Utah Consumer Privacy Act

Rights and Disclosures for Utah Residents

YOUR RIGHTS Our goal is to serve you. We know you want to control your data and you have the right to do so. Here is a list of the rights you have as a resident of Utah:

You can ask whether or not we are processing your personal data and ask for a copy of your data or info about what we collect, why and who we share it with
You can ask us to correct your data or to delete some of it
You can ask us to transfer data you gave us to other companies
You can ask to opt-out of the processing of your personal data pertaining to targeted advertising; the sale of personal data; profiling in furtherance of decisions that produce legal or similarly significant effects concerning you (see below for more information on your right to opt-out)
You will be notified if your personal data is involved in a data breach

RIGHT TO OPT OUT If you are a Utah resident, you have the right to opt out of the “sale” of your personal information to “third parties” Sale is defined very broadly. The law defines “sale” more broadly than you might think. It doesn’t just include the exchange of data for money. Instead, it covers any transfer of personal information to a “third party” in exchange for “monetary consideration” We do not transfer your information to third parties in exchange for money and we will not do so. However, we do transfer personal information to certain third parties in order to operate our business (for example, to market our products and services). It is possible that someone could claim that this transfer was in exchange for “monetary consideration.” We want to be careful with and respectful of your information. Therefore, if you opt out, we will not transfer your information to any “third party” except as explained below (and allowed by law).

Opting out may have impacts you don’t expect. Any transfer of data to a “third party” may be considered a “sale” of data. The law considers any other business a “third party” unless that business agrees to specific contractual provisions, aligning with the role and responsibilities of “processor” under Utah Law. We try to get all of the businesses to whom we send information to accept the role of “processor” and agree to the respective responsibilities in our contract. But not everyone will or can agree to those terms. As a result, if you opt out of the “sale” of data, we will not be able to send data to some of our business partners. That may mean that, after you opt out, you may not receive all of the marketing and other information you are accustomed to receiving from us. In the extreme, if one of our critical partners cannot agree to the special contract language, and is considered a “third party”, it is possible that some features of our web site or other services may not work for you after you opt out.

In addition, if you opt-out, we may alert you if a transaction requires a transfer to a third party so that you can opt in if you would like to continue with the transaction

Minors. We do not “sell” the data of people under 16, and do not intend to collect data related to people who are under 13.

Exceptions to the opt out. The law creates several exceptions that are important for you to be aware of.

We are allowed to transfer data to a “processor” even if you opt out. The law does not consider that kind of transfer to be a “sale.” A processor is a business that agrees not to use your information for any purpose other than providing the services specified in our contract. For example, we transfer data to business partners to provide data security and detect fraud. Those businesses are “processors.” Even if you opt out, we will continue to transfer data to our processors.

We are also allowed to transfer your data to a third party where you direct the transfer or direct us to interact with the third party. For example, if you direct us to use a specific payment method to pay for your order, even if you have opted out, we will still transfer the data necessary to process your order.

Collecting information and using it ourselves is not a “sale.” Opting out of the “sale” of your data does not prevent us from continuing to collect and process your personal information. You can learn more about how and why we collect personal information at our Notice of Collection. The “opt out” only applies to “personal information.” This is information that is or is capable of being linked to you. We use anonymization and pseudonymization to protect privacy. That data is not “personal information” Opting out will not limit our transfer of that data to third parties.

Technical limitations on opt out. Please note that there are technical limits to our ability to identify data related to you and, if you opt out, to prevent the "sale" of that information to other parties. Where we can reasonably determine that information relates to you and you have opted out, we will not "sell" it to "third parties" (except as allowed by the law). However, we may not be able to determine that information relates to you. In that case, the information may be "sold" to a third party.

Opting out is not unsubscribe. Opting out of the "sale" of personal information will not prevent you from receiving marketing messages from us. If you wish to unsubscribe from our emails, please follow the unsubscribe link in one of our emails. If you wish to unsubscribe from text messages, please follow the unsubscribe process for the program you opted into.

Opting-out multiple email addresses. If you want multiple email addresses opted out, you must provide each address to us. This is because we have no reasonable way to use a single address you give us to link to other addresses you may have.

HOW TO MAKE A REQUEST If you would like to opt out of the "sale" of your data, you have several options. You may click the opt out button (located below), you may email us at DataPrivacyOfficer@urbn.com, or you may call us toll free at (888) 708-0525. You will not be required to create an account in order to opt out.

If you have an account. The easiest way to opt out is to "log in" to your account and then click the opt out button. If you do, the email address associated with your account will be opted out, and we will set a cookie on your device to facilitate your opt out. That cookie will enable us to identify you if you return and allow us to prevent data from being "sold". If you delete the cookie or return using a different device or browser and are not "logged in" to your account, we will not be able to connect the session to your opt out and will not be able to prevent the "sale" of the data.

If you want to opt out using email or our toll-free number, you will need to follow more steps. If you want to opt out an email address that is different from the email on your account, you will need to use the email process or toll-free number to do so. To use the email process or toll-free numbers to opt out, you or your authorized representative will need to provide us the email address you wish to opt out. If you want multiple email addresses opted out, you must provide each address to us. This is because we have no reasonable way to use a single address you give us to link to other addresses you may have.

If you email us or use the toll free number, we will have no way of setting a cookie on your device. This will limit our ability to prevent the "sale" of data. For this reason, the opt out button is the most complete way to opt out of the "sale" of data.

If you do not have an account. The most complete way to opt out is to use the "opt out" button and then follow the prompts to email us the email addresses you would like opted out. If you do, we will set a cookie on your device to facilitate your opt out. That cookie will enable us to identify you if you return and allow us to prevent data from being "sold". If you delete the cookie or return using a different device or browser, we will not be able to connect the session to your opt out and will not be able to prevent the "sale" of the data.

After you click the “opt out” button, if you want to opt an email address out, you must follow the prompts and provide us the address. In the alternative, you may email us or use the toll free number. If you want multiple email addresses opted out, you must provide each address to us. This is because we have no reasonable way to use a single address you give us to link to other addresses you may have.

HOW TO APPEAL A DECISION PERTAINING TO A REQUEST Should we deem it necessary to refuse a request, our response will include our reason as well as instructions to appeal the decision. Per UT Law, you will need to appeal within a “reasonable period of time“ after receipt of the decision. Within 60 days of receipt of an appeal, we will inform you in writing of any action taken or not taken in response to the appeal. If the appeal is denied, you may contact the UT Attorney General to submit a complaint.

MORE ON PRIVACY. We take the security and privacy of your data very seriously. If you would like to learn more about it, please read our Privacy Policy.