Privacy Notice for Residents of the EEA and UK and Jurisdictions with Similar Laws

If you are located in the EU or a jurisdiction with a similar law, the GDPR or its local equivalent may grant you certain rights under the law. In particular, the right to access, correct, and delete the personal information we hold about you. Ecolab will retain your personal information for the length of time you engage with our services as described in the retention section of the Global Employee Privacy Notice, until you request deletion of such personal information. Ecolab is considered the Data Controller (or equivalent distinction) with regard to your personal information. You can find our contact information as described herein or in other portions of the Global Employee Privacy Notice.

In certain circumstances, you have the following data protection rights:

• The right to access, update, or delete the personal information we have on you.
• The right of rectification. You have the right to have your personal information rectified if that information is inaccurate or incomplete.
• The right to object. You have the right to object to our processing of your personal information.
• The right of restriction. You have the right to request that we restrict the processing of your personal information.
• The right to data portability. You have the right to be provided with a copy of the personal information we have on you in a structured, machine-readable and commonly used format.
• The right to withdraw consent. You also have the right to withdraw your consent at any time where we relied on your consent to process your personal information.

If you have a comment, question, complaint, or request regarding the processing of your personal information, please contact your manager, HR, or dataprivacy@ecolab.com.

Consistent with Art. 21 GDPR, you have the right to object to the processing of your personal data for the purposes of direct advertising. You also may object to the processing of your personal data on grounds related to your particular situation if we process your data in order to safeguard legitimate interests. We will then no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.

You may object, or lodge a complaint, by contacting us at dataprivacy@ecolab.com or any data protection regulator. The following links may assist you in finding the appropriate regulator:

• In the UK, you have the right to lodge a complaint with the Information Commissioner: www.ico.org.uk
• In South Africa, you have the right to file a complaint with the Information Regulator: https://www.justice.gov.za/inforeg/index.html
• In Switzerland, you have the right to contact the Federal Data Protection and Information Commissioner (FDPIC): FDPIC
• In the EU, you have the right to lodge a complaint with your local data protection authority. To find your local authority, you can check the list on the European Data Protection Board website:https://edpb.europa.eu/about-edpb/board/members_en
• In Brazil, you have the right to lodge a complaint with the National Data Protection Authority ANPD — National Data Protection Authority (www.gov.br)
• In Argentina, you have the right to contact the National Directorate for Personal Data Protection: PDP
• In Canada, you have the right to lodge a complaint with the Office of the Privacy Commissioner in Canada: Office of the Privacy Commissioner in Canada
• In Japan, you have the right to contact the personal information Protection Commission: https://www.ppc.go.jp/en/
• In Australia, you have the right to lodge a complaint with the Privacy Commissioner: Australian Information Commissioner
• In New Zealand, you can contact the Privacy Commissioner’s office: www.privacy.org.nz

If you are located in the EEA or a jurisdiction that requires a similar legal basis for processing, our legal basis for collecting and using the personal information described in this Notice depends on the personal information we collect and the specific context in which we collect it.

We may process personal information because:

• It is necessary for the performance of a contract between you and Ecolab;
• You have given us consent to do so (in applicable jurisdictions);
• The processing is in our legitimate interest as the Controller, when that legitimate interest is not overridden by your rights;
• Ecolab must comply with the law.

Where certain sensitive personal information is processed based on your explicit consent, you may have the right to withdraw such consent at any time. To do so, please contact us as described in this Notice. If there is a different legal basis that would permit us to continue processing your personal information after withdrawing consent, we will notify you of that legal basis at the time of your request.

Personal Data Privacy Rights (Brazil) Under the General Personal Data Protection Law (“LGPD”), you can exercise certain rights listed in Article 18 of the LGPD:

• Request confirmation of the existence of treatment;
• Access your Personal Data;
• Request the correction of incomplete, inaccurate or outdated data;
• Request the anonymization, blocking or deletion of unnecessary or excessive Personal Data, or those processed in non-compliance with the provisions of the LGPD;
• Request data portability to another supplier of products or services, upon express request, in accordance with the regulations of the national authority, observing commercial and industrial secrets;
• Request the deletion of Personal Data processed with your consent, except in the cases provided for in this Notice and in Article 16 of the LGPD;
• Request information from public and private authorities with which Ecolab shared data use;
• Obtain information about the possibility of not providing consent and the consequences of refusal;
• Revoke your consent, in accordance with §5 of article 8 of the LGPD.