Saint-Gobain Corporation, together with all its other North America Affiliates including but not limited to CertainTeed LLC and its North America affiliates, including but not limited to CertainTeed Ceilings Corporation, CertainTeed Gypsum, Inc., and CertainTeed Canada, Inc., and also Saint-Gobain Performance Plastics Corporation, Saint-Gobain Ceramics & Plastics, Inc., Saint-Gobain Abrasives, Inc., Vetrotech Saint-Gobain North America, Inc., Saint-Gobain Adfors America, Inc., Saint-Gobain Solar Gard LLC, and Sage Electrochromics, Inc. (collectively, the "Company") respect your privacy. Our privacy commitments are fundamental to the way we run our business. These commitments apply to everyone who has a relationship with us - including customers, partners and website visitors.

This privacy notice for California residents (Notice) supplements the information contained in the privacy policy of Saint-Gobain Corporation and those specifically applicable to its U.S. affiliates and subsidiaries (collectively, CertainTeed, Saint-Gobain or us or our), and applies solely to visitors, users, customers, and others who reside or do business in the State of California (Consumers or you or your) and access any of the Saint-Gobain websites (the “Sites”). We provide this notice to comply with the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA) and the regulations issued thereunder; accordingly, this notice addresses the specific requirements of the CCPA and should be read together with the other Saint-Gobain privacy policies that apply. Any terms used in this notice but not otherwise defined have the same meaning as ascribed to them in the CCPA.

Types of Information Collected

Saint-Gobain may directly or indirectly collect the following categories of Personal Information about Consumers:

• Identification and contact information: Name, alias, postal address, unique personal identifier, online identifier, email address, account name, or other similar identifiers.

• Payment information: Name, signature, address, telephone number, bank account number, credit card number, debit card number, card issuer and card type, expiration date, CVV code, billing address, or any other financial information.

• Commercial purchase and order information: Products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies, and any communications we have received about your order or purchase

• Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a Consumer's interaction with an Internet Web site, application, or advertisement.

• Preference information: your account settings including preferred contact channel and types of services/offers that interest you.

• Geolocation data.

• Audio, electronic, visual, thermal, or similar information.

• Sensitive Personal Information: such as your driver's license number, state identification card, and biometric data; combination of email address, financial account, debit card, or credit card with security or access code, password, or other credentials allowing access to your account.

• Internet network and device information: IP address, internet provider, operating system and browser used, domain names of the computers you use to visit our Website, type of device, such as laptop or smart phone, log files, URIs (Uniform Resource Identifiers) of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in reply, the numerical status code of the server reply (successful, error, etc.) and other parameters concerning the user's operating system and computer environment, and/or device cookie settings and other device details, such as MAC address.

• Information automatically collected from your browser: when you use the Website, some data is automatically transferred from your browser to our server, including your browser type, operating system type or mobile device model, viewed webpages, links that are clicked, the keystrokes typed, movement of the mouse or pointer, IP address, mobile device identifier or other unique identifier, sites or apps visited before coming to our Website, the amount of time you spend viewing or using the Website and the pages visited, the number of times you return, or other click-stream or site usage data, and emails we send that you open, forward, or click through to our Website.

• Legal information: fraud checks or flags raised about your transactions, payment card refusals, suspected crimes, complaints and/or claims.

• Social Media Information: if you interact with us through a social media service or log in using social media credentials, depending on your social media settings, we may have access to your information from that social network such as your name, email address, age, gender, and location.

• Inferences drawn from any personal information: to create a profile about a Consumer reflecting the Consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

Sources of personal information

Saint-Gobain collects the personal information described above from the following categories of sources:

• From you directly, when you provide us with information over our Sites or in person, in applications or questionnaire responses you submit in connection with one of our products or services, when you provide information about yourself to one of our employees.

• From you when you contact customer service.

• From others on your behalf, such as when you are named as a beneficiary or emergency contact of one of our employees or associated with a policy held by one of our clients.

• From our Sites technology’s interaction with your browser or devices.

• From data aggregators who provide us with information about individuals in order for us to understand who may be interested in our products or services.

• From public records or published databases.

Use of Collected Information

Saint-Gobain collects the personal information described above for a variety of business purposes. Saint-Gobain uses the personal information to:

• Fulfill your orders for goods and services;

• Provide customer support in response to your communications with us;

• Communicate with you about your orders, your account, and your requests for information

• Enable you to access our services;

• Send you updates about new products and offers that may be of interest to you;

• Complete a particular transaction or fulfill a service;

• Validate, confirm, verify, deliver, install, and track your order, including to arrange for shipping, handle returns and refunds;

• Maintain a record of the purchases you make;

• Service products you purchased from us,

• Enhance your online shopping experience, including as a way to recognize you and welcome you to the Sites;

• Personalize your experience and provide you with customized Site or App content;

• Create a session replay that shows your visit to our site;

• Protect the security or integrity of the Site and our business, such as by protecting against and preventing fraud, unauthorized transactions, and managing risk exposure, including by identifying potential hackers and other unauthorized users;

• Provide our products and services to you and activities related to our provision of such products and services, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing advertising or marketing services, or providing analytics services;

• Improve, upgrade, or enhance our products and services;

• Provide you with information about products and services that we and other businesses may provide that we think may be of interest to you;

• Detect security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity;

• Debug to identify and repair errors that impair existing functionality;

• For research and analysis purposes.

When Information is Disclosed

Saint-Gobain may share the personal information described above with the following categories of third parties:

We share your personal information with our service providers to assist us in providing our products and services to you, including service providers that:

• provide specialized services to us (such as helping us to maintain and manage our customer information, communicate with our customers, service our website, fulfill orders, etc.)

• host our databases, infrastructure and websites;

• provide analytics services to help us understand the activity on our website;

• assist us with marketing and communications with our clients or potential clients;

• assist us to analyze and understand the financial status and needs of our client base;

• assist us with the financial, regulatory and legal aspects of our business,

• assist us with quote and estimates specific to particular individuals interested in our products or services;

• assist us with event planning; and

• assist us with data security and privacy.

• With courts or governmental entities as we deem necessary to respond to a subpoena, regulation, binding order of a data protection agency, legal process, governmental request or other legal or regulatory process.

Saint-Gobain has not sold Personal Information about Consumers, or shared it with third parties for cross-context behavioral advertising, in the twelve (12) months prior to the Effective Date of this Policy. We do not use or disclose

sensitive personal information, as defined in applicable laws, for any purposes other than those permitted by applicable law.

Consumer Rights

The CCPA provides specific privacy rights to California residents with respect to your Personal Information:

Right to Know

A Consumer may request that a business that sells the Consumer's personal information, or that discloses it for a business purpose, disclose to that Consumer:

1. The categories of personal information that the business collected about the Consumer.

2. The categories of personal information that the business sold about the Consumer and the categories of third parties to whom the personal information was sold, by category or categories of personal information for each third party to whom the personal information was sold.

The Saint-Gobain California Privacy Policy describes Saint-Gobain our practices, which are in compliance with the CCPA regarding the collection, use, and disclosure Consumer personal information Saint-Gobain.

Right to Request Deletion

A Consumer has the right to request that a business delete any personal information about the Consumer which the business has collected from the Consumer. If it is necessary for Saint-Gobain to maintain the personal information for certain purposes, Saint-Gobain is not required to comply with your deletion request. If we determine that we will not delete your personal information when you request us to do so, we will inform you and tell you why we are not deleting it.

Right to Correct Personal Information You can correct personal information about you that you believe to be inaccurate by filling out this online form or you may submit a request as set forth below.

Right to Opt-Out of the Sale of Personal Information

You have the right to opt-out of the selling or sharing of your personal information as defined by state law.

How to Submit a Request

To exercise any of the CCPA rights described above, you must submit a verifiable Consumer request to us by contacting Saint-Gobain through one of the following methods:

• Calling 800-233-8990 or • Filling out the following online form

You may submit a request twice in any 12-month period.

To submit a verifiable Consumer request, you will be asked to provide certain information to help us verify your identity by asking you to provide additional information that we can match to our files. The information we ask you to provide to initiate a request may differ depending upon the type of request, the type, sensitivity and value of the personal information that is the subject of the request, and the risk of harm to you that may occur as a result of unauthorized access or deletion, among other factors. In certain circumstances, we may also require you to provide a written declaration that you are who you say you are. We also may use a third-party verification provider to verify your identity.

You may make a verifiable Consumer request on behalf of your minor child. You may also designate an authorized agent to make a request on your behalf. Upon request, your authorized agent must provide proof of identity and authority to speak on your behalf.

We will endeavor to honor such requests unless such a request conflicts with certain lawful exemptions under California’s consumer privacy law. If we cannot verify your identity or authority to make the request, we will not be able to comply with your request. We will inform you if we cannot verify your identity or authority. We will only use personal information provided in a verifiable Consumer request to verify the requestor's identity or authority to make the request.

No Retaliation

A Consumer has the right not to be discriminated against because the Consumer exercised any of the Consumer's rights under the CCPA. Saint-Gobain may charge a Consumer a different price or rate, or provide a different level or quality of goods or services to the Consumer, if that difference is reasonably related to the value provided to the Consumer by the Consumer's data.

Record Retention

We retain information for different periods of time depending on the purposes for which we collect and use it, as described in this Privacy Policy, or to comply with legal or regulatory requirements. The time period that records are to be maintained may be based on statutory or regulatory requirements, contract, general business practices, and/or the particular operating needs of a Saint-Gobain business unit. We will retain your information for no longer than is reasonably necessary to provide you services, comply with our legal obligations, resolve disputes, and enforce our agreements. We will delete information when it is no longer needed to fulfill these purposes unless a longer retention period is required to comply with applicable laws or regulatory requirements.

Contact for More Information

If you have any questions or concerns about Saint-Gobain’s privacy policy and practices or need to request this policy in another format, please contact:

Attn: Saint-Gobain Privacy Requests

20 Moores Road

Malvern, PA 19355

Effective Date: January 1, 2023