White Duck Outdoors California Privacy Notice

Effective December 12, 2023

This California Privacy Notice (“Notice”) supplements our Privacy Policy and provides information about how we collect, use, and disclose Personal Information of California residents (“you”) pursuant to the California Consumer Privacy Act, as amended (“CCPA”).  It applies to our website, and to information we collect offline. This Notice does not apply to White Duck Outdoors employees or job applicants.  If you fall within one of these groups and have questions about how we use your Personal Information, please contact us as provided below.

Unless otherwise noted, the disclosures contained within this Notice cover our activities in the prior twelve (12) months from the Effective Date as well as our current practices.

We may, from time-to-time, update information in this Notice. The date on which we last updated the Notice is provided above. We encourage you to read this Notice and contact us with any questions.

1. Personal Information We Collect, Use, and Disclose

“Personal information” is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you. Personal information does not include information that is publicly available, de-identified, or aggregated.

We may collect, use, and disclose Personal Information for valid business purposes or in connection with threatened or pending litigation consistent with applicable laws as identified below. Where we disclose applicable Personal Information to recipients, such as our service providers, we do so for the same business purposes described below. These examples may vary depending on the nature of your interactions with us.

Identifiers Personal information described in Cal. Civ. Code § 1798.80(e) Protected classification characteristics under California or federal law Commercial Information Internet or Other Electronic Network Activity Information Geolocation Data Sensory Data Professional or employment-related information Inferences 2. Sources of Personal Information

We collect the Personal Information identified above from the following sources:

• Directly from you. For example, when you purchase products, sign up for news, or otherwise submit information to us.
• Automatically from you. For example, we collect your IP address and usage information when you use our websites, and we collect video of our stores for security purposes.
• From our service providers. For example, from our marketing and advertising vendors, IT providers, and fulfillment services.
• From parties to corporate transactions. As permitted by law, we may receive Personal Information as part of a corporate transaction or proceeding such as a merger, acquisition, bankruptcy, dissolution, transfer, divestiture, or sale of all or a portion of a business or assets.
• Disclosures of Personal Information

We may disclose each of the categories of Personal Information identified above to the respectively identified categories of recipients for operational or business purposes consistent with the purposes for collection or use designated, as is reasonably necessary and proportionate to achieve those purposes, or for another purpose that is compatible with the context in which the Personal Information was collected, including, but not limited to:

• Auditing related to ads;
• Helping to ensure security and integrity;
• Debugging, repairing, and improving functionality;
• Short-term, transient use;
• Performing services on our behalf;
• Providing advertising and marketing services, as applicable;
• Internal research for technological development; and
• Verifying quality and/or safety.

The parties to which we disclose Personal Information for a business purpose include:

• Our service providers. For example, we may share your Personal Information to process or deliver your orders, provide customer service, operate and improve our business, website and apps, improve our products and customer service, help run our promotions and loyalty programs, perform marketing and advertising functions, process payments, perform auditing and quality control, to communicate with you, and to otherwise operate our business.
• As necessary, for the following purposes: (a) to comply with any legal process; (b) to respond to requests from public and government authorities; (c) to enforce our terms and conditions; (d) to protect our operations and protect our rights, privacy, safety or property, and/or that of you or others; and (e) to allow us to pursue available remedies or limit the damages that we may sustain.
• With our insurers and professional advisers. For the purposes of managing risks, obtaining professional advice, exercising or defending against legal claims, etc.
• With other businesses, as permitted. For example, in connection with or during negotiations of any reorganization, acquisition, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceeding).

3. Tracking Technologies

We may use tracking technologies, such as cookies, including tracking technologies managed by vendors or external parties.

Tracking technologies can generally be categorized as follows:

• Necessary or essential. These tracking technologies are used for core functionality, for example for security and to enforce your privacy preferences. Without these cookies, some functionality on our websites and apps may fail.
• Functional or analytics. These tracking technologies help to improve our websites and apps by allowing us to understand how they are used and how they perform. We may also use location-aware technologies for purposes such as verifying your location and delivering or restricting content based on your location.
• Advertising. These tracking technologies help personalize ads that are shown to you on our websites and apps. If enabled, these tracking technologies will allow other parties to engage in advertising based on your use of online services

We may use Google Analytics or other providers for analytics services. We may also implement Google Analytics Advertising Features such as remarketing with analytics and interest-based ads. We may use first-party cookies or other first-party identifiers as well as third-party cookies or other third-party identifiers to, e.g., deliver advertisements, measure your interests, and/or personalize content. For more information on how Google Analytics uses data collected through our services, visit http://www.google.com/policies/privacy/partners. To opt out of Google Analytics cookies, visit https://tools.google.com/dlpage/gaoptout or download the Google Analytics Opt-Out Browser Add-On.

Depending on your device settings, you may also opt out of certain interest-based advertising through the device’s “Limit Ad Tracking” or equivalent feature. Refer to your device for more information on what this opt out affects. For instance, you can adjust or reset the advertising identifiers on your mobile device in the device settings. iOS users can visit Settings > Privacy > Advertising > Reset Advertising Identifier. Android users can visit Google settings > Ads > Reset advertising ID.

