FERGUSON PRIVACY & SECURITY POLICIES

Ferguson, on its own or through authorized service providers, contractors and third parties, may collect and use the following categories of personal information:

• Individual identifiers and information – such as information that You provide for the purpose of registering with the Website or creating an account (e.g., Your real name, email, address, telephone number, other contact information, username and password, mobile phone number);

• Commercial information – such as information You provide in connection with ordering or purchase transactions when You place an order online or through an authorized sales representative, and activities on the Website, including search history and other information (e.g., items added to Your cart, online purchases, online product reviews, product preferences or specific interests, items not purchased, and any promotional information related to the session);

• Transaction information – such as information associated with transactions, including method of payment, credit/debit card or bank account information, and shipping information for order fulfillment;

• Computer, internet and network activity information – such as information We obtain from Your use of the Website (e.g., Your server log information, queries or searches, browsing history, internet protocol address, unique device identifiers, and mobile network information);

• Other electronic information – such as information from communications with Us and other user-generated content submitted by You to Us through e-mail, chat, telephone, and social media channels; and

• Marketing and promotional information – such as information You provide for the purpose of enrolling or participating in any programs, promotions or contests offered by Ferguson.

Ferguson and its authorized service providers, contractors and third parties obtain these categories of personal information from the following sources:

• Directly from You. For example, the information You provide directly to Us or to our authorized service providers and contractors (e.g., payment processors, shipping services, etc.);

• Indirectly from You. For example, the information from devices you use to access the Website; or information that is automatically collected about You by Us and our authorized service providers and third parties as a result of Your use of Our Website, including digital tracking tools such as cookies and similar technology; and

• Information obtained by Third Parties (e.g., LinkedIn, Bing, MNTN (Steelhouse), Facebook, and Google). For example, information obtained as a result of the use of Our Website and other websites.

Ferguson, on its own or through authorized service providers and third parties, may use Your personal information that You provide to Us or that is collected about You for various business or commercial purposes, including to:

• administer the Website and present the Website and its contents to You, as well as to facilitate and improve Your experience on the Website;

• process Your registration and manage Your online account;

• personalize the Website for You;

• enable Your access to use the Website and its services;

• provide You with products and conduct transactions (including purchases and returns);

• process payments;

• process, fulfill, and ship purchase requests, and complete returns and exchanges;

• send You statements and invoices;

• send You advertising, promotional and marketing communications, including direct mail and direct email, and process promotions, surveys, contests, giveaways, sweepstakes, and related prizes or incentives;

• provide You with product and service recommendations based upon your interests;

• contact You or communicate with You;

• address customer service issues You may have;

• protect against fraud and unauthorized transactions;

• create analytic reports; and

• perform internal systems diagnostics, analysis, monitoring, debugging, and troubleshooting.

In addition, Ferguson may disclose Your personal information to the extent that it is required to do so by law, in connection with any legal proceedings or prospective legal proceedings, and in order to establish, exercise, or defend its legal rights. Ferguson may also disclose Your personal information in connection with negotiations for or any actual sale, acquisition, or transfer all or a portion of Our business or assets.

Please note that if You voluntarily submit any personal information for posting on Our Website or any other website (including without limitation any social media website), the information may become publicly available and can be accessed and used by Us and by others. Therefore, You should use care before posting any personal information online.

We partner with authorized service providers, contractors and third parties as an essential part of Our business operations, which allows Us to make the Website available, offer products and services to You, process and deliver Your orders, and provide information and promotional material about products that may be of interest to You.

Ferguson does not sell or share your personal information in exchange for money.

A. SERVICE PROVIDERS AND CONTRACTORS:

Ferguson employs authorized service providers and contractors to assist with Website operations, online transactions, marketing, and analytics (such as for Website hosting, search engine optimization, customer relationship management, payment card processing services, advertising and marketing services, order fulfillment and delivery services, cloud storage services and other third-party technology services). Ferguson and these authorized service providers and contractors collect personal information and non-personal information, which may be provided to Ferguson or to these authorized service providers and contractors, including Your interests and online purchase behavior, what You have liked and clicked, and whether You have completed or abandoned a purchase. Ferguson may also provide Your personal information to its authorized service providers and contractors to facilitate processing, and fulfilling and delivering Your order.

