PRIVACY POLICY

Effective Date: August 31, 2026 (last updated August 17, 2026)

At Petco, your privacy is important to us, and we want you to know how we use your personal information in compliance with applicable privacy laws. We encourage you to review this Privacy Policy carefully—it describes how we handle your personal information, as well as the rights and choices available to you. You may click on the following links to directly access each section of this Policy:

1. INTRODUCTION
2. THE PERSONAL INFORMATION WE COLLECT
3. HOW WE COLLECT YOUR PERSONAL INFORMATION
4. HOW WE USE DIGITAL TRACKING TOOLS
5. HOW WE USE YOUR PERSONAL INFORMATION
6. HOW YOUR PERSONAL INFORMATION IS DISCLOSED
7. NOTICE OF FINANCIAL INCENTIVES/BONA FIDE LOYALTY PROGRAM
8. YOUR PRIVACY RIGHTS
9. HOW TO EXERCISE YOUR PRIVACY RIGHTS
10. CCPA/CPRA STATISTICS
11. HOW TO UPDATE YOUR INFORMATION & COMMUNICATION PREFERENCES
12. DATA SECURITY
13. RETENTION PRACTICES
14. TRANSFER OF DATA FROM OUTSIDE THE UNITED STATES
15. CHILDREN
16. EXTERNAL CONTENT, LINKS, AND PLUG-INS
17. PUBLIC FORUMS
18. CHANGES TO THIS POLICY
19. CONTACT US

1. INTRODUCTION

This Privacy Policy (the “Policy”) applies to personal information that Petco Animal Supplies Stores, Inc. and its subsidiaries, affiliates, divisions, and related businesses (collectively, “Petco,” “we” or “us”) as controllers of your data collect when you interact with us through our websites (“Sites”); mobile applications (“Apps”); stores, clinics, hospitals or other physical locations (“Stores”); or when you otherwise transact or interact with us (altogether, our business operations are referred to in this Policy as the “Services”). Throughout this Policy, we use the term “personal information” to mean information that directly or indirectly identifies you or is reasonably capable of being associated with you or your household. By accessing the Services, you agree that you have read and agreed to the use of your personal information as described in this Policy, and you agree to our Terms of Use, which are incorporated herein by reference, including but not limited to the Mandatory Dispute Resolution clause therein. If you do not agree to the use of your personal information as described here, please do not access or use the Services.

2. THE PERSONAL INFORMATION WE COLLECT

The table below lists the categories of personal information that we collect and have collected in the last 12 months (including “sensitive personal information” as that term is defined in applicable privacy laws); the categories of sources from which we collect personal information; and our purposes for collecting the information.

Under some privacy laws, certain types of personal information listed above are considered “sensitive personal information” and are protected by additional rights and obligations. Where required by law, we will obtain your consent before collecting sensitive personal information, or we provide you with a right to limit the use and disclosure of such information, as described in Section 8. If you provide consent, you may withdraw it at any time. As described in the above table, we collect the following types of sensitive personal information: (i) Driver’s license, state identification card, passport information/numbers (which we collect from you during the return process, and use to prevent fraud or harm, such as abuse of our return policies), and certain demographic information that may be reflected thereon such as race, ethnicity, national origin, citizenship, and immigration status; (ii) portions of your financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials necessary for us to process your payments, such as CVV codes (which we collect from you to complete your transactions); and (iii) precise geolocation (which we collect with your permission and use to fulfill your curbside pickup or delivery orders; display your nearest Services; conduct analytics; and deliver targeted advertising).

3. HOW WE COLLECT YOUR PERSONAL INFORMATION

We collect your personal information from various sources. For example, we collect and obtain personal information:

