Personal, Sensitive, and Non-Personal Data We Collect and How We Use and Disclose It

We collect data about users of the Sites directly, automatically when you visit the Sites, and sometimes from third parties. Some of this data may be considered personal information or personal data, and some of which may be considered sensitive, under various applicable laws. We will also treat other information, including IP addresses and cookie identifiers, as personal data where required by applicable law and we will treat certain personal data as sensitive data as required by applicable law.

Note that we may de-identify or pseudonymize personal data so that it is non-personal, such as aggregating (such as combining it with data about other individuals) and/or or converting it to a code, sometimes using a function commonly known as “hash”, or otherwise removing characteristics that make the data personally identifiable to you. We maintain and use de-identified data without attempting to re-identify it, except where permitted by applicable law, such as to determine whether our de-identification processes satisfy legal requirements. We will treat de-identified or pseudonymized data as non-personal to the fullest extent allowed by applicable law. If we combine non-personal data with personal data, then we will treat the combined information as personal data under this Privacy Policy.

The following chart sets out by category the personal data collected (Category), the purposes for which the information is collected (A. Purposes), the categories of third parties to whom the information may be disclosed for a business purpose (B. Disclosed To), and the categories of third parties to whom the information may be sold for monetary value or other valuable consideration or shared for cross contextual behavioral advertising/targeted marketing (C. Sold/Shared To).

For more information about certain practices disclosed in the chart, please also see the Additional Details About our Data Practices

[chart]

Additional Details about our Data Practices

We provide in this section additional detail about the data practices listed in the chart above, where it would be helpful for your understanding of such practices.

1. Device ID/Interaction Information Boot Barn and our third-party business partners (including any third-party service providers or third-party content, advertising, and analytics providers) may use a variety of technologies, including cookies and pixel tags, that automatically or passively collect information whenever you access, use, or otherwise interact with the Sites (Device ID/Interaction Information). Device ID/Interaction Information may include, but is not limited to:

   • Your IP address, mobile device identifier and other unique identifier

   • Device information, including device model, operating system version, device date and time, mobile network information

   • How you use and interact with the Sites, including your search terms, pages you visit, content you view and add to your shopping basket, time of your last interaction, time spent on the Sites, and your preferences through a unique visitor ID.

   Precise Location Data. In some cases, we may directly collect precise location data through your device. You may be able to turn off the collection of location data through the settings on your device. However, please note that we may still be able to infer your approximate location through other data we collect, such as IP address.

   Device ID/Interaction Information may be collected through the use of the following technologies:

   Cookies and Local Storage. Cookies and local storage are text files placed within a browser on a device when it is used to visit the Sites. Certain web browsers and browser add-ons may provide additional local data storage mechanisms. We may use cookies and similar technologies to help keep your use of the Sites more secure, to study traffic patterns on the Sites, to study the effectiveness of our customer communications, to maintain the integrity of the Sites, to measure crash analytics and other maintenance related information, to manage and measure the performance of advertisements displayed on or delivered by or through the Sites, and to personalize your experience through the Sites, such as to recognize you when you return to the Sites. Most browsers provide you with the ability to disable, decline, or clear cookies and local storage; please check your browser’s settings for further information. For more information about cookies, please visit https://www.allaboutcookies.org/. If you don't want to enable cookies but would like to place an order, please call us toll free at 1.888.440.2668.

   Pixel Tags. Small graphic images or other web programming code (also known as web beacons or web tags) may be included in our web pages and email messages. These and similar technologies may be used by us and our third party providers for a number of purposes, including to count visitors to the Sites, to monitor how users navigate Sites, to count how many of our email messages were opened, or to count how many particular products were viewed, or for marketing and targeted advertising purposes. The data we collect through this technology may include the first date and time you open our email, and whether you click any links included in our email.

   Embedded Scripts. An embedded script is programming code that is designed to collect information about your interactions with the Sites, such as the links you click on. The code is temporarily downloaded onto your device from our server or a third-party service provider, is only active while you are connected to one of the Sites, and is deactivated or deleted thereafter.

