Dough LLC Privacy Policy This privacy policy of Dough LLC (“Dough”, “Firm”, “us”, “our”, “we”) (“Privacy Policy”) is intended to cover the information we collect about you when you use our products or services, or otherwise interact with us. Furthermore, Dough’s Privacy Policy is intended to inform you of our policies and practices regarding the use and disclosure of any information we collect from you through your use of the Dough website (www.dough.com) and/or trading platforms (both desktop and mobile applications). This Privacy Policy refers to all of Dough’s products, services, platforms, and events (collectively referred to as “Services”). By opening an account with us and utilizing our Services, you agree to be governed by this Privacy Policy in conjunction with other applicable customer agreements and account documents. If you do not agree with our Privacy Policy, do not access or use our Services or interact with any other aspect of our business. We are committed to protecting your privacy, particularly with regard to the storage, access, and use of Personally Identifiable Data (defined below) collected from you. Federal law gives consumers the right to limit some but not all sharing of such information. Federal law also requires us to tell you how we collect, share, and protect your personal information. We will maintain your personal information in a secure format and, except as set forth herein, we will not permit anyone to access such information. Please read this notice carefully to understand what Dough does with respect to privacy. Why does Dough collect customer information?
 The information we gather from you is necessary for us to communicate with you about your Dough account, to process transactions for you, and to comply with certain laws, including, but not limited to, federal, state, tax, anti-money laundering, and certain foreign laws (collectively, “Applicable Laws”) as well as certain requirements enforced by regulatory agencies including but not limited to, FINRA, SEC, and other state regulators, (collectively, “Applicable Regulatory Requirements”). Furthermore, we collect information to help us safeguard your assets. Additionally, we may choose to gather information to help us assess your needs and preferences or to assist in the troubleshooting and resolution of technical problems. Our Services are not directed to individuals of any jurisdiction where Dough is not authorized to do business or where such products and Services offered by us would be contrary to the securities regulations or other local laws and regulations of that jurisdiction. We do not knowingly collect information from these individuals, and you are responsible for complying with your local laws and regulations. What information does Dough collect?
 We collect information about you when you provide it to us, when you use our Services, and when other sources provide it to us, as further described below. Information from your Dough account and profile Some of the information we collect directly from you is referred to as “Personally Identifiable Information” (“PII”). PII is defined as information that identifies a specific customer by non-public information that is associated with the customer. PII that we collect from you to comply with Applicable Laws and Regulatory Requirements includes, but is not limited to, your name, your address(es), your Social Security Number (“SSN”) or other Individual Tax Identification Number (“ITIN”), your date of birth, your email address, your mobile and other phone number(s). Additionally, you provide us with a unique username and security question and answer. Applicable Regulatory Requirements require us to adopt “Know Your Customer” (“KYC”) procedures to develop a customer profile and to aid in assessing your suitability for trading certain products, strategies, and in certain account types. The information we collect from you in addition to PII to compile your personal and investment profiles in order to comply with KYC requirements includes, but is not limited to, your approximate annual income, approximate net worth, approximate liquid net worth, number of dependents, investment experience, investment objective, employer and employment information. We collect this information from you when you input information on our account application, when you open an account with Dough, create or modify your profile(s), set preferences, or sign-up for information or products through the Services.
 Information collected from you through Dough’s websites
 The Dough Services also include our website(s) owned and/or operated by us. We collect other content that you submit to our website(s), including your feedback or participation in interactive features, surveys, contests, promotions, sweepstakes, activities or events.
 Information collected directly from you through the use of Dough’s Services
 We collect and store content that you send to us and that you receive from us via mediums such as, but not limited to, our support channel, our website or trading platform(s), our clearing firm, or directly from an employee, representative, or agent of Dough. This content includes, but is not limited to, email content we receive from you, email attachments we receive from you, documents we receive from you, faxed documents we receive from you, and documents you upload to our website. We collect and retain data from your use of our trading platform(s) and account management website, including but not limited to sessions, money movement activity, preference management and order activity.
 Information collected indirectly from you through the use of Dough’s Services
 We collect “Non-Personally Identifiable Information” (“NPII”) defined as information that is not associated or linked to PII and is not sufficient to uniquely identify an individual. We collect NPII when you visit and interact with any of our Services. The NPII we collect includes, but is not limited to, the features you use, the links you click on, and data about attachments you upload to the Services. We also collect information about your computer, phone, tablet, or other devices you use to access and utilize the Services. Additionally, we collect information through your device about your operating system, browser type, Internet Protocol (“IP”) address, timestamps, products or services used, country or approximate location. Cookies, which are small pieces of data sent from a website and stored on your computer by your web browser while you are viewing a website, provide operational data that enable us to better understand your interaction with Dough’s website and Services, such as referral sites and banner ads you click through. We collect this type of information to aid us in troubleshooting and improving products, as well as contributing to our commitment to secure your private information. We reserve the right to share certain NPII with any of our authorized marketing agents to measure the overall effectiveness of our online advertising, content, and distribution.