• Directly From You. We collect information that you provide us when you choose to use our Services; make a purchase, return, or exchange; book appointments or reservations; create an account or profile; sign up for our loyalty programs or subscriptions; participate in sweepstakes, contests, surveys, or similar campaigns/promotions; respond to surveys; and/or sign up to receive our emails, postal mail, push notifications, or text messages. This includes contact information such as your name, address, phone number, and email address, and portions of your payment card information necessary to process your transactions. In addition, if you would like to return or exchange a purchase made with us, we collect specific information from your government identification in order to protect against fraud or return abuse. This may include your passport, driver’s license or state identification card information and information reflected on that identification, such as the issuing state and country, expiration date, barcode, and certain demographic information that may be reflected there, such as your race, ethnicity, national origin, citizenship, and immigration status. Where relevant, we also ask for and collect your pet’s name, breed, date of birth, microchip information, veterinary/medical information or records, information about your pet’s prior vet visits with us or others, and other health-related information for your pet. If you choose to upload pictures of yourself or your pet to our digital platforms, we will collect those images.
• When You Communicate With Us. If you choose to contact us by phone, email, social media, or via the messaging features on our Sites or Apps, we collect information necessary to respond to or process your inquiry, such as your name, email address, online usernames/identifiers, telephone number, location, date of birth/age, your pet’s information, and similar information made available during our interaction. When you call, chat, or otherwise communicate with us by phone or online, we keep recordings and transcripts of your calls, chats and communications with us for quality assurance, training, fraud prevention, and customer support purposes. We may use interactive voice response technologies when you contact us by phone, which allow our systems to interact with you via voice applications or touches on a telephone keypad and better route your call to the appropriate team. We also may use machine learning, virtual assistants, chatbots, third-party artificial intelligence (“AI”) models, and/or other generative AI technologies (collectively, the “AI Features”) to help us improve our operations, such as to better identify and address customer support issues and trends. When you communicate with us via the chat features on our Sites, for example, you may be interacting with a virtual assistant rather than a human, and we may be able to see what you are typing before you hit the send/submit button so that we are better prepared to answer your questions. We may share your chat transcripts with our authorized vendors who process that data using AI, which allows for improved responses and customer service. Additionally, when you speak to us by phone, we disclose your call recordings and transcripts to our authorized vendors who help us answer your questions, summarize calls, assess sentiment, and otherwise improve our operations using AI Features. In addition, we may offer you the opportunity to participate in customer satisfaction surveys and product reviews that we facilitate internally or via our service providers and contractors, which allow you to review our products online, via email, or using your mobile device. If you opt to participate in such surveys or reviews, we will receive your feedback in the format you submit it, as well as any personal information that correlates with your review, such as your email address, loyalty program number, transaction history, and other information associated with your review. Additionally, from time to time, we may facilitate online or publicly posted petitions, or engage in similar advocacy activities, intended to influence government officials, news publications, or other advocacy targets on pet-related topics that may be important to our customers. If you choose to sign such an online petition or similar advocacy form with which we are associated, we will collect the personal information you provide at that time, such as your name, email address, postal address, telephone number, and overall information about your participation.
• Via Digital Tracking Tools. Like many businesses, we automatically collect information about you through third-party tools and technologies such as browser cookies, flash cookies, pixel tags, server logs, and web beacons (collectively, “Digital Tracking Tools”). These Digital Tracking Tools automatically collect information about you when you interact with us online, or with third parties that use or integrate into our online platforms. We also may use third-party tools known as “session replay” or heatmapping technologies. These tools can recreate a “replay” of a user’s online experience, including your clickstream and other interactions with our content, which helps us de-bug our Sites, perform analyses, understand how users interact with our content, and improve our operations. For more details about how we use Digital Tracking Tools, please see Section 4.
• From Social Media and Similar Online Platforms. We partner with social media companies, search engines, and similar online platforms for marketing and advertising purposes. These platforms (such as Facebook, Instagram, Twitter/X, Google, YouTube, Pinterest, TikTok, Snapchat, your email provider, or similar online platforms) combine information we provide about your interaction with our Services or similar businesses (such as products you viewed or purchased) with information they have collected from other sources, in order to deliver targeted and general advertisements to you. We use these platforms to match individuals who are likely to be interested in our Services with targeted advertisements about our Services. In addition, our Sites and Apps may offer you the ability to interact with plug-ins from social media platforms (such as the Facebook “Like” button or the Twitter/X “Follow” button), which allow us and/or the social media platform to receive personal information from or about you, your browsing activity, and your consumer preferences. Similarly, if you have previously provided personal information to an external party operating a plug-in on the Sites or Apps, then such external party may recognize you when you use our Sites/Apps. Our Sites/Apps also may give you the option to sign into or connect the Services to your social media or other online accounts. If you choose to integrate your use of our Services with any external platforms, we and those platforms automatically collect, receive, and use personal information about you based on your registration and settings with those services. Such information may include your name, social media usernames, address, email address, IP address, unique device and online identifiers, pet information, photographs you share, precise geolocation, social media activity, mobile device information, and your account profile information. Please review Section 16 for more information on our integration with external content.
• From Advertising Networks. We rely on internal and third-party advertising networks to serve targeted and generalized ads on our own Sites and Apps, and on third-party websites and platforms. These networks collect information about your online activity, interests, and consumer preferences in order to provide you with targeted and generalized advertising, optimize our operations, and perform analytics. They keep track of information such as your device advertising identifiers; cookie IDs; browsing and transaction history; and your interaction with ads and other content we serve on our own behalf and on behalf of third parties through our in-house media business. These advertising networks then use this data to match user profiles with ads that they and we believe will be relevant, interesting, and timely.
• When You Interact With Us In Person. Some of our Stores use security/closed circuit television cameras (also known as “CCTV”) and foot traffic video cameras in and around areas open to the public and our guests. We use these tools to prevent theft and fraud, secure our premises, optimize our Store layouts, understand how consumers navigate our stores, and improve operations. We do not use facial recognition software in these cameras. However, if you visit our Stores, we may collect video footage of you through these cameras.
• From Other External Sources. Our service providers, contractors, business partners, and other authorized third parties may provide us your information when authorized to do so. For example, if we acquire another business that you have shopped at or visited, that business may provide us your personal information as part of our acquisition. In addition, we acquire certain information from data brokers and similar third parties, including (i) address information that we use to validate or update your contact information, improve our marketing, and/or prevent fraud; (ii) demographic and lifestyle information (such as the size of your household, age, interests, and gender) to help us analyze our business’ performance, target advertisements, and/or improve the Services; and (iii) information about your online and offline transactions and purchases to help us target advertisements and analyze and improve the Services. We also receive personal information, such as your name, address, phone number, email address, transaction details, and pet information, from our business partners when you participate in joint marketing promotions, events, transactions, or similar partnerships or Services we offer with external parties with whom we have a joint venture or similar business relationship.

4. HOW WE USE DIGITAL TRACKING TOOLS

Like many businesses, we use Digital Tracking Tools to automatically identify, collect and link information about you and your activities over time on various platforms. Examples of Digital Tracking Tools we use include cookies, web beacons, pixels, tags, third-party software development kits, and similar technologies made available by external providers such as Meta, Pinterest, TikTok, Google, Adobe, and other providers of social media, analytics, advertising, and performance measurement services. When you interact with us online, these Digital Tracking Tools automatically collect personal information such as: (i) information about your device’s software, including your operating system, browser type, browser settings, and other software or services in use; (ii) information about your device’s hardware, such as your device’s serial number, type, and model; (iii) your IP address, internet service providers, and mobile carriers; (iv) your language and time zone settings; (v) unique identifiers, such as IMEIs, UDIDs, advertising identifiers, and MAC addresses; and (vi) details about your interaction with our content, such as entry/exit URLs; clickstream, keystrokes, or usage data from our Sites, Apps, and advertisements; other sites or mobile applications that you may visit; your precise geolocation while accessing our content when permitted; your clicks within and other interactions with our promotional or transactional emails, advertisements, online content, and texts from us or our business partners; the date and time you visit our online properties; the areas or pages that you visit; the amount of time you spend viewing or using the Sites or Apps; and the number of times you return to the Sites or Apps.