   Data Collected Through Mobile Devices and SDKs. We use embedded scripts and the tools provided in Software Development Kits (SDKs) to collect data through mobile devices such as the hardware model, operating system and version, identification numbers assigned to your mobile device, such as the ID for Advertising (IDFA) on Apple devices, and the Advertising ID on Android devices, mobile network data, and website usage behavior. SDKs are software packages that contain a set of tools that can be used to help build applications and implement new features in existing apps including those that collect data from your device.

   In addition, we may use a variety of other technologies that collect similar data for security, fraud detection, and maintenance purposes.

2. Data We Receive or Collect from Third Parties.

   Enhancement Data. We may receive data about you from third parties, such as data aggregators, joint marketing partners, third party websites, service providers and other business partners. This may include contact information, such as your email or mailing address, so that we may contact you if you express interest in our Sites. We may also supplement the data we collect with outside records from third parties, such as public databases, publicly available social media pages, and third parties who enhance the data we have about you, in order to provide you with information or services you have requested, to tailor content, to offer you opportunities to purchase products or services that we believe may be of interest to you, and for other purposes. The data collected and stored by third parties is subject solely to the third party’s privacy practices.

   Refer-A-Friend. We may make available a send-to-a-friend, refer a friend, wishlist or similar function that permits you to send content directly to a third party through the Sites. If you send a friend a communication using such functionality, the data you provide about your friend (e.g., name and e-mail address) is used to facilitate the communication and is not used for any other marketing purpose unless we obtain consent from that person. If you disclose any personal data relating to other people, you represent that you have the authority to do so and to permit us to use the data in accordance with this Privacy Policy. For further restrictions related to Canadian residents, please see our Notice to Canadian Residents below.

3. Data You Provide Directly.We may ask you to provide data directly when you use the Sites.

   Chats. When you participate in a chat feature, Boot Barn can record, use, and retain your communications and the data you provide in order to assist you during the chat session, provide customer support, to improve our products and services, and for marketing purposes. If you do not consent, please do not continue with chat assistance.

   Sweepstakes, Contests, Promotions. We may offer sweepstakes, contests, or other promotions (any, a Promotion), that may require registration. By participating in a Promotion, you are agreeing to the provisions, conditions, or official rules that govern the Promotion, which may require specific requirements of you (including, without limitation, and except where prohibited by law, allowing the sponsor(s) of the Promotion to use your name, voice, likeness, or other indicia of persona in advertising or marketing materials). If you choose to enter a Promotion, personal data may be disclosed to third parties or the public in connection with the administration of such Promotion, including, without limitation, in connection with winner selection, prize fulfillment, as required by law or permitted by the Promotion’s terms or official rules (such as on a winners list).

   Community Forums and User Submissions. The Sites may offer you the opportunity to submit information to us, through message boards and other communication functionality (Community Forums) where you can choose to interact with others and/or to post or submit content. You may choose, through such features or otherwise, to submit or post User Submissions (which means any and all information and content that you submit or post to the Sites, including, without limitation, photos, audio, video, messages, text, files, reviews, or other content you provide us and as further described in our Conditions of Use Use).

   Your use of any Community Forum is subject to our Conditions of Use. Note that anything you submit through a Community Forum may be made public and others will have access to your User Submission and may use it or share it with third parties. We are not responsible for the actions of third parties and the use of your data and other User Submissions by such third parties is not subject to the protections of this Privacy Policy.

4. Disclosure of Data to Third Parties. We may share the data we have collected about you (including personal data) in the circumstances described below or elsewhere in this Privacy Policy, as disclosed at the time you provide data, or otherwise with your consent.

   Please note that we are not responsible for the privacy practices of any third party. If you decide that you do not want to receive communications from a third party, or have questions about their privacy practices, you will need to contact that third party directly.

   Cobranded Credit Card. When you apply for and use a branded credit card, Boot Barn may share certain data at your direction to facilitate your application and use of the card. In addition, Boot Barn may share data with the issuing bank for our Boot Barn credit card, and its affiliates, for purposes related to those credit cards. For example, we may share information to send joint offerings, including information on how to apply for a Boot Barn credit card, and in connection with your use of a Boot Barn credit card, such as to maintain or service accounts and to effectuate transactions. We may also share data with these parties for analytics purposes.