 Information Dough collects from other sources
 We receive information about you when you link a third party service with our Services. For example, if you establish an Automated Clearing House (“ACH”) relationship between your Dough account and your bank account using instant verification (via Plaid Technologies Inc. (“Plaid”, a Qualified Third-Party), we receive your ABA routing number and bank account number, which we encrypt and store. The information we receive when you link or integrate our Services with a third party service depends on the settings, permissions and privacy policy controlled by that third party service. You should always check the privacy policy, settings, and notices provided by these third party services to understand what data may be disclosed to us or shared with our Services. In order to comply with Applicable Regulatory Requirements, Dough archives all interactions with our social media presence such as Facebook and Twitter. Any information you provide in a social media interaction with us is governed by the privacy policy of the social media network, not Dough. When does Dough collect information?
 You directly provide the majority of the information we collect when you perform various actions on the Dough website and use Dough Services. Listed below are some of the means in which we collect information directly from you: When you start the new account application; When you agree to customer agreements and account documents; When you read the Firm’s policies and disclosures; When you log into the website(s), platform(s), or mobile app(s); When you place a trade; When you send us an email; When you voluntarily submit information in response to a promotion or special offer; and When you initiate an ACH relationship using micro-deposits. Listed below are some of the means in which we collect information indirectly from you:
 When we analyze your usage of our website(s), platform(s), or mobile apps(s): When we provide products and services to you; When you initiate an ACH relationship using instant verification (via Plaid,); and When we obtain information from other sources such as credit reporting agencies, company affiliates, and qualified third party vendors and service providers (“Qualified Third-Party”, “Qualified Third Parties”).
 Company affiliates and Qualified Third Parties
 We may receive information about you from our parent companies, tastytrade, Inc. or PEAK6 Investments LLC
(“Parent Companies”) or other affiliate companies (owned by our Parent Companies) in accordance with their
terms and policies. Additionally, we may receive information about you and your activities from Qualified Third Parties, such as advertising and market research partners, who provide us with information about your interest in and engagement with our Services and online advertisements.
 How does Dough use your information? Dough uses the information about you to provide the Services to you, including, but not limited to, verifying your identity, contacting you about your Dough account(s) or new products or Services, establishing your Dough account(s), maintaining necessary records about your trading activity and portfolio, and to support you and your related Dough account(s). We also use your contact information to send transactional communications via email and within the Services, including, but not limited to, Dough account update notices, funding or withdrawal notices, trade fill notices, exercise and assignment notices, password and username reset notifications. These communications are part of the Services and in most cases you cannot opt out of them. If the option to opt-out is available, you will find that option within the communication itself or in your ‘Communication Preferences’ while logged into the Dough website and/or mobile application. Additionally, we use your contact information and information about how you use our Services to send promotional communications, including by email and by displaying Dough ads on our company affiliates’ websites, and third party websites, including social media websites, such as Facebook and Twitter. You can control whether you receive promotional email communications by updating your communication preferences or directly unsubscribing from respective promotional communications. Please note, should you opt-out of marketing and promotional emails, you will continue to receive important emails about your account as well as transactional emails related to our Services.

We use anonymized demographic and usage information to further our marketing and product development efforts. No PII is used for analysis of customer demographics or customer behavior.
 Safety and security
 We use information about you and your use of our Services to verify accounts and activity, to monitor for suspicious or fraudulent activity, and to identify violations of Dough policies. Furthermore, where required by Applicable Laws and Regulatory Requirements, or where we believe it is necessary in order to protect our legal rights, interests, and the interests of others, we use information about you in connection with legal claims, compliance, regulatory
and financial audit functions, and disclosures in connection with the acquisition, merger or sale of a business.
 Legal bases for processing (for EU customers)
 Dough does not currently open accounts for non-US customers. However, if you are located in a country of the European Union and provide information to Dough, we will collect and process information about you only where we have legal basis for doing so under EU applicable laws, US Applicable Laws, and US Applicable Regulatory Requirements. The legal bases depend on the Services you use and how you use them. Therefore, we collect and use your information only where necessary as outlined below:
 We need it to provide you our Services, including to operate our Services, provide customer support and personalized features, and to protect the safety and security of our Services; We need it to satisfy a legitimate interest, if it does not contradict your data protection interests, such as for research and development, to market and promote our Services, and to protect our legal rights and interests; When you have given us consent to do so for a specific purpose; or When we need to process your data to comply with a legal or regulatory obligation.
