Lulu Privacy Policy

1. Data Types and Overview

• Personal Data means data that allows someone to identify or contact you (for example, your name, address, telephone number, and e-mail address) as well as any other non-public information about you that can be associated with or linked to any data that allows the identification of individuals.

• Anonymous Data means data that is not associated with or linked to your Personal Data. Anonymous Data does not, by itself, permit the identification of individual people. We collect Personal Data and Anonymous Data, as described below.  We collect and use both Personal Data and Anonymous Data about users to (i) provide, measure, and improve the Services, (ii) communicate with you about your Account (as defined below) or transactions, (iii) send you information about changes to the Services or our policies, (iv) send you offers and promotions, (v) personalize content for you on the Services, (vi) detect, investigate and prevent activities that may violate our policies or applicable law, and (vii) as otherwise described in this Policy.

2. Information We Collect and How We Collect It

We may collect a variety of Personal Data from or about you or your devices when you interact with our Site. The Personal Data that we collect depends on the context of your interactions with us and the Site, the choices you make, and the Services you use.

• Information You Provide to Us You may need to provide certain Personal Data to use select Services, such as when you create a user account (an “Account”). When you create or update an Account, you must provide Personal Data that lets us contact you and deliver items purchased through the paid professional services. When you place an order, we collect financial details such as your bank account number and/or credit card number that allow us or our third-party service providers to process payments (“Financial Information”). In addition, we may collect the following information in connection with the Services and Site:

  • Contact and demographic information, including name, company name, address, email address, phone number, and other contact or demographic information you provide to us.

  • Account username and password.

  • Financial Information, as described above.

  • Any other content and information you elect to provide to us through the Site or emails, or other communications sent to us.

  • If you tell us where you are (e.g., by allowing your mobile device to send us your location), we may store and use that information to provide you with location-based information. This feature may be deactivated in the location settings of your device. 

  • After you establish an account, our Site lets you store preferences like how your content is displayed, your location, and safe search settings. As more fully described in our Terms & Conditions, we may associate these choices with your ID, browser, or mobile device. 

  • We retain information on your behalf, such as content submitted via the Services in connection with an order, the creation of content, or the distribution of content. 

  • If you provide us feedback or contact us via e-mail, we will collect your name and e-mail address, as well as any other content included in the e-mail, in order to reply. 

  • If we provide the ability to post messages to the Site (i.e., a forum), the information in your posting will be stored on our servers, and other users will be able to see it. 

  • We also collect other types of Personal Data that you may provide to us voluntarily in connection with support for the Services, such as your operating system and version, and mobile device or computer type. 

  • If you participate in a survey, contest, or giveaway on our Site, we may ask for your e-mail address and/or phone number (to notify you if you win or not). We may also ask for first and last names, and sometimes post office addresses, to verify your identity or to send prizes. Surveys and contests are voluntary, and you should read the rules for each contest that you enter. 

  • We may also collect Personal Data at other points during your use of our Site or Services when we inform you that Personal Data is being collected.

  • We use cookies to help keep track of items you put into your shopping cart, including when you have abandoned it. This information is used to determine when to send cart reminder messages via SMS to U.S. residents.

• Information Collected Automatically We may use standard online and mobile technologies to perform and improve the Services, and in some cases, these technologies may collect additional information about you, such as device identifiers like IP addresses, operating system and browser information, usage data, pages visited, referring URLs, links you click on, video viewing history, or other information that identifies you as having accessed specific video content. Additional information includes:

  • Information Collected by Our Servers To make our Site and Services more useful to you, our servers (which may be hosted by a third-party service provider) collect information from you, including your browser type, operating system, Internet Protocol (“IP”) address (a number that is automatically assigned to your computer when you use the Internet, which may vary from session to session), domain name, and/or a date/time stamp for your visit. 

  • Log Files As is true of most websites, we gather certain information automatically and store it in log files. This information includes IP addresses, browser type, Internet service provider (“ISP”), referring/exit pages, operating system, date/time stamp, and clickstream data. We use this information to analyze trends, administer the Services, track users’ movements around the Site, gather demographic information about our user base as a whole, and better tailor our Services to our users’ needs. For example, some of the information may be collected so that when you visit the Site or the Services again, it will recognize you, and the information could then be used to serve information more appropriate to your interests. Except as noted in this Policy, we do not link this automatically-collected data to Personal Data. 

