TJXREALESTATE.COM
VENDOR PRIVACY STATEMENT

Last Updated: September 2025

Introduction
What Information We Collect
How We May Use the Information We Collect
How We Share Your Information
Your Choices and Options Regarding Your Information
California Privacy
How You Can Contact Us Regarding Our Privacy Practices

Introduction

The purpose of this Vendor Privacy Statement ("Privacy Statement" or "Statement") is to inform individuals about how their personal information is collected, used, disclosed or otherwise handled (collectively, "processed" and its variants) by TJX (defined below) if they are engaged in services with TJX. In this Statement, when we say "TJX", "we", "us", or "our", we mean The TJX Companies, Inc. and its affiliates and subsidiaries who may process your personal information for the purposes described below. We use the words "you" and "your" to mean you, the reader who is otherwise an individual providing services to TJX through a contractual relationship TJX has with the individual’s employer and is not an employee or contract employee of TJX ("Vendor").

TJX is committed to protecting the privacy of your personal information and to maintaining the confidentiality of personal information in accordance with applicable laws and regulations, including data protection legislation, and TJX's corporate policies governing information security and data privacy. This Privacy Statement may be updated from time to time to reflect changes in our personal information practices, and we will post a prominent notice on https://www.mytjx.com/mytjx/supplier.html, our "Supplier Site," to notify you of significant changes.

Information We Collect

The categories of personal information that TJX may collect, use, disclose and otherwise handle may vary by applicable law. The categories listed below are not exhaustive and may change depending on day-to-day business or contractual needs, but may include:

Personal contact details such as your name, commercial driver’s license number and vehicle make, model and registration;
Authentication credentials for the access and use of TJX's IT systems and networks, such network user ID, password(s);
Audio, visual and similar information, such as images and video recordings from cameras, closed-circuit television
Personal information collected automatically by use of TJX’s IT systems such as IP addresses; and
Information about your internet/electronic activit such as your IP address, the address of the web page that referred you to our websites, the dates and times of website visits and how much time was spent on certain pages, the location of your device and other related device or electronic activity information.

How We Collect Your Information

We collect information from or about you in a number of different ways including:

Directly from you such as when you verify your identity at our offices, stores, distribution centers and processing centers (collectively, "Properties") or when you provide your information in connection to an investigation into and/or a report of a violation of law or TJX policies or guidelines;
Via technology used on our websites such as cookies and pixels; and
Technology used at our Properties, such as kiosks, CCTV cameras or body worn cameras.

To learn more about what information we collect in our stores and how we collect it, view our TJX In-Store Privacy Notice.

How We May Use the Information

TJX processes your personal information to the extent necessary to engage your services. This includes for:

Supporting and enabling accounting relating to the services provided by you and/or your employer;
Verifying and/or document your identity in certain circumstances (such as when you visit TJX Properties);
Operating, monitoring and managing IT resources;
Operating, managing, evaluating and improving the efficiency of our relationships with vendors (including administering and securing our websites);
Complying with, investigating and enforcing applicable legal requirements, industry standards and our policies, including the Service Provider Guidelines referenced in the TJX Professional Service Agreement;
Complying with requests from government or other public authorities;
Responding to legal process such as subpoenas and court orders;
Pursuing legal rights and remedies;
Defending litigation and managing internal complaints or claims; and
Preventing, detecting and prosecuting criminal activities.

We may use the information in other ways for which we provide specific notice at the time of collection. Your personal information may be processed utilizing both paper and electronic means.

How Long We Retain Your Information

We will store and retain your personal information in accordance with applicable law and as long as necessary to carry out the purposes described in this Statement and in accordance with our internal data retention procedures. The criteria used to determine the retention periods include:

How long the personal information is needed in connection with the applicable purposes for which we use it;
The type of personal information collected; and
Whether we are subject to a legal, contractual or similar obligation to retain the personal information (e.g., mandatory data retention laws, government orders to preserve personal information relevant to an investigation or personal information that must be retained for the purposes of litigation or disputes).

Affiliates

We may share your personal information among TJX companies such as, Marshalls, T.J. Maxx, HomeGoods, Homesense, Sierra, and other affiliates ("TJX Affiliates").

Business Sale/Purchase

Your information may also be transferred as an asset in connection with a merger or sale (including any transfers made as part of a reorganization, dissolution or liquidation) involving all or part of TJX or as part of a stock sale or other change in corporate control.

Third-Party Service Providers

We may also share certain personal information we collect about you with partners or third parties who perform services for us or with whom we contract for the purposes described in this Privacy Statement. For example, we may use third parties to host our websites and maintain the security of our Properties. Such third-party service providers enter into written agreements with us and are given the information that they need to perform their designated functions. We do not authorize them to use or disclose your personal information for their own or any others’ marketing purposes.

Legal Requirements and to Prevent Harm

We also may disclose information about you as is required by law or legal process such as subpoenas or court or agency orders, or as we may reasonably determine to be necessary or appropriate to protect our rights or the rights of others, to avert loss or harm to persons or property, to enforce TJX policies, including the Service Provider Guidelines, or this Privacy Statement, or in connection with an investigation of suspected or actual fraudulent or illegal activity.

External Online Services and Features

For your convenience and information, our websites may provide links to other online services, and may include third-party features such as apps, tools, widgets and plug-ins ("Third-Party Online Services"). These Third-Party Online Services may operate independently from us. The privacy practices of the relevant third parties, including details on the information they may collect about you, is subject to the privacy policies of these parties, which we strongly suggest you review. To the extent any linked Third-Party Online Services are not owned or controlled by TJX, we are not responsible for these third parties’ information practices.

Children’s Privacy

We do not knowingly collect personal information online from children under the age of 13.

How We Protect Your Information

We maintain administrative, technical and physical safeguards designed to protect against loss, misuse or unauthorized access, disclosure, alteration or destruction of your personal information. However, we cannot guarantee the effectiveness of these safeguards, and nothing in this statement shall be construed as an express or implied warranty against loss, misuse or unauthorized access, disclosure, alteration or destruction.

Contact Information

If you have questions regarding this Privacy Statement or our privacy practices, or if you wish to update the personal information you have provided to us, you may do so by contacting us at dataprivacy@tjx.com or by submitting and online request.

Changes to Our Statement

This Privacy Statement may be updated periodically and without prior notice to you to reflect changes in our information practices. We will post a prominent notice on the site to notify you of any significant changes to our Privacy Statement and indicate when it was most recently updated.

NOTICE TO RESIDENTS OF CALIFORNIA

When we collect personal information from residents of California, we become subject to, and those residents have certain rights under, California’s privacy laws including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"). This section of our statement supplements the Vendor Privacy Statement and applies solely to California residents.

Collection and Disclosure

During the prior 12-month period we have:

Collected the following categories of personal information and sensitive personal information about you:
- Identifiers such as real name, unique personal identifier (such as a device identifier; cookies, beacons, pixel tags and similar technology; other forms of persistent or probabilistic identifiers), online identifier, Internet Protocol address and other similar identifiers;
- State identification card or driver’s license number;
- Internet and other electronic network activity information, including, but not limited to, browsing history, search history and information regarding your interaction with websites, applications or advertisements;
- Electronic, visual and similar information; and
- Account log-in in combination with any required security or access code, password or credentials allowing access to an account.
Collected personal information abut you from the following categories of sources:
- From you or your devices, for example, through your interactions with us at our Properties or on our websites;
- TJX Affiliates; and
- Our vendors and consultants.
Collected personal information about you for the following business or commercial purposes (in addition to the purposes listed above in the How We May Use Your Personal Information Section):
- Performing services, including maintaining or servicing accounts;
- Auditing related to a current interaction with you, including, but not limited to, counting unique visitors and auditing compliance;
- Detecting security incidents, protecting against malicious, deceptive, fraudulent or illegal activity and prosecuting those responsible for that activity;
- Debugging to identify and repair errors that impair existing intended functionality;
- Undertaking internal research for technological development and demonstration; and
- Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for or controlled by us, and to improve, upgrade or enhance the service or device that is owned, manufactured, manufactured for or controlled by us.
Sold or shared (as both are defined under the CCPA and other state privacy laws) the following categories of personal information about you:
- Identifiers such as real name, unique personal identifier (such as a device identifier; cookies, beacons, pixel tags and similar technology; other forms of persistent or probabilistic identifiers), online identifier, Internet Protocol address and other similar identifiers;
- State identification card or driver’s license number;
- Internet and other electronic network activity information, including, but not limited to, browsing history, search history and information regarding your interaction with websites, applications or advertisements;
- Electronic, visual and similar information; and
- Account log-in in combination with any required security or access code, password or credentials allowing access to an account.
Sold your personal information to, or shared your personal information with, the following categories of third parties:
- TJX Affiliates;
- Vendors who provide services on our behalf;
- Professional services organizations, such as auditors and law firms; and
- Government entities, including law enforcement.
Business or commercial purposes for selling or sharing your personal information:
- Performing services, such as providing security and information technology services.
Disclosed for a business purpose the following categories of personal information about you:
- Identifiers such as real name, unique personal identifier (such as a device identifier; cookies, beacons, pixel tags and similar technology; other forms of persistent or probabilistic identifiers), online identifier, Internet Protocol address and other similar identifiers;
- State identification card or driver’s license number;
- Internet and other electronic network activity information, including, but not limited to, browsing history, search history and information regarding your interaction with websites, applications or advertisements;
- Electronic, visual and similar information; and
- Account log-in in combination with any required security or access code, password or credentials allowing access to an account.
Disclosed your personal information for a business purpose to the following categories of third parties:
- TJX Affiliates;
- Vendors who provide services on our behalf;
- Professional services organizations, such as auditors and law firms; and
- Government entities, including law enforcement.
Business or commercial purposes for disclosing your personal information:
- Performing services, including maintaining or servicing accounts and security of Properties;
- Auditing related to a current interaction with you, including, but not limited to, counting unique visitors and auditing compliance;
- Debugging to identify and repair errors that impair existing intended functionality;
- Helping to ensure security and integrity of Properties and information technology systems;
- Undertaking internal research for technological development and demonstration; and
- Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for or controlled by us, and to improve, upgrade or enhance the service or device that is owned, manufactured, manufactured for or controlled by us.

We do not sell the personal information of customers under the age of 16 if we have actual knowledge of the individual’s age.

We do not use or disclose sensitive personal information for purposes other than those specified in the California Consumer Privacy Act Regulations § 7027(m).

We will store and retain your personal information in accordance with applicable law and as long as necessary to carry out the purposes described in this statement in accordance with our internal data retention procedures. The criteria used to determine the retention periods include:

How long the personal information is needed in connection with the applicable purposes for which we use it;
The type of personal information collected; and
Whether we are subject to a legal, contractual or similar obligation to retain the personal information (e.g., mandatory data retention laws, government orders to preserve personal information relevant to an investigation or personal information that must be retained for the purposes of litigation or disputes).

Privacy Rights of California Residents

California residents have the below-listed rights with respect to their personal information:

Right to Know about what personal information we collected about you
Right to Delete the personal information we collected about you
Right to Correct inaccurate personal information we maintain about you
Right to Opt Out of the Sale or Sharing of your personal information
Right to Not Receive Discriminatory Treatment

These rights, and how you can exercise them, are described in greater detail below.

You have the right to request the following information about the personal information we have collected about you:

The categories and specific pieces of personal information we have collected about you;
The categories of sources from which we collected the personal information;
The business or commercial purpose for which we collected, sold or shared the personal information;
The categories of third parties with whom we disclosed the personal information; and
The categories of personal information about you that we sold or disclosed for a business purpose and the categories of third parties to whom we sold or disclosed that information for a business purpose.

Additionally, you have the right to request that we delete the personal information we have collected from you, subject to certain exceptions or correct inaccurate personal information that we maintain about you.

We will not deny, charge different prices for or provide a different level or quality of goods or services if you choose to exercise these rights.

As stated above, we do not use or disclose sensitive personal information for purposes other than those specified in the California Consumer Privacy Act Regulations § 7027(l)(1).

You can exercise most of these rights by submitting a verifiable request to dataprivacy@tjx.com, contacting us Monday - Friday 9:00 AM - 6:00 PM (Eastern Time) at the Toll-Free Number 1-508-390-1000 via an online request.

To help protect your privacy and maintain security, we take steps to verify your identity before granting you, or a third party acting on your behalf, access to your personal information or complying with your request. If someone is making a request on your behalf, we require proof of authorization as part of our identity verification process.

Metrics

To view metrics regarding Requests to Know, Requests to Delete, and Requests to Opt Out submitted pursuant to the CCPA that the TJX Businesses received, complied with (in whole or in part), and denied, please visit our TJX Compliance website. These requests as compiled and disclosed are for all individuals, not just California consumers.

TJXREALESTATE.COM VENDOR PRIVACY STATEMENT