Privacy Policy

Duck Donuts Holdings, LLC (“Duck Donuts,” the “Company,” “we,” or “us”) respects your privacy and is committed to protecting it through our compliance with this policy. This policy describes the types of information we may collect from you and our practices for collecting, maintaining, protecting, using, and disclosing that information.

This policy applies to personal information that we collect:

• Through our Website,www.duckdonuts.com, and any desktop or mobile applications or other mechanisms we provide to connect to our Website functionality (collectively, the “Service”).

• In email, text, chat, and other electronic messages between you and Duck Donuts.

• In person (including at our brick-and-mortar locations), over the phone, in writing, or through the mail.

• When you interact with our advertising and applications on/through third-party websites and services (if those applications or advertising include links to this policy).

It does not apply to personal information collected by:

• Any third party (such as social media platforms), which includes through any third-party application or content, (for example, advertising) that may link to or be accessible from or on the Service.

• Us pertaining to employees, job applicants, or independent contractors located outside of California.

• Us about entities or individuals with whom we only have a business-to-business (“B2B”) relationship and who are located outside of California.

• By our franchisees, if they collect your personal information through any method for their own purposes.

Please read this policy to carefully understand our policies regarding our collection, treatment, and use of your personal information. If you do not agree with our policies and practices, you should not use our Service. By accessing or using the Service, you accept and agree to be bound and abide by this Privacy Policy and our Terms of Use. You should periodically review this Privacy Policy because it may change from time to time. By continuing to use the Service, you agree to be bound by such changes.

Information we may collect about you

We collect several types of information from and about users of our Service, including information:

• That personally identifies you in particular, or that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (“personal information”), such as name, mailing address, email address, telephone number, employer, and job title. Personal information also includes “sensitive personal information” which is described later in the policy, but does not include publicly available information from government records or deidentified or aggregated consumer information.

• That is about you but (individually) does not identify you.

• Your payment information, when you make a purchase or place an order through our Service or at one of our brick-and-mortar locations.

• About your internet connection, the equipment you use to access our Service, and usage details (such as the pages of the Service you visit, the time of your visit, and the time spent on those pages).

• About your location when you access and use our Service.

How we collect information

We collect this information:

• Directly from you (for example, from forms you complete or products and services that you purchase).

• Automatically as you navigate through the Service. Information collected automatically may include usage details, IP addresses, and information collected through cookies, web beacons, and other tracking technologies.

• When you enable location services on your device.

• From our franchisees.

Information you provide to us

The personal information you provide to us may include:

• Information that you provide by filling in forms in our Service. This includes information provided at the time of registering to use our Service, subscribing to our newsletters and communications, posting material, or requesting further services or additional information. We may also ask you for information when you enter a contest or promotion sponsored by us and when you report a problem with our Service. Personal information you provide directly to us may include:

  • First and last name

  • Email address

  • Phone number

  • Address

  • Username and password

• Records and copies of your correspondence (including name, email addresses, or other contact information) if you contact us.

• Your responses to surveys that we may ask you to complete for research purposes.

• Details of transactions you carry out though our Service and at our brick-and-mortar stores for the fulfillment of your orders. You may also be required to provide payment information before placing an order through our Service.

• Your search queries on the Service.

You may also provide information to be published or displayed (“posted”) on public areas of the Service or transmitted to other users of the Service or third parties (“user contributions”). Your user contributions are posted on and transmitted to others at your own risk. We cannot control the actions of other users on the Service with whom you may choose to share your user contributions. Therefore, we cannot and do not guarantee that your user contributions will not be viewed by unauthorized persons.

Information we collect through automatic data collection technologies

As you navigate and interact with our Service, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:

• Details of your visits to our Service, including traffic data (including the site you access the Service from), location data, logs, and other communication data and the resources that you access and use on the Service.

• Information about your device (including any mobile device), computer, and internet connection, including model, brand, device date, IP address, operating system, mobile network, and browser type.

The information we collect automatically includes personal information. It helps us improve our Service and deliver a better more personalized service to you by enabling us to:

• Estimate our audience size and usage patterns.