  • Cookies “Cookies” are small pieces of information that a website sends to your computer’s hard drive while you are viewing the website. We may use both session Cookies (which expire once you close your web browser) and persistent Cookies (which stay on your computer until you delete them) to provide you with a more personal and interactive experience of the Services. 

  • Pixel Tags In addition, we use “Pixel Tags” (also referred to as clear Gifs, Web beacons, or Web bugs). Pixel Tags are tiny graphic images with a unique identifier, similar in function to Cookies, that track online movements of web users. In contrast to Cookies, Pixel Tags are embedded invisibly in Web pages and not stored on a user’s computer. Pixel Tags also let us send e-mail messages in a format users can read, and tell us whether e-mails have been opened to ensure that we are sending only messages that are of interest to our users. We do not tie the information gathered by Pixel Tags to our users’ Personal Data. 

  • Flash LSOs When we post videos, third parties may use local shared objects, known as “Flash Cookies,” to store your preferences for volume control or to personalize certain video features. Flash Cookies are different from browser Cookies because of the amount and type of data, and how the data is stored. Cookie management tools provided by your browser will not remove Flash Cookies. 

  • How We Respond to Do Not Track Signals Users may use the Lulu Privacy Setting tool to customize the amount of data that they will allow Lulu to collect when the User is accessing Lulu’s Site(s) or Services. While some browsers include a “Do Not Track” (DNT) setting, our Sites do not currently respond to browser DNT signals.

  • Universal Opt-Out Mechanism You may also interact with our Site using a universal opt-out mechanism, such as the Global Privacy Control, which allows users to send a signal that will communicate the user’s request to opt out of the sale or sharing of their Personal Data at the browser level. If we detect and recognize such a signal from your device or browser, we will honor it.

  • Analytics Services Other companies may set their own cookies or similar tools when you visit our Site or use the Services. This includes third-party analytics services that we engage to help analyze how users use the Services. We may receive reports based on these parties’ use of these tools on an individual or aggregate basis. We use the information we get from Analytics Services only to improve our Site and Services. The information generated by the Cookies or other technologies about your use of our Site and Services (the “Analytics Information”) is transmitted to the Analytics Services, which use Analytics Information to compile reports on user activity. The Analytics Services may also transfer information to third parties where required to do so by law, or where such third parties process Analytics Information on their behalf. Each Analytics Services’ ability to use and share Analytics Information is restricted by such Analytics Services’ Terms of Use and Privacy Policy. By using our Site and Services, you consent to the processing of data about you by Analytics Services in the manner and for the purposes set out above. For a full list of Analytics Services, please contact us at [email protected].

• Information Collected from Third Parties We may receive Personal and/or Anonymous Data about you from companies that provide our Services by way of a co-branded or private-labeled Site or companies that offer their products and/or services on our Site. We may add this information to the information we have already collected from you as described in this Policy in order to improve the Services.

3. Use and Disclosure of Personal Data

• General Personal Data you submit to us is typically used either to provide the Services, respond to requests that you or your customers make, or help us better serve you and your customers. We use your Personal Data in the following ways: 

  • facilitate the creation of and secure your Account;

  • identify you as a user in our system;

  • provide improved administration of our Site and Services;

  • provide the Services you request;

  • improve the quality of experience when you interact with our Site and Services;

  • send you a welcome e-mail to verify ownership of the e-mail address provided when you create your Account;

  • send you administrative e-mail notifications, such as security or support and maintenance advisories, as well as order and shipping confirmations;

  • send newsletters, surveys, offers, and other promotional materials related to our Services.

• User Testimonials and Feedback; Forums

  • We often receive testimonials and comments from users who have had positive experiences with our Services. We occasionally publish such content. When we do so, we may identify our users by their first and last name and indicate their home city, but we will obtain the user’s consent prior to posting this information with the testimonial. We may post user feedback with a first name and last initial, or an Account handle that does not allow identification of the user, without obtaining advance consent. When you provide Feedback with respect to the Services, you consent to our using such Feedback and identifying it, as described in this section. 

