Privacy Policy and Legal Statements

Last Updated: July 2018

Kohler Co. and its affiliates (“Kohler”) are committed to your privacy. We want you to be familiar with how we collect, use and disclose information. This Privacy Policy describes our practices in connection with information that we collect online and offline:

“Personal Information” is information that identifies you as a natural person or relates to an identifiable natural person. We may collect and process the following Personal Information:

• Personal contact information such as name, address, telephone number and email address;
• Business contact information such as business address, telephone number and email address;
• Information necessary to provide services or products to you;
• Comments and opinions you provide when you contact us directly by email, telephone or mail;
• Payment and transaction information for billing purposes.

“Other Information” is any information that does not reveal your specific identity or does not directly relate to an identifiable individual. We may collect and process the following Other Information:

• Browser and device information;
• App usage data;
• Information collected through cookies, pixel tags and other technologies. For more information regarding our use of cookies, click here https://www.corporate.kohler.com/cookie-policy.
• Demographic information and other information provided by you that does not reveal your specific identity;
• Information that has been aggregated in a manner such that it no longer reveals your specific identity.

If we are required to treat Other Information as Personal Information under applicable law, then we will collect, use and disclose it for the purposes for which we collect, use and disclose Personal Information as detailed in this Policy.

We and our service providers may collect Personal Information online in a variety of ways in connection with our services or products, including:

• Through our websites (“Websites”);
• Through the software applications made available by us for use on or through computers and mobile devices (“Apps”);
• Through social media properties (“Our Social Media”);
• Through HTML-formatted email messages that we send to you that link to this Privacy Policy (“Emails”);
• Through extranet sites made available to our clients and third parties (“Extranet Sites”);
• Through services we provide to our corporate and institutional clients (“services”); and
• Through our registration process for newsletters, seminars, webinars and events.

We also may collect Personal Information offline in a variety of ways in connection with our, including

• When you participate in a contractual arrangement for services or products;
• When you provide information in conjunction with our services or products; or
• When you interact with us at an event.

We also may collect Personal Information from other sources, including:

• Publicly available databases;
• Joint marketing partners and event sponsors, when they share the information with us;
• Other entities or franchisees to which we provide products and services;
• Referral sources; and
• Social media platforms.

We need to collect Personal Information in order to provide our products and services to you. If you do not provide the information requested, we may not be able to provide our products or services. If you disclose any Personal Information relating to other people to us or to our service providers in connection with our products and services, you represent that you have the authority to do so and to permit us to use the information in accordance with this Privacy Policy.

We and our service providers may collect Other Information in a variety of ways, including:

• Through your browser or device:
• Certain information is collected by most browsers or automatically through your device, such as your Media Access Control (MAC) address, computer type (Windows or Mac), screen resolution, operating system name and version, device manufacturer and model, language, Internet browser type and version and the name and version of the services (such as the App) you are using. We use this information to ensure that the services function properly.
• Through your use of an App
• When you download and use an App, we and our service providers may track and collect App usage data, such as the date and time the App on your device accesses our servers and what information and files have been downloaded to the App based on your device number.
• Using cookies
• Cookies are pieces of information stored directly on the computer that you are using. Cookies allow us to collect information such as browser type, time spent on the services, pages visited, language preferences and other traffic data. We do not currently respond to browser do-not-track signals. To learn more about how we use cookies, or to opt out of the collection and use of cookies, please see our Cookies Policy by clicking here https://www.corporate.kohler.com/cookie-policy.
• Using pixel tags and other similar technologies
• Pixel tags (also known as web beacons and clear GIFs) may be used to, among other things, track the actions of users of the services (including email recipients), measure the success of our marketing campaigns, and compile statistics about usage of the services and response rates.
• Analytics
• We use Google Analytics, which uses cookies and similar technologies to collect and analyze information about use of the services and report on activities and trends. This service may also collect information regarding the use of other websites, apps and online resources. You can learn about Google’s and YouTube’s practices by going to https://www.google.com/policies/privacy/partners/, and opt out of them by downloading the Google Analytics opt-out browser add-on, available at https://tools.google.com/dlpage/gaoptout. To view Google’s and YouTube’s privacy policy, please click here.
• You will be given the option at each website to opt-out of being tracked by cookies.
• IP Address
• Your IP address is automatically assigned to your computer by your Internet Service Provider. An IP address may be identified and logged automatically in our server log files whenever a user accesses our systems, along with the time of the visit and the page(s) that were visited. Collecting IP addresses is standard practice and is done automatically by many websites, applications and other systems. We use IP addresses for purposes such as calculating usage levels, diagnosing server problems and administering the systems. We may also derive your approximate location from your IP address.

