JOB APPLICANT PRIVACY POLICY

Lulu’s Fashion Lounge, LLC and its parent, affiliates and/or subsidiaries (collectively, “Lulus,” the “Company”, “we” or “us”) provides this Privacy Policy (“Policy”) to inform you of our practices concerning the processing of United States (“U.S.”) residents’ personal information collected through online and offline interactions when you apply for a job with us. If you interact with our website, use our products or services, or otherwise engage with us outside of your employment relationship, Lulus’ Customer Privacy Policy (located at https://www.lulus.com/customerservice/privacypolicy) applies to any personal information we process through those interactions, not this Policy.

We are required by applicable U.S. privacy laws and regulations to give you the information in this Policy. It is important that you read this Policy carefully, together with any other information that we might give you from time to time about how we collect and use your personal information.

This Policy does not form part of any contract of employment or other contract to provide services and does not give you any contractual rights.

Changes: We may update this Policy from time to time. Any updated Policy will be effective when posted. Please check this Policy periodically for updates.

1. Information We Collect

We may collect the following categories of Personal Information from U.S. job applicants, depending on the particular Business Purpose (described in the “How We Use Personal Information” below) for which we collect it:

Personal information does not include deidentified or aggregated applicant information.

We obtain the categories of Personal Information listed above from the following categories of sources:

• Directly from you. For example, from forms you complete or services we provide you.

• Third parties, including recruiters, who submit your information to us for an employment position that may interest you and consumer reporting agencies for employment background checks.

2. How We Use Personal Information

We may use or disclose the Personal Information we collect from you or about you to do one or more of the following:

• To fulfill or meet the purpose for which you provided the information. For example, if you share your name and contact information to apply for a job or become an employee, we will use that personal information in connection with your employment or potential employment.

• To contact you and to inform you about benefits or information relating to your employment or potential employment.

• To provide, support, personalize, and/or develop our website and services relating to your employment or potential employment.

• To create, maintain, customize, and secure your information or account with us.

• To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses.

• To help maintain the safety, security, and integrity of our systems, website, services, databases and other technology assets, and business.

• For research, analysis, and business development, including to develop and improve our business processes, website and services.

• To comply with legal obligations and respond to law enforcement or other legal requests and as required by applicable law, court order, or governmental regulation.

• As described to you when collecting your personal information, as otherwise set forth in applicable law or as subsequently agreed to by you.

• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us about our job applicants is among the assets transferred.

We do not Sell or Share personal information as defined under California law. We do not process Sensitive Personal Information to make inferences about you.

3. How We Disclose Personal Information

We may also disclose your personal information to third parties for a business purpose, including to our service providers.

In the past 12 months, we may have disclosed each category of personal information described in Section 1 with the following categories of third parties:

• Our affiliates and subsidiaries, including parent entities, corporate affiliates, subsidiaries, business units, and other companies that share common ownership.

• Service providers that work on our behalf to provide products and services, such as providers of the following services: recruitment and job application.

• Third parties with whom you direct us to share your personal information.

• Third parties for legal, security, or safety purposes.

• Third parties in connection with a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us about our employees is among the assets transferred.

• Entities to which you have consented to the disclosure, such as consumer reporting agencies for employment background checks.

We do not disclose your Personal Information to third parties for their direct marketing purposes.

4. Data Retention

Your personal information will be retained as long as necessary to fulfill the purposes we have outlined above unless we are required to do otherwise by applicable law. This includes retaining your personal information to maintain our employment relationship with you (if applicable); to improve our business over time; to ensure the ongoing legality, safety and security of our services and relationships; and for other legitimate business purposes otherwise in accordance with our internal retention procedures.

5. Your Rights Concerning Personal Information

California residents may have certain rights concerning collection, use, and sharing of personal information.

• Right to Know. You may have the right to request information about the categories of personal information we have collected about you, the categories of sources from which we collected the personal information, the purposes for collecting the personal information, and the categories of third parties to whom we have disclosed your personal information. You may also have the right to request the specific pieces of personal information we have collected about you.

• Right to Delete. You may have the right to request that we delete personal information that we have collected from you.

• Right to Correct. You may have the right to request that we correct inaccurate personal information that we maintain about you.

U.S. residents may submit such requests via email to privacy@lulus.com or submit a request to delete through self-service options available in your applicant account. We will not discriminate against you in any manner prohibited by law for exercising your privacy rights.

Verification: In order to process requests, we will need to obtain information to locate you in our records or verify your identity depending on the nature of the request. In most cases we will collect some or all of the following data elements: first and last name, and email address. In some cases, we may request different or additional information, including a signed declaration that you are who you say you are, and will inform you if we need such information.

Authorized Agents: Authorized agents may exercise rights on behalf of U.S. residents by submitting a request via email to privacy@lulus.com and indicating that they are submitting the request as an agent. We may require the agent to demonstrate authority to act on behalf of the resident by providing signed permission from the resident. We may also require the resident to verify their own identity directly with us or to directly confirm with us that they provided the authorized agent permission to submit the request.

Timing: We will respond to Right to Delete, Right to Correct, and Right to Know requests within 45 days, unless we need more time in which case we will notify you and may take up to 90 days total to respond to your request.

6. Contact Information

Please direct any questions about this Policy to privacy@lulus.com.