We use these Digital Tracking Tools, and the data they collect, for purposes such as identifying you; improving our marketing operations; performing analytics; targeting advertisements to you on our own platforms and on other Sites/Apps; delivering generalized advertising; measuring our performance; maintaining the security of our Sites and Apps; fixing bugs; remembering your preferences; and providing support for basic Site/App functions.

You may be able to limit or opt out of some Digital Tracking Tools using the following resources:

• You may opt out of certain Digital Tracking Tools (and targeted advertisements) by broadcasting the Global Privacy Control signal when browsing our Sites. You can read more about the Global Privacy Control at www.globalprivacycontrol.org. We currently use a third-party privacy tool to recognize whether users visiting our Sites are broadcasting the Global Privacy Control signal. Please note that using the Global Privacy Control signal will not stop all digital tracking, advertising, or information sharing.
• If you prefer not to use the Global Privacy Control, you can opt out of certain targeted advertising behaviors by following the instructions in Section 9 under “Requests to Opt Out of Sharing for Targeted Advertising and Selling of Personal Information (Do Not Sell/Share).” If you choose to opt out of targeted advertising, you will still continue to receive generalized advertising. If you disable, delete, or block cookies, you may not be able to place orders or use all of the features on our Sites or Apps, and not all of the tracking described in this Policy will stop.
• You can remove Google Analytics from your browser by installing the Google Analytics browser add-on, available from Google at https://tools.google.com/dlpage/gaoptout. You can learn about Google’s practices here.
• Some browsers or operating systems allow you to adjust your settings to limit or block certain Digital Tracking Tools. You should refer to your browser’s or operating system’s website or “Help” section for more information on how to delete and/or disable cookies, and options for controlling your tracking preferences. Please note, you may need to separately disable cookies on each browser and device you use to access the Services. Some browsers offer a “Do-Not-Track” feature, and we may not respond to Do-Not-Track requests or headers from some browsers; however, we do respond to the Global Privacy Control signal as explained above.
• To learn more about your choices with respect to the collection and use of your data by Digital Tracking Tools and participating companies, you can visit the Digital Advertising Alliance’s “Your Ad Choices” opt-out pages, available at https://youradchoices.com/ and https://optout.aboutads.info. You can download the free “AppChoices” app from the Digital Advertising Alliance to control how much information about your interests is used for in-app advertising on your mobile device by participating companies. More information is available at https://youradchoices.com/control.

5. HOW WE USE YOUR PERSONAL INFORMATION

We use your personal information for our business purposes, which include, for example:

• Providing and improving the Services. We use your personal information – such as your address and transaction details – to fulfill, validate, manage, deliver, and/or track your orders and transactions; process payments; process and verify returns and refunds; facilitate curbside pick-up and delivery services; and facilitate the treatment of your pet. We also use personal information to analyze and improve the performance, usage and operations of our Services using internal or external software and tools; to better understand who is using the Services and how; to administer our loyalty programs; and to develop new offerings. We also use your interactions with the Services to help improve and further develop our operations, including, for example, by using records of your customer support chats, and recordings of your calls with our customer support team, to gain insights into our operations and train machine learning or AI models, where permissible. For example, the Services may integrate with or offer artificially generated product descriptions or images, or chatbot responses via a virtual assistant. You should use caution when deciding whether to share any sensitive, confidential or proprietary information with a virtual assistant or other AI Features. Information you do share may be used to further enhance and improve the Services, AI Features, Outputs, and third-party AI models where permissible, including for purposes of training large language models licensed to us and used by us in providing you the Services.
• Communicating with you. We use your personal information – such as your email address, telephone number, address, online usernames, and other contact information – to respond to your inquiries; provide you with information about your account, purchases, transactions, and our Services; conduct surveys, sweepstakes, contests, focus groups, and promotions; provide you information about or access to your pet’s medical records; schedule or communicate with you about veterinary, grooming, or training appointments and Services; engage with you over features such as product ratings or reviews; and otherwise communicate with you as needed or permitted to run our business.
• Delivering targeted advertising and other information we think may be of interest to you. We use your personal information (including information collected by Digital Tracking Tools) to deliver targeted and cross-context behavioral advertising (meaning, advertising that is based on personal information obtained from your activities over time and across websites or applications that are not affiliated with our Company), in addition to generalized advertising. We, our service providers, contractors, and authorized third parties, may use your information to provide such advertising via email, mail, telephone, text message, push notifications, and/or across other websites, mobile applications, social media, or online services. We also may use your personal information to enhance and personalize your online shopping experiences, and to recognize or welcome you to the Sites or Apps. In addition, we use your personal information to identify you across the devices and browsers you use to access our Services. This helps us deliver a more personalized and consistent customer experience, targeted advertising, and relevant content. To assess our business and marketing performance, we and our vendors also combine, supplement, disclose, and update the personal information we collect from and about you, with information collected offline, across other computers or devices that you may use, and from external sources. If you choose to participate in a publicly posted or online petition (or similar advocacy activities) associated with our Services, we may use your personal information for marketing to you and contacting you regarding similar subjects we think may be of interest to you. In addition, we and our service providers and contractors use your personal information to evaluate your potential eligibility for and interest in special offers, such as Petco credit cards. Please visit Section 8 and Section 9 for further information on how to opt out of certain targeted advertising.
• Performing business reporting, analysis, and research. We use information about your transaction history with us, your location, and your use of the Services to engage in reporting, analytics, and research that help us operate or improve our business. This includes metrics measuring the performance of our marketing efforts and advertisements that you may see or receive. We also use your information to better understand who is using the Services; to develop new offerings; and to help us analyze and improve the performance, usage and operations of our Services overall. We use external software providers and tools (such as Google Analytics and Adobe Analytics) to help us perform these assessments.
• Preventing fraud, complying with applicable laws, protecting our business, and similar purposes. We may use your name, contact information, IP address, and other personal information to protect the security or integrity of the Services and our business; to prevent fraudulent activity; to investigate potential security incidents; to assist law enforcement; to protect our rights and/or the rights of third parties; and/or to comply with our legal or regulatory obligations. We may also use aggregated, anonymized, pseudonymized, or de-identified personal information for any legally permissible purpose. If we process deidentified data provided to us by third parties, we will not attempt to reidentify it if we are prohibited by applicable law from doing so.