We may use and disclose Other Information for any purpose, except where we are required to do otherwise under applicable law. In some instances, we may combine Other Information with Personal Information. If we do, we will treat the combined information as Personal Information as long as it is combined.

We and our service providers use Personal Information for legitimate business purposes, including:

• Providing Products and Services.
• To contact individuals (including employees of institutional clients) in connection with providing products and services.
• To respond to inquiries and fulfill requests from our clients and others, administer their file(s), provide products and services and manage our relationships.

We engage in these activities to manage our contractual relationship with you, to comply with a legal obligation, and/or because we have a legitimate interest.

• Providing you with our marketing materials and facilitating social sharing
• To send you our offers, newsletters, publications, updates, and mailings related to our products or services that we think may be of interest to you.
• To fulfill your event or accommodation registration requests and provide goods and services and resort services.
• To send you information about our products and services and other news about products or services which we have reason to believe will be of interest to you.

We will engage in this activity with your consent or where we have a legitimate interest.

• Providing the functionality of our Products and Services and fulfilling your requests
• To provide our products and services functionality to you, such as arranging access to your registered account, and providing you with related goods and services.
• To respond to your inquiries and fulfill your requests, when you contact us via one of our online contact forms or otherwise (e.g., when you send us questions, suggestions, compliments or complaints, or when you request other information about our products or services).
• To send administrative information to you, such as information regarding our products and services, guarantees and warranties and changes to our terms, conditions and policies.

We will engage in these activities to manage our contractual relationship with you and/or to comply with a legal obligation.

• Accomplishing our business purposes
• For data analysis, for example, to improve the efficiency of our goods and services and quality of our products.
• For audits, to verify that our internal processes function as intended and are compliant with legal, regulatory or contractual requirements.
• For fraud and security monitoring purposes, for example, to detect and prevent cyberattacks or attempts to commit identity theft.
• To meet our legal and regulatory obligations.
• For enhancing, improving, or modifying our current products and services.
• For identifying usage trends, for example, understanding which parts of our products and services are of most interest to customers.
• For determining the effectiveness of our promotional campaigns, so that we can adapt our campaigns to the needs and interests of our customers.
• For operating and expanding our business activities, for example, understanding which parts of our services or products are of most interest to our customers so we can focus our energies on meeting our customers’ interests.

We engage in these activities to manage our contractual relationship with you, to comply with a legal obligation, and/or because we have a legitimate interest.

We disclose Personal Information:

• To our affiliates for the purposes described in this Privacy Policy
• You can consult the list and location of our affiliates listed at the bottom of this page. Subject to local requirements, this information may be used to provide products and related products and services offered by our other legal entities and for all the purposes outlined in this Privacy Policy.
• [Kohler Co.] is the party responsible for the management of the jointly-used Personal Information.
• To our third-party service providers, to facilitate services they provide to us

• These can include providers of services such as website hosting, services-related consulting and monitoring, data analysis, information technology and related infrastructure provision, customer service, email delivery, auditing, and other services.
• By using our Services, you may elect to disclose Personal Information

• On message boards, chat, profile pages, blogs and other services to which you are able to post information and content (including, without limitation, our Social Media), or through which you are able to send messages through the systems. Please note that any information you post or disclose through these systems will become public and may be available to other users and the general public.

We also use and disclose your Personal Information as necessary or appropriate, especially when we have a legal obligation or legitimate interest to do so:

• To comply with applicable law and regulations including laws outside your country of residence.
• To cooperate with public and government authorities, including authorities outside your country of residence.
• To cooperate with law enforcement.
• For other legal reason such as to enforce our terms and conditions and to protect our rights, privacy, safety or property, and/or that of our affiliates, you or others.
• In connection with a sale, merger or business transaction.

We retain Personal Information for as long as needed or permitted in light of the purpose(s) for which it was obtained and consistent with applicable law. The criteria used to determine our retention periods include:

• The length of time we have an ongoing relationship with you and provide our products and services to you (for example, for as long as you have an account with us or keep using our products and services);
• The length of time we have an ongoing relationship with you as our client and provide you with products and services;
• Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions or communications for a certain period of time before we can delete them); or
• Whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation or regulatory investigations).