• Store information about your preferences, allowing us to customize our Service according to your individual interest.

• Speed up your searches.

• Recognize you when you return to our Service.

The technologies we use for this automatic data collection may include:

• Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your computer. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting, you may be unable to access certain parts of our Service. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you direct your browser to our Service.

• Flash cookies. Certain features of our Service may use local stored objects (or Flash cookies) to collect and store information about your preferences and navigation to, from, and on our Service. Flash cookies are not managed by the same browser settings as are used for browser cookies.

• Web beacons. Pages of the Service and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit the Company, for example, to count users who have visited those pages or opened an email and for other related website statistics (for example, recording the popularity of certain website content and verifying system and server integrity).

• Advertising and marketing pixels. We use advertising and marketing pixels for remarketing and conversion tracking purposes. The specific pixels and/or tags that we may use include but are not necessarily limited to: Meta/Facebook Ads Pixel, Google Ads Tag, and Bing Ads Tag.

• Session replay tools. We may use session replay tools to better understand our users’ needs and to optimize this service and experience. Session replay helps us better understand our users’ experience, including how much time they spend on which pages, which links they choose to click, what users do and don’t like, etc. Some session replay tools may allow us to visually represent where users click, move, and scroll on our Service. This type of technology enables us to build and maintain our Service with user feedback. Session replay tools may use cookies and other technologies to collect data on our users’ behavior and their devices. This includes a device's IP address, device screen size, device type (unique device identifiers), browser information, geographic location, and the preferred language used to display our website.

• Google Analytics. We use Google Analytics to optimize our Service based on the traffic we receive and assist with marketing. To learn more about Google Analytics, including options for opting out and/or managing the ads you may see online please visit: google.com/policies/privacy/partners. Additional information regarding online advertising is available at: https://www.networkadvertising.org/understanding-online-advertising/what-are-my-options. To learn more about targeted advertising and the choices available to you, visit Webchoices: Digital Advertising Alliance’s Consumer Choice Tool for Web US.

Categories of personal information collected in the past 12 months

The tables below show the categories of personal information and sensitive personal information that we have collected in the past 12 months. Please note that while examples are listed for each category, we do not necessarily collect each of those examples listed.

In the course of providing our products, services, or our Service to you, we may collect certain sensitive personal information about you. In the past 12 months we have collected the categories of sensitive personal information shown in the table below.

We will not retain your personal information or sensitive personal information for longer than is reasonably necessary for fulfillment of the purpose of each disclosed collection and use.

Third party use of cookies and other tracking technologies

Some content or applications, including advertisements, on the Service are operated by third parties, including advertisers, ad networks and servers, content providers, and application providers. These third parties may use cookies (alone or in conjunction with web beacons or other tracking technologies) to collect information about you when you use our Service. The information they collect may be associated with your personal information or they may collect information about your online activities over time and across different websites and other online services. They may use this information to provide you with interest-based (behavioral) advertising or other targeted content.

We do not control these third parties’ tracking technologies or how they may be used. If you have any questions about an advertisement or other targeted content, you should contact the responsible provider directly.

How we use your information

We use information that we collect about you or that you provide to us, including any personal information:

• To present our Service and its contents to you.

• To provide you with information, products, or services that you request from us.

• To fulfill any other purpose for which you provide it.

• To provide you with notices about your account.

• To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection.

• To notify you about changes to our Service or any products or services we offer or provide through it.

• To provide you with recommended products or services.

• To allow you to participate in interactive features on the Service.

• In any other way we may describe when you provide the information.

• For any other purpose with your consent.

Disclosure of your information

We may disclose aggregated information about our users and information that does not identify any individual. We also may disclose personal information that we collect or you provide:

• To our subsidiaries, affiliates, related companies, and franchisees.

• To our contractors, service providers, and other third parties we use to support our business, including payment processors, and who are bound by contractual obligations to keep personal information confidential and use it only for the purposes for which we disclose it to them.