6. HOW YOUR PERSONAL INFORMATION IS DISCLOSED

In addition to the specific situations discussed elsewhere in this Policy, we disclose your personal information to others for various business purposes. Recipients of such information include:

• Service providers, contractors, and authorized vendors. We disclose your personal information to service providers, contractors, processors, and authorized vendors we use to perform business services for us. For example, we disclose your personal information to vendors we use to assist us with shipping, delivering, and fulfilling your orders; providing customer support; processing your payments; administering our loyalty programs; and maintaining our IT, security, and other critical business systems. Where legally permissible, we also may disclose your personal information and/or your pet’s information to another veterinary care provider, if doing so will help facilitate treatment of your pet (such as in the event your pet experiences a medical emergency). If you seek and/or obtain pet insurance through us, we disclose your personal information with pet insurance providers, brokers, and similar third parties to facilitate your transaction, provide you pet insurance offers, and improve the Services where permitted by law. When you chat or call our customer support teams, we may share your chat and call transcripts and recordings with our authorized vendors who process that data using AI, which allows for improved responses and customer service. We also may disclose your information to data brokers we retain to supplement or verify our customer records, so that our shipments and mailings are more likely to reach you, and to improve our understanding of our customers’ attributes. To help prevent fraud such as return abuse, we may disclose your information to our external fraud prevention vendors during the return or exchange process. This includes but is not limited to your transaction details and information from your government-issued identification, such as ID number; issuing state and country; name; address; birth date; expiration date; phone number; and your identification’s barcode. If you participate in a publicly posted or online petition we are involved with, we may disclose the personal information you provide with our advocacy targets, such as government officials, news publications, legislators, and others. If you enter into or participate in one of our surveys, sweepstakes, contests, focus groups, or other promotions, we disclose your personal information to external parties, co-sponsors, marketing partners, regulators, or the public in connection with the administration of these items; as required by law; as permitted by the official rules; or otherwise in accordance with this Policy. Likewise, if you participate in a co-branded, co-sponsored, or jointly presented offering, your personal information will also be subject to those parties’ privacy policies.
• Advertising and analytics providers. We use third parties to perform marketing and advertising services for us, including both generalized advertising and targeted advertising. These third parties include platforms such as Google Analytics, Adobe Analytics, external and internal advertising networks, and social media companies such as Meta/Facebook, Instagram, Twitter/X, Google, YouTube, Pinterest, TikTok, Snapchat, your email provider, or similar online platforms. We will disclose information to them about your interaction with our Services or similar businesses (such as products you viewed or purchased online or in our Stores), in order to deliver targeted and general advertisements to you. You can read more about these practices under Section 3 and Section 5 of this Policy. In the preceding 12 months, we have disclosed the following categories of personal information to third parties providing advertising and analytics services for purposes of performing targeted advertising and data analytics: Identifiers; Commercial Information; Internet Activity; Demographic Information; Profiles & Inferences; Pet Information; and Geolocation Data including precise geolocation. Please also see the table at the end of this Section for more information.
• Social media and similar online platforms. Our Sites and Apps integrate Digital Tracking Tools, social media plug-ins, widgets, and similar tools from social media and similar online platforms that result in personal information being collected or exchanged between us and such parties.
• Public forums. Some of our Sites and Apps provide the opportunity to post content, such as product reviews or ratings, in a public forum. If you choose to post information in these public areas, that information will become publicly available.
• Affiliated and related entities. We disclose your personal information to our affiliates, business units, and/or subsidiaries for operational, promotional, marketing, and other business purposes consistent with this Policy and applicable law. For example, if you sign up for our loyalty programs, we may disclose certain information to our affiliated businesses or partners for marketing and advertising purposes. In addition, we may sell or purchase business assets during the normal course of operations. If another entity acquires our business and/or of any of our affiliates, personal information we have collected about you may be transferred to that entity. If any bankruptcy or reorganization proceeding is brought by or against us, such information may be considered an asset of ours and may be sold or transferred to external parties.
• Legal authorities and consultants. We may disclose your personal information to government authorities, law enforcement, regulators, insurance providers, consultants, or other authorized parties. We disclose your information to these parties to defend or protect ourselves in legal matters, and to comply with applicable laws, regulations, governmental and quasi-governmental requests, investigations, court orders, subpoenas, and other legal processes. We also disclose your information to these parties in connection with suspected illegal or fraudulent activity associated with our Services; to protect against harm to us, to the Services, or to others; and to detect or protect against security incidents.
• Other purposes. We may also disclose your personal information with your consent or based on your direction.

To comply with applicable privacy laws, we have compiled the following table, which lists the categories of personal information we disclose and may have disclosed for various business purposes in the last 12 months; the categories of third parties to whom we have disclosed this information; and our purposes for disclosing the information. Please note that under these laws, the categories of personal information disclosed to “advertising and analytics providers” may constitute a “Sale” or “Sharing” of personal information for targeted advertising.

All of the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties in accordance with text messaging industry standards. The following disclosures are provided to residents of Texas, Florida, and Louisiana based on those laws’ definitions of selling sensitive personal data to advertising and analytics providers, as noted above: For Texas and Louisiana residents: “NOTICE: We may sell your sensitive personal data.” For Florida residents: “NOTICE: This website may sell your sensitive personal data.”