  • If you make any comments on a blog or forum associated with our Site, you should be aware that any Personal Data you submit there can be read, collected, or used by other users of these forums, and could be used to send you unsolicited messages. Even if you later delete the information, it may have been saved by other users on their computers, and deleting the post will not affect any such other copies of the information. We are not responsible for the Personal Data you choose to submit in these blogs and forums.

• Creation of Anonymous Data

  • We may create Anonymous Data records from Personal Data by removing information that makes the data personally identifiable to you. We use this Anonymous Data to analyze request and usage patterns so that we may improve the Services and improve Site navigation. We may use Anonymous Data and aggregated and other de-identifiable information for any purpose and disclose Anonymous Data to third parties in our sole discretion.

• Disclosure of Personal Data

  • Third-Party Service Providers We may disclose your Personal Data to third-party service providers to: provide you with the Services that we offer you through our Site; to conduct quality assurance testing; to facilitate creation of Accounts; to provide technical support; to perform ad measurements and retargeting; and/or to provide other services to Lulu. These third-party service providers are required not to use your Personal Data other than to provide the services requested by Lulu. 

  • Affiliates We may disclose some or all of your Personal Data to our parent company, subsidiaries, joint ventures, or other companies under a common control (“Affiliates”), in which case we will require our Affiliates to honor this Policy. 

  • Corporate Restructuring We may disclose some or all of your Personal Data in connection with or during negotiation of any merger, financing, acquisition, or dissolution transaction or proceeding involving sale, transfer, divestiture, or disclosure of all or a portion of our business or assets. In the event of an insolvency, bankruptcy, or receivership, Personal Data may also be transferred as a business asset. If another company acquires our company, business, or assets, that company will possess the Personal Data collected by us and will assume the rights and obligations regarding your Personal Data as described in this Policy. 

  • Other Disclosures Regardless of any choices you make regarding your Personal Data (as described below), we may disclose Personal Data if we believe in good faith that such disclosure is necessary (i) in connection with any legal investigation; (ii) to comply with relevant laws or to respond to subpoenas or warrants served on Company; (iii) to protect or defend the rights or property of Company or users of the Site or Services; and/or (iv) to investigate or assist in preventing any violation or potential violation of the law, this Privacy Policy, or our Terms & Conditions.

  • To parties and networks that provide online tracking technologies that we may use to conduct internal analytics relative to the use of the Site, and as described above.

  • The above excludes text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Lulu does not sell your information, though we may share it for specific marketing purposes through our third-party providers. You may request that we not share your information with any third-party service providers at any time by contacting us below.

4. Protecting Your Personal Data

We use commercially reasonable administrative, physical, and technical measures designed to protect your Personal Data from accidental loss or destruction and from unauthorized access, use, alteration, and disclosure. However, no website, mobile application, system, electronic storage, or online service is completely secure, and we cannot guarantee the security of your personal information transmitted to, through, using, or in connection with the Site. In particular, email, texts, and chats sent to or from the Site may not be secure, and you should carefully decide what information you send to us via such communications channels. Any transmission of personal information is at your own risk.

For online payments and/or Automated Clearing House (ACH) payouts, we use the payment services of Adyen B.V. (https://www.adyen.com) and PayPal Holdings, Inc. (https://www.paypal.com). We do not process, record, or maintain your credit card or bank account information. For more information on how payments are handled, or to understand the data security and privacy afforded to such information, please refer to https://www.adyen.com/policies-and-disclaimer/privacy-policy and https://www.paypal.com/us/webapps/mpp/ua/privacy-full.

Lulu is designed to give you the ability to control who may access the Content and any associated information stored in your Lulu account. We seek not to make your Content publicly accessible, except by your explicit action, or as otherwise noted in this Privacy Policy.

In order to provide quality products, the Lulu employees and third-party service providers fulfilling your order or providing Customer Support need to have access to your Content.

5. Third-Party Websites

Our Site and Services may contain links to third-party websites. The links to third-party websites or locations are for your convenience and do not signify our endorsement of such third parties or their products, content, or websites. When you click on a link to any other website, you will leave our Site or Services and go to another Site, and another entity may collect Personal Data from or about you. We have no control over, do not review, and cannot be responsible for these outside websites, their content, or their practices. This Policy does not apply to these outside websites. We encourage you to read the privacy policies of every website you visit, as their practices may differ from ours.

