Fingerhut’s Privacy Policy

Effective Date: January 1, 2020
Last Updated Date: October 26, 2024

ATTENTION: PLEASE READ CAREFULLY THIS FINGERHUT (“FINGERHUT,” “OUR,” “US,”; OR “WE”) PRIVACY POLICY (“PRIVACY POLICY”) BEFORE YOU (“YOU”) ACCESS, DOWNLOAD, OR OTHERWISE USE https://www.fingerhut.com, applications on the site, and the Fingerhut mobile application (collectively “WEBSITE” OR “SITE”).

ACCESSING, DOWNLOADING OR OTHERWISE USING THE SITE INDICATES THAT YOU ACKNOWLEDGETHIS PRIVACY POLICY. IF YOU DO NOT ACKNOWLEDGETHIS PRIVACY POLICY, DO NOT ACCESS, DOWNLOAD, OR OTHERWISE USE THE WEBSITE. You acknowledge that you have read and understood this Privacy Policy.

This Privacy Policy covers the following topics:

1. Introduction
2. Information We Collect
3. How We Use Your Information
4. How Your Information Is Disclosed
5. Cookies, Local Storage, and Other Tracking Technologies
6. Security
7. Data Retention Policy
8. Your Choices Regarding Your Information
9. Information Collected from Other Websites, and Fingerhut’s Do Not Track Policy
10. Protecting Children
11. Terms of Use
12. Your Nevada Privacy Rights
13. Notice to Colorado, Connecticut, Delaware, Iowa, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah and Virginia Residents
14. Notice to California Residents
15. Notice of Financial Incentive
16. Shine the Light Law
17. Accessibility
18. Contacting Us

1. Introduction

This Privacy Policy only applies to your visits to the Site, which is presented by the Fingerhut brand and operated by BLST Sales, Marketing & Servicing, LLC. We have a place of business at 6250 Ridgewood Road, St. Cloud, MN 56303. We know you value your privacy. This Privacy Policy covers personal information we collect and receive from you or about you and explains how we may collect, use, and, in some instances, share this information.

This Privacy Policy does not cover the personal information you provide when applying for a WebBank/Fingerhut Credit Account. The personal information you provide when you apply for a WebBank/Fingerhut Credit Account is collected on behalf of WebBank and is covered by the WebBank Privacy Policy. If you have a consumer financial product or service with us (e.g., a Fingerhut Credit Account), we will use and share any information that we collect from or about you in accordance with our U.S. Consumer Privacy Notice, which offers you certain choices with respect to the use and sharing of your personal information.

Unless explicitly stated otherwise, any new features that augment or enhance the current Site will be subject to this Privacy Policy.

Please review the Privacy Policy each time you use the Site. From time to time, we may change this Privacy Policy. If we do, we will post an amended version on this page.

You may access the current version of this Privacy Policy at any time by clicking on the link marked “Privacy & Security” at the bottom of each page of the Site. For your convenience, we post the Last Updated Date of this Privacy Policy at the top of this page, so that you can see whether this Privacy Policy has changed since your last visit.

1. Privacy Notices

This Privacy Policy may be supplemented or amended from time to time by “Privacy Notices” posted on the Site. Generally, Privacy Notices provide details about the personal information we collect on particular pages or particular areas of the Site, why we need that information, and choices you may have about the ways we use that information. Our Privacy Notices are part of this Privacy Policy.

2. Separate Privacy Policies Governing WebBank/Fingerhut Credit Account

WebBank/Fingerhut Credit Account Holders. Please be aware that the personal information you provide when you apply for a WebBank/Fingerhut Credit Account is collected for WebBank, the Issuer of the WebBank/Fingerhut Credit Account, and is not covered by this Privacy Policy. If you apply and are approved for a WebBank/Fingerhut Credit Account, we will provide you with a separate copy of the WebBank Privacy Policy describing how WebBank collects, uses, shares, and protects the personal information collected in connection with your WebBank/Fingerhut Credit Account.

Fingerhut services WebBank/Fingerhut Credit Account. Fingerhut will provide you with a separate notice “WebBank/Fingerhut Credit Account Privacy Policy”) describing how we collect, use, share and protect the personal information we collect in connection with your WebBank/Fingerhut Credit Account (your “Credit Account Information”). Your Credit Account Information may include your name and contact information; information about your credit history and credit scores; and information about your account balances and payment history. Our WebBank/Fingerhut Credit Account Privacy Policy also describes the choices you have about the ways we use and share the personal information we collect in connection with your WebBank/Fingerhut Credit Account. If any of the terms of the WebBank/Fingerhut Credit Account Privacy Policy are different than the terms of this Privacy Policy, the terms of the WebBank/Fingerhut Credit Account Privacy Policy will supplement or amend this Privacy Policy, but only with respect to the personal information we collect in connection with your Credit Account Information. For more information, view our current WebBank/Fingerhut Credit Account Privacy Policy here.

