Privacy Policy

Effective Date: November 6th, 2025

Last Updated: November 6th, 2025

Introduction

Olukai, LLC, and our affiliates (collectively “Olukai”, “we”, “us”) care deeply about privacy, security, and online safety. This Privacy Policy (“Privacy Policy”) is designed to inform you about how we collect, use, and disclose your Personal Information (as defined below), and our commitment to using the Personal Information we collect in a transparent and respectful manner.

Please read this Privacy Policy carefully before you start to use our Services (defined below), or purchase our products, whether online or offline. If you are not comfortable with any part of this Privacy Policy or do not agree with the applicable Terms and this Privacy Policy, please immediately discontinue access or use of our Services. We may make changes to this Privacy Policy from time to time and will post the date it was last updated on this page. Unless otherwise noted, any changes to this Privacy Policy will become effective on the “Last Updated” date indicated above. We will provide additional notice to you if we make changes to this Privacy Policy that materially affects your privacy rights in accordance with applicable laws.

We may also provide “just-in-time” disclosure or additional information about our information collection, use, and sharing practices for specific products or service offerings. These notices may supplement or clarify our privacy practices or provide you with additional choices about how we process your personal information.

Scope and Applicability

This Privacy Policy applies to “Personal Information” we obtain from individuals (“you”) through our websites (collectively, our “Site(s)”), social media pages that we control, when you visit one of our retail stores, or engage with our products, and services (collectively, the “Services”). This Policy also applies to Personal Information we collect from third parties, and from publicly available sources. The definition of Personal Information (used interchangeably with “personal data”) depends on the applicable law based on your physical location or state residency. Only the definition that applies to your physical location or state residency will apply to you under this Privacy Policy. The Personal Information that we collect generally falls into three primary categories: (1) information you voluntarily provide to us; (2) information we collect from you automatically; and (3) information we collect from third parties.

Employees and Job Applicants. This Privacy Policy does not apply to the personal information we collect from employees, contractors, job applicants, owners, directors or officers of Olukai. If you are applying for a job with us, please see our Applicant Privacy Policy.

Vendors, Suppliers and Business Customers. This Privacy Policy does not apply to the personal information we collect from employees or representatives of our existing and prospective business clients, suppliers, service providers, agents, consultants, advisors, business partners, investors, or other individuals acting in a commercial context.

Notice of Collection

You can access specific topics within this Privacy Policy by clicking on the relevant links below. To the extent applicable, these links may serve as a “Notice of Collection” or similar notice as required under applicable state law.

Categories of Personal Information We May Collect

Sources of Personal Information

Use and Processing of Your Personal Information

Use of Your Sensitive Personal Information

Disclosures of Your Personal Information

Legal Basis for Collecting and Using Your Personal Information

Financial Incentive Program

Security and Retention

Children’s Privacy

Data Transfers

Cookies and Other Tracking Technologies

Links to Other Websites

Your Rights (including “share” opt-out right)

Opt-out Preference Signal (Do Not Track)

Changes to This Privacy Policy

Contact Us

Categories of Personal Information We May Collect

The types of Personal Information we collect about you depends on how you interact with us. Depending on the Services you use, the following are the categories and specific types of Personal Information that we may collect, or have collected in the preceding twelve months:

  • Contact Information/Identifiers, including name, email address, postal address, phone number, username, business contact information, or other similar identifiers and account information.
  • Government Identifiers, includingdriver’s license number (which in certain instances may be considered sensitive personal information).
  • Information Specific to the Services, in certain instances, such as invoices, business and commercial communications, order status and history.
  • Demographic Information,including age and gender, some of which may include characteristics or protected classifications under state or federal law.
  • Device Information and Other Unique Identifiers,device identifiers, internet protocol (IP) address, or similar unique identifiers.
  • Internet or Other Network Activity, including browsing or search history, and information regarding your interactions with our websites, mobile applications, emails, or advertisements.
  • Geolocation Data,including information that permits us to determine your location, such as if you manually provide location information or enable your mobile device to send us precise location information.
  • Payment Information,including credit or debit card number, or other financial information.
  • Video Recordings/CCTV. We may use closed-circuit television, video recordings, photography, or similar technologies (collectively “CCTV”) to monitor our stores for security, fraud, loss prevention, incident reporting, and operational purposes. No CCTV is deployed in an area where it would not otherwise be permissible under the relevant law. We have a legitimate interest in using CCTV to protect our visitors and have limited such use to public locations where visitors do not have an expectation of privacy.
  • Inferences,inferences drawn from or created based on any of the information identified in this section.
  • Sensitive Personal Information (where permitted and in accordance with applicable law), of the information listed above, racial or ethnic origin, username and password and/or health information are also sensitive Personal Information.

