VS collects various types of personal information about you through our Platforms and Services in three primary ways: directly from you, automatically, and from other sources.

Collected directly from you. You provide us with your personal information when you create an account, sign up to get our emails, buy from us, or contact us. You may provide us with contact information, account and loyalty information, and commercial and communications records, as well as content you generate and submit to us. Read more below about the types of information we collect directly from you:

• Account and Loyalty Information – When you create a VS customer account or participate in the VS & PINK Rewards Program, we collect your Contact Information (described below), as well as other optional information you may give us to personalize your profile, such as your birth month and day, clothing sizes, style and shopping preferences, personal interests and traits, and product wish list. We also maintain records about your VS shopping and purchase history, including items you add to your VS and PINK online shopping bag. 

• Contact and Identification Information – When you make product purchases, exchanges, or returns, or when you otherwise request our Services or interact with us on our Platforms, we may collect information such as your (or your gift recipient’s) name, phone number, e-mail address, billing and shipping address. We may also collect your driver’s license number, social security number, or other government identification number when you submit an application as part of the Victoria’s Secret Credit Card Program. 

• Commercial Records – When you make product purchases, exchanges, or returns, or when you redeem loyalty rewards or other promotional incentives, we collect your payment information and other details about your order. When you visit our Platforms, we may also collect your location information when you select your geographic region for customized language and currency options. 

• Communications Records – When you interact with VS via email, phone, text, or online chat, or any other remote or in-person communication method, we may collect, record, and transcribe the information and content you share with us, including information such as your Contact Information (described above) and the content, details, and circumstances surrounding the communication. 

• Customer Submitted Content – You may choose to interact with us and share your information on public forums like our social media pages and community spaces on our Platforms, provide feedback and product reviews on our Platforms or through our other Services, or participate in surveys or submit photos and other personal information when you participate in our VS & PINK Creator Program.

Collected automatically. We collect information about you automatically when you visit our Platforms and stores and interact with us through our Services. We use automated tracking technologies such as cookies, pixels, and other similar technologies, server logs, and other tools on our website or apps to collect personal information from your device or browser when you engage with VS. We may automatically collect personal identifiers, device and usage information, location information, as well as information about your internet activity, and certain other audio, visual, and electronic information. Read more below about the methods we use and what personal information we automatically collect about you:

• Personal Identifiers – VS uses elements of your contact information to create pseudonymous identifiers, such as a customer ID, that we use internally to manage the personal information we collect and maintain about you, such as your Commercial Records and Account and Loyalty Information (each described above), and other information we may collect about you, like your online purchasing histories, preferences, behaviors, and interests.

• Device and Usage Information – VS uses automated tools and technologies to automatically collect device, usage, and activity information when you access our Platforms, use our Services, interact with our advertisements, and visit certain third-party websites and apps. VS may store this information in log files. Many tools and technologies we use are provided by third parties. Using these tools, VS may collect the following types of personal information about you:

  • Device, Usage, and Performance Data: We collect certain information about the device you use to access VS Platforms and certain third-party sites and apps, including things like the device model, operating system and version, and browser version. We also collect information about how you use and interact with our Platforms and Services via your device, including through use of session replay technology. Examples of such information include the dates and times you access certain sites and your activities and behaviors on certain pages or screens you view (such as how long you spend on pages or screens and the routes by which you access them, products viewed, hyperlinks clicked, mouse movements, page or screen scrolling, and keystrokes). We may also collect information about searches you conduct on our Platforms, and technical information like app crashes and other system activity. 

  • Identifiers: We collect certain data points that can be used to directly identify you or your device. These identifiers can recognize you over time and across VS Platforms and other third-party platforms and services, and include things like your IP address, device and browser identifiers, advertising IDs (such as the ID for Advertising (IDFA) on Apple devices, and the Advertising ID on Android devices), cookies, pixels, beacons, and other tracking technologies, and other types of identifiers.

  • Internet Activity: We use cookies, pixels, beacons, embedded scripts, and other tracking technologies to collect information about your visits to our Platforms, your use of our Services, and how you interact with our advertisements. We may also collect information about the websites or apps you visit before and after interacting with our advertisements, using our Services, or visiting our Platforms. See below for more information about these tracking technologies.

  • Location Information: If you enable your device settings to permit device location tracking, we may collect information about your precise location in order to direct you to the nearest VS store location or for other purposes. You can change these preferences at any time in your device settings.

• Analytics and Inferences – When you communicate with us through our Services, such as contacting VS customer service, or interact with us or visit our online Platforms, we use automated tools and technologies that automatically collect and infer information about you from those interactions and other information we may collect from other sources. We may use these technologies to collect or infer information described above like Identifiers, Internet Activity, and Location Information, as well as other audio, visual, or electronic data. These technologies include session replay, which is a tool that records your behavioral interactions with our site and app, and which we use for quality assurance purposes. These and other analytics tools assist with data analysis to help improve customer experience on our Platforms, and which, depending on the tool, may also help us to infer or generate information about you, such as your product preferences and other interests. See the “Tracking Technologies” section below for more information about the tracking technologies we use.

• In-Store -

  • Theft Prevention, Safety and Security – When you visit our stores in-person, we automatically collect personal information about you for purposes of safety, security, and theft prevention. We may collect some of the information listed above like Identifiers and Location Data. We may also collect other audio, visual, and electronic information about you through in-store Closed-Circuit Television (CCTV) video recordings. See below for more information about other theft-prevention devices like Radio Frequency Identification (RFID), which does not collect your personal information.

  • Wi-Fi Network Access – When you visit some VS stores in-person, we may allow you to connect to the VS Wi-Fi network via access points. Connecting to our Wi-Fi network allows us to collect certain information about you and your device, such as your Device and Usage Information, Internet Activity, and Location Information, as described above. 

• Tracking Technologies - To better understand how you interact with VS Platforms and Services both online and offline, as well as to offer you a more personalized shopping experience, VS may collect information about you using cookies, pixels, clear-gifs, web beacons, tags, and similar tracking technologies. A cookie is a small amount of data that's stored by your browser on your device. A pixel (also known as a clear-gif, web beacon or tag) is a small graphic image on a web page, web-based document or email message.

  In addition to personalizing your shopping experience and serving you advertising tailored to your specific interests, these types of tracking technologies are used to collect information about your interactions with our Platforms and Services, including information about the site, page, document, or email that you viewed and when you viewed it. They are also used to maintain items in your shopping cart and remember you and your online purchases when you visit VS Platforms. Some of these technologies are considered necessary to the operation of our Platforms and cannot be turned off. Others, such as targeted advertising cookies, are optional, and you can change your preferences at any time by visiting the Cookie Preference Center.

Collected from other sources. These sources can include our contractors, service providers, social media platforms, and other third-party companies, as well as publicly available sources. These sources we partner with may collect and share information with us about you such as Personal Identifiers, Internet Activity, and Location Information (as described above), as well as inferences about your shopping interests and other preferences. Read more below about our sources and what data they provide to us or collect on our behalf:

• Contractors – We engage independent contractors and third-party consultants to support and assist us in performing business activities that may involve the collection and processing of personal information about you. When they collect your personal information on our behalf, they do so only for defined business purposes and do not use your personal information for their own purposes.

• Service Providers – We engage third party companies to support and assist us in performing business activities that may involve the collection and processing of personal information about you. When they collect your personal information on our behalf, they do so only for defined business purposes and do not use your personal information for their own purposes. 

• Social Media Platforms and Other Media Services – We partner with social media platforms (such as Facebook, Instagram, and Pinterest) and other media services to learn more about how you interact with VS advertising, promotions, services, and other content we share through those channels, as well as learn more about how you interact with other sites, apps, and content. These partners may provide us with Personal Identifiers, Device and Usage Information, and Analytics and Inferences (all defined above) about you, as well as information related to their social media services (subject to the platform’s privacy practices). 

• Other Third Parties – We partner with third-party data providers that supply us with information to help us learn more about our customers. These partners may provide us with Personal Identifiers, Device and Usage Information, and Analytics and Inferences (all defined above) about you, which may be in identifiable or aggregated form. When we partner with other companies for co-sponsored promotions and product offerings, these companies may provide us with personal information about you like Contact Information, Commercial Records, and Personal Identifiers (all defined above).

• Radio Frequency Identification (RFID) Technology Notice: We place RFID tags on our merchandise to maintain inventory, ensure adequate product availability, and to monitor and prevent fraud. No personal information is stored on RFID tags, only product and inventory information, and the RFID information is not linked to your account when you make a purchase. The RFID tags can be removed after purchase.

We use personal information for the following purposes:

• Enhancing Your Shopping Experience: Identifying you when you visit our Platforms or stores, and personalizing content and experiences offered to you.

• Completing Transactions: Receiving, processing, and fulfilling your orders and other transactions.

• Communication: Connecting with you in response to your inquiries or requests.

• Marketing: Advertising and marketing our products and services, and those of our business partners, including analyzing and improving the way we present ad campaigns on our Platforms and across third-party sites.

• Business Purposes: Operating our business and creating and improving our products and services.

• Fraud Prevention: Detecting, preventing, and responding to security incidents and malicious, deceptive, fraudulent, or illegal activity on our Platforms and in our stores.

• Legal Obligations: Supporting compliance with our legal and regulatory obligations, including protecting our legal rights and defending against legal claims.

• Other: For other reasons with your consent or as permitted by law.

In addition to the specific situations discussed elsewhere in this Notice, we may share personal information in the following situations: 

• Affiliates and Acquisitions. We may share personal information with our affiliates (e.g., parent company, sister companies, subsidiaries, joint ventures, or other companies under common control). If a company acquires or enters negotiations to acquire, our company, business, or assets, we may share personal information with that company. 

• Public. Some of our websites may allow for comments or reviews in a public forum. If you post on these pages, what you share may be publicly available. 

• Service Providers. We share your personal information with service providers. Service providers help us to run our Platforms, conduct surveys, run sweepstakes and contests, provide technical support, process payments, fulfill orders, and more. These service providers do not use your personal information for their own purposes – only to perform services for VS. 

• Professional Services. We may share personal information with our professional service providers, such as auditors or lawyers. They do not use your personal information for their own purposes – only to perform services for VS.

• Other Disclosures with Your Consent. We may share your personal information with third parties when you consent or direct us to. 

• Other Disclosures to Third Parties. We may share personal information to cooperate with law enforcement, participate in a legal process, or for legal compliance. For example, we may share your information if we sell and/or transfer all or a portion of our business assets, or purchase all or a portion of a third party’s business assets, in connection with proposed or complete sale, purchase, or merger events, as well as acquisitions, joint ventures, reorganization, dissolution, or liquidation. We may share your personal information to establish or exercise our rights, to defend against legal claims, to investigate, prevent, or act on possible illegal activities, threats to safety of person or property, or a violation of our policies. Your information may also be shared to ship products to you.

• Victoria’s Secret Credit Card Program. We partner with Comenity Bank, which is part of Bread Financial, to offer you the Victoria’s Secret Credit Card, the PINK Credit Card, the Victoria’s Secret Mastercard Credit Card, and the PINK Mastercard Credit Card. When you apply for any of these cards through our Platforms, the personal information you provide in your application is shared with Comenity Bank. Visit https://c.comenity.net/victoriassecret/ for more information. 

• International Purchases and Shipments. We partner with Global-E to support product purchases, shipping, and delivery for our customers in certain international destinations. You may provide certain personal information, such as your contact and payment information, directly to Global-E when you make a purchase on an international checkout page. VS and Global-E will exchange personal information about you to facilitate the purchase, shipment, and delivery of our products.

All visitors who interact with our Platforms and Services have the right to make certain privacy elections with respect to their personal information, such as opting out of targeted advertising, promotional marketing, and more. 

You may have other privacy rights and choices available to you depending on where you live and the applicable laws in your jurisdiction. Region-specific privacy rights may include the right to access, delete, and correct your personal information, and the right to opt-out of certain types of processing. These rights, and how they may apply to you, are all explained in the region-specific sections at the end of this Privacy Notice. We never discriminate against anyone for exercising their privacy rights. 

Read more about your privacy rights and choices below:

• Opt-Out of Targeted Advertising - You can change your preferences related to targeted advertising and opt-out of sharing your personal information with third parties for purposes of targeted advertising by following the steps below:

  • Cookie Preference Center: You can update your cookie preferences by visiting the Cookie Preference Center . Your elections are browser- and device-specific, so you will need to renew this choice each time you clear your browser and any time you visit our site using a new browser or device. Some cookies that are essential to the operation of our Platforms cannot be turned off. Others, such as those that support targeted advertising, are optional.

  • Browser Signals: VS sites are enabled to recognize universal opt-out mechanisms such as Global Privacy Control (GPC) signals (for more information on GPC visit: https://globalprivacycontrol.org/). GPC is a universal signal you can elect to turn on that communicates your privacy preferences to participating platforms. If our VS sites recognize that your browser has enabled GPC signals, we will honor your opt-out privacy preferences on that browser. GPC signals are browser- and device-specific, so you will need to set these signals for each browser and device you use to access VS sites.

• Opt-Out of Promotional Marketing – You can change your preferences related to promotional marketing messages by following the steps below:

  • Email – You may opt-out of the Victoria’s Secret and PINK email marketing list by following the instructions located at the bottom of each commercial email or by completing the Email Unsubscribe Request Form.

  • Text Messages – If you sign up to receive promotional text messages from us but later want to opt-out, simply follow the opt-out instructions included in our latest promotional text message to you. All text messages you receive from VS and PINK are subject to our Text Message Terms and Conditions.

  • Direct Mail - To specify your preferences for getting direct mail from us, simply follow the instructions on the mailer, or dial 1-800-411-5116 (for our US and Canada customers); and +1-937-438-4197 (for our customers elsewhere).

• End Mobile Push Notifications and Alerts – You can enable or deactivate push notification messages at any time by changing the notification settings on your mobile device.

• Turn Off Device Location Sharing – Location-based services can be turned on or off at any time by adjusting the settings of your browser or mobile device. Additionally, for mobile apps, you can adjust your location sharing permissions in the app settings on your device.

You may have privacy rights available to you depending on where you live and the laws in your jurisdiction. To submit a privacy rights request online, please follow the process listed below applicable to your relationship with VS. In the request webform, you will select your residential location and request type and enter limited personal information that we will use for purposes of verifying your identity and fulfilling your request. Alternatively, you may call us at 1-800-411-5116. We will comply with your request in accordance with our obligations under applicable law. We never discriminate against anyone for exercising their privacy rights. 

For residents of the U.S., Canada, and the European Economic Area, please review the applicable region-specific sections at the end of this Privacy Notice for additional information about your privacy rights. For job applicants, please review the Job Applicant Privacy Addendum at the end of this Privacy Notice to find out more about how to exercise your privacy rights.

VICTORIA’S SECRET CUSTOMERS

• Right to Access, Deletion, and Correction: Certain jurisdictions provide consumers with the right to request access to, or deletion or correction of, their personal information. To submit a request, visit the Your Privacy Rights webform. 

• Request for List of Third-Party Disclosures: Certain jurisdictions provide consumers with the right to request a list of third parties to which VS has disclosed their personal information. To submit a request, visit the Your Privacy Rights webform. 

• Request to Opt-Out of Targeted Advertising or Selling/Sharing: Certain jurisdictions provide consumers with the right to opt-out of the processing of their personal information for purposes of targeted advertising, as well as the sharing or selling of their personal information, as defined under applicable laws. To submit a request, visit the webform located here: Opt-Out of Targeting, Selling, and Sharing.  

Authorized Agents: To submit a request as an authorized agent on behalf of a consumer, follow the applicable process above. When filling out the webform, add your email address and information about the individual for whom you are submitting the request in the other required fields. Please add your name and phone number in the Request Details field and an indication that you are submitting the request as an authorized agent.

VICTORIA’S SECRET CURRENT AND PROSPECTIVE INVESTORS

• Right to Access, Deletion, and Correction: Certain jurisdictions provide residents with the right to request access to, or deletion or correction of, their personal information. To submit a request, visit the investor privacy rights webform located here: Investor Privacy Rights. 

• Request for List of Third-Party Disclosures: Certain jurisdictions provide residents with the right to request a list of third parties to which VS has disclosed their personal information. To submit a request, visit the investor privacy rights webform located here: Investor Privacy Rights.

• Request to Opt-Out of Targeted Advertising or Selling/Sharing: Certain jurisdictions provide residents with the right to opt-out of the processing of their personal information for purposes of targeted advertising, as well as the sharing or selling of their personal information, as defined under applicable laws. To opt-out, visit this page: Investor Opt-Out of Targeting, Selling, and Sharing.  

VS maintains appropriate technical and organizational measures to keep your personal information safe. However, no method of internet transmission or electronic storage of personal information is fully secure, and we cannot guarantee its security. Read more below about protection of your personal information:

Our Platforms and Services may permit you to create an account. You are responsible for selecting a unique and complex password and keeping it confidential.  You are responsible for any access to or use of your account by someone who has obtained your password, regardless of whether you approved of such access or use. Notify us immediately if you become aware of unauthorized use of your password or account.

We keep your personal information for as long as necessary to fulfill the purposes in this Notice unless a longer retention period is required or permitted by law. This includes the purposes of satisfying legal, accounting, or reporting requirements. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the information. We also weigh the potential risk of harm from unauthorized use or disclosure of the information, the purposes for which we obtained the information and whether we can meet those purposes through other means, as well as applicable legal requirements.

VS is a global company. We send data between and among our global affiliates for business purposes, as well as to our service providers located in countries all over the world. Read more below about how your personal information is transferred internationally:

Personal information originating in the EEA, Quebec, and elsewhere may be transferred to, stored in, and processed by individuals located in other countries outside of those originating jurisdictions, where laws regarding the protection of personal information may be less stringent than the laws that apply in your jurisdiction. Where applicable, we perform these transfers pursuant to mechanisms required under applicable data transfer laws such as the Standard Contractual Clauses (SCCs) required under the Regulation (EU) 2016/679 (General Data Protection Regulation (GDPR)). 

Our employees involved in data processing and our servers are based in Columbus, Ohio, US, and other locations throughout the United States, Canada, India, and the Netherlands, as well as other global locations. We work with affiliated and unaffiliated service providers in the United States, the United Kingdom, India, China, and other jurisdictions around the world. By submitting your personal information to us you agree to the transfer, storage, and processing of your data in a country other than your country of residence including, but not limited to, the jurisdictions listed above. We and our service providers may disclose your personal information if we are required or permitted by applicable law or legal process, which may include lawful access by foreign courts, law enforcement or other government authorities in the jurisdictions in which we or our service providers operate.

VS Platforms and Services are designed for a general audience and are not directed to or intended for use by children or minors. We do not knowingly collect or solicit personal information from children or minors under the age of 18 through our Platforms or Services. If we become aware that we have collected personal information from a minor, we will promptly delete the information from our records. To request deletion of personal information relating to a minor under the age of 18, please reach out to us at the contacts listed in the “Contact Us” section of this notice.

Through our Platforms, we may provide links to websites and other third-party content or services that VS does not own or operate. You may also interact with VS content, products, and ads through channels operated by third parties, such as social media sites and apps, where those third parties may separately collect information about you. Additionally, when you provide information to us on our Platforms that are operated by third parties, such as when you use our apps on a third-party platform through your mobile device, these third-party platform operators may separately collect information about you. The information collected by these third-party operators is subject to their privacy policies, not this Privacy Notice, and VS is not responsible for the data processing practices of these third parties. 

This Privacy Notice may be updated from time to time to reflect changes in our privacy practices regarding your personal information. If any significant changes are made, we will notify you by placing a prominent notice on our relevant Platforms. In certain situations, we may notify you in other ways, such as by e-mail, about material changes to our Privacy Notice.

From anywhere in the world, you may contact our privacy office for more information about our privacy practices. 

If you are located in the United States or Canada, you may write to our privacy officer or contact us by phone at: 

ATTN: Privacy Officer

Victoria’s Secret & Co. Legal Department

4 Limited Parkway

Reynoldsburg, OH 43068

US & Canada Phone: 1-800-411-5116

If you are located anywhere else in the world, you may write to our privacy officer at the address listed above, or contact us by phone at: International Phone:  1-937-438-4197

For data subjects in the United Kingdom and European Union: If you believe that your privacy rights under the GDPR have been violated, you have a right to lodge a complaint with your local supervisory authority.

Privacy laws in some U.S. jurisdictions, including California, Connecticut, Delaware, and others, may grant residents of those states the right to make certain privacy requests listed below, subject to certain exceptions and limitations. We never discriminate against anyone for exercising their privacy rights. Read on to learn more about the privacy rights that may be available to you, including the Notice at Collection for California residents:

• Request Access – You can ask us for a copy of the personal information we have collected about you. In certain jurisdictions, you may also ask us to provide you with a categorical or specific list of third parties to which we have disclosed personal information about you.

• Request Deletion – You can ask us to delete the personal information we have collected about you. 

• Request Correction – You can ask us to correct inaccuracies in the personal information we have collected about you.

• Request to Opt-Out of Certain Processing – You can opt-out of your personal information being sold or shared with certain third parties or being used for targeted advertising.

How to Submit Privacy Rights Requests

You may have privacy rights available to you depending on where you live and the laws in your jurisdiction. To submit a privacy rights request online, please follow the process listed below applicable to your relationship with VS. In the request webform, you will select your residential location and request type and enter limited personal information that we will use for purposes of verifying your identity and fulfilling your request. Alternatively, you may call us at 1-800-411-5116. We will comply with your request in accordance with our obligations under applicable law. We never discriminate against anyone for exercising their privacy rights. 

For job applicants, please review the Job Applicant Privacy Addendum at the end of this Privacy Notice to find out more about how to exercise your privacy rights.

VICTORIA’S SECRET CUSTOMERS

• Right to Access, Deletion, and Correction: Certain jurisdictions provide consumers with the right to request access to, or deletion or correction of, their personal information. To submit a request, visit the Your Privacy Rights webform. 

• Request for List of Third-Party Disclosures: Certain jurisdictions provide consumers with the right to request a list of third parties to which VS has disclosed their personal information. To submit a request, visit the Your Privacy Rights webform. 

• Request to Opt-Out of Targeted Advertising or Selling/Sharing: Certain jurisdictions provide consumers with the right to opt-out of the processing of their personal information for purposes of targeted advertising, as well as the sharing or selling of their personal information, as defined under applicable laws. To submit a request, visit the webform located here: Opt-Out of Targeting, Selling, and Sharing. 

Authorized Agents: To submit a request as an authorized agent on behalf of a consumer, follow the applicable process above. When filling out the webform, add your email address and information about the individual for whom you are submitting the request in the other required fields. Please add your name and phone number in the Request Details field and an indication that you are submitting the request as an authorized agent.

VICTORIA’S SECRET CURRENT AND PROSPECTIVE INVESTORS

• Right to Access, Deletion, and Correction: Certain jurisdictions provide residents with the right to request access to, or deletion or correction of, their personal information. To submit a request, visit the investor privacy rights webform located here: Investor Privacy Rights. 

• Request for List of Third-Party Disclosures: Certain jurisdictions provide residents with the right to request a list of third parties to which VS has disclosed their personal information. To submit a request, visit the investor privacy rights webform located here: Investor Privacy Rights.

• Request to Opt-Out of Targeted Advertising or Selling/Sharing: Certain jurisdictions provide residents with the right to opt-out of the processing of their personal information for purposes of targeted advertising, as well as the sharing or selling of their personal information, as defined under applicable laws. To opt-out, visit this page: Investor Opt-Out of Targeting, Selling, and Sharing.  

Right to Appeal

We make every reasonable effort to fulfill your privacy rights requests. However, where we are unable to fulfill your request, some U.S. jurisdictions provide you with the right to appeal. If we provide you with a message stating that we have rejected or limited your request, we will also provide you with a link to an appeal form and instructions on how to lodge an appeal. We will process your appeal in accordance with applicable laws.

Notice at Collection and Other Disclosures for California Residents

California law requires us to disclose the following supplemental information about our privacy practices. If you are a California resident, the following Notice at Collection disclosures apply to you in addition to the rest of the Notice.

Summary of Victoria’s Secret Privacy Practices

This section provides a summary of VS privacy practices. It describes the categories of personal information we may have collected from you in the past 12 months, the purposes for which we collect and use it, and when we may disclose such personal information. It also addresses “selling” or “sharing” your personal information, as those terms are defined by applicable data privacy laws. VS does not sell your personal information for money. 

VS collects these categories of consumer personal information:

• Personal Identifiers: your name, contact information (including postal address, phone number, and email address), and, as applicable, government issued identification such as driver’s license number, Social Security Number (SSN), or National Identification Number (NIN).

• Customer Records Information: as applicable, bank account number, credit card number, debit card number, and other transaction records including information about your purchases, payments, and transactions, such as your contact information, payment and billing details, and shipping address. 

• Commercial Information: information about products or services you purchase, obtain, or consider, loyalty program transactions, and other purchasing records and tendencies.

• Internet or Other Electronic Network Activity Information: browsing history, search history, and other online activity and usage information, such as information regarding your interactions with our Platform or other internet websites, applications, advertisements, or other content, and content you share in public forums on our Platform or through social media and other third-party digital platforms.

• Location Data: we may collect your general location data based on your IP address. With your consent, we may also collect your geolocation based on information from your mobile device.

• Audio, Video, or Electronic Information: audio and electronic records of your communications when you engage with us through any of our Platforms and communication channels, in-store video monitoring such as CCTV, information collected through other anti-theft tools in-store and on our Platforms, and call recordings and analytics.

• Characteristics of Protected Classifications: in certain situations, with your consent, we may collect demographic information about you such as disability or health information in order to comply with applicable laws and to better provide you with accommodations in our stores and on our Platforms.

• Inferences Derived from Any Information Listed Above: we may use the above information we have about you to create certain inferences about your preferences, interests, and other personal demographics and characteristics. 

• Biometric Information: in certain situations, for anti-fraud purposes we may collect and process biometric data to uniquely identify you.

• Sensitive Personal Information: in certain situations, and for specified, limited purposes, we may collect information about you that is classified as sensitive personal information, such as the following: account log in, driver’s license number, state identification card or social security number, debit and credit card in combination with access codes, and precise geolocation. We collect this data to process transactions, comply with laws, manage our business, or provide services.

VS collects, uses, and processes consumer personal information for these business and commercial purposes:

• Identifying you when you visit our Platforms or stores, and personalizing content and experiences offered to you.

• Receiving, processing, and fulfilling your orders and other transactions.

• Connecting with you in response to your inquiries or requests.

• Advertising and marketing our products and services, and those of our business partners, including analyzing and improving the way we present ad campaigns on our Platforms and across third-party sites.

• Operating our business and creating and improving our products and services.

• Detecting, preventing, and responding to security incidents and malicious, deceptive, fraudulent, or illegal activity on our Platforms and in our stores.

• Supporting compliance with our legal and regulatory obligations, including protecting our legal rights and defending against legal claims.

• For other reasons with your consent.

VS retains consumer personal information for as long as necessary to fulfill the original purpose for collection. We may keep it longer in accordance with applicable law.

VS discloses certain categories of consumer personal information to its service providers for the business, commercial, and operational purposes listed above, as well as to third parties for other purposes such as the following:

• Digital Service Providers: We engage third parties such as internet service providers (ISPs), cloud service providers (CSPs), and other systems to operate our Platforms and provide our services. These third parties may process Personal Identifiers, Internet or Other Electronic Network Activity Information, Location Data, and Audio, Video, or Electronic Information about you.

• Marketing, Advertising and Analytics Providers: We engage third parties such as marketing and advertising agencies, social networks, and data analytics companies to provide services that help us better reach customers with targeted advertising and other marketing campaigns. These third parties also help us measure the effectiveness of our marketing and advertising campaigns. They may process Personal Identifiers, Commercial Information, Internet or Other Electronic Network Activity Information, Location Data, Audio, Video, or Electronic Information, and Inferences about you.

• Information Providers: We engage third parties such as data suppliers and other information vendors that provide us with new information about customers so that we can enhance and improve our customer records. They leverage certain categories of customer information we share with them to identify and provide additional relevant customer information to VS. These third parties may process Personal Identifiers, Customer Records Information, Commercial Information, and Inferences about you.

VS provides you with an opportunity to opt-out of the use or disclosure of your personal information for purposes of targeted advertising and other activities deemed as “selling” or “sharing” under applicable privacy laws:

To opt-out of sharing your personal information for purposes of targeted advertising or opt-out of personal information sharing with third parties that could constitute “selling” or “sharing” under applicable laws, submit a request here: Do Not Sell or Share My Personal Information.

Sale and Sharing of Personal Information

We are required to disclose whether the following categories of personal information are collected, shared with third parties for a “business purpose,” or “sold,” or transferred for “valuable consideration.” The table below indicates the categories of personal information we collect and transfer in a variety of contexts. We do not “sell” your personal data for money. 

California Notice of Financial Incentive. VS offers discounts, promotions, and rewards to our customers enrolled in our optional Victoria’s Secret and PINK loyalty rewards program, and, from time to time, VS also offers contests, sweepstakes, and other promotions in connection with our advertising campaigns (“Programs”). VS collects certain personal information from and about you through these optional Programs, such as your personal identifiers (such as your name and birthday), contact information (such as your email and shipping address), and commercial information (such as your purchasing history). Details of each program are further explained in the program offering. There is no obligation to opt in to these Programs, and you may opt-out at any time. Under California law, these Programs may be considered as offering you a “financial incentive” in exchange for your personal information. The value of your personal information to VS is commensurate with the value of the benefits you receive from these Programs, such as free or discounted products.

California Shine the Light. In accordance with California’s Shine the Light law, VS provides you with a cost-free means to request to opt-out of our sharing your personal information to third parties with whom we do not share the same brand name, if that third party will use it for its own direct marketing purposes. To submit a request, simply complete the CA Shine the Light Request form.

If you are located in the European Economic Area (“EEA”), the following supplemental disclosures apply to you in addition to the rest of the Notice. Read on for more information about your privacy rights and VS privacy practices:

Pursuant to the Regulation (EU) 2016/679 (General Data Protection Regulation (“GDPR”)), where VS collects and processes the personal information of individuals located in the EEA, we process your personal information on the following legal bases:

• Consent – If VS requests consent for the processing of your personal information, you may decline or withdraw that consent at any time by following the opt-out procedures outlined in this Privacy Notice, or by following the same method by which you originally provided consent. 

• Performance of Contractual Obligations – To perform our commercial obligations, VS collects and processes your personal information when providing you with requested Services, completing your purchases, and fulfilling your product orders. When you order products on our VS Platforms or visit our stores to make a purchase, we may collect and process your payment, shipping, and contact information, and may communicate with you about your product orders and purchases. We also collect and process your personal information when you request other VS Services, such as contacting our customer services team for assistance. 

• Compliance with Legal Obligations and Protection of Rights – It may become necessary for VS to process your personal information in order to comply with our applicable legal obligations, such as financial reporting, or to protect our rights and the rights of others.

• Legitimate Interests – To pursue our legitimate business interests, VS collects and processes your personal information when you visit our Platforms in order to provide you with content, such as advertising and other marketing, about our products, as well as to communicate with you about our products and Services. We may process your personal information to learn more about how you interact with our Platforms and Services and make improvements. VS may share your personal information with processors and other third parties as necessary to accomplish our legitimate business interests, including for advertising and other marketing purposes.

Under GDPR, persons located within the EEA have the right to make certain privacy requests listed below, subject to certain exceptions and limitations. We never discriminate against anyone for exercising their privacy rights.

• Right to Know – You can ask us questions about how we collect and use your personal information.

• Right of Access – You can ask us for a copy of the personal information we have collected about you. 

• Right to Erasure – You can ask us to delete the personal information we have collected about you. 

• Right to Rectification – You can ask us to correct inaccuracies in the personal information we have collected about you.

• Right to Restrict Certain Processing – You can opt-out of your personal information being sold or shared with certain third parties or being used for targeted advertising.

• Right to Object to Certain Processing – You can opt-out of your personal information being sold or shared with certain third parties or being used for targeted advertising.

How to Submit Privacy Rights Requests

To submit a privacy rights request online, please follow the process listed below applicable to your relationship with VS. In the request webform, you will select your residential location and request type and enter limited personal information that we will use for purposes of verifying your identity and fulfilling your request. Alternatively, you may call us at 1-937-438-4197. We will comply with your request in accordance with our obligations under applicable law. We never discriminate against anyone for exercising their privacy rights. 

For job applicants, please review the Job Applicant Privacy Addendum at the end of this Privacy Notice to find out more about how to exercise your privacy rights.

VICTORIA’S SECRET CUSTOMERS

• To submit a privacy rights request, visit the Your Privacy Rights webform. 

VICTORIA’S SECRET CURRENT AND PROSPECTIVE INVESTORS

• To submit a privacy rights request, visit the investor privacy rights webform located here: Investor Privacy Rights. 

If you believe that your privacy rights under the GDPR have been violated, you have a right to lodge a complaint with your local supervisory authority.

Cookies and Tracking Technologies

Our Platforms use cookies and other tracking technologies as described below. See the “Tracking Technologies” section of this Notice for more information about how we use these technologies on our Platforms. See our Cookie Preference Center to learn more about how to update your cookie preferences. 

If you are a resident of Canada, the following supplemental disclosures apply to you in addition to the rest of the Notice. Read on for more information about your privacy rights and VS privacy practices:

Your Privacy Rights

To submit a privacy rights request online, please follow the process listed below applicable to your relationship with VS. In the request webform, you will select your residential location and request type and enter limited personal information that we will use for purposes of verifying your identity and fulfilling your request. Alternatively, you may call us at 1-800-411-5116. We will comply with your request in accordance with our obligations under applicable law. We never discriminate against anyone for exercising their privacy rights. 

For job applicants, please review the Job Applicant Privacy Addendum at the end of this Privacy Notice to find out more about how to exercise your privacy rights.

VICTORIA’S SECRET CUSTOMERS

• To submit a privacy rights request, visit the Your Privacy Rights webform. 

VICTORIA’S SECRET CURRENT AND PROSPECTIVE INVESTORS

• To submit a privacy rights request, visit the investor privacy rights webform located here: Investor Privacy Rights. 

Information about our Privacy Governance Policies and Practices

We are committed to protecting personal information and have implemented a comprehensive set of policies and practices that govern our treatment of personal information. These policies and procedures include, among other things, the following:

• We have implemented policies and procedures to protect personal information in our custody and control from unauthorized access, use or disclosure.

• We have implemented processes to respond to data subject requests and complaints in a timely and effective manner.

• We have implemented a framework for the retention and destruction of personal information to ensure compliance with legal obligations, and to securely destroy personal information once no longer required.

• We have designated a Privacy Officer who is responsible for overseeing the company’s compliance with privacy legislation.

• We have policies and trainings that define the roles and responsibilities for our employees with respect to the treatment of personal information.

• We provide our employees with regular privacy training and awareness.

If you are applying for a career opportunity with Victoria’s Secret and you are located in the European Economic Area (“EEA”) or are a resident of Canada or the state of California in the U.S., the following disclosures apply to you in addition to the rest of the Notice. This section describes the types of personal information collected and processed by VS for job recruitment and hiring purposes, and related VS privacy practices. Individuals currently employed by Victoria’s Secret should refer to the applicable VS Associate Privacy Notice. Read on for more information about your privacy rights and VS privacy practices:

Personal Information We Collect

When you apply for a job with VS online or in person, or register for our VS&Co. candidate database, we collect various types of personal information directly from you, automatically, and from other sources. In addition to the types of personal information described in the rest of this Notice, we also collect the following personal information about you:

• Personal Identifiers: You may provide us with your name, contact information (including postal address, phone number, and email address), and government issued identification such as driver’s license number, Social Security Number (SSN), or National Identification Number (NIN) as part of the application process. We may use this information to contact you, to complete the application process, and to carry out background checks that are considered relevant to the role for which you are applying. You may also create a username and password when you register for our VS&Co. candidate database. If you are offered a role with us, we may also collect personal information about your dependents, as well as your marital status, gender, full date of birth, bank account information, and emergency contact information during the employment onboarding process.

• Professional or Employment-Related Information: You may provide us with your job history, references, education history, certifications, and other information related to your qualifications for a particular position with VS.

How We Use Your Personal Information

The personal information we collect about you during the application process is used for job recruitment purposes. In addition to the other ways we process personal information described in the rest of this Notice, we also process your personal information in the following ways in connection with the job recruitment and selection process:

• To communicate with you about the status of your application and respond to your requests.

• To send you job alerts and communicate with you about VS positions that may match your skills and interests, if requested.

• To evaluate your candidacy for employment with VS using information we collect directly from you, as well as additional information we may obtain from third parties.

• To perform a background check.

• To maintain and create information for statistical purposes.

How We Share Your Personal Information

We share your personal information in the ways described elsewhere in this Notice. In connection with the job application and recruitment process, we may also share your personal information with service providers and contractors that evaluate employment applications and conduct background checks on our behalf.

Your Privacy Rights and Choices

Job applicants located within the EEA, or who reside in Canada or the state of California in the U.S. have the right to make certain privacy requests, subject to certain exceptions and limitations. See the applicable region-specific terms in this Notice for more information on your privacy rights. To submit a privacy rights request online, please follow the applicable process listed below. In the request webform, you will select your residential location and request type and enter limited personal information that we will use for purposes of verifying your identity and fulfilling your request. Alternatively, you may call us at 1-800-411-5116. We will comply with your request in accordance with our obligations under applicable law. We never discriminate against anyone for exercising their privacy rights. 

• Right to Access, Deletion, and Correction: Certain jurisdictions provide job applicants with the right to request access to, or deletion or correction of, their personal information. To submit a request, visit the job applicant privacy rights webform located here: Job Applicant Privacy Rights. 

• Request for List of Third-Party Disclosures: Certain jurisdictions provide job applicants with the right to request a list of third parties to which VS has disclosed their personal information. To submit a request, visit the job applicant privacy rights webform located here: Job Applicant Privacy Rights. 

Request to Opt-Out of Targeted Advertising or Selling/Sharing: Certain jurisdictions provide job applicants with the right to opt-out of the processing of their personal information for purposes of targeted advertising, as well as the sharing or selling of their personal information, as defined under applicable laws. To opt-out, visit this page: Job Applicant Opt-Out of Targeting, Selling, and Sharing.