RESPONSIBLE DATA CONTROLLER

This Website is operated by Olin. Olin is responsible for the processing of your Data. We have appointed a global Data Protection Officer whose contact details you will find at the end of this Policy. Olin has designated Blue Cube Germany Assets GmbH & Co. KG, Werk Stade, Bützflether Sand 2, D-21683 Stade, Germany, as their EU representative with regard to their respective obligations under the General Data Protection Regulation (Regulation 2016/679) (“GDPR”) with effect from May 25, 2018.

CATEGORIES OF DATA PROCESSED

Olin processes the following categories of Data:

Log data

We collect log data through automatic means, such as your IP address, details concerning the access to our Website, such as date and time, status and data volume transferred, products you viewed or searched for, information on your browser (type of browser and version number) and other technical device information, and details of the Website that you used to access our Website. Olin saves this data in a log file every time a page is viewed. Olin is unable to assign this data to individual, identifiable persons without additional information, such as information from an Internet provider on the subscriber, which Olin regularly does not have access to without a concrete reason, such as, for example, in the case of suspicions of a legal infringement.

Cookies

We use cookies in order to broaden the Website’ range of functions and make it more convenient to use. These are small text files, which are stored on your computer. Most of the cookies that are used by Olin are deleted from your hard drive at the end of your browser session (session cookies). In addition, Olin uses so-called permanent cookies, which remain on your device in order to recognize you the next time you visit the Website. Permanent cookies are also used to award you “points” based on the content you view to help personalize the content you see and avoid displaying repetitive content on the Website. You can prevent cookies from being stored on your device by changing the settings accordingly in your browser or by deleting cookies, but doing so may interfere with your ability to use the Website and may result in seeing content that is less relevant to you. At this time, we do not honor “do not track” signals from website browsers.

Contact form data

If you are contacting Olin through a contact form Olin processes the Data as shown in the contact menu provided on our Website – in particular email address and your request, as well as first name, last name, salutation and telephone number, or any other data that you choose to submit to Olin.

Content You Submit

If you choose to submit content, such as a photograph or review, we will process and may publicly post the content you provide.

Customer Support

In order to handle your customer support request we collect your first name, last name, postal address, telephone number, email address, age group and questions or comments that you submit.

Product Support

If you submit a product support request, we will ask you to provide us your first name, last name, telephone number, email address, postal address, and your age group.

Newsletter

If you register for our newsletter we will collect your name, email address, IP address, and time of registration for the newsletter. The newsletter may contain marketing materials regarding our products and services or third party products and services that may be of interest to you. We will use your email address to send you the newsletter. You may revoke your consent to receive our newsletter at any time with future effect by clicking on the link provided in each newsletter email or sending a message to newsletter@winchester.com.

Social Media

Our Websites’ web pages may embed plugs-ins, widgets or other apps of various external social media platforms. When you encounter those embedded objects, your internet browser may make a direct connection to the social media platform’s service and may share with the social media platforms information such as which of our Websites you have visited, information about your public profile, or content you have posted.

Rebates

For users in the United States, if you request a rebate, we will collect your name and zip code to calculate the rebate. In order to request a rebate, you need to save the form that you can download from the Website to your computer, print it out and send it via postal service to the address displayed. When you “save and print” your Data in the rebate form, we will store and process your Data at that time, but will not process your rebate until you submit and we receive the rebate request form through the mail. Please note that the rebate offer is handled by Repco Logistics, 8405 St. Charles Rock Road, St. Louis, MO 63114, USA. To check on the status of a rebate, you will need to provide your name, zip code, and email address used to submit the rebate request.

Geo-location data

If you visit the section of our Website that includes mapping or location functionality, including Website features that provide directions to a location where our products are available, we will collect your precise geo-location information (using technologies such as HTML5 Geolocation API) if you have enabled geo-location data sharing through your browser settings. We may also collect other location data that you manually provide to us through the Website.

Search function

If you use the search function on our Website, the five most recent searches are tracked in your browser’s local storage across the sessions.

PURPOSE OF PROCESSING

Olin collects your Data in order to enable you to use the Website, to answer your contact requests, provide services you have requested, or enable the use of the features and services describe above. If you have opted-in to receive regular updates on the status of your product support request, Olin will use your email address to send you such updates.

You have the option to refrain from affirmatively providing certain Data (such as contact form Data, rebate information, etc.) or you may provide Olin with incomplete information. However, you may not be able to use the Website in such case at all or to the fullest extent that the Website permits. Olin will not use your Data for automated decision-making. We do not create any personalized profiles for direct marketing purposes. The analysis of your user behavior through our cookies takes place after shortening your IP address so that the assignment to a specific person is no longer possible.

Google Analytics

Our Website uses Google Analytics, a web analyzing service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA („Google“). Google Analytics uses cookies. Information generated concerning your usage of the Website (including your IP address) is transmitted to a Google server in the USA and are saved there. You may read about how Google uses your Data here: https://www.google.com/intl/de/policies/privacy/partners/. You can prevent Google Analytics cookies from being stored on your device through your browser software settings. You may object to the processing of your Data at any time with effect for the future.

