Privacy Policy

This U.S. State Privacy Notice applies to “Consumers” as defined under U.S. privacy laws, specifically the California Consumer Privacy Act, including as amended by the California Privacy Rights Act (“CCPA”), the Virginia Consumer Data Privacy Act (“VCDPA”),the Colorado Privacy Act, the Utah Consumer Privacy Act, Connecticut’s Act Concerning Personal Data Privacy and Online Monitoring, and any other U.S. privacy laws, as each are amended and as and when they become effective, and including any regulations thereunder (collectively, the “U.S. Privacy Laws”). This U.S. State Privacy Notice is a supplement to this Privacy Policy. In the event of a conflict between any other P&G policy, statement, or notice and this U.S. State Privacy Notice, this U.S. State Privacy Notice will prevail as to Consumers and their rights under the applicable U.S. Privacy Laws.

This U.S. State Privacy Notice is designed to provide you with notice of our recent personal data practices over the prior 12 months from the “Last Updated” date of this Privacy Policy. This U.S. State Privacy Notice will be updated at least annually. This U.S. State Privacy Notice also applies to our current data practices such that it is also meant to provide you with “notice at collection,” which is notice of personal data (also referred to in some of the U.S. Privacy Laws as “personal information”) we collect online and offline, and the purposes for which we process personal data, among other things required by the U.S. Privacy Laws. For any new or substantially different processing activities that are not described in this U.S. State Privacy Notice, we will notify you as required by the U.S. Privacy Laws, including by either notifying you at the time of collecting personal data, or by updating this U.S. State Privacy Notice earlier than required. We reserve the right to amend this U.S. State Privacy Notice at our discretion and at any time. To contact us about this U.S. Privacy Notice, please see the Contact Us section below.

Generally, we collect, retain, use, and disclose your personal data for our business purposes and commercial purposes, which are described above in the remainder of this Privacy Policy, including in “How We Gather & Use Personal Data,”and “How We Disclose Personal Data” (collectively, our “Processing Purposes”). The sources from which we collect personal data are set forth above in the “How We Gather & Use Personal Data.” Some of the Processing Purposes, as we discuss below in the table, implicate “Sale,” “Sharing”, and or “Targeted Advertising.” For more details on the meaning of Sale, Sharing, and Targeted Advertising, see the “Do Not Sell/Share/Target” sectionbelow. Please note that the Processing Purposes as shown in the table are categorical descriptions, to aid in readability and clarity. Please reference the “General Ways We Use Personal Data” section of the Privacy Policy above for the full description of each Processing Purpose.

The table below describes the categories of personal data we collect in the first column (starting on the left). The second column provides examples of data types within the applicable categories, which, in some instances, include the personal data types/categories listed above under “Types of Personal Data We Collect.” The third column states the categories of recipients that receive such personal data (including sensitive personal data or special category data) as part of disclosures for business purposes, as well as disclosures which may be considered a Sale or Share under certain U.S. Privacy Laws. Not all data indicated in the examples is “sold” to third parties. For example, in the “Identifiers and Contact Information” of the chart, we may collect “financial account data” or “government issues IDs” in order to provide services to you, but we do not “sell” it to third parties. However, we may sell “unique IDs” and account information to third parties. If any of your data is “sold” or “shared,” it will be done so according to applicable law. The fourth column provides the Processing Purposes that are applicable to each category of personal data. In the fifth column, we provide, on a per category of personal data basis, the applicable retention period.

Category of Personal Data	Examples of Personal Data Types within Category	Categories of Recipients	Processing Purposes	Retention Period
1. Identifiers and Contact Information	Contact information, Unique IDs & Accounts Details, Online and Technical Information, Financial Account Information, Government-issued IDs	Disclosures for Business Purposes: • Software and other business Vendors (“Business Vendors”) • Marketing Vendors • Affiliates and Related Entities Sale/Sharing: Third-Party Digital Businesses and Retail Partners	• Products/Services • Customer Management • Customer Service/Communications • Payment/Financial • Serving Ads • Ads Administration • Quality and Safety • Security • Recordkeeping • Legal/Compliance • R&D • Purposes Disclosed at Collection • Legitimate Business Purposes	After no longer needed for the processing purpose(s) or after a maximum of 50 months of non-activity unless required by law or contract to retain. Data necessary to suppress communications to opted out consumers may be retained further.
2. Personal Records	Contact information, Unique IDs & Accounts Details, Financial Account Information, Government-issued IDs	Disclosures for Business Purposes: • Business Vendors • Marketing Vendors • Affiliates and Related Entities Sale/Sharing: Third-Party Digital Businesses	• Products / Services • Customer Management • Customer service / communications • Payment / financial • Serving ads • Ads Administration • Quality and Safety • Security • Recordkeeping • Legal / Compliance • R&D • Purposes Disclosed at Collection • Legitimate Business Purposes	After no longer needed for the processing purpose(s) or after a maximum of 50 months of non-activity unless required by law or contract to retain. Data necessary to suppress communications to opted out consumers may be retained further.
3. Personal Characteristics or Traits	General Demographics & Psychographics, Data About Children, Inferred Information, Health-related information	Disclosures for Business Purposes: • Business Vendors • Marketing Vendors • Affiliates and Related Entities Sale/Sharing: Third-Party Digital Businesses and Retail Partners	• Products / Services • Customer Management • Customer service / communications • Payment / financial • Serving ads • Ads Administration • Quality and Safety • Security • Recordkeeping • Legal/Compliance • R&D • Purposes Disclosed at Collection • Legitimate Business Purposes	After no longer needed for the processing purpose(s) or after a maximum of 50 months of non-activity.
4. Customer Account Details / Commercial Information	General Demographics & Psychographics, Transaction and Commercial Information, Online & Technical Information	Disclosures for Business Purposes: • Business Vendors • Marketing Vendors • Affiliates and Related Entities Sale/Sharing: Third-Party Digital Businesses and Retail Partners	• Products/Services • Customer Management • Customer Service/Communications • Payment/Financial • Serving Ads • Ads Administration • Quality and Safety • Security • Recordkeeping • Legal/Compliance • R&D • Purposes Disclosed at Collection • Legitimate Business Purposes	After no longer needed for the processing purpose(s) or after a maximum of 50 months of non-activity.
5. Biometric Information	Biometric Information	Disclosures for Business Purposes: • Business Vendors • Affiliates and Related Entities Sale/Sharing: N/A	• Products/Services • Customer Management • Customer Service/Communications • Quality and Safety • Security • Recordkeeping • Legal/Compliance • R&D • Purposes Disclosed at Collection • Legitimate Business Purposes	After no longer needed for the processing purpose(s) unless required to retain for legal or regulatory compliance.
6. Internet/App Usage Information	Transaction and Commercial Information, Online & Technical Information, Smart Devices and Sensor Data	Disclosures for Business Purposes: • Business Vendors • Marketing Vendors • Affiliates and Related Entities Sale/Sharing: Third-Party Digital Businesses	• Products/Services • Customer Management • Customer Service/Communications • Payment/Financial • Serving Ads • Ads Administration • Quality and Safety • Security • Recordkeeping • Legal/Compliance • R&D • Purposes Disclosed at Collection • Legitimate Business Purposes	After no longer needed for the processing purpose(s) or after a maximum of 50 months of non-activity unless required by law or contract to retain.
7. Location Data	Imprecise Location Data, Precise Geolocation Data	Disclosures for Business Purposes: • Business Vendors • Marketing Vendors • Affiliates and Related Entities Sale/Sharing: N/A	• Products/Services • Customer Management • Customer Service/Communications • Payment/Financial • Serving Ads • Ads Administration • Quality and Safety • Security • Recordkeeping • Legal/Compliance • R&D • Purposes Disclosed at Collection • Legitimate Business Purposes	After no longer needed for the processing purpose(s) or after a maximum of 50 months of non-activity.
8. Audiovisual and Similar Information	Audio Visual Information, Smart Devices and Sensor Data	Disclosures for Business Purposes: • Business Vendors • Affiliates and Related Entities Sale/Sharing: N/A	• Products/Services • Customer Management • Customer Service/Communications • Payment/Financial • Quality and Safety • Security • Recordkeeping • Legal/Compliance • R&D • Purposes Disclosed at Collection • Legitimate Business Purposes	After no longer needed for the processing purpose(s) or after a maximum of 50 months of non-activity unless required by law or contract to retain.
9. Professional or Employment Information	General Demographics & Psychographics	Disclosures for Business Purposes: • Business Vendors • Affiliates and Related Entities Sale/Sharing: Third-Party Digital Businesses	• Products/Services • Customer Management • Customer Service/Communications • Payment/Financial • Serving Ads • Ads Administration • Quality and Safety • Security • Recordkeeping • Legal/Compliance • R&D • Purposes Disclosed at Collection • Legitimate Business Purposes	After no longer needed for the processing purpose(s) unless required by law or contract to retain.
10. Non-public Education Records	Not applicable in non-HR contexts (which are not within the scope of this notice)	Not applicable in non-HR contexts (which are not within the scope of this notice)	Not applicable in non-HR contexts (which are not within the scope of this notice)	Not applicable in non-HR contexts (which are not within the scope of this notice)
11. Inferences from Collected Information	General Demographics & Psychographics, Inferred Information	Disclosures for Business Purposes: • Business Vendors • Marketing Vendors • Affiliates and Related Entities Sale/Sharing: Third-Party Digital Businesses and Retail Partners	• Products/Services • Customer Management • Customer Service/Communications • Payment/Financial • Serving Ads • Ads Administration • Quality and Safety • Security • Recordkeeping • Legal/Compliance • R&D • Purposes Disclosed at Collection • Legitimate Business Purposes	After no longer needed for the processing purpose(s) or After no longer needed for the processing purpose(s) or after a maximum of 50 months of non-activity unless required by law or contract to retain.

