Privacy & Security Policy 

Last Updated: August 26, 2026

Zumiez Inc. (“Zumiez” or “we” or “us”) is deeply committed to the relationship of trust we have with you, our customer. Accordingly, your privacy is important to us. This Privacy Policy describes our privacy practices in connection with the personal information we collect on our website (the “Site”), our mobile application, and at our brick-and-mortar stores (our “Services”).

We may update this Privacy Policy based upon evolving laws, regulations, and industry standards, or as we may make changes to our Services. We will post changes to our Privacy Policy on our Site or mobile application and encourage you to review our Privacy Policy when you use our Services to stay informed. We will take appropriate measures to inform you, consistent with the significance of the changes we make.  If you disagree with the changes to this Privacy Policy, you should discontinue your use of the Services.

We do not knowingly collect personal information from anyone under the age of 13 without parental consent. If a parent or guardian becomes aware that his or her child has provided us with information, they should contact us. We will delete such information from our files as soon as reasonably practicable.

If you are at least 13 years of age but less than 16 years of age you will need to specify your age before sharing your personal information with us and will be asked to affirmatively opt-in to the sale and sharing of personal information at the time you sign up for an account.

We may collect information that personally identifies you (“personal information”) when you use our Services. The categories of personal information that we may collect from you include your name, postal address, email address, phone number, and credit card information. You may also provide us with sensitive information such as racial or ethnic origin, precise geolocation data, religious or philosophical beliefs, and information concerning your sexual orientation. Sensitive information that you provide to us will be used to provide you with personalized options on our Site and mobile application, based on your preferences, and may be used by us to help us better understand our customers. We will never use sensitive personal information to draw inferences about you or sell it to partners or advertisers. 

When you visit the Site and use our mobile application we may automatically collect certain information about your device, including information about your web browser, IP address, time zone, and some of the cookies that are installed on your device using cookies and similar technologies. Additionally, as you browse the Site and use our mobile application, we may collect information about the individual web pages or services that you view, what websites or search terms referred you to the Site and Services, information about how you interact with our Services – including the products that you view, purchase, and put in your cart, and how you interact with our marketing materials.

We use cookies (small, often encrypted, text files that are stored on your computer or mobile device) and similar technologies (such as web beacons, pixels, and scripts) (collectively, “Cookies”) to provide you with certain functions on our Services and help collect data. This section explains how we use Cookies to collect information about the way you use our Services and how you can control them.

We use Cookies to track how you use our Services by providing usage statistics. Cookies are also used to deliver our information (including updates) and allow account authentication to you based upon your browsing history and previous visits to the Services. Information supplied to us using Cookies helps us to provide a better online experience to our visitors and users and send marketing communications to them, as the case may be. We may combine the information we collect from Cookies with personal information that we have collected from you to learn more about how you use our Services to improve it.

We use both session Cookies (which expire once you close your web browser) and persistent Cookies (which stay on your device until you delete them). To make it easier for you to understand why we need them, the Cookies we use on our Services can be grouped into the following categories:

Cookies can be controlled, blocked, or restricted through your web browser settings. Information on how to do this can be found within the Help section of your browser. All Cookies are browser specific. Therefore, if you use multiple browsers or devices to access the Services, you will need to manage your Cookie preferences across these environments.

Find out how to manage Cookies on popular browsers:

We use social networks websites, applications and services in various Channels such as “social plug-ins,” “widgets” or other technologies that do various things (e.g. allow you to log-in via social media credentials or to express your “likes/dislikes” or “pin” something). When we use or you interact with social network technologies, we will receive (and you will allow) disclosures contemplated by the social network's privacy policy or other rules, including the network's “developer rules” (which are rules allowing us to use the social technology).

Here are a few examples of social networks we use:

• Facebook

• X (formerly Twitter)

• YouTube

• Instagram

• Pinterest

• Snapchat

We use your personal information for the following purposes and as otherwise described in this Privacy Policy or at the time of collection:

• To fulfill your orders and returns;
• To create and manage your account on our Site or in our Zumiez Stash program;
• To contact you with alerts or marketing communications, if you have opted to receive them;
• To personalize your account;
• To provide you with access to the Site and mobile application and services such as The Zumiez Stash;
• To provide you with information about promotional events, coupons and loyalty reward redemptions;
• To provide, operate and improve the Services;
• To personalize your experience with the Services and communicate with you;
• To provide support and maintenance;
• To respond to your request and feedback; 
• To help us advertise the Services and display advertisements to you;
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations; 
• To comply with legal obligations; and
• With your consent.