 If you have consented to our use of information about you, either explicitly or through the use of our Services, you have the right to change your mind at any time, but it will not affect any processing that has already occurred. Furthermore, you understand that it may prohibit your continued use of certain or all of our Services and may result in the termination of a relationship between you, our Services and us. You should be aware that there are published Applicable Regulatory Requirements that mandate US broker-dealers and other financial institutions retain customer information, sometimes in an easily accessible location, for a specified period of time during the lifetime of an account and after an account is closed.
 How does Dough share your information?
 Dough does not sell, license, lease or otherwise disclose your personal information to any third party for any reason other than for the following purposes:
 We may share certain information about you with other customers as a result of requests you initiate on our platform. For example, if you have granted Limited Trading Authorization on your account to another customer, we share your trade confirmations with that other customer.
 We may disclose personal information to Qualified Third Parties in order to administer or process a transaction, product or service you have authorized or requested, or in the context of facilitating the settlement of a transaction. For example, we may be required to deliver personal information about you to Qualified Third Parties for certain investments or to validate customer identities when performing electronic transfers of funds and wires. We are required to validate customer identity by Applicable Laws and Regulatory Requirements and rely on Qualified Third Party services to perform these validations. PII that you provide to us during the account opening process is passed to these services at account opening and on an ongoing basis thereafter. We provide PII that you provide during the account opening process to our clearing firm, as required by Applicable Laws and Regulatory Requirements, to carry out or aid in certain functions, such as, but not limited to, account processing, surveillance, reconciliation, settlement, fulfillment, retention requirements, and document dissemination. We may share analysis based on anonymized customer information or behavior with our Parent Companies and affiliate companies in order to operate and improve products and services.
 We may disclose or transfer information we collect under this Privacy Policy to a purchaser of our capital stock, business or assets, or to an affiliate successor. You will be notified via email and/or a prominent notice on the Services if such a transaction takes place, which notice will include choices you may have regarding your information.
 We may disclose personal information should you decide to participate in certain promotions and special offers when the nature of the promotion or special offer requires us to gather and share your personal information (such as your mailing address) with a third party for delivery of goods or services. Should you choose to purchase a product or service offered by another company by way of a promotion or special offer, any personal information you share with that company would no longer be under the jurisdiction of this Privacy Policy.
 We may disclose personal information to Qualified Third Parties and/or affiliate companies who provide services, such as, but not limited to, consulting, sales, customer support operations, payment processing, authentication services, and technical support or services.
 We use Plaid to gather end user’s data from financial institutions. By choosing to use Plaid for instant verification and money movement in coordination with our Services, you grant Dough and Plaid the right, power, and authority to act on your behalf to access and transmit your personal and financial information being transferred, stored, and processed by Plaid in accordance with the Plaid Privacy Policy, which can be viewed at https://plaid.com/legal/#privacy-policy. You may opt not to use instant verification via Plaid for money movement if you wish to opt out of sharing your information with Plaid. If an affiliate company or qualified third party needs access to certain personal or customer information in order to carry out certain functions on our behalf, they do so under close instruction from us. All affiliate companies and Qualified Third Parties with whom we share personal or other customer information with have their own privacy policies, and while they are expected to protect your information in a manner that aligns respectively with the protocols described in this Privacy Policy, we strongly encourage you to read their respective privacy policies.
 Non-qualified third parties
 We do not share information with non-qualified third parties (third parties with whom we do not have a contract to use their services or products, or who is not an affiliate company) for marketing purposes unless we have record of your prior consent. You may respectively decline to share your information if and when there is a time that we request your consent before disclosing any information to a non-qualified third party.
 Compliance with enforcement, Regulatory Requests, and Applicable Laws
 We may share information about you to third parties if it is determined that sharing such information is necessary to: Comply with Applicable Laws and Regulatory Requirements or requests, as well as legal processes; Respond to mandatory legal or government requests; Meet national security requirements; Enforce our agreements, policies, procedures, and terms of use; Protect the security and integrity of our Services; Protect ourselves, our affiliate companies, our customers, or the general public from illegal activities; or Respond to an emergency that requires the disclosure of certain information.