   Social Media and Other Third Party Platforms. The Sites may permit or facilitate interactions with an interactive third-party website or service (Social Media), such as enabling you to like or share content. If you choose to share content or otherwise post information from or via the Sites to Social Media, that data may be public, and the third party may have access to data about you and your use of the Sites. You may also choose to participate on Social Media in a way that connects that third-party service with the Sites (such as posting to one of our pages on a Social Media site or signing into the Sites with your credentials from another website or service). Doing so may allow us to collect (or the third party to share) data about you. These third-party Social Media platforms may be able to collect certain data about your visits to the Properties regardless of whether or not you affirmatively interact with the feature and whether or not you are logged into (or have) an account with the third-party platform.

   We may also receive data about you if other users of Social Media give us access to their profiles and you are one of their connections or friends. The data we collect is subject to this Privacy Policy. The data collected and stored by the third party remains subject to the third party’s privacy practices, including, without limitation, whether the third party continues to share data with us, the types of data shared, and your choices with regard to what is visible to others on that third-party website or service. The third party may allow you to remove the application or feature, in which case we will no longer collect data about you through the application or feature, but may retain the data previously collected.

   Third Parties Providing Services on Our Behalf. We may share data with third parties who perform services on our behalf, such as website hosting, conducting website usage analysis, sending email or other communications, fulfilling orders, providing marketing assistance and data analysis, processing payments (including clearing and processing credit card payments), running promotions, or performing other services. We may provide access to your personal data to such service providers in order for them to perform these services. Additionally, we may share various information relating to our users and fraudulent or potentially fraudulent activities with our fraud prevention and similar service providers, and they will use this information to help us and their other clients prevent fraudulent and illegal transactions.

   We use retention.com’s third-party services to help identify you when you visit the Sites by associating the information collected from you when you interact with the Sites with information they or others have about you, including your email address, and to send you communications including marketing. You may opt out of retention.com’s database, which will also opt you out of receiving these communications, by visiting https://app.retention.com/optout.

   Business Transfers and Transitions. Your personal data may be provided to third parties in connection with a business transaction, including a merger or sale (including transfers made as part of insolvency or bankruptcy proceedings) involving all or part of Boot Barn or as part of a corporate reorganization, or stock or asset sale, or other change in corporate control, including for the purpose of determining whether to proceed or continue with such transaction or business relationship. Your personal data may also be one of the transferred assets as part of the transaction or bankruptcy. We may also share your personal data in the due diligence process or to otherwise facilitate any such transaction, and with individuals assisting in the transaction or in connection with a bankruptcy.

   Administrative and Legal Reasons. Boot Barn reserves the right to use or disclose any data as needed to satisfy any law, regulation or legal request; to protect the integrity of the Sites; to fulfill your requests; to cooperate in any law enforcement investigation, an investigation on a public safety matter, or an investigation into claims of intellectual-property infringement; to protect and defend the legal rights or property of Boot Barn, our affiliates and shareholders, any Sites or its users, or any other party; or, in an emergency, to protect the health and safety of our users or the general public. This includes exchanging data with other companies and organizations for fraud protection and credit risk reduction.

   SMS/MMS/RCS Message Data. Notwithstanding anything else in this policy, Boot Barn does not share personal data we collect specific to our SMS/MMS/RCS text message programs (such as mobile number and record of consent) with unaffiliated third parties for their own direct marketing purposes without your consent.

   Non-Personal Data. Except as expressly prohibited by law, we may share non-personal data that we collect, such as certain Device ID/Interaction Information, aggregate user statistics, and hashed or otherwise de-identified or pseudonymized data (including email addresses), and/or our analyses derived from such data, with third parties in our discretion, including for targeted advertising purposes.

Data Retention

We will retain all categories of personal data described in this Privacy Policy for as long as it is reasonably necessary for the purposes set out in this Privacy Policy, considering the time period reasonably necessary to: use the Sites; exercise the choices and rights you have requested; comply with our contractual obligations; enforce our terms for use of the Sites; and comply with legal and regulatory requirements. Except as noted differently on specific pages or apps, we retain your personal data while you have an account with us, or while you are using our Sites or continuing to visit us.