California Residents. If you are a California resident, we will send you a California Privacy Statement when you open a WebBank/Fingerhut Credit Account. Our California Privacy Statement describes some of the choices you have about the ways we share your personal information. If any of the terms of our California Privacy Statement are different than the terms of this Privacy Policy or the WebBank/Fingerhut Credit Account Privacy Policy, the California Privacy Statement will govern. For more information, view our current California Privacy Statement here

Vermont Residents. If you are a Vermont resident, we will send you a Vermont Privacy Statement when you open a WebBank/Fingerhut Credit Account. Our Vermont Privacy Statement describes some of the choices you have about the ways we share your personal information. If any of the terms of our Vermont Privacy Statement are different than the terms of this Privacy Policy or the WebBank/Fingerhut Credit Account Privacy Policy, the Vermont Privacy Statement will govern. For more information, view our current Vermont Privacy Statement here.

2. Information We Collect

We collect information from you when you use the Site, contact us, or interact with us in the manner described below. We may collect personal information that you may provide. If you submit any personal information in connection with using the Site, you represent that you have the authority to do so and to permit Fingerhut to use the information in accordance with this Privacy Policy.

1. Information You Voluntarily Provide Us

We collect the personal information that you knowingly and voluntarily provide when you use the Site. For example, we collect the information you provide when you request information about products or services, request a catalog, purchase a product or service, contact us regarding a purchase, or enter a contest or promotion. When using the Site, you may provide personal information including, but not limited to your first and last name, shipping/billing address, email address, phone or mobile phone number, credit or debit card information, driver's license, Social Security number, age, birth date, gender, purchase/return/exchange information, occupation, personal interests and information used to verify your identity or for fraud prevention purposes. Whether to provide such information is completely your own choice. But if you choose not to provide the information we request, you may be unable to purchase products, or access certain services, offers and content on the Site.

2. Information We Collect Automatically When You Use the Site

When you access and use the Site, we automatically collect information regarding you and your device, including your device's Internet Protocol address, the domain name of your internet service provider, your location, your mobile device information (e.g., device model and operating system version), your page visits, your social sharing activity, and aggregated information that cannot be used to specifically identify you.

Additional information collected is described in the “Analytics” and “Cookies, Local Storage, and Other Tracking Technologies” sections below.

3. Supplemental Information

To serve you better, we may combine information you give us by shopping our catalogs with the information we collect through the Site. We may also supplement the information we collect through the Site with information that is publicly available such as information based on your address, zip code or information you submit in a public forum (e.g., a blog, chat room, or social network). We may also supplement the information we collect through the Site with information we receive from or cross-reference with other marketing partners and third parties including data brokers.

We may also collect information regarding payment on your WebBank/Fingerhut Credit Account. When you apply for credit on the Site, personal information may be obtained about you from credit bureaus. To learn more about the ways we protect your privacy in association with your WebBank/Fingerhut Credit Account, see the WebBank/Fingerhut Credit Account Privacy Policy here.

4. Information We Collect from Other Sources

We may collect information about you from partner sources, including advertising companies, marketing consultants, and social media companies. Advertising and marketing companies may display online advertising for us or other companies to you on the Site and on other websites. The information these advertising partners and marketing consultants collect and use includes non-personally identifiable information (e.g., click stream information, browser type, time and date, subject of advertisements clicked or scrolled over, hardware/software information, cookie and session ID) and personally identifiable information (e.g., IP address).

As an example, we utilize services from the following partners:

• Contentsquare: We use Contentsquare to capture statistical audience data of how you interact with our Site. Through the use of Cookies, Contentsquare may collect your IP addresses, non-identifying data regarding a device, operating system, browser type, locale and language settings, the cookies and pixels installed on such device, session logging, heatmaps and scrolls, screen resolution, ISP, referring or exit pages, and date/time stamps, and the activity (clicks, browsing, zooms and other interactions). For more information on Contentsquare’s data practices, please visit their privacy policy here.

• TransUnion: We use services provided by a third-party, TransUnion LLC (“TransUnion”), for the purposes of fraud prevention and account authentication purposes. TransUnion is based in the US. Their third-party services help us decide whether to accept transactions from electronic devices by analyzing device attributes and checking whether they have been associated with fraudulent or abusive transactions in the past. The service also helps verify your identity by registering and remembering devices associated with your account. We also report to TransUnion if we conclude that a device has been used in connection with a fraudulent or abusive transaction with us.
  
  Through the use of Cookies, the following may be collected: your attributes of your device, which is like the types of information collected by many websites such as IP addresses, device type, browser type, screen resolution, operating system, etc. Your identifiable personal data may not be directly collected, although your IP address may be collected. This information is then shared with TransUnion for fraud prevention and account authentication purposes. For more information about TransUnion’s privacy practices, please visit www.transunion.com/privacy/iovation.
  
  Additional information about Cookies is described in the “Cookies, Local Storage, and Other Tracking Technologies” section below.
  
  The Site includes social media features, such as the Facebook Like button, Google Plus, Pinterest, and Twitter widgets. These features may collect information about your IP address and which page you are visiting on our Site, and they may set a cookie to make sure the feature functions properly. Social media features and widgets are either hosted by a third party or hosted directly on our Site. Your interactions with those features are governed by the privacy policies of the companies that provide them.

3. How We Use Your Information

We use the information we collect for several purposes including:

• to provide the products, information and services you request;
• for security, credit or fraud prevention purposes;
• to provide you with effective customer service;
• to provide you with a personalized experience when you use the Site;
• to provide relevant advertising and remarketing across websites;
• to contact you with special offers and other information we believe will be of interest to you;
• to contact you with information and notices related to your use of the Site;
• to invite you to participate in surveys and provide feedback to us;
• to invite you to participate in and administer sweepstakes and contests;
• to better understand your needs and interests;
• to improve the content, functionality and usability of the Site;
• to improve our products and services;
• to improve our marketing and promotional efforts;
• to administer and troubleshoot the Site;
• to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, or violations of our Terms of Use, and to otherwise fulfill our legal obligations;
• to allow our affiliates and Bluestem Brands family of companies and third parties to provide you products, information, and services we believe will be of interest to you;
• to compile aggregate data for internal and external business purposes; and
• for any other purpose identified in an applicable privacy notice or other agreement between Fingerhut and you or as permitted or required by law.

Please note that you may choose not to allow us to use your personal information for certain purposes (such as to email you promotional information) as described in the “Your Choices Regarding Your Information” section below.

4. How Your Information is Disclosed

Information may be disclosed to third parties in accordance with this Privacy Policy. You may choose not to share certain information as described in the “Your Choices Regarding Your Information” section below.

1. Vendors and Third Parties

We share personal information with companies and organizations that perform services on our behalf, for example, companies that provide support services to us (such as credit card processing services, cloud data storage services, web hosting services, shipping services) or that help us market our products and services (such as companies that provide advertising and marketing services). These entities are required by contract to use the personal information we share with them only to perform services on our behalf and to take commercially reasonable measures to protect the confidentiality and security of your personal information.

We also may share users' personal information with third parties for their direct marketing and promotional purposes so they can offer and provide products and services to you.

2. Business Changes

If we become involved in a merger, acquisition, sale of assets, joint venture, securities offering, bankruptcy, reorganization, liquidation, dissolution, or other transaction or if the ownership of all or substantially all our business otherwise changes, we may transfer your information to a third party or parties in connection therewith.

3. Affiliates

We may also share your information with our affiliates so they can offer and provide products and services to you.

4. Investigations and law

We may disclose information about you to third parties if we believe that such disclosure is necessary to:

• Investigate, prevent, or take action regarding suspected illegal activities, suspected fraud, the rights, reputation, safety, and property of us, users or others, or violations of our policies or other agreements with us;
• Comply with the law or guidance and cooperate with government or law enforcement officials or private parties;
• Respond to claims and legal process (e.g., subpoenas); and/or
• Protect against legal liability.

5. Aggregated Information

We may share aggregated information relating to users of the Site with affiliated or unaffiliated third parties. This aggregated information does not contain personal information about any user.

6. As Described in a Privacy Notice

We reserve the right to disclose your personal information as described in any privacy notice posted on the Site where you provide that information. By providing your personal information on that webpage, you consent to the disclosure of your personal information as described in that privacy notice.

7. As Described in Any Other Agreement Between You and Fingerhut

We reserve the right to disclose your personal information as described in any click-through agreement or any other agreement between you and Fingerhut.

8. Analytics

We use third-party analytics tools to help us measure traffic and usage trends for the Site. These tools may use cookies and other technologies to collect information about your use of the Site. These tools collect information sent by your device or the Site and other information that assists us in improving the Site. This information may be used to, among other things, analyze and track data, determine the popularity of certain content, and better understand your online activity.

We also participate in the Adobe Marketing Cloud Device Co-op to better understand how you use our Site across the various devices you use and to deliver tailored promotions. If you do not wish to participate, you may “opt out” at Adobe Marketing Cloud Device Co-op Privacy Control.

5. Cookies, Local Storage, and Other Tracking Technologies

1. How We Use Cookies

Fingerhut and third parties may collect or receive information about your use of the Site, including through the use of cookies, web beacons and other technologies (collectively, ““Cookies”). Cookies are small files of information that are stored by your web browser software on your computer hard drive, mobile or other devices (e.g., smartphones or tablets), and they may be collected over time and combined with information collected on different websites and online services, which may track you across websites and apps.

We use Cookies to:

• collect information that may include which pages you visit, which web address you came from, which links you use, and how long you stay on each page the type of browser/device/hardware you are using, purchase and checkout process, search terms you use and IP-based geographic location;
• support the features and functionality of the Site - for example, to track the items you add to your shopping cart or to track your order;
• customize your Site experience and our advertising and marketing to you including Fingerhut advertising and marketing presented on another website or mobile application;
• save you the trouble of reentering information already in our database or to prompt the settings you established on previous visits to the Site;
• personalize your shopping experience;
• provide you products and services that you may be interested in;
• manage and determine the effectiveness of our advertising and marketing efforts including how you respond to our advertising and marketing efforts;
• provide Site security and/or fraud prevention purposes

Generally, the information we collect using Cookies does not identify you personally. If, however, you have created a user identity, for example, by applying for credit, we may link the information we collect using Cookies to other information that identifies you personally.

We set some of these Cookies ourselves, while separate entities set other Cookies. We use Cookies other entities set to provide us with useful information, to help us improve our Site, to conduct advertising, and to analyze the effectiveness of advertising. For example, we use Cookies from Google, Facebook, and other similar companies.

2. How You Can Opt Out of Cookies

• Browser Settings

You can block Cookies by changing your Internet browser settings to refuse all or some Cookies. If you choose to block all Cookies (including essential Cookies), you may not be able to access all or parts of the Site.

You can find out more about Cookies and how to manage them by visiting www.AboutCookies.org or www.allaboutcookies.org.

• Platform Controls

You can opt out of Cookies set by specific entities by following the instructions found at these links:

• Adobe: https://www.adobe.com/privacy/opt-out.html
• Google: https://adssettings.google.com
• Facebook: https://www.facebook.com/about/ads
• Microsoft: https://account.microsoft.com/privacy/ad-settings/
• Yahoo: https://policies.yahoo.com/xa/en/yahoo/privacy/topics/opt-outfaq/

• Advertising Industry Resources

You can understand which entities have currently enabled Cookies for your browser or mobile device and how to opt out of some of those Cookies by accessing the Network Advertising Initiative's website or the Digital Advertising Alliance's website. For more information on mobile specific opt-out choices, visit the Network Advertising Initiative's Mobile Choices website.

Please note these opt-out mechanisms are specific to the device or browser on which they are exercised. Therefore, you will need to opt out on every browser and device that you use.

Google Analytics

We use Google Analytics, a web analytics service provided by Google, Inc. Google Analytics uses Cookies or other tracking technologies to help us analyze how users interact with the Site, compile reports on their activity, and provide other services related to their activity and usage. The technologies used by Google may collect information such as your IP address, time of visit, whether you are a returning visitor, and any referring website. The information generated by Google Analytics will be transmitted to and stored by Google and will be subject to Google's privacy policies. To learn more about Google's partner services and to learn how to opt out of tracking of analytics by Google, click here.

6. Security

We implement a variety of security measures to protect the safety of your personal information when you enter, submit, or access your personal information.

While we take reasonable measures to protect the information you submit via the Site against loss, theft and unauthorized use, disclosure, or modification, we cannot guarantee its absolute security. No Internet, email, or mobile application transmission is ever fully secure or error free. Email or other messages sent through the Site may not be secure. You should use caution whenever submitting information through the Site and take special care in deciding with which information you provide us. If you have any questions about security on our Site, please email us at customerservice@fingerhut.com.

For your protection, certain areas of the Site are password protected. You are responsible for maintaining the confidentiality of your passwords. We have the right to assume that anyone accessing the Site using a password assigned to you has the right to do so. You will be solely responsible for the activities of anyone accessing the Site using a password assigned to you, even if the individual is not authorized by you. If you have reason to believe that your password has been compromised or used without authorization, you must promptly change it using the functionality provided on the Site.

Never provide sensitive personal information (e.g., Social Security number, driver's license number, or credit card information) to us via email. Use the appropriate areas of the Site to communicate this information or contact us by telephone with your 10-digit customer number. We cannot guarantee that transmissions of your personal information will be fully secure and that third parties will never be able to defeat our security measures or the security measures of our partners. WE ASSUME NO LIABILITY FOR DISCLOSURE OF YOUR INFORMATION DUE TO TRANSMISSION ERRORS, THIRD-PARTY ACCESS, OR CAUSES BEYOND OUR CONTROL.

Any information collected through the Site is stored and processed in the United States. If you use our Site outside of the United States, you consent to have your data transferred to the United States.

7. Data Retention Policy

We will retain your information for as long as you use the Site and for a reasonable time thereafter, unless as otherwise specified by applicable laws. Please note that some or all the information we have collected may be required in order for the Site to function properly.

8. Your Choices Regarding Your Information

We respect your right to make choices about the ways we collect, use, and disclose your personal information. In most cases, we will ask you to indicate your choices at the time we collect your personal information. We will also include an “opt out” link in newsletters or promotional emails we send you so you can inform us that you do not wish to receive such communications from us in the future. If you have created an account or a personal profile on the Site, you may be able to update some or all your privacy choices by changing the settings on your account settings or profile page.

1. Changing Your Information

If you wish to update or correct your personal information, please let us know by calling us at 1-800-964-1975 or by sending us an email at customerservice@fingerhut.com. Please be sure to include your email address, full name, and specifically what information you would like to update or correct. If you contact us by email, please provide us with your 10-digit customer number, but DO NOT include your Social Security number or your 16-digit account number.

2. Email Communications and Direct Marketing

We want to communicate with you only if you want to hear from us. You have the choice to be excluded from our offers and promotions and to be excluded from sharing personal information with our affiliates or Marketing Partners.

To unsubscribe from our marketing emails, please click the unsubscribe link included in the footer of our emails. You also may submit a request to us at customerservice@fingerhut.com.

If you choose not to receive information from us or do not want us to share your personal information with our affiliates, Bluestem Brands family of companies, marketing partners and third parties (“Marketing Partners”), please let us know by calling us at 1-800-964-1975 or by sending us an email at customerservice@fingerhut.com. Please be sure to include your email address, full name, and specifically what information you do not want to receive, such as “no phone offers”, “no mail offers”, “no email offers”, or “no sharing of information with Marketing Partners.” Please include your 10-digit customer number, but DO NOT include your Social Security number or your 16-digit account number in the email. We will respond to reasonable requests within a reasonable time and, in any event, within the time period required by law.

Even if you ask us not to share or use your personal information for direct marketing purposes, we may still use your personal information in connection with the proper administration and management of your WebBank/Fingerhut Credit Account. In addition, when you purchase from us online or through our catalogs, we may need to contact you via phone, email, or mail to address questions specific to your order, even if you have opted to not receive marketing communications.