An authorized service provider or contractor receiving any of Your personal information from Ferguson is required by written contract to use and maintain that personal information only as authorized by Ferguson and in accordance with the terms of this Privacy Policy.

B. THIRD PARTIES:

Ferguson shares Your personal information – (i.e., Individual identifiers and information, Commercial information, Transaction information, Computer, internet and network activity information, and Marketing and promotional information) - with certain authorized third parties that provide interest-based and other targeted advertising or marketing services to Ferguson. These business partners use this information to provide You advertisements that are tailored to Your individual interests, as described in more detail in the section "Interest-Based Advertising And Other Targeted Advertising".

Ferguson, on its own or through authorized service providers, contractors and third parties, may also collect and use other information from and about users of the Website that does not specifically identify the user individually. Without limitation, this may include:

• purchase interests and purchase history information;

• preferences information (including marketing and communication preferences);

• information from Your internet browser whenever You visit or use the Website (sometimes call “Log Data” or “Log Files”);

• device information and usage data;

• internet service provider;

• referring and exiting websites and pages;

• operating system;

• which pages You visit on Our Website; and

• the time and date of Your visit and use of Ferguson’s pages.

We do not collect, nor do We request or require that You provide any sensitive personal information (e.g., social security number, driver’s license number, state identification card, passport number, information related to racial or ethnic origin, political opinions, religious, philosophical, or other beliefs, information related to sex life or sexual orientation, health data, biometric or genetic characteristics, criminal convictions and offenses, trade union membership, or specific geolocation), and You should not send Us and should not disclose to Us any sensitive personal information on or through the Website or otherwise.

At times, We may aggregate certain personal information and/or non-personal information in a manner that does not identify You to determine information about Our customers, including product trends, sales histories, and where Our customers are located.

We may also combine personal information with non-personal information. If We do so, We will treat such combined information as personal information.

Because non-personal information does not identify You individually, We may collect, use, and disclose non-personal information for any lawful purpose in Our sole discretion.

Ferguson may use SMS / TEXT MESSAGING to communicate with you, send order information, and provide promotional materials. MMS (multimedia message service) is used to send messages of product photos to and from the user. You must opt-in and provide a valid mobile phone number to activate this service, and after activating, You can opt-out at any time and discontinue the messaging service.

Ferguson does not charge for its SMS or MMS services. However, Your wireless service provider may apply package deductions and message / data rates to all SMS or MMS messages and rates differ from carrier to carrier. Please contact Your wireless service provider to inquire about the details specific to Your plan. Message frequency will vary by user.

If You need any further assistance, please contact Us at (888) 222-1785 or email customer.support@ferguson.com.

Ferguson, its authorized service providers, and certain authorized third parties use digital tracking tools such as cookies and similar technology when You use the Website (e.g., cookies, web beacons and single-pixel GIF files). Cookies are small files that are transferred to Your device's hard drive through Your internet browser that enables the Website's or authorized service providers’ or third parties' systems to recognize Your browser and capture and remember certain information. This helps Us to improve Your access to Our Website, identify repeat visitors, help ensure the authenticity of registered users, target advertising, provide the mechanism for online shopping, and enable Website traffic monitoring.

We use session-based cookies and persistent cookies. Session-based cookies will last only as long as Your web browser is open, and are deleted when You close Your browser. A persistent cookie will last until it expires or until You delete it. At times, Ferguson administers the use of cookies (called first-party cookies) and tracking technologies, and at times We rely upon authorized service providers and third parties to do so (called third-party cookies). These service providers and third parties may also use cookies, pixels and other identifiers to collect information that indicates how users interact with the Website (e.g., Google Analytics, Localytics, social media sites).

Using cookies helps Us do a number of things to enhance Your experience as a customer or potential customer of Ferguson, including to:

• identify users and visitors to the Website, including new visitors and returning customers;

• remember and process the items in Your shopping cart;

• process and save Your preferences for future visits;

• ensure You do not need to login multiple times through user identification tracking;

• compile analytics, statistics and reports on Our Website and web traffic activity;

• track and target Your interests to enhance Your experience on Our Website, including searches and web traffic adjacent to activity on the Website;

• allow for integration with social media;

• offer products and advertising that may be aligned with Your interests; and

• provide other services related to the Website.

New visitors to the Ferguson Website will receive a pop-up prompt asking if they would like to allow or block push notifications. If You all allow notifications, You have opted-in to promotional notifications. If You block notifications, You are opted out. If the pop-up prompt is closed out within a response, You will receive the prompt at the start of each subsequent session. If You wish to opt-out in the future, You can clear Your cookies to get the allow/block option again.

The Ferguson App also sends push notifications if You have opted-in to receive notifications on Your mobile device.

We collect data about Your activities on Our Website for use in providing tailored advertising to you while using Our Website as well as through e-mails, texts and other direct marketing channels that We utilize. To provide You with a consistent shopping experience, We may also associate various devices You utilize (e.g., smartphones, tablets, and desktop computers) by using the with other information We have about You, Your interaction with Our Website and Your transaction history.

We may share Your personal information about activities on Our Website with advertising networks or cooperatives administered by third parties. These ad networks use this information to provide You advertisements that are tailored to Your individual interests. You can opt-out of Us sharing Your personal information with these networks and cooperatives by completing an opt-out request available through "Do Not Sell or Share My Personal Information".

We also have partnered with certain third parties, including social media platforms, that use their own digital tracking tools, such as cookies and pixels, to track Your online activities over time and across Our Website and other websites by collecting information through automated means. These third parties will provide You with ads based upon your interests, activities, and preferences. As a result, You may see certain ads for Ferguson on other websites based on prior activities on Our Website. You may be able to disable these digital tracking tools by changing the settings for cookies on the browser for each device You use to access the Website. In addition, You may be able to opt-out of their digital tracking tools by changing Your preferences on each social media platform.

These third parties may allow consumers to opt-out of receiving advertisements through the Digital Advertising Alliance - https://youradchoices.com/control - or the Network Advertising Initiative - https://optout.networkadvertising.org/?c=1.

If You receive promotional materials or newsletters from Us, You may unsubscribe from these communications at any time by following the instructions contained in the emails You receive. You may also change Your subscription status at any time by logging into Your account and editing Your information, or by contacting Us at customer.support@ferguson.com, or using the information provided below in the "Contacting Us" section. Even if You opt-out of receiving direct marketing messages, We may still contact You about a purchase or order or in connection with other customer service activities.

In addition, We may send You direct mail or catalogs containing offers for You. If You wish to stop receiving catalogs or direct mail, You may contact Us using the information provided below or send an email to customer.support@ferguson.com. Additionally, You can use the form that is provided on the back of every catalog.

Some browsers have a “Do Not Track” feature that lets You tell websites that You do not want to have Your online activities tracked. There is currently no uniform browser signal for this feature and no industry standard on how to respond to these signals. Therefore enabling/disabling the Do Not Track feature in Your browser does not ensure that all websites You visit will respond to the request.

Ferguson does not recognize or respond to Do Not Track signals at this time. Ferguson will reassess its approach to responding to Do Not Track signals once an industry standard is established.

If You are a resident of California, You have the following rights:

• Right to Correct: You have the right to request that We correct inaccuracies in your personal information.

• Right to Delete: You have the right to request that We delete personal information that We have collected from or obtained about You (subject to certain exceptions).

• Right to Know: You have the right to request that We disclose to You what personal information We collect about You, including the right to request that we provide You the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, the categories of third parties to whom We disclose personal information, and the specific pieces of personal information We have collected about You (typically for the 12-month period preceding Your request).

• Right to Know About Sale or Sharing: You have the right to request that We disclose to You what personal information We sell or share with third parties, including the right to request that We provide to You the categories of personal information We have collected, the categories of personal information about You which we sold or shared to third parties, the categories of third parties with whom We sold or shared such personal information and the categories of personal information We disclosed about You for a business purpose (typically for the 12-month period preceding Your request);

• Right to Opt-out of Sale of Personal Information: You may request that We stop sharing data in a way that is considered a “sale.”

• Right to Opt-out of Sharing of Personal Information: You may request that We stop disclosures of your personal information to a third party for cross-context behavioral advertising (i.e., targeted advertising)

• Right to Non-Discrimination: You have the right not to be discriminated against because You exercised any of these rights.

To exercise any of these rights (other than non-discrimination), please complete and submit the Data Subject Access Request (DSAR) Form or call (833) 865-0355.

You may also designate an authorized agent to complete a DSAR Form on Your behalf. If You use an authorized agent to submit a request. We will not act on that request unless We are able to authenticate, with commercially reasonable effort, both your identity and the authorized agent’s authority to act on your behalf.

You are first asked to select a request type. The DSAR Form requires You to complete several mandatory fields. If You select a Delete or Access request, You will be asked for an “Order #”, which enables Us to verify Your identity and protect against fraudulent access to Your personal information. If you have not placed an order, we will attempt to identify you in our systems without an order number.

Once You submit a completed DSAR form, You are sent an email that requires clicking on a link to verify the email address. This two-factor validation helps protect against fraudulent submissions. Please note that a DSAR Form is not processed until You have authenticated Your request by verifying the email address submitted on the DSAR form.

There may be certain circumstances when We may not completely fulfill Your request, as permitted under the applicable California statute and regulations. For example, in connection with a Request to Delete, We may need to retain certain information to complete a transaction, detect fraud, or comply with a legal obligation.

With limited exceptions, You may only make a verifiable consumer Request to Know your personal information twice within a 12-month period.

If you would like to opt-out of the sale or sharing of Your personal information by Ferguson with third parties, You can click on the link entitled Do Not Sell or Share My Personal Information. The processed opt-out preference will be implemented by Ferguson for the specific consumer account You have identified in the DSAR request.

As a resident of Colorado, Connecticut, Montana, Oregon, Texas, Utah, or Virginia, You may have one or more of the following rights:

• Right to Confirm and Access: You have the right to confirm whether We are processing Your personal information and request access to Your personal information.

• Right to Correct: You have the right to request that We correct inaccuracies in your personal information.

• Right to Delete: You have the right to request that We delete personal information that We have collected from or obtained about You (subject to certain exceptions).

• Right to Obtain a Copy. You have the right to and obtain a copy of any personal information in digital format We may hold about You. If You are an Oregon resident, You also have the right to a list of third parties with whom We share personal data.

• Right to Opt-out of Sale of Personal Data: You may request that We stop sharing data in a way that is considered a “sale.”

• Right to Opt-out of Targeted Advertising: You may request that We stop disclosures of your personal information for targeted advertising.

• Right to Opt-out of Profiling: You have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. We do not profile in a manner that would result in legal or similarly significant effects and as such do not offer this right.

• Right to Appeal: If You are unsatisfied with our actions related to exercising one of your privacy rights above, You may appeal our decision.

• Right to Non-Discrimination: You have the right not to be discriminated against because You exercised any of these rights.

To exercise any of these rights (other than non-discrimination), please complete and submit the Data Subject Access Request (DSAR) Form or call (833) 865-0355.

If You are a Colorado, Connecticut, Montana, Oregon, or Texas resident, You may also designate an authorized agent to complete a DSAR Form on Your behalf for the Right to Opt-Out of our processing of personal information for the purposes of targeted advertising or sales. If You use an authorized agent to submit a request, We will not act on that request unless We are able to authenticate, with commercially reasonable effort, both your identity and the authorized agent’s authority to act on your behalf.

You are first asked to select a request type. The DSAR Form requires You to complete several mandatory fields. If You select a Delete or Access request, You will be asked for an “Order #”, which enables Us to verify Your identity and protect against fraudulent access to Your personal information. If you have not placed an order, we will attempt to identify you in our systems without an order number.

Once You submit a completed DSAR form, the consumer is sent an email that requires clicking on a link to verify the email address. This two-factor validation helps protect against fraudulent submissions. Please note that a DSAR Form is not processed until You have authenticated Your request by verifying the email address submitted on the DSAR form.

There may be certain circumstances when We may not completely fulfill Your request, as permitted under the applicable statute or regulation. For example, in connection with a Request to Delete, We may need to retain certain information to complete a transaction, detect fraud, or comply with a legal obligation.

Right to Appeal (CO, CT, MT, OR, TX, VA Residents) – If, for any reason, You would like to appeal our decision relating to your request and You are a resident of Colorado, Connecticut, Montana, Oregon, Texas or Virginia, You have the right to submit an appeal by visiting our Privacy Center and submitting the Data Subject Access Request (DSAR) Form. Please include the original Request ID, the basis for your appeal, and any additional information to consider.

The Website contains links to other sites (including social media sites) that are not owned or controlled by Ferguson. Ferguson is not responsible for the content, actions, privacy policies or information privacy and security practices of any other sites and encourages You to review the privacy policies of those sites. Ferguson is not responsible for the content of linked sites, Your use of any linked sites, or any information (including Your personal information) collected, posted, used, or displayed by operators of any linked sites. In addition, Ferguson is not responsible for any third party, or their affiliates or agents, failure to use Your personal information in accordance with such third party's privacy policy, or any contractual or other legal obligations to which such third party, their affiliates, or agents, may be subject.

We do not knowingly collect or store any personal information from children under the age of 18, and We request that minors do not provide any personal information to Us through the Website. If a parent or guardian becomes aware that his or her child under 18 has provided Us with information without his or her consent, he or she should contact Us as set forth in the “Contacting Us” section below.

The Website is hosted in the United States and is intended for use only by individuals in the United States who are 18 years or older. Purchases on this Website are shipped in the United States and, as a result, the information Ferguson collects is governed by applicable laws of the United States. If You are visiting the Website from outside the United States, Your information may be transferred to, stored and processed in the United States or other countries.

The data protection and other applicable laws of the Unites States may not be as comprehensive as those laws or regulations in other countries or may otherwise differ from the data protection or consumer protection laws in other countries.

By using the Website and/or providing personal information to Ferguson, You consent to transfer and use of Your personal information by Ferguson as set forth and described in this Privacy Policy and Our Terms of Use.

The security of your personal information is very important to Us. We follow generally accepted industry standards to protect the personal information submitted to Us, and that We collect, both during transmission and once We receive it. However, no method of transmission over the Internet, or method of electronic storage, is 100% secure. Therefore, while We strive to use commercially acceptable means to protect your personal information, We cannot guarantee the absolute security of the personal information provided by You or collected by Us through use of the Site.

We store all categories of the personal information that We collect – (i.e., Individual identifiers and information, Commercial information, Transaction information, Computer, internet and network activity information, and Marketing and promotional information) - for as long as you have an account with Us or the period of time necessary for the purpose for which it was collected, or as required by or permitted by applicable law.

To determine the appropriate duration of the retention of personal information, We consider a variety of factors, including the following:

• The amount, nature, and sensitivity of the personal information;

• The potential risks of harm to consumers;

• Our recordkeeping and legal compliance requirements;

• The need to protect the rights or safety of You, Us or others, including the resolution of inquiries or complaints;

• The need to exercise or defend legal claims; and

• The need to prevent fraud, protect assets and promote data security.

Once retention of the personal information is no longer necessary for the purposes outlined above, We will either delete or deidentify the personal information or, if this is not possible (for example, because personal information has been stored in backup archives), then We will store and protect the personal information until deletion or deidentification is possible.

We may update Our privacy policy from time to time and use of the information We collect now is subject to the privacy policy in effect at the time of use. The "LAST UPDATED" legend at the top of this Privacy Policy indicates when this Privacy Policy was last revised, and We encourage You to check our Privacy Policy periodically. Any changes will become effective when We post the revised Privacy Policy on Our Website. Your use of the Website, and/or your purchase of a product or service following these changes means that You accept the revised Privacy Policy.

If You have any questions about this Privacy Policy, or would like more information, You may contact us by toll free number (833) 865-0355

To exercise any rights in Your personal information, please complete and submit the Subject Access Request (DSAR) Form, or call Us at (833) 865-0355.