California Consumer Privacy Notice

Effective Date: January 1, 2020

This notice reflects our good faith understanding of the California Consumer Privacy Act (the “CCPA“) and our data practices as of January 1, 2020, but the CCPA’s implementing regulations are not yet final, and there remain differing interpretations of the law. Accordingly, we may update information regarding our data practices and your rights, modify our methods for responding to your requests, and/or supplement our response to your requests, as we continue to develop our compliance program to reflect the evolution of the law and our understanding of how it relates to our data practices.

This California Privacy Notice (“Notice“) applies to “Consumers“ as defined by the CCPA and supplements other Five Below privacy policies and notices. In the event of a conflict between any other Five Below policy, statement, or notice and this Notice, this Notice will prevail as to California Consumers and their rights under the CCPA.

In accordance with the CCPA’s requirements, this Notice covers the calendar year 2019 and describes our collection, use, disclosure, and sale of California Consumers’ “Personal Information“ (“PI“), as well as rights California Consumers have under the CCPA. Terms defined in the CCPA that are used in this Notice have the same meanings as in the CCPA.

COLLECTION AND USE OF PERSONAL INFORMATION

We collect PI about California Consumers as described in the table below.

Category Examples of PI Collected Sources of PI Purposes for PI Collection Categories of Recipients
Identifiers Name, postal address, Internet Protocol address, email address Consumer Directly (e.g. forms you complete or services you obtain from us)
Consumer Indirectly (e.g. from activity on our websites or applications)
Performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, or processing payments
Interest-based advertising
Ad networks, analytics providers, and social networks
Customer Records Name, address, telephone number, email address, payment card details Consumer Directly Performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, or processing payments
Interest-based advertising
Ad networks, analytics providers, and social networks
Protected Characteristics Marital/familial status, race, religion, disabilities Consumer Directly Interest-based advertising Internal
Commercial Information / Purchase Details Purchase history or tendencies Consumer Directly
Consumer Indirectly
Performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, or processing payments
Interest-based advertising
Internal
Internet Usage Information Browsing history, search history, information regarding interactions with our website or advertisements Consumer Directly Interest-based advertising Internal
Geolocation Data Precise physical location, movements, and travel patterns Consumer Directly Interest-based advertising Internal
Sensory Data Audio recordings of customer service calls, CCTV footage Consumer Directly
CCTV security cameras
Performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, or processing payments.
Loss Prevention
Internal
Inferences from PI Collected Customer profiles reflecting preferences and predispositions Consumer Directly
Consumer Indirectly
Performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, or processing payments
Interest-based advertising
Ad networks, analytics providers, and social networks

In addition, we may collect, use, and disclose your PI as required or permitted by applicable law. We do not treat deidentified data or aggregate consumer information as PI, and we reserve the right to convert, or permit others to convert, your PI into deidentified data or aggregate consumer information.

Subject to the CCPA’s restrictions and obligations, our affiliates, service providers, and vendors also may use your PI for some or all of the above-listed business purposes.

We may share your PI with our affiliates, service providers, vendors (including those that facilitate interest-based advertising and other advertising and marketing), and other parties as described in the table above.

Five Below does not “sell“ (as the term “sale“ is defined by the CCPA) Consumer PI.

CALIFORNIA PRIVACY RIGHTS

Under the CCPA, California Consumers have certain rights which they may exercise independently or through an authorized agent. CCPA rights requests are subject to an identification and verification process. We will not fulfill a CCPA request unless we have been provided sufficient information for us to reasonably verify that the requestor is the Consumer about whom we collected PI.

Some PI we maintain about Consumers (e.g., clickstream data) is not sufficiently associated with enough PI about the Consumer for us to be able to verify that it is a particular Consumer’s PI. Accordingly, we will not include such information in response to Consumer requests. If we cannot comply with a request, we will explain the reasons in our response. We will use PI provided in your request only to verify your identity or authority to make the request and to track and document request responses, unless you also provided the PI to us for another purpose.

We will make commercially reasonable efforts to identify Consumer PI that we collect, use, store, disclose, or otherwise process, and to respond to your California Consumer privacy rights requests. In some cases, particularly with voluminous and/or typically irrelevant data, we may provide you with a summary of your PI and give you the opportunity to elect whether you want us to provide the entire data set. Alternatively, we may direct you on how to access and copy responsive PI yourself. We may charge a reasonable fee or refuse to act upon a request if the request is excessive, repetitive, unfounded, or overly burdensome. If we determine that the request warrants a fee, or that we may decline to comply with the request, we will give you notice explaining why we made that decision. In the case of a fee, we will provide a cost estimate and the opportunity to accept such fees before charging you for responding to your request.