3. Social Media

You should make sure you are comfortable with the information that a third-party social networking service may make available to us by carefully reviewing the social media service’s privacy policy and terms and conditions and by modifying your privacy settings directly on that service.

4. Advertising Partners and Marketing Consultants

If you do not wish to receive our advertising or marketing consultants' Cookies, please see our “Analytics” and “How You Can Opt Out of Cookies” sections above.

9. Information Collected from Other Websites, and Fingerhut's Do Not Track Policy

Through Cookies we place on your browser or device, we and our partners may collect information about your online activity after you leave the Site. Just like any other usage information we collect, this information allows us to improve the Site and customize your online experience, and otherwise as described in this Privacy Policy.

Your browser may offer a “Do Not Track” option, which allows you to signal to operators of websites and mobile applications and services (including behavioral advertising services) that you do not wish such operators to track certain of your online activities over time and/or across different websites and mobile applications and services. Given there is not a uniform way that browsers communicate the “Do Not Track” signal, the Site does not currently interpret, respond to, or alter its practices when it receives “Do Not Track” signals, which means that we collect information about your online activity both while you are using the Site and after you leave the Site.

10. Protecting Children

The Site is not intended for marketing or attracting children and we do not knowingly collect, use, or disclose personal information about anyone under the age of 13. Anyone under the age of 13 should not use the Site. Our goal is to comply with applicable laws and regulations relating to collection and use of information from children, including the federal Children's Online Privacy Protection Act. If you believe that we have received information from a child, please notify us immediately by calling us at 1-800-964-1975 or by sending us an email at customerservice@fingerhut.com, and we will remove that information from our database.

11. Terms of Use

Please also visit Fingerhut's Terms of Use, which states the terms, disclaimers, and limitations of liability governing your use of the Site.

State Rights

12. Your Nevada Privacy Rights

Under Nevada law, consumers who reside in Nevada have the right to make a verifiable request prohibiting us from selling “covered information” that we have collected or will collect to a third party (“Verifiable Opt-Out Request”). “Covered Information” may include your first name and last name; a home or other physical address; and email address; a social security number; an identifier that allows for a person to be contacted either physically or online; or any other information concerning a person collected from the person through the Site and maintained in combination with an identifier that makes the information personally identifiable. We may not be required to follow a consumer's Nevada Opt-Out Request under specific circumstances.

If you are a Nevada consumer and would like to make a Verifiable Opt-Out Request, please fill out the form found here: Contact us. We intend to respond to Verifiable Opt-Out Requests within 60 days. If we need more time to respond to a Verifiable Opt-Out Request, we will notify you of such an extension.

13. Notice to Colorado, Connecticut, Delaware, Iowa, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah and Virginia Residents

This Privacy Statement for Residents of Colorado, Connecticut, Delaware, Iowa, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah and Virginia and supplements the information contained in the Fingerhut Online Privacy Policy and applies solely to residents of Colorado, Connecticut, Delaware, Iowa, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah and Virginia. This section of the Privacy Policy is intended solely for, and is applicable only as to the residents Colorado, Connecticut, Delaware, Iowa, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah and Virginia.

We adopt this notice to comply with the Colorado Privacy Act (“CPA”), the Connecticut Data Privacy Act (“CTDPA”), the Delaware Personal Data Privacy Act ("DPDPA"), the Iowa Consumer Data Protection Act ("ICDPA"), the Minnesota Consumer Data Privacy Act effective July 31, 2025 ("MCDPA"), the Montana Consumer Data Privacy Act (“MTCDPA”), the Nebraska Data Privacy Act ("NDPA"), New Hampshire Act relative to the expectation of privacy ("NHCDPA"), the New Jersey Legislative Act ("NJDPA"), the Oregon Consumer Privacy Act (“OCPA”), the Tennessee Information Protection Act effective July 1, 2025 ("TIPA"), the Texas Data Privacy and Security Act (“TDPSA”), the Utah Consumer Privacy Act (“UCPA”) and the Virginia Consumer Data Protection Act (“VCDPA”), respectively. Any terms defined in the respective privacy laws have the same meaning when used in this section.

For a discussion of the categories of personal data we process, the purposes for our processing, the categories of personal data that we share with third parties, and the categories of third parties with whom we share personal data, please see Sections 2 through 4, above, and Section 14, below.

Categories of Personal Data We Collect, Categories of Personal Data that We Disclose with Third Parties, and Categories of Third Parties with whom We Disclose Personal Data. Please refer to Sections 2 through 4 and Section 14 as the descriptions similarly apply to you.

Purposes of Processing Personal Data. Please refer to Sections 2 through 4 and Section 14 as the descriptions similarly apply to you.

Sale of Personal Data & Targeted Advertising. We “sell” personal data to third parties and process personal data for “targeted advertising” as those terms are defined in the CPA, CTDPA, DPDPA, ICDPA, MCDPA, MTCDPA, NDPA, NHCDPA, NJDPA, OCPA, TIPA, TDPSA, UCPA and VCDPA. We sell the categories of personal information to the categories of the third parties as listed Sections 4 and 14. We engage in targeted advertising so that we can conduct more personalized and tailored marketing to our consumers. We do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects.