• To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Duck Donuts Holdings, LLC’s assets, whether as a going concern or as part of a bankruptcy, liquidation, or similar proceeding, in which personal information held by us about our Service users is among the assets transferred.

• To fulfill the purpose for which you provide it.

• For any other purpose disclosed by us when you provide the information.

• With your consent.

We may also disclose your personal information:

• To comply with any court order, law, or legal process, including to respond to any government or regulatory request.

• To enforce or apply our Terms of Use and other agreements, including for billing and collection purposes.

• If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Duck Donuts, our customers, or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction.

Categories of personal information shared or sold in the past 12 months

We may share your personal information or sensitive personal information by disclosing it to a third party for a business purpose. In some circumstances we may “sell” your personal information as that term is defined under certain state privacy laws, including the California Consumer Privacy Act or the California Privacy Rights Act. In the past 12 months we have disclosed or sold the categories of personal information shown in the table below.

Choices about how we use and disclose your information

We strive to provide you with choices regarding the personal information you provide to us. We have created mechanisms to provide you with the following control over your information:

• Tracking technologies and advertising. You can set your browser to refuse all or some browser cookies or to alert you when cookies are being sent. If you disable or refuse cookies, please note that some parts of the Service may then be inaccessible or not function properly.

• Targeted advertising. We use remarketing services to advertise on third-party websites to you after you have visited our Service. We and our third-party vendors use cookies (either alone or in conjunction with web beacons or other tracking technologies) to collect information about you to inform, optimize, and serve ads based on your past visits to our Service. This collected information may be associated with your personal information and may also be about your online activities over time and across different websites and other online services.

• Promotional offers from us. If you do not wish to have your information used by the Company to promote our own or third parties’ products or services, you can opt-out by un-checking the relevant box located on the form on which we collect your personal information (the order form or account creation form) or at any other time by logging into the Service and adjusting your user preferences in your account profile by checking or unchecking the relevant box on the Account Settings page. If we have sent you a promotional email, you may use the “Contact Preferences” link to visit your Account Settings page and update your email preferences. This opt-out does not apply to information provided to us as a result of a product purchase, warranty registration, product service experience or other transactions.

We do not control the collection or use of your information in connection with third parties’ interest-based advertising. If you have any questions about an advertisement or other targeted content, including how to opt-out of receiving targeted advertising from those parties, you should contact the responsible advertiser directly.

You may also opt out of receiving targeted ads from members of the Network Advertising Initiative ("NAI") on the NAI's website.

Residents of certain states may have additional personal information rights and choices. For more information, see below.

Website analytics services

We use certain analytics services, such as Google Analytics, to gather information about our site visits. Learn more about Google Analytics, including opting out of Google Analytics.

Accessing and correcting your information

You can review and change your personal information by logging into the Service and visiting your account profile page. You may also send us an email at customerfeedback@duckdonuts.com to request access to, correct, or delete any personal information that you have provided to us. If you have an account connected with the Service, we cannot delete your personal information except by also deleting your user account. We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect.

If you delete your user contributions from the Service, copies of your user contributions may remain viewable in cached and archived pages or might have been copied or stored by other Service users.

Residents of certain states may have additional personal information rights and choices. For more information, see below.

Our policy on “do not track” signals

You may be able to configure your device or browser to automatically communicate your preference to opt out of the sale and transfer of your personal information. We will recognize signals communicated to us that are in a commonly used and recognized format, and we will apply your preferences to your browser or device. If you have an account with us and are logged into your account when we receive your “do not track” signal, we will apply your preference to your account settings.

Your state privacy rights

The California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “California Privacy Law”), as well as other state consumer privacy laws, provide their residents with additional rights regarding our use of their personal information. These rights are described below.

The Right to Know and to Confirm, and the Right to Data Portability

You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months (the “right to know” and the “right to confirm”). Once we receive your request and confirm your identity, we will disclose to you:
The categories of personal information that we collected about you.

• The categories of sources for the personal information we collected about you.

• Our business or commercial purpose for collecting or selling that personal information.

• The categories of third parties with whom we share that personal information.

