Last Modified: September, 28 2021

INTRODUCTION

At Duluth Holdings Inc. d/b/a Duluth Trading Co. (“DTC,” “we,” “our,” or “us”) we take a “No Bull” approach to your privacy. We believe that managing your privacy is important, and we want you to be informed. Please take a few minutes to review this privacy policy (this “Policy”) to understand how we collect, use, disclose, and otherwise interact with your personal information. We respect your privacy and are committed to managing it through our compliance with this Policy. This Policy applies to your interactions and transactions with DTC, including when you visit our website (www.duluthtrading.com) (and any other website, platform or mobile application operated by or on behalf of DTC that links to this Policy) (the “Site”), when you visit our retail locations, when you purchase our products, and when you otherwise communicate or connect with us (online, by phone, in-person, or otherwise) (collectively, the “Services”). When you use the Services, you consent to our use of your personal information as described in this Policy. Like most companies, we may periodically revise this Policy, including when there are changes to the law, technology, or our business. Your continued use of the Services after any revisions means you consent to and accept the revised Policy. Because we want you to be informed and privacy aware, we encourage you to review this Policy periodically to ensure you keep up to date with and understand our privacy practices.

DTC’S DATA COLLECTION

Types of Information We Collect DTC collects the following categories and types of information, which may constitute personal information: Identifying Information (or “Identifiers”) – your name, postal address, billing or shipping address, driver’s license number (if payment by personal check), email address, telephone or mobile number, age, account username and password, job title, and any unique, online, or similar identifiers. Payment and Credit Information – Your credit or debit card information, banking information, information about your payment transaction, or other financial information you provide us. Demographic Information – Your age, date of birth, gender, and zip code. Device Information – The operating system of your device, device identifier, the type of device you are using, and other mobile identifiers. Commercial Information – Information about your orders, shipping details, returns, product complaints, product reviews, and warranties. Internet and Network Activity – Information on your interactions with the Services, our advertisements, navigation, and activity in the Services, and how you use your account. Geolocation Information – Information about your physical location and movements. Audio/Video/Sensory Information – CCTV video and images captured in and around our stores, audio recordings of customer calls, and images you share with DTC online. Employment Information - Information such as work experience, education, skills, behaviors, motivations, licenses and certifications, and any other information you provide to us through our employment application. Inferences – Information derived from your preferences, characteristics, predispositions, and behavior, as well as other information that helps us identify or predict which products you may be interested in. How We Collect Information From and About You Information You Voluntarily Provide to Us. You may provide us information, when you:

• Create an account with us;
• Purchase a product or a gift card, including when you submit your payment and credit information to DTC or its payment processors;
• Sign up for emails, news updates, promotions, or our text messaging program;
• Participate in surveys, sweepstakes, focus groups, marketing initiatives, contests, events, or promotions;
• Make a return or exchange;
• Contact Customer Service, or request information about us or our Services – please note that we may record calls with you for training, customer service, fraud prevention, or quality purposes;
• Submit product reviews, including photos of products;
• Track an online order;
• Communicate with us through the Chat function in the Services;
• Interact with us on our social media pages;
• Apply for a job (online or in-person);
• Create a wish list; or
• Request a catalog.

