Introduction

This Privacy Policy applies to James Hardie Building Products Inc. and its related corporate entities. It describes how we collect, hold, use, and disclose your personal information when you interact with us in North America and how we maintain the quality and security of your personal information under applicable privacy laws. These interactions include using our website and any mobile app, purchasing our products, inquiring about our products, participating in a contest or sweepstakes, requesting information about a local contractor, or applying for a job.

This Privacy Policy does not apply to employment-related records (other than job applicant information) or your interactions directly with third parties and their websites. In some cases, we may provide different or supplemental information when you interact with us in different regions. Some of that information can be found below.

James Hardie values and respects the privacy of all people – including our customers, business partners, investors, job applicants, and suppliers. We are committed to building trust by ensuring that your personal information is handled appropriately by our staff and our service providers, in accordance with applicable privacy laws and community expectations.

What We Collect

We collect the following categories of information in order to sell and market our products, communicate with you, enhance our offerings and operations, recruit candidates, and for other operational, legal and compliance purposes. The responsible data controller for this information is: James Hardie Building Products Inc., Attn: Legal & Compliance, 303 East Wacker Drive, Floor 25, Chicago, IL 60601 USA.

• IdentifiersInformation that can be used to identify you, including contact information, name, alias, address, email, login credential, phone number, company details, IP address, interests, date of birth, military status, or other identifiers.
• Commercial Information. Products or services that you purchased or considered purchasing, rebate and sweepstake submissions, warranty claims, and related information.
• Protected class information under state or federal law. Demographic information such as age, gender, marriage or family status.
• Professional, Education, and Employment Information. Employment and education details, credentials and certifications.
• Geolocation Data. Including precise geolocation if you allowed an application you are using to collect it.
• Audio, electronic or visual informationAudio or video, for example when calling customer service or other phone lines or during a virtual applicant interview process.
• Online Activities Information.Such as your online interactions with us, digital information, device identifiers, cookies, search history, location information, browsing history, keystroke activity and rhythms, mouse movements, scrolling, and clicks.
• Inferences.Inferences or preferences which may be derived or based on other information we collect.
• Other Personal Information.Other personal information if it identifies, relates, or can be reasonably associated with or linked to you or your household.

How We Collect It

We collect personal information about you in the following ways:

Direct collection
We will collect your personal information directly from you when you:

• visit or create an account or profile on one of our websites;
• conduct training via one of our websites;
• engage with communications from us (including any of our newsletters) or notifications about offers or connections to contractors;
• ask about any of our products, including when you request a brochure (or other marketing material) or when you request a product sample;
• provide feedback on any of our products or website features;
• choose to participate in sweepstakes or a promotion;
• create a 3D rendering;
• ask about local contractors;
• apply for a job with us; or
• engage with us on social media.

Indirect collection
There may be occasions when we collect information about you indirectly from third parties or publicly available sources. Such third parties may include people or organizations who provide leads and marketing, promotional and data analysis services to us. We may combine this information with information we already have about you to help us understand trends, behavior, and views about our products. These third parties may set and access cookies, pixel tags, and similar technologies on your device, which may have cookies with varying expiration periods. These parties may, likewise, collect various types of information about your browser, device, or browsing activities through use of these cookies.

Why We Collect It

We collect personal information for various business or commercial purposes, including to:

• provide information about our products or information that we think may interest you;
• provide updates or materials relevant to your use of James Hardie websites and products;
• facilitate business relationships with contractors, distributors, customers or employees;
• fulfil requests for information, brochures, catalogs, and samples;
• conduct and administer contests, surveys, rebate programs, and sweepstakes;
• determine effectiveness of our advertising and marketing;
• address complaints;
• conduct market research on our products and develop new products;
• deliver personalized offers and targeted ads, including to a targeted geographic region;
• administer our website, including making sure that our content is presented in the most effective manner on different platforms; or
• enforce any contractual obligations, assist law enforcement, respond to regulatory inquiries, and protect against security incidents and malicious activity.

How We Share Personal Information

We may share your personal information with:

• our related corporate entities and/or associated companies;
• builders, installers, or contractors in your area that install our products;
• companies that provide warranty and customer support services;
• organizations with whom we have relationships for the purpose of promoting our products;
• our agents, contractors and external advisers who carry on our functions and activities or who assist us to carry on our functions and activities;
• organizations who are contracted by us to perform certain services, such as maintaining our websites, providing storage management services, delivering product samples, delivering promotional materials, providing security and compliance services, and providing software services that help us run our business effectively;
• Recruitment, contingent hire, and other employment agencies to facilitate candidate screening, interviewing, and hiring;
• Law enforcement or regulatory agency if we believe we are required to by law or as we deem appropriate in response to request or in connection with an investigation.

In addition, in the future, we may sell some or all of our assets. In such transactions, personal information may be one of the transferred business assets. In the event of a sale of our assets, personal information may be transferred to the buyer of those assets, provided that there is a legal basis to do so.

Requirement or Obligation to Provide Information

Unless expressly stated, the provision of your personal information is not required or obligatory.

Use of Cookies

Cookies are data records that are stored in databases of the browser. For example, user identification numbers are stored here, which are transmitted to the user's computer when the website is used and managed there. The data records are kept ready there for later access. Typical uses of cookies are, for example, language selection, consent documentation or authentication of the user. Session cookies: Session cookies are stored for the duration of a website visit and then automatically deleted when the browser is closed. They ensure, for example, that video and audio files can be played, your user input is temporarily stored during the input time and thus the user experience is improved. Persistent cookies: Persistent cookies remain on your terminal device even after you close the browser. These cookies can, for example, store your user preferences, such as language settings, and analyze user behavior on our website. The storage period of persistent cookies is determined individually per cookie. After expiry of the period, they are automatically deleted. The modification or withdrawal of consent for the placement of cookies, or a request for information on individual cookies, can be made using the cookies banner or by contacting [email protected] or calling 866-274-3464.

How We May Transfer Personal Information Overseas

James Hardie has affiliates in a number of different countries. As part of our operations, your personal information may be shared with one or more of our group companies in those countries. In addition, we may disclose your personal information to our third-party service providers who may be based in or have servers located outside of the country in which you live. When we disclose your personal information to international recipients, we make efforts to ensure data security and appropriate privacy practices are maintained by those overseas entities. We will only disclose your information to overseas entities where:

• we have contracted with the entity to treat your personal information in a manner consistent with applicable privacy laws; or
• the entity is subject to comparable obligations to protect personal information as those in your country; or
• you have given us your consent to disclose personal information in this way.

In addition, if information is subject to GDPR, we only transfer such information to countries that are considered to provide an adequate level of protection or where we have established that all relevant recipients provide an adequate level of data protection.

Storage Period

We store your information:

• if you have consented to the processing, at most until you revoke your consent;
• if we need the information for the execution of a contract, at most for as long as the contractual relationship with you exists;
• if we use the information on the basis of a legitimate interest, at most for as long as your interest in deletion or anonymization does not outweigh our interest in keeping the information;
• insofar as there is a legal storage obligation, in compliance with that obligation.

Automated Decision-Making Including Profiling

We may use your identity, contact, technical, usage, account, and profile information, including identity, contact and profile data we have received from data brokers or aggregators, to form a view on what we think you may want or need, or what kinds of products may be of interest to you. Combining information from multiple sources in this way is commonly known as “enriching data” or “profile building.” This is how we decide which products and offers to include in our communication. This process may involve automated decision-making to determine which messages will be most meaningful to you based on your interests, preferences, and location. There may also be other instances where we may use your information to render a decision based on automated processing of such personal information. However, these other instances will not have a legal effect or other significant effect on any data subject. If you would not like us to use data from data brokers and aggregators to enrich any information we have collected from you or if you would like to object to automated decision-making or if you would like to submit observations about a decision made by automated means, please submit a privacy request.

How To Submit Privacy Requests

To update, access or delete your personal information, please email [email protected] or call 866-274-3464. To opt out from sale, please also contact [email protected] or call 866-274-3464. To stop receiving marketing emails, you may also click on the "Unsubscribe" link in any marketing email you receive from us and update your preferences.

Note that you may also contact us to request information regarding the purpose of any processing activity, the categories of personal information processed, the recipients of the data (if a transfer is made), the duration of the storage or the criteria for determining the duration. You also have the right to receive personal information in a structured, common and machine-readable format or to have it transferred to a third party, to restrict processing, to object to processing, or to complaint to the relevant supervisory authority about unauthorized processing activity.

We may need your contact information, such as name, address, phone number and email, to process a privacy request and verify your identity. For security and privacy, we may use a third-party identity verification service to do so. With your consent, we may send you a text to your mobile number to verify your identity. The service provider may also present you with several questions requiring a response. Please note we need to keep certain information when permitted by law to detect security incidents, prevent fraudulent or illegal activities, identify and repair errors, comply with laws and regulations, and for other solely internal and lawful purposes.