• If we sold or disclosed your personal information for a business purpose, two separate lists disclosing:

• Sales, identifying the personal information categories that each category of recipient purchased; and

• Disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.

• The specific pieces of personal information we collected about you (also called a “data portability” request).

• If you submit a data portability request, we will provide you with a copy of your personal information in a common and portable format that you may transfer to another organization of your choosing.

The Right to Delete

You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions (the "right to delete"). Once we receive your request and confirm your identity, we will review your request to see if an exception allowing us to retain the information applies. We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

• Complete the transaction for which we collected the personal information, provide a service that you requested, take actions reasonably anticipated within the context of our ongoing relationship with you, or otherwise perform our contract with you.

• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.

• Debug products to identify and repair errors that impair existing intended functionality.

• Exercise free speech, ensure the right of another individual to exercise their free speech rights, or exercise another right provided for by law.

• Comply with specific laws, such as the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).

• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement, if you previously provided informed consent.

• Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us.

• Comply with a legal obligation.

• Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

We will delete or deidentify personal information not subject to one of these exceptions from our records and will direct our service providers to take similar action.

The Right to Correct Inaccurate Information

You have the right to correct any inaccurate personal information about you that we have in our possession (the “right to correct”). Once we receive your request and confirm your identity, we will disclose to you the specific pieces of personal information that we have collected about you. You will then have the opportunity to direct us to correct the pieces of information which you believe are inaccurate.

We may deny your request to correct if we believe the updated information is incorrect or is being used for any fraudulent or deceptive purpose.

The Right to Restrict Sensitive Personal Information Processing

You have the right to restrict our processing of your sensitive personal information (the “right to restrict”). Once we receive your request and verify your identity, we will cease the processing of your sensitive personal information for the purpose of inferring characteristics about you. Please note that we may continue to process your sensitive personal information for other purposes consistent with this Privacy Policy.

The Right to Opt Out of the Processing and Sale of Personal Information

You have the right to direct us to not process your personal information for targeted advertising and to not sell your personal information at any time (the "right to opt-out"). Once we receive your request, we will no longer use or process your personal information for the purpose of providing targeted advertising to you based on your activity and interests. We will also no longer sell (as that term is defined by relevant and applicable state law) your personal information to third parties for targeted advertising purposes.

The Right to Opt Out of the Sharing of Personal Information for Cross-Contextual Behavioral Advertising

You have the right to opt out of the sharing of your personal information with third parties for cross-contextual behavioral advertising. Once we receive your request, we will no longer use or process your personal information for the purpose of advertising to you based on your individual activity.

The Right to Opt Out of Profiling

You have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects to you. Once we receive your request, we will no longer use or process your personal information for making decisions that produce a legal or similarly significant effect to you.

The Right to Be Free from Discrimination

We will not discriminate against you for exercising any of your rights under applicable state privacy law. Unless permitted by state law, we will not:

• Deny you goods or services.

• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.

• Provide you with a different level or quality of goods or services.

• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

However, we may offer you certain financial incentives permitted by state privacy law that can result in different prices, rates, or quality levels. This may include loyalty and rewards programs. Any legally permitted financial incentive we offer will reasonably relate to your personal information’s value and will contain written terms that describe the program's material aspects. Participation in a financial incentive program requires your prior opt-in consent, which you may revoke at any time.

Exercising your rights

To exercise your rights described in this Privacy Policy, you may submit a request to us by:

• Contacting us online at: https://www.duckdonuts.com/contact-us/

• Emailing us at: customerfeedback@duckdonuts.com

• Calling us at 1-866-273-5776

• Mailing us at: Duck Donuts, Attn: Privacy Officer, 1215 Manor Drive, Suite 206, Mechanicsburg, PA 17055

Only you or someone legally authorized to act on your behalf may make a request related to your personal information. You may also make a request on behalf of your child. You may only submit a request twice within a 12-month period.

We may not require you to provide additional personal information to verify your identity for opt-out requests. However, to process other requests, we may require you to:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative, which may include:

• Providing at least three (3) pieces of information that match the information we have about you.