7. NOTICE OF FINANCIAL INCENTIVES/BONA FIDE LOYALTY PROGRAM

We currently offer price discounts, coupons, services, and other perks for members of our loyalty, rewards, and subscription-based programs (including but not limited to the Petco Perks and Vital Care programs and similar offerings); large volume customers; mobile or online customers; repeat customers; members of our mailing lists; and customers who have signed up for our branded credit cards (collectively, “Offers”). To participate in these Offers, you may be asked to provide us with personal information, such as identifiers and financial information (e.g., name, address, email address, phone number, credit/debit card number, credit history or qualifications) and in some instances, your pets’ medical and other information. The details of each Offer are described in the materials outlining that specific Offer. There is no obligation to participate in our Offers, and you may opt out at any time.

We provide these Offers to enhance our relationship with you, and so you can enjoy more of our Services and products at a lower price. We invest heavily in our marketing and brands, in part, so we can provide such Offers to our customers. The value to our business of any individual’s personal information is dependent on a number of factors, including, for example, whether and to what extent that person takes advantage of any Offers, whether and to what extent they opt out of any Offers, and whether we are able to enhance the data through our efforts. However, customer data is valuable to our business only when it is combined with a sufficient number of other data and after it is enhanced by our efforts. Our ability to create any value from the Offers is heavily based on our ability to leverage our intellectual properties and enhance the data. To the extent we create overall value to our business from our Offers that could be directly or reasonably related to the value of customer data, the method for calculating such value would include: (1) the expenses associated with the Offer, including the provision or imposition of any financial incentive or price or service differences, such as our intellectual property, data analytics, and marketing operations; (2) the expenses related to the collection, retention and enhancement of customer’s personal information; and (3) all other expenses reasonably related to the programs. We make the preceding good faith estimate only for the limited purpose of complying with applicable privacy laws.

Colorado Residents: The table in Section 2 of this Policy describes the categories of personal information that we collect and process for targeted advertising via our current loyalty programs. Section 6 of the Policy describes the categories of third parties that receive personal information as a result of your participation in our loyalty programs. In addition, Section 6 of this Policy discloses how we disclose certain information to data brokers to supplement or verify our customer records and improve our marketing. Third parties that provide benefits to our program participants, and the benefits made available to participants, change regularly and frequently. For questions about benefits provided by third parties, please contact privacy@petco.com. If you request deletion of your personal information under applicable privacy laws, we cannot maintain your membership in our loyalty programs, because we need your contact information in order to issue and deliver the rewards, credits and perks you earn under the programs.

8. YOUR PRIVACY RIGHTS

Privacy laws afford you certain rights with respect to your personal information. These rights are described below. If you would like to exercise any of the privacy rights described here, please follow the instructions in Section 9. Subject to certain limitations, you have rights to:

• Know/Access Your Personal Information, Confirm Processing, and Receive Portable Data (together, the “Right to Know/Access”): You have the right to know and access the personal information (including any inferences about you derived from such data) we have collected about you, including the categories of personal information we collect; the categories of sources from which the personal information is collected; the business or commercial purposes for collecting, Selling, or Sharing personal information; the categories of third parties to whom we disclose personal information; the specific pieces of personal information we have collected about you; and whether we are processing your personal information for the purposes of profiling to make a decision that produces any legal or similarly significant effect concerning you. This includes the right to receive this information in a format, to the extent technically feasible, that is portable, usable, and allows you to transmit the information to a person without impediment, where the processing is carried out by automated means.
• Request a List of Third Parties: Depending on your state of residency, you may have the right to receive a list of specific third parties to whom we have disclosed or sold your personal information, if we maintain that information in a format specific to you. If we do not maintain that information specific to you, we will provide a list of specific third parties to whom we have disclosed or sold any consumers’ personal information. Currently, this right is available to residents of Oregon, Minnesota, and Connecticut with certain variations. If another state subsequently grants you this right and you are a resident of that state, Petco will recognize those rights where applicable and based on the unique requirements for that state.
• Delete Your Personal Information: You have the right to request that we delete your personal information subject to certain exceptions, such as other laws that may require or permit us to preserve information (such as veterinary records, records related to a contract you signed, and records to prevent fraud).
• Correct Your Personal Information: You have the right to request that we correct inaccurate personal information that we maintain about you.
• Opt Out of Sharing for Targeted Advertising and Selling of Personal Information (also referred to as a “Do Not Sell/Share Request”): You have the right to request that we do not “Share” your personal information with third parties for targeted advertising (also known as cross-context behavioral advertising) or “Sell” your personal information to other parties for monetary or other valuable consideration. We do Share your personal information with third parties for targeted advertising and we disclose it to our vendors for analytics purposes, both of which may constitute a “Sale” or “Sharing” under privacy laws. However, we do not Sell your personal information to third parties for monetary consideration. We do not knowingly Sell or Share the personal information of minors under the age of 18.
• Limit the Use and Disclosure of, Withdraw Consent for, and/or Opt-Out of the Processing of Your Sensitive Personal Information: You have the right to request that we limit the use and disclosure of your sensitive personal information to certain permitted purposes under data privacy laws. In some states, you may also opt out of the processing of your sensitive personal information or withdraw your consent for us to process your sensitive personal information except for certain permitted purposes. Even after you submit a request to limit or withdraw consent for processing of your sensitive personal information, however, we may still have permitted purposes for continued processing of your Sensitive Personal Information. These may include (depending on applicable law, such as the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”) and their implementing regulations) things such as (i) to provide the goods or services reasonably expected by an average consumer who requests those goods or services; (ii) to prevent, detect, and/or investigate security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information; (iii) to resist malicious, deceptive, fraudulent, or illegal actions directed at us and to prosecute those responsible for those actions; (iv) to ensure the physical safety of natural persons; (v) for short-term, transient use, including, but not limited to, nonpersonalized advertising shown as part of a current interaction with us; (vi) to perform services on our behalf; (vii) to verify or maintain the quality or safety of a service or device; and/or (viii) for purposes that do not infer characteristics about you.
• Opt Out of Automated Profiling or Automated Decision-Making Technology (“ADMT”): Data privacy laws may provide various rights, including opting-out, contesting and accessing information, related to the use of ADMT and processing of your personal information for profiling in furtherance of decisions that produce legal or similarly significant effects. However, please note that we do not believe we use such ADMT and profiling to make decisions that produce legal or similarly significant effects, such as decisions that result in the provision or denial of financial or lending services, housing, insurance, education enrollment or opportunities, criminal justice, employment or independent contracting opportunities or compensation, health care services, or access to essential goods or services or basic necessities.
• Opt Out of Financial Incentives: You have the right to opt out of our loyalty programs at any time, and any other financial incentive programs we may offer. Please see Section 7 for our full Notice of Financial Incentives.
• Non-Retaliation/Non-Discrimination: You have the right not to be discriminated against for exercising your privacy rights. This right prevents your exercise of privacy rights from being the basis of (a) denying you goods or services; (b) charging you different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties; (c) providing you a different level or quality of goods or services; (d) suggesting to you that you will receive a different price or rate for goods or services or a different level or quality of goods or services; (e) retaliating against you for exercising your privacy rights; and (f) violating existing United States anti-discrimination laws.
• File an Appeal: You may appeal a denial of your privacy rights request. Within 45 days of receipt of an appeal, we will inform you of any action taken in response to the appeal, including a written explanation of the reasons for the decisions where applicable. If we deny your appeal, you may submit a complaint to the Attorney General or other privacy regulator of your state.

In addition to the above, some states provide additional privacy rights that you may be eligible to exercise. These include:

• California Residents – ‘Shine the Light’ Law: Under California’s “Shine the Light” law, a California resident with whom we have an established relationship has the right to request information about our disclosure of personal information to affiliated companies or third parties for their direct marketing purposes, within the immediately preceding calendar year, subject to certain exceptions.
• Nevada Residents: Nevada residents have the right to request that we do not sell certain personal information to select third parties for monetary consideration, even if their personal information is not currently being sold.

9. HOW TO EXERCISE YOUR PRIVACY RIGHTS

Please follow the instructions below if you would like to exercise your privacy rights.

• Requests to Know/Access Your Personal Information, and Requests for a List of Third Parties

To exercise your Right to Know/Access, or to Request a List of Third Parties, please submit your request through our web form using the instructions provided there. If you are unable to submit your request using the webform and these instructions, need assistance, or have any questions, please email privacy@petco.com or call us at (877) 738-6742.

When you submit a request to Know/Access your personal information, or Request a List of Third Parties, we will verify your identity by matching the information provided by you with the information we have in our records. In some cases, we may need to request additional information in order to verify your identity, or as necessary to process your request or protect against fraud. If we are unable to adequately verify your identity or the legitimacy of your request, we will notify you (or the requester, if you are using an authorized agent). If you fail to timely respond to our request to verify your identity, your request may be denied.

If permitted or required by applicable law, you may designate an authorized agent (which may include a guardian or conservator as used herein) to make a request to Know/Access your personal information on your behalf, or Request a List of Third Parties on your behalf. Authorized agents may exercise these rights on your behalf by submitting their request through our web form, selecting the button indicating they are an “Authorized Agent of Consumer” and following the instructions provided. If an agent submits a request for you, the agent may be asked to present signed permission to act on your behalf. To prevent fraud, you may be required to independently verify your own identity directly with us, and to confirm with us that you provided the agent your permission to submit the request. This identity verification process is not necessary if your authorized agent provides documentation reflecting that the agent is acting as a conservator or has power of attorney to act on your behalf.

• Requests to Delete

To exercise your Right to Delete your personal information, please submit your request through our web form using the instructions provided there. If you are unable to submit your request using the webform and these instructions, need assistance, or have any questions, please email privacy@petco.com or call us at (877) 738-6742.

When you submit a request to delete your personal information, we will verify your identity by matching the information provided by you with the information we have in our records. In some cases, we may need to request additional information in order to verify your identity, or as necessary to process your request or protect against fraud. If we are unable to adequately verify your identity or the legitimacy of your request, we will notify you (or the requester, if you are using an authorized agent). If you fail to timely respond to our request to verify your identity, your request may be denied.

If permitted or required by applicable law, you may designate an authorized agent (which may include a guardian or conservator as used herein) to make a deletion request on your behalf. Authorized agents may exercise this right on your behalf by submitting their request through our web form, selecting the button indicating they are an “Authorized Agent of Consumer” and following the instructions provided. If an agent submits a request for you, the agent may be asked to present signed permission to act on your behalf. To prevent fraud, you may be required to independently verify your own identity directly with us, and to confirm with us that you provided the agent your permission to submit the request. This identity verification process is not necessary if your authorized agent provides documentation reflecting that the agent is acting as a conservator or has power of attorney to act on your behalf.

Please note that even if your deletion request is granted, we may retain certain limited information where necessary under applicable law, such as to fulfill a contract with you, to comply with other laws, to prevent fraud, for dispute resolution, to protect information security, and/or to enforce our Terms of Use and other agreements.

• Requests to Correct

To exercise your Right to Correct your personal information, please submit your request through our web form using the instructions provided there. If you are unable to submit your request using the webform and these instructions, need assistance, or have any questions, please email privacy@petco.com or call us at (877) 738-6742.

When you submit a request to correct your personal information, we will verify your identity by matching the information provided by you with the information we have in our records. In some cases, we may need to request additional information in order to verify your identity, or as necessary to process your request or protect against fraud. If we are unable to adequately verify your identity or the legitimacy of your request, we will notify you or the requester. If you fail to timely respond to our request to verify your identity, your request may be denied.

If permitted or required by applicable law, you may designate an authorized agent (which may include a guardian or conservator as used herein) to make a correction request on your behalf. Authorized agents may exercise this right on your behalf by submitting their request through our web form, selecting the button indicating they are an “Authorized Agent of Consumer” and following the instructions provided. If an agent submits a request for you, the agent may be asked to present signed permission to act on your behalf. To prevent fraud, you may be required to independently verify your own identity directly with us, and to confirm with us that you provided the agent your permission to submit the request. This identity verification process is not necessary if your authorized agent provides documentation reflecting that the agent is acting as a conservator or has power of attorney to act on your behalf.