Third Party Advertising and Analytics/Privacy Controls

We may use third party business partners, such as analytics companies, ad agencies, network advertisers, and others who provide us with data about the Sites, users, and our advertisements, and who deliver ads to you on our behalf on the Sites and elsewhere online. We and our third party business partners collect certain data about your visits to and activity on the Sites and other websites and services, including through the Social Media Features, and may use this data to target advertising to you and others and to assess the effectiveness of our advertising. We may also share (or permit third parties to collect) certain data, such as Device ID/Interaction Information, aggregated or de-identified, pseudonymized or hashed data (including email addresses), with these third parties for similar purposes.

These third parties may set and access their own tracking technologies on your device (including cookies, pixel tags or other technology) and may otherwise collect or have access to your personal data over time, including about your visits to the Sites as well as other websites and online services, some of which may be personal information or personal data under various state laws. Companies that we share data with, including ad agencies and networks, may use the data, often in combination with their existing data, in order to present more relevant advertisements that may be of interest to you, and to help us and third parties to do the same.

• Cookie Opt-Out Tools. To disable sharing through cookies set on our site by third parties for advertising and analytics purposes, please adjust your settings by clicking here: [LINK to trigger cookie manager.]. Certain jurisdictions provide their residents further rights, please see Jurisdiction Specific Rights below regarding additional rights you have.

• NAI/DAA Opt-Out. Some of the companies we use may be members of the Network Advertising Initiative (“NAI”) or Digital Advertising Alliance (“DAA”). The NAI provides information regarding targeted advertising and the opt-out procedures of NAI members, including opt-out mechanisms for web browsers, mobile and other connected devices, and a tool to opt out from participating NAI members using your hashed email address for interest-based advertising. You may also want to visit the DAA's website, which provides information regarding targeted advertising and offers an opt-out for DAA-participating companies and the European DAA online choice page at http://youronlinechoices.eu/. To learn more about interest-based advertisements from participating third parties in Canada, please visit the Canadian DAA online choice page at https://youradchoices.ca/choices/.

• Mobile Device/AppChoices. Mobile devices may contain settings that allow you to disable tracking advertising and/or analytics. In addition, the digital advertising industry has provided the ability for mobile users to register at AppChoices for their intent not to receive targeted advertising.

• Google Analytics. We use Google Analytics, which uses cookies and similar technologies to collect and analyze data about the use of the Sites and report on activities and trends. This service may also collect data about the use of other websites, apps, and online services. You can learn about Google's practices, and opt out of them by downloading the Google Analytics opt-out browser add-on.

• Additional Third-Party Services. We use retention.com’s third-party services to help identify you when you visit the Sites by associating the information collected from you when you interact with the Sites with information they or others have about you, including your email address, and to send you communications including marketing. You may opt out of retention.com’s database, which will also opt you out of receiving these communications, by visiting https://app.retention.com/optout.

Please note that opting out through these mechanisms does not opt you out of being served advertising, and that you will continue to receive generic ads while online. Your opt-out choices are browser and device specific; if you disable your cookies, upgrade your browser after opting out or if you use multiple different devices, please opt-out on each device and each browser separately.

Loyalty Program Disclosures

We provide the B Rewarded Program, Club C.O. Rewards, and Sheplers Rewards if needed (collectively Boot Barn Rewards Programs) all of which provide you with loyalty benefits such as points on your eligible purchases that are redeemable for credit on your purchases, access to exclusive offers, and the ability to maintain wish lists and your order history. This program is subject to termination at any time at our sole discretion. Additional information available at https://www.bootbarn.com/cs-rewards-program.html, https://www.countryoutfitter.com/loyalty, and https://www.sheplers.com/loyalty.

Through our Boot Barn Rewards Programs, we process, including for targeted advertising purposes, the following personal data: Loyalty Number, points, and rewards (Loyalty Program Data). Loyalty Program Data is personal data that would not be collected, processed, sold, or shared if you were not a member of the Boot Barn Rewards Programs. This section discusses our practices in relation only to Loyalty Program Data. We may collect, process, sell, and share other personal data of members and non-members alike, including for targeted advertising, as set forth in other sections of this Privacy Policy.