• Providing a signed declaration, under penalty of perjury, that you are the individual about whom you have submitted the request, or that you are legally authorized to submit the request on the individual’s behalf.

• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm that the personal information relates to you.

You do not need to create an account with us to submit a request. We will only use the personal information provided in the request to verify the requestor’s identity or authority to make it.

You may appeal a decision concerning your privacy rights by emailing us at customerfeedback@duckdonuts.com or by writing us at Duck Donuts, Attn: Privacy Officer, 1215 Manor Drive, Suite 206, Mechanicsburg, PA 17055.

Response timing and format

We will confirm receipt of your request within ten (10) business days. If you do not receive confirmation within the 10-day timeframe, please email customerfeedback@duckdonuts.com or call 1-866-273-5776.

We endeavor to substantively respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing.

If you have an account with us, we may deliver our written response to that account. Alternatively, or if you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

Any disclosures we provide will only cover the 12-month period preceding our receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Other California privacy rights

California's “Shine the Light” law (Civil Code Section § 1798.83) permits users of our Service that are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please send an email to customerfeedback@duckdonuts.com or write us at: Duck Donuts, Attn: Privacy Officer, 1215 Manor Drive, Suite 206, Mechanicsburg, PA 17055.

If you are a California resident under 18 years old and a registered user, you can request that we remove content or information that you have posted to our Service. Please note that fulfilment of the request may not ensure complete or comprehensive removal (for example, copies may remain viewable in cached and archived pages or might have been copied and stored by other Service users). To request removal of content or information, send an email to customerfeedback@duckdonuts.com.

Data security

We have implemented measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure. All information you provide to us is encrypted and stored on our secure servers behind firewalls.

The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Service, you are responsible for keeping this password confidential. We ask you not to share your password with anyone, and you acknowledge and agree not to provide any other person with access to the Service or portions of it using your username, password, or other security information. If you share this information with a third party (or authorize a third party to have access to or be linked to your account through any of the Service’s features), that individual will have access to your account and personal information, including, but not limited to, your credit card information. You agree to take responsibility for actions taken by an individual with whom you have shared or authorized access to your account.

Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of your personal information transmitted to our Service. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the Service.

Transfer of data

Your personal information may be transferred and maintained on computers located outside of your state, province, country, or other jurisdiction where the data protection laws may differ. If you are located outside of the United States and choose to provide information to us, note that we transfer the data, including, but not limited to, personal information, to the United States and process it there. Your use of the Service and submission of such information represents your consent to our Terms of Use, Privacy Policy, and transfer of personal information. We will take reasonable steps to ensure your personal data is treated securely and is not transferred to an organization or country unless there are reasonable security controls in place.

Children under the age of 16

Our Service is not intended for children under the age of 16. No one under the age of 16 may provide any personal information to or on the Service. We do not knowingly collect personal information from children under 16. If you are under 16, do not use or provide any information on this Service or through any of its features, register on the Service, make any purchases through the Service, use any interactive or public comment features on the Service, or provide any information about yourself to us, including, but not limited to, your name, address, telephone number, email address, or any screen name or username you may use. If we learn we have collected or received personal information from a child under 16 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 16, please contact us at: customerfeedback@duckdonuts.com. California residences under 16 may have additional rights regarding the collection and sale of their personal information.

Changes to the Privacy Policy

We will post any changes that we make to our Privacy Policy on this page. If we make material changes on how we treat our users’ personal information, we will notify you by email to the primary email address specified in your account or through

notice on the Service homepage. The date the Privacy Policy was last revised is identified at the top of the page. You are responsible for ensuring we have an up to date active and deliverable email address for you and for periodically visiting our Service, Privacy Policy, and Terms of Use to check for any changes. Changes to the Privacy Policy, and Terms of Use are effective upon posting to the Service.

Comments and concerns

All questions or comments about this Privacy Policy and our privacy practices should be directed to: customerfeedback@duckdonuts.com or 1-866-273-5776. You may also contact us online using our Contact Form available at https://www.duckdonuts.com/contact-us/.