Sensitive Personal Data

Category of Sensitive Personal Data	Examples of Sensitive Personal Data Types within Category	Categories of Recipients	Processing Purposes	Retention Period
1. Financial Information & Account Credentials allowing access to an account	Financial Information. In addition, we may store your P&G account logins in combination with a password in our systems.	Disclosures for Business Purposes: • Business Vendors • Affiliates and Related Entities Sale/Sharing: N/A	• Products/Services • Customer Management • Customer Service/Communications • Payment/Financial • Serving Ads • Ads Administration • Quality and Safety • Security • Recordkeeping • Legal/Compliance • R&D • Purposes Disclosed at Collection • Legitimate Business Purposes	After no longer needed for the processing purpose(s) or after a maximum of 50 months of non-activity unless required by law or contract to retain or dispose of prior.
Physical & Mental Health Data	Physical and Mental Health data / condition / information that we may ask a consumer in connection with a research study or survey. It also includes information collected when consumer contacts us to report a complaint or an adverse occurring in connection with one of our products.	Disclosures for Business Purposes: • Business Vendors • Affiliates and Related Entities Sale/Sharing: N/A	• Products/Services • Customer Management • Customer Service/Communications • Serving Ads • Ads Administration • Quality and Safety • Security • Recordkeeping • Legal/Compliance • R&D	After no longer needed for the processing purpose(s).
Precise Geolocation Data	Precise geolocation data	Disclosures for Business Purposes: • Business Vendors • Marketing Vendors • Affiliates and Related Entities Sale/Sharing: N/A	• Products/Services • Customer Management • Customer Service/Communications • Payment/Financial • Serving Ads • Ads Administration • Quality and Safety • Security • Recordkeeping • Legal/Compliance • R&D • Purposes Disclosed at Collection • Legitimate Business Purpose	After no longer needed for the processing purpose(s).
Racial or Ethnic Origin	General Demographics & Psychographics	Disclosures for Business Purposes: • Business Vendors • Marketing Vendors • Affiliates and Related Entities Sale/Sharing: • Business Vendors • Marketing Vendors	• Products/Services • Customer Management • Customer Service/Communications • Payment/Financial • Serving Ads • Ads Administration • Quality and Safety • Security • Recordkeeping • Legal/Compliance • R&D • Purposes Disclosed at Collection • Legitimate Business Purposes	After no longer needed for the processing purpose(s) or after a maximum of 50 months of non-activity unless required by law to retain.
Processing of Biometric Information for the purpose of uniquely identifying a consumer	Not applicable	Not applicable	Not applicable	Not applicable
Personal Data Concerning a Consumer’s Health *This personal data would not include health diagnostic information but is related to demographic or purchase data that may help us determine which products you may be interested in.	Health-related Information	Disclosures for Business Purposes: • Business Vendors • Affiliates and Related Entities Sale/Sharing: Third-Party Digital Businesses and Retail Partners (in jurisdictions where the law permits)	• Products/Services • Customer Management • Customer Service/Communications • Payment/Financial • Serving Ads • Ads Administration • Quality and Safety • Security • Recordkeeping • Legal / Compliance • R&D • Purposes Disclosed at Collection • Legitimate Business Purposes	After no longer needed for the processing purpose(s) or after a maximum of 50 months of non-activity unless required by law to retain.
Inferences from Collected Information	Racial or Ethnic Origin General Demographics & Psychographics	Disclosures for Business Purposes: • Business Vendors • Marketing Vendors • Affiliates and Related Entities	• Products/Services • Customer Management • Customer Service/Communications • Serving Ads • Ads Administration • Quality and Safety • Purposes Disclosed at Collection • Legitimate Business Purposes	After no longer needed for the processing purpose(s) and deleted within a maximum of 24 hours after collection.

We also may disclose each category of personal data and sensitive personal data in the table to the following categories of recipients in a manner that does not constitute Sale or Sharing:

• The Consumer or to other parties at your direction or through your intentional action

• Recipients to whom personal data is disclosed for legal and similar reasons

• In addition, our Vendors and the other recipients listed in the above table may, subject to contractual restrictions imposed by us and/or legal obligations, also use and disclose your personal data for business purposes. For example, our Vendors and the other categories of recipients listed in the table above may engage subcontractors to enable them to perform services for us or process for our business purposes.

Consumer Rights Requests

As described in further detail below, subject to meeting the requirements for a Verifiable Consumer Request (defined below), we provide Consumers – which are, for clarity, residents of certain states – the privacy rights described in this section. For residents of states without Consumer privacy rights, we will consider requests but will apply our discretion in how we process such requests. For states that have passed consumer privacy laws, but are not yet in effect, we will also consider applying state law rights prior to the effective date of such laws but will do so in our discretion.

Making a Request and Scope of Requests

As permitted by the U.S. Privacy Laws, certain requests you submit to us are subject to an identity verification process (“Verifiable Consumer Request”) as described below in the “Verifying Your Request” section below. We will not fulfill such requests unless you have provided sufficient information for us to reasonably verify you are the Consumer about whom we collected personal information.

To make a request, please submit your request to us by one of the methods below. For further instructions on how to submit a Do Not Sell/Share/Target request, for non-cookie PI (as defined below), please go to the “Do Not Sell/Share/Target” section below.

• Calling us at (877) 701-0404 
• Visiting our Preference Center (which can be reached by the “Your Privacy Choices” link in the footer of our websites or via the Settings menu in our mobile applications)

Some personal data we maintain about you is not sufficiently associated with enough of your other personal data for us to be able to verify that it is your particular personal data (e.g., clickstream data tied only to a pseudonymous browser ID). We do not include that personal data in response to those requests. If we deny a verified request, we will explain the reasons in our response. You are not required to create a password-protected account with us to make a Verifiable Consumer Request. We will use personal data provided in a Verifiable Consumer Request only to verify your identity or authority to make the request and to track and document request responses unless you also gave it to us for another purpose.

