91����

At 91����, our approach to privacy and data protection begins with our values: we are committed to doing the right things, in the right ways, for the right reasons, all of the time. 91���� and its affiliates (collectively, “91����,” “we,” “us,” “our”) are responsible for this website, including its mobile versions and designated mobile applications, and we are committed to respecting your privacy.

An ethical approach. 91���� respects individuals’ privacy and values the confidence of its employees, customers, vendors, and others with whom we do business. 91���� strives to collect, use, disclose, and otherwise process personal data in a manner consistent with the laws of the countries in which we do business, and we pride ourselves on upholding the highest ethical standards in our business practices. 91���� have implemented technical and organizational measures to protect any information we may collect.

This Privacy Notice (the “Notice”) describes how we handle personal data we collect and use while you are accessing our website at www.internationalpaper.com (our “91����bsite”), any other website we own or operate or mobile applications that reference this Notice unless we have implemented a separate privacy notice for a particular site or mobile application. This Notice does not apply to the websites or applications of third parties that have their own privacy policies.

When we collect your personal information. 91���� collect your personal information when you:

• Browse and interact with the InternationalPaper.com website
• Use the “91����” form
• Sign up for email alerts
• Attend a hosted event
• Provide information for making a purchase, reporting a problem or participating in online surveys
• Apply for employment

How we use your personal information. 91���� may need your personal data to fulfill a contractual relationship with you, comply with legal obligations or pursue a legitimate interest – for example, to:

• Respond to inquiries and fulfill your requests, such when you ask us to send you product informatiom
• Allow you to apply for employment
• Verify your identity
• Provide investor services
• Communicate with you about products, services, and events related to 91����
• Review and evaluate your use of (or your decision not to use) our products and services in order to develop and improve the quality of our offering and strengthen our relationship with you, along with our other existing and potential customers
• Communicate with our business partners
• Send you marketing information
• Send you administrative information regarding changes to our terms, conditions and policies
• Achieve certain business purposes, such as data analysis, audits, new product development, usage trend identification, and determining the effectiveness of our promotional campaigns
• Personalize this site and track its performance
• Prevent and detect fraud
• Comply with applicable laws, regulations, export controls, customer requirements or codes of practice
• Fulfill business partner compliance screening obligations to prevent money-laundering and corruption-related crimes
• Support the sale or transfer of all or a portion of our business or assets

Except where we need it to support a contract with you or fulfill a legal obligation, we will only use your personal information for legitimate interests as set forth above.

When you apply for a job, we process your personal data as set forth in the “Careers” section of our 91����bsite. If you apply for a job through the Careers section of the 91����bsite, 91���� will use your personal data as set forth in the “Applicant Data Privacy Notice.”

On your first visit to this site, a notification banner asked you to accept our use of cookies and similar technologies. If you reject or block cookies whilst using our systems, online portal or web pages,this could mean that your usage might be severly impaired or even become impracitcal. You may still remove our cookies once you have finished using our sysems using your browser.91���� automatically collect basic technical information from all 91����bsite users – such as your IP address – through our automatic data collection tools, including cookies. Please see our Cookies Policy for more information

Business affiliates. 91���� may share your personal information with our affiliated companies for the purposes set forth in this notice. 91���� may also use selected third parties to provide us with services, including companies that:

• Provide technical support and assistance with the 91����bsite
• Are engaged to market and distribute our products
• Assist with our internal recruitment and may have access to personal data you provide to us

91���� have appropriate processing terms in place between us and the third parties, in order to be in compliance with applicable data protection laws.

Legal purposes. The servers used in the operation of the 91����bsite automatically identify a computer by its IP address. If we, in good faith, determine that you have or are attempting to misuse or harm the 91����bsite, we may investigate and cooperate with appropriate law enforcement agencies to protect our rights or property. Similarly, we may share your personal data as required or permitted by law to comply with a subpoena or similar legal process or government request. 91���� may also share it when we believe in good faith that disclosure is legally required or otherwise necessary to protect our rights and property or the rights, property or safety of others. In such cases, we may share it with advisors, law enforcement agencies, judicial authorities and regulatory authorities.

Acquisitions. 91���� may also transfer your personal data to a third party that acquires all or part of our assets or shares, or that succeeds us in carrying on all or a part of our business, whether by merger, acquisition, reorganisation or otherwise.

91���� 91����bsite may contain links to other sites that 91���� does not control. 91���� make every effort to link only to sites that share our high standards and respect for privacy. 91���� recommend that you read the privacy notices of any other sites you visit as we are not responsible for the content of, or the privacy practices employed by, those sites.

91���� is a global company with locations in many different countries. Consequently, we may transfer your information from one legal entity to another or from one country to another in order to accomplish the purposes listed above. These countries include the United States (which hosts the 91����bsite), member states of the European Union (“EU”), the United Kingdom, Canada and other countries. 91���� will transfer your information in a manner that is consistent with applicable legal requirements and for the purposes stated above.

To accomplish cross-border legal transfers of personal information, 91���� relies on EU Standard Contractual Clauses approved by the European Commission.

91���� will retain personal information as long as needed to comply with our contractual and legal obligations. If there is no legal or contractual requirement for us to retain the information, we will only retain the data for as long as is required for the original purpose for which we collected it and for a reasonable period thereafter, including to deal with any claims or queries in connection with the contract, if any.

You have a choice about whether or not to provide 91���� with your personal information, but if you choose not to do so, 91���� may not be able to perform activities such as considering you for employment or providing information about our products.

Users in Europe. Individuals in Europe have certain data privacy rights that include the right to:

• Request data regarding whether or not their personal data is being processed and, if so, the purpose for the processing
• Request access to their personal data
• Request correction or erasure of their personal data
• Obtain restriction of processing or object to the processing of their personal data, and
• Ask us to provide a copy of their personal data to them or to a third party in a digital format

If you wish to exercise one of the above rights, please send your request via email to My-Privacy@ipaper.com. Individuals in Europe also have the right to raise a privacy concern about the processing of their personal data with their local data protection authority.

Users in California. California residents have certain rights under the California Consumer Privacy Act (“CCPA”). Where the CCPA applies, you have the right to:

• Request access to your personal information that 91���� collects uses or discloses about you
• Request that 91���� delete personal information about you
• Opt out of the use or disclosure of your sensitive information, and
• Non-discriminatory treatment for exercising any of your data protection rights.

In accordance with the disclosure requirements of the CCPA, 91���� does not sell or share your personal information in exchange for monetary compensation.

91���� takes reasonable and appropriate precautions to protect personal data in our possession from loss, misuse, unauthorized access, disclosure, alteration and destruction, and to respond to the misuse, loss or unauthorized use of such data. When our 91����bsite provides links to third-party websites, we are not responsible for the security or content of those sites. Be sure to read that company’s privacy and cookie policies before providing your personal information on their site.

You are solely responsible for complying with all local laws, rules, and regulations regarding online conduct and 91����bsite access. If you are located in Europe, personal data collected from you, including via the 91����bsite, will be transferred to recipients in countries located outside Europe (including the United States, where this 91����bsite is hosted), which do not provide a similar or adequate level of protection compared to that provided by European countries. You hereby expressly consent to the transfer of your personal data to recipients, as described in this Notice, that are located outside of Europe. As noted above, we will transfer your data in accordance with legal requirements by entering into EU Standard Contractual Clauses, as necessary.

91���� does not knowingly collect any data from children under 13 years of age through the 91����bsite. 91���� will specifically instruct children under 13 not to submit such information. 91���� do not currently allow children under 13 to register for or participate in contests or promotions on the 91����bsite. However, if the parent or guardian of a child under 13 believes his or her child has provided us with personal data and wants it deleted, that parent or guardian should contact us to remove it from our systems. If 91���� discovers we have personal data about a child under 13 in retrievable form in our files, we will delete it. In addition, anyone under 18 years of age should get the permission of a parent or guardian prior to using or disclosing any personal data on the 91����bsite. Because 91����’s 91����bsite is not directed to users under the age of 16, and in compliance with the disclosure requirements of the CCPA, 91���� does not sell the personal data of any minors under 16 years of age.

Questions or comments about this Notice should be submitted to:

91���� Global Ethics and Compliance Office
6400 Poplar Avenue
Memphis, TN 38197
Email: My-Privacy@ipaper.com

or

Data Privacy Counsel
EMEA Ethics and Compliance Office
Chaussée de la Hulpe 166
1170 Brussels, Belgium
Email: My-Privacy@ipaper.com

91���� evaluate our privacy policies and procedures to implement improvements and refinements from time to time. If we make material changes to this Notice, we will notify you by means of a prominent notice on the 91����bsite prior to the change becoming effective. This Notice is also a part of our Terms and Conditions ("Terms") for the 91����bsite.

This statement was last updated in February 2023.