Consumer Rights under the CPA, CTDPA, DPDPA, ICDPA, MCDPA, MTCDPA, NDPA, NHCDPA, NJDPA, OCPA, TIPA, TDPSA, UCPA and VCDPA. If you are resident of Colorado, Connecticut, Delaware, Iowa, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah or Virginia, under the CPA, CTDPA, DPDPA, ICDPA, MCDPA, MTCDPA, NDPA, NHCDPA, NJDPA, OCPA, TIPA, TDPSA, UCPA and VCDPA respectively, starting from the effective date of the relevant laws, you have the right to (1) confirm whether or not we are processing your personal data and to access such personal data; (2) correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of your personal data; (3) delete personal data you have provided or we have obtained about you, though exceptions under the respective laws may allow us to retain and use certain personal data notwithstanding your deletion request; (4) obtain a copy of your personal data that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance, where the processing is carried out by automated means; and (5) opt out of the processing of your personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

To exercise your rights to request to know, delete, correct, and/or opt-out, please submit a request through our interactive webform. If you have an account with us, use this link, if you do not have an account, click here, or call us toll free at 1-888-912-0579. If we refuse to take action regarding your request, you may appeal our decision by emailing us at customerservice@fingerhut.com.

We process your consumer request substantially in accordance with the manners as described in “Your Rights” in Section 14 (Notice to California Residents). In case we cannot wholly or partially comply with your request, the response we provide will explain the basis for our decision as well as the descriptions of your right to appeal and the manner you can exercise your rights.

14. Notice to California Residents

The California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2020 (“CCPA”), requires that we provide California residents with a privacy policy that contains a comprehensive description of our online and offline practices regarding the collection, use, sale, sharing, and retention of personal information and of the rights of California residents regarding their personal information. This section of the Privacy Policy is intended solely for, and is applicable only as to, California residents. If you are not a California resident, this section does not apply to you and you should not rely on it.

The CCPA defines “personal information” to mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household. Personal information does not include publicly available, deidentified or aggregated information or lawfully obtained, truthful information that is a matter of public concern. For purposes of this “Notice to California Residents” section we will refer to this information as “Personal Information.”

The CCPA's privacy rights described below do not apply to Personal Information that we collect, process, sell, or disclose subject to the federal Gramm-Leach-Bliley Act and its implementing regulations or the California Financial Information Privacy Act. Because we are subject to those laws and regulations, much of the Personal Information that we collect is exempt from the CCPA. Your choices and rights with respect to our use and sharing of that information are subject to our U.S. Consumer Privacy Notice.

The CCPA's privacy rights also do not apply to certain types of Personal Information subject to the federal Fair Credit Reporting Act (“FCRA”). Some of our services are subject to the FCRA and, therefore, exempt from the CCPA on that basis.

If you are a California resident and a current or former employee, job applicant, or independent contractor of ours, please see our privacy notice available here for more information on our collection and use of your Personal Information in that capacity.

Notice at Collection of Personal Information

We currently collect and, in the 12 months prior to the Last Updated Date of this Privacy Policy, have collected the following categories of Personal Information:

• Identifiers (name, alias, postal address, online identifier, Internet Protocol address, email address, account name, Social Security number, driver's license number, passport number)
• Unique personal identifiers (device identifier; cookies, beacons, pixel tags, mobile ad identifiers, or other similar technology; customer number, unique pseudonym, or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device)
• Telephone number
• Signature
• Physical characteristics or description
• Bank account number
• Credit and debit card number
• Internet or other electronic network activity information (browsing history; search history; and information regarding consumer's interaction with website, application, or advertisement)
• Geolocation data
• Commercial information (records of personal property, products or services purchased, obtained, considered or returned); other purchasing or consuming histories or tendencies; or other commercial information
• Characteristics of protected classifications under California or federal law (sex/gender, age (40 and older), marital status, military or veteran status)
• Audio, electronic, or similar information
• Inferences drawn from above information to create a profile about a consumer reflecting the consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes

We collect Personal Information directly from California residents and from advertising networks, internet service providers, data analytics providers, credit bureaus, marketing providers, customer service providers, shipping providers, software providers, verification sources, social networks, data brokers, government entities, operating systems and platforms and our affiliates. We do not collect all categories of Personal Information from each source.

In addition to the purposes stated in the “How We Use Your Information” section above, we currently collect and have collected the above categories of Personal Information for the following business or commercial purposes:

• Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards
• Helping to ensure security and integrity to the extent the use of the consumer's Personal Information is reasonably necessary and proportionate for these purposes
• Debugging to identify and repair errors that impair existing intended functionality
• Short-term, transient use, including, but not limited to, nonpersonalized advertising shown as part of a consumer's current interaction with us, provided that the consumer's Personal Information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumer's experience outside the current interaction with us
• Performing services, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services or providing similar services
• Providing advertising and marketing services, except for cross-context behavioral advertising, to the consumer provided that, for the purpose of advertising and marketing, our service providers and/or contractors shall not combine the Personal Information of opted-out consumers that the service provider or contractor receives from us, or on our behalf with Personal Information that the service provider or contractor receives from, or on behalf of, another person or persons or collects from its own interaction with consumers
• Undertaking internal research for technological development and demonstration
• Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us
• Advancing our commercial or economic interests, such as by inducing another person to buy, join, subscribe to, provide, or exchange products, goods, property, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction

Sale, Sharing, and Disclosure of Personal Information

The following table identifies the categories of Personal Information that we sold or shared to third parties in the 12 months preceding the Last Updated Date of this Privacy Policy and, for each category, the category of third parties to whom we sold or shared Personal Information:

Category of Personal Information	Category of Third Parties
Name, postal address, email address, online identifier, Internet Protocol address Commercial information (records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies) Characteristics of protected classifications under California or federal law (sex/gender, age (40 and older)) Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumer's preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes	Data brokers; data analytics providers; social networks; advertising networks; affiliates
Unique personal identifiers (device identifier; cookies, beacons, pixel tags, mobile ad identifiers, or other similar technology; customer number, unique pseudonym, or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device) Internet or other electronic network activity information (browsing history, search history, and information regarding a consumer's interaction with an internet website, application, or advertisement)	Data analytics providers; social networks; advertising networks; affiliates
Geolocation data	Data analytics providers; social networks; advertising networks

We sold or shared Personal Information to third parties for the following business or commercial purposes:

• Auditing related to interactions with consumers
• Providing advertising and marketing services
• Advancing our commercial or economic interests

The following table identifies the categories of Personal Information that we disclosed for a business purpose in the 12 months preceding the Last Updated Date of this Privacy Policy and, for each category, the category of recipients to whom we disclosed Personal Information:

Category of Personal Information	Category of Recipients
Name, alias, postal address, online identifier, Internet Protocol address, email address, account name	Vendors (e.g., cloud data storage, software); support service providers (e.g., credit card processing, shipping, web hosting, marketing providers; data analytics providers; customer service; social networks; fraud prevention services; verification services); government entities; credit bureaus
Social Security number, driver's license number, passport number	Verification services; credit bureaus; government entities
Unique personal identifiers (customer number, unique pseudonym, or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device)	Vendors (e.g., cloud data storage) support service providers (e.g., credit card processing, web hosting, email marketing providers, customer service, social networks)
Bank account number and information	Support service providers (e.g., credit card processing, customer service)
Credit and debit card number	Support service providers (e.g., credit card processing, customer service)
Geolocation data	Support service providers (e.g., web hosting, social networks, email marketing)
Commercial information (records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies)	Vendors (e.g., cloud data storage); support service providers (e.g., credit card processing, shipping, web hosting, email marketing, customer service, social networks, fraud prevention services)
Characteristics of protected classifications under California or federal law (sex/gender, age (40 and older))	Vendors (e.g., cloud data storage); support service providers (e.g., customer service, marketing providers, data analytics providers, social networks)
Audio, electronic, or similar information	Vendors ( e.g., cloud data storage); Support service providers (e.g., customer service, web hosting, marketing providers, data analytics providers, social networks)

We disclosed Personal Information for the following business purposes:

• Auditing related to interactions with consumers
• Debugging to identify and repair errors
• Providing advertising and marketing services
• Performing services
• Helping to ensure security and integrity
• Advancing our commercial or economic interests

We do not knowingly collect, sell, or share the Personal Information of consumers under 16 years of age. We do not use Sensitive Personal Information for purposes other than those the CCPA and its regulations allow for.

Retention of Personal Information

In addition to the “Data Retention Policy” section above, we retain your Personal Information for as long as necessary to fulfill the purposes for which we collect it, such as to provide you with the service you have requested, and for the purpose of satisfying any legal, accounting, contractual, or reporting requirements that apply to us.

Your Rights

If you are a California resident, you have the following rights with respect to your Personal Information:

1. The right to know what Personal Information we have collected about you, including the categories of Personal Information, the categories of sources from which we collected Personal Information, the business or commercial purpose for collecting, selling, or sharing Personal Information (if applicable), the categories of third parties to whom we disclose Personal Information (if applicable), and the specific pieces of Personal Information we collected about you;

2. The right to delete Personal Information that we collected from you, subject to certain exceptions;

3. The right to correct inaccurate Personal Information that we maintain about you;

4. If we sell or share Personal Information, the right to opt out of the sale or sharing;

5. If we use or disclose sensitive Personal Information for purposes other than those allowed by the CCPA and its regulations, the right to limit our use or disclosure; and

6. The right not to receive discriminatory treatment by us for the exercise of privacy rights the CCPA confers.

• How to Submit a Request to Know, Delete, and/or Correct

If you have an account with us, please click on the following link to log into your account and submit your request to know, delete, and/or correct through your account, click here. If you do not have an account, you may submit a request to know, delete, and/or correct through our interactive webform available here, or by calling us toll free at 1-888-912-0579.

If you are a California resident who has a financial product or service with us, much of the Personal Information that we collect is exempt from the CCPA and, therefore, is not subject to the rights discussed in this “Notice to California Residents” section. Your choices and rights with respect to our use and sharing of that information are subject to our U.S. Consumer Privacy Notice.

If you are submitting a request on behalf of a California resident, please submit the request through one of the designated methods discussed above. After submitting the request, and if the request is not subject to an exemption or exception, we will require additional information to verify your authority to act on behalf of the California resident.

• Our Process for Verifying a Request to Know, Delete, and/or Correct

If we determine that your request is subject to an exemption or exception, we will notify you of our determination. If we determine that your request is not subject to an exemption or exception, we will comply with your request upon verification of your identity and, to the extent applicable, the identity of the California resident on whose behalf you are making such request. Our verification process may differ depending on whether you maintain a password-protected account with us.