Your California Consumer privacy rights are described below. To make a request, complete an online form on our website by clicking here (or call us at 1 (888) 914-9661 PIN: 103 569). An email address is required to verify your request. Once the request is made, a verification email will be sent to the email address provided. Please follow the instructions on our website and promptly respond to any follow-up inquires so that we may confirm your identity. If you request that we provide you with specific pieces of information about you, we may apply the heightened verification standards set forth in this Notice. An authorized agent may submit a request on behalf of a Consumer here if the Consumer has provided the authorized agent with power of attorney in accordance with California law; alternatively, the agent must (1) present verifiable written authorization from the Consumer that the agent has the Consumer’s permission to submit the request; and (2) independently verify the agent’s own identity with Five Below.

We may collect, use, and disclose your PI as required or permitted by applicable law. Please note we are not obligated to comply with consumer requests to the extent that doing so would infringe on our, or any other person’s or party’s, rights or conflict with applicable law.

Disclosure Rights

You have the right to request that we disclose your PI that we have collected and are maintaining for the 12-month period prior to the request date. Consumer requests of this nature may be made no more than 2 times in a 12-month period.

  1. The categories of PI we have collected about you, including the categories of sources from which we collected your PI and the purpose(s) for such collection.
  2. The specific pieces of PI we have collected about you.
  3. The categories of third parties to whom we have disclosed your PI, including a list of the categories of PI disclosed (or a statement that no such disclosure occurred).
  4. A list of the categories of PI sold about you, including the categories of third parties to whom we sold your PI and the purposes for the sale (or a statement that no such sale occurred).

With respect to (1) and (2) above, we will provide this information in a portable and, if technically feasible, readily usable format.

“Do Not Sell“ Rights

We do not sell California Consumer PI as defined under the CCPA and, until such time as we change our practices by updating this Privacy Notice, will treat PI collected under this Notice as subject to a “do not sell“ request.

Some browsers have signals that may be characterized as “do not track“ signals, but we do not understand them to operate in that manner or to signify a “do not sell“ request. We understand that various parties are developing “do not sell“ signals, and we may recognize certain such signals if we conclude such a program is appropriate.

Deletion Rights

You may request that we delete your PI that we have collected directly from you. Under the CCPA, we may decline to delete your PI under certain circumstances, for example, if we need the PI to complete transactions or provide services you have requested or that are reasonably anticipated, for security purposes, for internal business purposes (including maintaining business records), to comply with law, or to exercise or defend legal claims. Note also that we are not required to delete your PI that we did not collect directly from you.

Non-Discrimination Rights

We will not discriminate against you in a manner prohibited by the CCPA because you exercise your CCPA rights.

California’s “Shine the Light“ Law

California’s “Shine the Light“ law permits customers in California to request certain details about how certain types of their information are shared with third parties and, in some cases, affiliates, for those third parties’ and affiliates’ own direct marketing purposes.

Under this law, a business must either provide California customers certain information upon request or permit California customers to opt in or out of this type of sharing.

We may from time to time, with your consent, elect to share certain information we have collected about you with third parties and affiliates for those third parties’ and affiliates’ direct marketing purposes. If you are a California resident, you may prospectively opt out of such ongoing sharing by emailing privacy@fivebelow.com, or by sending a letter to Five Below, Inc., 701 Market Street, Suite 100, Philadelphia, PA 19106 (Attention: Compliance Department). Requests must include “California Privacy Rights Request“ in the first line of the description and include your name, street address, city, state, and zip code.

Please note that we are only required to respond to one request per customer each year, and we are not required to respond to requests made by means other than through this email address or mail address. Also note that your rights under the CCPA and California’s “Shine the Light“ law must be exercised separately.

CONTACT US

For more information regarding your California privacy rights, you may email us at privacy@fivebelow.com or call us at 1 (888) 914-9661 PIN: 103 569. You also may write to us at: Five Below, Inc., 701 Market Street, Suite 100, Philadelphia, PA 19106 (Attn: Compliance Department).