Last Updated: May 12, 2025

This privacy notice and policy (“Notice”) explains how we collect, store and use the personal data you provide by email to Clayton, Dubilier & Rice, LLC or one of its affiliates (“CD&R”, “we” or “us”).  CD&R may change this Notice at any time; your email correspondence with us following any such change will signify and constitute your assent to such changes.  This Notice may be supplemented or superseded by other privacy policies or notices, depending on the nature of your relationship and/or interaction with CD&R. 

In this Notice, “personal information” refers to information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to you, and includes “personal data” or similar terms as defined in applicable law.

For the purposes of EU and UK data protection laws, CD&R is the “data controller” of the personal information referred to in this Notice.  Contact details for CD&R are at the end of this Notice.

The personal information we collect

CD&R respects the privacy of third parties with whom we communicate.

If you voluntarily submit information to us by email, the categories of personal information which may be collected or processed by CD&R, or may be collected or processed over the last twelve (12) months, are as follows:

• Identifiers (e.g., names, email addresses, phone numbers)

• Internet or other electronic activity

In addition, we may record and use any other personal information that you provide to us via email correspondence. This information may be used to respond to your request, to correspond with you or for other business purposes.

Sources of personal information

We collect the foregoing categories of personal information from the following sources:

• You, including on forms you complete and copies of documentation you provide via email

• Vendors, including internet service and analytics providers

Use of and legal bases for processing personal information

We use the personal information you provide by email to further our legitimate interest in exercising and complying with our rights and obligations, to further our legitimate interest in administering our business as well as (but not limited to) the following business purposes: (i) to provide you with our services and operate our business; (ii) to communicate with you, including sending you updates and messages about changes to our services, this Notice, and/or other applicable terms and conditions, or in order to respond to your request; (iii) to review the usage of and maintain the operation of our email system; (iv) to conduct analysis and develop and/or improve our services; (v) to monitor, protect and maintain the security and integrity of our email system, our services and our business, such as protecting against and preventing fraud, unauthorized transactions, claims and other liabilities; (vi) to comply with applicable legal and regulatory obligations, and respond to lawful requests and communications from law enforcement and other government officials or bodies; (vii) to protect our rights, privacy, safety, property and/or those of others; and (viii) to fulfill any other purpose for which you provide your personal information or as explained to you at the point of information collection.

How we disclose personal information

We may disclose the personal information you provide by email to further our legitimate interest in exercising and complying with our rights and obligations, to further our legitimate interest in administering our business, as well as (but not limited to), (i) in response to requests by government agencies or law enforcement or where disclosure is required to private parties in connection with a lawsuit, subpoena, investigation or similar proceeding or to comply with CD&R’s other legal and regulatory obligations; (ii) if CD&R or an affiliate believes, in its sole discretion, that such disclosure is appropriate in connection with an official investigation, is requested by tax authorities or in response to a significant threat to a person's health or property or to respond to claims of violations of third party rights; (iii) to a regulatory body, financial market, broker or other intermediaries, counterparties, courts, auditors or other third parties; (iv) to conduct compliance activities, when CD&R thinks this is in its or someone else’s legitimate interests; (v) to enforce contractual rights or to protect the rights of CD&R or its affiliates; (vi) to protect our operations; (vii) to protect our rights, privacy, safety or property and/or those of you or others; (viii) to allow us to pursue available remedies or limit damages that we may sustain; (ix) to a third party in the event of a sale of stock, merger or consolidation or other transfer of all or substantially all of the assets of CD&R, whether voluntarily or by operation of law, to such third party, provided that such third party agrees to protect the confidentiality of your personal information consistent with this Notice; and (x) for other purposes in connection with the operation of our business. 

We may disclose your personal information for other reasons that we will describe at the time of collection or prior to disclosing your information.

We disclose personal information for the foregoing purposes to the following parties, as applicable: (i) Firm partners, principals, officers, members and employees; (ii) CD&R affiliates; (iii) the Firm’s agents, contractors, consultants, advisors and/or service providers; (iv) governmental and quasi-governmental bodies; and (v) any other party designated by you. Any third party that receives non-public personal information about you is permitted to use your information only for the purposes for which we disclose the information to them and as allowed by applicable law or regulation. 

Retention periods

We will retain your personal information for as long as reasonably necessary to provide you with our services that you request or otherwise where permitted or required in accordance with applicable law. We will retain and use your personal information as necessary to comply with our legal obligations, resolve disputes and enforce our agreements. What this means in practice will vary among different types of information, and when we consider our approach, we take into account ongoing business or legal needs for the information, for example in relation to tax, health and safety, and potential or actual disputes or investigations.

Transfers of personal information

Individuals whose personal data is processed subject to the data protection laws of the European Economic Area (“EEA”) and/or United Kingdom are hereby advised: If you email an individual at CD&R who is situated outside the EEA and/or UK, or if you provide personal information to us using the contact details included in the “Questions and Contact Information” section below, you will be transferring your personal information to the United States, a jurisdiction which does not provide a data protection framework equivalent to those of the UK and/or EEA countries. 

Security

We use commercially reasonable administrative, technical, personnel and physical measures to safeguard information in our possession against loss, theft and unauthorized use, disclosure or modification. However, we cannot guarantee the absolute security of our servers or databases or those of our third-party service providers. You disclose personal information to us via email at your own risk.

Your privacy rights and choices

I. United States

Depending on your U.S. state of residence, you may have the right (i) to request that CD&R disclose additional information to you about our collection and use of your personal information, including a copy of your personal information (ii) to request that CD&R correct inaccurate personal information that we may obtain about you, subject to appropriate verification, and (iii) to request that CD&R delete any of your personal information that we collected.  In some circumstances, CD&R may not honor your request for deletion – for example, if we need to retain your information to protect the security or functionality of our operations or to comply with legal or regulatory obligations.

To request a record of the personal information CD&R holds about you, make a request to correct, or to ask CD&R to delete your personal information, please contact us at the contact information provided at the end of this Notice. We may take steps to verify your identity, or the identity of an agent acting on your behalf, before granting you access to your personal information or complying with your request. If you request access to or deletion of your personal information, we may require you to provide any or all of the following information: email address, account credentials or a copy of your identification. Submitting a privacy rights request does not require you to create an account with us. We will not use the information you provide for any purpose beyond verifying your identity.

We will not discriminate against you if you decide to exercise your privacy rights.

If CD&R denies your request for a record of your personal information held by CD&R or denies your request to delete such information, then, depending on your U.S. state of residence, you may have the right to appeal such decision. To appeal a decision, please contact us at the contact information at the end of this Notice.

We aim to provide a substantive response to your request as soon as we can, generally within 45 days from when we receive your request, although we may take longer to process your request under certain circumstances. If we expect your request is going to take us longer than normal to fulfill, we will let you know.

II. Non-U.S.

In some jurisdictions, including under the data protection laws of the EEA and the UK, you have the right, in certain circumstances (i) to require us to delete your personal information; (ii) to withdraw your consent where our basis for collecting your personal information was based on consent; (iii) to require us to restrict processing of your personal information (for example, if you contest the accuracy of that information); (iv) to require us to correct inaccurate personal information we hold about you; (v) to confirm whether we process personal information relating to you; (vi) to receive information about the personal information we process in relation to you and a copy of it in a structured, commonly used and machine-readable format and/or instruct us to transmit that data to a third party; and (vii) to object to our continued processing of your personal information, for direct marketing or other purposes if we rely on the “legitimate interests” basis to process it or are processing it in the public interest.

You may exercise these rights free of charge by contacting us using the details below. 

Individuals whose personal data is processed subject to the data protection laws of the EEA and/or UK have the right to lodge a complaint relating to privacy or data protection with a supervisory authority of the United Kingdom – the Information Commissioner’s Office – or EEA member state where they live or where any alleged infringement of data protection laws occurred.  A list of the EEA supervisory authorities can be found here.

Questions and Contact Information

If you have any questions or concerns about this Notice, the collection or processing of your personal information or wish to exercise any of the aforementioned rights, please contact CD&R’s Chief Compliance Officer at (212) 407-5200 or in writing at:

Clayton, Dubilier & Rice, LLC

550 Madison Avenue

32nd Floor

New York, NY 10022

Attn: Chief Compliance Officer