Version: [202407V1]
Last Updated: [July 1, 2024]

Kenvue Inc. and each of its affiliates, subsidiaries, assigns, successors, and brands (collectively, “Kenvue”, “we”, “us” or “our”) respect your privacy and want you to be familiar with how we collect, use, store and disclose personal information of current, former and potential suppliers’ representatives (jointly referred to as “suppliers’ representatives” or “you”) in the context of our main products and services. This Privacy Notice describes our practices in connection with the information that we, or our service providers, collect online or offline in connection with the administration of our suppliers and provisioning of their services (hereinafter the “Service”). The local Kenvue affiliate that you are engaged with is the entity responsible for the management of your personal information (the data controller). By providing personal information to us or by using the Service, you acknowledge that you have read and understood this Privacy Notice.

If you submit any personal information relating to another employee or associate within your organization to us, you represent that:

(i) You have obtained a consent from their side – where necessary – and/or you have informed them accordingly of their personal information processing in accordance with this Privacy Notice.

(ii) You have the authority to do so and to permit us to use the information in accordance with this Privacy Notice.

Use by Minors
The Service is not directed to individuals who are considered minors in their country of residence, and we request that these individuals not provide personal information through the Service. If your child has submitted personal information and you would like to request that such personal information be removed, please contact us as explained below under “Contacting Us”.

Information Collection
In the course of your engagement with a Kenvue affiliate, Kenvue may have collected or will collect personal information about you in relation to the services you provide to us.

We may ask you to submit personal information in order for you to benefit from certain features and functionalities of the Service (such as order processing) or to participate in a particular activity (such as surveys). You will be informed what information is required and what information is optional.

We may combine the information you submit with other information we have collected from you, whether online or offline, including, for example, your purchase history. We may also combine it with information we receive about you from other Kenvue affiliates.

You can find more about the personal information we collect and process, and how we use and disclose it, in the section “How We Use and Disclose Information” in this document.

Sensitive Information
Unless we specifically request or invite it, we ask that you not send us, and you not disclose, any sensitive personal information (e.g., Social Security numbers, information related to racial or ethnic origin, political opinions, religion or philosophical beliefs, health or medical conditions, sex life or sexual orientation, criminal background, or trade union membership, or biometric or genetic data) on or through the Service or otherwise to us.

Automatic Information Collection and Use
We and our service providers may collect certain personal information automatically as you navigate around the Service. On each site available to you, in the footer, you may access the Cookie Notice or Cookie Policy detailing the use of cookie technologies for the particular site, if applicable. The Cookie Notice or Policy includes information on how you may consent to these technologies, if required.

Please read the Cookie Notice or Policy available to you for detailed information about any cookies and other tracking technologies used on the site. Except where allowed by applicable law, we place cookies after having received your consent through the cookie banner or preference center. The Cookie Notice or Policy includes information on how you may disable these technologies if such are enabled.

We and our service providers may also automatically collect and use information in the following ways:

• Through your browser: Certain information is collected by most browsers, such as your Media Access Control (MAC) address, computer type (Windows or Mac), screen resolution, operating system name and version, and Internet browser type and version. We may collect similar information, such as your device type and identifier, if you access the Service through a mobile device. We use this information to ensure that the Service functions properly.
  
• IP address: Your IP address is a number that is automatically assigned to your computer by your Internet Service Provider. An IP address is identified and logged automatically in our server log files whenever a user visits the Service, along with the time of the visit and the pages visited. Collecting IP addresses is standard practice and is done automatically by many online services. We use IP addresses for purposes such as calculating Service usage levels, diagnosing server problems, and administering the Service. We may also derive your approximate location from your IP address.
  
• Device information: We may collect information about your mobile device, such as a unique device identifier, to understand how you use the Service.

How We Use and Disclose Information
We use and disclose personal information you provide to us as described to you at the point of collection. Please see the section “Choices and Access” below in this document to learn how you may opt out of certain uses and disclosures.

Where required by applicable law, we will obtain your consent to our use of your personal information at the point of information collection. We may also use your personal information as necessary to perform a contract, to comply with a legal obligation (for example, due to our pharmacovigilance obligations), or for our legitimate business interests.

The following table contains more detailed information about how we use your personal information and the legal bases for such use.

All categories of personal data are disclosed for a business purpose.

Categories of third parties to whom the personal information is disclosed:

• To our affiliates for the purposes described in this Privacy Notice. A list of our affiliates is available in our most recent Annual Report at https://investors.kenvue.com/financials-reports/ (in the section “SEC filings” select category “Annual Filings”, open the Filing Type “10-K” and go to “Exhibit 21 – Subsidiaries”).
  
• To our third-party service providers who provide services such as website hosting and moderating, mobile application hosting, data analysis, transactions and payment processing, order fulfillment, infrastructure provision, IT services, customer service, e‑mail and direct mail delivery services, auditing, professional advisory and other services, in order to enable them to provide services.
  
• As permitted by applicable law, to a third party in the event of any reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).

In addition, we may use and disclose your information as we believe to be necessary or appropriate: (a) to comply with legal process or applicable law, which may include laws outside your country of residence; (b) as permitted by applicable law to respond to requests from public and government authorities, which may include authorities outside your country of residence; (c) to enforce our terms and conditions; and (d) to protect our rights, privacy, safety, or property, and/or that of our affiliates, you, or others. We may also use and disclose your information in other ways after obtaining your consent to do so.

We may use and disclose information we collect automatically as described above, under “Automatic Information Collection and Use.”

In addition, where allowed by applicable law, we may use and disclose information that is not in personally identifiable form for any purpose. If we combine information that is not in personally identifiable form with information that is identifiable (such as combining your name with your geographical location), we will treat the combined information as personal information as long as it is combined.

Choices and Access

How you can access, change, delete your personal information, or exercise your privacy rights

If you would like to review, correct, update, restrict, or delete your personal information, or exercise any of your privacy rights (to the extent these rights are provided to you by applicable law), please contact us via one of our phone numbers.

We will respond to your request as soon as reasonably practicable and consistent with applicable law. If circumstances cause any delay in our response, you will be promptly notified and provided with a date for our response. Where available, you may also visit the supplier online portal to update some of your information.

For your protection, we may only exercise verifiable requests with respect to the personal information associated with the particular email address or account that you use to send us your request, and we may need to verify your identity. To do so, we may request additional personal information from you, such as email address, phone number or postal address. The information we ask you to provide to initiate a request may differ depending upon the type of request, the type, sensitivity and value of the personal information that is the subject of the request, and the risk of harm to you that may occur as a result of unauthorized access or deletion, and this information will only be used to verify your identity or authority to make the request. If we cannot verify your identity or authority to make the request, we will not be able to comply with your request.

Please note that we may need to retain certain information for recordkeeping purposes, to fulfill our legal obligations and/or to complete any transactions that you began prior to requesting a change or deletion (e.g., when you place an order, you may not be able to change or delete the personal information provided until after the completion of such order).

Cross-Border Transfer
Your personal information may be stored and processed in any country where we have facilities or service providers, and by using our Service or by providing consent to us (where required by law), your information may be transferred to countries outside of your country of residence, including to the United States, which may provide for different data protection rules than in your country. Nonetheless, appropriate contractual and other measures are in place to protect personal information when it is transferred to our affiliates or third parties in other countries. For example, where applicable, standard contractual clauses, as approved by your country’s/region’s competent authority, are executed to protect your personal information when it is transferred outside your country of residence.

Security
We seek to use appropriate organizational, technical, and administrative measures designed to protect personal information under our control. Where appropriate these can include technical solutions like firewalls, intrusion detection, or encryption, and organizational and physical controls such as training staff, identification of data incidents and risks, or access restrictions.

To determine the level of protection required in each case, we appropriately assess the nature of your personal information together with the risk of a security incident occurring.

If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any account you have with us has been compromised), please immediately notify us in accordance with the “Contacting Us” section below.

Retention Period
We will retain your personal information for as long as needed or permitted in light of the purpose(s) for which it was obtained. The criteria used to determine our retention periods include: (a) the length of time we have an ongoing relationship with you and provide the Service to you; (b) whether there is a legal obligation to which we are subject; and (c) whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation, or regulatory investigations).

Third Party Sites and Services
This Service may contain links to sites of third parties. This Privacy Notice does not address, and we are not responsible for, the privacy, information, or practices of any third parties, including any third party operating any site or online service (including, without limitation, any application) that is available through this Service or to which this Service contains a link. The availability of, or inclusion of a link to, any such site or property on the Service does not imply endorsement of it by us or by our affiliates.

Contacting Us
The Kenvue affiliate that you are engaged with is the company responsible for collection, use, and disclosure of personal information under this Privacy Notice.

If you have any questions about this Privacy Notice or processing of your personal information, or you would like to exercise your privacy rights, please contact us via one of our phone numbers.

Additional Provisions for Specific Jurisdictions

Local Data Protection Officers and Authorities

Canada

In addition to the purposes listed in the section “How We Use and Disclose Information”, we may also collect and process personal information without your consent where this is allowed under applicable law.

The personal information you provide us may be stored and processed in any jurisdiction (country/province) where we have facilities or service providers, and your information may be transferred to jurisdictions outside of your province/country of residence, including to the United States, which may provide for different data protection rules than in your province/country of residence.

While such information is outside of your province/country of residence, it is subject to the laws of the jurisdiction in which it is held, and may be subject to disclosure to the governments, courts, or law enforcement or regulatory agencies of such other country/province/state, pursuant to local laws.

China

Notwithstanding anything contained above to the contrary, we may also collect and process personal information about you in accordance with the legal bases provided under Chinese law. As noted in the section “Cross-Border Transfer”, foreign transfers of personal information will be made in accordance with applicable law. If we process personal information based on your consent, we will require your separate consent for Cross-Border Transfer.

Sensitive Information is personal information that the breach or illegal use of information may easily lead to the infringement of your personal dignity or harm to personal or property safety.

In principle, personal information generated or collected within the territory of Mainland China will be processed and stored within Mainland China. To fulfill the purposes described in the section “How We Use and Disclose Information” of this Notice, your personal information may be disclosed to members of the Kenvue Group of Companies and authorized third parties located in countries or regions outside Mainland China, including but not limited to the United States, countries within the European Economic Area (EEA), Singapore, Australia, and New Zealand. We will strictly abide by relevant laws and regulations as well as the Kenvue information security policies to ensure the security of your personal information during the transfer, and will require data recipients to provide adequate protection for your personal information through contractual clauses or other means. Requests for the exercise of access and other rights in respect to personal information disclosed to an overseas recipients can be directed to us via the contacts in the “Contacting Us” section of this Notice.

If we process personal information based on your consent, you may withdraw your consent at any time by contacting us via the contacts in the “Contacting Us” section of this Notice.

To the extent inconsistent with the provisions of this Notice, including but not limited to definitions (e.g., sensitive personal information), China’s Cybersecurity Law, Personal Information Protection Law, their implementing measures and other Chinese laws and regulations in relation to cybersecurity and data protection will prevail.

United States – California

Under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CPRA”), we are required to notify you that we collect certain personal information in connection with your engagement.

The section “How We Use and Disclose Information” above in this Notice lists categories of personal information collected and categories of third parties to whom the personal information is disclosed.

We collect, use and disclose the following categories of sensitive personal information regarding our employees and Dependents:

Kenvue does not use or disclose the above sensitive personal information for any purpose other than those permitted under the CPRA.

Kenvue does not sell or share any personal information, including sensitive personal information. Kenvue does not have actual knowledge that it sells or shares personal information about minors under the age of 16.

The personal information, including the sensitive personal information, we collect, are collected directly from you when you are engaged and during your engagement as a supplier, and from other sources as described in section “Information Collection”.

We use the personal information, including the sensitive personal information, we collect as set forth in section “How We Use and Disclose Information”.

We will retain personal information, including sensitive personal information, as set forth in section “Retention Period”.

As a California resident, you have the following rights under the CPRA:

Right to Know: You have the right to request that we disclose certain information to you about our collection and use of certain personal information, including sensitive personal information, about you as described below:

· The specific pieces of personal information collected;

· The categories of personal information collected;

· The categories of sources from whom the personal information is collected;

· The purpose for collecting, selling or sharing the personal information;

· The categories of third parties with whom we have disclosed the personal information;

· The categories of personal information that we have sold or shared, and the categories of third parties to whom the personal information was sold or shared, by category or categories of personal information for each third party to whom the personal information was sold or shared;

· The categories of personal information that we disclosed for a business purpose and the categories of persons to whom it was disclosed for a business purpose.

Right to Delete: You have the right to request that we delete your personal information, subject to certain exceptions.

Right to Correct Inaccurate Personal Information: You have the right to request that we correct inaccurate personal information we maintain about you, taking into account the nature of the personal information and the purposes of the processing of the personal information.

Right to Opt-Out of Sale or Sharing: As stated above, Kenvue does not sell or share your personal information.

Right to Limit the Use and Disclosure of Sensitive Personal Information for Certain Purposes: As stated above, we do not use or disclose your sensitive personal information for any purpose other than those permitted under the CPRA.

Freedom from Discrimination: You have the right not to receive discriminatory treatment for exercising your rights above, including not to be retaliated against for exercising such rights.

To exercise the rights above, you must submit a verifiable request online here or by calling us at +18779040744. You may designate an authorized agent to make a request on your behalf by providing the agent with signed written permission to do so. For more information about exercising your rights see section “Choices and Access”.

Updates to This Privacy Notice
We may update this Privacy Notice from time to time. Any changes will be available in the Privacy Notice posted on the Service and will include the last reviewed date. If we make any significant changes, we will notify you and provide you with additional information. We encourage you to check this Privacy Notice regularly to stay informed about how we use your personal information.