The State Privacy Laws may provide residents with some or all of the rights listed below. However, these rights are not absolute and some State Privacy Laws do not provide these rights to their residents. Therefore, we may decline your request in certain cases as permitted by law.

• Information. You may have the right to request information concerning whether we are processing your Personal Information as well as the following information about how we have collected and used your Personal Information:
  • The categories or specific pieces of Personal Information that we have collected about you and inferences derived from such Personal Information.
  • The categories of sources from which we collected Personal Information.
  • The business or commercial purpose for collecting and/or selling or sharing Personal Information.
  • The categories of third parties with which we share Personal Information.
  • The categories of Personal Information that we sold or disclosed for a business purpose.
  • A list or the categories of third parties to whom your Personal Information (or any Personal Information) was sold or disclosed for a business purpose.
• Access. You may have the right to request a copy of the Personal Information that we have collected about you. If available in a digital format, you may have the right to request that a copy of your Personal Information is provided in a portable and, to the extent technically feasible, readily usable format.
• Appeal. You may have the right to appeal our denial of any request validly submitted. If so, and we deny your request, we will inform you of the reason for denying your request and provide you with instructions on how you may be able to appeal the decision. If we deny your appeal, we will also inform you, if applicable, of any online mechanism that may be available to you to submit a complaint to the applicable attorney general or regulator.
• Correction. You may have the right to ask us to correct inaccurate Personal Information that we have collected about you.
• Deletion. You may have the right to ask us to delete the Personal Information that we have collected about you and/or from you.
• Opt-out.
  • Opt-out of certain processing for targeted advertising purposes. We may process Personal Information for targeted advertising purposes. You may have the right to opt-out of certain processing of Personal Information for targeted advertising purposes.
  • Opt-out of profiling/automated decision-making. We do not use your Personal Information to engage in profiling in furtherance of decisions about you, or perform automated decision-making or use automated decision-making technology that results in legal or significant financial impacts, significant impacts on housing, education, employment, health care, or criminal justice, or similarly significant impacts.
  • Opt-out of other sales of Personal Information. You may have the right to opt-out of other sales of your Personal Information.
• Consumers under 16. We do not have actual knowledge that we collect, sell or share the Personal Information of consumers under 16 years of age.
• Sensitive Personal Information. We do not process Sensitive Personal Information for the purpose of inferring characteristics about consumers under the State Privacy Laws.
• Nondiscrimination. You may be entitled to exercise some or all of the rights described above free from discrimination as prohibited by the State Privacy Laws.

You may submit requests to exercise your right to information/know, access, appeal, correction, or deletion at https://privacy.kohler.com/, calling us toll free at 1-800-923-1138, or via email to KohlerGlobalDataPrivacy@kohler.com.

While we do not sell Personal Information for money, we, like many companies, use services that help deliver interest-based ads to you as described above. The State Privacy Laws may classify our use of some of these services as “selling” or “sharing” your Personal Information with the advertising partners that provide the services. These third parties use this information for, among other purposes, serving ads that are more relevant and may sell that information to, or share that information with, other businesses for advertising and other purposes. Note that opting out will not affect your receipt of advertising based on activities within or across our own websites or apps or the processing of your Personal Information solely for measuring or reporting advertising performance, reach, or frequency.

You can submit requests to opt-out of tracking for targeted advertising purposes or other sales of Personal Information via email to KohlerGlobalDataPrivacy@kohler.com or via phone by calling 1-800-923-1138, or by broadcasting the global privacy control signal. You may also opt-out of tracking of this sort or other sales of Personal Information by navigating to and clicking on the “Do Not Sell or Share My Personal Information” link on any Kohler website and following the instructions provided.

We may need to verify your identity in order to process your information/know, access, appeal, correction, or deletion requests and reserve the right to confirm your residency. To verify your identity, we may require government identification, a declaration under penalty of perjury, or other information, where permitted by law.

Under some State Privacy Laws, you may enable an authorized agent to make a request on your behalf. However, we may need to verify your authorized agent’s identity and authority to act on your behalf. We may require a copy of a valid power of attorney given to your authorized agent pursuant to applicable law. If you have not provided your agent with such a power of attorney, we may ask you to take additional steps permitted by law to verify that your request is authorized, such as by providing your agent with written and signed permission to exercise your State Privacy Laws rights on your behalf, the information we request to verify your identity, and confirmation that you have given the authorized agent permission to submit the request.

We cannot process your request if you do not provide us with sufficient detail to allow us to understand and respond to it. In certain circumstances, we may decline a request to exercise the rights described above, particularly where we are unable to verify your identity or locate your information in our systems. If we are unable to comply with all or a portion of your request, we will explain the reasons for declining to comply with the request.

We have summarized the Personal Information we collect, the purposes for which we collect it and the third parties with or to whom we may disclose, sell or share it by reference below to both the categories defined in the "What information we collect" section of this Privacy Notice above and the categories of Personal Information specified in the California Consumer Privacy Act (Cal. Civ. Code §1798.140). This chart describes our practices currently and during the 12 months preceding the effective date of this Privacy Notice. Information you voluntarily provide to us, such as in free-form webforms, may contain other categories of Personal Information (including Sensitive Personal Information) not described below.

*Your Personal Information may also be disclosed to third parties at your request or with your consent, to third parties in connection with a business transaction, and/or to law enforcement, regulators and other third parties for legal reasons.

**Each of the categories of Personal Information that is sold or shared with third parties is sold or shared for purposes of marketing, advertising, analytics and service personalization.

Under California’s Shine the Light law (Cal. Civ. Code §1798.83), California residents may ask companies with whom they have formed a business relationship primarily for personal, family or household purposes to provide the names of third parties to which they have disclosed certain personal information (as defined under the Shine the Light law) during the preceding calendar year for their own direct marketing purposes, and the categories of personal information disclosed. You may send us requests for this information to KohlerGlobalDataPrivacy@kohler.com. In your request, you must include the statement “Shine the Light Request,” and provide your first and last name and mailing address and certify that you are a California resident. We reserve the right to require additional information to confirm your identity and California residency. Please note that we will not accept requests via telephone, mail, or facsimile, and we are not responsible for notices that are not labeled or sent properly, or that do not have complete information.

We may provide financial incentives to consumers who allow us to collect and retain Personal Information, such as Identifiers (e.g., name and email address) and Commercial Information (e.g., purchase history). These incentives may result in differences in our prices or services offered to consumers, and may include payments to consumers and/or a lower price for goods and services (e.g., discounts and other promotions). For example, the financial incentives we may provide include:

• Loyalty programs, where you earn rewards credits based upon spend levels
• Discounts or free products for frequent visitors
• Periodic promotional discounts and other offers

The material aspects of any financial incentive will be explained and described in its program terms or in the details of the incentive offer.

Please note that participating in any financial incentive program is entirely optional and participants may withdraw from the program at any time. To opt-out of the program and forgo any ongoing incentives, please follow the instructions in the program’s terms and conditions, or contact us using the contact details set forth in the “How to Contact Us” section, above.

Each financial incentive or price or service difference related to the collection and use of Personal Information is based upon our reasonable, good-faith determination of the estimated value of such information to our business, taking into consideration the value of the offer itself and the anticipated revenue generation that may be realized by rewarding brand loyalty and repeat purchases. We calculate the value of the offer and financial incentive by using the expense related to the offer.

If you have questions or concerns about this privacy notice or our information practices, please contact us using the contact details set forth in the “How to Contact Us” section, in the full notice tab.

Where this notice applies. The information provided in this Notice for EEA and UK (“EEA-UK Privacy Notice”) supplements the Privacy Notice and applies only to individuals located in the EEA or the UK. For the purposes of this EEA-UK Privacy Notice, “EEA-UK Data Protection Legislation” means all applicable legislation and regulations relating to the processing and/or protection of data or information that is capable, whether directly or indirectly, of identifying a natural person, in each case as in force from time to time in the European Union, the EEA or the UK, including: (i) the General Data Protection Regulation 2016/679 (“EU GDPR”); the EU GDPR as it forms part of the laws of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union Withdrawal Act 2018 (“UK GDPR”) (EU GDPR and UK GDPR together, “GDPR”); (iii) any other legislation which implements any other current or future legal act of the EEA or the UK concerning the protection and processing of personal data and any national implementing or successor legislation; and (iv) any amendment or re-enactment of any of the foregoing. The terms “controller,” “processor,” “data subject,” “personal data” and “processing” in this EEA-UK Privacy Notice shall be interpreted in accordance with the applicable EEA-UK Data Protection Legislation.

Personal information. References to “personal information” in this EEA-UK Privacy Notice should be understood to include a reference to “personal data” as defined in EEA-UK Data Protection Legislation. That is, information about individuals from which they can be directly or indirectly identified.

Controller. The specific company identified on this page as being the operator of this website is the data controller in the meaning of the EEA-UK Data Protection Legislation for the processing activities described in this EEA-UK Privacy Notice.

In the course of our business relationship with you, we may share business partner contact information with affiliated Kohler companies. We and these companies are jointly responsible for the proper protection of your personal data (Art. 26 of the GDPR). To allow you to effectively exercise your data subject rights in the context of this joint controllership, we entered into an agreement with these Kohler companies granting you the right to centrally exercise your data subject rights under the Account Actions Information section of this Privacy Notice.

Our legal bases for processing

In respect of each of the purposes for which we use your personal information, the EEA-UK Data Protection Legislation requires us to ensure that we have a “legal basis” for that use.

Our legal bases for processing your personal information described in this EEA-UK Privacy Notice are listed below.

• Where we need to perform a contract, we are about to enter into or have entered into with you (“Contractual Necessity”).
• Where it is necessary for our legitimate interests and your interests and fundamental rights do not override those interests (“Legitimate Interests”). More detail about the specific legitimate interests pursued in respect of each Purpose we use your personal information for is set out in the table below.
• Where we need to comply with a legal or regulatory obligation (“Compliance with Law”).
• Where we have your specific consent to carry out the processing for the Purpose in question (“Consent”).

We have set out below the legal bases we rely on in respect of the relevant purposes for which we use your personal information - for more information on these purposes and the data types involved, see ‘HOW KOHLER USES YOUR PERSONAL INFORMATION’.

No Automated Decision-Making and Profiling. As part of our services, we do not engage in automated decision-making and/or profiling that produces legal or similarly significant effects.

Your rights

General. The EEA-UK Data Protection Legislation gives you certain rights regarding your personal information. If you are located in EEA or the UK, you may ask us to take the following actions in relation to your personal information that we hold:

• Access. Provide you with information about our processing of your personal information and give you access to your personal information.
• Correct. Update or correct inaccuracies in your personal information.
• Delete. Delete your personal information where there is no good reason for us continuing to process it - you also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Transfer. Transfer a machine-readable copy of your personal information to you or a third party of your choice.
• Restrict. Restrict the processing of your personal information, for example if you want us to establish its accuracy or the reason for processing it.
• Object. Object to our processing of your personal information where we are relying on Legitimate Interests - you also have the right to object where we are processing your personal information for direct marketing purposes.
• Withdraw Consent. When we use your personal information based on your consent, you have the right to withdraw that consent at any time.

Exercising These Rights. You may submit these requests by email to KohlerGlobalDataPrivacy@kohler.com. You may also submit requests to exercise your right to information/know, access, appeal, correction, or deletion at https://privacy.kohler.com/. We may request specific information from you to help us confirm your identity and process your request. Whether or not we are required to fulfill any request you make will depend on a number of factors (e.g., why and how we are processing your personal information). If we reject any request you may make (whether in whole or in part), we will let you know our grounds for doing so at the time, subject to any legal restrictions.

Your Right to Lodge a Complaint with your Supervisory Authority. In addition to your rights outlined above, if you are not satisfied with our response to a request you make, or how we process your personal information, you can make a complaint to the data protection regulator in your habitual place of residence.