Additional Infromation – Job Applicants

James Hardie collects information from you during your job application, including: (1) identification information, such as your name, address, phone number, email, account credentials and government-issued ID (if asked), (2) online activities, such as your interactions with the website, (3) professional or employment-related information, such as employment status; employment history, references or your résumé, (4) education information, such as your education background, (5) geolocation information such as your location when targeting our help wanted ads on social media, (6) protected class information, such as gender, military status, race and ethnic background for Equal Employment Opportunity compliance purposes in accordance with the law, (7) information relating to your immigration status and ability to work legally in the U.S., (8) personal or family employment affiliation with James Hardie, (9) criminal background information, and (10) audio, video or electronic information, when you communicate with us, during your application or interview process, and (11) other personal information, if it identifies, relates and can be reasonably associated with or linked to you. We use the information to improve our recruitment practices, evaluate positions and candidates, conduct background checks and credential verifications, and for communication and analytic purposes.

Supplemental Policy For California Residents

Revised November 2023

This Supplemental Policy for California Residents supplements our Privacy Policy – North America and describes the types of information we collect from and about California residents. It also explains how we may use and disclose such information, as well as your ability to control certain uses of it. Any terms defined in the California Privacy Rights Act have the same meaning when used in this Supplemental Policy.

TYPES OF PERSONAL INFORMATION COLLECTED, SOURCES OF COLLECTION AND PURPOSES OF USE

To view the types of personal information collected, sources of collection and purposes of use, please refer to the Privacy Policy/North America.

CATEGORIES OF PERSONAL INFORMATION DISCLOSED FOR BUSINESS PURPOSES

We disclose the following categories of personal information to the following categories of entities for business purposes:

Categories of Personal Information Shared That May be Deemed As a “Sale" Under the California Consumer Privacy Act

We do not knowingly sell the personal information of consumers under 16 years of age.

To update, access, or delete your personal information, please email [email protected] or call 866-274-3464. To opt out from sale, please also contact [email protected] or call 866-274-3464. To stop receiving marketing emails, you may also click on the "Unsubscribe" link in any marketing email you receive from us and update your preferences.

We may need your contact information, such as name, address, phone number and email, to process a privacy request and verify your identity. For security and privacy, we may use a third-party identity verification service to do so. With your consent, we may send you a text to your mobile number to verify your identity. The service provider may also present you with several questions requiring a response.

GDPR and the EU-US (and UK Extension) Data Privacy Framework

Revised January 2024

This information about GDPR and the EU-US (and UK Extension) Data Privacy Framework supplements our Privacy Policy – North America and describes our legal bases for collection of personal data that is subject to GDPR obligations and our commitment to the EU-U.S. (and UK Extension) Data Privacy Framework.

To the extent subject to GDPR, we base the processing of your information on the following legal bases:

• Your consent, if you have given us such consent (art. 6 (1) (a) GDPR),
• The initiation or execution of a contract with you (art. 6 (1) (b) GDPR),
• The fulfilment of legal obligations (art. 6 (1) (c) GDPR),
• The implementation of our legitimate interests (art. 6 (1) (f) GDPR)

James Hardie Building Products Inc. complies with the EU-U.S. (and UK Extension) Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, as set forth by the U.S. Department of Commerce. James
Hardie Building Products Inc. has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. (and UK Extension) Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, James Hardie Building Products Inc. commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-US.DPF and the UK Extension to the EU-U.S. DPF. Under the DPF, you may invoke binding arbitration by delivering notice to us and following the procedures and subject to conditions set forth in Annex I of Principles. Under the DPF we acknowledge that we may be liable for onward transfers to third parties. We have identified the JAMS IRM Service as the independent recourse mechanism available to address complaints free of charge and provide appropriate recourse. They may be contacted at jamsadr.com/eu-us-data-privacy-framework. In addition, we acknowledge that we are subject to investigatory and enforcement powers of the Federal Trade Commission (FTC). If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit dataprivacyframewor.gov/.

Additional Information - Canada

In Canada, electronic communications are governed in part by Canada's Anti-Spam Legislation, effective as of July 1st, 2014, and its relevant rules and regulations ("CASL"). As it relates to anti-spam activities, CASL requires organizations, in their electronic communications with others, to comply with certain consent and informational requirements. Such electronic communications include newsletters, product updates, pricing information and promotional material. James Hardie is committed to making sure that it respects the law, as well as the choice of any third party, with respect to electronic communications. Where applicable, James Hardie will ask for your opt-in express consent to receive such electronic communications.

Changes to Policy

We may change or update portions of this Privacy Policy (including any supplements) in the future. When we do, we will post it on our websites. Your continued use of our websites following the posting of changes means you accept the changes.

If you have any questions, concerns, or suggestions regarding this privacy policy, please contact us at [email protected].