We may share limited partners’ personal information with our affiliates and to service providers such as brokers, custodians, lawyers, and accountants. We may share your personal information with our wholly-owned Canadian affiliate, Zumiez Canada Holdings Inc. as necessary for the proper management of the Zumiez business in Canada. This may include sharing personal information that our Canadian customers have provided us for direct marketing, market research, and analysis to develop and advertise promotions. We may also share personal information for compliance purposes and as required by law.

We may sell, transfer, or otherwise share some or all of our business or assets, including your personal information, in connection with a business transaction (or potential business transaction) such as a corporate divestiture, merger, consolidation, acquisition, reorganization or sale of assets, or in the event of bankruptcy or dissolution.

We respond to opt-out preference signals such as Global Privacy Control as valid opt-out requests under the CCPA.

The Services may contain links to other websites, mobile applications, and other online services operated by third parties. These links are not an endorsement of, or representation that we are affiliated with, any third party. In addition, our content may be included on web pages or in mobile applications or online services that are not associated with us. We do not control third party websites, mobile applications, or online services, and we are not responsible for their actions. Other websites, mobile applications and services follow different rules regarding the collection, use and sharing of your personal information. We encourage you to read the privacy policies of the other websites, mobile applications, and online services you use.

We employ a number of administrative, technical, and physical safeguards designed to protect the personal information we collect. The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Services, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. We urge you to be careful about giving out information in public areas of the Services.

Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of your personal information transmitted to our Services. Any transmission of personal information is at your own risk.

Zumiez strives to retain Personal Information for no longer than it is reasonably necessary for its processing purpose. The applicable retention period depends on the purpose for which Personal Information was obtained and on specific data retention obligations arising from applicable laws that may require the data to be held for a certain period of time. We may retain Personal Information for a longer period than is necessary if it is required by law.

Certain state consumer privacy laws may provide their residents with additional rights regarding our use of their personal information. These additional rights include:

• Right to Know – The right to request what personal information we have collected, used, and the categories of third parties with whom we have shared your personal information during the past 12 months. We have made this information available within this privacy notice.

• Right To Access – The right to request a copy of the specific pieces of personal information we maintain about you.

• Right to Delete – The right to request that their personal information be deleted, subject to some exceptions. Once we receive your request and confirm your identity, we will review your request. We may deny your deletion request if retaining the information is proper and necessary or if an exception allowing us to retain the information applies.

• Right to Correct / Update – The right to correct personal information that has become outdated or is otherwise inaccurate.

• Right to Opt-Out – The right to opt-out of the sharing of personal information for targeted and cross-context behavioral advertising purposes. Some states may offer a specific right to limit the use of sensitive personal information as well. 

• Right to a copy of your data – The right to request that we provide you or  an authorized agent with your personal information in a readily usable format, as technically feasible. 

• Right to opt-out of automated decision making technologies – Please see below for more information on ADMTs.

To exercise any of the rights described above, submit a request through the Zumiez Privacy Request Form.

Only you, or someone legally authorized to act on your behalf (an “Authorized Agent”), may make a request to know or delete related to your personal data. We require Authorized Agents to provide written authorization confirming they may submit a request on your behalf. You may only submit a request to know twice within a 12-month period. We will substantively respond to a Verifiable Consumer Request as soon as practicable and within the timeframe required by applicable law. If we reasonably require an extension, we will inform you of the reason and extension period. Please note that we will not require you to verify your identity for purposes of processing a request to opt-out of the sale or sharing of your personal information or a request to limit the use of your sensitive personal information; the information you provide in connection with such requests will be used solely to fulfill your request.

In the event your request is denied, you may be able to appeal that denial, depending on your state of residency. To appeal a denied request, please submit a new request using the Zumiez Privacy Request Form and indicate in the applicable field that you are submitting a question about a previous request.

