top of page
Green Book Alliance - Privacy Policy

This Privacy Policy is effective as of June 15, 2026.

The Green Book Alliance (“GBA”, “we”, “our”, “us”) is an initiative formed in 2020 by BookNet Canada (“BookNet”), the Book Industry Study Group, Inc. (“BISG”), and Book Industry Communication Ltd (“BIC”) to advance environmental sustainability in the book industry. We respect your privacy and are committed to protecting it through our compliance with this privacy policy (the “Privacy Policy”). This means we do not transfer, distribute, disclose, rent or sell any of your personal information to third parties except as provided for in this Privacy Policy or as specifically consented by you. We collect only the Personal Information reasonably necessary for the purposes identified, in line with applicable Data Protection Laws (as defined below).​

Scope

This Privacy Policy applies to all personal information (“Personal Information”) collected, used or disclosed when you visit the Green Book Alliance website or any related websites operated by or on behalf of the GBA (collectively, the “Site”.) The Site is hosted and operated by BookNet Canada from servers located in Canada.

By using our Site and/or Services and providing us with your Personal Information, you expressly consent to our collection, use, disclosure, and transfer of your Personal Information in accordance with this Privacy Policy. If you do not agree with any terms of this Privacy Policy, please do not use our Site or our Services or provide us with any Personal Information.​

Accountability

BookNet Canada is responsible for the day-to-day operation of the Site and Services and acts as the primary custodian of Personal Information under our possession and control. BookNet has designated a Privacy Officer to be responsible for compliance with this Privacy Policy and applicable privacy legislation. The GBA will make known, upon request, the title of the person or persons designated to oversee compliance with this Privacy Policy.

​

For the purposes of the EU General Data Protection Regulation (“GDPR”) and the UK General Data Protection Regulation (“UK GDPR”), BookNet Canada acts as the data controller for Personal Information processed through the Site and Services. BISG and BIC are partner organizations in the GBA initiative but do not independently determine the purposes and means of processing Personal Information collected through the Site. BookNet is responsible for Personal Information in its possession or custody, including information that has been transferred to a third party for processing. BookNet shall use contractual or other means to provide a comparable level of protection while the information is being processed by a third party.

BookNet shall implement policies and practices to give effect to these principles, including:

  • implementing procedures to protect Personal Information;

  • implementing an internal process to receive and respond to complaints and inquiries relating to this Privacy Policy; and

  • training staff and communicating to staff information about the organization’s policies and practices.

Definitions

To better understand this Privacy Policy, the GBA has set out some basic definitions to use when reading and interpreting it.

Collection: the act of gathering, acquiring, recording, or obtaining Personal Information from any source, including third parties, by any means.

Canadian Privacy Laws: means the Personal Information Protection and Electronic Documents Act (Canada) ("PIPEDA") and any other applicable federal or provincial privacy legislation, including, without limitation, the Personal Information Protection Act (Alberta), the Personal Information Protection Act (British Columbia) and An Act respecting the protection of personal information in the private sector (Quebec Law 25), as amended from time to time.

Consent: voluntary agreement to the collection, use and disclosure of Personal Information for defined purposes. Consent can be either express or implied. Express consent can be given orally, electronically or in writing, but is always unequivocal and does not require any inference on the part of the GBA. Implied consent is consent that can reasonably be inferred from the circumstances or from an individual’s action or inaction.

Data Protection Laws: means the Canadian Privacy Laws, the EU General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”), the UK General Data Protection Regulation and the UK Data Protection Act 2018 (“UK GDPR”), and any other applicable data protection or privacy laws in the jurisdictions from which the Site is accessed.

Disclosure: making Personal Information available to a third party for that party’s own use.

Personal Information: means information, recorded in any form, which identifies an individual or that could be used to identify an individual (referred to as “personal data” under the GDPR and UK GDPR), but does not include aggregated or de-identified information that cannot be associated with an individual.

Transfer: making Personal Information available to a third party for processing, storage or otherwise, solely to be used on behalf of the GBA.

Use: the treatment, handling, and management of Personal Information by and within the GBA.

What Personal Information Do We Collect?

We collect your Personal Information when you voluntarily provide it to us by using our Site or Services. We collect only the Personal Information reasonably necessary for the purposes identified, in line with applicable Data Protection Laws. For example, we may collect Personal Information if you:

  • use our Site and our Services;

  • create an account on our Site;

  • send us a question or comment by email;

  • contact us by phone or visit our office;

  • subscribe to newsletters or mailing lists; or

  • otherwise participate in features of our Site that ask for Personal Information.

Personal Information that we collect includes, but is not limited to:

  • Technical Data: IP address, browser type, operating system, device information, and other technical connection data collected automatically when you use the Site.

  • Usage Data: user activity such as pages visited, clicks, scrolling information, and how you interact with the Site features.

  • Other Information: we may also collect Personal Information from service requests, inquiries, event registrations, and survey responses.

How Do We Use Your Personal Information?

We will only use the Personal Information that we collect for the purpose for which it was collected and only as permitted by applicable Data Protection Laws. Where the GDPR or UK GDPR applies, we will process your Personal Information only where we have a lawful basis to do so. We use your Personal Information for the following purposes:

  • to communicate with you regarding the Services, or to respond to any correspondence you may direct to us;

  • to understand, research, and improve our Services;

  • for operational purposes including hosting, customer support, maintenance, and security management;

  • to enforce our Terms and other service agreements;

  • to provide you with system or administrative messages;

  • to meet legal and regulatory requirements; and

  • for any other reasonable purposes for which you may have provided your express consent or in which your consent can be reasonably implied.

How Long Will We Retain Your Personal Information?

We retain Personal Information as long as necessary for the purposes described and as required by applicable Data Protection Laws. We maintain retention schedules and securely delete or anonymize information once no longer needed. Account data is retained while your account remains active and for a reasonable period thereafter. If you request deletion of your account, we will delete or anonymize your Personal Information within a reasonable period, subject to any legal obligations requiring retention.

Legal Basis for Processing (EEA and UK Users)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your Personal Information only where we have a lawful basis under the GDPR or UK GDPR. The lawful bases we rely on include:

Contract: Processing necessary for the performance of our contract with you, including maintaining your account (GDPR Article 6(1)(b)).

Legitimate Interests: Processing necessary for our legitimate interests, including operating and improving the Site, ensuring security, conducting de-identified analytics, and managing the GBA initiative, provided these interests are not overridden by your rights and freedoms (GDPR Article 6(1)(f)).

Consent: Where we rely on your consent for specific processing activities (such as non-essential cookies or marketing communications), you may withdraw your consent at any time by contacting us or using the mechanisms provided (GDPR Article 6(1)(a)).

Legal Obligation: Processing necessary to comply with a legal obligation to which we are subject (GDPR Article 6(1)(c)).

Consent

We respect your privacy and, unless otherwise required or permitted by law, we will not collect, use, or disclose your Personal Information without an appropriate legal basis. Under Canadian Privacy Laws, we rely on consent (express or implied) unless an exception applies. Under the GDPR and UK GDPR, we process Personal Information on the lawful bases described above. Your Personal Information will only be used for the purposes for which it was collected or in accordance with applicable laws. From time to time, we may wish to use Personal Information for new or additional purposes, in which case we will obtain your consent or establish another lawful basis as required.

Under Canadian Privacy Laws, you may expressly give your consent in writing, verbally or through any electronic means. In certain circumstances, your consent may be implied by your actions. For example, providing us Personal Information to register for our Services is implied consent to use such information to provide you the associated services. The form of consent (express or implied) will be determined in accordance with Canadian Privacy Laws, taking into account the sensitivity of the information and reasonable expectations.

In certain circumstances, consent with respect to use or disclosure may be sought after the information has been collected, but before use (for example, when we want to use information for a purpose other than those identified above).

Subject to legal and contractual requirements, you may refuse or withdraw your consent to certain of the purposes identified in this Privacy Policy at any time by contacting us at the contact information set forth below. If you refuse or withdraw your consent, you acknowledge that we may not be able to provide you or continue to provide you with certain services or information which may be of value to you. For EEA and UK residents, where processing is based on consent, you have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Automated Decision Making

Presently the GBA does not use Personal Information to render a decision based exclusively on automated processing. If in future we do, we will inform you at the time we communicate the decision. Upon request, we will provide: (1) the Personal Information used to render the decision; (2) the reasons and principal factors and parameters that led to the decision; and (3) your right to have the Personal Information used to be corrected. If and when we implement automated decision making, we will provide notices and enable rights as required by applicable Data Protection Laws (including the right not to be subject to a decision based solely on automated processing under GDPR Article 22, and information about the logic involved and how to contest the decision). To exercise these rights, you may contact our Privacy Office at the contact information below.

Limiting Collection

When collecting Personal Information, we will limit the collection of Personal Information to that which is necessary to fulfill the purposes identified in this Privacy Policy. We limit collection to what is necessary for identified purposes in compliance with applicable Data Protection Laws, including the data minimization principle under the GDPR. We will be open and transparent about the information that is being collected by communicating the purpose of collection.

Do We Disclose or Transfer Your Personal Information to Others?

We will maintain the strict confidentiality of all Personal Information collected and will not sell, transfer or otherwise disclose any of your Personal Information to any third party without your knowledge and an appropriate legal basis except for purposes outlined in this Privacy Policy. Any disclosure or transfer will be made in accordance with applicable Data Protection Laws.

We may share your Personal Information with the following categories of recipients:

  • GBA Partner Organizations: BookNet Canada, BISG, and BIC collaborate on the GBA initiative. Personal Information may be shared among these partners to the extent necessary for the operation and improvement of the Services, subject to appropriate data protection agreements;

  • service providers we contract with to develop, host, and deliver the Site and Services, including cloud hosting, analytics, and information technology services; and

  • service providers that assist with our operations, including customer support, data analysis, email communications, and security services.

We enter into written agreements with service providers and partner organizations that include privacy and security obligations required by applicable Data Protection Laws, including (where applicable) standard contractual clauses or other approved transfer mechanisms under the GDPR. Only authorized personnel with a business need to know are granted access to Personal Information. All such personnel are required to respect the confidentiality of your Personal Information.

We may also disclose your Personal Information in the event we sell or transfer all or a portion of our business or assets (including corporate reorganization, merger or amalgamation with another entity, dissolution or liquidation). We will safeguard Personal Information and limit use/disclosure to evaluating or completing the transaction as required by Canadian Privacy Laws.

From time to time, we may disclose your Personal Information to third parties under the following limited circumstances:

  • when necessary to protect our safety, property or other rights, our representatives, customers and users of our products and services, including to detect and prevent fraud;

  • with your consent; or

  • when otherwise required or permitted by law.

Law Enforcement Requests and Legal Process

We are committed to protecting the privacy and security of Personal Information while complying with applicable laws. We will disclose Personal Information without notice to the individual if we receive a valid order, subpoena, warrant, or other legal requirement issued by a court, tribunal, regulator, or other person or body with lawful authority to compel disclosure. We will review the request to confirm it appears facially valid and limited to information within the scope of the authority cited, and we will produce responsive information to the extent required by law. We will limit any disclosure to the scope of the request and applicable law, applying data minimization principles. Where permitted by law, we will request that authorities narrow or clarify overbroad, vague, or unduly burdensome requests. We will maintain internal records of requests received, our evaluation of legal authority and scope, the information disclosed, and any steps taken to narrow or challenge the request. Where permitted and appropriate, we may notify affected individuals of a request for their Personal Information, for example where we are not legally prohibited from doing so and where notification would not create a risk of harm or prejudice to an investigation. In circumstances where a legal prohibition (such as a non-disclosure order) applies, or where notice could pose a risk of harm or compromise an investigation, we will not provide notice until such prohibition is lifted or the risk has passed. Where we believe a request is invalid, overbroad, or otherwise inappropriate, we may seek to narrow its scope, request clarification, or challenge the request to the extent available under applicable law. We may also seek protective orders or other safeguards where appropriate. Nothing in this section limits the GBA’s rights or remedies to object to, challenge, or decline any request where permitted by applicable law.

How Do We Protect Your Personal Information?

We protect your Personal Information by security safeguards appropriate to the sensitivity of the information. We maintain technical, physical and administrative security safeguards to safeguard your Personal Information against loss, theft, misuse, unauthorized disclosure and unauthorized access. We will regularly review and update our security measures to address new and emerging threats and ensure that third parties to whom we disclose personal information have adequate safeguards in place.

The methods of protection for Personal Information may include:

  • maintaining Personal Information in secure data storage to safeguard it from unauthorized access, use or disclosure;

  • implementing industry-standard technical security measures, such as firewalls and intrusion detection systems;

  • limiting access to Personal Information to authorized personnel on a need-to-know basis through the use of passwords and other access controls;

  • the use of pseudonymization and encryption of Personal Information, where appropriate;

  • implementing measures to help ensure the ongoing confidentiality, integrity, and availability of systems and services;

  • a process for regularly testing, assessing, and evaluating the effectiveness of security measures;

  • providing ongoing security awareness training for employees; and

  • conducting regular security vulnerability and penetration testing.

Unfortunately, no data transmission over the Internet can be guaranteed to be 100% secure. As a result, while we are committed to protecting your Personal Information, we cannot ensure or warrant the security of any information you provide to us.

We maintain breach detection, assessment, record-keeping, and notification procedures to meet our obligations under Canadian Privacy Laws and other applicable Data Protection Laws.

International Data Transfers

The Site is hosted on servers located in data centres operating globally, operated by BookNet Canada. Because the GBA is an international initiative with partners in Canada, the United States, and the United Kingdom, and because the Site is accessible globally, Personal Information may be transferred to or accessed from jurisdictions outside your country of residence. Specifically, Personal Information may be accessed by BISG in the United States or BIC in the United Kingdom in connection with the GBA initiative. We may also use service providers located in other jurisdictions. Where we transfer Personal Information internationally, we do so in compliance with applicable Data Protection Laws. For transfers from the EEA or the United Kingdom to countries not deemed to provide an adequate level of data protection, we implement appropriate safeguards such as standard contractual clauses approved by the European Commission or the UK Information Commissioner’s Office, or other lawful transfer mechanisms. We assess foreign processing risks and implement contractual, technical, and organizational measures to ensure a level of protection that is appropriate. For Quebec transfers, we conduct a transfer impact assessment as required by Canadian Privacy Laws.

Do We Collect Non-Identifiable and Aggregated Information and How Do We Use It?

Non-identifiable and aggregated information is data and information that is aggregated or anonymized in such a manner that it cannot be connected to an individual. We create and use de-identified or anonymized data in accordance with applicable Data Protection Laws, and we take steps to prevent re-identification. User-level data (such as IP addresses) will not be displayed to other users and individual data is not exposed publicly. We may disclose aggregated and non-identifiable information to GBA partners and third parties that provide services for us. In some instances, we may collect non-identifiable data through cookies, as described below.

Your Rights

You have the right to access and correct your personal information under applicable Data Protection Laws. To do so, please contact our Privacy Officer using the contact information provided in this policy. You can also file a complaint if you believe your information is not being handled properly. We will need to verify your identity before providing you with the Personal Information we hold about you and we will respond within the time periods provided for under applicable laws. There is no cost for such access request unless you require copies of records.

In certain circumstances, we may not be able to provide you with access to your Personal Information if the information cannot be separated from the Personal Information of others, cannot be disclosed for reasons of security or commercial confidentiality, or is protected by legal privilege. If we cannot provide you with access to your Personal Information, we will advise you of the reasons access is being denied, unless we are prohibited by law from doing so.

You may request to update and change your Personal Information either directly through your account or by contacting us at the contact information set forth below. We shall endeavor to correct or complete any Personal Information that you advise us is inaccurate or incomplete. Where appropriate, the amended information shall be transmitted to third parties having access to such information.

An individual will be able to address a challenge concerning compliance with this Privacy Policy to the GBA Privacy Office at BookNet Canada.

We will maintain procedures for addressing and responding to all inquiries or complaints about handling of Personal Information. We shall investigate all complaints. All inquiries or complaints involving handling of Personal Information or compliance with this Privacy Policy shall be directed to our Privacy Office.

We will respond within timelines required by applicable Data Protection Laws and will provide reasons where access is restricted, as permitted by law. We handle complaints in accordance with applicable Data Protection Laws and maintain procedures to respond to inquiries and regulatory requests. If we find a complaint to be justified, we will take appropriate measures, including, if necessary, amending our policies and procedures.

Where required by Canadian Privacy Laws (for example, in Quebec), you may have additional rights such as to request cessation of dissemination, de-indexing, or re-indexing in certain circumstances.

Additional Rights for EEA and UK Residents

If you are located in the EEA or the United Kingdom, you have the following additional rights under the GDPR and UK GDPR, subject to certain conditions and exceptions:

Right of Access: You have the right to request a copy of the Personal Information we hold about you (GDPR Article 15).

Right to Rectification: You have the right to request correction of inaccurate Personal Information (GDPR Article 16).

Right to Erasure: You have the right to request deletion of your Personal Information in certain circumstances (GDPR Article 17).

Right to Restriction of Processing: You have the right to request that we restrict the processing of your Personal Information in certain circumstances (GDPR Article 18).

Right to Data Portability: You have the right to receive your Personal Information in a structured, commonly used and machine-readable format and to transmit it to another controller (GDPR Article 20).

Right to Object: You have the right to object to processing based on legitimate interests or for direct marketing purposes (GDPR Article 21).

Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority. For UK residents, this is the Information Commissioner’s Office (ICO) at https://ico.org.uk/make-a-complaint/. For EEA residents, you may contact your local data protection authority.

To exercise any of these rights, please contact our Privacy Office using the contact details below. We will respond to your request within one month (or such other period as required by applicable law) and will not charge a fee unless your request is manifestly unfounded or excessive.

For more information, or to exercise your rights, please contact the GBA Privacy Office as follows:

Privacy Officer, Green Book Alliance c/o BookNet Canada#440-455 Danforth Avenue, Toronto, ON M4K 1P1E-mail: info@greenbookalliance.org

Links to Other Sites

The Site may contain links to other sites that are independently owned and operated by third parties. These other sites may have their own privacy policies and are not governed by this Privacy Policy. We are not responsible for the privacy practices, or the content of any sites owned and operated by any third parties. Other sites may collect and treat information collected differently, so we encourage you to carefully read and review the privacy policy of each site you visit.

Cookies, Web Beacons and Other Similar Technologies

As you interact with the Site, we may use automatic data collection technology and services that record and collect information that identifies your computer, tracks your use of this Site, and collects certain other information about you and your surfing habits. This data collection technology may include cookies, web beacons and other similar devices on this Site to enhance functionality and navigation for our visitors.

Our use of cookies and similar technologies complies with Canadian Privacy Laws and other applicable Data Protection Laws. Where required, we obtain consent for non-essential cookies and provide mechanisms to withdraw consent.

A cookie is a small data file that is placed on the hard drive of your computer so that your computer will “remember” information when you visit a site. Web beacons and tags are small strings of code that are used in conjunction with a cookie and allow us to record activity on our Site. Internet tags, graphic tags and similar web beacon type functions allow us to count the number of users who have visited a particular web page or to access certain cookies. We may use web beacons on this Site to count users and to recognize users by accessing our cookies. Being able to access our cookies allows us to personalize this Site and improve your experience at this Site. We may also include web beacons in HTML-formatted email messages that we send to determine which email messages were opened.

Information tracked through these mechanisms include: (i) your IP address; (ii) the type of web browser and operating system being used; (iii) the pages of the Site a user visits; and (iv) other sites a user visited before visiting this Site.

You can reject or disable cookies by managing your browser settings and following the directions provided in your Internet provider’s help file. Please note that if you disable cookies, you may be unable to access some customized features on this Site. Cookies and web beacons do not collect or contain your Personal Information.

We implement measures consistent with Canadian Privacy Laws to limit tracking, respect browser/device settings where applicable, and de-identify analytics data where feasible

Google Analytics

Our Site uses Google Analytics, a web analytics service of Google, Inc. ("Google"), or comparable technology. Google Analytics uses cookies to analyze how you use our Site. The information generated by the cookie about your use of our Site (including your IP address) is sent to a Google server in the U.S. and stored there. Google will use this information to evaluate your use of our Site, compile reports on Site activity for our Site operators and to provide other site activity related to internet services. Additionally, Google may transfer this information to a third party when required by law or in the case of a third-party processing information on Google's behalf. In no case will Google use your IP address in connection with any other information held by Google. You can set your internet browser to prohibit the installation of cookies, although we must point out that some features and functions of our Site will then be unusable. By using our Site, you consent to the processing of data about you collected by Google in the manner described and for the above-mentioned purpose. The consent for collection and storage of data can be withdrawn at any time in the future by clicking on the following link: https://tools.google.com/dlpage/gaoptout?hl=en.

Our deployment of analytics is conducted in accordance with Canadian Privacy Laws and other applicable Data Protection Laws, including appropriate IP handling, configuration, and consent where required.

Children’s Privacy

We do not knowingly collect Personal Information from children. Where consent of a parent or person with parental authority is required under applicable Data Protection Laws, we will obtain it before collection.

Email Communications

We send electronic messages in compliance with Canadian Privacy Laws (including CASL) and other Data Protection Laws where applicable.

We will ensure that each email includes an opt-out feature and instructions on how to unsubscribe if you no longer wish to receive future emails from us. You can unsubscribe using the link included in the email or electronic message, or by using the contact information set forth below. If we do not have consent, express or implied, to send you commercial electronic messages, we will only communicate with you for the limited purposes permitted under CASL.

You may send your unsubscribe requests or any other questions about our electronic communications practices to our Privacy Office at the contact information above.

Privacy Policy Changes

We will update this Privacy Policy from time to time to reflect any changes in regarding how we collect, use, or disclose your Personal Information. We will implement any updates in accordance with Canadian Privacy Laws and other applicable Data Protection Laws, including providing additional notice or seeking consent where required.

We will indicate at the top of this page the date this Privacy Policy was last revised. Your continued access or use of this Site after any such changes constitutes your acceptance of the Privacy Policy as revised and will be binding on you.

bottom of page