Privacy Agreement 

We may share information about you with certain third parties and affiliates, as described below, and as otherwise described in this Policy:

1. Service Providers and Contractors: We use affiliated and unaffiliated third-party service providers and contractors to help handle parts of our business because of their expertise, resources, or scale. They help us do things like fulfill requests, operate our Services, monitor activity on our Services, analyze use of our Services, maintain databases, administer and monitor emails, evaluate applications for employment and conduct background checks, and provide consulting services. Contractors may also assist us in hosting microsites and mobile websites where you may provide personal information about yourself and where they may observe information about you in the same way as described above (go to What information do we collect and how do we use it?).

2. Law Enforcement, Legal Disclosure and Emergency Response: We and our service providers may disclose personal information about you (a) if we are required or permitted to do so by law or legal process (such as a court order or subpoena); (b) in response to requests by courts or government agencies, such as law enforcement authorities; in the jurisdictions in which we or our service providers process your personable information; (c) to establish, exercise, or defend our legal rights; (d) when we believe disclosure is necessary or appropriate to prevent physical or other harm or financial loss; (e) in connection with an investigation of suspected or actual illegal activity; or (f) otherwise with your consent.

3. Sale, Merger, Transfer, or Similar Event: We reserve the right to share and/or transfer your information in the event we sell and/or transfer all or a portion of our business assets (including, without limitation, in the event of a prospective or completed merger, acquisition, joint venture, reorganization, dissolution or liquidation).

What choices do you have over how your information is used?

1. Email: You may remove yourself from the Victoria's Secret & Co. investor email list by following the removal instructions located at the bottom of each "E-mail Alert" or by completing the email alert unsubscribe form. If you would like to stop receiving job alert emails, you may similarly follow the unsubscribe link located at the bottom of each emails. Note that if you opt out of job alert emails from us, we may still send you operational or transactional email messages in connection with your application for employment (such as emails related to your application, updating your account information). Opting out of investor or job alert emails also will not automatically remove you from our brands’ marketing lists, such as Victoria's Secret, Victoria's Secret PINK or PINK Nation email list. If you have joined our Talent Community, you can unsubscribe from receiving email communications about jobs that may be of interest to you by clicking the unsubscribe link included in the Talent Community emails.

2. Cookies and Clear Gifs: You may view and specify your preferences over the use of cookie technologies on victoriassecretandco.com (our corporate information site) by selecting the Cookie Preferences button on the do not sell my personal information page. And you may do the same for careers.victoriassecret.com by accessing the cookie preferences gear control at the bottom right-hand corner of careers.victoriassecret.com. Note that your cookie preferences are specific to each of these two sites and address future cookie placement, only. You may also specify your preferences with respect to companies that participate in a centralized registry. Additionally, your browser may offer the ability to block or delete cookies from your device. Simply follow your browser's instructions on how to block and clear cookies. Please note that without cookies, you may not to be able to use all features of our Services.

3. Withdrawing an Employment Application: If at any time you wish to withdraw your application for employment, please log in to your account at careers.victoriassecret.com and select “Withdraw Your Application.” You may also withdraw your application by writing to us at:
   
   Human Resources
   Victoria’s Secret & Co.
   Four Limited Parkway
   Reynoldsburg, OH 43068
   US

4. Mobile Text Messages: If you are receiving mobile text messages, for example related to an application or employment opportunities, but you no longer wish to receive these text messages, simply reply STOP to any text message.Please note that these text messages are subject to Victoria’s Secret’s Text Message Terms and Conditions, which are expressly incorporated by reference.

5. Location Information: You may have the ability to turn location-based services on and off by adjusting the settings of your internet browser or mobile device.

We may require certain personal data for the purpose of verifying the identity of the individual making the request

How do we protect personal information?

We maintain administrative, technical and physical safeguards designed to protect the personal information we collect through our Services against accidental, unlawful destruction, loss, alteration, access, disclosure or use.

Our administrative safeguards include implementing, maintaining, and training employees on company privacy and information security policies and procedures.  Our physical and technical safeguards include maintaining physical security policies and standards to protect company systems and data, and a cybersecurity program overseen by executive leadership and the Victoria’s Secret & Co. board of directors.