We will make commercially reasonable efforts to identify personal data that we collect, process, store, disclose, and otherwise use and to respond to your privacy requests. We will typically not charge a fee to fully respond to your requests; provided, however, we may refuse to act upon a request, if your request is excessive, repetitive, unfounded, or overly burdensome. If we determine that we may refuse a request, we will give you notice explaining why we made that decision.

Verifying Your Request

To help protect your privacy and maintain security, we take steps to verify your identity before granting you access to your personal data or considering your deletion request. Upon receipt of your request, we will send you a verification form by email or postal mail. To complete your request, please respond to the verification form when you receive it. To verify your identity, we may require you to provide any of the following information: Name, email address, postal address, or date of birth.

We will review the information provided as part of your request and may ask you to provide additional information via e-mail or other means as part of this verification process. We will not fulfill your Right to Know (Categories), Right to Know (Specific Pieces/Portability), Right to Delete, or Right to Correction request unless you have provided sufficient information for us to reasonably verify you are the Consumer about whom we collected personal data. The same verification process does not apply to opt-outs of Sale or Sharing, or limitation of sensitive personal data or special category data requests, but we may apply some verification measures if we suspect fraud.

The verification standards we are required to apply for each type of request vary. We verify your categories requests and certain deletion and correction requests (e.g., those that are less sensitive in nature) to a reasonable degree of certainty, which may include matching at least two data points provided by you with data points maintained by us, which we have determined to be reliable for the purpose of verifying you. For certain deletion and correction requests (such as those that relate to personal data that is more sensitive in nature) and for specific pieces requests, we apply a verification standard of reasonably high degree of certainty. This standard includes matching at least three data points provided by you with data points maintained by us, which we have determined to be reliable for the purpose of verifying you, and may include obtaining a signed declaration from you, under penalty of perjury, that you are the individual whose personal data is the subject of the request.

If we cannot verify you in respect of certain requests, such as if you do not provide the requested information, we will still take certain actions as required by certain U.S. Privacy Laws. For example:

• If we cannot verify your deletion request, we will refer you to this U.S. State Privacy Notice for a general description of our data practices.
• If we cannot verify your specific pieces request, we will treat it as a categories request.

Authorizing an Agent

You may designate an authorized agent to submit a request on your behalf by submitting a request in the manners described above. If you are an authorized agent who would like to make a request, the U.S. Privacy Laws require that we ensure that a request made by an agent is a Verifiable Consumer Request (except Do Not Sell/Share requests) and allow us to request further information to ensure that the Consumer has authorized you to make the request on their behalf. Generally, we will request that an agent provide proof that the Consumer gave the agent signed permission to submit the request, and, as permitted under the U.S. Privacy Laws, we also may require the Consumer to either verify their own identity or directly confirm with us that they provided the agent permission to submit the request. To make a request as an authorized agent on behalf of a Consumer, click here.

Appeal Rights

You may appeal a denial of your request by clicking here.

Right to Know/Access

Right to Know–- Categories Request

You have the right to request, twice in a 12-month period, the following information about the personal information we have collected about you during the past 12 months:

• the categories of personal information we have collected about you;
• the categories of sources from which we collected the personal information;
• the business or commercial purposes for which we collected or sold the personal information;
• the categories of third parties to whom we sold or shared the personal information, by category or categories of personal information for each category of third parties to whom the personal information was sold or shared;
• the categories of personal information about you that we disclosed for a business purpose, and the categories of persons to whom disclosed that information for a business purpose.

Right to Know–- Specific Pieces

You have the right to request a transportable copy of the specific pieces of personal data we collected about you in the 12-month period preceding your request. Please note that personal data is retained by us for various time periods, so there may be certain information that we have collected about you that we do not even retain for 12 months (and thus, it would not be able to be included in our response to you). Please also note that you may be limited under your applicable state’s law to making a certain number of “right to know” requests in any 12-month period.

Right to Delete

In addition, you have the right to request that we delete certain personal information we have collected from you. Please understand that P&G cannot delete personal data in those situations where our retention is required for our own internal business purposes or otherwise permitted by relevant U.S. Privacy Laws (such as fraud prevention or legal compliance). In these situations, we will retain your personal data in accordance with our records retention program and securely delete it at the end of the retention period.

Right to Correct

You have the right to request that we correct inaccuracies that you find in your personal data maintained by us. Your request to correct is subject to our verification (discussed above) and the response standards in the applicable U.S. Privacy Laws.

Right to Limit Sensitive Personal Data Processing

Certain personal data qualifies as “sensitive personal data” or “sensitive personal information” or “special category data” under U.S. Privacy Laws, which we refer to in this U.S. State Privacy Notice as “sensitive personal data or special category data”. Some U.S Privacy Laws require consent for the processing of sensitive personal data or special category data, which can be revoked, subject to certain exceptions and exemptions (for example, if the processing of your sensitive personal data or special category data is required to provide a product or service specifically requested by you). Depending on your state of residence, you have the right to revoke such consent, if applicable, and/or direct businesses to limit their use and disclosure of sensitive personal data or special category data if they use or disclose it beyond certain internal business purposes. You can make a request using the methods set forth above.

Rights as to Automated Decision-Making and Profiling

You have the right to opt-out of profiling in furtherance of decisions that produce legal or similarly significant effects. However, as discussed above , we do not carry out profiling or automated decision-making activities in a manner that requires us to provide opt-out rights.

Do Not Sell/Share/Target

Under the various U.S. Privacy Laws, Consumers have the right to opt-out of certain processing activities. Some states have opt-outs specific to Targeted Advertising activities – which California’s law refers to as “cross-context behavioral advertising”, and others simply as Targeted Advertising – which involve the use of personal data from different businesses or services to target advertisements to you. California provides Consumers the right to opt-out of Sharing, which includes providing or making available personal information to third parties for such Targeted Advertising activities, while other states provide Consumers the right to opt-out from processing personal information for Targeted Advertising more broadly. There are broad and differing concepts of the Sale of personal data under the various U.S. Privacy Laws, all of which at a minimum require providing or otherwise making available personal data to a third party.

When you provide us personal data for the below Processing Purposes, we may use some or all of that personal data to advertise to you. This may include making available your personal data collected during these Processing Purposes to third parties in way that may constitute a Sale and/or Sharing, as well as using your personal data for purposes of Targeted Advertising.

• Products/Services.

• Customer Management.

• Customer Service/Communications,

• Serving Ads.

• Ads Administration,

• Purposes Disclosed at Collection

Third-Party digital businesses, including online platforms (Google, Amazon, Facebook, etc.) and AdTech companies such as Demand Side Platforms which help us place advertisements (“Third-Party Digital Businesses”) may associate cookies and other tracking technologies that collect personal data about you on our apps and websites, or otherwise collect and process personal data that we make available about you, including digital activity information. Giving access to personal data on our websites or apps, or otherwise, to Third-Party Digital Businesses could be deemed a Sale and/or Sharing and could implicate processing for purposes of Targeted Advertising under some U.S. Privacy Laws. Therefore, we will treat such personal data collected by Third-Party Digital Businesses (e.g., cookie ID, IP address, and other online IDs and internet or other electronic activity information) as such, and subject to the opt-out requests described above. In some instances, the personal data we make available about you is collected directly by such Third-Party Digital Businesses using Tracking Technologies on our websites or apps, or our advertisements that are served on third-party sites (which we refer to as “cookie PI”). However, certain personal data which we make available to Third Party Digital Businesses is information that we have previously collected directly from you or otherwise about you, such as your email address (which we refer to below as “non-cookie PI”).

When you opt-out pursuant to the instructions below, it will have the effect of opting you out of Sale, Sharing, and Targeted Advertising, such that our opt-out process is intended to combine all of these state opt-outs into a single opt-out. Instructions for opting out are below. Please note that there are distinct instructions for opting out of cookie PI and non-cookie PI, which we explain further, below.