We have implemented internal policies and technical measures to protect Personal Information from loss, accidental destruction, misuse or disclosure. Such internal policies and technical measures include:

• The use of pseudonymization and encryption of personal data where appropriate;
• Procedures and controls to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;
• Procedures and controls to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;
• Procedures for regularly testing, assessing and evaluating the effectiveness of technical and organizational measures for ensuring the security of the processing; and
• Procedures to ensure that data is not accessed, except by individuals in the proper performance of their duties.

You have choices regarding marketing-related communications. If you no longer want to receive marketing-related emails from us on a going-forward basis, you may opt-out by following the unsubscribe instructions in any such message or by contacting us by email at KohlerGlobalDataPrivacy@kohler.com. We will try to comply with your request(s) as soon as reasonably practicable. Please note that if you opt-out of receiving marketing-related emails from us, we may still send you important administrative messages, from which you cannot opt-out.

If you are resident in the European Economic Area, under European law you have the following rights in respect of your personal information that we hold:

• Right of access. You have the right to obtain confirmation of whether, and where, we are processing your personal information; information about the categories of personal information we are processing, the purposes for which we process your personal information and information as to how we determine applicable retention periods; information about the categories of recipients with whom we may share your personal information; and a copy of the personal information we hold about you.
• Right of portability. You have the right, in certain circumstances, to receive a copy of the personal information you have provided to us in a structured, commonly used, machine-readable format that supports re-use, or to request the transfer of your personal data to another person.
• Right to rectification. You have the right to obtain rectification of any inaccurate or incomplete personal information we hold about you without undue delay.
• Right to erasure. You have the right, in some circumstances, to require us to erase your personal information without undue delay if the continued processing of that personal information is not justified.
• Right to restriction. You have the right, in some circumstances, to require us to limit the purposes for which we process your personal information if the continued processing of the personal information in this way is not justified, such as where the accuracy of the personal information is contested by you.
• Right to object. You have a right to object to any processing based on our legitimate interests where there are grounds relating to your particular situation. There may be compelling reasons for continuing to process your personal information, and we will assess and inform you if that is the case. You can object to marketing activities for any reason.
• If you are resident in France, you also have the right to set guidelines for the retention and communication of your personal information after your death.

If you wish to exercise one of these rights, please contact us at KohlerGlobalDataPrivacy@kohler.com.

You also have the right to lodge a complaint to your local data protection authority.

Residents in other jurisdictions may also have similar rights to the above. Please contact us at KohlerGlobalDataPrivacy@kohler.com if you would like to exercise one of these rights, and we will comply with any request to the extent required under applicable law.

This California Privacy Policy is intended to comply with the California Consumer Privacy Act (CCPA), California Online Privacy Protection Act (CalOPPA), California Notice Data Security Act and other applicable privacy laws. Consumers with disabilities may access this policy in an alternative format by sending an email to: KohlerGlobalDataPrivacy@kohler.com.

For purposes of this California Privacy Policy, “Personal Information” means anything that identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular California consumer or household.

Kohler Co. does not sell personal information.

As a California resident, you have the following rights regarding the Personal Information we collect about you:

• Right to Notice. You have the right to receive notice of the categories of Personal Information we collect prior to or at the time we collect your Personal Information. The Personal Information we collect about California residents is described above in the section titled WHAT INFORMATION WE COLLECT. The business or commercial purposes for the collection of your Personal Information are described above in the section titled HOW WE USE PERSONAL INFORMATION.
• Right to Know. You have the right to know about the Personal Information we collected and disclosed about you and your household during the prior 12 months. You can obtain the Personal Information we collected and/or disclosed about you by calling us at our toll-free telephone number: 1-800-923-1138 or emailing us at: KohlerGlobalDataPrivacy@kohler.com. To ensure that the request is coming from you and to protect the security of your Personal Information, we may require you to provide us with certain information to verify your identity such as your email address, your telephone number, a description of the product or service you purchased or inquired about, the dollar amount of your last purchase and/or a signed declaration under penalty of perjury from you that you are the consumer whose Personal Information is subject to the request. You may use an authorized agent to exercise your right to know if the authorized agent has your power of attorney act on your behalf or the authorized agent has your written authorization permitting the authorized agent to request access to your Personal Information.
• Right to Delete. You have the right to request us to delete the Personal Information that we have collected or maintained about you and your household. You can request us to delete your Personal Information by calling us at our toll-free telephone number: 1 800 923-1138 or emailing us at: KohlerGlobalDataPrivacy@kohler.com. To ensure that the request is coming from you and to protect the security of your Personal Information, we may require you to provide us with certain information to verify your identity such as your email address, your telephone number, a description of the product or service you purchased or inquired about, the dollar amount of your last purchase and/or a signed declaration under penalty of perjury from you that you are the consumer whose Personal Information is subject to the request. You may use an authorized agent to exercise your right to delete if the authorized agent has your power of attorney act on your behalf or the authorized agent has your written authorization permitting the authorized agent to request deletion of your Personal Information.
• Right to Nondiscrimination. You have the right to receive our products and services on equal terms regardless of whether or not you exercise your rights under the CCPA.
• Right to Request Information about Disclosures. You may request information about any disclosures of categories of Personal Information we make to our affiliates or third parties for their direct marketing purposes. We will provide a list of the categories of Personal Information disclosed to third parties or our affiliates for their direct marketing purposes during the immediately preceding calendar year, along with the names and addresses of these third parties or affiliates. Your request may be made no more than once per calendar year. You may submit your request by emailing us at: KohlerGlobalDataPrivacy@kohler.com. We do not respond to “Do Not Track” requests.

If you have questions or concerns regarding this Privacy Policy, please email us at: KohlerGlobalDataPrivacy@kohler.com.

You have the right to direct us not to sell certain personally identifiable information that we collect about you on our Websites or other online services by emailing us at KohlerGlobalDataPrivacy@kohler.com. This information includes: your first name or first initial and last name in combination with your social security number; driver’s license number, driver authorization card number or identification card number; account number, credit card number or debit card number, in combination with any required security code, access code or password that would permit access to your financial account; medical identification number or a health insurance identification number; user name, unique identifier or electronic mail address in combination with a password, access code or security question and answer that would permit access to an online account.

Additionally, you may review and request that we change the personally identifiable information that we collect about you on our websites or other online services by emailing us at KohlerGlobalDataPrivacy@kohler.com.

Our service providers and other third parties may collect personally identifiable information about your online activities over time and across different internet websites or online services when you use our Websites or online services.

This Privacy Policy does not address, and we are not responsible for, the privacy, information or other practices of any third parties.

This includes any third party operating any website or service to which our websites may link. The inclusion of a link does not imply endorsement of the linked site or service by us or by our affiliates.

In addition, we are not responsible for the information collection, use, disclosure or security policies or practices of other organizations, such as Facebook, Apple, Google, Microsoft, RIM or any other app developer, app provider, social media platform provider, operating system provider, wireless service provider or device manufacturer, including with respect to any Personal Information you disclose to other organizations through or in connection with the Apps or our Social Media.

The goods and services we provide are not directed to individuals under the age of [sixteen (16)], and we do not knowingly collect Personal Information from individuals under [16].

Your Personal Information may be stored and processed in any country where we have affiliates, outlets and facilities or in which we engage service providers. By using our services you understand that your information will be transferred to countries outside of your country of residence, including the United States, which may have data protection rules that are different from those of your country. In certain circumstances, courts, law enforcement agencies, regulatory agencies or security authorities in those other countries may be entitled to access your Personal Information.

Some of the non-EEA countries are recognized by the European Commission as providing an adequate level of data protection according to EEA standards (the full list of these countries is available here). For transfers from the EEA to countries not considered adequate by the European Commission, we have put in place adequate measures, such as standard contractual clauses adopted by the European Commission, to protect your Personal Information. You may obtain more information by reaching out to us at KohlerGlobalDataPrivacy@kohler.com.

The “LAST UPDATED” legend at the top of this Privacy Policy indicates when this Privacy Policy was last revised. Any changes will become effective when we post the revised Privacy Policy. Your use of our online services following these changes means that you accept the revised Privacy Policy.

Kohler Co. is the company responsible for collection, use and disclosure of your Personal Information under this Privacy Policy.

If you have any questions about this Privacy Policy, please contact us at KohlerGlobalDataPrivacy@kohler.com.