Individuals Residing in Certain U.S. States

Some U.S. states have enacted privacy laws that grant their residents certain rights and require specific disclosures (“State Privacy Laws”). If you reside in California, Colorado, Connecticut, Delaware, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, or Virginia, and to the extent these laws apply to Kodiak Cakes, this section applies to you. This section also serves as our California notice at collection.

Additional Disclosures

Our Privacy Policy explains how we collect, use, and discloseinformation about you, as well as our targeted advertising and analytics practices. As required by certain State Privacy Laws, we use the tables below to explain this same information.

Category of Personal Information We collect…	Categories of Recipients We may disclose personal information to…	Use of Personal Information We use personal information to…
- Identifiers (such as your name, email, phone number, and IP address) - Commercial information (such as records of products you purchased) - Internet and electronic network activity (such as information about your activity on our website) - Audio data (such as call recordings when you contact customer service) - Inferences (such as inferred information about your shopping preferences) - Other data you choose to provide (such as the content of product reviews)	- To vendors and service providers - To others that visit our Services (such as the content of product reviews) - To law enforcement or others involved in legal proceedings - Recipients in connection with efforts to protect rights of Kodiak Cakes and others - To professional advisors - Recipients in connection with corporate transactions - To our corporate affiliates - With your consent or at your direction	- Process and fulfill your orders; - Market our products to you Provide, maintain, and improve our products and Services; - Develop new products and services; - Personalize your experience with us; - Send you technical notices, security alerts, support messages, and other transactional or relationship messages; - Send you marketing communications, including if you choose to sign up for early-access and other promotions we offer or if you choose to sign up for marketing text messages from us (see the Your Choices section below for information about how to opt out of these communications at any time); - Monitor and analyze trends, usage, and activities in connection with our Services and products; - Facilitate contests and promotions and process and deliver entries and rewards; - Detect, investigate, respond to, prosecute, and help protect against security incidents and other malicious, deceptive, fraudulent, or illegal activity, and help protect the rights and property of Kodiak Cakes and others; and - Comply with our legal and financial obligations.

We do not collect information that is considered “sensitive” under State Privacy Laws.

As described in the Collection of Informationsection above, we collect personal information from various sources, including directly from you, automatically when you access or use our Services, and from third-party sources.

We store personal information for as long as necessary to carry out the purposes for which we originally collected it and for other business purposes explained in this Privacy Policy.

Sales, Sharing, and Targeted Advertising Activities

We also disclose certain categories of personal information to show you targeted ads on third-party properties and allow certain third parties to use this information for their own marketing purposes. These disclosures may be considered “sales,” “sharing,” or use of personal information for “targeted advertising” under State Privacy Laws, and the table below provides more information about our practices.

Category of Personal Information	Category of Third Parties
- Identifiers (such as a cookie ID, IP address, or hashed version of your email address) - Internet and electronic network activity (such as information about your activity on our website) - Inferences (such as inferred information about your shopping preferences)	- Advertising and marketing networks

We do not engage in sales, sharing, or targeted advertising using personal information about consumers we know to be under the age of 18.

Your Rights under State Privacy Laws

Opt Out of Sales, Sharing, and Targeted Advertising

You may opt out of activities that we engage in that constitute “targeted advertising,” “sharing,” or “sales” of personal information under the State Privacy Laws by:

Following the prompts behind the Your Privacy Choices link in the footer of our website. Your opt-out choice will be linked to your browser only; therefore, you will need to renew your opt-out choice if you visit our website from a new device or browser, or if you clear your browser’s cookies; and
Emailing us at privacy@kodiakcakes.com to turn off “targeted advertising,” “sharing,” and “sales” based on your email address.

You can also opt out by visiting our websites with a legally recognized universal opt-out signal enabled, such as the Global Privacy Control. If you are not logged into your account with us, our processing of the signal will be limited to cookie-based sales, sharing, and targeted advertising for the specific browser or device that you are using.

Access, Correction, and Deletion

You have the right to (1) request to know more about and access your personal information, including in a portable format, (2) request deletion of your personal information, and (3) request correction of inaccurate personal information.

To request access, correction, or deletion of your personal information, please send an email to privacy@kodiakcakes.com, or write us at: 8163 Gorgoza Pines Road, Park City, UT 84098. To authenticate your request, we will verify your request by asking you to provide certain information, such as your name, email address, mailing address, and phone number.

Nondiscrimination

You have the right not to be discriminated against for exercising any of your privacy rights.

Appeals

If we deny your request, you may appeal our decision by contacting us at privacy@kodiakcakes.com. If you have concerns about the result of an appeal, you may contact the attorney general in the state where you reside.

Authorized Agents

If you are an authorized agent seeking to make a request to opt out of sales, sharing, or targeted advertising on behalf of a consumer, please email us at privacy@kodiakcakes.com.

If you reside in California, you may also designate an authorized agent to submit an access, deletion, or correction request on your behalf. We may ask authorized agents to submit proof of their authority to make a request, such as a valid power of attorney or proof that they have signed permission from the consumer who is the subject of the request. In some cases, we may contact the individual who is the subject of the request to verify their own identity or confirm the authorized agent has permission to submit the request. If you are an authorized agent seeking to make an access, correction, or deletion request on behalf of a California resident, please contact us at privacy@kodiakcakes.com.

Notice of Financial Incentives

We provide discounts, rewards, coupons, exclusive offers and other benefits to customers who join participate in certain promotional or marketing campaigns we offer. These offerings may constitute “financial incentives” or “bona fide loyalty programs” under State Privacy Laws (for simplicity, we refer to these offerings as financial incentives throughout this Privacy Policy).

If you decide to participate in a financial incentive, we collect relevant personal information from you, such as identifiers (like your name, email address, or phone number) and commercial information (like your purchase history). We disclose this information to our marketing and advertising vendors so we can display ads that are targeted to your interests and preferences. We also may disclose your commercial information to our program partners and other merchants.

You can opt into a financial incentive by following the instructions we provide. You can withdraw from the financial incentive at any time by following the unsubscribe instructions in the applicable program’s terms and conditions, promotional emails, or text messages, or contacting us at privacy@kodiakcakes.com. If you request that we delete personal information that is essential to providing you with the financial incentive, we will not be able to provide you with such benefits going forward. For example, if you ask us to delete your email address, we will no longer be able to email you discounts, coupons, or other exclusive offers or benefits. In some cases, we may provide additional terms and conditions when you sign up to participate in a financial incentive. The value of your personal information is reasonably related to the value of the offer or discount presented to you.