6. Your Choices

You may have several choices regarding your Personal Data. You may choose not to provide the Personal Data we request. However, not providing the information we request may restrict your ability to use certain features of our Site. For example, we will not be able to respond to your inquiries if you do not provide us with your contact information. In addition: 

• Email Communications.  We may periodically send you newsletters and e-mails that promote our Site or Services. When you receive newsletters or promotional communications from us, you may indicate a preference to stop receiving further communications from us, and you will have the opportunity to “opt-out” by following the unsubscribe instructions provided in the e-mail you receive or updating your preferences in your Account Profile pages of the Site(s). Despite your indicated e-mail preferences, we may send you service-related communications, including notices of any updates to our Terms & Conditions or this Policy, via the email address associated with your Account. 

• Cookies.  If you decide at any time that you no longer wish to accept Cookies from our Service, you can instruct your browser, by changing its settings, to stop accepting Cookies or to prompt you before accepting a Cookie from the websites you visit. Consult your browser’s technical information. If you do not accept Cookies, however, you may not be able to use all portions of the Services or all functionality of the Services. If you have any questions about how to disable or modify Cookies, please let us know at [email protected].

• Accessing, Correcting, or Deleting Your Personal Data. All users may review, update, correct or delete the Personal Data in their Account via the “My Account” page within the Services. If you completely delete all of your Personal Data, then your Account may be deactivated. We will use commercially reasonable efforts to honor your request. We may retain an archived copy of your records as required by law or for legitimate business purposes.

Depending on your state or country of residence, you may have certain additional rights related to your Personal Data, including:

• Access and Data Portability. You may confirm whether we process your Personal Data and request a copy of the Personal Data we process. To the extent feasible and required by law, information will be provided in a portable format.

• Right to Correct Inaccuracies. You may request that we correct inaccuracies in your Personal Data that we maintain, taking into account the nature of the information and processing purpose.

• Right to Delete Personal Data. You may request that we delete Personal Data about you that we maintain, subject to certain exceptions under applicable law.

• Opt Out of Using Personal Data for Targeted Advertising, Profiling, and Sales. If applicable, you may request that we not use your Personal Data for these purposes.

Important: The exact scope or existence of these rights varies by jurisdiction. There are also several exceptions where we may not have an obligation to fulfill your request. We will not discriminate against you in response to any privacy requests you make. 

In order to ensure that a request is genuine, we may need to take steps to verify your identity or the identity of an agent making a request on your behalf.

To exercise any of these rights, please email us at [email protected].

If you are located in the European Economic Area (EEA), Switzerland, or the United Kingdom (UK), the GDPR Addendum, below, includes additional information about our practices and your rights.

7. Our Policy Towards Children

The Service is not intended for children under the age of 16, and we do not knowingly collect Personal Data from children under the age of 16. If you become aware that we may have Personal Data of a child under the age of 16, please contact us at [email protected]. If we become aware that a child under the age of 16 has provided us with Personal Data without verification of parental consent, we will take steps to remove such information and terminate the associated Account. 

Do not register at a Lulu Press, Inc. Site or for a Lulu Service if you are under the age of 16. If you require the use of the Lulu Site(s) or Services and are under the age of 16, a Legal Guardian must create your Lulu Account or sign up for Lulu Services.

8. Changes to this Policy

This Policy is subject to occasional revision, and if we make any material changes in the way we use your Personal Data, we will notify you by sending you an e-mail to the last e-mail address you provided to us and/or by prominently posting notice of the changes on the Site. Any changes to this Policy will be effective upon the earlier of thirty (30) calendar days following our dispatch of an e-mail notice to you or thirty (30) calendar days following our posting of notice of the changes on our Site. These changes will be effective immediately for new users of our Services.

At all times, you are responsible for updating your Personal Data to provide us with your most current e-mail address. If the last e-mail address that you have provided us is not valid, or for any reason is not capable of delivering to you the notice described above, our dispatch of the e-mail containing such notice will nonetheless constitute effective notice of the changes described in the notice. If you do not wish to permit changes in our use of your Personal Data, you must deactivate your Account prior to the effective date of the changes. Continued use of the Site or Services following notice of such changes will indicate your agreement to be bound by the terms and conditions of such changes. 