Opt-out for non-cookie PI: If you would like to submit a request to opt-out of our processing of your non-cookie PI (e.g., your email address) for Targeted Advertising, or opt-out of the Sale or Sharing of such data, make an opt-out request here.

Opt-out for cookie PI: If you would like to submit a request to opt-out of our processing of your cookie PI for Targeted Advertising or opt-out of the Sale/Sharing of such personal data, you need to exercise a separate opt-out request on our cookie management tool. To do so, click “Do Not Sell or Share My Personal Information / Opt-Out of Targeted Advertising” in the footer of each of our websites and/or in the Settings menu of each of our mobile applications.  Then follow the instructions for the toggle. This is because we have to use different technologies to apply your opt-outs of cookie PI and of non-cookie PI. Our cookie management tool enables you to exercise such an opt-out request and enable certain cookie preferences on your device.

You must exercise your preferences separately on each of our websites that you visit, within each of our mobile applications that you use, if you use a different browser than the one on which you originally opted out, and on each device that you use. Since your browser opt-out is designated by a cookie, if you clear or block cookies, your preferences will no longer be affective, and you will need to enable them again via our cookie management tool.

For more information about how we have shared your personal data with third parties such that it constitutes a “Sale” or “Share” under CCPA during the 12-month period prior to the date this privacy policy was last updated, please refer to the chart above. We do not knowingly Sell or Share personal data of minors older than 13 years of age and under 16 years of age without their consent.

Global Privacy Control (“GPC”)

Some of the U.S. Privacy Laws require businesses to process GPC signals, which is referred to in some states as opt-out preference signals and in other states as universal opt-out mechanisms. GPC is a signal sent by a platform, technology, or mechanism, enabled by individuals on their devices or browsers, that communicate the individual’s choice to opt-out of the Sale and Sharing of personal data, or of processing of personal data for Targeted Advertising. To use GPC, you can download an internet browser or a plugin to use on your current internet browser and follow the settings to enable the GPC. We have configured the settings of our consent management platform to receive and process GPC signals on our website and mobile applications, which is explained by our consent management platform here.

Certain of the U.S. Privacy Laws require us to explain how we process GPC signals in detail, specifically how we apply GPC signals and the corresponding Do Not Sell/Share/Target requests to online data (what we refer to above as “cookie PI”) and offline data (what we refer to above as “non-cookie PI”). Below we explain the scenarios in which we apply the Do Not Sell/Share/Target requests communicated by GPC signals to cookie PI and, where applicable, to non-cookie PI:

• When you are visiting our website on a particular internet browser (“browser 1”), we will apply the GPC signal and corresponding Do Not Sell/Share/Target to cookie PI collected on that browser 1.

• When you log in on browser 1: We will be able to apply the GPC signal and corresponding Do Not Sell/Share/Target request to non-cookie PI associated with your user account, but only if and after you have logged into your user account on browser 1.

When you visit our website on a different browser (“browser 2″). If you later visit our website on browser 2 (whether on the same device or a different device) and GPC is not enabled, we are unable to apply the prior GPC signal from browser 1 to cookie PI on browser 2, unless and until you login to your user account on browser 2. We will continue to apply the Do Not Sell/Share/Target opt-outs communicated via the GPC signal on browser 1.

We process GPC signals in a frictionless manner, which means that we do not: (1) charge a fee for use of our service if you have enabled GPC; (2) change your experience with our website if you use GPC; or (3) display a notification, pop-up, text, graphic, animation, sound, video, or any interstitial in response to the GPC.

Incentive and Loyalty Programs; Right to Non-Discrimination

Loyalty/Incentive Programs Notice

We also collect and use your personal data to administer and maintain Rewards Programs (defined above in “How We Gather & Use Personal Data”), which may be considered a “financial incentive” or a “bona fide loyalty program” under one or more of the U.S. Privacy Laws.

We use all categories of personal data disclosed in the above table, excluding “biometric information,” “professional or employment information, and “non-public education records,” to administer and maintain such Rewards Programs. All categories of personal data we use for loyalty programs may also be Sold or processed for Targeted Advertising. We may also use, Sell, and process for Targeted Advertising the categories of sensitive personal data or special category data: account information and credentials, precise geolocation data, racial or ethnic origin, and personal data concerning health. While we may collect sensitive personal data or special category data in relation to some Rewards Programs, the collection and processing of sensitive personal data or special category data is not required to participate in Rewards Programs. We use personal data to verify your identity, offer unique rewards, track your program status, and to facilitate the exchange of program points for products, promotional materials, training workshops, and other items. The categories of third parties that will receive personal data and sensitive personal data or special category data are set forth in the table above, some of which may qualify as data brokers under some of the U.S. Privacy Laws. Some U.S. Privacy Laws require us to state whether we provide Rewards Programs benefits through third-party partners; however, while we sometimes will provide you the opportunity to independently engage with third parties through our websites or apps, third parties do not provide Rewards Programs on our behalf.

You can opt-in to a Rewards Program by signing up on the applicable rewards page. If you opt-in to participate in any of our Rewards Programs, you may withdraw from participation at any time by contacting us using the contact details in this Privacy Policy or in accordance with the instructions set forth in the applicable Rewards Program’s terms and conditions.

Under certain U.S. Privacy Laws, you may be entitled to be informed as to why financial incentive programs, or price or service differences, are permitted under the law, including (i) a good-faith estimate of the value of your personal data that forms the basis for offering the financial incentive or price or service difference, and (ii) a description of the method we used to calculate the value of your personal data. Generally, we do not assign monetary or other value to personal data. However, in the event we are required by law to assign such value in the context of Rewards Programs, or price or service differences, we have valued the personal data collected and used as being equal to the value of the discount or benefit provided, and the calculation of the value is based upon a practical and good-faith effort often involving the (i) categories of personal data collected (e.g., names, email addresses), (ii) the use of such personal data for our marketing and business purposes in accordance with this Privacy Policy and our Rewards Programs, (iii) the discounted price offered (if any), (iv) the volume of consumers enrolled in our Rewards Programs, and (v) the product or service to which the Rewards Programs, or price or service differences, applies. The disclosure of the value described herein is not intended to waive, nor should be interpreted as a waiver to, our proprietary or business confidential information, including trade secrets, and does not constitute any representation with regard to generally accepted accounting principles or financial accounting standards. We deem the value of the personal data to be reasonably related to the value of the rewards, and by subscribing to these Rewards Programs you indicate you agree. If you do not, do not subscribe to the Rewards Programs.

Non-Discrimination

You have the right not to receive discriminatory treatment for the exercise of your privacy rights described in this U.S. State Privacy Notice. We will not deny, charge different prices for, or provide a different level or quality of goods or services in a manner that is prohibited by the U.S. Privacy Laws if you choose to exercise your rights. Please note, however, that you will no longer be able to participate in Rewards Programs request to delete personal data. This is because we need the personal data collected in relation Rewards Program to carry out the functions described above.

California Consumer Request Metrics

Click here to see request metrics from the previous calendar year.

Other California Notices

California Notice for Minors

We may offer interactive services which allow teens under the age of 18 to upload their own content (e.g., videos, comments, status updates, or pictures). This content can be removed or deleted any time by following the instructions on our sites. If you have questions about how to do this, contact us. Be aware that such posts may have been copied, forwarded, or posted elsewhere by others and we are not responsible for any such actions. You will, in such cases, have to contact other site owners to request removal of your content.

California Shine the Light

We provide California residents with the option to opt-out to sharing of “personal information,” as defined by California’s “Shine the Light” law, with third parties (other than with Company affiliates) for such third parties’ own direct marketing purposes. California residents may exercise this opt-out, request information about our Shine the Light law compliance, and/or obtain a disclosure of third parties we have shared information with and the categories of information shared. To do so contact us at 1 Procter & Gamble Plaza, Cincinnati, OH 45202, U.S.A. (Attn: Privacy). You must put the statement “Shine the Light Request” in the body of your correspondence. In your request, please attest to the fact that you are a California resident and provide a current California address for your response. This right is different than, and in addition to, CCPA rights, and must be requested separately. We are only required to respond to one request per Consumer each year. We are not required to respond to requests made by means other than through the provided mail address. We will not accept Shine the Light requests by telephone or by fax, and are not responsible for requests not labeled or sent properly, or that are incomplete.

EEA, UK, Switzerland, and Serbia Privacy

This section includes information that is required to be disclosed in respect of our processing of personal data of EEA country, UK, Swiss and Serbian residents. It aims to provide increased transparency into our processing, retention, and transfer of EEA, UK, Swiss and Serbian residents personal data that is in line with the letter and spirit of the General Data Protection Regulation (“GDPR”), the Swiss Federal Act on Data Protection, the Serbian Law on Personal Data Protection and the GDPR as incorporated into UK law by the Data Protection Act 2018 and amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019. Certain information, such as the Entities and list of Data Controllers below. The retention periods described above, however, apply more broadly to personal data of residents of the states described above in the U.S. State Privacy Notice.

Entities

Different P&G entities may be the controller of your personal data. A data controller is the entity which directs the processing activity and is principally responsible for the data. The chart below identifies our data controllers for EEA country, UK and Serbian data. For example, when you register for email on one of our French websites, the P&G entity listed next to that country name will be the controller of that personal data (e.g., Procter & Gamble France SAS).

The data controller for the Smart Sleep Coach application is P&G Baby Care Digital LLC, located at One Procter & Gamble Plaza, Cincinnati, Ohio, 45202.

Countries	Data Controller
Austria	Procter & Gamble Austria – Zweigniederlassung der Procter & Gamble GmbH, Wiedner Gürtel 13, 100 Wien
Belgium	Procter & Gamble Distribution Company (Europe) BV For P&G Healthcare: P&G Health Belgium BV, Temselaan 100, 1853 Strombeek-Bever
Bulgaria	Procter & Gamble Bulgaria EOOD, Sofia 1404, Bd. Bulgaria nr. 69, Bulgaria
Croatia	Procter & Gamble d.o.o. za trgovinu, Bani 110, Buzin, 10010 Zagreb, Croatia
Czech Republic	Procter & Gamble Czech Republic s.r.o., 269 01 Rakovnik, Ottova 402, Czech Republic
Denmark	Procter & Gamble Danmark ApS Stensmosevej 15, stuen. 2620 Albertslund, Denmark
Estonia	Procter & Gamble International Operations SA, Route de Saint-Georges 47 1213 PETIT-LANCY Geneve
Finland	Procter & Gamble Finland Oy, Lars Sonckin Kaari 10, 02600 ESPOO, Finland
France	Procter & Gamble France SAS For P&G HealthCare: P&G Health France SAS 163/165 quai Aulagnier, 92600 Asnières-sur-Seine
Germany	Procter & Gamble Service GmbH, Sulzbacher Strasse 40, 65824 Schwalbach am Taunus For P&G Health: P&G Health Germany GmbH, Sulzbacher Strasse 40, 65824 Schwalbach am Taunus
Greece	P&G Hellas Ltd. 49 Ag. Konstantinou str., 15124 Maroussi – Athens, Greece
Hungary	Procter & Gamble Magyarország Nagykereskedelmi Kkt., 1097 Budapest, Könyves Kálmán krt. 34., Hungary
Ireland	Procter & Gamble UK, The Heights, Brooklands, Weybridge, Surrey KT13 0XP
Italy	Procter & Gamble Srl, viale Giorgio Ribotta 11, 00144 Roma
Latvia	Procter & Gamble International Operations SA, Route de Saint-Georges 47 1213 PETIT-LANCY Geneve
Lithuania	Procter & Gamble International Operations SA, Route de Saint-Georges 47 1213 PETIT-LANCY Geneve
Netherlands	Procter & Gamble Nederland B.V., Watermanweg 100, 3067-GG Rotterdam New address as of April 27, 2020: Weena 505, 3013 AL Rotterdam
Norway	Procter & Gamble Norge AS Visiting address: Nydalsveien 28, 0484 Oslo Postal address: Postboks 4814, 0422 Oslo
Poland	Procter and Gamble DS Polska sp z o.o., ul. Zabraniecka 20, 03-872 Warszawa, Poland
Portugal	Procter & Gamble Portugal, Productos de Consumo Higiene de Saúde, S.A., S.A. Edificio Alvares Cabral 3º, Quinta da Fonte, 2774-527 Paço D’Arcos, Portugal
Romania	For contests: Procter & Gamble Distribution SRL, 9-9A Dimitrie Pompei Blvd., Building 2A, District 2, Bucharest 020335, Romania For other sites: Procter & Gamble Marketing Romania SR, 9-9A Dimitrie Pompei Blvd., Building 2A, District 2, Bucharest 020335, Romania
Serbia	Procter & Gamble Doo Beograd, Španskih boraca 3, 11070 Novi Beograd, Belgrade, Serbia
Slovakia	Procter & Gamble, spol. s.r.o., Einsteinova 24, 851 01 Bratislava, Slovakia
Spain	Procter & Gamble España, S.A.U., Avenida de Bruselas, 24, 28108 Alcobendas, Madrid, Spain
Sweden	Procter & Gamble Sverige AB Visiting address: Telegrafgatan 4, 169 72 Solna, Sweden Postal address: Box 27303, 102 54 Stockholm
United Kingdom	Procter & Gamble UK Seven Seas Limited, The Heights, Brooklands, Weybridge, Surrey KT13 0XP

Brasil Privacy

Procter & Gamble Industrial e Comercial Ltda., registered under CNPJ No. 59.104.760/0001-95, headquartered at Avenida Dr. Chucri Zaidan, No. 296, floors 24-026-27, São Paulo/SP, ZIP code 04583-110, acting as Controller and in compliance with Federal Law No. 13.709/2018 (“General Data Protection Law” or “LGPD”), as well as other applicable regulations, informs Data Subjects that the personal data provided will be processed, stored, and handled according to the purposes described in the Privacy Policy (“Policy”).

This addendum is an integral and essential part of the referenced Privacy Policy.

Rights of Data Subjects

Conforme As established by applicable law, you may exercise the following rights regarding your Personal Data:

• Confirmation and access: You may request confirmation of processing and access to your Personal Data processed by P&G.
• Correction: You may request the correction of Personal Data that is incomplete, inaccurate, or outdated.
• Anonymization, blocking, or deletion: You may request anonymization, blocking, or deletion of Personal Data that is unnecessary, excessive, or processed in non compliance with the LGPD.
• Deletion of data processed based on consent: If processing is based on consent, you may request deletion of the Personal Data, except in cases of mandatory preservation under law or regulation.
• Data portability: You may request the portability of your Personal Data to another service or product provider, subject to ANPD rules and P&G’s commercial and industrial secrets.
• Information about data sharing: You may request information about public and private entities with whom P&G has shared your Personal Data.
• Information about the option to refuse consent: When consent is the applicable legal basis, we will inform you about the possibility of refusing to provide Personal Data and the consequences for using our products or services.
• Revocation of consent: You may revoke consent at any time through express communication.
• Objection to processing: You may object to processing carried out under legal bases other than consent if you identify non-compliance with the LGPD.
• Review of automated decisions: You may request the review of decisions made solely based on automated processing that affect your interests, subject to P&G’s commercial and industrial secrets.
• Petition to the ANPD: You may lodge complaints with the ANPD regarding the processing of your Personal Data.

For security reasons, when receiving your request, we may need to verify your identity before responding. Verification may include asking for additional information to prevent fraud and ensure that Personal Data is not disclosed to unauthorized individuals. If you designate a third party to submit requests on your behalf, that person must present documentation authorizing them to act for you, such as a signed power of attorney.

In some cases, we may have legitimate reasons not to comply with a request, such as when disclosure would violate P&G’s or third-party trade secrets, or when anonymization, blocking, or deletion cannot be carried out due to legal or regulatory obligations or the need to preserve data for P&G’s or third-party rights defense. Some requests may not be answered immediately, but we commit to responding within a reasonable timeframe and always in accordance with applicable law.

To exercise any of these rights, the Data Subject may contact the Data Preference Center or the Data Protection Officer through the channel indicated below.

If you believe your rights are not being respected, you may submit a request to the ANPD.

International Data Transfers

If you are located in Brazil, and in accordance with Articles 33 et seq. of the LGPD and ANPD Resolution No. 19/2024, below are additional details on possible international transfers of your Personal Data:

Item	P&G Information
1. Method of transfer	The transfer is based on the Standard Contractual Clauses (SCCs) approved by the ANPD.
2. Duration of transfer	The transfer is continuous, lasting as long as the commercial relationship exists and for the period necessary to comply with legal obligations of Procter & Gamble Industrial e Comercial Ltda.
3. Specific purpose	• Cloud hosting and storage services; • Technology solutions and platforms; • Service providers; • Intragroup services among P&G group companies.
4. Destination country	Global.
5. Controller identification and contact	Procter & Gamble Industrial e Comercial Ltda., CNPJ 59.104.760/0001-95, Avenida Dr. Chucri Zaidan, No. 296, floors 24-026-27, São Paulo/SP, ZIP 04583-110. Data Protection Officer (DPO): Natalia Soares Email: privacidadebr@shared.pg.com Data Preference Center
6. Shared use and purpose	Personal Data is shared with technology service providers for system maintenance and technical support. To ensure operational efficiency and service consistency, P&G may share Personal Data among its group companies (parent company, subsidiaries, and affiliates).
7. Security responsibilities and measures	• Firewalls; • Intrusion detection and prevention systems; • Unique and complex passwords; • Encryption; • Employee training on data-processing obligations; • Incident and risk identification; • Restricted access to personal information; • Physical security measures, including safe storage of documents when not in use.
8. Data subject rights and methods of exercising them	Data Subjects may: • Confirm processing • Access their Personal Data • Request correction • Request anonymization/blocking/deletion • Request deletion of consent-based data • Request sharing information • Decline consent and understand consequences • Revoke consent • Request portability • Request review of automated decisions To exercise your rights, contact the Data Preference Center or email privacidadebr@shared.pg.com. You may also petition the ANPD if you cannot exercise your rights with P&G.

Data Protection Officer in Brazil

In accordance with Art. 41 of the LGPD and ANPD Resolution No. 18/2024, Procter & Gamble Industrial e Comercial Ltda. has appointed Natalia Soares as its Data Protection Officer (DPO), responsible for communication between the company, data subjects, and the ANPD.

You may write to the DPO at privacidadebr@shared.pg.com. This email is also designated for official communications with the ANPD.

Colombia Privacy

Procter & Gamble Colombia Ltda., with NIT. 800.000.946-4, address at Carrera 7 # 114-33, 12th floor, Bogotá D.C., with phone number: 601-5280000 and email address notifications.im@pg.com, acting as the Data Controller, and in compliance with articles 15 and 20 of the Constitution of Colombia, Law 1581 of 2012, Law 1266 of 2008, Decree 1377 of 2013, and Decree 1074 of 2015, informs all data subjects that the personal data provided will be processed in accordance with the purposes described in this privacy Policy https://privacypolicy.pg.com/es-co/.

Rights of the Owner of personal data residing in Colombia

In compliance with articles 15 and 20 of the Constitution of Colombia, Law 1581 of 2012, Law 1266 of 2008, Decree 1377 of 2013, and Decree 1074 of 2015, data subjects are informed that the personal data provided will be processed in accordance with the purposes described in this privacy policy. Likewise, it is informed that data subjects have the following rights: a) to know, update, and rectify their personal data regarding partial, inaccurate, incomplete, fractioned, misleading, or data whose processing is expressly prohibited or has not been authorized; b) to request proof of the authorization granted, unless expressly exempted as a requirement for processing; c) to be informed, upon request, of the use that has been given to their personal data; d) to file complaints with the Superintendence of Industry and Commerce for violations of Law 1581 of 2012 and other regulations that modify, add, or complement it; e) to revoke the authorization and/or request the deletion of the data when the processing does not comply with constitutional and legal principles, rights, and guarantees. The revocation and/or deletion will proceed when the Superintendence of Industry and Commerce has determined that the Data Controller or Processor have engaged in conduct contrary to this law and the Constitution; f) to access their personal data that have been subject to processing free of charge. The aforementioned rights may be exercised in accordance with the provisions set forth in this section and the privacy policy, which can be found at the following link: https://privacypolicy.pg.com/es-co/.

Authorization and form of collection of personal data

For the processing of personal data, Procter & Gamble Colombia Ltda. will obtain the prior, express, and informed consent of the data subject. This consent may be obtained through any means that can be consulted later and may be granted through different mechanisms enabled by Procter & Gamble Colombia Ltda., in writing, orally, or through the data subject’s unequivocal conduct.

The data subject’s consent will not be necessary when it concerns:

• Information required by a public or administrative entity in the exercise of its legal functions or by judicial order.
• Data of a public nature.
• Cases of medical or sanitary urgency.
• Processing of information authorized by law for historical, statistical, or scientific purposes.
• Data related to the Civil Registry of Persons.

Processing of personal data

Procter & Gamble Colombia Ltda uses personal data to fulfill the purpose of affecting and improving people’s lives, better understanding their interests and preferences as consumers and individuals. We use your information for the processing purposes designated in the privacy policy, which can be found at the following link: https://privacypolicy.pg.com/es-co/, and for the following purposes:

• Carrying out marketing, promotion, and/or advertising activities through different means such as personal visits to customers, marketing, and sending information by physical and electronic means.
• Providing customers with information that allows them to access offers, promotions, discounts, launches, and supplying information of interest (personalized attention, benefits, use, health care, and well-being, etc.).
• Fulfilling obligations contracted with customers, suppliers, and employees.
• Informing about changes to our products and/or services.
• Evaluating the quality of products and/or services and measuring customer satisfaction.
• Disseminating policies, programs, results, and organizational changes.
• Analyzing information for the development and implementation of commercial or marketing strategies, as well as designing, implementing, and developing programs, projects, and events.
• Contacting the data subject through calls, text messages, emails, and/or physical means for activities related to the authorized purposes.
• Electronic invoicing.
• Disclosing, transferring, and/or transmitting personal data within and outside the country to Procter & Gamble Colombia Ltda.’s parent companies, subsidiaries, or affiliates, or to third parties because of a contract, law, or lawful relationship requiring it or to implement cloud computing services, with the same limitations and rights.
• Transferring and/or transmitting sensitive personal data to competent public entities, either by virtue of a legal mandate or judicial or administrative order, on account of or suspicion of adverse events that Procter & Gamble Colombia Ltda. has become aware of, relating to technical claims or others.
• Knowing, storing, and processing all the information provided in one or more databases, in the format that Procter & Gamble Colombia Ltda. deems most convenient.
• Managing procedures (requests, complaints, claims).
• Sending information regarding the use and care of offered products, whether directly or through the data processor.
• The attention of requests, complaints or claims (PQR) related to the activity and/or products of P&G.

International Transfer and Processing of Personal Data

Procter & Gamble Colombia Ltda. carries out International Transfer of personal data to other parent companies, affiliates or subsidiaries or with service providers that may store, process or access the data, as a consequence of a contract, law or legal link that requires it. To carry out this process, Procter & Gamble Colombia Ltda. has verified that the transfer or transmission of personal data will be carried out to countries that meet the standards that guarantee an adequate level of protection of personal data, in accordance with the provisions of article 26 of Law 1581 of 2012 and section 3.2. of Chapter Three, of Title V of the Sole Circular of the Superintendence of Industry and Commerce.

Additionally, Procter & Gamble Colombia Ltda. may also carry out the Transmission of personal data through different management software whose servers are located in a country other than Colombian territory, the above in order to manage all the internal processes of Procter & Gamble Colombia Ltda. In any case, in addition to having express and unequivocal authorization from the Owner, Procter & Gamble Colombia Ltda. will ensure that the action provides adequate levels of data protection. and meets the requirements established in Colombia by the Habeas Data Regime.

Personal Data of Children and Adolescents

Procter & Gamble Colombia Ltda. may collect public data from children and adolescents for specific activities, always respecting the best interests of the minor and the prevailing rights of children and adolescents enshrined in article 44 of the Political Constitution of Colombia. For this purpose, Procter & Gamble Colombia Ltda. will have prior authorization granted by the guardian or parents of the minor.

In any case, personal data collected from children and adolescents will not be used for targeted advertising.

Attention to inquiries, complaints, revocation of authorization, updating, withdrawal, correction, or deletion of databases (generally known as “PQRS”).

The data subject, their successors, representatives, or anyone determined by stipulation in favor of another (generally known as the “Interested Party”) may exercise their rights by contacting us through written communication addressed to the customer service department.

The communication can be sent through one of the following channels:

• Email: to send an email click HERE
• Telephone: 01-800-917-0036
• Written communication submitted to Carrera 7 # 114-33, 12th floor, Bogotá D.C.
• Preference Center click HERE

Procedure for the exercise of queries, requests, complaints, revocation of authorization, updating, withdrawal, correction, or deletion of databases

Verification of the Data Subject’s identity and the content of any request

To help protect the privacy and security of the Data Subject, we take steps to verify their identity before responding to the request. Therefore, to address your request, we ask you to provide the Data Subject’s identification data:

• Full name.
• Identification number.
• Contact information (physical and/or electronic address and contact telephone numbers).
• Date of birth.

In the event that the request is submitted through our Preference Center, upon receiving your request, we will send a verification form via email. To complete the request, the Data Subject must respond to the verification form upon receipt.

Likewise, any other Interested Party who is not the Data Subject must prove their identity and their status as their successor in interest, representative, or the representation or stipulation in favor of another or for another.

For further reference on the aforementioned identity verification, please refer to the privacy policy located at the following link: https://privacypolicy.pg.com/es-co/

Taking into account the above, requests related to the processing of Personal Data must contain at least:

• The Data Subject’s identification data (full name, identification number, contact information, and date of birth).
• Accreditation of the Interested Party’s identity and status, if applicable (identification data and documents proving their identity and status as Interested Party).
• Means to receive a response to the request.
• Reasons and facts that give rise to the request.
• Documents intended to be invoked.
• Clear and precise description of the personal data regarding which the Data Subject seeks to exercise their right to complaint, request for rectification, updating, or deletion of their personal data (not applicable to the filing of inquiries).

Inquiry procedure

The Interested Party may submit a request indicating the information they wish to know, and in any case, inquiries will be answered within a maximum period of ten (10) business days from the date of receipt. If it is not possible to address the inquiry within said period, the Interested Party will be informed, before the expiration of the ten (10) business days, of the reasons for the delay and the date on which the inquiry will be addressed, which in no case may exceed five (5) business days following the expiration of the initial term.

Procedure for complaints, revocation of consent, withdrawal, correction, updating, or deletion of personal data

When the Data Subject considers that the processed information should be subject to correction, updating, or deletion, or when they become aware of the alleged breach of any of the duties contained in the Law, the Data Subject or another Interested Party may submit a complaint, request for rectification, updating, or deletion of their personal data.

If the complaint is incomplete, the Interested Party will be given a period of five (5) days following the receipt of the complaint to remedy any deficiencies. If two (2) months have passed since the date of the request without the applicant providing the requested information, it will be understood that they have withdrawn the complaint.

In the event that Procter & Gamble Colombia Ltda. receives a complaint that it is not competent to resolve, it will forward it to the appropriate authority within a maximum period of two (2) business days and inform the Data Subject.

The maximum period to address the complaint will be fifteen (15) business days from the day following the date of its receipt. If it is not possible to address the complaint within said term, the interested party will be informed of the reasons for the delay and the date on which their complaint will be addressed, which in no case may exceed eight (8) business days following the expiration of the initial term.

Modification of Policies

Procter & Gamble Colombia Ltda., reserves the right to modify this Personal Data Treatment and Protection Policy at any time. However, any modification will be communicated to the owners of the personal data through an efficient means and prior to its implementation.

In the event that a Personal Data Owner does not agree with the modification to the Data Processing Policy, the Owner may request Procter & Gamble Colombia Ltda. to withdraw or delete their personal data.

Validity

This policy is effective as of February 14, 2024, and was updated as March 10, 2025. Any updates once approved will be duly communicated to the Data Subjects.

The databases in which personal data will be registered will remain valid until you request the deletion of personal data or withdraw your consent. Otherwise, we will delete your personal data from our databases after they are no longer necessary for the purpose of the processing described in this section or after a maximum of 50 months of inactivity, unless the law or contract requires us to keep them for a longer period.

We define inactivity through various internal criteria that indicate a lack of interaction by a user with our programs and communications. For example, if you do not log in or do not open or click on our emails, we will consider you “inactive” and delete your data after a maximum of 50 months, but earlier for certain countries according to local legal requirements. We may need to retain some personal data to fulfill your requests, including continuing to keep you opted out of marketing emails or to comply with other legal obligations. We may also retain certain personal data used in ratings and reviews for as long as the review is used or until the product is discontinued.

Malaysia Privacy

This notice supplements the Global Privacy Policy above (the “Privacy Policy”).

Data Protection Officer

If you have any questions or concerns about your Privacy and our data protection practices, you can contact our Data Protection Officer using the following channels:

Email: MYDataprivacy@shared.pg.com

Phone: 03 7724 3200

Written Communication can be sent to: Procter & Gamble (Malaysia) Sdn Bhd, 10th Floor, Surian Tower, No. 1, Jalan PJU 7/3, Mutiara Damansara, 47810 Petaling Jaya, Selangor

Nigeria Privacy

Reporting a potential data breach to P&G

Personal data breach means a breach of security leading to the accidental, or unlawful, destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.

Confirmed or suspected data breaches should be reported promptly to P&G’s Data Protection Officer. All data breaches will be logged by the Data Protection Officer to ensure appropriate tracking of the types and frequency of confirmed incidents for management and reporting purposes.

An individual who wishes to complain about how their personal information may have been breached may lodge their complaint directly with the Data Protection Officer by email: nigeriadpo.im@pg.com.

The complaint should include:

• a detailed description of the security incident that caused the data breach,
• the type of personal data that was affected by the data breach,
• the identity of the affected person,
• and any other information that may be requested by the Data Protection Officer.

Any such complaints should be reported within 72 (seventy-two) hours of the occurrence of the suspected or confirmed data breach.

Reporting a data breach to the authorities

P&G will seek to report potential data breaches within 72 hours of knowledge of such breaches to the relevant authorities responsible for monitoring the security of personal data.

Saudi Arabia Privacy

This notice supplements the Global Privacy Policy above (the “Privacy Policy“). Terms which appear capitalized but ae not defined in the Policy or in the Notice have the meaning given under the Personal Data Protection Law promulgated by Royal Decree No. M/19, dated 09/02/1443H on 24 September 2021

Data Controller

Ismail Abudawood and Procter & Gamble Limited

Modern Products Company Limited

Categories of Personal Data & Legal Basis for Processing

In Saudi Arabia, ‘Sensitive Data’ includes personal information revealing racial or ethnic origin, or religious, intellectual, or political belief, data relating to security criminal convictions and offenses, biometric or Genetic Data for the purpose of identifying the person, Health Data, and data that indicates that one or both of the individual’s parents are unknown.