Boot Barn does not sell Loyalty Program Data for targeted advertising purposes. The Boot Barn Rewards Programs does not include loyalty program partners, which is defined as an unaffiliated third party who offers benefits to a company’s loyalty program members. However, the following third parties may receive Loyalty Program Data: Spire, Coefficient, and Cordial received loyalty program data.

Impact of Deletion of Personal Data: If you are a Boot Barn Rewards Program member who is eligible to and chooses to exercise your right to delete your personal data, your Boot Barn Rewards Program account, including the unique membership identification number, any accrued points associated with the account, your contact information, and any other information tied to your membership account will also be deleted. There is no benefit of the Boot Barn Rewards Programs that can be extended to you after the deletion of your personal data.

• Our program is based on points which accrue to your unique membership identification number based on your purchases. Points are debited based on your point redemptions and returns. Without the ability to relate and track your transactions to the membership identification number that will be deleted as a result of your deletion request, we will be unable to add or deduct points based on your transaction activity, or access any previously accrued points.

• Without your email address, we will be unable to send you member-only offers such as seasonal and exclusives deals.

• Once your unique membership identification number is deleted from our systems, we will be unable to recognize your membership identification number to provide you with access to your order history, wish lists, and other member-only benefits that we may offer from time to time.

• If you choose to exercise your data privacy rights such that your membership in the Program is impacted, we will notify you at the contact information you have provided to us, the consequences of your decision at least five (5) days prior to discontinuing your membership.

Additionally, if you are a California consumer, please see here for our Notice of Financial Incentive. [Insert link to Notice of Financial Incentive in CPRA Notice]

Your Choices

Marketing Communications from Us. We may provide you with the option to update your information or to opt out of marketing communications through the profile and/or preferences section of your account. In addition, you may opt-out of marketing communications as set forth below.

• Email. You may unsubscribe from marketing emails we send you through the opt-out mechanism included in each such email. Note, however, that we reserve the right to send you certain communications relating to your use of the Sites, notices of changes to this Privacy Policy or other terms, or similar administrative and transactional messages.

• Catalog Requests. We need your name and address in order to mail you a catalog. We also require a phone number, or e-mail address, so that we can contact you in the event there is an error in your address, or other delivery problem. To stop receiving catalogs, simply e-mail us at mailto:custserv@bootbarn.com.

• Text Messages. If you sign up to receive SMS, MMS or RCS messages from Boot Barn, you may unsubscribe by replying “STOP” to the short code.
• Push Notifications. We may send promotional and non-promotional push notifications or alerts to your mobile device, and may in some cases do so based on your device’s location or physical proximity to a beacon. You can elect to stop receiving those messages at any time by changing the notification settings on your mobile device.

Data Privacy Choices. Opt-Out of Targeted Advertising – Boot Barn engages in online advertising practices (and certain analytics or similar activities) that may be considered “targeted advertising” under these states’ laws. To disable sharing through cookies set by third parties that may be considered targeted advertising under such laws, please visit our Cookie Preference Center here [Insert link] Please also review the Third Party Advertising and Analytics/Privacy Controls [insert hyperlink to above section] section above for information on industry tools and device settings that may be available to you.

• Access, Correction and Deletion. You are responsible for maintaining the accuracy of the data you submit to us, such as your contact data. Boot Barn will make good faith efforts to make requested changes in our then active databases as soon as reasonably practicable. Note, however, that data may persist internally for administrative purposes and that residual data may remain on backup media or for other reasons.

  You may access your personal information by signing into your account. From there, you can correct or modify your information. You may also exercise your rights, subject to applicable laws, to request that we delete or restrict access to your personal data. If you need assistance correcting or updating your personal information, or would like to request that we delete your personal information, please submit your request using this form [Link]. Certain jurisdictions provide additional privacy rights, please see more in the Jurisdiction Specific Rights [Hyperlink to section] section, below.

Security

Boot Barn uses commercially reasonable steps designed to secure your personal data; however no data transmission over the Internet, wireless transmission, or electronic storage of data can be guaranteed to be 100% secure. Boot Barn cannot ensure or warrant the security of any data we collect. You use the Sites and provide us your data at your own risk.