• Requests to Opt Out of Sharing for Targeted Advertising and Selling of Personal Information (“Do Not Sell/Share”)

To exercise your Right to Opt Out of Sharing for Targeted Advertising or Selling of Personal Information, please follow the instructions below for each online platform where you interact with us. If you are unable to submit your request using these instructions, need assistance, or have any questions, please email privacy@petco.com or call us at (877) 738-6742. If you exercise an opt out request through Global Privacy Control or the Manual Opt-Out (explained below), we will display whether we have processed your request by stating “Opt-Out Request Honored.”

Website Users – Global Privacy Control: You may opt out of Selling/Sharing by broadcasting the Global Privacy Control signal when browsing our Sites. You can read more about the Global Privacy Control at www.globalprivacycontrol.org. We currently rely on a third-party privacy tool to recognize whether users visiting our Sites are broadcasting the Global Privacy Control signal. If you stop using the Global Privacy Control, you will need to manually opt out again using the below instructions. Please note that the Global Privacy Control signal will not stop all digital tracking, generalized advertising, or information sharing for other legitimate purposes.

Website Users – Manual Opt-Out: You may scroll to the bottom of this webpage or our homepage at www.petco.com and click the footer link titled “Your Privacy Choices.” This will open a pop-up window where you may opt out by clicking the blue toggle button so that the button changes from blue to gray, and/or it moves from right to left. When you are successfully opted out, the button will be gray and appear on the left side of the icon. Please note that the “Your Privacy Choices” pop-up window will give you the option of logging into your account and/or providing your email address. This is voluntary. However, if you do not log into your account and/or do not provide an email address at that time, we may not be able to identify you. If we cannot identify you, your opt-out can be processed only on the browser and device you are using at that time. Please also note that when you opt out, our privacy vendor will place a cookie on your browser to automatically prevent our targeted advertising technologies from operating when you use the same browser and device to visit the Site. If you are having trouble accessing the “Your Privacy Choices” link or opening the pop-up window, you may need to temporarily disable cookie-blocking technologies or browser extensions in order for the “Your Privacy Choices” link and pop-up window to appear on the Site.

Mobile App Users: Within the mobile app, navigate to the “Account” page, scroll down, and click the link to “Your Privacy Choices.” This will open a pop-up window where you may opt out by clicking the blue toggle button so that the button changes from blue to gray, and it moves from right to left. When finished, click “Confirm My Choices.” When you are successfully opted out, the button will be gray and appear on the left side of the icon. If you do not log into your account in the app before opting out, we may not be able to identify you. If we cannot identify you, your opt-out can be processed only within the mobile app. If you don’t log into your account on the app, if you use a different account on the app, or if you delete the app, you will need to opt out again.

All Users: After we process your opt out, you may still see advertising regarding our Services. This advertising is designed for a general audience, or it may be delivered in ways that do not involve Sharing or Selling of your personal information under applicable laws. You may designate an authorized agent (which may include a guardian or conservator) to submit a request to opt-out of the Sale or Sharing of personal information on your behalf. Authorized agents may exercise this right on your behalf while using your devices and browsers. To do so, they can either deploy the Global Privacy Signal on your device/browser on your behalf, or follow the instructions above to manually opt out on our Sites while using your browsers/devices/apps (i.e., from your device/browsers, the agent should scroll to the bottom of this webpage or our homepage at www.petco.com, click the footer link titled “Your Privacy Choices,” and follow the instructions provided in the pop-up window; or, from your mobile app, the agent should scroll to the “Account” page, click “Your Privacy Choices,” and follow the instructions provided there).

• Requests to Limit the Use and Disclosure of, Opt Out of, or Withdraw Consent for Processing of Sensitive Personal Information

To exercise your right to limit the use and disclosure of, opt out of, or withdraw consent for processing of your sensitive personal information, please submit your request through our web form using the instructions provided there. If you are unable to submit your request using the webform and these instructions, need assistance, or have any questions, please email privacy@petco.com or call us at (877) 738-6742.

If permitted or required under applicable law, you may designate an authorized agent to submit this request on your behalf. Authorized agents may exercise this right on your behalf by submitting their request through our web form, selecting the button indicating they are an “Authorized Agent of Consumer” and following the instructions provided. If an agent submits a request for you, the agent will be asked to present signed permission to act on your behalf.

• Requests to Opt Out of Automated Profiling or ADMT

While we do not believe we currently use your personal information for automated profiling in furtherance of decisions that produce legal or similarly significant effects under applicable privacy laws, or in ways that involved regulated uses of ADMT, in an abundance of caution, we provide you the ability to register with us your opt out of automated profiling in case our practices change in the future. To exercise your right to opt out of automated profiling, please submit your request through our web form using the instructions provided there. If you are unable to submit your request using the webform and these instructions, need assistance, or have any questions, please email privacy@petco.com or call us at (877) 738-6742.

If permitted or required under applicable law, you may designate an authorized agent to submit this request on your behalf. Authorized agents may exercise this right on your behalf by submitting their request through our web form, selecting “Authorized Agent of Consumer” and following the instructions provided. If an agent submits a request for you, the agent will be asked to present signed permission to act on your behalf.

• Opting Out of Financial Incentives

You can opt out of our Offers at any time by calling us at (877) 738-6742, emailing privacy@petco.com, or writing to us at Petco, 10850 Via Frontera, San Diego, CA 92127, Attn: Privacy Team: Financial Incentives.

• Appealing a Denied Privacy Rights Request

You may be eligible to appeal certain denied privacy rights requests. To exercise your right to appeal, please submit your request through our web form. Additional information related to appeals is provided by email at the time your request is denied.

• California Residents – ‘Shine the Light’ Law

To exercise this right, please contact us by writing to us at Petco, 10850 Via Frontera, San Diego, CA 92127, Attn: Privacy Team: Shine the Light.