9. Jurisdiction

If you are interacting with our Sites from a location outside of the United States, please be aware that your connection will be through and to servers located in the United States. Any information we collect while you are using our Sites will be processed, stored, and transferred in and to the United States or other jurisdictions, which may have different privacy laws that may or may not be as comprehensive as your local law.  By engaging with our Sites, you agree to such processing, storage, and transfer.

10. Contact Information

To exercise your rights, or if you have questions or comments about this Privacy Policy, you may contact us by email at [email protected], by phone at 919-459-5858, or by mail at:

Lulu Press, Inc.

600 Park Offices Drive, Suite 250

Durham, NC 27713

GDPR PRIVACY ADDENDUM: Additional Information for Individuals Located in the EEA, Switzerland, or the UK. 

This GDPR Privacy Addendum (the “GDPR Privacy Addendum”) supplements the information contained in our Privacy Policy and applies solely to the users of Sites who are located in the European Economic Area, Switzerland, or the United Kingdom. We adopt this GDPR Privacy Addendum to comply with the European Union’s General Data Protection Regulation, and any laws implementing the foregoing by any member states in the European Economic Area, the United Kingdom (including the UK Data Protection Act and the UK-GDPR), and/or Switzerland (collectively, the “GDPR”). Unless otherwise defined in this GDPR Privacy Addendum, any terms defined in the GDPR or our Privacy Policy have the same meaning when used in this GDPR Privacy Addendum. When this GDPR Privacy Addendum is applicable to you, it takes precedence over anything contradictory in our Privacy Policy.

If you have any questions about this GDPR Privacy Addendum, including any requests to exercise your legal rights, please contact us using the information set out in the contact details section.

Information We Collect About You and How We Collect It

The Personal Data we collect and the ways in which we collect it are described in our Privacy Policy.

The Personal Data we collect from you is provided with your consent, is required to enter into a contract with us, for us to perform under the contract, and/or to provide you with our Services. If you refuse to provide such Personal Data or withdraw your consent to our processing of Personal Data (when appropriate), then in some cases we may not be able to enter into the contract or fulfill our obligations to you under it.

Lawful Basis for Processing Your Personal Data

GDPR requires us to have a legal basis for collecting and using or otherwise processing your Personal Data. We rely on one or more of the following legal bases:

• Performance of a contract with you: Where we need to perform the contract we are about to enter into or have entered into with you.

• Legitimate interests: We may use your Personal Data where it is necessary to conduct our business and pursue our legitimate interests, for example, to prevent fraud and enable us to give you the best and most secure customer experience. We make sure we consider and balance any potential impact on you and your rights (both positive and negative) before we process your Personal Data for our legitimate interests. We do not use your Personal Data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to do so by law).

• Legal obligation: We may use your Personal Data where it is necessary for compliance with a legal obligation that we are subject to. We will identify the relevant legal obligation when we rely on this legal basis.

• Consent: We rely on consent only where we have obtained your active agreement to use your Personal Data for a specified purpose, for example, if you subscribe to an email newsletter.

Automated Decision Making

We do not currently use your Personal Data with any automated decision-making process or technologies that may produce a legal effect concerning you or similarly significantly affect you, including profiling. Any changes pertaining to the use of Personal Data with automated decision-making will be updated in this GDPR Privacy Addendum and our Privacy Policy.

How We Use Your Information

We use your Personal Data as described in our Privacy Policy. 

Disclosure of Your Information

We do not share or otherwise disclose your Personal Data for purposes other than to the entities and for the purposes described in our Privacy Policy. 

Your Rights Regarding Your Information and Accessing and Correcting Your Information

The GDPR provides you with certain rights with regard to our processing of your Personal Data. These rights replace the similar rights provided in our Privacy Policy or are supplemental to such rights. 

• Access and Update. You may contact us if you wish to review or change any Personal Data we have about you to ensure that it is complete, accurate, and as current as possible. 