Information We Collect Through Other Means. We like to know who our customers are and how they are using our products, so we can market the right products to the right people. As a result, we may also collect, obtain, or supplement information about you (including personal information) from sources other than you, including publicly available sources and records, social media platforms, forums, blogs, other users of our products and services, our affiliates, our service providers, and third-party marketing partners. Information When You Shop at Our Stores. We may also collect information from you when you shop at our stores, including much of the same information we would collect if you shopped online (i.e., order information, payment information, etc.). If you pay by personal check, we may also collect your driver’s license number for verification and fraud prevention purposes. In addition, to keep our employees and our customers safe, we use CCTV cameras in our retail stores and other company locations. These cameras collect and store audio, video, images, and other associated information, to help us with fraud prevention, security, and risk management. Our CCTV cameras are provided by a trusted third-party vendor, so video and images, as well as other associated information, is shared with both DTC and that trusted vendor. Information From Emails. We collect information about your interactions with emails sent by us or on our behalf, including whether you opened the email or clicked on any links. We may use this information to improve our marketing, to understand our audience, and to improve the Services. If you wish to opt out of receiving emails from us, please see the “Opt-Out” section, below. Information We Collect Automatically When You Use the Services. When you use or interact with the Services, we may use a variety of technologies that collect information automatically, including cookies, web beacons, flash cookies, and logging. Those technologies may collect, among other things, your IP address, location, device type, date and time of visit, operating system, and browser type, as well as what webpage you visit immediately prior to or after visiting the Site and your activities on the Site. We also use these technologies to monitor the performance of the Site, troubleshoot the Site, and optimize your experience. If you are interacting with the Services on a mobile device, additional information may be collected, including your mobile device’s unique device ID, GPS signal, and information about how you use the Services. The information may also be collected, received by, or shared with our service providers or third parties who assist us with these activities. We use this information to, for example, help make the Site more useful and appealing to you and to better understand our users.

• Cookies. We think it is important that you understand cookies. A cookie is a small text file that is sent to your browser when you access the Services. We, our service providers, and the third parties described below may use session cookies. A session cookie is available only during the course of the browser session; the information is not sent to or stored on a computer’s hard drive. Closing the browser or logging off will invalidate the session cookie. We and our service providers and other third parties described below may also use machine cookies, which do remain on a computer hard drive and gather information, sometimes over time and across sites. You can find more information about your choices regarding cookies under the heading “YOUR CHOICES ABOUT OUR COLLECTION, USE, AND DISCLOSURE.”
• Web Beacons. “Web beacons” or “tracking pixels” are electronic images, tags, or scripts that allow access to cookies and, among other things, help track general usage patterns of visitors to online services. Web beacons can recognize certain types of information, such as cookies, time and date of a page view, and a description of the page where the web beacon is placed. They may also be used to track interactions with emails. We, our service providers, and the third parties described below may use web beacons to compile information regarding your use of the Services.
• Location Information: We may collect information about your location (via GPS or other technologies), including when you enable location-based features in the Services, like allowing us to show you the nearest DTC store.

THIRD-PARTY DATA COLLECTION AND ADVERTISING

Like the internet itself, online marketing is a networked enterprise. Thus, we want to make it clear that we do use third parties, including Google, Facebook, Adobe, and Salesforce, to assist us, including with marketing, analytics, social media, and data analysis. These third parties may use cookies, or other methods or technologies like scripts, pixels, or action tags to collect information about you when you interact with the Services. We may also provide these third parties with information about you to assist us in our marketing efforts. We use the information we collect and receive for a variety of purposes, including to learn which online advertisements attracted you; to improve our content, products, and services; to inform groups of users about relevant products and services; to identify new customers; and to help us analyze and improve the Services and the effectiveness of our marketing. The use of your information may be governed by privacy policies maintained by those third parties. There is additional information about third-party data collection and targeted advertising in the section titled “Online Behavioral (Targeted) Advertising,” below. Third-Party Analytics. We also use third-party analytics in the Services, such as those provided by Google Analytics, Adobe, and ContentSquare, to, for example, enable us to continually improve upon the content we offer to you and our marketing efforts, for systems administration purposes, to evaluate your use of the Services, to compile reports on activity, to analyze performance metrics, and to collect and evaluate other information related to the Services. Some of our analytics can be used to track users over time, for geo-location purposes, and across third-party websites. Social Media Platforms. We use third parties to gather and analyze data from social media platforms, including, for example, Facebook®, Instagram®, Pinterest®, YouTube®, and Twitter®. We use these third parties to help us understand your interaction between social media and our Services, and to advertise to current and future customers based on interests and demographics. Online Behavioral (Targeted) Advertising. Online behavioral advertising is used to deliver advertisements that are catered to your interests (or “targeted” to you) based on your browsing history. We may engage third parties to display ads on our behalf on the Internet, including, for example, Google, and those third parties may use information about you to provide you with our ads. They may also track and report on the performance of our advertising and marketing campaigns and provide that information to us. Online behavioral advertising can use a variety of tracking technologies, including cookies, pixels, and scripts, and track you across websites.

