Privacy Policy

Our promise to you. 

We are committed to maintaining our customers' privacy. We take great care to safeguard the information that we collect to ensure that our customers' privacy is maintained. We have provided this notice to you to describe our information collection and use practices at Boots Retail USA, Inc. This notice also describes the choices you can make about the way your information is collected, used, and shared. By interacting with Boots Retail USA, Inc. through our websites, mobile applications, products, and services, you consent to the use of information that is collected or submitted as described in this Privacy Policy. We may change or add to this notice, so we encourage you to review it periodically. For California, Colorado, Connecticut, Virginia, and Utah residents, there is an "Information for California Consumers," “Information for Colorado Consumers,” “Information for Connecticut Consumers,” “Information for Virginia Consumers,” and “Information for Utah Consumers” section in this Privacy Policy.

Personal information is information that can be used to directly identify you. Types of personal information we collect may include information such as your name, date of birth, email address, mailing address, phone or mobile number, credit/debit card number, and other identifying information. Personal information does not include aggregated or de-identified information. We may also collect information that does not directly identify you by name or contact information, but which may be used to identify that a specific computer or device has accessed our website or online services. Please see the "Information for California Consumers," “Information for Colorado Consumers,” “Information for Connecticut Consumers,” “Information for Virginia Consumers,” and “Information for Utah Consumers” sections for additional information.

Who’s in control of your information?

Throughout this Privacy Policy, ‘we’ means Boots Retail USA, Inc. We are part of the Walgreens Boots Alliance group of companies, including subsidiaries, affiliates, joint ventures and franchises. You can find out more about the companies in our group at Walgreens.com

Collecting information about you

Information we collect directly from you

We collect information about you whenever you visit our website, mobile application, sign up for an account or subscribe to our notifications, make an online or phone purchase with us, request customer service assistance, participate in a contest, sweepstake, promotion or survey, post a review or comment on our website, or post other user generated content on our website.

 Information we collect from your use of our services

Log information refers to information that is automatically sent by your web browser or device (or otherwise automatically collected by us) each time you view or interact with our online services and ads. Log information may include the online service(s) requested; date and time of your request; referring URL (i.e., the website you came from); your device's Internet Protocol (IP) address; location data derived from your device's IP address; browser type; browser language; device operating system; device hardware and other characteristics; information regarding your use of our online services (e.g., pages viewed, features used, number of clicks, time spent on a particular page); and related device and usage data. Log information is automatically recorded by our servers each time you view or interact with our online services and ads.

Device information refers to device-specific information that we automatically collect when you view or interact with our online services and ads. Device information may include your device type and model; device operating system and version; unique device and advertising identifiers; mobile network information; and related device information. To learn more about the information your device may make available to us, please check the policies of your device manufacturer or software provider.

Information we collect online: Cookies and Similar Technologies

We use Cookies on this website. A 'Cookie' is a small data file that is sent from a website’s server and are stored on your device’s hard drive either for only the duration of your visit (“session cookies”) or for a fixed period of time (“persistent cookies”). Cookies enable us to recognise your computer when you visit the site and make using our website quicker and easier (e.g. login fields may be pre-filled with your email address). Cookies are also essential to the functioning of certain parts of the site and we use them to collect information about how the site is used, such as how many people visit and return and what products are being viewed. We may also use Cookies for marketing and to give you a more personalised experience on our website.

How we use Cookies, Beacons and Similar Technologies:

Making our website work:

Certain Cookies are essential so that you can move around the site and log in to your Account. Without them you would be unable to take certain actions on our website or access your account.

Monitoring and improving the performance of the website:

We may use Cookies to collect information about how visitors use the site, e.g. which pages they visit most often and whether they see error messages. The information is aggregated so it does not identify individuals, and we use it only to help us improve the way the website works.

Enabling the features of the website:

We may use Cookies that allow our website to remember choices you have made, such as your user name, and help us provide you with a better, more personal experience. For example, they may allow you to watch a video clip, comment on a blog or add a product review.

Marketing and advertising:

We may use Cookies to deliver advertisements that are more relevant to you, as well as to limit the number of times you see a particular advertisement and to measure the effectiveness of advertising campaigns. The Cookies remember that you have visited a website and this information may then be shared with other organizations for advertising purposes.

What are ‘Flash Cookies’ (or ‘Local Shared Objects’)?

If your browser does not support HTML5 player, we may deliver video content using Adobe Flash Player instead (although you may experience display problems if your browser is unsupported). Flash Cookies are stored on your device in a similar way to other types of Cookie, but they're managed differently by your browser, and the cookie management tools provided by your browser will not remove Flash cookies. If you wish to disable or delete them you can do this through Adobe Flash Player security settings or by visiting the Adobe website. 

Restricting or blocking Cookies

As you will have seen in ‘How We Use Cookies’ above, some parts of our website need Cookies in order to function correctly. By default, Cookies should be enabled on your computer or device, and although you can ‘disable’ them in your browser this will affect your experience on the website. You will be limited to browsing, viewing and searching for products but may not be able to take additional actions on our site or log in to your account.

If you'd still prefer to restrict ,block or delete Cookies from this or any other website, you may do so in your internet browser. Each browser is different, so you’ll need to go to the 'help' menu on your browser and look for how to change your ‘Cookie preferences’. The website www.aboutcookies.orgcontains comprehensive information on how to do this on a wide variety of browsers.

Disabling advertising Cookies

We may engage third party advertisers to provide interest-based advertising on our website, as well as other third party sites in order to display advertising that is relevant to you. These third parties may collect information about your use of our services over time and that information may be combined with information collected on different websites and online services.

If you are concerned about behaviourally targeted advertising Cookies (which serve you advertisements based on your use of this website and other websites), you can visit either aboutads or network advertising and opt out of advertising Cookies. 