• Nevada Residents

If you are a Nevada resident and wish to exercise your privacy rights, please email privacy@petco.com.

10. CCPA/CPRA STATISTICS

Each year, we compile and publish information about the number and types of privacy requests we receive under the California Consumer Privacy Act, as modified by the California Privacy Rights Act effective January 1, 2023. You can click here to view our latest report.

11. HOW TO UPDATE YOUR INFORMATION & COMMUNICATION PREFERENCES

You may correct or update certain personal information that we collect from you by editing your information on the “My Account” page of our Sites or Apps, or by using one of the methods listed in Section 19 for contacting us.

If you would like to stop receiving emails, mail, or other communications from us, please follow the instructions below. Your instructions to limit the use of your information for these purposes will be processed as soon as reasonably practicable.

• Email Promotions. If you do not want to receive emails from us regarding special promotions or offers, you may (i) click the unsubscribe link in the footer of any of our promotional emails; or (ii) contact us using one of the methods in Section 19. Please note, you may still receive transactional emails from us after unsubscribing to our marketing content. For example, if you have earned benefits or points through our loyalty programs, you will continue to receive transactional emails from us about the terms of the program; legally required updates; and similar non-marketing content.
• Direct Mail Promotions. If you do not want us to send you any promotional offers through the mail, you may contact us using one of the methods in Section 19. To opt out by email or mail, please include “Do Not Mail” in the subject line so your request can be properly directed.
• Mobile/Telephone Promotions. If you no longer wish to receive text messages from us, you can (i) follow the instructions provided in those messages or otherwise reply STOP; or (ii) contact us using one of the methods listed in Section 19.
• Push Notifications. When you use the Apps, you may receive push notifications. If you prefer not to receive push notifications, you may adjust your settings on your mobile device to control whether you want to receive these alerts.

12. DATA SECURITY

We have taken certain physical, administrative, and technical steps designed to safeguard the personal information we collect from and about our customers. However, please be aware that despite these measures, no e-commerce platform, website, application, or system is 100% secure. We strongly encourage you to take reasonable steps to protect your personal information against unauthorized access by, for example, signing off after using shared devices; choosing a unique password for each account that no one else knows or can easily guess; and keeping all log-in credentials private. We are not responsible for any lost, stolen, or compromised passwords or for any activity on your account via unauthorized password activity.

13. RETENTION PRACTICES

We store personal information for as long as reasonably necessary to carry out the purposes for which we originally collected it, and for other legitimate business purposes, including meeting our legal, regulatory, and other compliance obligations. We have established an internal policy for retiring unnecessary data after the initial purpose for which we collected it has expired, among other factors. Under that policy, we use several criteria to determine how long we retain your information, including applicable legal requirements; business needs; best practices; industry standards and recommendations; storage costs; and similar factors.

14. TRANSFER OF DATA FROM OUTSIDE THE UNITED STATES

We are located in the United States, and therefore collect, process, and store your information in the United States. If you use any of our Services from outside of the United States, information that we collect from or about you will be transferred to and stored on servers inside the United States. Your use of the Services or provision of information to us constitutes your consent to the collection, transfer, use, processing, sharing, and storage of your information in the United States.

15. CHILDREN

Our Services are directed at a general audience and are not targeted to children. We do not knowingly collect personal information from children. If we learn that we have collected personal information from an individual under age 18, we will use reasonable efforts to promptly remove such information. If you believe that we may have information from a child, please contact us at privacy@petco.com.

16. EXTERNAL CONTENT, LINKS, AND PLUG-INS

The Sites and Apps may have links to external websites or applications that have privacy policies that differ from our own. Your use of any external platforms in connection with our Services is also subject to those platforms’ separate and independent privacy policies. For example, your use of social network plug-ins available on our Services is also subject to each social network’s own privacy policy, which may be different from ours, so please read their policies carefully. As another example, our Apps may allow you to choose to enable Apple Face ID and/or similar biometric log-in methods offered by your device or its operating system. When you enable these, we do not receive any fingerprint, facial recognition, facial geometry, or any other biometric identifiers from the service you are using; we receive an indication from your device as to whether the log-in was successful. You are not required to use biometric log-in features offered by your device or other external operating systems; if you object to using such features, please do not use them to access our Services. Please note that we have no control over the information that is collected, stored, or used by social network plug-ins, linked/external websites or applications, or third-party services or devices, and we are not responsible for the practices of such third parties.

17. PUBLIC FORUMS

Any personal information you choose to disclose on public websites, blogs, discussions, or message boards, in chat rooms, interactive forums, product ratings or reviews, on other external websites that we may link to, or on other public areas on the Sites or Apps, becomes public information. Please exercise caution when disclosing personal or other information in public areas. We are not responsible for the personal information you choose to post in a public forum.

18. CHANGES TO THIS POLICY

We may revise and update this Policy from time to time. When we make a material change that affects your privacy rights, we will provide appropriate notice to you by email, by posting the updated Policy on our Sites or Apps, or by any other reasonable means. Where permitted under applicable law, you will be deemed to have accepted any updates or modifications to this Policy by, among other things, continuing to access or use the Services and not opting out, withdrawing or exercising other rights described above (such as a deletion right). If we make material changes to our processing of your previously-collected personal information, we will obtain your consent where required by applicable law. We encourage you to check this page frequently to review the Policy currently in effect and any changes that may have been made. If we upgrade, supplement, or replace the Services with additional offerings or features, this Policy will apply to such upgrades. You may learn more about your rights and exercise them by reviewing Sections 8 and 9 above or contacting us below under Section 19 to learn more about opting out of or withdrawing from our going-forward processing activities.

19. CONTACT US

If you have any questions regarding this Policy or have trouble accessing this Policy because of a disability and would like to receive it in an alternative format, you can contact us by calling (877) 738-6742; emailing privacy@petco.com; or writing to us at Petco, 10850 Via Frontera, San Diego, CA 92127, Attn: Privacy Team.