• Restrictions. You have the right to restrict our processing of your Personal Data under certain circumstances. In particular, you can request we restrict our use of it if you contest its accuracy, if the processing of your Personal Data is determined to be unlawful, or if we no longer need your Personal Data for processing but we have retained it as permitted by law. 

• Portability. You have the right to request that we provide you a copy of, or access to, all or part of such Personal Data in structured, commonly used, and machine-readable format under certain conditions. You also have the right to request that we transmit this Personal Data to another controller, when technically feasible. 

• Object. You have the right to object to our processing of your Personal Data when the processing is based on our legitimate interests and your objection is not overridden by a compelling legitimate ground. You have the right to object to marketing activities at any time.

• Withdrawal of Consent. To the extent that our processing of your Personal Data is based on your consent, you may withdraw your consent at any time by closing your account. Withdrawing your consent will not, however, affect the lawfulness of the processing based on your consent before its withdrawal, and will not affect the lawfulness of our continued processing that is based on any other lawful basis for processing your Personal Data. 

• Right to be Forgotten. You have the right to request that we delete all of your Personal Data. We cannot delete your Personal Data except by also deleting your user account, and we will only delete your account when we no longer have a lawful basis for processing your Personal Data or after a final determination that your Personal Data was unlawfully processed. We may not accommodate a request to erase information if we believe the deletion would violate any law or legal requirement or cause the information to be incorrect. In addition, we cannot completely delete your Personal Data as some data may rest in previous backups. These will be retained for the periods set forth in our disaster recovery policies. If you delete your User Contributions from the Services, copies of your User Contributions may remain viewable in cached and archived pages, or might have been copied or stored by other users. Proper access and use of information provided through our Services, including User Contributions, is governed by our Terms of Service.

• Complaints. You have the right to lodge a complaint with the applicable supervisory authority in the country you live in, the country you work in, or the country where you believe your rights under applicable data protection laws have been violated. However, before doing so, we request that you contact us directly to give us an opportunity to work directly with you to resolve any concerns about your privacy. 

• How You May Exercise Your Rights. You may exercise any of the above rights by contacting us through any of the methods listed below. If you contact us to exercise any of the foregoing rights, we may ask you for additional information to verify your identity. We reserve the right to limit or deny your request if you have failed to provide sufficient information to verify your identity or to satisfy our legal and business requirements. Please note that if you make unfounded, repetitive, or excessive requests (as determined in our reasonable discretion) to access your Personal Data, you may be charged a fee subject to a maximum set by applicable law. We will aim to respond to your request within thirty (30) days and in accordance with any deadline or extension set forth in applicable law.

• Important: The exact scope of these rights varies depending on where you live and the applicable law. There are also several exceptions, including research-specific exceptions, where we may not have an obligation to fulfill your request. We will not discriminate against you for exercising any of these rights.

Processing of Personal Data In Other Countries Outside the European Economic Area (“EEA”), the United Kingdom (“UK”), and Switzerland

To provide our Services, we may transfer your Personal Data outside of the EEA, the UK, or Switzerland, including to the United States. Accordingly, your Personal Data may be transferred outside the country where you reside or are located, including to countries that may not or do not provide an equivalent level of protection for your Personal Data. When we so transfer your Personal Data, we rely on appropriate data transfer mechanisms, including, as applicable, adequacy decisions or standard contractual clauses. Such processing is conducted pursuant to the lawful bases described above. 

Data Retention 

Unless you request us to delete your Personal Data (subject to the above) earlier, we will retain your Personal Data as set forth in our Privacy Policy.

Changes to This GDPR Privacy Addendum

We may change this GDPR Privacy Addendum at any time. It is our policy to post any changes we make to our GDPR Privacy Addendum on this page. You are responsible for ensuring we have an up-to-date, active, and deliverable email address for you, and for periodically visiting our Services and this GDPR Privacy Addendum to check for any changes.

Contact Information

If you have any questions, concerns, complaints, or suggestions regarding our Privacy Policy or this GDPR Privacy Addendum, have any requests related to your Personal Data described in the Privacy Policy or this GDPR Privacy Addendum, or otherwise need to contact us, you can do so at the contact information below.

Email: [email protected]

Phone: 919-459-5858

Mail: Lulu Press, Inc. 600 Park Offices Drive, Suite 250, Durham, NC 27713, USA