Please Note: When you "opt-out" of receiving interest-based advertisements, this does not mean you will no longer see advertisements from us. It means that the online ads that you do see will not be tailored for you based on your particular interests. We may still collect information about you for any purpose permitted under the Policy, including for analytics.

Google Analytics

Some of our online services may use Google Analytics, a web analytics service provided by Google. Google Analytics utilizes cookies and similar technologies to collect and analyze non-identified information (i.e., data that does not identify a specific individual) about the performance and use of our online services and ads. More information on Google Analytics can be found here. If you would like to opt-out of having your information collected and used by us and our online partners as described herein, please use the Google Analytics opt-out available here.

Interactive Services

Our website may provide interactive services, including chatbot and managed chat. By accessing or using these features, you agree that we may record and retain a transcript of all communications with you via these interactive tools and may record or recreate your activity while using the website, in order to provide services, enhance your website experience, and for quality and verification purposes. We may work with trusted service providers to analyze, store, and/or use this data on our behalf. Your use or access of any of these tools or of our website is governed by this Privacy Policy and this section.

Your privacy and shared computers

If you log in to the website from a shared computer, such as in an internet cafe or from a colleague’s computer at work, Cookies may cause your email address to display in the login field to anyone who uses the site on that computer after you. You can avoid this by clearing the Cookies stored by the web browser. The option to do this can normally be found within your browser ‘tools’ preferences.

Information we obtain from external companies

We collect data that is publicly available. For example, information you submit in a public forum (e.g., a blog, chat room, or social network) can be read, collected or used by us and others, and could be used to personalize your experience. You are responsible for the information you choose to submit in these instances.

From time to time we may supplement the information we hold about you with data from other commercially-available sources like third party partners, organizations, and other companies. This helps us keep our records up to date and learn more about our customers so we can continue to improve our products and services.

Information from within our parent company

As you’ll have seen in ‘Who’s in control of your information’, Boots Retail USA, Inc. is part of the Walgreens Boots Alliance group of companies. If you are also a customer of Boots or other companies in our group, we may consolidate the information we hold about you across our group. This helps us build a better picture of our customers, develop our products and services and, with your consent, provide you with offers and information we think may interest you.

How we use your information:

• Providing our products and services
• We use your information to provide our products and services, respond to queries and comments and provide you with the best possible level of customer service.
• Our own internal purposes and operations
• We use your information to improve the effectiveness of our services, conduct analysis, and to perform other business activities as needed.
• Our marketing and advertising purposes

We may analyze your information, including the products you view and buy, your browsing habits and other ways you interact with us, to evaluate the effectiveness of our advertising and help us provide more relevant offers and content. We may use your information to deliver coupons, mobile coupons, newsletters, e-mails, mobile messages, social media notifications and other notifications about our brands, products, events, or other promotional purposes.

Legal compliance

We may use your information to assist law enforcement and respond to regulatory or other legal inquiries.

Prevention of fraud and other harm

We may use your information to detect, prevent, or investigate potential security incidents, fraudulent transactions, to monitor against fraud and to otherwise protect our customers and our business.

Research

From time to time we may invite you to take part in market research activities such as customer surveys, questionnaires or focus groups.

Sharing your information:

Internally we may share your information with our parent company or affiliates, including but not limited to, Walgreens Boots Alliance Inc. and Walgreen Co.

Companies that provide services on our behalf

We may share your information with companies who provide services on our behalf that are related to our business. These tasks may include analysing site data, customer service, electronic and postal mail service, and social and other media services. Third party service providers only receive your personal information as required to perform their role and we instruct them not to use it for any other purpose.

Examples of the functions that may be carried out by external companies:

• Customer service center
• Mailing houses
• Printers
• Couriers
• Delivery services
• Manufacturers or suppliers
• Companies that cleanse data
• Payment providers
• Companies that do fraud and money laundering checks
• Companies that provide web hosting, content providers, competitions, and sweepstakes
• Data storage facilities
• IT services and support

We may work with other companies who place cookies, tags, and web beacons on our websites. These companies help operate our websites and provide you with additional products and services. We may also use third party advertising networks to serve advertisements on our behalf. The cookies received with the banner advertisements served by these networks may be used to collect and build behavioral profiles by these companies to deliver targeted advertisements on our website and unaffiliated websites.

Third Party Partners

We may work with other companies who operate their own websites or mobile applications, to allow them to offer our customers the ability to connect to our services. These services give you more options for ways to use our services from websites or applications that are not owned or operated by Boots Retail USA, Inc.

Sharing with other companies (for their marketing purposes)

We do not share your personal information with other companies, or organizations for their direct marketing purposes.

Non-identifiable or aggregate information

We may share non-identifiable or aggregate information for third parties for lawful purposes.

Legal obligations

We may share your Information with third parties where required or permitted by law, if we believe we need to do so to protect our rights and interests, or to comply with legal proceedings, to enforce or apply our terms and conditions and other agreements, to facilitate the financing, securitization, insuring, sale, assignment, or disposal of all or part of our business or assets, or to protect the property or safety of our company, customers, or others. In such cases, we will always do so legally and with due regard to your privacy.

Elsewhere at your direction

At your direction or request, or where you otherwise consent, we may share your information.

Changes to our business

If ownership of all or part of our business changes or we undergo a reorganization (including a merger or transfer between Walgreens Boots Alliance companies), we will transfer your information to the new owner or successor company so we can continue to provide our services. We also may retain a copy of your information.

How long do we keep your personal information?

We hold your personal information for as long as you remain a customer, or as required to meet our legal obligations or those of our parent group, resolve disputes or enforce our agreements. This may mean we need to keep some of your information fora period of time after you cease to be a customer but we will always store it securely.

Links to other websites

Our services may contain links to, or otherwise make available, social media sites and other third party services, websites and mobile applications that are owned, operated, or controlled by third parties. We do not take responsibility for the content or privacy practices employed by third party sites. Unless otherwise stated, any information you provide to any such third party site will be collected by that party, and will be subject to that party’s privacy notice (if any), rather than this notice. In such a situation, we have no control over, and shall not be responsible for, that party’s use of the information you provide to them.