 Links to third party websites
 Our Services may include links that direct you to other websites or services whose privacy policies may differ from ours. We are not responsible for the privacy policies of the websites we may link out to. We have no governance over the collection, use, or protection of the information you provide to third party sites when you visit them. We strongly encourage you to read the privacy policy of any website you visit.
 With your consent
 We may share certain information about you upon receipt of your consent to do so. For example, we may display personal testimonials of satisfied customers. With your consent, we may post your name alongside the testimonial.
 How does Dough protect and store your information?
 We employ industry standard measures to ensure data is protected from being accessed by any unauthorized parties. Access to customer data by our personnel is strictly controlled and audited. We utilize multiple layers of firewalls, network segregation, intrusion prevention, encryption and password policies to prevent unauthorized access to or retrieval of data from our systems.
 Any customer support communications between our personnel and a customer regarding sensitive and/or private information requires authentication of the customer’s identity, such as requesting the customer provide the answer to their security question. All communication with the Dough website is encrypted with Transport Layer Security
v1.2 or greater (TLS 1.2) and sent over a secure channel. While we take the security of your information and of our systems very seriously, and implement safeguards designed to protect both, we cannot guarantee that our security system is completely impenetrable. Attack vectors which are out of our control such as compromised client systems or man in the middle attacks on public networks, zero-day threats and other unknown exploits make it impossible for Dough to provide an absolute guarantee of security.
 Retention of the information we collect
 We are required under applicable laws and regulatory requirements to retain certain information, including personal information of customers, customer profiles, identification verification materials, information we used to satisfy our know-your-customer and anti-money laundering obligations, account information, account agreements, trade orders, trade confirmations and other agreements between us, account statements, and other records. Once a retention period has expired based on the type of information retained, we will either delete or anonymize your information within a reasonable period of time.
 Account, personal, and investment profile information: We retain your account(s) information and customer profile information, such as, but not limited to, personal information, suitability information, the aforementioned types of information necessary to for us to comply with KYC, account agreements and documents, account statements, customer documents, identity validation records, and username records for a period of no
less than six (6) years after the account is closed per Applicable Regulatory Requirements.
 Support emails, chats, and phone calls: We retain customer communications, which may include email attachments and records of communication generated by Dough and sent to you, for a period of no less than three (3) years per Applicable Regulatory Requirements. Furthermore, we are required to retain written customer complaints for a period of no less than four (4) years. Trade and order information: We retain information regarding your orders and your trade confirmations for a period of no less than three (3) years per Applicable Regulatory Requirements. Deposit, withdrawal, and transfer information: We retain certain information about deposit transactions,
withdrawal transactions, money and/or position transfers for a period of no less than three (3) years per Applicable Regulatory Requirements. Marketing information: If you have elected to receive marketing emails from us, we retain information about your marketing preferences for a reasonable period of time from the date you last expressed interest.
 How can you access and control your information?
 You have the right to review your information, request a copy of your information, and update your information. Furthermore, you can contact us to request to withdraw consent you previously gave us (but this request will not affect any processing that has already taken place) or to object to our use of your information if such request or objection would not result in our non-compliance with our reasonable company policies, Applicable Laws and Regulatory Requirements. If you have chosen to share your information with third parties (for example, in the context of sweepstakes or promotions) you will need to contact those third parties directly to have your information updated, deleted, or otherwise restricted.
 Accessing your information. Your respective personal and investment profiles are available on the Dough mobile platform. Additionally, you can view your account balances, trade and order information directly there.
 Closing your account
 If you no longer wish to hold an account with us or use our Services, you may request to have your account(s) closed. This can be achieved by emailing accounts@dough.com. It is important that you understand that closing your account(s) does not delete your information. Your information will be retained in accordance with this Privacy Policy or as otherwise required of us to comply with our policies, Applicable Laws and Regulatory Requirements, and may be visible to appropriate company personnel during this time.

What if Dough makes changes to this Privacy Policy?
 We reserve the right to modify this Privacy Policy from time to time. Therefore, we encourage you to review it frequently on the Dough website (www.dough.com). If we make material changes to this Privacy Policy, we will post our updated Privacy Policy to the Dough website and notify you via email and/or directly on the Dough website. We will note the date of the most recent Privacy Policy in the footer of the document.

How can you contact Dough with questions regarding this Privacy Policy?
 If you have questions, comments, concerns, or complaints, please email privacy@dough.com or reach us at the following address:
 Dough LLC
Attention: Privacy Department
141 W. Jackson Blvd, Suite 800 Chicago, IL 60604 Last Updated: December 26, 2018