Except as set forth below in relation to Cookies and Other Tracking Technologies, no category above is “sold” or “shared” as that term is defined by applicable law. In certain instances, we will not be able to process your request for our Services without the requested Personal Information.

If you do not provide us with certain Personal Information, we may not be able to fulfill the requested purpose of collection, such as to respond to your queries or request for customer service, or to provide the full functionality of our Site or Services to you. However, unless otherwise specified, not providing your Personal Information will not result in legal or other consequences to you.

Sources of Personal Information

We collect your Personal Information in the following ways, if consistent with applicable law:

  • Directly From You, such as when you use our Services, create an account and profile with us; sign up with us to receive marketing communications; or otherwise reach out to us.
  • Other Sources, including vendors, affiliates, data brokers, and through tracking technologies. To learn more about our use of cookies and similar tracking technologies, please review the “Cookies and Other Tracking Technologies” section below.
  • Single Sign-on (“SSO”). SSO is an authentication method that enables you to securely authenticate your login within multiple applications and websites by using one set of credentials. If you choose to login to our Services through a third-party platform (such as Facebook or Google), we may have access to certain information from that platform, such as your username or email address. The information we receive may vary based on your privacy settings on such platform or as otherwise controlled by the provider of such platform.

Use and Processing of Your Personal Information

We use your Personal Information and Sensitive Personal Information for the following business purposes (“Processing Purposes”) associated with our general business operations. We may collect your Personal Information for the following Processing Purposes as applicable to each of the categories and sources above:

  • To provide you the Services.
  • To enable you to access and use our websites.
  • To communicate with you and to respond to your requests, questions, comments, and other inquiries.
  • To understand what partner resources you use, if any, and to connect you to additional resources at your request.
  • To offer you personalized advertisements, which you may be able to opt out of as explained in the “Your Rights” section.
  • To send marketing and promotional materials, including information relating to our products, Services, sales, sweepstakes and other contests, or promotions or those of a third party.
  • To administer, maintain, evaluate, and improve our websites and Services, and to develop new products and services.
  • To conduct research and analytics related to our websites and Services.
  • We may use Personal Information for marketing and promotional purposes to show you advertisements for products and/or services tailored to your interests on social media and other websites.
  • To manage our business operations, perform our obligations and exercise our rights under any agreement that you or your organization has with us.
  • For other purposes with your consent, or as otherwise permitted or required by applicable law.
  • We use Personal Information to comply with our legal or regulatory obligations, to establish or exercise our rights, and to defend against a legal claim.
  • We use Personal Information to detect, investigate, prevent, or take action regarding possible malicious, deceptive, fraudulent, or illegal activity, including fraudulent transactions, attempts to manipulate or violate our policies, procedures, terms and conditions, security incidents, and harm to the rights, property, or safety of Olukai and our users, customers, employees, or others.
  • We may also aggregate or deidentify Personal Data for internal business purposes.Deidentified information is generally not considered to be Personal Information under applicable laws.To the extent that we use deidentified information, we commit to maintaining and using the information in deidentified form and we will not attempt to reidentify the information, except as permitted under the applicable law.

Use of Your Sensitive Personal Information

With regard to sensitive Personal Information you provide, if any, we only use your Sensitive Personal Information to provide you with the requested products or services, to administer your account or application, or with your consent.

Disclosure of Your Personal Information

We respect the importance of privacy. Other than as provided in this Privacy Policy, we do not sell your Personal Information, nor do we share it with unaffiliated third parties for their own marketing use, unless we have your consent, or we are required by law to do so. Generally, we may disclose the Personal Information we collect to facilitate our communications with customers, to operate our business, to advertise or promote our Services, or with your consent. To the extent that we have collected or processed your Personal Information in the prior twelve (12) months, we may have disclosed the above-listed Personal Information as described below.

We may disclose each category of Personal Information listed above to third parties in the following ways:

  • Service Providers. We may disclose Personal Information to authorized third parties who perform services for us (including cloud services, data storage, sales, human resources, and marketing). Our contracts with our service providers include commitments that they agree to limit their use of Personal Information and to comply with privacy and security standards at least as stringent as the terms of this Privacy Policy. Remember that if you provide Personal Information directly to a third party, such as through a link on the Site, that processing is typically based on their standards.
  • Affiliated Companies. We may disclose such Personal Information with subsidiaries, affiliates or strategic partners as needed to provide our products and services and generally as necessary in the administration of a global organization.
  • Corporate Transaction. We may disclose your Personal Information in connection with a proposed or actual corporate merger, acquisition, consolidation, sale of assets, bankruptcy, insolvency or other corporate change. Such recipients will be bound by terms and conditions reasonably similar to those set out in this Privacy Policy.
  • Analytics and Interest-based Advertising Partners. We use third-party analytics, advertising, and marketing providers to collect information about your use of the Sites, see the overall patterns of usage on the Sites, deliver advertisements to your social media account based on email addresses, optimize ad performance, and determine whether our advertising is effective. Where permitted by applicable law, we may share your personal information with marketing and advertising partners for targeted advertising purposes, such as matching custom audience or creating lookalike audience on social media or other marketing platforms, so that we can better understand which of our Services may be of interest to you, market our Services to you, and to provide us information necessary to improve our Services.
  • Other Parties. We may disclose your Personal Information to legal, governmental, or judicial authorities, as instructed or required by those authorities or applicable laws, or in relation to a legal activity, such as in response to a subpoena or an investigation of suspected illicit activity. We may also disclose such Personal Information if we believe disclosure is necessary to prevent physical, financial, or other harm, injury, or loss.
  • Business Partners, Sponsors, and Other Third Parties. We may disclose your personal information to business partners, co-sponsors of promotions, and other third parties in order to provide you with Services that may interest you. For example, we may co-sponsor promotions, sweepstakes, or other events with a third party and may share your personal information in connection with these events. If you provide additional information to any of these third parties, such information provided to these third parties will be subject to each third party's privacy practices and policies.
  • Deidentified Personal Information.We may disclose or use aggregated or deidentified data for any lawful purpose.
  • Additional Disclosures.From time to time, we disclose your information to our attorneys, banks, auditors, securities brokers and other professional service providers and advisors in connection with the purposes described above.
  • Other Disclosures with Your Consent. We may disclose your Personal Information with your consent to other unaffiliated third parties who are not described elsewhere in this Privacy Policy.

We rely on the following legal grounds, to the extent such reliance is required, for the collection, processing, and use of your Personal Information:

  • As necessary to provide a service or perform a transaction (such as when we respond to your requests);
  • Consent (where you have provided consent as appropriate under applicable law, such as for direct marketing or certain cookies);
  • As necessary for legitimate interests (such as when we act to maintain our global business generally, including maintaining the safety and security of the Site); and
  • Compliance with legal obligations, particularly in the area of labor and employment law, social security and protection law, data protection law, tax law, and corporate compliance laws.

The provision of your Personal Information is partly a statutory requirement and partly a contractual obligation.

Financial Incentive Program

Olukai offers [Program Name], to customers, which provides certain perks, such as rewards, discounts, and exclusive offers (the “Program”). When you sign up for the Program, we will ask you to provide your name, email address, and in some cases your telephone number (if you opt-in to receive text messages). To provide the Program, we may disclose this and other Personal Information as described in the section entitled “Disclosures of Your Personal Information.” Because our Program involves the collection of Personal Information, it might be interpreted as a “financial incentive” program or a “bona fide loyalty program” under applicable law.

We generally do not assign monetary value to Personal Information or promotional activities in which we engage. To the extent we create overall value from the Program to our business that could be directly or reasonably related to the value of Personal Information, the method for calculating the value would include: (1) costs related to maintaining the Program, including but not limited to IT infrastructure, delivery of offers, and skilled marketing teams with the appropriate knowledge to enhance Personal Information; (2) whether the sales generated by the Program exceed the cost to us of offering the Program, including the value of discounts to customer; (3) the value of the insights we are able to create based upon aggregate data; and (4) such other data and/or metrics we may consider relevant to any such calculation. These factors may change over time.

Finally, to the extent that you request the deletion of your Personal Information, you may not be able to continue to participate in the Program because we require your Personal Information to manage your Program account. You may opt-out of the Program by contacting us at the address described at the end of this Policy [or the Program Terms]. [You may learn more about the Program by reviewing our Program Terms (link).]

Security and Retention

We have implemented generally accepted standards of technical and organizational security to protect Personal Information from loss, misuse, alteration or destruction. All employees are required to keep Personal Information confidential and only authorized personnel have access to this information. Despite these protections, however, we cannot guarantee the safety of your Personal Information. In case there is unauthorized access to or use of your Personal Information, we may notify you of such access or use, including by electronic means if permitted by law.

We will keep your Personal Information for as long as we have a relationship with you. Once our relationship with you has come to an end, we will retain your Personal Information for a period of time that enables us to:

  • Maintain business records for analysis and/or audit purposes;
  • Comply with record retention requirements;
  • Defend or bring any existing or potential legal claims;
  • Deal with any queries or complaints you may have; and
  • Comply with any other relevant laws and regulations.

We will delete or deidentify your Personal Information when it is no longer required for these purposes. If there is any information that we are unable, for technical reasons, to delete entirely from our systems, we will put in place appropriate measures to prevent any further processing or use of the information.

Children’s Privacy

Olukai does not knowingly collect Personal Information from children under the age of 18 (or other relevant age of majority) without first obtaining parental consent in accordance with applicable laws. Users under the age of 18 should not submit any Personal Information to us. If you believe we have collected Personal Information from your child in error or have questions or concerns about our practices relating to children, please notify us using the details in the “Contact Us” section below. We will take prompt steps to remove the Personal Information from our systems.

Data Transfers

Olukai is headquartered in the United States, and we have operations, entities, and service providers both in the United States and throughout the world. As such, we and our service providers may transfer your Personal Information to, or access it in, jurisdictions that may not provide equivalent levels of data protection as your home jurisdiction. We will take steps to ensure that your Personal Information receives an adequate level of protection in the jurisdictions in which we process it. If you are located in the European Economic Area, Switzerland or the UK, we provide adequate protection for the transfer of Personal Information to countries outside of these areas, such as through the use of authorized EU Standard Contractual Clauses, the UK Standard Contractual Clauses, or the UK Addendum to the EU Standard Contractual Clauses. Depending on your location, you may have the right to request a copy of such appropriate safeguards by contacting us as set out at the end of this Privacy Policy.

Cookies and Other Tracking Technologies

Every time you come to the website, our website’s web server automatically collects information, including, in some instances, Personal Information, through cookies, web beacons, and other similar tracking technologies (collectively “cookies”). Cookies are small text files that are placed on your computer or mobile device when you visit a website. Cookies help the website remember information about your visit, which can make it easier to visit the website again and make the website more useful to you. Some cookies are deleted once you close your browser (session cookies), while other cookies are retained even after you close your browser so that you can be recognized when you return to a website (persistent cookies). More information about cookies and how they work is available atwww.allaboutcookies.org. Generally, your email address and all other Personal Information is collected only when you voluntarily provide that data.

Cookies on our website are generally divided into the following categories:

Cookie Type

Description

Essential Cookies

These are cookies that our website needs in order to function and that enable you to move around and use the website and features. Without these essential cookies, the website will not perform as smoothly for you as we would like it to, and we may not be able to provide the website or certain services or features you request. Examples of where these cookies are used include: to determine when you are signed in, to determine when your account has been inactive, and for other troubleshooting and security purposes.

Analytics Cookies

Analytics cookies provide us with information regarding how visitors navigate and interact with our website. Such cookies allow us to understand, for example, more about how many visitors we have to our website, how many times they visit us and how many times a user viewed specific pages within our Site. Among other Analytics cookies, we use Google Analytics cookies for these purposes. For more information about Google Analytics, please refer to “How Google Uses Information From Sites or Apps that Use Our Services,” which can be found at www.google.com/policies/privacy/partners/, or any other URL Google may provide from time to time.

Advertising Cookies

Advertising cookies may be placed by us or third parties to enable third party ad networks to recognize a unique cookie on your computer or mobile device. The information that is collected and shared by these types of cookies may also be linked to the device identifier of the device you are using to allow us to keep track of all the websites you have visited that are associated with the ad network. This information may be used for the purpose of targeting advertisements on our website and third-party sites based on those interests.

 

We may use the information collected through cookies and related tracking technologies for the following purposes:

  • To make our website easier to use and generally improve its performance.
  • To gather metrics about how you interact with our website.
  • For security reasons.
  • To provide personalized content. For example, we may store user preferences, your default language, device and browser information, and your profile information, which includes the level of your usage of the website so we can identify you across devices and personalize the content you see.
  • To advertise to you via behavioral-based/targeted advertising and allow others to do the same.

Most web browsers automatically accept cookies, but you can usually change your browser settings to prevent this. If you disable cookies, your ability to use some features of the website may be limited. For mobile devices, you may be able to manage certain cookies using your built-in mobile device settings and controls. Any choices concerning cookies are browser and/or device specific. If you clear your cookies from your browser on any of your devices, your choices will need to be reset. You should check how to do this on your device(s) and operating systems.

Some cookie providers may also offer opportunities to control your preferences. To learn how to opt-out of Google Analytics, an Analytics cookie, please visit https://tools.google.com/dlpage/gaoptout.

Some of these cookies may be placed by third parties to help determine the effectiveness of our advertising campaigns or email communications. The use of cookies by third parties is within their control and not ours. We do not control their websites or their policies and practices regarding your Personal Information, and you should be aware that different rules might apply to the collection, use or disclosure of your Personal Information by third parties in connection with their advertisements or promotions and other sites you encounter on the Internet. This Privacy Policy does not cover any use of Personal Information that a third party may directly collect from you, and we do not undertake to confirm, investigate, or police their practices.

Links to Other Websites

Our Site may contain links to other websites for your convenience and information. These websites may be operated by companies not affiliated with Olukai. Linked websites may have their own privacy policies or notices, which we recommend you review if you visit those websites. We have no control over third-party websites and are not responsible or liable for the content, privacy practices, or use of any websites that are not affiliated with Olukai.

Your Rights

You may have certain rights regarding your Personal Information. The rights available to you depend on our reason for processing your Personal Information and the requirements of applicable law (i.e., your rights will vary depending on whether you are located in, for example, California, Delaware, the European Union, or United Kingdom). Specifically, you may have the following rights:

  • Right to access: You may have the right to obtain from us confirmation as to whether Personal Information concerning you is being processed, and, where that is the case, to request access to the Personal Information. You may also have the right to request a list of third parties that have received Personal Data from us, depending on where you are located.
  • Right to rectification (right to correct inaccurate information): You may have the right to request that we correct any Personal Information about you that is inaccurate. Depending on the purpose of the processing, you also have the right to request that we complete the Personal Information we hold about you where you believe it is incomplete, including by means of providing a supplementary statement.
  • Right to erasure (right to be forgotten): You may have the right to request that we erase your Personal Information, under certain conditions.
  • Right to restrict processing: You may have the right to request that we restrict the processing of your Personal Information, under certain conditions. In such case, the respective data will be marked and may only be processed by us for certain purposes.
  • Right to object to processing:You may have the right to object to our processing of your Personal Information, under certain conditions, and we can be required to no longer process your Personal Information. Such right to object may especially apply if we collect and process your Personal Information through automated decision making, such as profiling, to better understand your interests in our products and services or for direct marketing. If you have a right to object and you exercise this right, your Personal Information will no longer be processed by us for such purposes. Such a right to object may, in particular, not exist if the processing of your Personal Information is necessary to take steps prior to entering into a contract or to perform a contract already concluded.
  • Right to data portability: You may have the right to request that we transfer the Personal Information we have collected about you to another organization, or directly to you, in a structured, commonly used, and machine-readable format, under certain conditions.
  • Right to withdraw consent:Where we rely on your consent to process your Personal Information, you have the right to withdraw that consent at any time with future effect. Such a withdrawal will not affect the lawfulness of the processing prior to the consent withdrawal.
  • Right to know what Personal Information is sold or shared and to whom, and right to prohibit the sale or sharing of Personal InformationWe do not and have not in the preceding 12 months, sold your Personal Information. However, we have shared (in this context, share means use of your Personal Information for cross-contextual behavioral advertising) your Personal Information. You may opt-out of the sharing of your Personal Information by updating your cookie preferences, as described above, or by using this link.
  • Right to limit the use and disclosure of sensitive Personal Information: We will only use sensitive or special Personal Information as needed for the purposes for which it was collected. If this changes, we will notify you, and you may have the right to restrict such additional uses.
  • Right of non-discrimination/retaliation:We do not discriminate against individuals who exercise any of their rights described in this Privacy Policy, nor do we retaliate against individuals who exercise these rights.

Please note that many of the above rights are subject to exceptions and limitations. Your rights and our responses will vary based on the circumstances of the request. If you choose to assert any of these rights under applicable law, we will respond within the time period prescribed by such law.

If you are located in certain states in the United States, a person authorized to act on your behalf may make a verifiable request related to your personal information. If you designate an authorized person to submit requests to exercise certain privacy rights on your behalf, we will require verification that you provided the authorized agent permission to make a request on your behalf.

In any circumstances, your request must: (i) provide sufficient information that allows us to reasonably verify that you are the person about whom we collected personal information or an authorized representative of that person; and (ii) describe the request with sufficient detail that allows us to properly understand, evaluate, and respond to it. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

To exercise your rights, please contact us as stated in the Contact Us section of this Privacy Policy.

Opt-out Preference Signal (Do Not Track)

Your browser may allow you to adjust your browser settings so that “do not track” requests are sent to the websites that you visit. However, since uniform standards for “DNT” signals have not been adopted, we do not disable tracking technology that may be active on the Websites in response to any “do not track” requests that we receive from your browser. If you are a resident of Colorado, Connecticut, Delaware (as of 1.1.26), Maryland, Minnesota, Montana, New Hampshire, Oregon (as of 1.1.26) or Texas, you may also opt-out of targeted advertising via cookies by using an opt-out preference signal.

The Global Privacy Control signal is currently the only opt-out preference signal we can recognize. You can visit the Global Privacy Control official site at https://globalprivacycontrol.org/#about to learn how to configure your device to send such signals. We will honor and process the opt-out preference signal accordingly.

Please note that your opt-out choice will only apply to your use of our Sites through the current browser or device you are using and only so long as that browser’s cookies are not erased. You will need to submit a separate opt-out of targeted advertising request on each device and browser you use to visit our Sites to completely opt-out using this method. Please note that you may still receive generalized ads after opting out.

Changes to This Privacy Policy

As Olukai grows and our business changes, we may modify, expand, or update this Privacy Policy at any time as we deem appropriate to reflect those changes. When we make changes to this Privacy Policy, we will post the updated Privacy Policy on the Site and update the Privacy Policy’s “last updated” date above. It is important that you check back from time to time and make sure that you have reviewed the most current version of this Privacy Policy. If you do not agree with the changes, then you should stop using our Site and Services and notify us that you do not want your Personal Information used in accordance with the changes.

Shine the Light

The California Shine the Light law permits California residents that have an established business relationship with us to request certain information regarding our disclosure, if any, of certain types of personal information to third parties for their direct marketing purposes during the immediately preceding calendar year. To make such as request, please contact us using the information below, and indicate in your message that you are a California resident making a “Shine the Light” inquiry. This request may be made no more than once per calendar year.

Contact Us

If you have questions or comments regarding this Privacy Policy or our privacy practices, please contact us via email at info@olukai.eu. You may also have the right to lodge a complaint with a data protection supervisory authority. You may also exercise your rights as noted above by following this link and completing the web form.

This Privacy Policy includes an “effective” and “last updated” date. The effective date refers to the date that the current version took effect. The last updated date refers to the date that the current version was last substantively modified.