Our legal basis for processing personal data are set out in the Privacy Policy. Where we process Sensitive Data, we will always obtain explicit consent as required by law.

How We Collect Personal Data

When we collect personal data from third parties, we do so in accordance with the Privacy Policy and only to the extent permitted by applicable law.

How we Disclose Personal Data

When we disclose personal data to third parties, we do so in accordance with the Privacy Policy as well as the applicable requirements under the law.

International Transfers

We may transfer your personal data to countries outside Saudi Arabia as set out in the Privacy Policy above. When doing so, we are complying with all applicable requirements under applicable law to protect personal data transferred outside Saudi Arabia adequately. This includes transferring your data to countries that are recognized by the competent authority as adequately protecting personal data or implementing certain additional and appropriate safeguards to protect personal data (as required by applicable law).

Data Subject Rights

You have the right to access the personal data we hold about you, the right to request access to such personal data in a readable and clear format, the right to request correction of personal data where you believe it is inaccurate, and the right to request destruction of personal data (in certain circumstances). You may also withdraw your consent at any time where we are relying on your consent to process your personal data. To exercise your rights, click here or send us an email by clicking here.

If you are not happy with our response to your requests, you have the right to lodge a complaint with the data protection regulator, the Saudi Data & Artificial Intelligence Authority (“SDAIA”). You can contact SDAIA using the following details:

Website: https://sdaia.gov.sa

Phone: +966 11 223 2222

Vietnam Privacy

This Addendum forms part of the Consumer Privacy Policy. In the event of any conflict between this Addendum and the Privacy Policy, this Addendum shall prevail, but solely to the extent of the conflicting provision.

As a data subject, you have the rights related to your data as provided by Vietnam regulations, such as: right to be informed, to give and withdraw consent, requests for access, erasure, rectification/correction, provision, to restrict or object to personal data processing, to seek remedies under laws, to request relevant individuals/organizations/agencies to implement measures and solutions to protect your personal data under laws. You are obliged to provide complete and accurate personal data according to laws or contracts or when consenting to the processing of personal data, as well as other obligations according to applicable data privacy laws.

Some of the personal data we collect are considered sensitive personal data under applicable laws, which might include: race and ethnicity, location data of the individual identified through location services; other data that can directly or indirectly indicates your physical location such as IP address, Health-related Information, Bank Account Information, Biometric Information, Online Activity Monitoring Data, Images of Government-Issued IDs.

Please note that Legitimate Interest is not the only legal requirement for personal data processing in Vietnam, and we will seek your consent to process personal data unless other exceptions apply as provided by laws.

We only collect and process personal data of children under 16 years of age after we have obtained the consent of the children, if aged seven or older, and of their parent/legal guardian, unless otherwise provided by applicable laws.

We may process personal data within big data analytics systems for the processing purposes as specified in this Privacy Policy and/or the notice/consent form shared with you in specific circumstances. The processing of big data containing personal data means the processing of personal data on a large scale, with continuity, integrated from multiple sources, capable of analyzing behaviors, predicting trends, or classifying users. In case of a data breach, we will comply with all reporting and remedial obligations under applicable laws. Procter & Gamble Vietnam does not engage in any sale or purchase of personal data that is deemed unlawful under Vietnamese laws.

Ecuador Privacy

Procter & Gamble Ecuador Cía. Ltda., located at Baustista Boussingaul No. E10A and 6 de diciembre, Edificio T6, 2nd floor, Quito-Ecuador, phone number: +593 3922255, and email address privacypgecuador@shared.pg.com, acting as the Data Controller and in compliance with the Organic Law on Personal Data Protection (“LOPDP”) and its General Regulation (“Reglamento”), informs Data Subjects that any personal data provided will be processed according to the purposes described in this privacy policy https://privacypolicy.pg.com/-.

Personal data subject to processing will be stored in databases managed by Procter & Gamble Ecuador Cía. Ltda and/or affiliates of the business group.

Data Subjects are responsible for providing correct, complete, and updated data. If incorrect or inaccurate data is provided, or if the Data Subject refuses to provide personal data, Procter & Gamble Ecuador Cía. Ltda. will not be able to fulfill the purposes of processing established in the privacy policy.

Exercise of Rights and Requests by Data Subjects

The Data Subject or their duly authorized representative may exercise their rights, revoke consent, or submit requests by contacting us via email at privacypgecuador@shared.pg.com, which is the department responsible for personal data protection in Ecuador. Communications can be sent through the following channels:

•  Email: privacypgecuador@shared.pg.com.
•  Written communication to: Baustista Boussingaul No. E10A and 6 de diciembre, Edificio T6, 2nd floor, Quito-Ecuador.

Verification of the Data Subject’s Identity and Content of Requests or Claims

To help protect the privacy and security of the Data Subject, we take steps to verify their identity before responding to requests or claims. Therefore, to process your request, you must provide the following information:

• Full name;
• Identification number; and,
• Contact details (physical and/or electronic address).

If a third party, not the Data Subject, submits the request or claim, they must prove their identity and status as a representative.

Procedure for Exercising Rights

In compliance with the LOPDP, Data Subjects are informed that any personal data provided will be processed according to the purposes described in this privacy policy. Likewise, Data Subjects may exercise the following rights: a) access; b) rectification and updating; c) deletion; d) objection; e) portability; f) suspension; and, g) not to be subject to decisions based solely or partially on automated evaluations.

Requests to exercise rights must contain at least:

•  Full names and surnames;
•  Identity card or passport number;
• Home or email address for notifications;
• Clear and precise description of the personal data regarding which the rights are to be exercised, or any element or document that facilitates its location;
•  Clear and precise statement of what is being requested;
•  The right(s) to be exercised; and,
• Documents proving identity.

Requests for the exercise of rights of access, rectification and updating, deletion, and objection will be addressed within fifteen (15) days from receipt of the request. However, if the information provided needs to be expanded or clarified, the Data Subject may be asked to clarify or complete the request within five (5) days of receipt. In that case, the Data Subject will have ten (10) days from the day after notification to clarify or complete the request. If the Data Subject does not clarify or complete the request within the established time, it will be archived and notification will be given.

If the Data Subject believes their rights have been violated by the response provided, or if no response is received within the established period, a claim may be filed with the Data Protection Authority.

Direct Requests from the Data Subject

The Data Subject may submit inquiries, requests, petitions, complaints, or claims, which will be addressed within a maximum period of ten (10) business days from the date of receipt.

Notifications of Personal Data Security Breaches

Procter & Gamble Ecuador Cía. Ltda. will notify affected Data Subjects of personal data security breaches within three (3) days and the relevant authorities within five (5) days from the time the breach is known, unless such a security breach does not pose a risk to the rights and freedoms of Data Subjects.

Comments from Document Author

• There are comments indicating that some processes (such as manual DSR—Data Subject Rights—handling and security breach notifications) may have changed or no longer apply due to updated procedures for Ecuador.

Contact Us

Still have a question or concern? We’re here to help.

As indicated in this policy, the easiest way to submit requests regarding your personal data is through the Privacy Preference Center. You may also contact us directly with any questions or concerns you may have about your privacy and our data protection practices or if you are a consumer with a disability and need a copy of this notice in an alternative format. If you have an inquiry that is specific to our data protection officer, such as a suspected data breach, please indicate this in your message or email pgprivacyofficer.im@pg.com. You may also write to our Data Protection Officer at 1 Procter & Gamble Plaza, Cincinnati, OH 45202, U.S.A.

Art. 27 GDPR Representative:

The contact details of our Art. 27 GDPR representative in the UK and EU are as follows: Procter & Gamble Ireland, The Graan House, Units E1 and E14, Calmount Business Park, Dublin 12, Ireland