If you maintain a password-protected account, we may verify your identity through existing authentication practices available through your account. Prior to disclosing or deleting the Personal Information, we will ask you to re-authenticate yourself with respect to that account.

If you do not maintain a password-protected account, or if you are an account-holder but we suspect fraudulent or malicious activity with your account, we will verify your identity either to a “reasonable degree of certainty” or a “reasonably high degree of certainty” depending on the sensitivity of the Personal Information and the risk of harm to you by unauthorized disclosure, deletion, or correction as applicable.

For requests to access categories of Personal Information and for requests to delete or correct Personal Information that is not sensitive and does not pose a risk of harm by unauthorized deletion or correction, we will verify your identity to a “reasonable degree of certainty” by verifying at least two data points that you previously provided to us and which we have determined to be reliable for the purpose of verifying identities.

For requests to access specific pieces of Personal Information or for requests to delete or correct Personal Information that is sensitive and poses a risk of harm by unauthorized deletion or correction, we will verify your identity to a “reasonably high degree of certainty” by verifying at least three pieces of Personal Information you previously provided to us and which we have determined to be reliable for the purpose of verifying identities. In addition, you must submit a signed declaration under penalty of perjury stating that you are the individual whose Personal Information is being requested.

• Requests Received During Prior Calendar Year

During the prior calendar year, January 1, 2023 through December 31, 2023, Fingerhut received the following number of requests from California residents exercising their right to access, correct, delete, or stop selling or sharing of their personal information. Unfulfilled requests were due to lack of identity verification, described in the section above labeled “Our Process for Verifying a Request to Know, Delete, and/or Correct.”

	Requests Received	Requests Honored	Requests Denied	Median Days to Fulfill
Requests to Access Personal Info	28	21	7	9.5
Requests to Correct Personal Info	22	11	11	43
Requests to Delete Personal Info	68	50	18	43
Requests to Stop Selling/Sharing Personal Info	149	123	26	Less than 1

Right to Opt Out of Sale or Sharing of Personal Information

If you are a California resident, you have the right to direct us to stop selling or sharing your Personal Information.

You may submit a request to opt out of sales or sharing through our interactive webform available by clicking on this link: “Do Not Sell or Share My Personal Information.” You also may submit a request by calling us toll free at 1-888-912-0579. If you have enabled privacy controls on your browser (such as a plugin), we will also treat that as a valid request to opt out. To opt out of our use of third-party advertising Cookies, please see the “How You Can Opt Out of Cookies” section above.

15. Notice of Financial Incentive

From time to time, you may have the opportunity to provide Personal Information in exchange for discounts, price differences and prizes. For example, we provide discounts and price differences in exchange for you subscribing to our mailing and/or email list and/or subscribing to our mobile application. Categories of Personal Information that we may collect when you subscribe to receive discounts and price differences include your email address. We also offer prizes and/or discounts in exchange for you entering our sweepstakes and contests. Categories of Personal Information that we may collect when you enter to receive prizes include your name, postal address, date of birth, phone number and email address. Please see the official rules applicable to each sweepstake or contest for additional terms and conditions.

• How to Opt-In and Right to Withdraw

Signing up for discounts and price differences is optional. By providing your email address during the discount sign-up process, you affirmatively opt in to receiving the financial incentive and to joining our mailing and/or email list. By placing a Fingerhut order, making on-time payments on your account, submitting a mail-in entry, or by any additional entry method listed in the official rules applicable to each sweepstake or contest, you affirmatively opt in to the possibility of receiving the financial incentive and to entering our sweepstake or contest. You have the right to withdraw from the financial incentive at any time. If you opt out of receiving a financial incentive, we will not reduce the value of any financial incentives you previously received from us. If you wish to withdraw from receiving the financial incentive, you may submit such a request at any time by emailing us at customerservice@fingerhut.com.

• How the Financial Incentive is Reasonably Related to the Value of Your Personal Information

The financial incentive or price difference is reasonably related to the value provided by your Personal Information. We take into consideration, without limitation, the anticipated revenue generated from such information, the anticipated expenses which we might incur in the collection, storage, and use of such information, and the anticipated expenses which we might incur related to the offer, provision, and imposition of any financial incentive or price difference. Based on this analysis, the value of your Personal Information that allows us to make these offers and financial incentives is the value of the offer itself.

16. Shine the Light Law

If you are a California resident, California Civil Code § 1798.83 permits you to request information regarding the disclosure of your personal information by us to third parties for the third parties' direct marketing purposes (as those terms are defined in that statute). To make such a request, please send an email to customerservice@fingerhut.com with the subject line “Shine the Light Request” or write us at:

Fingerhut
6250 Ridgewood Road
St. Cloud, MN 56303
Attention: Privacy and Security

17. Accessibility

We are committed to ensuring this Privacy Policy is accessible to individuals with disabilities. If you wish to access this Privacy Policy in an alternative format, please contact us as described below.

18. Contacting Us

If you have questions about this policy or our privacy practices, please email us at customerservice@fingerhut.com and write “Privacy” in the subject line or write us at:

Fingerhut
6250 Ridgewood Road
St. Cloud, MN 56303
Attention: Privacy and Security