Where is personal information stored and processed?
Our employees involved in data processing and our servers are based in Columbus, Ohio, US, and other locations throughout the United States. We work with affiliated and unaffiliated service providers in the United States, the United Kingdom, India, China, and other jurisdictions around the world. We and our service providers may disclose your personal data if we are required or permitted by applicable law or legal process, which may include lawful access by foreign courts, law enforcement or other government authorities in the jurisdictions in which we or our service providers operate.

Whom should you contact with questions or concerns?
If you have general questions about our Policy, please feel free to contact us by letter or email at:

ATTN: Privacy Matter
Victoria’s Secret & Co.
Four Limited Parkway
Reynoldsburg, OH 43068
US

How will we communicate updates to our Policy?

This Policy may be updated periodically to reflect changes in our personal information practices. Changes to the Policy will be posted on this page. For significant changes, we will notify you by posting a prominent notice on our Services indicating at the top of the Policy when it was most recently updated.

Supplemental Privacy Notice for California Residents

If you are a California resident, the information below (the “California Supplement") also applies to you, in addition to our Victoria’s Secret & Co. Privacy Policy. Certain terms used in this section have the meaning given to them in the California Consumer Privacy Act, as amended by the California Privacy Rights Act, California Civil Code § 1798.100 et seq., and its implementing regulations (collectively the “CCPA/CPRA”). For clarity, the information below applies to personal information we collect about California residents both on our Services and offline, such as in our corporate offices. This California Supplement does not apply to Victoria’s Secret personnel.

1. Collection and Disclosure of Personal Information

   We may collect (and may have collected during the 12-month period prior to the effective date of this Policy) the following categories of personal information about you to the following categories of third parties, as described below:

   Category of Personal Information Collected	Category of Third-Party, to Whom Information is Disclosed for a Business Purpose (as defined under the CCPA/CPRA)	Category of Third-Party, to Whom Information is Sold or Shared (for cross-context behavioral advertising purposes) (as each term is defined under the CCPA/CPRA)
   Identifiers (Personal) Including, for example, name, postal address, IP address, email address, telephone number or other similar identifiers)	• Analytics insights providers •Affiliated brands and entities •Data centers •Human resources service providers •Information security service providers •Vendors who provide services on our behalf	Not Applicable
   Additional Data Subject to Cal. Civ. Code § 1798.80 Characteristics of protected classifications under California or federal law, such as race, and military and veteran status	•Human resources service providers	Not Applicable
   Online Activity Including, for example, Internet and other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding your interaction with our Services or other third-party websites or applications	• Analytics insights providers •Affiliated brands and entities •Contextual online experience provider •Data center •Fraud monitoring and prevention providers •Information security service provider •Technology administration and integrity providers (including for maintaining and improving networks; identifying problems; and fixing problems) •Vendors who provide services on our behalf	•Advertising technology providers (including online advertising) •Social media platforms
   Employment Information Including, for example, talent management information (e.g., resumé information, occupation details, education details, certifications and professional associations, historical compensation details, previous employment details, and pre-employment screening and background check information, including criminal records information	•Human resources service providers	Not Applicable
   Geolocation by consent for jobs available “nearby”	•Analytics insights providers •Data centers •Fraud monitoring and prevention providers •Human resources service providers •Information security service providers	Not Applicable
   Sensory Information Including, for example, photographs, video and audio recordings, and electronic or similar information	•Fraud monitoring and prevention providers • Information security service providers • Vendors who provide services on our behalf	Not Applicable
   Inferences Including, for example, inferences drawn from any of the information identified above to create a profile about you reflecting your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes	• Human resources service providers • Information security service providers • Vendors who provide services on our behalf	Not Applicable

2. Use of Personal Information

   We may use (and may have used during the 12-month period prior to the effective date of this Policy) personal information about you for the following business purposes specified in the CCPA/CPRA (supplementing the information described above in our Privacy Policy), such as:

   • Performing services, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing services, providing analytics services, providing storage or providing similar services 
   • Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance
   • Short-term, transient use, including, but not limited to, non-personalized advertising shown as part of your current interaction with us<
   • Helping to ensure security and integrity to the extent the use of your personal information is reasonably necessary and proportionate for these purposes
   • Debugging to identify and repair errors that impair existing intended functionality
   • Undertaking internal research for technological development and demonstration
   • Providing advertising and marketing services, except for cross-context behavioral advertising (which is addressed in the “Disclosures of Personal Information” section of this California Supplement)

3. Sensitive Personal Information

   We do not use or disclose (and have not used or disclosed during the 12-month period prior to the Last Updated date of this Privacy Policy) “sensitive personal information” (as defined under the CCPA/CPRA) for any purpose other than those expressly permitted under the CCPA/CPRA.

4. Retention of Personal Information

   We will retain your personal information for the period reasonably necessary to achieve the purposes outlined in this Supplement, unless a longer retention period is required or permitted by applicable law, taking into account relevant statutes of limitations and our records retention requirements and policies.

5. Sale or Sharing of Personal Information

   We do not sell your personal information in exchange for monetary consideration. We may disclose your personal information by allowing certain third parties to collect personal information via automated technologies on our Services for cross-context behavioral advertising purposes. Under California law, these kinds of disclosures may be considered a “sale” when the personal information is exchanged for non-monetary consideration, or “sharing” when the personal information is disclosed for cross-context behavioral advertising purposes. You have the right to opt out of these types of disclosures of your information.

   We do not have actual knowledge that we sell or share personal information of minors under 16 years of age.

6. California Privacy Rights

   You have the following rights noted in the What privacy rights do you have?section: Access, Correction, Deletion, and Opt-Out of Sale and Sharing. You also have the right to non-discrimination for exercising your of privacy rights.  you have additional choices regarding your personal information, as described below.

How to Submit a Request

To submit a request to exercise your privacy rights under the CCPA/CPRA as an applicant, contractor or former associate, please visit our Privacy webform. If you are submitting a request as an authorized agent on behalf of an applicant, contractor or former associate, on the form add your email address and information about the individual for whom you are submitting the request in the other required fields. To make a privacy request by phone, for applicants and contractors, call 1-888-873-2738 and for former associates, call 1-866-473-4728.

If you are a customer of Victoria’s Secret or to submit a request as an authorized agent on behalf of a consumer, you can submit a separate data subject request by visiting Victoria’s Secret Privacy Rights webform. Please add your name and phone number in the Request Details field and an indication that you are submitting the request as an authorized agent. For customers or to call as an authorized agent on behalf of a customer, call 1-800-411-5116.

To opt out of the sale or sharing of your personal information for victoriassecretandco.com, visit the Do Not Sell or Share My Personal Information webpage. To opt out of the sale or sharing of your personal information for careers.victoriassecret.com, visit the Do Not Sell or Share My Personal Information webpage.

Verifying Requests

To help protect your privacy and maintain security, we take steps to verify your identity before granting access to information or complying with a request. Upon submission, you will be required to provide your full name, date of birth, address, phone number. You will also be asked to verify the email address you submit with your request. You will receive an email from us with instructions on completing this step. You may also be asked to sign a declaration under penalty of perjury that you are the individual whose personal information is the subject of the request.

If you designate an authorized agent to make a request on your behalf, we may require you to provide the authorized agent written permission to do so and we may require you to verify your identity directly with us (as described above).

To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request.

Supplemental Privacy & Cookie Notice for Visitors from the European Economic Area

If you are accessing our Services from a member state of the European Economic Area ("EEA"), this Supplemental Privacy Notice (“Notice”) applies to you in addition to our Online Privacy Policy. This Supplemental Privacy Notice does not otherwise apply to visitors who are accessing our Services from outside the EEA.

Cookies

We use the following web cookies and other information technologies to provide features on our web and mobile sites to users in the EEA, including cookies that deliver basic visitor experiences and fuller website experiences such as interactivity with third-party content.

