Please visit https://www.bbwinc.com/our-company/associates/associate-privacy-policies to view privacy policies for associates in jurisdictions outside the US.

Bath & Body Works, Inc., including its subsidiaries and affiliated entities (the "Company," "we," "us," or "our"), respects your concerns about privacy. This Internal Employee Privacy Policy ("Policy") explains what personal information we collect when you become an associate of the Company, how we use that information, to whom we disclose it, and how we safeguard personal information.

This Policy applies to our employees who reside and work in the United States.

We may obtain the following categories of personal information about you (collectively, "employee personal information"):

• Contact information, including name, work and personal address, phone number, email address, and emergency contact information;
• Demographic and family information, including age, date of birth, race, gender, ethnicity, marital and family status, disability status, veteran status, and dependent information;
• Identification information, including driver's license or state identification card number, passport number, visa ID number, Social Security number, Social Insurance number, Tax ID number, Employee ID, and signature;
• Photographs, and video and audio recordings;
• Compensation, benefits, and payroll information, including bank account details and salary-related information, payment card information, tax-related information, and information relating to participation in group insurance policies (such as insurance policy number, medical information and health insurance information);
• Information relating to your position, including job title, job description, office location, hire date, termination date, training details, performance evaluation, disciplinary actions, information regarding fitness for work, paid time off or leave of absence, alcohol or drug testing-related information (where permitted by applicable law), and information regarding immigration status and eligibility for work;
• Information related to employment, including occupation details, CV information, education details, language and other job-related skills, historical compensation details, previous employment details, and references;
• Geolocation data;
• Information about your use of Company IT and communications resources, including timestamp information, IP address, activity logs, and call detail; and
• The content of communications that traverses Company IT and telecommunications resources.

If you're hired for a position with the Company, we will collect employee personal information during and after the course of your employment with us and use it to administer the employment and post-employment phases of the relationship.

We may incorporate information from your job application into your personnel file, and we may collect employee personal information directly from you. We also collect employee personal information in the course of job-related activities.

We may collect information from third parties (e.g., during the application and recruitment process, in connection with background checks and the onboarding process, and as part of a change in duties or a promotion) to supplement your employee personal information.

We may also collect and use contact information that you provide about people you know (for example, your emergency contacts or people covered by your benefits programs).

We may use your personal information for the following purposes:

• Workforce management: managing work activities and personnel generally, including recruiting and employee on-boarding; performing background checks; determining suitability for employment or promotion; determining physical and/or mental fitness for work; reviewing and evaluating performance; determining eligibility for and processing salary increases, bonuses, and other incentive-based compensation; providing employee discounts; providing references; managing attendance, absences, leaves of absences, and vacations; administering payroll and compensation services; reimbursing expenses; administering health, dental, and other benefits; training and development; making travel arrangements; securing immigration statuses; monitoring staff; creating staff directories; investigating suspected misconduct or non-performance of duties; managing disciplinary matters, internal investigations, grievances, and terminations; reviewing staffing decisions; and providing access to facilities;
• Facilities and emergencies: ensuring business continuity; protecting the health and safety of our staff and others; responding to incidents; safeguarding, monitoring, and maintaining our IT infrastructure, telecommunications network, office equipment, facilities, and other property; detecting or preventing theft or fraud, or attempted theft or fraud; and facilitating communication with you and your designated contacts in an emergency;
• Business operations: operating and managing our IT, communications systems and facilities, and monitoring the use of these resources; providing technical support; performing data analytics; improving our services; allocating and managing company assets and human resources; strategic planning; producing promotional videos; managing projects; planning events; compiling audit trails and other reporting tools; maintaining records relating to business activities, budgeting, and managing finances; managing mergers, acquisitions, liquidations, sales, reorganizations or disposals, and integrating with purchasers; and
• Legal and compliance: complying with legal requirements, such as tax, record-keeping and reporting obligations; conducting audits, management and resolution of health and safety matters; complying with requests from government or other public authorities; responding to legal process such as subpoenas and court orders; pursuing legal rights and remedies; defending litigation and managing internal complaints or claims; conducting investigations; and complying with internal policies and procedures.

We may also use monitoring, communications interception, and recording technology to collect information about you and others to protect people and property. For example, we may use video and surveillance technology in our stores and in our facilities; and we may intercept, access, use, and disclose communications (like email) that traverses our company network and assets (e.g., computers and phones).

We may share your employee personal information (as listed above in "What Does this Policy Cover?") with our subsidiaries and affiliates. We may also share your employee personal information (as listed above in "What Does this Policy Cover?") with third-party service providers that provide us with services that we find necessary to run our business, and which may directly or incidentally involve your employee personal information. These providers help us do all the things listed above (see When is Employee Personal Information Collected and How is It Used?), as summarized below:

• Provide workforce management.
• Maintain facilities and respond to incidents and emergencies.
• Maintain business operations.
• Deliver legal and compliance services.

We also may disclose personal information about you (a) if we are required to do so by law or legal process (such as a court order or subpoena); (b) in response to requests by government agencies, such as law enforcement authorities; (c) to establish, exercise, or defend our legal rights; (d) when we believe disclosure is necessary or appropriate to prevent harm or financial loss; (e) in connection with an investigation of suspected or actual illegal activity; or (f) otherwise with your consent.

We reserve the right to share and/or transfer your information in the event we sell or transfer all or a portion of our business assets (including, without limitation, in the event of a merger, acquisition, joint venture, reorganization, dissolution or liquidation).

We maintain administrative, technical and physical safeguards designed to protect employee personal information from accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure, or use.

If you have questions or concerns about your employee personal information or this Privacy Policy, please contact:

The Privacy Team

Bath & Body Works, Inc.

3 Limited Parkway

Columbus, OH 43230

privacy@lb.com

This Policy may be updated periodically to reflect changes in our personal information practices.