DATA INTEGRATION

Some of the information we collect or that we receive from our service providers and third parties may be maintained or associated with other personal information we have or collect about you. This helps us to, among other things: (a) estimate our audience size and usage patterns; (b) store information about your preferences, allowing us to customize our Services according to your individual interests; (c) speed up your searches; (d) recognize you when you return to the Services; (e) improve the Services and any products and services we offer; and (f) improve our marketing efforts.

HOW WE USE INFORMATION

The information we gather works every bit as hard as a pair of Fire Hose Work Pants. It allows us to serve you better, in ways such as those described above and below. Uses of Personal Information. We may use your personal information:

• To respond to any request you have made, including for information, products, or about the Services;
• For our marketing efforts, including to keep you informed about existing and new products, to determine how best to market to you, and to provide you with surveys, questionnaires, and other promotional or marketing inquiries;
• To process, confirm, complete, and support any transactions requested by you, including any payments;
• To provide you with customer support;
• To communicate with you, including through email and SMS/text messages;
• To resolve issues or concerns, including any returns and exchanges;
• To improve the Services and our products, including your user experience;
• To protect the safety, security, availability and integrity of the Services, including to prevent fraud, theft, or other illegal activity;
• To monitor compliance with and enforce this Policy and our Terms of Use and any other applicable agreements and policies;
• To comply with or enforce our legal obligations or rights;
• If necessary, to notify you about changes to the Services and any products we offer or provide;
• In any other way we may describe when you provide the information; and
• To fulfill any other purposes for which you provide it or offer your consent.

Aggregated, Anonymized, and De-Identified Information. We may use or share information we collect automatically from your use of the Services that is not personal information and any other information that is otherwise de-identified or anonymized for any purpose, including with third parties to improve the content and functionality of the Services, to better understand our customers and markets, and to improve our products and services.

DISCLOSURE OF YOUR INFORMATION

We may share your information, including your personal information:

• With our subsidiaries and affiliates;
• With service providers we use to provide or support our business and the Services, including payment processors, data analytics providers, technology providers (for example, providers that send emails on our behalf, host or monitor the Services, operate our call center, and provide the chat functionality), maintenance providers, fraud prevention providers, shipping providers, and marketing providers;
• With third parties for marketing purposes as described in the “Third-Party Data Collection” section, above. We also share your personal information with carefully screened companies and organizations (third parties) whose products and activities might be of interest to you, including by submitting your information to marketing partners and cooperatives that provide us information about customers like you or provide your information to companies like us;
• With a buyer, successor, or any other party involved in a merger, acquisition, or other sale or transfer of same or all of our assets, equity, or business or any similar transaction, or as part of bankruptcy, dissolution, liquidation, or similar proceeding, as well as advisors, lawyers, accountants, and parties that may assist in the negotiation, review, and consummation of any such transaction or proceeding, either of which may involve personal information held by DTC as an asset;
• For any other purposes disclosed by us when you provide the information; or
• With your consent.

We may also share your personal information to comply with any court order or legal obligation, including responding to any lawful government or regulatory request, or if we believe disclosure is necessary to enforce or protect our rights, property, or safety, or that of our users or third parties. Where we provide personal information to our service providers, we strive to ensure that our service providers handle such personal information solely in the manner described in our agreement with them and in accordance with applicable laws.

YOUR CHOICES ABOUT OUR COLLECTION, USE, AND DISCLOSURE

There are steps you can take to manage your privacy, which we outline below. Keep in mind that an opt-out is typically valid only for the device that you use to opt-out; so, if you use multiple devices, you may need to opt-out on each device. Also, some opt-outs require that you accept a cookie or install a plug-in to record and honor your request; if you delete the cookie, you may need to opt-out again. In addition to the methods below, you may be able to use the incognito or private function in your browser or other software and plug-ins, to help manage your privacy preferences; make sure to review the privacy policy of any provider of such software or plug-in before installing it. Cookies. If you wish to disable or opt-out of some or all cookies, you may set your browser to refuse some cookies or to alert you when cookies are being sent. Your browser may also allow you to remove or delete cookies on your device. If you do so, please note that some parts of the Services may then be inaccessible or may not function properly. Information on deleting or controlling cookies can be found at www.aboutcookies.org. Analytics. Some of the analytics providers we use allow you to opt-out of data collection, as described below.

• Google Analytics: To opt-out, click here: https://tools.google.com/dlpage/gaoptout
• Adobe: To opt-out, click here: https://www.adobe.com/privacy/opt-out.html
• ContentSquare: To opt-out, [click here](javascript:window._uxa = window._uxa || []; window._uxa.push(['optout']); "Web Form")

Location Information. If you do not wish to share GPS location information with DTC, you may be able to turn off location sharing in your mobile device settings, or otherwise decline the option to allow your web browser to use your location for certain functionality like finding the nearest DTC store. E-mail Opt-Out. You may opt-out of receiving future communications from us by clicking on the “unsubscribe” link at the bottom of any email from us (or sent on our behalf). SMS/Text Messaging Opt-Out. You may opt-out of receiving future marketing text messages by replying “STOP” to one of our SMS/text messages. More information can be found in our SMS/Text Terms and Conditions here. Accessing and Correcting Personal Information. If you have an account with us and wish to review and/or update your personal information, please log into the Services and visit your account profile page to make any desired changes. If you are a California resident, you may have other rights which are described below in Appendix A (Privacy Information for California Residents). Google Ads. We use a number of Google services to assist us with advertising. To learn more about Google’s practices with regard to data collection, and to manage Google Ads, click here: https://policies.google.com/technologies/ads. Online Behavioral Advertising. You can opt-out of online behavioral advertising from members of the Digital Advertising Alliance and the National Advertising Initiative using the links below. For more information visit: https://youradchoices.com and https://www.networkadvertising.org/understanding-online-advertising/what-are-my-options. Our ads on third-party websites may also display an advertising options icon that you can click to learn about your privacy choices. This icon will only appear on certain platforms. The opt-out links are:

• NAI - Network Advertising Initiative: http://www.networkadvertising.org/choices or
• DAA - Digital Advertising Alliance Opt Out Tool: http://optout.aboutads.info

Social Media and Other Opt-Outs. You can also opt-out of some of our advertising and social media partners by visiting their opt-out pages:

• Facebook: https://www.facebook.com/help/568137493302217
• Twitter: https://twitter.com/personalization

Personal Information Opt-Out. If you prefer not to have your personal information shared with carefully screened companies or organizations (third parties) whose products might be of interest to you, just let us know by sending us an email at customerservice@duluthtrading.com, or contacting us by mail at 201 East Front Street, Mount Horeb, WI 53572, or calling 1-866-300-9719. Please note that we may take reasonable steps to verify your identity and the authenticity of your request, including where permitted or required by law.

EXTERNAL WEBSITES

Third-Party Links. Our Services may contain links to websites operated and maintained by third parties. We have no control over and are not responsible for the privacy policies or content on those websites, and any links to third-party websites do not imply an affiliation between DTC and the website owner, or any endorsement, approval, or verification of any content contained on those websites. Privacy policies on third-party websites and mobile applications may be different from our Policy. You access such links at your own risk. You should always read the privacy policy of a website or mobile application before disclosing any of your information. Social Media. If you use any functionality in the Services that allows you to interact with social media platforms (e.g., Facebook®, Instagram®, Twitter®, Pinterest®, and YouTube®) or otherwise interact with us on social media, generally, then please be aware that: (a) we may display your email address and/or social media handle (e.g., username) to other users; (b) we may use information you provide about yourself or other users to facilitate communications; and (c) we may collect information about interactions with us, including personal information and audio, video, and photos, and receive information from social media platforms about you, including as described in the section titled “THIRD-PARTY DATA COLLECTION.” Please note that any content you post to social media platforms is subject to the data handling practices of each social media platform, as described in their respective terms of use and privacy policy, which we encourage you to read before posting content.

DO NOT TRACK

The Services does not respond to “do not track” requests. All traffic is treated as equal and processed the same. If you desire to have your browsing be private, we suggest that you use your web browser’s private, incognito, or similar function, or utilize third-party software or plug-ins that have such functionality.

NOTICE TO CALIFORNIA AND NEVADA RESIDENTS

California. Residents of the State of California may have additional rights under California law with respect to their personal information. If you are a California Resident, please review Appendix A (Privacy Information for California Residents) to understand the rights you may have and how to exercise them. Nevada. Residents of the State of Nevada have the right to opt-out of the sale of certain pieces of information for monetary consideration, where the buyer of such information will sell and license it to others. DTC does not sell any personal information for monetary consideration, but DTC may share your information with third parties that want to market products or services to you. To opt-out of such activity, please follow the instructions in the section above entitled “Personal Information Opt-Out.”

CHILDREN UNDER THE AGE OF 13

Although we appreciate the Duluth Trading customers of the future, these Services are not intended for anyone under the age of 13, and we do not knowingly collect personal information from children under 13. In the event that we learn that we have collected personal information from a child under the age of 13 without parental consent, we will delete that information and otherwise comply with the requirements of any applicable law including the Children’s Online Privacy Protection Act. If you believe that we might have any information from or about a child under the age of 13, please contact us at customerservice@duluthtrading.com.

SECURITY

We strive to use reasonable means to secure your personal information while you are using the Services. However, please keep in mind that the transmission of information over the internet and on mobile platforms is not always secure, which means we cannot and do not guarantee the security or confidentiality of any personal information you provide to us. Given this reality, your use of the Services, and your decision to provide personal information to us, is at your own risk.

CHANGES TO THIS POLICY

Innovation is part of our company mission. As we constantly evolve and improve how we do business online, from time to time this Policy may change. The effective date of this Policy is the date next to the words “Last Modified” at the top of this Policy. We may update this Policy at any time, at our sole discretion, if we make material changes to the way we handle your personal information, or if material changes are necessary due to law. Our most current Policy will always be posted at https://www.duluthtrading.com, and at any other link you clicked on to reach this Policy. Any changes we make to this Policy will be effective immediately upon the posting of the updated Policy. As such, we encourage you to review this Policy regularly. Your continued use of the Services after we make changes will constitute your acceptance of any such changes.

Sales of Personal Information DTC does not sell your personal information for monetary payment, whatsoever. However, to ensure we can share our products with you and tailor our advertisements, we do allow some of our advertising partners to use cookies, pixels, and other technologies to collect personal information when you use the Services and we also share personal information with them directly, both of which may constitute a “sale” of personal information under CCPA. We also utilize marketing partners and cooperatives, which allow us to send and receive personal information to enhance our marketing efforts and permit you to receive ads for products and services that might be of interest to you from carefully screened companies, and this too may constitute a “sale” of personal information under CCPA. Given the foregoing, we have disclosed the following information in situations which might constitute a “sale” during the past twelve (12) months: Identifiers, Internet and Network Information, Device Information, Commercial Information, and Inferences. DTC does not knowingly sell the personal information of minors under sixteen (16) years of age. Personal Information Sales Opt-Out If you are 16 years of age or older, you have the right to direct us to not sell your personal information at any time (the “right to opt out”). We do not sell the personal information of consumers we actually know are less than 16 years of age, unless we receive affirmative authorization (the “right to opt in”) from either the consumer who is between 13 and 16 years of age, or the parent or guardian of a consumer less than 13 years of age. Consumers who opt-out of personal information sales may opt-in to future sales at any time. To exercise the right to opt out, you (or your authorized representative) may submit a request via our webform. Once you make an opt-out request, we will wait at least twelve (12) months before asking you to reauthorize personal information sales. However, you may change your mind and opt back in to personal information sales at any time by contacting us at customerservice@duluthtrading.com. You do not need to create an account with us to exercise your opt-out rights. We will use the personal information provided in an opt-out request only to review and comply with the request. California Residents’ Rights and Choices The CCPA provides California residents with specific rights regarding their personal information, described below. Below are your CCPA rights and how to exercise those rights. 1. Access to Specific Information and Data Portability Rights You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request, we will disclose to you:

• The categories of personal information we collected about you.
• The categories of sources of the personal information we collected about you.
• Our business or commercial purpose for collecting that personal information.
• The categories of third parties with whom we share that personal information.
• The specific pieces of personal information we collected about you.

2. Deletion Request Rights You have the right to request that we delete some or all of the personal information that we have collected from you and retained, subject to a number of exceptions. We (and our service providers) are not required to delete personal information where it is, for example: (a) necessary to complete a transaction with you or for warranty or product recalls; (b) used for security purposes, to prevent fraud, to fix errors, or to comply with law; (c) reasonable for us to use for internal purposes given our relationship with you; or (d) compatible with the context in which you provided the information. The list of exceptions above is not exhaustive and we may also deny a deletion request as otherwise permitted by law. 3. Exercising Your Rights To exercise your rights described above, please submit a verifiable consumer request to us by either:

• Calling us at 1-866-401-9314, or
• Filling out our webform

Only you, or a person that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child. If you are making a request on behalf of another person, we may require that you prove you are authorized to act on behalf of that individual. You may make a verifiable consumer request for access or data portability only twice within a 12-month period. The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative; and
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We may not be able to fulfill your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. To verify your identity, we may request certain pieces of personal information about you, and we reserve the right to take additional steps as necessary to verify your identity if we have reason to believe a request is fraudulent. We will use the personal information provided in a verifiable consumer request only to verify the requestor’s identity or authority to make the request. 4. Response Timing and Format We endeavor to respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. We will deliver our written response by mail or electronically, at your option. Any disclosures we provide will cover only the 12-month period preceding the date we receive your verifiable consumer request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance. We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request. 5. Non-Discrimination You have the right to not be discriminated against for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

• Deny you goods or services;
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;
• Provide you a different level or quality of goods or services; or
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Other California Privacy Rights California’s “Shine the Light” law (Civil Code Section § 1798.83) permits users of the Services who are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please contact us through the information provided in the CONTACT US section of our Privacy Policy.

CONTACT US

Have questions or comments? We want to hear from you. If you have feedback about this Policy or our Terms of Use, wish to remove or change your contact information in our database, or do not want to receive future mailings or other communications, as well as other inquiries, just contact us at any time using one of the options below:

• Via e-mail: customerservice@duluthtrading.com
• Via telephone: 1-866-300-9719
• Via mail: Duluth Trading Co., 201 East Front Street, Mount Horeb, WI 53572

APPENDIX A (PRIVACY INFORMATION FOR CALIFORNIA RESIDENTS)

This Appendix supplements the information contained in the DTC Privacy Policy and applies solely to residents of the State of California (“consumers” or “you”). When you use the Services, we may collect personal information. Personal information is defined under the California Consumer Privacy Act (“CCPA”) as information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device. Personal information does not include publicly available information from government records, de-identified or aggregated consumer information, or information excluded from CCPA’s scope, like health or medical information subject to HIPAA, and financial information subject to GLBA or FCRA. Disclosures In the past twelve (12) months, we have collected the categories of personal information described in the Privacy Policy section entitled “Types of Information We Collect.” In the past twelve (12) months, we have used and shared personal information of consumers in those categories as follows: