Privacy Statement

Privacy Statements

Main

AXALTA COATING SYSTEMS GLOBAL PRIVACY STATEMENT

Last Updated: February 2023

Axalta Coating Systems, LLC and its affiliates worldwide (collectively “Global Axalta Group”, “Axalta”, or “we”) respect your privacy.

This Global Privacy Statement (“Privacy Statement”) describes the types of personal information (“Personal Information”) we may collect, the purposes for which we may collect that Personal Information, the other parties with whom we may share it, and the measures we take to protect the security of the data. It also tells you about your rights and choices with respect to your Personal Information, and how you can contact us about our privacy practices. This Privacy Statement should be taken together with any other privacy policy, statement or notice that we may provide on specific occasions when we are collecting or processing information about you. This Privacy Statement is intended to supplement other policies, statements or notices and is not intended to override them unless explicitly addressed herein.

Our privacy practices may vary among the countries in which we operate to reflect local practices and legal requirements. If you apply for a job through our website, then the Personal Information you provide may be governed by a separate privacy notice.

1. ABOUT THIS STATEMENT

What this statement applies to. This statement applies to the Personal Information that we collect when you interact with the Global Axalta Group brand online and offline. This includes information collected through our websites, Wi-Fi services or similar technology provided by Axalta, branded pages on third party platforms (i.e., social networking services), mobile applications, and through our direct marketing campaigns or other communications, as well as, when you purchase our products, subscribe to our news and offers, enter one of our promotions, or contact customer support.

What this statement does not apply to. This Privacy Statement does not address, and we are not responsible for, the privacy, information, or other practices of any third parties, including any third party operating any site to which the website contains a link. The inclusion of a link on the website does not imply endorsement of the linked site by the Global Axalta Group.

Changes to this statement. If we make a change to this statement, then we will make previous versions available upon request. If we make any material changes to this statement, then we will notify you by means of a notice on this site or by an email (sent to the email address specified in your account). Where we are required by applicable data protection laws, we will also seek your consent to any material changes that affect how we use your Personal Information. We encourage you to periodically review this page for the latest information on our privacy practices.

2. PERSONAL INFORMATION WE COLLECT AND USE

Information Received Directly from You

We collect Personal Information when you participate in various services or opportunities that we provide, for example:

Orders and Requests: we collect Personal Information when you order a product or service or make a request.
Website Communications: we collect Personal Information when you register for subscriptions, technology forum or other communications through the website.
Promotions: we collect Personal Information when you participate in a contest, promotion, sweepstakes, survey, or other promotion.
Blogs & Forums: we collect Personal Information when you participate in a blog or forum.
Events and Market Research: we collect Personal Information when we conduct market research, meet you at a trade show or other event.

Where we need to collect your Personal Information by law, or under the terms of a contract we have with you, and you fail to provide that information when requested, we may not be able to perform the contract we have or are trying to enter with you (for example, to provide you with our products or services). In this case, we may have to cancel the contract and notify you accordingly.

Information Received from Third Parties

We may collect information about you from other companies and organizations, including public databases, social media platforms, our third-party marketing partners, or various independent purchasing organizations.

Publicly Available Information

We may also collect information that is publicly available. For example, we may collect public information about you when you interact with us through social media. By collecting additional information about you, we can correct inaccurate information, enhance the security of your transactions, and, if permitted under local law, give you product recommendations and special offers that are more likely to interest you.

Information Collected Automatically

Whenever you visit or interact with Global Axalta Group services, as well as any third-party advertisers and/or service providers, we may use a variety of technologies that automatically or passively collect information about your online activity. This information may be collected in the following ways:

Through your browser: Certain information is collected by most browsers, such as your Media Access Control (MAC) address, computer type (Windows or Macintosh), screen resolution, IP address, operating system version and Internet browser type and version. Your “IP Address” is a number that is automatically assigned to the computer that you are using by your Internet Service Provider (ISP). An IP Address is identified and logged automatically in the Global Axalta Group server log files whenever a user visits the website, along with the time of the visit and the page(s) that were visited. Collecting IP Addresses is standard practice on the Internet and is done automatically by many websites. The Global Axalta Group uses IP Addresses for purposes such as calculating website usage levels, helping diagnose server problems, administering the website, and presenting content that is tailored to your country. We may also use and disclose IP Addresses for all the purposes for which we use and disclose other Personal Information.
Through Cookies: Cookies allow a web server to transfer data to a computer for recordkeeping and other purposes. We use cookies and other technologies to, among other things, better serve you with more tailored information, to facilitate your ongoing access to and use of the website, and to provide you with personalized marketing. If you do not want your information collected by cookies, there is a procedure in most browsers that allows you to decline the use of cookies. Some features of the website may not work properly if you decline the use of cookies. To learn more about cookies, please visit http://www.allaboutcookies.org/
Through pixel tags, web beacons, clear GIFs, or other similar technologies: These may be used in connection with some website pages and HTML-formatted email messages to, among other things, track the actions of website users and email recipients, measure the success of the Global Axalta Group marketing campaigns, and compile statistics about website usage and response rates.
From you: Information, such as your location, as well as other information, such as your preferred means of communication, is collected when you voluntarily provide this information.

Combined Information

For the purposes stated in this Privacy Statement, we may combine Personal Information that we collect about you with Personal Information you provide to the Global Axalta Group through other sources, such as product registrations, inquiries, or marketing events. We will use the combined Personal Information in accordance with this Privacy Statement unless expressly stated otherwise.

Other Ways We Use the Information We Collect

In addition to the uses we identified above, we may use Personal Information for the following purposes:

Business Prospecting. Exploring or initiating prospecting of potential customers and vendors, including:

· Searching for and providing information to potential corporate customers and vendors and appropriate contact persons;

· Researching prior purchase history and interactions, as well as potential interest in Axalta products and services of corporate customers and vendors;

· Contacting the contact persons for potential corporate customers and vendors;

· Reviewing sales and marketing activities and assessing performance and conversion rates of those activities;

· Facilitating sweepstakes, contests, and similar promotions;

· Supporting messages to a friend through the website;

· Facilitating related business development opportunities, as relevant;

· Facilitating communications in furtherance of the foregoing; and/or

· Satisfying reporting and auditing obligations

Conducting Business and Managing Client Relationships. The organization and operation of our business, including:

· Operating our business by developing, producing, marketing, selling, and providing goods and services;

· Improving our website, blog, message board, forums, chat functionality, mobile apps, and marketing activities by conducting tests, research, and analysis of users;

· Displaying website, mobile apps and marketing content to users, customers, and prospective customers;

· Providing after-sales services to clients;

· Auditing and assessing performance of business operations, including client services and associated activities;

· Training and quality control;

· Satisfying client reporting and auditing obligations;

· Facilitating business development opportunities, as relevant; and/or

· Facilitating communications in furtherance of the foregoing.

Security and Monitoring. To monitor and secure our resources and network, including:

· Monitoring for, preventing and investigating suspected or alleged misconduct or violations of law;

· Monitoring for, preventing, investigating, and responding to security and privacy incidents; and/or

· Monitoring activities, access, and use to ensure the security and functioning of our systems and assets.

Auditing, reporting, corporate governance, and internal operations, relating to financial, tax and accounting audits, and audits and assessments of our business operations, security controls, financial controls, or compliance with legal obligations, and for other internal business purposes such as administration of our records retention program.

M&A and Other Business Transactions, for purposes of planning, due diligence, and implementation of commercial transactions, for example mergers, acquisitions, asset sales or transfers, bankruptcy or reorganization, or other similar business transactions.

Defending and Protecting Rights, to manage and respond to legal disputes, to respond to legal claims or disputes, and to otherwise establish, defend, or protect our rights or interests, or the rights, interests, health or safety of others, including in the context of anticipated or actual litigation with third parties.

Compliance with Applicable Legal Obligations, relating to compliance with applicable legal obligations (such as responding to subpoenas and court orders) as well as assessments, reviews and reporting relating to such legal obligations.

Sensitive Personal information

Under different laws, certain information that we collect may be considered sensitive personal information (“Sensitive Personal Information”), such as your financial account, identity information, location, and any other information that might endanger the safety of you or your property, or may lead to damage to personal reputation, physical or mental health or discriminatory treatment. In particular, Sensitive Personal Information includes, but is not limited to:

· Financial Information: includes bank account number, credit card number, debit card number, or any other financial information.

· Precise Geolocation: includes your precise location (or the precise location of your device).

· Communication Information: includes the contents of your communications using email and other messaging accounts (except when those communications are to or from us).

· Other Sensitive Personal Information: includes browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement, device type, physical location or movements.

If permitted under local law, we may collect, use, and share your Sensitive Personal Information when it is necessary for our relationship with you. We will use it for the purposes we described above. You need to carefully consider whether to disclose any of your Sensitive Personal Information, but keep in mind that there may be consequences if you do not. You agree that your Sensitive Personal Information will be treated in accordance with the purposes and manners described in this Privacy Statement.

Axalta does not knowingly collect data from children. If you are under 16 (or under 14 in China) (or under 18 in Brazil) please do not provide any information to us.

Refusing to Consent

If permitted under local law, and you wish to refuse consent to our proposed collection, use, or disclosure of your Personal Information, then you must notify us within thirty (30) days (or within the timeframe prescribed by local law) by using the “Contact Us” information in Section 14 below.

Withdrawal of Consent

If we have asked for you consent to process your Personal Information, under certain local laws, you have the right to withdraw your consent at any time. This includes the right to withdraw your consent for purposes of direct marketing. If you withdraw your consent pursuant to local laws, this doesn’t affect the lawfulness of the processing before you withdrew consent. To withdraw consent, you must contact us in writing using the “Contact Us” information in Section 14. If you withdraw your consent, however, then we may not be able to adequately provide you the assistance, products, or services you requested.

Anonymity

We give customers the option to remain anonymous, where practicable. However, if you do not provide us with the Personal Information that we need, then we may not be able to adequately provide you the assistance, products, or services you requested.

If You Fail to Provide Personal Information

If you fail to provide certain information when requested or if you withdraw your consent, we may not be able to perform the contract we have entered into with you (such as providing you with products, services, or assistance), or we may not be able to comply with our legal obligations (such as to pay taxes or conduct required reporting). If we need to process your Personal Information to provide you a service or benefit, or to fulfill our obligations to you, we will tell you that in the event you do not provide or withhold your consent for us to process that Personal Information.

3. LEGAL BASES FOR PROCESSING PERSONAL INFORMATION

All processing and use of your Personal Information is justified by at least one “legal basis” for processing. In most cases, processing will rely on one of the following legal bases:

Contract performance: The processing is necessary to perform a contract with you or take steps to enter into a contract at your request, such as to fulfil an order, or to provide product information you have requested;
Legal obligation: The processing is necessary for us to comply with a relevant EEA, UK, South African, Russian, Turkish, or other legal obligation, such as keeping accounting records;
Legitimate interests: The processing is in our legitimate interests, which are not overridden by your interests and fundamental rights; or
Consent: You have consented to the processing. This Consent may be according to the legislation obtained as “tacit consent” by accessing to our websites.

Mainly, we use the Personal Information we collect for the below purposes:

Contract performance:
- Provide you with documentation or communications which you have requested (pre-contractual steps)
- Support and manage a recruitment, work placement or internship process, including considering applications and making offers (pre-contractual steps)
- Provide after-sales support
- Provide you with any services or products you have contracted for
- Administer and manage performance of purchase or sales agreements with our suppliers and customers who are natural persons
- Process, evaluate, and complete certain transactions involving the website, and more generally transactions involving Axalta’s products and services
Legitimate interests:
- Administer and manage performance of purchase or sales agreements with contact persons for our suppliers and customers who are legal persons
- (or consent, where required by law) Operate, evaluate, maintain, improve, and develop the website (including by monitoring and analyzing trends, access to, and use of the website for advertising and marketing with the help of analytics software)
- Evaluate, improve, and develop our products and services generally
- Customize our website to users’ needs
- Engage you about events, promotions, the website and Axalta’s products and services, where it is lawful for us to do so
- Correspond with users to resolve their queries or complaints
- Send you marketing communications, where it is lawful for us to do so
- Protect and ensure safety of the website, Axalta confidential and proprietary information, and Axalta employees
- Manage, protect against and investigate fraud, risk exposure, claims and other liabilities, including but not limited to violation of our contract terms or laws or regulations
- Share your personal data with third parties in connection with the potential or actual sale of our company or any of our assets, or those of any affiliated company, in which case personal data held by us about our users may be one of the transferred assets

Where required by law, Axalta will obtain your consent before processing and/or using your Personal Information.

While the processing of Personal Information can be justified by at least one “legal basis,” the processing of Sensitive Personal Information requires at least two “legal bases” for processing.

4. HOW WE SHARE YOUR PERSONAL INFORMATION

We will only share the information collected from or about you with the following categories of companies in the following ways:

The Global Axalta Group. The Global Axalta Group may share your information among our entities to administer our loyalty programs, process orders and requests, and expand and promote our product and service offerings. Members of the Global Axalta Group who receive your Personal Information are not authorized to use or share the information, except as set out in this Privacy Statement and all Global Axalta Groups operate under the same internal practices in the protection of the Personal Information.

Third Party Service Providers. We may share your Personal Information with vendors who provide services to us, such as businesses, professional, or technical support functions. This includes, but is not limited to, service providers that host or operate Global Axalta Group services; data processing or other information technology services; carrying out research and analysis; providing customer experience management services; and personalizing individual customer experiences. We do not allow these vendors to use or share this information for any purpose other than to provide services on our behalf.

Business Transfers. Your Personal Information is considered a company asset and may be disclosed or transferred to a third party in the event of a proposed or actual purchase, any reorganization, sale, lease, merger, joint venture, assignment, amalgamation or any other type of acquisition, disposal or financing of all or any portion of our business or of any of the business assets or shares (including in connection with any bankruptcy or similar proceeding) of the Global Axalta Group or a division thereof, in order for you to continue to receive the same products and services from, or to continue the same or similar relationship with, the third party.

Legal Disclosures. We may disclose your information if we believe that the disclosure is required by law, a subpoena or other legal process; if we believe that the disclosure is necessary to enforce our agreements or policies; or if we believe that the disclosure will help us protect the rights, property, or safety of the Global Axalta Group or our customers or partners.

When You Consent. We may share your information with other companies if you give us permission or direct us to share the information.

Types of Third Parties: The following types of third parties who may process your information for the purposes described above include:

• service providers

• advisors and agents

• government entities and law enforcement

• affiliates and subsidiaries

• data analytics providers

• internet service providers

• operating systems and platforms

• business customer/client

Axalta does not sell customers’ Personal Information to any one and Axalta does not share Personal Information with third parties for those parties’ commercial use. Axalta does not knowingly collect, sell, or share children’s Personal Information.

5. TARGETED ADVERTISING

When permitted under local law, the Global Axalta Group and third-party service providers use cookies, pixel tags, web beacons, clear GIFs, or similar technologies to track the actions of website users and email recipients across non-affiliate websites over time, in order to personalize your experience on the website by presenting advertisements that are more relevant to you. For example, we use third party service providers, to present products and offers tailored to the preferences and interests demonstrated by your online activity over time. If you would like to opt-out of receiving personalized ads from third party advertisers and ad networks who are members of the Network Advertising Initiative (NAI) or who follow the Digital Advertising Alliance’s Self-Regulatory Principles for Online Behavioral Advertising, you may visit the opt-out pages on the NAI website and DAA website. You understand that these opt-out mechanisms are maintained by third parties, not Axalta. Axalta is not responsible for, nor does it control these mechanisms of the third parties who choose to participate in these opt-out programs.

Cookies

“Cookies” are small files which enable us to store individual information related to your computer or other device used to access our website. Cookies help us, e.g., to determine the frequency of use and the number of people visiting our website.

The following are different types of cookies:

Session cookies: are stored only temporarily during a browsing session and are deleted from the visitor’s device when the browser is closed.

Persistent cookies: are saved on your device for a fixed pre-defined period of time (usually several months) and are not deleted when the browser is closed. Persistent cookies are used where we need to be able to recognize your device for more than one browsing session.

First party cookies: are set by the website you are visiting, and they can only be read by that site. Third party cookies are not set by the owner of the website you are visiting, but by a different organization. For example, advertisers and other third parties may use their own cookies when you click on an advertisement or link on our website, or we might engage a third-party analytics company that will set their own cookie to perform this service.

The above types of cookies can be grouped into the following categories of cookies:

Necessary cookies are cookies that are required for the operation of our website, such as to ensure security. Other necessary cookies allow us to provide features or services that you expressly request. These cookies do not require your consent and cannot be switched off (although in some cases you can change your requests). You can set your browser to block or alert you about these cookies, but some parts of our website may not work if you block these types of cookies.

Functional cookies are used to provide certain functionalities to you by recording your choices and settings regarding our services, maintaining your preferences over time and recognizing you when you return to our website so that we can offer you a better experience on this website. We will only store and access functional cookies on your device if you consent to such storage and access. If you do not consent to these types of cookies, then we will not be able to provide certain functionalities to you.

Analytics cookies allow us to analyze website usage and understand how visitors use it. These cookies recognize and collect information about the number of visitors, the pages they view, how long they view pages and how they move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that visitors are easily finding what they are looking for. We will only store and access analytics cookies on your device if you consent to such storage and access. If you do not consent to these types of cookies, we will not be able to improve our website based on information from your visit.

We use the following “cookies” on our websites in connection with some of the functionalities described below.

Cookie Type	Name	Purpose	Lifespan
Necessary cookies	.auth.axaltacs.com	This cookie is necessary to facilitate basic site functionality, such as remembering log-in state and allows you to be automatically signed in to an Axalta service for which you have previously registered.	will be deleted after your session
Functional cookies	.axaltacs.com, .axalta.com, .standox.com, .spieshecker.com, .cromax.com	These cookies allow Axalta to remember choices you make such as your language or the region you are in and provide enhanced, more personal features. The information these cookies collect may be anonymized and they cannot track your browsing activity on other websites.	12 months
Analytics cookies	.addthis.com	The cookie is used to aggregate data to offer reporting to websites that use AddThis. AddThis provides analytics to help Axalta better understand their visitors. For example, AddThis uses a randomly generated ID assigned to each web browser to tell a website publisher how many people are sharing content. They also use aggregate browsing data to tell a website publisher whether the people most likely to share their content with their friends.	13 months
Analytics cookies	.statse.webtrekklive.com, .webtrekk.com	Axalta analytics system uses cookies to gather information regarding visitor activity on the website and other Axalta online services. The data gathered is sent to Webtrekk, our analytics partner, for analysis and reporting. Axalta uses this information to help improve the services it provides to its users. Data is only used in aggregated form. Further details can be found here.	6 months

The content of a cookie is limited to an identification number. Name, IP-address or other information regarding your true identity is only collected to the extent necessary for the operation of the functionality cookies (i.e., in connection with the log-in function).

Managing Cookies and Withdrawing Consent

We will obtain your opt-in consent for the use of the cookies and other tracking technologies on this website when you first access the website and if we introduce any new cookies to the website, unless they are necessary cookies, in which case your consent is not required. When you visit this website, a pop up will appear to inform you about our use of such cookies. You can then consent by clicking on “Accept,” or you may refuse cookies (except necessary cookies) by clicking on “Reject.” You may alternatively click on the link to the cookie manager to visit our Consent Management Platform and decide the categories of cookies that you wish to accept, and the cookies you wish to reject.

You may withdraw your consent at any time with effect for the future.

If you reject cookies, then we will not set those cookies on your device, except necessary cookies and a cookie to remember that you don’t want any cookies set when you visit this website.

If you have accepted cookies but want to reject them (withdraw your consent) for the future, then you can delete the cookies in your website browser and the cookies window (including the link to the cookie manager) appears again.

You can also disable cookies by changing your website browser settings to reject cookies. Rejecting cookies will prevent your browser from accepting new cookies, as well as (depending on the sophistication of your browser software) allow you to decide on acceptance of each new cookie in a variety of ways. You can also delete all cookies that are already on your device. If you do this, however, then you may have to manually adjust some preferences every time you visit this website. All modern browsers allow you to change your cookie settings, typically by going to the ‘options’ or ‘preferences’ menu of your browser. Use the “Help” option in your browser for more details.

(i) Cookie settings in Internet Explorer

(ii) Cookie settings in Microsoft Edge

(ii) Cookie settings in Firefox

(iii) Cookie settings in Chrome

(iv) Cookie settings in Safari web and iOS.

If you choose not to use the cookie preference tool, but instead control cookies through browsers, please remember to change your settings in each browser and for each of your devices.

Blocking all cookies (including necessary cookies) will have a negative impact upon the usability of many websites, including ours. If you block necessary cookies, you may not be able to use all the features on this website. You can also delete cookies already stored on your computer. However, deleting cookies might have a negative impact on the usability of many websites, including ours.

To find out more about cookies, visit www.aboutcookies.org or www.allaboutcookies.org.

6. INTERNATIONAL DATA TRANSFERS

Axalta primarily stores the Personal Information we collect in the United States. To facilitate Axalta’s global operations, we and/or our service providers may transfer and access your Personal Information from locations around the world. This may involve transferring your Personal Information outside the country where you live. For example, we may use a server hosted overseas to store data, which may include your Personal Information. Your Personal Information may also be processed by employees or by other third parties who work for us, or by the representatives and employees of our parent, affiliate, or other subsidiary companies. If we transfer your Personal Information to third parties in other countries, then we will only do so if the third party offers an adequate level of protection under the law and only as necessary for the performance of our obligations or where you have provided explicit consent.

We will take all steps reasonably necessary to ensure that your Personal Information is treated securely and in accordance with this Privacy Statement. We only share Personal Information with third-parties who adequately implement appropriate technical and organizational measures and who guarantee the protection of your rights as required under the laws that apply to you. We’ve described the different categories of third parties we may share your Personal Information within section 4 of this Privacy Statement titled “How We Share Your Personal Information,” and we may also have a legal obligation to share your Personal Information with government agencies.

For example, if you live in the EEA, Australia, Brazil, or China, if we transfer your Personal Information out of your respective area, we will ensure one of the following safeguards is implemented:

We will only transfer your Personal Information to countries that have been deemed to provide an adequate level of protection for Personal Information (for example, in the EEA, this is decided by the European Commission); or
We may use specific contracts approved by the law which give Personal Information the same protection it has in your country; or
We will ensure there is some other protection in place which has been approved by the law as giving Personal Information the same protection it has in your country.

We may transfer your Personal Information to the following countries: Argentina, Australia, Brazil, Canada, China, Colombia, Costa Rica, Dominican Republic, Ecuador, El Salvador, the European Economic Area, Guatemala, Honduras, India, Indonesia, Japan, Malaysia, Mexico, Morocco, Nicaragua, Panama, Philippines, Russia, Singapore, South Africa, South Korea, Taiwan, Thailand, United Arab Emirates, United Kingdom, United States, or Vietnam.

For more information about transferring your Personal Information from China to another country, please refer to the NOTICE FOR CHINA RESIDENTS section below.

7. NOTICE FOR CALIFORNIA RESIDENTS

This section of this Privacy Statement applies to residents of California.

“Legal Categories” of Personal Information

We collect the following “legal categories” of Personal Information:

The legal category of Personal Information,
Examples of the types of Personal Information included in each legal category,
The source from which your Personal Information is collected,
The purpose for why we collect and use your Personal Information for each legal category; and
The business purposes for which we share your Personal Information and with whom.

We’ve included these categories in the Personal Information Privacy Chart at the end of this Privacy Statement.

California Residents’ Rights

For all Personal Information that we collect about you, you may have the rights and choices described, in section 11 of this Privacy Statement titled Your Rights and Choices. For any request you would like to make, we will accommodate it as long as it meets legal and regulatory requirements and does not risk making our other data less secure or changing our other data. You may also designate an authorized agent to make a request on your behalf.

California Privacy Rights under California’s Shine the Light Law

Under California’s “Shine the Light” law (Cal. Civ. Code § 1798.83), any California resident who provides certain Personal Information to us in obtaining products or services for personal, family, or household purposes is entitled to request and obtain from us, free of charge, a list of categories of Personal Information disclosed to third parties during the immediately preceding calendar year for those third parties’ own direct marketing purposes and a list of the categories of third parties to whom we disclosed such information. Such requests may be made once per calendar year for information about any relevant third party sharing in the prior calendar year. California residents who would like to make such a request may submit a request in writing to CAPrivacy@axalta.com or through our California resident rights webform. The request should attest to the fact that the requester is a California resident and provide a current California address.

Do Not Track Signals

Your browser settings may allow you to automatically transmit a “Do Not Track” signal to online services you visit. Note, however, there is no consensus among industry participants as to what “Do Not Track” means in this context. Like many online services, we currently do not alter our practices when we receive a “Do Not Track” signal from a visitor’s browser. We do, however, respond to the Global Privacy Control signal for California residents wishing to opt-out of the “sale” of their Personal Information.

8. NOTICE FOR NEVADA RESIDENTS

Nevada law allows residents to opt out of the sale of certain Personal Information, called “covered information.” We do not sell covered information as defined under Nevada law and we have no plans to change that practice.

9. NOTICE FOR CHINA RESIDENTS

For the Personal Information processing subject to the Personal Information Protection Law of People’s Republic of China (the “PIPL”), we may rely on the following legal bases under the PIPL to process your Personal Information:

Contracts. Where we need to perform the contract we are about to enter into or have entered into with you, including for purchases, orders, or services.
Voluntary Disclosure. To use Personal Information disclosed by yourself or other Personal Information that has been lawfully disclosed, within a reasonable range.
Consent. Where we have obtained your consent, if it is required.

Even though it would be rare, we may also use your Personal Information in the following situations:

Emergencies. In response to public health emergencies, or necessary to protect the life, health and property of natural persons in emergency situations.
Public Interest. To implement news reporting, public opinion supervision and other acts in the public interest, within a reasonable range.
Criminal Convictions. Where necessary for the purposes of processing criminal convictions data as permitted by applicable local laws.
Laws and Regulations. Other circumstances as provided by laws and regulations.

Privacy Rights

For all Personal Information that we collect about you, you may have the rights and choices described above, in Section 11 of this Privacy Statement titled Your Rights and Choices. For any request you would like to make, we will accommodate it as long as it meets legal and regulatory requirements and does not risk making our other data less secure or changing our other data. You may also designate an authorized agent to make a request on your behalf.

International Data Transfers

When we transfer your Personal Information out of China, we will use lawful cross-border transfer mechanisms to transfer your Personal Information and adopt necessary measures to ensure the overseas recipients can provide the level of protection required under applicable Chinese laws. You understand that your Personal Information might be exported to the following countries / regions outside of China for the purposes as indicated. You agree to this cross-border transfer, otherwise we may be unable to continue your relationship with Axalta.

Recipient	See Section 4
Recipient Country / Region	See Section 4
Types of Personal information	See Section 2
Purposes	See Section 2
Transfer Method	See Section 6
Retention Period	See Section 12
Recipient Privacy Notice	Provided where and when required by law

10. NOTICE FOR MEXICAN RESIDENTS

Identity of company responsible of Personal Information management: Axalta Coating Systems México, S. de R.L. de C.V.

Address: Avenida Industria Eléctrica número 10, Colonia Industrial Barrientos, Tlalnepantla de Baz, C.P. 54015, Estado de México, México

Contact information:

Email: PrivacidadAXALTA@axaltacs.com

Phone: 53.66.46.00 from Monday to Friday at 9:00am to 4:00pm

How to access to your Access, Rectification, Cancellation and Opposition (or Objection) rights: You or your legal representative may exercise any of the rights of access, rectification, cancellation or opposition, as well as revoke your consent for the processing of your personal data by sending an email to our Department of Protection of Personal Data at the address PrivacidadAXALTA@axalta.com. Likewise, you can call 53.66.46.00 from Monday to Friday from 9:00 am to 4:00 pm (Mexico Central Time) where you will be attended to in a timely manner. Upon request, we will provide you with a “Application Form for the Exercise of the Rights of the Holders”.

In order for our Department of Protection of Personal Data to follow up on your request, you or your legal representative must correctly prove your identity for which it is necessary to complete all the fields indicated in the form and accompany it with a copy of any of the current official identifications indicated therein.

In the event that the information provided is erroneous or insufficient, or the corresponding accreditation documents are not accompanied, then, our Personal Data Protection Department, within five (5) business days following receipt of the request, may require you to provide the elements or documents necessary to process it. You will have ten (10) business days to meet the request, counted from the day after you received it. If no response is given within that period, then the corresponding application will be deemed not to have been submitted.

Our Department of Protection of Personal Data will inform you of the determination adopted, within a maximum period of twenty (20) business days from the date on which the request was received, so that, if appropriate, it becomes effective within fifteen (15) business days following the communication of the response.

Options and how to limit the use or disclose your Personal Information. You may limit the use or disclosure of your personal information by sending your request to our Personal Data Protection Department at the address PrivacidadAXALTA@axalta.com The requirements to prove your identity, as well as the procedure to meet your request will be governed by the same criteria indicated in the previous section. If your request is appropriate, our Personal Data Protection Department will register it on Axalta's own exclusion list

Authorities. You have the right to go to the National Institute of Transparency Access to Information and Protection of Personal Data (INAI) to assert any disagreement related to your right to the protection of personal information.

11. YOUR RIGHTS AND CHOICES

Under certain circumstances, you have rights under applicable data protection laws in relation to your Personal Information. You have the right to:

Know What Personal Information We Have. You may have the right to know what Personal Information is being collected about you, whether it is disclosed, and to whom. If you have questions, you also have the right to ask that we explain Personal Information handling rules and policies to you.

Access Your Personal Information. You can request access to your Personal Information. This enables you to receive a copy of the Personal Information we hold about you and to check that we are lawfully processing it. You may reasonably access your Personal Information by contacting the Global Axalta Group Privacy Office. Please note that we may request specific information from you to enable us to confirm your identity and right to access, as well as to search for and provide you with the Personal Information we have about you.

Your right to access the Personal Information that we hold about you is not absolute. There are instances where applicable law or regulatory requirements allow or require us to refuse to provide some or all the Personal Information we hold about you. In addition, the Personal Information may have been destroyed, erased, or made anonymous. If we cannot provide you with access to your Personal Information, we will inform you of the reasons why, subject to any legal or regulatory restrictions.

Modify or Update Your Personal Information. We aim to ensure that Personal Information in our possession is accurate, current, and complete. If you believe that the Personal Information about you is incorrect, incomplete, or outdated, you may request the revision or correction of that information. We will use reasonable efforts to revise it and, if necessary, to use reasonable efforts to inform agents, service providers or other third parties, which were provided with inaccurate information, so records in their possession may also be corrected or updated. However, we reserve the right not to change any Personal Information we consider accurate or if it is necessary for our records.

Erasure of Your Personal Information. You may ask us to delete or remove Personal Information where there is no legal reason for us to continue using it. You also have the right to ask us to delete or remove your Personal Information where you successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your Personal Information to comply with law. Please note that we may not always be able to comply with your request of erasure for specific legal reasons which we will notify you, if applicable, at the time of your request.

Object to Processing Your Personal Information. You may have the right to object to us processing your information in certain circumstances. This right applies when we are processing your Personal Information based on a legitimate interest (or those of a third party), which you may challenge if you feel it impacts your fundamental rights and freedoms. You also have the right to object where we are processing your Personal Information for direct marketing purposes. However, in some cases, we may demonstrate that we have compelling legitimate ground to process your information or legal obligations which override your rights and freedoms.

Data Portability. You may request that we transfer your Personal Information to you or a third party. We will provide to you, or a third party you have chosen, your information in a structured, commonly used, machine-readable format. Please note this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Opt Out of Sale/Marketing: Axalta gives you many choices regarding Axalta’s use and disclosure of your Personal Information for marketing purposes. By contacting Axalta, you may opt-out from receiving future electronic marketing messages from Axalta and request that we not share your Personal information with unaffiliated third parties for their marketing purposes.

Please also note that if you do opt-out of receiving marketing-related messages from the Global Axalta Group, we may still send you important administrative messages, and you cannot opt-out from receiving administrative messages.

If you would like to review, correct, update, suppress, delete or otherwise limit Axalta’s use of your Personal Information that has been previously provided to Axalta, then you may contact us using the methods in the “Contact Us” Section 14 below.

Non-Discrimination, Incentives: Businesses may not discriminate against people who exercise their privacy rights. Discrimination may exist where a business denies or provides a different level or quality of goods or services, or charges (or suggests that it will charge) different prices or rates or impose penalties on residents who exercise their privacy rights, unless doing so is reasonably related to the value provided to the business by the person’s data.

Restrict Processing: Your country’s laws may allow you to ask that we restrict processing of your Personal Information if: (a) you want us to establish the data’s accuracy; (b) where our use of the data is unlawful, but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data, but we need to verify whether we have overriding legitimate grounds to use it.

Restrict Processing of Sensitive Information: You may have the right to ask us to limit our processing of your Sensitive Personal Information to what is necessary to our relationship with you. While Axalta’s practices are to restrict processing of your Sensitive Personal Information to what is strictly necessary at all times, you are welcome to make a request using the methods in the “Contact Us” Section 14 below.

Right to Make a Complaint: You have a right to contact us about our Personal Information practices, and you can do so using one of the methods in the “Contact Us” Section 14 below. We will evaluate your communication and will contact you if we need further information to resolve it. In addition, you may have the option of communicating to a government authority if you believe we have not processed your Personal Information in compliance with the laws and principles that apply in your home country. If you would like to make a complaint to an authority, you may contact your country’s supervisory authority, including, but not limited to, the following: Canada: Office of the Privacy Commissioner of Canada, or your province or territory’s privacy commissioner; Australia: the Australian Privacy Commissioner; Brazil: National Data Protection Authority; European Economic Area: your country’s supervisory authority; China: Cyberspace Administration of China.

Rights In Different Countries: Depending on where you live, you may have the following additional rights:

Transfer: In Brazil, China, or the European Economic Area, you may ask us to transfer your Personal Information to you or to a third party in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
Intervention in Automated Decision Making: In Brazil, China, or the European Economic Area, you can request to have a human review an automated decision made by automated means that affects your interests, including decisions intended to define your personal, professional, consumer and credit profile, or aspects of your personality. You may also have the right to ask us to explain the automated decision making process.
Anonymize: If you live in Brazil and believe we are processing unnecessary or excessive Personal Information about you under the law, you may ask us to anonymize, block, or delete it.
Opt-Out of Collection: For customers in India and China, you may opt out of the collection of your Personal Information by contacting us using the contact information below. If you choose to opt out of collection, however, we may not be able to adequately provide you the assistance or services you requested or continue providing you with products, services, or assistance.

How to Make a Request: If you would like to make a request, then please contact us using the information in the “Contact Us” Section 14 of this Privacy Statement. Please include your name, address, email, phone number, and the specific type of request you would like to make (a request to know, erase, opt out of sale, etc.). If you would like an authorized agent or lawyer to make a request on your behalf, then we will ask you for written confirmation that you have appointed the agent or lawyer, as described in the “Verify Your Identity” section below, and will verify the agent’s or lawyer’s identity separately.

Responding to Requests: Your request will be evaluated to determine whether it meets legal regulatory requirements and does not risk making our other data less secure or changing our other data. If we aren’t able to honor any part of your request, we will tell you that in our response, as well as the reason(s) we cannot do so.

Verifying Your Identity: To protect you and your information, we may ask you to confirm certain information before we honor your request. For example, if you make a request, we will ask you to confirm your name, email address, and phone number. For certain requests, we will use a combination of your name, email address, phone number, zip code, address, and/or birth date to verify your identity, so that we can help protect your information. If you designate an authorized agent or lawyer to make a request on your behalf, we may require you to verify your identity and provide the authorized agent’s or lawyer’s identity and contact information to us.

12. HOW LONG WE KEEP YOUR INFORMATION

To the extent permitted by applicable law, we retain your Personal Information as long as (1) it is needed for the purposes for which we obtained it and in accordance with this Privacy Statement or (2) we have another lawful basis for retaining that information beyond the period for which it is necessary to serve the original purpose. If permitted under local law and if the lawful basis for processing that data is based solely on consent, then we will delete the Personal Information if that consent is revoked.

13. OUR SECURITY

We recognize the importance of maintaining the security of your Personal Information. We protect your information using security measures, including physical, administrative, and technical safeguards to reduce the risk of loss, misuse, unauthorized access, disclosure, or modification of your information.

While we have employed security technologies and procedures to assist safeguarding your Personal Information, no system can be guaranteed to be 100% secure. Please note that we cannot ensure or warrant the security of any information you transmit to us. Your use of Axalta services and providing us with your information is at your own risk.

14. CONTACT US

For questions regarding this Privacy Statement, you can contact us, as follows:

Email: Data-Privacy@axalta.com

Phone: 1-(855)-547-1461

Address: 50 Applied Bank Blvd STE 204, Glen Mills, PA 19342

For California residents, please contact us at: CAPrivacy@axalta.com

For South African residents, please contact us at:

Hannes Kloppers, The Axalta Group South Africa (Pty) Ltd; 121 Gazelle Avenue, Corporate Park South, Randjespark, Midrand, 1685, South Africa

Phone +27 10 592 1768.

Turkish residents please contact us at:

Elif Sahin, Axalta Boya Sistemleri, Plot G 22 B13 C1D, Axalta Boya Sistemleri, Cumhuriyet Mahallesi, Kadife sokak No: 9, 41480 Çayırova / Kocaeli, Türkiye,

Phone +90 262 674 00 00.

For Brazilian residents, please contact us at: dpo-data-protection-officer@axalta.com.

PERSONAL INFORMATION PRIVACY CHART

We collect customers’ Personal Information as described above for the following business purposes, when permissible under applicable law. We may collect your Personal Information directly from you, partners, contractors or consultants, vendors, third parties (background check services), distributors, customers, our affiliates, or other individuals and businesses, as well as public sources of data such as consumer reporting agencies or recruiters or talent agencies. In particular, we sometimes collect the following categories of Personal Information:

Legal Category	Examples of Types of Information Collected	Sources	Purposes for Collection and Use	Sharing with Third Parties
A. Identifiers.	Real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers.	· Directly from You · Automatically from Your Devices · From Third Parties	· Orders and Requests · Purchase Registration · Warranty · Site Communications · Promotions · Blogs & Forums · Events and Market Research	· Service Providers · Business Partners · Advertising Networks · Promotional Advertising Companies
B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).	Name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some Personal Information included in this category may overlap with other categories.	· Directly from You · From Third Parties	· Orders and Requests · Purchase Registration · Warranty · Site Communications · Promotions · Blogs & Forums · Events and Market Research	· Service Providers · Business Partners · Advertising Networks · Promotional Advertising Companies
C. Protected classification characteristics under California or federal law.	Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).	Not collected	Not collected	N/A
D. Commercial information	Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	· Directly from You · Automatically from Your Devices · From Third Parties	· Orders and Requests · Purchase Registration · Warranty · Promotions · Events and Market Research	· B2B Customers · Business Partners
E. Biometric information	Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.	Not collected	Not collected	N/A
F. Internet or other similar network activity.	Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.	· Automatically from Your Devices · From Third Parties	· Orders and Requests · Purchase Registration · Warranty · Site Communications	· Service Providers
G. Geolocation data	Physical location or movements	Not collected	Not collected	N/A
H. Sensory data	Audio, electronic, visual, thermal, olfactory, or similar information.	Not collected	Not collected	N/A
I. Professional or employment-related information.	Current or past job history or performance evaluations.	· Directly from You · From Third Parties	· Orders and Requests · Site Communications · Promotions · Events and Market Research	· Service Providers
J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99))	Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records	Not collected	Not collected	N/A
K. Inferences drawn from other Personal Information	Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes	· Directly from You · Automatically from Your Devices · From Third Parties	· Orders and Requests · Site Communications · Events and Market Research	N/A
L. Sensitive Personal Information as defined in § 1798.140(ae) of the California Privacy Rights Act	Social Security number, driver’s license number, state ID card, passport number, precise geolocation, racial or ethnic origin, religious beliefs, union membership, health and genetic data, biometric data, information about a sex life or sexual orientation, a consumer’s account login, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account, the contents of mail, email, and text messages if the business is not the intended recipient.	· Directly from You · From Third Parties	· Orders and Requests	N/A

We may also collect information to comply with applicable law or regulatory requirements or legal requests.