Social Media and Ads

We engage with guests on multiple social media platforms (e.g., Facebook and Instagram). If you contact us on one of our social media platforms, request guest service via social media, or otherwise direct us to communicate with you via social media, we may contact you via direct message or use other social media tools to interact with you. In these instances, your interactions with us are governed by this privacy policy as well as the privacy policy of the social media platform you use.

We may display targeted ads to you through social media platforms and other websites. These ads are sent to groups of people who share traits such as likely commercial interests and demographics. For example, we may target guests who have expressed an interest in shopping for cosmetics, skincare, etc.

You may see ads that are tailored to your interests, based on the information we hold about you. For example, your age or the products you have browsed on our website. See the policies of each social media platform for additional information about these types of ads.

Social Media Plug-Ins

Our online services may use social media plug-ins (e.g., the Facebook "Like" button, "Share to Twitter" button) to enable you to easily interact with certain social media websites (e.g., Facebook, Twitter, Instagram) and share information with others. When you visit our online services, the operators of the available social media plugins can place a cookie on your device enabling such operators to recognize individuals who have previously visited our online services. If you are logged into these social media websites while visiting our online services, the social media plugins allow the relevant social media websites to receive information that you have visited our online services or other information. The social media plugins also allow the applicable social media websites to share information about your activities on our online services with other users of the social media website. For example, Facebook Social Plugins allow Facebook to show your "Likes" and comments on our online services to your Facebook friends. Facebook Social Plugins also allow you to see your friends' Facebook activity on our online services. We do not control any of the content from the social media plugins. For more information about social media plugins from other social media websites, please refer to those websites' privacy and data sharing statements.

Our "Do Not Track" Policy

Please note that this website does not interpret or respond to "do not track" signals. However, you may set your Web browser to not accept new cookies, be notified when you receive a new cookie, or disable cookies altogether. Please note that by disabling these features, your experience will not be as smooth and you will not be able to take full advantage of our website's features. Please see the Help section of your browser for instructions on managing security preferences.

 Minors

We recognize the importance of protecting children’s privacy online. Our website and services are intended for a general audience and are not directed at children. We do not knowingly collect personal information from children under the age of 13.

If you are under the age of 18 and are a registered user of the site, you may request that we remove content or information that you have posted on our site. Please note that responding to your request may not ensure a complete or comprehensive removal (e.g., if the content or information has been reposted by another user.) To request removal, please contact us at through your account help center or at customer.experience@thehutgroup.com.

Staying in control of your information and your choices

• Email and mobile communications
• We provide our customers with the opportunity to update their information or opt-out of having their information used for purposes not directly related to placement, processing, fulfillment, or delivery of a product order or servicing of your product. To opt-out of marketing communications, you may:
• Send us an e-mail at customer.experience@thehutgroup.com
• Contact us by mail at the address below in the “Contact Us” section, or
• Unsubscribe from our email communications at any time by clicking the unsubscribe button at the bottom of the e-mail.

Your instructions to limit the use of your information for these purposes will be processed as soon as reasonably practicable. If you receive marketing communications from one or more company affiliates, you must opt out individually from each of the affiliates from which you are receiving brand-specific marketing communications.

Accessing and updating your information

If you wish to verify, correct, or update any of your personal information, you may visit the “Your Account Page” to sign into your account, or otherwise contact us at the address or e-mail in the “Contact Us” section below. If you choose to deactivate your account, we may still retain certain information for analytical purposes and record keeping integrity, as well as to prevent fraud, resolve disputes, enforce our Terms of Use or other policies, take actions we deem necessary due to technical and legal requirements, and as dictated by constraints related to the security, integrity and operation of our Site.

Interest-based advertising

To learn more about interest-based advertising, or to opt-out of having your web browsing information used by certain third party advertisers for behavioral advertising purposes, please visit either Aboutads or Network Advertising

How we protect your information

We maintain administrative, technical, and physical safeguards to protect your information. When we collect or transmit sensitive information such as credit or debit card number, we use industry standard methods to protect that information. However, no e-commerce solution, website, mobile application, database or system is completely secure. You are also responsible for taking reasonable steps to protect your personal information against unauthorized disclosure or misuse. If you have reason to believe that your interaction with us is no longer secure, please immediately contact us in accordance with the Contact Information section below.

Email security

“Phishing” is a common e-mail scam where your e-mail address is used to contact you and ask for personal or other sensitive information. Always be cautious when opening links or attachments from unsolicited third parties. Always know that Boots Retail USA, Inc. will not send you e-mails asking for such information. If you are ever asked for this information, you can be confident it is not from Boots Retail USA, Inc. If you are concerned that a website or e-mail may be fraudulent, please contact us using the Contact Information section below.

Changes to this privacy policy

We may update this policy from time to time so we recommend that you check back here occasionally. If we make changes we think may affect you significantly, we’ll provide you with a prominent notice by the most appropriate medium so you know about the changes before they happen. We will always note the effective date of the latest version at the bottom of this notice.

State Privacy Laws

Information for California Consumers:

If you reside in California, we are required to provide additional information to you about how we use and disclose your information, and you may have additional rights with regard to how we use and disclose your information. We have included this California-specific information below.

• CA Personal Information. Consistent with the "Collecting information about you" section above, we collect certain categories and specific pieces of information about individuals that are considered "Personal Information" under California law ("CA Personal Information"). Specifically, we may collect the following types of categories of CA Personal Information and have listed some representative data elements in each category:
•  Identifiers: such as name, address, telephone number, email address, age, date of birth, username and password for our websites, online identifiers, IP address;
• Characteristics of protected classifications under California or Federal Law: such as sex, gender, age (40 or older)
• Commercial information: such as products or services purchased, obtained or considered, other purchasing or consuming histories or tendencies and payment information.
• Internet or other electronic network activity information: such as computer and connection information, statistics on page views, traffic to and from the websites, ad data and other standard weblog information;
• Geolocation information: such as physical location information through the use of our Services on your mobile phone or device by, for example using satellite, cell phone tower, WiFi signal, beacons, Bluetooth and near field communication protocols;
• Audio, visual, or similar information: such as photographs you share, customer service audio recordings; and
• Inferences drawn from other personal information: such as consumer preferences, characteristics, predispositions, and behavior.
• Sources. We may collect certain categories of CA Personal Information from you and third parties as described in the "Collecting information about you" section above. The categories of sources from whom we may collect CA Personal Information include the following:
• On our websites and mobile applications (parent, subsidiary and affiliate brands)
• When you communicate with our Customer Care Center
• Third party websites and mobile applications (e.g., websites that share information with us or our advertising partners regarding your online activities)
• Online advertising companies
• Delivery partners/carriers
• Social media companies
• Other service providers
• Purposes. We collect CA Personal Information for the business and commercial purposes described in the "How We Use Your Information" section above. We also share and/or disclose CA Personal Information as follows:
• Retention. We retain CA Personal Information for the business and commercial purposes described in the "How We Use Your Information" and “Purposes” sections above. Retention of you CA Personal Information may also be required to provide products and services you requested, to maintain our business relationship with you, or for us to fulfill a legal obligation. Once no longer needed for these purposes, we will not retain your CA Personal Information in our systems.
• Sharing your CA Personal Information for business purposes: As described above in the "Sharing Your Information" section, we may share the following categories of CA Personal Information with third parties who are considered “service providers” as defined under California law since we disclose CA Personal Information to them for our business purposes. We also list representative data elements for each of these categories of CA Personal Information:
• Identifiers: such as name, address, telephone number, email address, age, date of birth, username and password for our websites, online identifiers, IP address;
• Characteristics of protected classifications under California or Federal Law: such as sex, gender, age (40 or older);
• Commercial information: such as products or services purchased, obtained or considered, other purchasing or consuming histories or tendencies, payment information;
• Internet or other electronic network activity information: such as computer and connection information, statistics on page views, traffic to and from the websites, ad data and other standard weblog information;
• Geolocation information: such as physical location information through the use of our Services on your mobile phone or device by, for example using satellite, cell phone tower, WiFi signal, beacons, Bluetooth and near field communication protocols;
• Audio, visual, or similar information: such as photographs you share, customer service audio recordings; and
• Inferences drawn from other personal information: such as consumer preferences, characteristics, predispositions, and behavior.
• As described above, examples of business purposes include product and service fulfillment, internal operations, prevention of fraud and other harm, and legal compliance.
•  Sale or Sharing CA Personal Information with third parties: As described above in the "Sharing your information" section, we may share the following categories of CA Personal Information with third parties who are considered “third parties” as defined under California law since we disclose CA Personal Information to them which they may use for secondary purposes. Our disclosure of CA Personal Information to the third parties who use the information for secondary purposes may constitute a "sale” or “share” of CA Personal Information as defined under California law. You may stop our potential disclosure of your CA Personal Information to these entities for their use for secondary purposes by opting-out of the sale or “sharing” of your CA Personal Information as described in the California Consumer Rights section below. We also list representative data elements for each of these categories of CA Personal Information:
• Identifiers: such as online identifiers, IP address;
• Commercial information: such as products or services purchased, obtained or considered, other purchasing or consuming histories or tendencies;
• Internet or other electronic network activity information: such as computer and connection information, statistics on page views, traffic to and from the websites, ad data and other standard weblog information;
• Geolocation information: such as physical location information through the use of our Services on your mobile phone or device by, for example using satellite, cell phone tower, WiFi signal, beacons, Bluetooth and near field communication protocols; and
•  Inferences drawn from other personal information: such as consumer preferences, characteristics, predispositions, and behavior.
• California Consumer Rights. Subject to certain exceptions, as a California resident, you have the right to: (i) request access to your CA Personal Information (including information regarding the sharing of your CA Personal Information), including in a portable, machine-readable format; (ii) request deletion of your CA Personal Information;(iii) correction, (iv) appeal and (v) opt-out of the sale or sharing of your CA Personal Information.
• Exercising California Consumer Rights. Should you wish to request the exercise of your rights as detailed above with regard to your CA Personal Information, we will not discriminate against you by offering you different pricing or products, or by providing you with a different level or quality of products or services, based solely upon this request. You may receive a different level or quality of goods or services as permitted by California law in connection with programs such as Balance Rewards if you exercise your right to request deletion of, or your right to opt-out of the sale or sharing of, your CA Personal Information. To the extent you provide CA Personal Information in connection with programs such as Balance Rewards, additional information about the terms applicable to those programs, including our use of CA Personal Information in exchange for the applicable financial incentives, can be found in the terms and conditions for those programs.
• Opt-out Preference Signal. You may opt out of the sale and sharing of your CA Personal Information at a browser level. Browser level opt outs are based on your unique browser and device. In addition to manually opting out at a browser level through clicking on the "Do not Sell or Share My Personal Information" link in the footer, we also have processes in place to recognize opt-out preference signals you set on your browser or device and honor those signals when you visit our website as a request to opt out of the sale and sharing of your CA Personal Information. To enable an opt-out preference signal, you must use a platform or internet browser with technology to set and communicate your preferred privacy setting.
• You may exercise your California Consumer Rights by
• Emailing customer.experience@thehutgroup.com. Once we receive your request, we will verify it by asking you to provide information related to your account or your recent interactions with us, such as information regarding a recent purchase. If you would like to use an authorized agent to exercise your rights, we may request evidence that you have provided such agent with power of attorney or that the agent otherwise has valid written authority to submit requests on your behalf. We will not discriminate against you if you exercise your rights under the CCPA.
• Please find the link by clicking on the ‘Do not Sell or Share My Personal Information’ link in the footer.
• We also have processes in place to recognize opt-out preference signals you set on your browser or device and honor those signals when you visit our website as a request to opt out of the sale of your CA Personal Data. To enable an opt-out preference signal, you must use a platform or internet browser with technology to set and communicate your preferred privacy setting.

Business to Business Consumers

This "Information for California Consumers” section, including the “California Consumer Rights” subsection also applies to CA Personal Information collected from individuals acting as an employee, owner, director, officer, or contractor of another company, partnership, sole proprietorship, nonprofit, or government entity, in the context of conduct business with us.

Metrics. California law requires recording of metrics regarding requests for Access, Correction, Deletion, and Opting-out of Sale/Sharing submitted by California residents pursuant to the California Privacy Rights Act. The metrics below reflect the time period from January 1, 2022, to December 31, 2022, which does not include requests for Correction.

• Access Requests
•  Request Received:1
• Completed:1
• Expired/Rejected: 0
• Median Days to Fulfill: 15
• Deletion Requests
• Requests Received: 30
• Completed:30
• Expired/Rejected: 0
• Median Days to Fulfill: 1
• Opt-out Requests
• Requests Received:129,402
• Completed:129,402
• Expired/Rejected:0
• Median Days to Fulfill:15

Information for Colorado Consumers. 

If you are a Colorado resident, we are required to provide additional information to you about how we collect, use and disclose your information that may be considered “Personal Data” under Colorado Law (“CO Personal Data”), and you may have additional rights with regard to how we use and disclose your CO Personal Data.

CO Processing. Consistent with the "Information We Collect" section above, we process certain categories and specific pieces of CO Personal Data about individuals who reside in Colorado. In the 12 months prior to the date of this Privacy Policy, we collected the following types of categories of CO Personal Data, which we will continue to collect:

•  Identifiers: such as name, address, telephone number, email address, age, date of birth, username and password for our websites, online identifiers, IP address;
• Commercial information: such as products or services purchased, obtained or considered, other purchasing or consuming histories or tendencies, payment information, and loyalty program participation information;
• Internet or other electronic network activity information: such as computer and connection information, statistics on page views, traffic to and from the websites, ad data and other standard weblog information;
• Geolocation information: including location data and precise location data such as physical location information through the use of our services on your mobile phone or device by, for example using satellite, cell phone tower, WiFi signal, and beacons;
• Audio, visual, or similar information: such as photographs you share, and customer service audio recordings;
• Inferences drawn from the above categories of CO Personal Data: such as consumer preferences, characteristics, predispositions, and behavior; and

Deidentified Information. We may also maintain and use information that does not identify an individual and cannot reasonably be used to identify an individual which is derived from CO Personal Data. We will not attempt to reidentify deidentified CO Personal Data unless permitted by law.

Purposes. We collect CO Personal Data for the business and commercial purposes described in the "How We Use Your Information" section above. Specifically, we collect CO Personal Data to respond to your inquiries, fulfill your requests and improve your experience; for marketing, advertising and promotional purposes; for reporting and analytics; to improve the effectiveness of our services, conduct research and analysis, or for other internal operations purposes; to detect, prevent or investigate potential security breaches, fraudulent transactions and monitor against theft.

CO Sale and Targeted Advertising.  As described above in the "How We Share Your Information" section, we may share the following categories of CO Personal Data with third parties who are considered "third parties" as defined under Colorado law. In the 12 months prior to the date of this Privacy Policy, we shared your CO Personal Data with third parties for purposes of “targeted advertising,” which may constitute a "sale" of CO Personal Data under Colorado law, and may continue to share the following categories of CO Personal Data for “targeted advertising”:

• Identifiers: such as online identifiers, IP address;
• Commercial information: such as products or services purchased, obtained or considered, other purchasing or consuming histories or tendencies;
• Internet or other electronic network activity information: such as computer and connection information, statistics on page views, traffic to and from the websites, ad data and other standard weblog information; and
• Inferences drawn from CO Personal Data: such as consumer preferences, characteristics, predispositions, and behavior.

The categories of third parties to which we may share the above-described categories of CO Personal Data include Online Advertising Networks, Marketing Companies, and Social Media Companies.

Opting Out of Sale and Targeted Advertising. You may stop our disclosure of your CO Personal Data to these entities for purposes of targeted advertising by opting-out of the sale of your CO Personal Data. You can do so by submitting an opt-out request through clicking on the "Do not Sell or Share My Personal information" link in the footer or by contacting us at customer.experience@thehutgroup.com.

• Opt-out Preference Signal. As described on our “Do Not Sell or Share my Personal Information” link under the ‘Manage Consent Preference’ section, you may opt out of the sale of your CO Personal Data at a browser level. Browser level opt outs are based on your unique browser and device. In addition to manually opting out at a browser level through clicking on the "Do not Sell or Share My Personal Information" link in the footer, we also have processes in place to recognize opt-out preference signals you set on your browser or device and honor those signals when you visit our website as a request to opt out of the sale of your CO Personal Data. To enable an opt-out preference signal, you must use a platform or internet browser with technology to set and communicate your preferred privacy setting.

Colorado Consumer Rights. As a Colorado resident, you have the right to ask us for and access, including in a portable, readily usable format, any or all of following types of information regarding the CO Personal Data we have collected about you:

• Specific pieces of CO Personal Data we have collected about you;
• Categories of CO Personal Data we have collected about you;
• Categories of sources from which such CO Personal Data was collected;
• Categories of CO Personal Data we sold or disclosed for a business purpose about you; and
• The business or commercial purpose for collecting or selling your CO Personal Data.

• Exercising Colorado Consumer Rights. You or your authorized agent may submit a request to exercise your Colorado Consumer Rights by:
• Emailing customer.experience@thehutgroup.com
• Submitting a sale or targeted advertising opt out through clicking on the "Do not Sell or Share My Personal Information" link in the footer
• Responding to Requests. For requests for access, correction, deletion, or appeal, we will first acknowledge receipt of your request within 10 business days of receipt of your request. We provide a substantive response to your request as soon as we can, generally within 45 days from when we receive your request, although we may be allowed to take longer to process your request under certain circumstances. If we expect your request is going to take us longer than normal to fulfill, we will let you know.

For requests to opt out of the use of your CO Personal Data for purposes of targeted advertising and sale we will comply within 15 business days after receipt of your request.

We usually act on requests and provide information free of charge, but we may charge a reasonable fee to cover our administrative costs of providing the information in certain situations. In some cases, the law may allow us to refuse to act on certain requests. When this is the case, we will endeavor to provide you with an explanation as to why.

• Requests By Authorized Agents. You may designate an agent to submit requests on your behalf. The agent must be a natural person or a business entity that is registered with the Colorado Secretary of State.

If you would like to designate an agent to act on your behalf, you and the agent will be required to provide us with proof of the agent’s identity and proof that you gave the agent signed permission to submit a request on your behalf. Additionally, you will be required to verify your identity by providing us with certain CO Personal Data as described above or provide us with written confirmation that you have authorized the agent to act on your behalf.

Please note that this subsection does not apply when an agent is authorized to act on your behalf pursuant to a valid power of attorney. Any such requests will be processed in accordance with Colorado law pertaining to powers of attorney.

No7Loyalty Program. If you enroll and participate in the No7 Loyalty Program, the following information about how we collect, use and disclose your CO Personal Data applies.

The categories of CO Personal Data collected from participants of theNo7 Loyalty Program include those listed under the “CO Processing” section above and the categories of CO Personal Data sold or processed for targeted advertising include those listed above under the “CO Sale and Targeted Advertising” section.

The categories of third parties that may receive the categories of CO Personal Data listed above under “CO Sale and Targeted Advertising” include Online Advertising Networks, Marketing Companies, and Social Media Companies.

If you request deletion of your CO Personal Data and are a No7 Loyalty Program member, your loyalty profile may be deleted. We use your loyalty profile to provide loyalty program benefits to you as a loyalty member. Without a loyalty profile, you would lose rewards and other benefits such as sales prices and personalized offers.

Information for Connecticut Consumers

If you are a Connecticut resident, we are required to provide additional information to you about how we collect, use and disclose your information that may be considered "Personal Data" under Connecticut Law ("CT Personal Data"), and you may have additional rights with regard to how we use and disclose your CT Personal Data. We have included this Connecticut-specific information below.

Processing. Consistent with the "Collecting information about you" section above, we process certain categories and specific pieces of CT Personal Data about individuals who reside in Connecticut. In the 12 months prior to the date of this Privacy Policy, we collected the following types of categories of CT Personal Data, which we will continue to collect:

• Identifiers: such as name, address, telephone number, email address, age, date of birth, username and password for our websites, online identifiers, IP address;
• Commercial information: such as products or services purchased, obtained or considered, other purchasing or consuming histories or tendencies, payment information, loyalty program participation information;
• Internet or other electronic network activity information: such as computer and connection information, statistics on page views, traffic to and from the websites, ad data and other standard weblog information;
• Geolocation information: including location data and precise location data such as physical location information through the use of our services on your mobile phone or device by, for example using satellite, cell phone tower, WiFi signal, beacons, Bluetooth and near field communication protocols;
• Audio, visual, or similar information: such as photographs you share and customer service audio recordings;
• Inferences drawn from the above categories of CT Personal Data: such as consumer preferences, characteristics, predispositions, and behavior; and

Deidentified Information. We may also maintain and use information that does not identify an individual and cannot reasonably be used to identify an individual which is derived from CT Personal Data. We will not attempt to reidentify deidentified CT Personal Data unless permitted by law.

Purposes. We collect CT Personal Data for the business and commercial purposes described in the "How We Use Your Information" section above. Specifically, we collect CT Personal Data to respond to your inquiries, fulfill your requests and improve your experience; for marketing, advertising and promotional purposes; for reporting and analytics; to improve the effectiveness of our services, conduct research and analysis, or for other internal operations purposes; to detect, prevent or investigate potential security breaches, fraudulent transactions and monitor against theft.

Sale and Targeted Advertising. As described above in the "Sharing your information" section, we may share the following categories of CT Personal Data with third parties who are considered "third parties" as defined under Connecticut law. In the 12 months prior to the date of this Privacy Policy, we shared your CT Personal Data with third parties for purposes of “targeted advertising,” which may constitute a "sale" of CT Personal Data under Connecticut law, and may continue to share the following categories of CT Personal Data for “targeted advertising”:

• Identifiers: such as online identifiers, IP address;
• Commercial information: such as products or services purchased, obtained or considered, other purchasing or consuming histories or tendencies;
• Internet or other electronic network activity information: such as computer and connection information, statistics on page views, traffic to and from the websites, ad data and other standard weblog information; and
• Inferences drawn from CT Personal Data: such as consumer preferences, characteristics, predispositions, and behavior.

The categories of third parties to which we may share the above-described categories of CT Personal Data include online Advertising Networks, Marketing Companies, and Social Media Companies.

Opting Out of Sale and Targeted Advertising. You may stop our disclosure of your CT Personal Data to these entities for purposes of targeted advertising by opting-out of the sale of your CT Personal Data. You can do so by submitting an opt-out request through clicking on the "Do not Sell or Share My Personal Information" link in the footer or by contacting us at customer.experience@thehutgroup.com.

Connecticut Consumer Rights. As a Connecticut resident, you have the right to ask us for and access, including in a portable, readily usable format, any or all of following types of information regarding the CT Personal Data we have collected about you:

• Specific pieces of CT Personal Data we have collected about you;
• Categories of CT Personal Data we have collected about you;
• Categories of sources from which such CT Personal Data was collected;
• Categories of CT Personal Data we sold or disclosed for a business purpose about you; and
• The business or commercial purpose for collecting or selling your CT Personal Data.

You also have the right to request correction or deletion of your CT Personal Data and to opt out of the use of your CT Personal Data for purposes of targeted advertising and sale. In addition, you have the right to appeal our refusal to act on your request.

• Exercising Connecticut Consumer Rights. You or your authorized agent may submit a request to exercise your Connecticut Consumer Rights by using one of the following specifically designated methods:
• Emailing us at customer.experience@thehutgroup.com
• Submitting a sale or targeted advertising opt out, through clicking on the "Do not Sell or Share My Personal Information" link in the footer
• Responding to Requests. For requests for access, correction, deletion, or appeal, we will first acknowledge receipt of your request within 10 business days of receipt of your request. We provide a substantive response to your request as soon as we can, generally within 45 days from when we receive your request, although we may be allowed to take longer to process your request under certain circumstances. If we expect your request is going to take us longer than normal to fulfill, we will let you know.

For requests to opt out of the use of your CT Personal Data for purposes of targeted advertising and sale we will comply within 15 business days after receipt of your request.

We usually act on requests and provide information free of charge, but we may charge a reasonable fee to cover our administrative costs of providing the information in certain situations. In some cases, the law may allow us to refuse to act on certain requests. When this is the case, we will endeavor to provide you with an explanation as to why.

Information for Virginia Consumers

If you are a Virginia resident, we are required to provide additional information to you about how we collect, use and disclose your information that may be considered "Personal Data " under Virginia Law ("VA Personal Data"), and you may have additional rights with regard to how we use and disclose your VA Personal Data. We have included this Virginia-specific information below.

Processing. Consistent with the "Collecting information about you" section above, we process certain categories and specific pieces of VA Personal Data about individuals who reside in Virginia. In the 12 months prior to the date of this Privacy Policy, we collected the following types of categories of VA Personal Data, which we will continue to collect:

• Identifiers: such as name, address, telephone number, email address, age, date of birth, username and password for our websites, online identifiers, IP address;
• Characteristics of protected classifications under California or Federal Law: such as sex, gender, age (40 or older)
• Commercial information: such as products or services purchased, obtained or considered, other purchasing or consuming histories or tendencies and payment information.
• Internet or other electronic network activity information: such as computer and connection information, statistics on page views, traffic to and from the websites, ad data and other standard weblog information;
• Geolocation information: such as physical location information through the use of our Services on your mobile phone or device by, for example using satellite, cell phone tower, WiFi signal, beacons, Bluetooth and near field communication protocols;
• Audio, visual, or similar information: such as photographs you share, customer service audio recordings; and
• Inferences drawn from other personal information: such as consumer preferences, characteristics, predispositions, and behavior.

Deidentified Information. We may also maintain and use information that does not identify an individual and cannot reasonably be used to identify an individual which is derived from VA Personal Data. We will not attempt to reidentify deidentified VA Personal Data unless permitted by law.

Purposes. We collect VA Personal Data for the business and commercial purposes described in the "How We Use Your Information" section as described above. Specifically, we collect VA Personal Data to respond to your inquiries, fulfill your requests and improve your experience; for marketing, advertising and promotional purposes; for reporting and analytics; to improve the effectiveness of our services, conduct research and analysis, or for other internal operations purposes; to detect, prevent or investigate potential security breaches, fraudulent transactions and monitor against theft.

Sale and Targeted Advertising. As described above in the "How We Share Your Information" section, we may share the following categories of VA Personal Data with third parties who are considered "third parties" as defined under Virginia law. In the 12 months prior to the date of this Privacy Policy, we shared your VA Personal Data with third parties for purposes of “targeted advertising,” which may constitute a "sale" of VA Personal Data under Virginia law, and may continue to share the following categories of VA Personal Data for “targeted advertising”:

• Identifiers: such as online identifiers, IP address;
• Commercial information: such as products or services purchased, obtained or considered, other purchasing or consuming histories or tendencies;
• Internet or other electronic network activity information: such as computer and connection information, statistics on page views, traffic to and from the websites, ad data and other standard weblog information; and
• Inferences drawn from VA Personal Data: such as consumer preferences, characteristics, predispositions, and behavior.

The categories of third parties to which we may share the above-described categories of VA Personal Data include online Advertising Networks, Marketing Companies, and Social Media Companies.

Opting Out of Sale and Targeted Advertising. You may stop our disclosure of your VA Personal Data to these entities for purposes of targeted advertising by opting-out of the sale of your VA Personal Data. You can do so by submitting an opt-out request through clicking on the "Do not Sell or Share My Personal Information" link in the footer or by contacting us at customer.experience@thehutgroup.com.

Virginia Consumer Rights. As a Virginia resident, you have the right to ask us for and access, including in a portable, readily usable format, any or all of following types of information regarding the VA Personal Data we have collected about you:

• Specific pieces of VA Personal Data we have collected about you;
• Categories of VA Personal Data we have collected about you;
• Categories of sources from which such VA Personal Data was collected;
• Categories of VA Personal Data we sold or disclosed for a business purpose about you; and
• The business or commercial purpose for collecting or selling your VA Personal Data.

You also have the right to request correction or deletion of your VA Personal Data and to opt out of the use of your VA Personal Data for purposes of targeted advertising and sale. In addition, you have the right to appeal our refusal to act on your request.

• Exercising Virginia Consumer Rights. You or your authorized agent may submit a request to exercise your Virginia Consumer Rights by using one of the following specifically designated methods:
• Emailing us at customer.experience@thehutgroup.com
• Submitting a sale or targeted advertising opt out, through clicking on the "Do not Sell or Share My Personal Information" link in the footer
• Responding to Requests. For requests for access, correction, deletion, or appeal, we will first acknowledge receipt of your request within 10 business days of receipt of your request. We provide a substantive response to your request as soon as we can, generally within 45 days from when we receive your request, although we may be allowed to take longer to process your request under certain circumstances. If we expect your request is going to take us longer than normal to fulfill, we will let you know.

For requests to opt out of the use of your VA Personal Data for purposes of targeted advertising and sale, we will comply within 15 business days after receipt of your request.

We usually act on requests and provide information free of charge, but we may charge a reasonable fee to cover our administrative costs of providing the information in certain situations. In some cases, the law may allow us to refuse to act on certain requests. When this is the case, we will endeavor to provide you with an explanation as to why.

Information for Utah Consumers

If you are a Utah resident, we are required to provide additional information to you about how we collect, use and disclose your information that may be considered "Personal Data" under Utah Law ("UT Personal Data"), and you may have additional rights with regard to how we use and disclose your UT Personal Data. We have included this Utah-specific information below.

Processing. Consistent with the "Collecting information about you" section above, we process certain categories and specific pieces of UT Personal Data about individuals who reside in Utah. In the 12 months prior to the date of this Privacy Policy, we collected the following types of categories of UT Personal Data, which we will continue to collect:

• Identifiers: such as name, address, telephone number, email address, age, date of birth, username and password for our websites, online identifiers, IP address;
• Characteristics of protected classifications under California or Federal Law: such as sex, gender, age (40 or older)
• Commercial information: such as products or services purchased, obtained or considered, other purchasing or consuming histories or tendencies and payment information.
• Internet or other electronic network activity information: such as computer and connection information, statistics on page views, traffic to and from the websites, ad data and other standard weblog information;
• Geolocation information: such as physical location information through the use of our Services on your mobile phone or device by, for example using satellite, cell phone tower, WiFi signal, beacons, Bluetooth and near field communication protocols;
• Audio, visual, or similar information: such as photographs you share, customer service audio recordings; and
• Inferences drawn from other personal information: such as consumer preferences, characteristics, predispositions, and behavior.

Deidentified Information. We may also maintain and use information that does not identify an individual and cannot reasonably be used to identify an individual which is derived from UT Personal Data. We will not attempt to reidentify deidentified UT Personal Data unless permitted by law.

 Purposes. We collect UT Personal Data for the business and commercial purposes described in the "How We Use Your Information" section as described above. Specifically, we collect UT Personal Data to respond to your inquiries, fulfill your requests and improve your experience; for marketing, advertising and promotional purposes; for reporting and analytics; to improve the effectiveness of our services, conduct research and analysis, or for other internal operations purposes; to detect, prevent or investigate potential security breaches, fraudulent transactions and monitor against theft.

Sale and Targeted Advertising. As described above in the "How We Share Your Information" section, we may share the following categories of UT Personal Data with third parties who are considered "third parties" as defined under Utah law. In the 12 months prior to the date of this Privacy Policy, we shared your UT Personal Data with third parties for purposes of “targeted advertising,” which may constitute a "sale" of UT Personal Data under Utah law, and may continue to share the following categories of UT Personal Data for “targeted advertising”:

• Identifiers: such as online identifiers, IP address;
• Commercial information: such as products or services purchased, obtained or considered, other purchasing or consuming histories or tendencies;
• Internet or other electronic network activity information: such as computer and connection information, statistics on page views, traffic to and from the websites, ad data and other standard weblog information; and
• Inferences drawn from UT Personal Data: such as consumer preferences, characteristics, predispositions, and behavior.

The categories of third parties to which we may share the above-described categories of UT Personal Data include online Advertising Networks, Marketing Companies, and Social Media Companies.

Opting Out of Sale and Targeted Advertising. You may stop our disclosure of your UT Personal Data to these entities for purposes of targeted advertising by opting-out of the sale of your UT Personal Data. You can do so by submitting an opt-out request through clicking on the "Do not Sell or Share My Personal Information" link in the footer or by contacting us at customer.experience@thehutgroup.com.

Utah Consumer Rights. As a Utah resident, you have the right to ask us for and access, including in a portable, readily usable format, any or all of following types of information regarding the UT Personal Data we have collected about you:

• Specific pieces of UT Personal Data we have collected about you;
• Categories of UT Personal Data we have collected about you;
• Categories of sources from which such UT Personal Data was collected;
• Categories of UT Personal Data we sold or disclosed for a business purpose about you; and
• The business or commercial purpose for collecting or selling your UT Personal Data.

• Exercising Utah Consumer Rights. You or your authorized agent may submit a request to exercise your Utah Consumer Rights by using one of the following specifically designated methods:
• Emailing us at customer.experience@thehutgroup.com
• Submitting a sale or targeted advertising opt out, through clicking on the "Do not Sell or Share My Personal Information" link in the footer
• Responding to Requests. For requests for access or deletion, we will first acknowledge receipt of your request within 10 business days of receipt of your request. We provide a substantive response to your request as soon as we can, generally within 45 days from when we receive your request, although we may be allowed to take longer to process your request under certain circumstances. If we expect your request is going to take us longer than normal to fulfill, we will let you know.

For requests to opt out of the use of your UT Personal Data for purposes of targeted advertising and sale, we will comply within 15 business days after receipt of your request.

We usually act on requests and provide information free of charge, but we may charge a reasonable fee to cover our administrative costs of providing the information in certain situations. In some cases, the law may allow us to refuse to act on certain requests. When this is the case, we will endeavor to provide you with an explanation as to why.

How To Contact Us:

If you have questions or concerns about your privacy, you may contact us by email at customer.experience@thehutgroup.com. Alternatively, you may write to us by post at Customer Services, Meridian House, Gadbrook Park, Cheshire, CW9 7RA, United Kingdom

Version date: 02/05/2024