leaving a positive legacy for our world Unleashing the power of data Data stewardship For Ulta Beauty, data is a source of both great opportunity and great responsibility. Using insights from guest data helps us personalize our offerings and develop products that guests love. Our customer analytics group uses data to: o Drive demand via targeted marketing o Develop merchandise insights and strategies o Support member recognition through our loyalty program o Provide guest insights to drive business objectives across our company We safeguard this data by monitoring and complying with privacy and consumer protection laws. While we do not sell guest data, we share aggregated and anonymized data with our brand partners and third-party vendors to enhance our business. We manage data security and privacy at the highest levels. Our Board of Directors has always actively engaged in oversight of cybersecurity, and it is part of the charter of our Audit Committee. Our CEO keeps the Board informed on cybersecurity and privacy matters via monthly reporting, regular reports to the Audit Committee and full Board discussions throughout the year. Understanding the increased prevalence of ransomware attacks on companies of all sizes, we have strengthened our data protection capabilities through investments and training. Working with third parties, we developed a heatmap of cyber risks to help us understand our areas for improvement. SecurityScorecard: A(93/100) Rating Evaluation of cybersecurity risk As of February 2022 Environment Product People Supplemental Data Community 2021 ESG Report 9 Introduction