We will not discriminate against you for exercising any of your data subject rights (in some states this is considered another “privacy right”). We do not charge a fee to process or respond to your Verifiable Consumer Request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Automated decision-making technologies are technologies that process Personal Information and use computation to execute a decision and either replace or substantially replace human decision-making, resulting in decisions made without human involvement. Decisions are significant when they result in the provision or denial of employment or independent contracting opportunities or compensation, education enrollment or opportunities, housing, healthcare services, or financial or lending services. Advertising is not a significant decision.  We do not currently use ADMT to make significant decisions, such as decisions about job applicants or our consumers, so we do not provide ADMT access, opt-out, or appeal rights.

Some browsers and browser extensions support the Global Privacy Control ("GPC") that can send a signal to the websites you visit to opt out from certain types of data processing, including data "sales" and "sharing" as defined under applicable privacy laws. When we detect such a signal, we will make reasonable efforts to respect your choices indicated by a GPC setting as required by applicable law.

In the preceding twelve (12) months, we may have collected and disclosed the following categories of personal information for the specific purposes disclosed below and to the categories of third parties indicated in the chart below. We do not “sell” your personal information as that term is defined in the CCPA, though we do share your personal information for purposes of cross-context behavioral advertising.

Collection Status: Yes

Examples of Information Category: A real name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, or other similar identifiers

Business Purpose Disclosures: Account processing; invoice and payment processing; product and services recommendations

Category of Third-Party Recipients: Data Analytics Providers; advertising networks; Operating Systems & Platforms; Social Networks; Billing and Payment Processors

Collection Status: Yes

Examples of Information Category: Name, postal address, telephone number, payment-card information, and other customer-record information. Zumiez may not collect every example included in the statutory category.

Business Purpose Disclosures: Account processing; invoice and payment processing; product and services recommendations

Category of Third-Party Recipients: Data Analytics Providers; advertising networks; Operating Systems & Platforms; Social Networks; Billing and Payment Processors

Collection Status: Yes

Examples of Information Category: Information such as age (for those 40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, and sex

Business Purpose Disclosures: Personalization and customer insights, with consent

Category of Third-Party Recipients: Service providers that process information on our behalf

Collection Status: Yes

Examples of Information Category: Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies

Business Purpose Disclosures: Product and services recommendations

Category of Third-Party Recipients: Data Analytics Providers; advertising networks

Collection Status: No

Examples of Information Category: Behavioral characteristics, including imagery of the face and voice recordings.

Business Purpose Disclosures: N/A

Category of Third-Party Recipients: N/A

Collection Status: Yes

Examples of Information Category: Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement

Business Purpose Disclosures: Product and services recommendations

Category of Third-Party Recipients: Advertising Networks; Data Analytics Providers; Operating Systems & Platforms

Collection Status: Yes

Examples of Information Category: IP address-based location information and GPS data

Business Purpose Disclosures: Product and services recommendations

Category of Third-Party Recipients: Service providers; advertising partners; analytics partners and other parties you may authorize

Collection Status: Yes

Examples of Information Category: Recorded Customer service calls.

Business Purpose Disclosures: To operate and improve the business

Category of Third-Party Recipients: Service providers; customer service provider

Collection Status: In recruiting contexts

Examples of Information Category: Current or past job history or performance evaluations.

Business Purpose Disclosures: Job application processing and background checks

Category of Third-Party Recipients: Service providers and job application processors

Collection Status: In recruiting contexts

Examples of Information Category: Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial Information, or student disciplinary records

Business Purpose Disclosures: Job application processing and background checks

Category of Third-Party Recipients: Service providers and job application processors

Collection Status: Yes

Examples of Information Category: Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

Business Purpose Disclosures: Product and services recommendations

Category of Third-Party Recipients: Advertising Networks, Data Analytics Providers; Operating Systems & Platforms

Collection Status: Yes

Examples of Information Category: Sensitive personal information includes data such as racial or ethnic information.* We only collect sensitive personal information with your consent and for purposes that will be disclosed to you at the time of collection.

Business Purpose Disclosures: Personalized options and customer insights, with consent

Category of Third-Party Recipients: Service providers processing information on our behalf; not sold to partners or advertisers