• For users in the EEA - the contact information for the data protection regulator in your relevant jurisdiction can be found here: https://edpb.europa.eu/about-edpb/board/members_en
• For users in the UK - the contact information for the UK data protection regulator can be found here: https://ico.org.uk/make-a-complaint/

We are a U.S.-based company and many of our service providers, advisers, partners or other recipients of data are also based in the U.S. This means that, if you use our service, your personal information will necessarily be accessed and processed in the U.S. It may also be provided to recipients in other countries outside the EEA or the UK. Where we share your personal information with third parties who are based outside the EEA or the UK, we try to ensure a similar degree of protection is afforded to it by making sure one of the following mechanisms is implemented:

• Transfers to territories with an adequacy decision. We may transfer your personal information to countries or territories whose laws have been deemed to provide an adequate level of protection for personal information by the European Commission or UK Government (as and where applicable) (from time to time), or under specific adequacy frameworks approved by the European Commission or UK Government (as and where applicable) (from time to time), such as the EU-U.S. Data Privacy Framework or the UK Extension thereto.
• Transfers to territories without an adequacy decision.
  • We may transfer your personal information to countries or territories whose laws have not been deemed to provide such an adequate level of protection.
  • However, in these cases:
    • we may use specific transfer mechanisms, which are mandated by the EEA-UK Data Protection Legislation to legitimise transfers of personal information subject to the GDPR from the EEA and/ or the UK to third countries and designed to give personal information effectively the same protection it has in the EEA and/ or the UK - for example, the EU’s standard contractual clauses (“EU SCCs”), the UK Addendum to the EU SCCs, or the UK’s International Data Transfer Agreement, and any other replacements published by the European Commission or the UK’s Information Commissioner’s Office and/ or UK Secretary of state from time to time; or
    • in limited circumstances, we may rely on an exception, or ‘derogation’, which permits us to transfer your personal information to such country despite the absence of an ‘adequacy decision’ or ‘appropriate safeguards’ - for example, reliance on your explicit consent to that transfer.

You may contact us through any of the mechanisms listed in the “How to Contact Us” section of the main notice if you want further information on the specific mechanism used by us when transferring your personal information out of the EEA or the UK.

We obtain your personal data through our website or through other forms of contact and interaction with the public. Your data may be obtained when you provide it to us, for example, when registering on our websites. We may also obtain your personal data through indirect means, such as through the collection of cookies and other features on our website.

In respect of each of the purposes for which we use your personal information, the LGPD requires us to ensure that we have a "legal basis" for that use.

Our legal bases for processing your personal information described in this Privacy Notice are listed below.

• When we need to celebrate a contract with you ("Execution of a Contract").
• When it is necessary for our legitimate interests and on behalf of your interests and fundamental rights ("Legitimate Interests").
• When we need to comply with a legal or regulatory obligation ("Compliance with Law").
• When we have your specific consent to process your personal data ("Consent").

We have outlined below the legal grounds we rely on for the specific purposes for which we use your personal information – for more information, please access How Kohler Uses Your Personal Information.

Kohler will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

Kohler may disclose your personal information to a third party, when necessary. When we disclose personal information for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract.

We may disclose your personal information to the following categories of third parties:

• Service providers;
• Our affiliates;
• Third parties to whom you authorize us to disclose your personal information in connection with products or services we provide you; and
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.

We are a U.S.-based company and many of our service providers, advisers, partners or other recipients of data are also based in the U.S. This means that, if you use our service, your personal information will necessarily be accessed and processed in the U.S. It may also be provided to recipients in other countries outside Brazil. When we share your personal information with third parties who are based outside Brazil, we try to ensure compliance with the principles, rights of the data subject and the data protection regime provided by the LGPD, making sure one of the following mechanisms is implemented:

• Transfers to territories with an adequacy decision. We may transfer your personal information to countries or territories whose laws have been deemed to provide an adequate level of protection for personal information by the ANPD.
• Transfers to territories without an adequacy decision.
  • We may transfer your personal information to countries or territories whose laws have not been deemed to provide such an adequate level of protection.
  • However, in these cases:
    • we may use specific appropriate safeguards, which are designed to give personal information effectively the same protection it has in Brazil – for example, standard contractual clauses, specific contractual clauses for a given transfer or binding corporate rules;
    • in limited circumstances, we may rely on an exception, or 'derogation', which permits us to transfer your personal information to such country despite the absence of an 'adequacy decision' or 'appropriate safeguards' – for example, reliance on your explicit consent to that transfer.

You may contact us at KohlerGlobalDataPrivacy@kohler.com if you want further information on the specific mechanism used by us when transferring your personal information out of Brazil.

Brazil's Privacy Notice supplements the information contained in Kohler's global privacy notice published at https://www.kohlercompany.com/privacy/. This Notice applies to data processing activities in Brazil and/or that involve individuals located in Brazil. We have adopted this Notice in compliance with the LGPD, and any terms defined under the LGPD will carry the same meaning when used in this Notice.

We securely store your personal data in compliance with applicable security standards and in a way that ensures your ability to exercise the rights granted under privacy and data protection laws. Some of the technical and administrative measures we use to protect your information are (encryption data both at rest and in transit, multi-factor authentication (MFA), Firewalls).

Kohler will only store your personal data for as long as necessary to fulfill the purpose for which it was collected, including compliance with applicable laws, regulations and court orders. Upon termination of processing activities, Kohler will securely delete the data if there is no legal basis to justify its storage.

The LGPD gives you certain rights regarding your personal information. The LGPD gives you certain rights regarding your personal information. We highlight that in cases provided for in art. 3º of the LGPD, this law will be fully applicable and its provisions will prevail, especially for Brazilian citizens, in the event of any conflicts between different laws. Therefore, you may ask us to comply with your requests, including:

• Confirmation of the existence of processing;
• Access;
• Rectification;
• Anonymization, redaction or elimination of unnecessary or excessive personal data, or of data that is not being processed in compliance with LGPD;
• Portability;
• Deletion of personal data being processed based upon consent;
• Disclosure of subprocessors and other third parties with whom personal data is shared;
• Information about consent choices and the consequences of refusing consent; and
• Revocation of consent.

You may submit these requests by email to KohlerGlobalDataPrivacy@kohler.com. You may also submit requests to exercise your right to information/know, access, appeal, correction, or deletion at https://privacy.kohler.com/policies/en/. We may request specific information from you to help us confirm your identity and process your request. Whether or not we are required to fulfill any request you make will depend on a number of factors (e.g., why and how we are processing your personal information), if we reject any request you may make (whether in whole or in part) we will let you know our grounds for doing so at the time, subject to any legal restrictions.

Your Right to File a Complaint with ANPD. In addition to your rights outlined above, if you are not satisfied with our response, or how we process your personal information, you can make a complaint to ANPD through the link https://www.gov.br/anpd/pt-br/canais_atendimento/cidadao-titular-de-dados/denuncia-peticao-de-titular.

Please find below the contact information of our DPO. If you have any questions or complaints about the processing of personal data carried out by KOHLER, please contact our DPO directly:

• Identity of our DPO: Mr. Allan Estevan Di Bartolomeo
• Contact our DPO: KohlerGlobalDataPrivacy@kohler.com

You have the right to request and access any personal information we have of you.

You have the right to correct any inaccurate or outdated personal information we hold about you or delete any inaccurate information.

You have the right to withdraw consent on any activities which you have not consented on such as direct marketing or cookies or delete any user generated content you have posted on our website.

Personal Information is various information that is recorded electronically or by other means and is related to an identified or identifiable natural person, excluding anonymized information. Sensitive Personal Information is Personal Information which, once leaked or illegally used, would easily hurt a natural person’s human dignity or cause harm to personal or property safety, including information regarding such as biometrics, religious beliefs, specially designated identities, medical health, financial accounts, and location tracking, as well as the Personal Information of minors under the age of 14. We will only process your Sensitive Personal Information for the purposes mentioned in the Privacy Notice and to the extent necessary. Our processing of your Sensitive Personal Information will not have an impact on your legitimate rights and interests permitted by applicable laws and regulations.

The following are your individual rights and to practice any of these rights, please contact us at KohlerGlobalDataPrivacy@kohler.com.
To the extent permitted by applicable laws and regulations:

• You have the right to know what personal information is handled
• You have the right to know how your personal information is handled
• You have right to access your personal information
• You have a right to ask for your personal information to be corrected or supplemented
• You have a right to ask to limit or reject processing of your personal information or to delete your personal information
• You have a right to opt-out of automated decision making for push notifications or automated decision making for any marketing purposes; for automated decisions made on matters that have an important impact on personal rights and interests, you have a right to know how they are made and you have a right to reject purely automated decisions on such matters.
• You have the right to withdraw consent to personal information processing
• You have the right to ask that we transfer personal information that you have provided to us to a third party of your choice if all the following conditions can be met: (1) your identity can be verified as authentic; (2) the personal information requested for transfer is the information that you consented to provide or that was collected based on a contract; (3) the transfer of personal information is technically feasible; and (4) the transfer of personal information does not harm the legitimate rights and interests of others.
• You have the right to cancel your account and after this, we will stop providing products and services and delete your personal information unless otherwise stipulated by law.

We will respond to your request of exercising your data subject rights in accordance with the applicable laws and regulations. Having said that, to the extent as permitted by laws and regulations, we may not be able to respond to your request of exercising your data subject rights in the following circumstances:

• If your request is contrary to our obligations under laws and regulations;
• If the requested data is directly related to national security or national defense security;
• If the requested data is directly related to public safety, public health, or significant public interest;
• If the requested data is directly related to criminal investigations, prosecutions, trials and enforcement of judgments, etc.;
• If we have sufficient evidence of your subjective malice or abuse of rights;
• If it is in the interest of safeguarding your or other individuals’ significant legitimate rights and interests, such as life and property, but it is difficult to obtain your authorization or consent;
• If responding to your request to exercise your rights would result in serious harm to your or other individuals’ or organizations’ legitimate interests;
• If the requested data involves trade secrets.

You have the right to withdraw your consent to process Personal Information at any time if your consent is the lawful basis for our processing. To exercise this right please send an email to KohlerGlobalDataPrivacy@kohler.com and practice the right to opt-out. You may also submit requests to exercise your right to information/know, access, appeal, correction, data portability, deletion or account cancellation by sending an email to KohlerGlobalDataPrivacy@kohler.com or at https://privacy.kohler.com/.

We will ask for separate consent under the following circumstances when applicable unless we have a Non-Consent Lawful Basis:

• Your Sensitive Personal Information is handled;
• Your Personal Information is transferred outside of China;
• Your Personal Information is provided to another personal information handler;
• Your Personal Information is publicly disclosed;
• Use your Personal Information that has been collected for the purpose of maintaining public security for any other purposes.

A Non-Consent Lawful Basis means one of the following circumstances: (i) our processing of your Personal Information is necessary for entering into or performing a contract to you, or for human resource management according to lawfully developed labor policies and lawfully signed collective contracts; (ii) our processing of Personal Information is necessary for carrying out our legal responsibilities or legal obligations; (iii) our processing of Personal Information is necessary in response to a public health emergency or for protecting a natural person’s life, health and property safety in an emergency; (iv) we process Personal Information to a reasonable extent in carrying out activities for public interests; (v) we process your Personal Information that has been published by you or otherwise has been published legitimately to a reasonable extent and in compliance with applicable laws and regulations; or (vi) other circumstances as provided by applicable laws or regulations.

• We are not allowed to transfer your personal information outside of China unless we have a lawful basis to do so, and unless we have a Non-Consent Lawful Basis for transferring your Personal Information overseas, we will request your explicit consent for the transfer to take place. If we transfer your personal information outside of China, we will complete the relevant transfer compliance mechanism as required by applicable laws and regulations.
• We keep records of the transfers we make.