Third Party Content and Links

The Sites may contain content that is served by someone else or links to third-party content or websites. Boot Barn does not control this content or these sites. The third-party operators and content providers use their own cookies or other tracking technologies, and they may independently collect data from or about you. Boot Barn is not responsible for the privacy practices employed by any third party.

Consent to Transfer

Boot Barn is a US-based company. Please be aware that the data we collect will be transferred to and processed in the United States and other countries. By accessing using the Sites, or providing us with any data, you fully understand and unambiguously consent to this transfer to, and processing, usage, sharing, and storage of your data in the United States and other jurisdictions, for which the privacy laws may not be as comprehensive as those in the country where you reside and/or are a citizen. As a result, this data may be subject to access requests from governments, courts, or law enforcement in the United States and other countries according to the laws in those jurisdictions. Your data will also be disclosed to third parties as described in the Personal, Sensitive, and Non-Personal Data We Collect and How We Use and Disclose It section above.

General Audience Sites

The Sites are general audience and do not target users younger than the age of 18. We do not knowingly collect personal data online from children younger than the age of 18. If you are a parent or guardian and think we have data about your child, please contact us at [Insert contact method].

Changes to This Privacy Policy

To the extent permitted by applicable law, we reserve the right to change or modify this Privacy Policy at our discretion at any time. We will notify you of material changes by posting the changed or modified Privacy Policy on our Sites. We may also provide notice to you in other ways, such as through contact information you have provided. Any changes will be effective immediately upon the posting of the revised Privacy Policy unless otherwise specified. Your continued use of the Sites after the effective date of the revised Privacy Policy (or such other act as specified in the revised Privacy Policy) will, to the fullest extent permitted by applicable law, constitute your consent to those changes. However, we will provide notice and obtain your consent (opt-in or opt-out) if required by law. Note that you may need to consent to our new policies to continue using the Sites.

How to Contact Us

You may contact us by emailing privacy@bootbarn.com or calling us at [Insert phone number if applicable]. The information you provide is used to respond directly to your questions or comments. We may also file your comments and share them with our consumer care team to improve our service in the future. If you still have questions or concerns about our privacy policy, please write us at:

17100 Laguna Canyon Road, Irvine, CA 92618

Jurisdiction Specific Rights

Residents of certain countries and U.S. states may have the ability to exercise additional rights and choices regarding their personal data. We will take reasonable steps to accommodate your request, but may need to verify your identity before doing so. If you are a resident of a U.S. state with specific rights, please see additional information below. Residents of Canada and the EEA/UK/Switzerland, please see additional information below.

U.S. State-Specific Rights
Residents of certain U.S. states may have the ability to exercise additional rights and choices regarding their personal data. We will take reasonable steps to accommodate your request but may need to verify your identity before doing so. If you are a resident of Colorado, Connecticut, Delaware, Iowa, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, or Virginia, please see additional information below. If you are a California resident, please see the California Privacy Notice below. If you are a Nevada resident, please see below.

Colorado, Connecticut, Delaware, Iowa, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia. We set forth above the categories of personal data we process, the purpose for processing personal data, the categories of personal data shared, and the categories of third parties with whom personal data is shared. Depending on your state of residence, residents of Colorado, Connecticut, Delaware, Iowa, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia may have the following privacy rights with respect to this data.

If you are a Consumer residing in one these states (as defined in each state’s respective law) and would like to exercise your applicable rights, please complete this form or call 1-844-901-1870 to submit a request.

1. Access Your Personal Data/Data Portability (CO, CT, DE, IA, MN, MT, NE, NH, NJ, OR, TN, TX, UT, VA Residents) - You have the right to confirm whether we are processing your personal data and request to access such data., Where required by law, this includes to obtain a copy of the personal data we hold about you and, to the extent feasible and where permitted by applicable law, in a readily usable format to allow data portability. For Oregon and Minnesota residents or where otherwise provided by applicable law, this includes a list of third parties with whom we have shared personal information. For Delaware residents, and where otherwise provided by applicable law, you have the right to request a list of categories of third parties with whom we have specifically shared your personal data.

2. Delete Your Personal Data (CO, CT, DE, IA, MN, MT, NE, NH, NJ, OR, TN, TX, UT, VA Residents) – You have the Right to Delete your personal data.