4. Data Retention

Except as otherwise permitted or required by applicable law or regulation, we will only retain your Personal Information (which includes the categories of Personal Information set forth in the charts and sections above) for as long as necessary to fulfill the purposes we collected it for, as required to satisfy any legal, obligations, or as necessary to resolve disputes. To determine the appropriate retention period for Personal Information, we consider applicable legal requirements, the amount, nature, and sensitivity of the Personal Information, the potential risk of harm from unauthorized use or disclosure of your Personal Information, the purposes we process your Personal Information for, and whether we can achieve those purposes through other means. For certain types of Personal Information we will only maintain it for a limited duration.

5. Sharing and Selling Personal Information

We may sell or share the following categories of Personal Information with third parties for the purposes of cross-context behavioral advertising:

• Identifiers
• Internet or other electronic network activity
• Geolocation data

We sell and/or share this Personal Information with third parties for advertising purposes.  The third parties to whom this Personal Information was sold and/or shared are advertisers and analytics vendors.  When we use the terms sell, sold, or sale, we mean for valuable consideration and not monetary value.

We offer you the ability to opt out of sales and sharing of your Personal Information as set forth in the “Right to Opt-Out of Sales and Sharing of Personal Information” section below.

We do not have actual knowledge that we sell or share the Personal Information of consumers under sixteen (16) years of age.

• How to Use Your Rights

If you are a California resident, you have the right to submit certain requests relating to your Personal Information as described below. Please note that when submitting a request, you will be asked to provide information to verify your identity before action is taken. You may designate an authorized agent to make the requests below on your behalf. An authorized agent must submit proof to us that he or she has been authorized by you to act on your behalf, and you will still need to verify your identity directly with us.

Right to Opt-Out of the Sale of Personal Information. You have the right to opt out of the sale of your Personal Information, and to request that we do not share your Personal Information for cross-context behavioral advertising. To opt-out, please click here.

If you choose to use the Global Privacy Control (“GPC”) browser signal, you will only be opted out of online sales or sharing of Personal Information. To submit a request to opt out of offline sales and sharing which would not otherwise be controlled by GPC, please use our webform.

Right to Request More Information. California residents have the right to request more information regarding the following, to the extent applicable:

1. The categories of Personal Information we have collected about you.
2. The categories of sources from which the Personal Information was collected.
3. Our business or commercial purposes for collecting, selling, or sharing your Personal Information.
4. The categories of Personal Information that we sold, and for each category identified, the categories of third parties to which we sold that particular category of Personal Information
5. The categories of Personal Information we disclosed for a business purpose in the preceding twelve (12) months, and for each category identified, the categories of recipients to which we disclosed that particular category of Personal Information.
6. The specific pieces of Personal Information we have collected about you.
7. A list of the third parties to which we have disclosed Personal Information, as defined under California Civil Code Section 1798.83(e) (a/k/a the “Shine the Light Law”), during the preceding calendar year for third-party direct marketing purposes.

Right to Request Deletion of Your Personal Information. California residents have the right to request we delete Personal Information collected or maintained by us. Following receipt of a verifiable request to delete, we will let you know what Personal Information we can delete from our records. If applicable, we will also notify our Service Providers to which we transferred your information about your request to delete.  You may submit a request to delete your personal information via our webform or by calling us toll-free at 1-833-215-1002.

Right to Non-Discrimination. If you choose to exercise any of the privacy rights conferred by the CCPA, you also have the right not to receive discriminatory treatment by us. This means that, consistent with California law, we will not deny providing our products or services to you, charge you different prices or provide a different level or quality of products or services to you unless those differences are related to the value of your personal information.

Right to Correct Inaccurate Information. If you believe that any of the Personal Information we maintain about you is inaccurate, you may submit a request via our webform or by calling us toll-free at 1-833-215-1002. Upon receipt of a verifiable request to correct inaccurate personal information, we will use commercially reasonable efforts to correct the information as you direct.

Right to Limit Use and Disclosure of Your Sensitive Personal Information. We do not use or disclose sensitive Personal Information for purposes to which the right to limit use and disclosure applies under the CCPA.

• Notice of Financial Incentive & Our Loyalty Program

Our loyalty program provides benefits such as loyalty points and discounts to those who choose to participate, and participation requires you to provide some personal information. Any difference in price or benefits provided to customers who participate in our loyalty program is reasonably related to the value of the personal information provided.

Unless you specifically request, submission of a request to delete will not erase information required for you to continue to participate in our loyalty program. Should you wish to delete your personal information associated with our loyalty program (and thereby cancel your participation in the program), please contact us at support@whiteduckoutdoors.com. Using your right to know the personal information we collected about you or opting-out of the sale of your personal information will not impact your ability to participate in our loyalty program.

6. How to Contact Us

If you have any questions about this Notice, please email us at support@whiteduckoutdoors.com, or write us at White Duck Outdoors, 1215 Livingston Ave, Ste 4, North Brunswick NJ 08902 (Attention: Legal).