LEGAL BASIS FOR PROCESSING

Olin is entitled to process your Data as set out above because you are visiting our Website. If you subscribe to any service for which Olin is asking you to provide consent, the legal basis of processing your Data will be your consent. You may revoke your consent at any time with effect for the future by sending an email to the contact information. We may process your personal data to comply with a legal obligation.

If you have subscribed to a newsletter or a service, Olin may send you additional information about similar services or products. You may object to the sending of this additional information at any time with effect for the future. Please send an email in this regard to the contact information at the end of this Policy, or contact us using the contact methods provided in any such communication.

RECIPIENTS

We may share your Data with the following entities:

Olin Employees and Other Olin Companies

Olin will grant access to your Data to those employees who are responsible for technical administration, maintenance and the further development of the Website, the provision of the services you may have subscribed for, and other purposes described above. Olin may also provide some of the services through contractual arrangements with other Olin companies (i.e., intra-group) who process Data on our behalf.

Third Party Service Providers

In addition, Olin engages external IT service companies to maintain its IT systems, and other service providers who assist Olin to operate the website, to help with Olin’s business functions, or to provide the services you have requested. For example, Olin uses third party service providers to help distribute its email newsletters, to manage email marketing subscriber lists and send emails to subscribers, and to fulfill rebate requests. These third party service providers may be able to access your Data when performing their services. Olin will contractually obligate these recipients to confidentiality, to safeguard your Data from disclosure, and to utilize an adequate level of data protection. For example, if legally required, Olin will require such third parties to sign the EU or Swiss Model Clauses; you may request a copy of the Clauses by contacting us.

With Your Consent

Olin may also transfer your Data to third parties, including for marketing purposes. Where applicable law requires, we will obtain your consent for such transfers. For example, when you fill out a rebate form, you have the option to consent to receive unrelated marketing and other communications from Olin and other affiliated and non-affiliated third parties. If you provide such consent, you may receive additional marketing and other communications from Olin and the other affiliated and non-affiliated third parties. You may revoke your consent at any time by clicking on the link provided in each marketing email or by sending an email to dpo@olin.com. Where applicable law requires, we will not share your Data with third parties for the third parties’ direct marketing purposes without your consent.

Public Postings

When you voluntarily disclose your Data in any public areas on this Website (such as by uploading a photograph or review), that Data, along with any information disclosed in your communication, can be collected and used by third parties and may result in unsolicited messages from third parties. Such activities are beyond our control. If you do not want your comments or photographs to be viewed by third parties, you are advised not to make any public submissions.

Legal Purposes

To the extent permitted by applicable local law, we share your Data with government authorities or courts in order to comply with any legal obligation, or to protect the rights, property or safety of Olin, our customers, or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction.

Corporate Change

Finally, to the extent permitted by applicable local law, Olin may transfer your Data to a third party as part of a merger, acquisition, bankruptcy, transfer, sale, corporate change, or any other transaction involving all or a portion of Olin’s assets or in connection with the purchase or some or all of another company.

RETENTION

We will retain your Data for the statutory retention periods. Your log data will be deleted within seven days after your use of the Website. Permanent cookies will be kept for six months; Permanent cookies used for website customization will be stored indefinitely; cookies to calculate rebates will be kept as long as they are required for calculation; and newsletter data will be retained for the time you have subscribed to our newsletter and six months after you have revoked your consent. We will follow these retention periods unless otherwise required by law.

SECURITY

We maintain reasonable administrative, technical and physical safeguards to protect your Data against loss, misuse, unauthorized access, disclosure, alteration or destruction.

THIRD PARTY LINKS

Our Website may, from time to time, contain links to and from the Website of our partner networks, third party organizations and affiliates (including our “careers” website, which is hosted by a third party). If you follow a link to any of these websites, please note that they have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.

Social Plugins

We currently use social media plugins on our Website. These social media plugins collect information about your visit to the Website and your use of the social platform services (for example, buttons or likes) on the Website. The server of the social media platform operator receives a message about which specific web page of our Website you are visiting. If you click on a button of a social media platform while you are logged in to your account with the social media website, the operator collects information about the URL recommended or visited by you, your IP address, and other browser-related information via your social media profile. Your profile saves your recommendation or any other action you took, such as a re-tweet, and makes it publicly available. We have no influence on the amount of data that the social media platforms collect through the social plugin.

We may be using the following social media plugins:

Facebook

www.facebook.com which is operated by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA (“Facebook”). The plugins are identified by one of the Facebook logos (white “f” on blue tile or a “thumbs-up” sign).

Google Plus

Google Plus which is operated by Google Inc. 1600 Amphitheatre Parkway Mountain View, California 94043, USA (“Google”). The button is identifiable by the “+1” symbol on a white and colored background. For the Google privacy policy about “+1” buttons as well as additional information about collection, disclosure, and use of data by Google, see https://www.google.com/intl/de/+/policy/+1button.html.

Twitter

Twitter which is operated by Twitter Inc., 795 Folsom Street, Suite 600, San Francisco, CA 94107, USA. For the Twitter data protection disclaimer, see: https://twitter.com/privacy.

YouTube

You Tube which is operated by YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. For the YouTube privacy policy please see https://www.google.de/intl/de/policies/privacy/

YOUR EEA RIGHTS

In the case that the GDPR applies to you because you are located in the EU and you are using the Website in relation to the offering of goods or services, you have the following rights. These rights can be exercised by contacting us by using the contact information at the end of this Policy:

• Obtain information on your Data in order to check and verify such Data,
• Receive a copy of your Data,
• Correction, deletion or restriction of the processing, which also includes the right to have incomplete or incorrect Data rectified by supplementary information,
• Right to object to the processing,
• You may receive your provided Data in a structured, common and machine-readable format and transfer this Data to another controller as long as you have consented to the processing or the processing is based on a contract.

CHANGES TO THE POLICY

Any changes we make to the Policy in the future will be posted on this page. We encourage you to visit this area frequently to stay informed, as your continued use of our Website and interaction with us following the posting of changes to this Policy means that you consent to such changes. If you have signed up to a service that is provided through the Website, you may be notified by email of any changes to the Policy where applicable law requires.

Contact: Olin Data Protection Officer, Megan Rosenberg, dpo@olin.com or +1.314.355.8285

Effective Date: August 16, 2018 Last Updated: August 16, 2018

YOUR CALIFORNIA PRIVACY RIGHTS

We primarily provide our services to business customers and generally only collect Data of the employees of those business customers. In limited circumstances when an individual consumer who is a California resident interacts with us directly, such as through our Website, this section applies. If you are a California resident, this section applies. Pursuant to the California Consumer Privacy Act of 2018, below is a summary of the Data we collect from and about consumers, the online and offline sources from which we collect the Data, the business or commercial purpose for which the Data is collected and the categories of third parties with whom we share consumer Data.

The terms in the chart below have the following meanings:

• Auditing. Auditing related to a current interaction with the consumer and concurrent transactions, including, but not limited to, counting and impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
• Security. Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.
• Debugging. Debugging to identify and repair errors that impair existing intended functionality.
• Performing Services. Performing services on behalf of the business or service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider.
• Internal Research. Undertaking internal research for technological development and demonstration.
• Quality Assurance. Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.
• Legal. As necessary to comply with legal and regulatory requirements such as to ensure the safety of our property, employees, and users, and to protect our rights including investigating and responding to claims against us, our customer, or employees.
• Marketing. For market research and for commercial sales and other marketing activities including but not limited to sending you information about our products and services, promotions, or events.

We disclosed all of the categories of Data listed above for a business purpose in the past 12 months.

Your Rights

As a California resident you have certain rights, subject to legal limitations and applicable exceptions, regarding the collection, use, and sharing of your Data. California residents may exercise the following rights via our website at https://www.olin.com/privacy/ccpa/, by emailing us at dpo@olin.com, or by calling 1-800-356-2666.

• Right to Know. You have the right to request information about the categories of Data we have collected about you, the categories of sources from which we collected the Data, the purposes for collecting the Data, the categories of third parties with whom we have shared your Data, and the purpose for which we shared your Data (“Categories Report”). You may also request information about the specific pieces of Data we have collected about you (“Specific Pieces Report”).
• Right to Delete. You have the right to request that we delete Data that we have collected from you.
• Right to Opt Out. We do not sell Data to third parties.

In accordance with applicable law, we will not discriminate against you for exercising these rights.

Verification: In order to exercise your rights, we will need to obtain information to locate you in our records or verify your identity depending on the nature of the request. If you are submitting a request on behalf of a household, we will need to verify each member of the household in the manner set forth in this section. For Specific Pieces Report, we will request your name, email address, phone number or physical address to verify your identity, along with a signed declaration, under penalty of perjury, that you are who you say you are. For a Categories Report, we will request your name, email address, phone number or physical address to verify your identity. For a Right to Delete request, we will request your name, email address, phone number or physical address to verify your identity.

Authorized Agents: You may use an authorized agent to exercise your rights on your behalf. If you are making any of the requests above through an authorized agent, we will request written authorization from you and will seek to verify as described above or we will accept a legal Power of Attorney under the California Probate Code to the authorized agent. To make a request using an authorized agent use the webform at https://www.olin.com/privacy/ccpa/ and upload documentation demonstrating you have authorized the agent to exercise rights on your behalf.

Timing: We will respond to Requests to Delete and Requests to Know within 45 days, unless we need more time in which case we will notify you and may take up to 90 days total to respond to your request.

Olin Corporation Biometric Privacy Notice