The following types of cookies (and cookie technology) are used on this website. Cookies that are strictly necessary are set as soon as the user visits the website. Cookies that are not strictly necessary are only set if the web or mobile user gives consent to the use of those cookies.

You may contact our data protection officer at:

ATTN: Privacy Matter
Victoria’s Secret & Co.

4 Limited Parkway, Reynoldsburg, OH 43068
US

The legal basis for our processing of your personal data in connection with our Services is Article 6.1(b) EU GDPR, which allows processing of personal data as necessary for the performance of a contract. When you access our Services, you form a contract with us based on our Site Terms, Conditions and Notices, and we need to process your personal data to respond to and fulfill your requests and satisfy our obligations with respect to the other purposes listed in this Policy.

As exceptions, we rely on your consent with respect to cookies and direct marketing emails per Article 6.1(a) EU GDPR, and legitimate interests under Article 6.1(f) EU GDPR, especially with respect to situations where we must process your personal data to comply with applicable laws (as a U.S.-based company, we are subject to U.S. laws and must comply, just like EEA-based companies have to comply with EEA laws). When we collect and process sensitive personal data for the purposes described above, we do so when required by law or otherwise with your explicit consent.

Recipients or categories of recipients of your personal data are employees of our company and affiliated and non-affiliated services providers who have a need to know.

When you access our Services, you transfer your personal data to the United States of America and India for which the European Union Commission has not yet issued an unlimited adequacy decision. We will comply with applicable legal requirements to ensure that personal data is subject to an adequate level of protection when we transfer your personal data to additional recipients in countries located outside the EEA. In all such cases, we will only transfer your personal data if:.

You may request a copy of the safeguards that we have implemented with respect to transfers of personal data by contacting our data protection office, as described above, or by contacting us through our contact information at the end of this Notice.

We will process and keep your personal information for as long as is necessary for the purposes set out in this Policy, for our legitimate business needs, and for compliance with the law.

You have a right to request from us these EU GDPR rights concerning your personal data: access to data; rectification of data; erasure of data; restriction on processing; objection to data processing; and data portability. You can exercise these rights through a combination of actions: (a) visit Your Privacy Rights; (b) access the information in your account; (c) exercise your opt-out options through our Services; or (d) by phone, for applicants and contractors, call 1-888-873-2738 and for former associates, call 1-866-473-4728.

If you are also a customer of Victoria's Secret, you can submit a separate data subject request by visiting Victoria's Secret Privacy Rights. If you have provided consent for direct marketing emails or other data processing, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

You have the right to lodge a complaint with a supervisory authority.

We do not use automated decision-making, including profiling, as referred to in Article 22(1) EU GDPR, that is, in a way that produces legal effects concerning you or significantly affects you. Our Services' customization technologies and e-commerce processes are automated, but do not produce legal effects or affect you significantly as contemplated by Article 22(1) or (2) EU GDPR.

You can contact us with any questions, or to exercise your rights by calling +1-937-438-4197 in the EU.

Supplemental Privacy Notice for Canada Residents

The following applies in addition to the Privacy Notice above:

We collect personal information for the purposes disclosed to you at the time personal information is collected, and as set out under “What information do we collect and how do we use it?”.

You have the right to access, update, rectify and correct inaccuracies in your personal information in our custody and control and withdraw your consent to our collection, use and disclosure of your personal information. You may exercise these rights by using the Your Privacy Rights webform or by calling or writing to us at the contact information set out below.

To submit a request as an authorized agent on behalf of a resident, please visit the Your Privacy Rights webform. On the form, add your email address and information about the individual for whom you are submitting the request in the other required fields. Please add your name and phone number in the Request Details field and an indication that you are submitting the request as an authorized agent. See What information do we share with or disclose to third parties and our affiliates? to learn about how we may share your personal information. Your personal information will be transferred to us and our affiliated and unaffiliated service providers outside of your province.

How to Contact Us

If you have general questions or concerns about our Privacy Policy or the manner in which we or our service providers treat your personal information, for applicants and contractors, call 1-888-873-2738 and for former associates, call 1-866-473-4728.You may also contact our Privacy Officer at the contact information below: