Privacy Policy

RPM International Inc.

Privacy Notice

Last Updated: September 1, 2026

QUICK LINKS

• Personal Information We Collect
• Cookies and Tracking
• Use of Your Information
• Artificial Intelligence
• Sharing Your Information
• Use of Social Media
• Keeping Your Information
• Transferring Your Information
• Securing Your Information
• Product Reviews
• Your Responsibilities
• Email Marketing Opt-Out
• Biometric Information
• Rewards Programs
• Events and Teleconferences
• Changes to this Privacy Policy
• How to Contact Us

JURISDICTIONAL DATA PRIVACY RIGHTS

• Canada Data Privacy Rights
• EU, Switzerland & the United Kingdom Privacy Rights
• Australia Data Privacy Rights
• New Zealand Privacy Rights
• Brazil Data Privacy Rights
• South Africa Data Privacy Rights
• India Data Privacy Rights
• California Privacy Rights
• U.S. State Privacy Rights (General)

RPM International Inc., together with its affiliates, subsidiaries, and operating companies (each a "Company entity" and collectively the “Company”, “us,” "we") understands the importance of protecting your privacy. This Privacy Policy sets out how we process personal information. It describes, among other things, the types of personal information that we collect, the purposes for which we use it, the types of third parties with whom we share it, and the rights and responsibilities you may have with respect to it.

This Privacy Policy applies to the personal information you provide us when you (i) visit any website or interact with software that we own, license, or otherwise operate and that links to this Privacy Policy (each, a “Site”), (ii) purchase or receive products, goods, or services through a Site, or (iii) visit our offices or otherwise contact or engage with us. Other policies may also apply where applicable. For purposes of this Privacy Policy, a Site and all products, goods and services sold or furnished by the Company through a Site shall be referred to collectively as the “Services.”

PLEASE READ THIS PRIVACY POLICY CAREFULLY AS IT DESCRIBES YOUR RIGHTS, RESPONSIBILITIES, AND LIABILITIES. BY ACCESSING OR USING THE SERVICES OR OTHERWISE PROVIDING US WITH PERSONAL INFORMATION, YOU ARE CONSENTING TO THE TERMS OF THIS PRIVACY POLICY, THE COMPANY’S TERMS OF USE AND ANY APPLICABLE COOKIE POLICY ON A SITE.

You must be at least eighteen (18) years of age to access the Services. RPM International Inc. is headquartered in the United States, and the personal information you provide to the Company may be processed and stored in the United States and other jurisdictions. For more information on our data transfer practices, please click the “Transferring Your Information” quick link above or see Section 11 (Data Transfers) below.

1. Scope

In most instances, this Privacy Policy applies to personal information that the Company entity identified on a Site, order documentation, event registration, application form, or other point at which your personal information is collected receives during its business operations as a “data controller”. This means that such entity determines the purpose and means of processing such personal information. A Company entity that collects your personal information may also share it with RPM International Inc. or other Company entities, and those recipient entities may process that personal information as controllers for their own legitimate intra-group purposes, including internal administration, governance, legal, compliance, audit, security, strategic planning, and business operations, as permitted by applicable law. For purposes of this Privacy Policy, the term “personal information” means any information that, alone or in conjunction with other information or data, identifies or is linked to a natural person and that is subject to, or otherwise afforded protection under, a data protection law, statute, or regulation. The term “personal information” does not include anonymized or de-identified data that is not attributable to a particular individual, household, or device and that is not otherwise subject to a data protection law, statute, or regulation. The Company may anonymize or de-identify personal information, and such data is not subject to this Privacy Policy, and the Company may use such data for any purpose permitted by law. In some instances, the Company or a Company entity may receive your personal information as a “data processor”. This means that another party determines the purpose and means of processing such personal information. In such cases, the Company entity will process your personal information only on the written instructions of the data controller and to the extent reasonably necessary or appropriate for the performance of the services to which it is engaged, including the transfer of personal data to third countries, unless provided otherwise by applicable data protection laws to which the Company is subject. Finally, there may be situations where the Company or a Company entity receives your personal information as a “joint controller”. In such cases, the relevant Site, service materials, or point of collection will identify the Company entity or entities involved and, where required by applicable law, provide or make available relevant information about that arrangement.

2. The Types and Categories of Personal Information We Collect

The Company collects personal information to provide our Services, comply with our legal obligations, promote our business interests, and for the other reasons set forth in this Privacy Policy. When you do not provide personal information to the Company, we may not be able to provide you with the Services or complete a transaction you requested. Generally, we collect the following types and categories of personal information in connection with our Sites, Services, and related customer, marketing, and business-to-business interactions:

3. Technical Data

When you access a Site, we collect certain data automatically using technical means and tools. From time to time, the Company or its service providers may release aggregate and de-identified reports derived from this technical and usage information (for example, by publishing a report on trends in the usage of our Site or service provider’s platforms). This data relates to your device and your experience on a Site and other websites, including the following:

Usage and Device Data. When you access and use a Site, we automatically collect details of your access to and use of a Site, including traffic data, usage logs and other communication data, and the resources that you access and use on or through a Site (e.g., browsing history, viewing duration, search history). We may also collect information about your device and internet connection, including the device’s unique identifier (e.g., device type, IMEI, Wi-Fi MAC, IP address), operating system, browser type, and mobile network information. A Site may collect “diagnostic” data related to your use of a Site, such as crash data and logs, performance data (e.g., launch time, hang rate, or energy use), and any other data collected for the purposes of measuring technical diagnostics.

Cookies and Tracking Data. We use “cookies” and other tracking technologies within a Site. A cookie is a small file placed on your smartphone or other device. You may refuse to accept certain cookies by activating the appropriate setting on your smartphone or device or by changing your cookie preferences on the Site. However, if you disable certain cookies, some parts of a Site may become inaccessible or not function properly. In addition, a Site may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit us to analyze data on your use of a Site (e.g., recording the popularity of certain content and verifying system and server integrity). A Site may collect data about the advertisements you have seen or engaged. For more information, see our Cookie Policy. From time to time, we may use on our Site certain third-party cookies and pixels provided by our marketing partners, including social media companies. To the extent we use such third-party cookies and pixels, you hereby agree to the terms and conditions set forth by those third parties, which may include Meta, X (formerly Twitter), TikTok, YouTube, and LinkedIn, among others.

Site Monitoring. We also use cookies and other tracking technologies within a Site to monitor and record any and all activities and communications to, from, and on a Site to safeguard, improve, and analyze usage of a Site and for the other purposes listed in this Privacy Policy. For the avoidance of doubt, you hereby acknowledge, agree, and consent to such monitoring and recording.

Non-Cookie Technologies. Where permitted by applicable law and consistent with your selections in the cookie management tool or other consent mechanism made available on a Site, we may deploy on our Site certain types of “Non-Cookie Technologies” provided by our service providers to support our digital advertising programs. These technologies often include browser cache, locally stored objects, or the creation of a statistical identifier wherein an identifier, much like a cookie identifier, is calculated based on the characteristics of a browser or device that distinguishes it from other browsers or devices. These identifiers are calculated either from the data your browser or device shares automatically or with additional data specifically requested from your browser or device. We will describe the Non-Cookie Technologies we use and the choices available to you in our Cookie Policy, if available, on a Site.

4. Sources of Information

First Party / Direct Collection. We collect personal information directly from you when you use our Services (e.g., account registration, completing purchases, signing up for subscriptions), when you provide a Product Review (as defined below), or whenever you directly engage with us, such as when you call, email, visit our offices or premises or otherwise contact us. Some in-person, event, visitor, or employment-related interactions may also be subject to a separate privacy notice or supplemental disclosure.

Automated Collection. We may collect information and data, such as usage data and cookies, through automated means when you use a Site (see “Technical Data” above).

Third-Party Sources. In accordance with applicable law, the Company may collect personal information about you from third parties, such as publicly available databases, advertising companies, and social media websites and applications, and combine it with information we already hold about you in order to help us improve and customize our Services and for other purposes set forth in this Privacy Policy. In addition, we may collect personal information from third-party service providers so we can assess whether to pursue a business relationship with you and for “background,” “credit” check, or due diligence processes. We may also collect your contact information from your employer or other third parties to facilitate or otherwise engage in traditional business activities and similar administrative matters.

5. How We Use Your Information / Purpose of Collection

We may use the personal information we collect about you to perform our Services, comply with our legal obligations, and promote our business interests.

For the avoidance of doubt, we may contact you, where permitted by applicable law, via the contact details you provide to us, including via SMS/text message, direct message via messaging apps and email and, where we have obtained any consent required by applicable law, through the use of autodialing systems and services, to furnish you information regarding a product order, shipping status, warranty-related information, customer support, account or security matters, and similar data and information pertaining to a commercial transaction or our Services. Promotional and marketing communications will be sent only in accordance with applicable law, including any legally required opt-in and opt-out rights.

6. Use of Artificial Intelligence

We may use artificial intelligence (AI) technologies to enhance our Services, improve user experiences, and support our business operations. These technologies may process personal data to:

• Analyze patterns, determine trends, make predictions, and identify preferences to personalize content and recommendations.
• Detect fraud, security threats, or policy violations.
• Implement data loss prevention protocols.
• Support certain customer service and other operational processes and, where permitted by applicable law, automate processes, which may vary by business, product, service, and jurisdiction.

Where AI is used in processing that is subject to legal requirements relating to automated decisions with legal or similarly significant effects, we will comply with applicable law, which may include:

• Appropriate human review or intervention.
• Advance notice of the use of automated decision-making and an opportunity to opt-out or request review, where required by applicable law.
• Meaningful information about the logic involved, where required by applicable law.

Individuals may have the right to opt out of such processing, where applicable. To the extent we use AI to make decisions based solely on sensitive personal data, we do so only with explicit consent or as otherwise permitted by law.

If personal data is used to train AI models, we take steps to ensure that such data is anonymized or aggregated where possible, and that appropriate safeguards are in place to protect individual privacy.

Virtual Assistant: Some of our businesses utilize virtual assistants powered by third-party AI and automated processing to facilitate consumer interactions. The virtual assistant is designed to (i) analyze user input using natural language processing, (ii) match user questions with appropriate responses from a knowledge base, (iii) automatically record and store communication for compliance, audit, and quality assurance purposes in accordance with applicable data protection laws, and (iv) deliver information such as payment invoices, balances, and confirmations.

7. Sharing Information / Third-Party Disclosures

We may share your personal information with certain organizations and third parties in accordance with applicable law, including as set out below.

Intra-Group. The Company is composed of affiliates and operating businesses all over the world. The specific Company entity that acts as the data controller for a particular Site or Service will be identified on the relevant Site, order documentation, event registration, application form, or other point of collection, unless otherwise stated in this Privacy Policy. We may disclose your personal information to other Company entities only where reasonably necessary for the purposes for which the personal information was collected, including to comply with laws, provide, operate, maintain, improve, and promote our Services, to manage customer and supplier relationships, to provide internal administrative, IT, finance, legal, compliance, and reporting support, and to support corporate transactions. For a list of Company entities, please see https://www.rpminc.com/leading-brands/; that list is provided for general information only and does not by itself determine which Company entity is the data controller for a particular Site or Service.

Service Providers. We may share your personal information with companies that provide services on our behalf, such as hosting and analyzing a Site, conducting surveys, benchmarking and marketing, processing transactions (including order fulfilment, rebates and returns), tracking and responding to consumer questions or complaints, and performing analyses to improve the quality of our Services.

Payment Card Transactions. Online payments for purchases made through a Site may be completed using third-party vendors’ online payment systems. In such cases, the Company will not have access to your credit card information. Any personal or financial information you provide to our third-party online payment systems is subject to the third party’s privacy policy and terms of use, and we recommend you review these documents before providing any personal or financial information. The Company may, from time to time, facilitate payment card transactions outside a Site, including (but not limited to) transactions completed over the telephone.

Distributors and Business Partners. We may share your personal information with third parties that are involved in distributing or reselling our goods or products, fulfilling your order or request, providing installation or after-sales support, administering joint promotions or events, or delivering marketing materials where permitted by applicable law.

Marketing Partners. The Company has partnered with third-party service providers with whom we share Online Identifiers concerning your use of a Site, which are derived through the cookies, pixels, and tags we use on a Site. If you would like to opt out of this non-essential information sharing and related targeted advertising, please click on the cookie management tool to set your preferences. You may also use that tool or mechanism to withdraw or adjust your preferences for non-essential cookies, pixels, and tags. The cookie management tool and the Cookie Policy, if available, on a Site will identify these partners or the categories of cookies, pixels, and tags through which such information is shared, together with any choices required by applicable law.

Business Restructuring. Circumstances may arise where for strategic or other business reasons the Company decides to sell, buy, divest, merge or otherwise reorganize our businesses. We may disclose your personal information to the extent reasonably necessary to proceed with the negotiation or with the completion of a merger, acquisition, divestiture, or sale of all or a portion of the Company’s assets.

Legal; Compliance; Legitimate Interest. We may disclose personal information to a third party (i) if required by law or government order, or with a legal process, (ii) when necessary to defend or protect our legal, regulatory, or business interests, (iii) to protect and defend our rights or property, or (iv) in urgent circumstances, to protect the health and personal safety of any individual.

Consent. In addition to the reasons for disclosure set forth above, we may also disclose your personal information when you consent to the disclosure.

In the event that you facilitate a transaction with the Company, or request information from or otherwise engage with us, and such activities require the Company to share your personal information with a service provider or other third party, you hereby consent to such disclosure and/or direct the Company to intentionally disclose your personal information to the service provider or third party.

8. Social Media

We may engage with you on various social media platforms (e.g., Facebook, Twitter, TikTok, WhatsApp, YouTube, Pinterest, Instagram). If you contact us on a social media platform for customer support or for other reasons, we may contact you via the social media’s direct message tools. Your use of a social media platform is subject to the policies and terms of the relevant social media platform. Certain social media platforms may also automatically provide us with your personal information, and the information we receive will depend on the terms that govern your use of the social media platform(s) and any privacy settings you may have set.

A Site may, from time to time, include social media features and widgets (e.g., the “Facebook Like” button, the “Share This” button) or interactive mini programs that run on a Site. These features may collect your IP address and which Site page you are accessing and may set a cookie to enable the feature to function properly. Social media features and widgets are either hosted by a third party or hosted directly on a Site. Your interactions with these features are governed by the privacy statement of the relevant social media platform that provides them.

According to the terms and conditions governing certain social media platforms, you may request that the information, data, or other content we obtain from or through the social media platform (“Platform Data”) be deleted or modified. If you would like Platform Data related to you deleted or modified, please contact us in accordance with the “Contact Us” section below and (i) identify the social media platform at issue and (ii) the Platform Data that you would like deleted and/or modified, and if modified, the modification to said Platform Data. We may also delete Platform Data if requested by the social media platform.

9. Links to Other Websites; Your Direct Third-Party Disclosures

This Privacy Policy only governs your use of our Services (as defined above), and the Company is not responsible for the content or privacy practices employed by any third party. As a resource to you, a Site may include links to third-party websites or provide you with the opportunity to disclose information directly to third parties (e.g., credit card processors). Please be aware that third-party websites may include a Company logo, may be linked to a Site, or may otherwise appear to be affiliated with the Company. Our Privacy Policy does not apply to such third-party websites or organizations. You assume all privacy, security, and other risks associated with providing any data, including personal information, to third parties via the Services. For a description of the privacy protections associated with providing information to third parties, you should refer to the privacy statements, if any, provided by those third parties.

10. Data Retention

How long we keep your personal information varies depending on why it was collected. We keep personal information to provide you with our Services, facilitate transactions you have requested, or engage in marketing activities, for as long as is necessary to defend our legal or business interests. For example, when you have made a purchase with us, we will keep a record of your purchase for the period necessary for invoicing, tax and warranty, and liability purposes. We may also keep a record of correspondence with you (e.g., if you have made a complaint about a product) for as long as is necessary to protect us from a legal claim. Please note that when you unsubscribe from our marketing communications, we keep a record of your email address to ensure we do not send you marketing emails in the future.

11. Data Transfers

RPM International Inc. is headquartered in the United States, and the personal information that we collect and process may be retained and stored in the United States. We use service providers that store personal information on our behalf in the United States and in other third countries. Please be aware that the United States, and these other third countries, may not provide the same level of protection of personal information as in your country, state, or other jurisdiction of residence or nationality, and when transferred to the United States or elsewhere, your personal information may be accessible by, or otherwise made available to, local government authorities and officials pursuant to judicial and/or administrative orders, decrees, and demands, and/or other domestic laws, statutes, and regulations. By continuing to provide us such information, you hereby acknowledge and agree that your personal information will be transferred to, and stored in, the United States and in such other third countries. Where required by applicable law, we will only transfer personal information internationally pursuant to a valid legal mechanism and with any required safeguards.

12. Security

We use a variety of security technologies and procedures to help protect your personal information from unauthorized access, use, or disclosure. HOWEVER, NO INFORMATION SYSTEM CAN BE FULLY SECURE, AND WE CANNOT GUARANTEE THE ABSOLUTE SECURITY OF YOUR PERSONAL INFORMATION. MOREOVER, WHILE WE USE REASONABLE ADMINISTRATIVE, TECHNICAL, AND PHYSICAL SAFEGUARDS DESIGNED TO PROTECT PERSONAL INFORMATION, THE SECURITY OF PERSONAL INFORMATION YOU TRANSMIT TO A SITE AND/OR THE SERVICES OVER NETWORKS THAT WE DO NOT CONTROL, INCLUDING THE INTERNET AND WIRELESS NETWORKS, CANNOT BE GUARANTEED. TO THE EXTENT PERMITTED BY LAW, WE ARE NOT RESPONSIBLE FOR ANY DATA INCIDENT OR EVENT CAUSED BY A THIRD PARTY OR BY NETWORKS OR SYSTEMS NOT UNDER OUR CONTROL, EXCEPT AS OTHERWISE REQUIRED BY APPLICABLE LAW. The safety and security of your personal information also depends on you. Where we have given you (or where you have chosen) a username and password to access a Site or our Services, you are responsible for maintaining the security and confidentiality of those credentials and not revealing them to others. You must contact us immediately if you have reason to believe that your username or password to a Site or our Services has been compromised. You acknowledge and agree that we may contact you via email or other electronic communications in the event we are legally required to notify you of a data security incident or event related to your personal information.

13. No Data Collected from Children

A Site is not directed at, nor intended for use by, children. As a result, if you are under the age of eighteen (18), you are prohibited from accessing or using the Services (including a Site) or providing us with your personal information. If the parent or guardian of a child under the age of eighteen (18) believes that the child has, or if you are under the age of 18 and believe that you have, provided us with any information, the parent or guardian of that child should contact us if they want this information deleted from our files, and we will undertake commercially reasonable efforts to comply with the request.

14. Publicly Posted Information; Product Reviews

You may, from time to time, have the ability to submit via a Site a comment on, provide an opinion about, rate, or otherwise discuss our Services (a “Product Review”). In other circumstances, you may directly provide us feedback on our business, our business sector, a Site or the Services (“Feedback”). Any information or content you include in a Product Review, or in any Feedback that you choose to make publicly available through a Site or our social media platforms may be available to other users of a Site (and our social media platforms) and may be retrievable by third-party search engines, and third parties may also be able to download or share your Product Review or publicly posted Feedback to social media websites or elsewhere. We recommend that you guard your privacy and anonymity and not upload any information in a Product Review or in any publicly posted Feedback that you wish to remain confidential. Any third party with access to your information via a Site will be permitted to use the information in the same manner as if you submitted the information directly to that third party. Publicly posting any information on a Site is entirely voluntary on your part, and we recommend you carefully consider the information you choose to make publicly available. This Privacy Policy addresses how we process personal information contained in Product Reviews and Feedback. Separate terms regarding ownership, licenses, moderation, or permitted use of Product Reviews or Feedback are addressed in the Company’s Terms of Use or other applicable terms for the relevant Site.

15. Your Responsibilities

You are permitted, and hereby agree, to only provide personal information to the Company if such personal information is accurate, reliable, and relevant to our relationship and only to the extent such disclosure will not violate any applicable law, statute, or regulation or infringe upon a person’s data privacy rights or privileges. IF YOU PROVIDE PERSONAL INFORMATION (INCLUDING PERSONAL INFORMATION CONCERNING A THIRD PARTY) TO THE COMPANY, YOU EXPRESSLY REPRESENT AND WARRANT TO THE COMPANY THAT YOU HAVE THE FULL RIGHT AND AUTHORITY TO PROVIDE THE COMPANY WITH SUCH PERSONAL INFORMATION (INCLUDING PERSONAL INFORMATION CONCERNING A THIRD PARTY) AND THAT THE COMPANY’S USE AND PROCESSING OF SUCH PERSONAL INFORMATION AS SET FORTH HEREIN WILL NOT VIOLATE ANY PERSON’S RIGHTS OR PRIVILEGES, INCLUDING RIGHTS TO PRIVACY. YOU HEREBY AGREE TO FULLY AND COMPLETELY INDEMNIFY THE COMPANY FOR ANY CLAIMS, HARM, OR DAMAGES THAT MAY ARISE FROM YOUR PROVISION OF PERSONAL INFORMATION (INCLUDING PERSONAL INFORMATION CONCERNING A THIRD PARTY) TO THE COMPANY.

16. Updating Your Information

It is important that the personal information that you provide to us is accurate and reliable. In certain circumstances, you may have the ability to directly edit your online account with the Company to update and change your personal information (e.g., name, telephone number, email, shipping address), and you must do so when such changes are warranted. If your account does not contain such an editing feature, then you must notify the Company directly of any changes or updates to your personal information in accordance with the “Contact Us” section listed below.

17. Marketing Communications Opt-Out

You have the right to opt out of receiving marketing communications and direct-mail marketing from us. Where required by law, the marketing communications that you receive from us will provide you an option to “unsubscribe” or otherwise opt out of receiving future marketing communications from us. You may also unsubscribe from email and direct-mail marketing by contacting us in accordance with the "Contact Us" section listed below. For SMS/text message or messaging app marketing, you may opt out using the instructions provided in the relevant message or by contacting us in accordance with the “Contact Us” section listed below. Due to production, mailing and system timelines, it may take some time to process your request. Until your requested change takes effect, you may still receive communications from us. If you send us your request by regular mail, please allow extra time for us to receive your notice. Please note: Although you may have opted not to receive communications, you may still receive business-related communications such as order confirmations, product recall notices, membership information, or other communications that are necessary to complete your transaction. You hereby agree to immediately notify the Company, in writing, in the event you no longer own, license, or use an email address to which you subscribed to receive email marketing from us.

18. Biometric Data

The Company does not collect biometric data or biometric identifiers through a Site. Where permitted by law and in certain limited circumstances, the Company may collect biometric data and biometric identifiers related to our customers, suppliers, service providers, guests visiting a physical location, employees, temporary workers, contractors, or agents, including through cameras, kiosks, and similar devices and technology to collect, retain, and use information derived from the scanning of a person’s facial geometry or thermal temperature in order to facilitate the Company’s health and safety screening programs, and for other security-related purposes, or from individuals that are accessing sensitive areas of the Company’s facilities or for other administrative (e.g., timekeeping) or security functions and purposes. The Company will maintain protocols for the security and destruction, or disposal of, biometric identifiers in a manner that complies with applicable data protection law and renders such data and identifiers unreadable to remove any potential for its reuse or re-identification. Barring any applicable law to the contrary, the Company may disclose and disseminate biometric identifiers to third parties in the same manner as it may disclose and disseminate personal information to third parties in accordance with this Privacy Policy, and such disclosures of biometric identifiers may include to third party service providers and law enforcement or regulatory agencies, where permitted by law.

19. Do-Not-Track Signals

Some browsers and browser extensions support the Global Privacy Control (“GPC”) that can send a signal to process your request to opt out from certain types of data processing, including data "sales" as defined under certain laws. When we detect such a signal, we will make reasonable efforts to respect your choices indicated by a GPC setting as required by applicable law.

Some web browsers may transmit “do-not-track” signals to a Site with which the user communicates. Because of differences in how web browsers incorporate and activate this feature, it is not always clear whether users intend for these signals to be transmitted, or whether they are even aware of them. Unless otherwise required by law, we currently do not take action in response to these signals.

20. Persons with Disabilities

The Company strives to ensure that every person has access to information related to our Services, including this Privacy Policy. Please contact us in accordance with the “Contact Us” section listed below if you would like this Privacy Policy provided in an alternative format, and we will seek to meet your needs.

21. Rewards Programs and Financial Incentives

We collect and use personal information, including personal information provided by third parties, to administer and maintain our financial incentive, rewards, and loyalty programs (“Rewards Programs”). We use the personal information you provide in these programs to verify your identity, offer unique rewards, track your program status, and facilitate the exchange of program points for products, promotional materials, training workshops, and other items. If you consent to participate in any of our Rewards Programs, you may withdraw that consent at any time by contacting us in accordance with the “Contact Us” section listed below or in accordance with the instructions set forth in the applicable Rewards Program’s terms and conditions. The Company may use personal information gathered from, or related to, participants in our Rewards Programs for any other purpose or in any other manner set forth in this Privacy Policy.

22. Events and Video Teleconferencing

Conference Platforms. The Company uses web-based conferencing platforms and applications (each a “Conference Platform”) for the purpose of hosting or conducting video and audio meetings and conferences, webinars and similar training exercises, social events, and other types of video and audio meetings (collectively, “Conferences”). The type of personal data processed by the Company via a Conference Platform depends on the scope and nature of the Conference, and may include your identity data, registration data, transaction data, technical data, discussion transcripts, and other information captured during the Conferences. Please note that we, and our third-party service providers and partners, may record certain Conferences or particular Conference features, including audio, video, chat, and transcripts, where recording is enabled for that Conference, and we may use and disclose such content, information and data for the purposes described in this privacy statement and as otherwise permitted by applicable law. Such recording may be facilitated using AI as described more fully in Section 6 above. Where required by applicable law, the Company will provide notice of recording and obtain any required consent before recording begins. By participating in a recorded Conference or using a recorded Conference feature after receiving such notice, you acknowledge the recording and, to the extent permitted by applicable law, consent to the recording, use, and disclosure described above. If you do not wish to be recorded, you should notify the meeting host before joining or participating in the recorded portion of the Conference and discontinue use of the relevant recorded feature or leave the Conference as applicable; any withdrawal of consent will apply only going forward and the Company may be unable to stop, edit, or delete a recording or transcript already in progress except as required by applicable law. When attending or presenting on a Conference Platform, you must implement measures designed to ensure data and privacy protection in the background of your environment (e.g., by notifying bystanders of the conference, using the background masking function). Please see the privacy statement by Microsoft Teams for a description of its Conference Platform privacy practices. Where a recording or transcript exists, any request for access will be handled in accordance with applicable law and subject to legal, security, confidentiality, and technical limitations. The Company prohibits attendee third-party recording devices or processes, including chat/recording bots or transcription tools, on a Conference Platform, without advanced, express written permission from the Company.

Communications Content and Recordings. When you email, call, or otherwise communicate or interact with us or with other Company users, including if you sign up for our mailing lists, complete forms on our websites, interact with our social media pages, post a product review or testimonial, submit content in any online discussion groups, participate in a conference, or otherwise enter information into public-facing comment fields, blogs, or community forums sponsored by or affiliated with the Company, we may collect and maintain records of your contact details, communications and interactions, your posts or submissions, and our responses, if applicable. We, and our third-party service providers and partners, may also collect and maintain records of information you submit through our websites and online services, such as through our Conference Platforms, chat functions, or virtual assistants, and may record or log communications made through those channels as permitted by law.

23. Canada

Personal data (as the term is defined in the Personal Data Protection and Electronic Documents Act of Canada (“PIPEDA”)) shall be synonymous with personal information, where permitted, and will be collected, stored, used, and/or processed by the Company in accordance with this Privacy Policy and the Company’s obligations under PIPEDA and other applicable Canadian provincial laws. Pursuant to these Canadian laws, you have a right to request access to your personal information and to request that inaccurate personal information be corrected. If you have submitted personal information to us and would like to have access to it, or have it corrected, please contact us in accordance with the “Contact Us” section listed below. When requesting access to, or correction of, your personal information, we will require that you verify our request via email, and we will request specific data from you to enable us to confirm the authenticity of the request and your identity, and to enable us to search our records and databases. We may charge you a fee to access your personal information, provided that we advise you of any such fee in advance. Your right to access personal information is not absolute, and we may not be able to allow you to access certain personal information in certain circumstances (e.g., if the information contains personal information of other persons or is subject to legal privilege). In the event that we cannot provide you with access to, or the ability to correct, your personal information, we will use reasonable means to inform you of the reasons why, subject to any legal or regulatory restrictions. To delete your name from our electronic contact lists (text or email), please follow the applicable opt-out instructions listed above (see “Marketing Communications Opt-Out”) or contact us in accordance with the “Contact Us” section listed below. If you have concerns with our data processing, you may file a complaint with the Office of the Privacy Commissioner of Canada. Please refer to the Office of the Privacy Commissioner of Canada for more information.

24. European Union (EU), Switzerland, and United Kingdom (UK)

Data Protection Rights. If you are located in the EU, Switzerland, or the UK, you have the following data protection rights:

• Right to Know. The right to know about what personal information the Company collects and processes about you, including the types and categories of personal information we collect and process, the sources of such personal information, our retention criteria, with whom we share your personal information, cross-border data transfers, and how to file complaints and inquiries. Such information is set forth in this Privacy Policy.
• Automated Decision Making. When we engage in profiling or other processing activities that may subject you to decisions based solely on automated processing, which may produce legal effects or similarly significant results, we process such personal information in accordance with Section 6 (Artificial Intelligence).

• Access Rights. You may ask us whether we process any of your personal information and, if so, receive access to such personal information. When complying with an access request, we will also provide you with additional information, such as the purposes of the processing, the categories of personal information concerned as well as any other information necessary for you to exercise the essence of this right.
• Rectification. You have the right to have your personal information corrected/rectified in case of inaccuracy or incompleteness. Upon request, we will correct inaccurate personal information about you and, taking into account the purposes of the processing, update any incomplete personal information, which may include the provision of a supplementary statement.
• Erasure. You have the right to have your personal information erased, which means the deletion of your personal information by us and, where possible, any other controller to whom your data has previously been disclosed. However, your right to erasure is subject to statutory limits and prerequisites (e.g., where your personal information is no longer necessary in relation to the initial purposes for which it was processed, your personal information was processed unlawfully).
• Restriction of Processing. You have the right to obtain the restriction of the processing of your personal information, which means that we suspend the processing of your personal information for a certain period of time. Circumstances which may give rise to this right include situations where the accuracy of your personal information is contested, but we need time to verify the inaccuracy (if any) of your personal information.
• Data Portability. You have the right to request us to provide you with your personal information in a structured, commonly used and machine-readable format and to have such data transmitted directly to another controller, where technically feasible.
• Right to Object. You have the right to object to the processing of your personal information, which means you may request us to no longer process your personal information. This only applies in case the “legitimate interests” ground (including profiling) constitutes the legal basis for processing (see below “Legal Basis for Processing”). However, at any time (and free of charge) you can object to having your personal information processed for direct marketing purposes.
• Withdrawing Consent. You also may withdraw your consent at any time if we are solely relying on your consent for the processing of your personal information. However, this will not impact our legal basis to process such personal information prior to the withdrawal of your consent.

To exercise any of these data privacy rights, please contact us, or have your designated agent contact us, in accordance with the “Contact Us” section listed below. To the extent permitted by law, we will need to verify your identity (or the identity of your agent) and ensure the authenticity of your request.

Legal Basis for Processing. We process your personal information in accordance with the legal bases set forth in law. For example, our processing of personal information (as described herein) is justified based on the following legal grounds:

• Consent. Processing is based on your consent (e.g., you register to receive our marketing materials, you voluntarily contact us).
• Legitimate Interests. Processing is necessary for our legitimate interests as set out herein (e.g., monitoring your use of a Site and your compliance with the terms and conditions governing the same, improving our Services).
• Contract Undertaking. Processing is necessary for the performance of a contract to which you are a party (e.g., you purchase or consider purchasing our Services).
• Legal Compliance. Processing is required to comply with a legal or statutory obligation (e.g., tax disclosures).

Complaints. In the event you have concerns about our data processing, you have the right to file a complaint with your data protection authority. For data protection authorities in the EU, please see here: https://edpb.europa.eu/about-edpb/about-edpb/members_en. For the data protection authority in Switzerland, please contact the Federal Data Protection and Information Commissioner (https://www.edoeb.admin.ch/edoeb/en/home.html). For the data protection authority in the UK, please contact the Information Commissioner’s Office (www.ico.org.uk). We would, however, appreciate the opportunity to deal with your concerns before you approach a data protection authority with a complaint, and invite you to contact us in the first instance.

25. Australia

Based on location and/or operation, some of our entities will be subject to the Australian Privacy Act 1988 (Cth). Under Australian Privacy Laws, if you are a citizen or resident of Australia, you may have certain additional rights regarding your personal information including, for example, the right to access and correct the information that we hold about you, and a general requirement to ensure the quality and accuracy of the personal information collected. You may request access to any of the personal information we hold about you at any time, but we may charge a fee for our costs of retrieving and supplying the information to you. If any of the personal information we hold about you is incorrect, inaccurate, or out of date, you may request that we correct it. We will generally rely on you to ensure the information that we hold about you is accurate and/or complete.

Access and correction requirements in the Australia Privacy Act 1988 (Cth) operate alongside and do not replace other informal or legal procedures by which an Australian resident can be provided access to or correction of his or her personal information, such as Australia’s Freedom of Information Act 1982.

If you are dissatisfied with how we have dealt with your personal information, please contact us in accordance with the “Contact Us” section listed below so that we can try to find a solution. You may ultimately choose to raise your concern with the applicable data privacy regulator. For Australia, the Office of the Information Commissioner may be contacted either via www.oaic.gov.au, by phone at 1300 363 992, or at GPO Box 5218 Sydney NSW 2001.

26. New Zealand

If you are a resident of New Zealand, under the New Zealand Privacy Act 2020, where we collect your personal information directly from you, we are required to tell you whether providing the information is voluntary or required and what may happen if you do not provide it. Unless we tell you otherwise at the time of collection, providing your personal information is voluntary; however, if you do not provide information needed for a request, transaction, or service, we may not be able to respond to you or provide the relevant Services. Where we collect your personal information from a source other than you, we will, where required by law, take reasonable steps to inform you that we have collected the information and that you have the right to request access to, and correction of, that information.

27. Brazil

If you are a resident of Brazil, under the Brazil General Data Protection Law (Lei Geral de Protecao de Dados Pessoais (“LGPD”), Law No. 13,709/2018, you may have additional rights regarding your personal data, including:

• The right to confirm the existence of the processing of your personal data;
• The right to access your personal data;
• The right to correct incomplete, inaccurate or out-of-date personal data;
• The right to anonymize, block, or delete unnecessary or excessive personal data or personal data that is not being processed in compliance with the LGPD;
• The right to the portability of personal data to another service or product provider if you make an express request;
• The right to delete your personal data being processed;
• The right to information about public and private entities with which we have shared your personal data;
• The right to refuse consent for processing your personal data and information regarding the consequences if you refuse to give such consent; and
• The right to revoke consent previously given for the processing of your personal data.

We may collect and process personal data: (i) where we have your consent to do so; (ii) where we need the personal data to perform a contract with you (e.g. to administer an employment or work relationship); (iii) to comply with one of our legal or regulatory obligations; (iv) to execute public policies provided in laws or regulations, or based on contracts, agreements, or similar instruments; (v) to exercise our rights in judicial, administrative or arbitration procedures; (vi) to protect the life or physical safety of the data subject or a third party; (vii) to protect credit; and/or (viii) where the processing is in our legitimate interests and not overridden by your privacy interests or other rights found in applicable laws.

If you are dissatisfied with how we have dealt with your personal data, please contact us in accordance with the “Contact Us” section listed below so that we can try to find a solution.

28. South Africa

If you are a resident of South Africa, under the Protection of Personal Information Act 4 of 2013 (POPIA), the provision of personal information to us may be voluntary or mandatory, depending on the nature of your interaction with us and any applicable legal requirements. If you do not provide personal information that is required for us to enter into or perform a contract with you, comply with law, or respond to your request, we may not be able to provide the relevant Services or otherwise engage with you. Subject to applicable law, you have the right to object to the processing of your personal information in certain circumstances, and to request access to and correction of your personal information. You also have the right to lodge a complaint with the Information Regulator (South Africa) by email at enquiries@inforegulator.org.za or by telephone at 010 023 5200.

29. India

If you are a resident of India and we process your personal data on the basis of your consent, under the Digital Personal Data Protection Act (DPDPA), you have the right to withdraw that consent at any time, with the ease of doing so being comparable to the ease with which such consent was given. You may exercise this right, and seek grievance redressal, by contacting us in accordance with the “Contact Us” section listed below. If you are not satisfied with our response, you may make a complaint to the Data Protection Board of India in the manner prescribed under applicable law.

30. California

If you are a resident of California, under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), you have the following data privacy rights:

• Right to Know (Specific Pieces of Personal Information). You have the right to know the specific pieces of your personal information that we have collected about you.
• Right to Know (Categories of Personal Information). You have the right to know (i) the categories of personal information we have collected from you; (ii) the categories of sources from which the personal information is collected; (iii) the categories of your personal information we have sold or disclosed for a business purpose; (iv) the categories of third parties to whom your personal information was sold or disclosed for a business purpose; and (v) the business or commercial purpose for collecting or selling your personal information.
• Right to Delete. You have the right to request that we delete your personal information that we have collected and retained.
• Right to Correct. You have the right to request that we correct inaccurate personal information that we have collected and retain.
• Nondiscrimination. You have the right not to be subject to discrimination for asserting your rights under the CCPA.

Submit a Privacy Request. To submit a privacy request, you may contact us using any of the following means:(email)dataprotection@rpminc.com,(webform)https://www.rpminc.com/contact-rpm/, (telephone) 1 (800) 776-4488, or (mail) RPM International Inc., ATTN: Privacy Request, 2628 Pearl Road, Medina, OH 44256. If you would prefer, you may designate an authorized agent to submit a CCPA privacy request on your behalf. An authorized agent must be registered with the California Secretary of State to conduct business in California.

Privacy Request Verification Process. If you (or your authorized agent) make any request related to your personal information, the Company will ascertain your identity (and the identity of the authorized agent, to the extent applicable) to the degree of certainty required or permitted under the law before addressing your request. In particular, the Company will, to the extent required or permitted by law, require you (or your authorized agent) to verify your request via email, request certain contact information or government identifiers, and we will match at least two pieces of such personal information with data that we have previously collected from you before granting you access to, erasing, or correcting, specific pieces or categories of personal information, or otherwise responding to your request. We may require written documentation that demonstrates that a third party is authorized to serve as your agent for the purposes of submitting the requests set forth herein, unless you have provided the authorized agent with power of attorney pursuant to California Probate Code §§ 4121 to 4130. None of the CCPA’s rights, as amended by the CPRA, are absolute, and such rights are subject to legal and regulatory exceptions and exemptions. For more information about the CCPA or the CPRA, please see: https://oag.ca.gov/privacy/ccpa.

Opt-Out Rights / Do Not Sell My Personal Information. California residents have the right to opt out of the “sale” of their personal information. The Company does not sell personal information. However, the use of certain third-party cookies, pixels, tags, analytics, and advertising technologies on our Site and our disclosures to certain marketing partners may constitute a "sale" under California law. To opt out of these activities, please click on the cookie management/settings tool (sometimes visible as a "Cookie Settings" link) on the footer of a Site to set your cookie preferences.

Opt-Out Rights / Do Not Share My Personal Information. California residents have the right to opt out of the “sharing” of their personal information. The Company uses third-party analytical and targeted advertising features on our Site and similar web tools provided by our marketing partners, and such features, tools and marketing relationships involve the disclosure of your personal information to third parties and may constitute the “sharing” of your personal information. To opt out of this sharing of your personal information in these circumstances, please click on the cookie management/settings tool (sometimes visible as a “Cookie Settings” link) on the footer of a Site to set your cookie preferences. You, or your authorized agent, may also contact us in accordance with the “Contact Us” section listed below.

Right to opt-out of automated decision-making technology (“ADMT”). In certain circumstances, California residents have the right to opt out of the use of ADMT to make significant decisions where a human reviewer is not involved in the decision.

Children. A Site is not directed at, and should not be used by, minors under the age of eighteen (18), and therefore the Company does not knowingly sell or share the personal information of minors under eighteen (18) years of age.

Limit Use of Sensitive Personal Information. The Company does not use or disclose sensitive personal information for reasons other than those set forth in the CCPA, and therefore we do not provide individuals with the ability to limit how we use or disclose such sensitive personal information.

31. U.S. State Privacy Rights (General)

Data Privacy Rights. Pursuant to certain U.S. state privacy laws, you may have the following privacy rights with respect to your personal information:

• To confirm whether we are processing your personal information and accessing such personal information.
• To correct inaccuracies in your personal information, considering the nature of the personal information and the purposes of the processing of your personal information.
• To delete personal information provided by, or obtained about, you.
• To obtain a copy of your personal information processed by us, in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance.
• To obtain a list of the categories of third parties to which we have disclosed your personal data.

Submit a Privacy Request. To submit a privacy request, you may contact us using any of the following means: (email) dataprotection@rpminc.com, (webform) https://rpminc.com/contact/, (telephone) 1 (800) 776-4488, or (mail) RPM International Inc., ATTN: Privacy Request, 2628 Pearl Road, Medina, OH 44256. Where permitted by U.S. state law, you may designate an authorized agent to submit a privacy request on your behalf.

Privacy Request Verification Process. If you make any request related to your personal information, the Company will ascertain your identity (and the identity of the authorized agent, to the extent applicable) to the degree of certainty required or permitted under the law before addressing your request. In particular, before granting you access to, erasing, or correcting, specific pieces or categories of personal information or otherwise responding to your request, the Company will, to the extent required or permitted by law, (i) require you (or your authorized agent) to verify your request via email, (ii) request certain contact information or government identifiers, and (iii) match at least two pieces of such personal information with data that we have previously collected from you. None of your privacy rights are absolute, and such rights are subject to exceptions and exemptions.

Privacy Requests Appeals Process. If you would like to appeal a decision the Company has made with respect to your privacy request, please email us in accordance with the “Contact Us” section listed below, with the subject line “ATTN: Privacy Appeals,” and describe the nature of your request, and the reason for requesting an appellate review.

Opt-Out Rights / The Sale of Personal Information. You may have the right to opt out of the “sale” of their personal information. However, the Company does not sell your personal information to third parties for monetary consideration or other valuable consideration, and therefore we do not provide opt-out request processes for the sale of personal information (because we do not undertake such activities). Nevada residents may submit a request directing us to not sell personal information we maintain about them to third parties who will sell or license their personal information to others. If you would like to exercise this right (even though we do not sell or license personal information), please contact us in accordance with the “Contact Us” section listed below.

Opt-Out Rights / Targeted Advertising. You may have the right to opt out of having your personal information used for targeted advertising purposes. The Company uses third-party analytical and targeted advertising features on our Site and similar web tools provided by our marketing partners. To opt out of this sharing of your personal information in these circumstances, please click on the cookie management tool (sometimes visible as a “Cookie Settings” link) on the footer of a Site to set your cookie preferences.

Opt-Out Rights / Profiling. You may have the right to opt out of having their personal information used for profiling in furtherance of decisions that produce legal or similarly significant effects. However, the Company does not engage in such activities

Complaints. You may file a complaint about our data processing activities with your local authorities, which may include the following:

• The Colorado Attorney General
• The Connecticut Attorney General
• The Delaware Attorney General
• The Iowa Attorney General
• The Maryland Attorney General
• The Montana Attorney General
• The Nebraska Attorney General
• The Nevada Attorney General
• The New Hampshire Attorney General
• The New Jersey Division of Consumer Affairs
• The Oregon Attorney General
• The Tennessee Attorney General
• The Texas Attorney General
• The Virginia Attorney General

32. Additional Jurisdictions

If you are a resident of a jurisdiction that affords data privacy rights not specifically described in this Privacy Policy, and such laws apply to the Company’s processing of your personal information, you may have additional rights with respect to your personal information. To exercise any such rights, please contact us in accordance with the "Contact Us" section listed below, and we will process your request in accordance with applicable law.

33. Changes to the Policy

We reserve the right to amend this Privacy Policy at any time. The “Last Updated” date listed above will identify when this Privacy Policy was last amended. It is your responsibility to periodically review the Privacy Policy to determine whether any amendments have been made since your last interaction. Your use of the Services and continued use of the Services after any amendments are made to this Privacy Policy signifies your acknowledgment of the amended Privacy Policy and, to the extent permitted by applicable law, your acceptance of those amendments. Where applicable law requires your affirmative consent to an amendment or to any related processing activity, including the use of certain cookies or other tracking technologies, that amendment or processing will apply only after that consent has been obtained. We may, in our sole discretion, provide you communications, including via email or text messages, about changes to our Privacy Policy; however, such communications do not abrogate or otherwise limit your responsibility to periodically review the Privacy Policy to determine whether any amendments have been made.

34. Contact Us

If you have any questions or concerns about this Privacy Policy, or would like to submit a privacy request, contact us using any of the following means: (email) dataprotection@rpminc.com, (webform) https://rpminc.com/contact/, (telephone) 1 (800) 776-4488, or (mail) RPM International Inc., ATTN: Privacy Request, 2628 Pearl Road, Medina, OH 44256. If you are unsure which Company entity is responsible for your personal information in connection with a particular Site or Service, contact us and we will direct your request to the appropriate entity.