3. Correct Your Personal Data (CO, CT, DE, MN, MT, NE, NH, NJ, OR, TN, TX, VA Residents) – You have the Right to Correct the personal data we hold about you.

4. Opt-Out of Sales of Your Personal Data and Targeted Advertising (CO, CT, DE, IA, MN, MT, NE, NH, NJ, OR, TN, TX, UT, VA Residents) – You have the right to opt out of the sale of your data. Boot Barn does not sell personal data to third parties for monetary compensation, as defined by Iowa, Tennessee, Virginia, and Utah laws and therefore does not offer this opt-out right to residents of these states. Sharing of IP addresses or mobile ad IDs with third party advertising vendors and certain other targeted advertising practices may constitute a sale under definitions set forth under other state laws. If you would like to opt out of the sale of your personal data, please make a request using the methods to exercise your rights listed above. Please note that opting out of sales and targeted advertising will not opt you out of all advertising.

   • Cookie-Based Opt-Outs for Sale and Targeted Advertising – Boot Barn engages in online advertising practices (and certain analytics or similar activities) that may be considered targeted advertising under CO, CT, DE, MN, MT, NE, NH, NJ, OR, TN, TX, UT, VA state laws. To disable sharing through cookies set by third parties that may be considered targeted advertising under such laws, adjust your settings in our Cookie Preference Center [Link to cookie manager]. Please also review the Third-Party Advertising and Analytics [hyperlink to Third Party Advertising and Analytics/Privacy Controls section] section above for information on industry tools and device settings that may be available to you.

   • NOTICE: We may sell your sensitive personal data. Specifically, with your consent where required by law, we may disclose your precise geolocation to third parties to better serve localized advertisements to you.

5. Right to Appeal (CO, CT, DE, IA, MN, MT, NE, NH, NJ, OR, TN, TX, VA Residents) - If, for any reason, you would like to appeal our decision relating to your request and you are a resident of Colorado, Connecticut, Delaware, Iowa, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, or Virginia, you have the right to submit an appeal and can do so contact us using the instructions above. Please include your full name, the basis for your appeal, and any additional information to consider.

6. Sensitive Data – If you are a Colorado, Connecticut, Delaware, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Virginia resident, or a resident of another state that requires such, we will obtain your consent to the processing of any Sensitive Data (as defined by the applicable state law) we collect. If you are a resident of Iowa, Utah, or another state that requires such, we will notify you at or before the time of collection of Sensitive Data (as defined by the respective law).

7. Opt-Out of Profiling in furtherance of legal or similarly significant effects – Boot Barn does not process your personal data for the purposes of profiling in furtherance of decisions that produce legal or similarly significant effects as defined under these state privacy laws.

8. Authorized Agents Submitting Opt-Out Requests for Sales and Targeted Advertising (CO, CT, DE, MN, MT, NE, NH, NJ, OR, TX Residents Only) – If you are an authorized agent submitting a request to opt out of sales or targeted advertising on behalf of a Colorado, Connecticut, Delaware, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, or Texas resident, please submit the request pursuant to the above instructions. Where permitted by law, we may require documentation to authenticate the Consumer’s identity and that you are authorized to submit the request on the consumer’s behalf in order to be able to fulfill your request. Please keep in mind that if we cannot authenticate that you are authorized to act on the Consumer’s behalf or we cannot authenticate the Consumer’s identity, we may deny the request.

9. Nevada. Boot Barn does not currently sell your covered information as those terms are defined under applicable Nevada law. You may still submit an opt-out request and we will honor that request as required by Nevada law if Boot Barn were to engage in such a sale in the future. If you are a Nevada resident and would like to opt-out of the sale of your covered information, please submit your request to [Insert method for processing Nevada requests. This can be done via email, webform, or phone number]. Your request must include your full name, street address, city, state, zip code, and an email address so that we can contact if needed regarding this request. If you previously provided a phone number, it will assist us in making sure we identify you as someone who wants to opt-out. You may also be required to take reasonable steps as we determine from time to time in order to verify your identity and/or the authenticity of the request. Boot Barn will respond to your request within sixty (60) days either confirming that your request has been processed or indicating that we need an additional thirty (30) days to complete the request.