to audit, research, and conduct analysis to protect people who use our websites;
• For safety and security, by making sure third parties protect your information, and monitoring the technical functioning and security of our network;
• For legal and compliance, including complying with applicable laws, regulations, and legal obligations; and
• To protect the rights or property of B&H, its employees, its customers, and people who use its websites.

We use Personal Information for these purposes to comply with a legal obligation to which we are subject. Otherwise, the processing is based on our legitimate interest. When we rely on our legitimate interest, we will always assess whether your interests or fundamental rights and freedoms do not outweigh our interests. We carry out legitimate interest assessments in such cases.

D. De-Identified (Anonymized) Data

B&H may de-identify (also known as anonymize) and aggregate data for its business purposes, including but not limited to, to improve the products and features of its Services, to maintain the security and integrity of its systems, for analytics, and other legitimate business purposes. "De-identified Data" means information that cannot reasonably be used to infer information about, or otherwise be linked to a particular data subject. Where we process De-identified Data, we commit to maintain and use the information in de-identified form and not attempt to reidentify the information, except where permitted by law. B&H may disclose De-identified Data to third parties who commit themselves to maintaining the De-identified Data in de-identified form and not attempting to re-identify the data for any business or commercial purpose.

E. Sharing Your Personal Information

This section will tell you about how we share your Personal Information with others. We only share your information where we have a legal basis for doing so and where we've described the business purpose to you in this Policy. The list below tells you when we share your Personal Information for a business purpose and the categories of third parties we share it with.

• Service Providers and Business Partners: Other companies sometimes provide services to us or on our behalf. For example, we may use other companies for IT support, order fulfillment, warranties, shipping and tracking, technology solutions, maintaining our website, fraud prevention, verification, and government policy compliance.
• Business to Business (B2B) Accounts: When you interact with us as part of a B2B relationship, we may share any of the information we collected historically for the business account with a person who is currently acting for or on behalf of the business. We do this so that we can provide you with the products and services requested, to maintain your account, and to provide customer service and assistance to the business.
• Third Parties with Whom You Ask Us to Share Your Personal Information: If you ask us to share your Personal Information with a third party, we will only share the information that is needed to complete your request. This can apply to any request you make, like warranty claims, store credit cards, manufacturers or suppliers, and other requests you might make.
• Website Chat Providers: If you use the chat feature on our website, that chat feature is operated by a third party. When you use the chat, the third party operator will receive all the information you provide in the course of your chat, such as your name, email address, and any other information you choose to provide in the chat. By using the chat, you agree to us sharing information with and receiving information from the third party chat service provider.
• Marketing and Advertising Partners: We may disclose purchase history, contact information, advertising identifiers and other information regarding how you have engaged with us in the past with our marketing and advertising partners so they can present you with special offers and deliver you with marketing related to B&H.
• Compliance with Legal Obligations: We may need to disclose certain information to auditors, government authorities, law enforcement, regulatory agencies, our legal counsel, third-party litigants and their counsel, or other authorized individuals to comply with laws that apply to us, subpoenas, discovery requests, or other legal obligations such as contractual requirements. This can include things like customs and used item sales.
• Changes in Business Structure or Ownership: We may disclose or transfer your Personal Information to a third party in the event of any reorganization, merger, sale, acquisition, joint venture, assignment, transfer, or other disposition of all or any portion of B&H's business, assets, or ownership interest (including through bankruptcy or similar proceedings).

1. Information Regarding Payboo Partnership

B&H has a partnership with Comenity Bank, which operates as “Payboo,” to provide B&H Payboo credit card services to our customers. As part of this service, we may provide first and last name, mailing address, email, order information, purchase history, and transaction information (such as transaction ID, transaction amount, and date/time of transaction) to Payboo to offer you services. All information shared with Payboo is to enable the use of the Payboo credit card on our websites. Personal Information collected directly by Payboo, including information related to your transactions on our website, is subject to their terms and privacy policies.

2. Other Third Party Controllers

B&H partners with other third parties who act as independent controllers to help us provide services to our customers, protect against fraud, and process payments on our behalf. Where we use a third party controller, we may share certain information about you with them provided we have a legal basis to do so. A list of current third party controllers we use and their policies are below:

• https://risk.lexisnexis.com/corporate/privacy-policy
• https://www.aciworldwide.com/privacy-policy
• https://www.forter.com/privacy-policy/
• https://ekata.com/privacy-policy/
• https://www.worldpay.com/en/privacy
• https://www.tsys.com/privacy-policy

F. Cookies and Other Tracking Technologies

When you visit our Platform, we or our authorized service providers may use cookies, web beacons, and other similar technologies for storing information to help provide you with a better, faster, and safer experience for advertising purposes.

To learn more about the types of cookies we use on our platform, including the types of cookies we use and how to manage your cookie preferences, please visit our Cookie Policy.

Do Not Track Signals. Some web browsers allow you to turn on Do Not Track ("DNT"), which sends signals to websites you visit, telling those sites that you do not want your online activities to be tracked. Our websites currently are not designed to respond to DNT signals received from web browsers.

G. Managing Your Communications Preferences

We understand that our customers may want to choose how often and by what means we communicate with them. This is why we want to be clear how you can manage your communication preferences. If we are processing your Personal Information based on your consent, you can withdraw your consent from B&H at any time.

1. Email Marketing

For email marketing and communications, please visit our Email preferences page in your profile which can be accessed from the 'My Account' menu on the top of any page on our Platform. You can also unsubscribe using the links at the bottom of any of our emails to you.

2. Targeted Advertising

If you do not wish to participate in our advertising personalization programs, you can opt out by unchecking the appropriate cookies on our Cookie preferences page. While logged out, your selection will apply to the browser on the device you make your selection from. Your selection may change when you log in to your B&H account, should you have one with us. To have your preferences apply across all B&H experiences, sign in to make your selection.

Please note that you can disable all cookies from your browser settings. However, our websites require cookies to function and disabling all cookies will limit functionality of the site, including actions like adding products to a cart, etc.

3. Push Notifications

You can configure settings for Push Notifications in your web browser settings for the websites and on the application settings for the mobile app.

You can also contact us via the Contact Us section should you have a question or need more information.

H. Retention of Personal Information

We retain your Personal Information for as long as we have a relationship with you or for as long as legally required. When deciding how long to keep your Personal Information after our relationship with you has ended, we consider our legal and regulatory obligations and internal Personal Information management policies. For example, we may retain records to investigate or defend against potential legal claims or where required by law. Where we retain data, we do so in accordance with any limitation periods and records retention obligations that are imposed by applicable law.

Our employees are trained to understand and comply with these measures and we communicate our Privacy Policy, practices and guidelines to our employees.

I. How We Protect Your Information

We implement and maintain appropriate technical, and administrative security measures designed to safeguard your Personal Information against unauthorized access, destruction, loss, alteration, or misuse. We evaluate and update these measures on an ongoing basis and ensure reasonable security measures are deployed consistent with industry standards. However, no Personal Information system can be 100% secure, so we cannot guarantee the absolute security of your Personal Information.

We retain your Personal Information for as long as we have a relationship with you or for as long as legally required. When deciding how long to keep your Personal Information after our relationship with you has ended, we consider our legal and regulatory obligations and internal Personal Information management policies. For example, we may retain records to investigate or defend against potential legal claims or where required by law. Where we retain data, we do so in accordance with any limitation periods and records retention obligations that are imposed by applicable law.

Our employees are trained to understand and comply with these security measures and we communicate our Privacy Policy, practices and guidelines to our employees.

J. Children’s Personal Information

The B&H Platform is not intended for use by anyone under the age of sixteen (16). In accordance with the Children’s Online Privacy Protection Act (“COPPA”) and other applicable data protection laws related to minors, we do not knowingly request or solicit Personal Information from anyone under the age of sixteen (16) nor will we knowingly, allow anyone under the age of sixteen (16) to create a B&H user account. In the event that we receive actual knowledge that we have collected such Personal Information without the requisite and verifiable parental consent, we will delete that information from our database as quickly as is practical. We reserve the right to request proof of age at any stage so that we can verify that minors are not using the Services. We do not sell or share Personal Information of minors under the age of sixteen (16).

K. Required Disclosures

1. Privacy Rights

Some privacy laws require that we disclose the privacy rights that you may have regarding your Personal Information. We have defined the various rights below.

For all Personal Information that we collect about you, you may have the following rights or choices that we will accommodate where your requests meet legal and regulatory requirements and do not risk making our other data less secure or changing our other data. You may also designate an authorized agent to make a request on your behalf.

Right to access — The right for a consumer to access from a business/data controller the information or categories of information collected about a consumer, the information or categories of information shared with third parties, or the specific third parties or categories of third parties to which the information was shared; or, some combination of similar information.

Right to correct — The right for a consumer to request that incorrect or outdated personal information be corrected but not deleted.

Right to delete — The right for a consumer to request deletion of personal information about the consumer under certain conditions. B&H allows all consumers to submit a request to delete, no matter where they reside.

Right to opt out of certain processing — The right for a consumer to restrict a business’s ability to process personal information about the consumer.

Right to portability — The right for a consumer to request personal information about the consumer be disclosed in a common file format.

Right to opt-out of sales — The right for a consumer to opt out of the sale of personal information about the consumer to third parties.

Right to opt in for sensitive data processing — The right for a consumer to opt in before a business can process their sensitive data.

Right against automated decision making — A prohibition against a business making decisions about a consumer based solely on an automated process without human input.

Right to appeal — where a controller declines to take action regarding a consumer's request to exercise any privacy right, the controller must allow the consumer to appeal the decision and provide instructions on how they may request an appeal.

In addition, a business may not treat a consumer who exercises a consumer right differently than a consumer who does not exercise a right.

Privacy Rights Chart:


+ The term Europe, as used in this Policy, shall mean the European Union, European Economic Area, United Kingdom and Switzerland.

++Provinces may vary. Please refer to your local Provincial law to determine which are applicable to you.

^ B&H allows all consumers to submit a request to delete, no matter where you reside.

Y – right exists	O – right to opt out or limit use of sensitive data
S – sensitive data	T – right to opt out of targeted advertising
L – private right of action limited to certain violations only	N – right does not expressly exist or activity is expressly prohibited
P – right to opt-out of processing for profiling/targeted advertising purposes	* – right to opt out of certain automated decision making

2. Making a Request

To make a data privacy related request, please call toll free +1 800.947.9915 or contact us. Once the request has been received, you may be asked to provide additional personal information for verification purposes before your request can be accommodated, including your full name, email address, telephone number, billing address, previous purchase history and order information.

3. Verifying Your Identity

Once the request has been received, you may be asked to provide additional personal information for verification purposes, including your full name, email address, telephone number, billing address and previous order history before your request can be accommodated. For requests involving specific pieces of information, we may also require you to sign a declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request.

4. Authorized Agents

You may have the right to designate someone else make privacy requests for you under the data protection laws. Authorized agents must:

1. provide us with valid written authorization, that the third party agent has the authority to act on behalf of the individual whom they are making the request, which must include the agent’s name, email address, and phone number,
2. You must follow the instructions above to verify your own identity, and
3. The authorized agent must follow the instructions provided in this section to make a request.

We reserve the right to verify the validity of any third party request to exercise privacy rights on behalf of our customers to the fullest extent permitted under applicable data protection law.

5. Appealing our Decision

If you disagree with a decision we make regarding your request to exercise a privacy right as described in this policy, you may contact us using the Contact Us section below. Please refer to the prior request, and include the reason for your appeal in your request.

L. Additional California Notices

1. The "Legal Categories" of Personal Information We Collect About You

Certain U.S. laws require us to tell you about the Personal Information we collect about you in a certain way – specifically, we need to tie it back to the "legal categories" of Personal Information that are listed in the laws. To do this, we bundled up the information we gave you in this Policy and matched the different types of Personal Information we collect about you with the legal category. To make things easier to understand, we've put this information in a Personal Information Privacy Chart at the end of this Privacy Policy.

2. Shine the Light Notice

California residents have the following additional rights regarding disclosure of your Personal Information to third parties for their own direct marketing purposes:

We provide California residents with the option to opt-in to sharing of “Personal Information” as defined by California’s “Shine the Light” law with third parties, other than with our affiliates, for such third parties’ own direct marketing purposes. We do not share Personal Information with non-affiliate third parties for their direct marketing purposes absent your consent. If you are a California resident, you may request information about our compliance with the Shine the Light law and/or withdraw previously given consent to sharing with non-affiliate third parties for their direct marketing purposes by contacting using the methods in the “Contact Us” section below. Requests must include “California Marketing Privacy Rights Request” in the first line of the description and include your name, street address, city, state, and ZIP code. Please note that we are only required to respond to one request per customer each year, and we are not required to respond to requests made by means other than through the provided e-mail address or mailing address.

M. International Customers

B&H is a U.S. based corporation with its operations and services headquartered in the United States. As such, customers who visit us outside of the U.S. acknowledge and consent to their Personal Information being transferred to the United States. In addition, B&H complies with the EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Framework. For more information, see below.

1. EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Frameworks

B&H complies with the EU-U.S. Data Privacy Framework program (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF (UK Extension), and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. B&H has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework program Principles (DPF Principles) with regard to the processing of personal data received from the European Union and United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. B&H has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Policy and the EU-U.S. DPF, UK Extension, or Swiss-U.S. Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/. In compliance with the EU-U.S., UK Extension, and Swiss-U.S. Principles, B&H commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to the DPF Principles. European Union, UK, and Swiss individuals with DPF inquiries or complaints should first contact B&H at:

Legal Department
B & H Foto & Electronics Corp.
440 Ninth Avenue
New York, New York 10001
Phone: +1 800.947.9915
Web: www.bhphotovideo.com

In compliance with the Principles, B&H commits to refer resolve DPF-related complaints about our collection or use of your personal information. European Union, UK, and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the Principles should first contact us via email.

B&H has further committed to refer unresolved privacy complaints under the DPF Principles to an independent dispute resolution mechanism, Data Privacy Framework Services, operated by JAMS. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://www.jamsadr.com/DPF-Dispute-Resolution for more information and to file a complaint. This service is provided free of charge to you.

If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See https://www.dataprivacyframework.gov/s/article/G-Arbitration-Procedures-dpf?tabset-35584=2

Pursuant to the Principles, European Union, UK, and Swiss individuals have the right to obtain our confirmation of whether we maintain, in the United States, personal information relating to them.

• Upon request, we will provide you with access to the personal information that we hold about you. You may also correct, amend or delete the personal information we hold about you. An individual who seeks access to, or seeks to correct, amend, or delete inaccurate data processed in the United States under the Principles should direct their query to [email protected]. If requested to remove data, we will respond within a reasonable timeframe.
• To request us to limit the use and disclosure of your personal information, please submit a written request to [email protected].
• In certain situations, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Our accountability for personal data that we process in the U.S. is described in the Principles. In particular, we remain responsible and liable under the Principles if third-party agents that we engage to process personal data on our behalf do so in a manner inconsistent with the Principles, unless we prove that we are not responsible for an event giving rise to damage.

N. Changes to This Privacy Policy

We reserve the right to modify this Policy. When we make changes, the updated Policy will be posted here and the revision date will be updated. You are encouraged to refer back to ensure you are familiar with our most recent Policy updates.

For Prior Versions of this Policy, see below:

O. Contact Us

If you have questions or concerns about this privacy policy, you may contact us at:

Legal Department
B & H Foto & Electronics Corp.
440 Ninth Avenue
New York, New York 10001
Phone: +1 800.947.9915
Email: [email protected]
Web: www.bhphotovideo.com

P. Personal Information Privacy Chart

This section summarizes how B&H processes Personal Information in accordance with California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, “CCPA”), The terms used in this section shall have the same meanings as given to them under the CCPA. Definitions for each legal category are in italic as examples only. To understand the specific information that is shared for each purpose, please review The Data We Collect From You And How We Use It section, or contact us using the Contact Us section. Please note: we do not sell or share Personal Information of minors under the age of sixteen (16).

In the last 12 months, we have processed, shared and sold the following categories of Personal Information, where we have a legitimate interest, legal obligation or consent for processing:

* We may also collect your information to comply with laws or regulations or with legal requests that don't fit into one of the categories we've described for you.