Privacy & Cookies Statement

Privacy & Cookies Statement

Effective Date: September 3, 2024

This Privacy & Cookies Statement ("Statement") describes how Nutrien Ltd. and its affiliates and subsidiaries (collectively, "Company" or "Nutrien" or “We”) collect, use, share, and otherwise process information about certain identified or identifiable individuals ("Personal Data"). Specifically, this Statement applies to Personal Data that we obtain in connection with the provision of products and services and/or the operation of our business ("Services") about:

• Visitors to our websites, mobile apps, or other online properties ("Sites");
• Our individual customers and prospects;
• Business contacts for our customers, prospects, business partners, distributors, vendors, customer’s guarantors, and suppliers or their representatives.

References to Company or Nutrien indicates that we may share Personal Data between our affiliates and subsidiaries subject to applicable laws.

For the avoidance of doubt, this Statement does not apply to the Company's collection or processing of information related to job applicants, employees, or contractors. Privacy Notices for such practices are made available through other Company policies.

Nutrien endeavors to comply with the privacy legislation within each jurisdiction in which we operate. Sometimes the privacy legislation and / or an individual's right to privacy are different from one jurisdiction to another. Practices relating to Personal Data will be guided by what is permitted or required under applicable law.

Summary of Key Points

1. Collection of Personal Data

We collect the following categories of Personal Data:

• Basic Data: Name, date of birth, title, company, job responsibilities, phone number, address, email address, location or geographic data, and other contact details.
• Device Data: Computer Internet Protocol (IP) address, unique device identifier (UDID), cookies and other data linked to a device, and data about usage of our Sites and communications, data generated or collected by our or third party equipment or devices owned and operated by us or third parties, including location, land boundaries, images, and any data provided by you or your agents.
• Financial Data: Revenue history, expenditure records, credit related information, and other purchasing or usage histories or tendencies, payment information,- and transaction history.
• Government Identifiers: tax file numbers, government issued business numbers, and license numbers.
• Marketing Data: Data about individual participation (whether in-person or virtual) at industry gatherings, Company sponsored events (including in the stores/experience centers), credentials, associations, Services you are interested in, and other preferences.
• Registration Data: Newsletter requests, subscriptions, downloads, and username/passwords.

2. Use of Personal Data

We use the above categories of Personal Data for the following purposes:

3. Sharing of Personal Data

We share Personal Data with the following categories of recipients:

• Service providers: We may share Personal Data with third party companies and service providers to enable such parties to perform functions on our behalf and under our instructions in order to carry out the purposes identified above. We require such third party companies and service providers to provide reasonable security for Personal Data and to use and process such Personal Data only on our behalf.
• Auditors and advisors: We may share Personal Data with auditors for the performance of audit functions and advisors for the provision of legal and other advice.
• Business reorganization parties: We may share Personal Data with any corporate seller, acquirer, or prospect to the extent permitted by law as part of a proposed or actual merger, acquisition, sale of company assets, or transition of service to another provider, as well as in the event of insolvency, bankruptcy, or receivership in which Personal Data would be transferred as an asset of the Company.
• Government agencies or private parties to legal proceedings: We may share Personal Data in order to comply with any subpoena, court order or other legal process, or other governmental request. We also share Personal Data to establish or protect our legal rights, property, or safety, or the rights, property, or safety of others.
• Business partners: We may share Personal Data with third party independent business partners in connection with incentive and rebate programs or other activities. Such third party independent business partners may send you information promoting the products or services of those partners.

If you have questions about the recipients with which we share Personal Data, please contact us as specified below.

4. Marketing Choices

You have choices with respect to our use of your Personal Data for direct marketing purposes. If you no longer wish to receive any marketing communications, remain on a mailing list to which you previously subscribed, or receive any other marketing communication, you can choose to not receive such communications at any time. Please follow the unsubscribe link in the relevant communication or contact us as detailed in Section 10 below.

5. Cookies

We use and allow certain trusted third party companies to use cookies, web beacons, and similar tracking technologies (collectively, "cookies") on third party sites and our Site.

What are cookies?
Cookies are small amounts of data that are stored on your browser, device, communication, or the page you are viewing. Some cookies are deleted once you close your browser, while other cookies are retained even after you close your browser so that you can be recognized when you return to a website. More information about cookies and how they work is available at www.allaboutcookies.org.

How do we use cookies?
We use cookies to provide our Services, gather information about your usage patterns when you navigate our Site in order to enhance your personalized experience, and understand usage patterns to improve our Site and Services. We also allow certain trusted third party companies to place cookies on our Sites in order to collect information about your online activities on our Sites and across different websites you visit. This information is used to provide advertising tailored to your interests and to analyze the effectiveness of such advertising.

Cookies on our Sites are generally divided into the following categories:
Strictly Necessary Cookies: These are required for the operation of our Sites. They include, for example, cookies that enable you to log into secure areas. These cookies are session cookies that are erased when you close your browser.
Analytical/Performance Cookies: These allow us to recognize and count the number of users of our Sites and understand how such users navigate through our Site. This helps to improve how our Sites work, for example, by ensuring that users can easily find what they are looking for. These cookies are session cookies, which are erased when you close your browser. We use Google Analytics to collect information about the use of our Sites.
Functional Cookies: These improve the functional performance of our Sites and make them easier for you to use. For example, cookies are used to remember that you have previously visited the Sites and asked to remain logged into them. These cookies qualify as persistent cookies, because they remain on your device for us to use during a next visit to our Sites. You can delete these cookies via your browser settings.
Targeting Cookies: These record your visit to our Sites, the pages you have visited and the links you have followed to recognize you as a previous visitor and to track your activity on the Sites and other websites you visit. These cookies qualify as persistent cookies, because they remain on your device for us to use during a next visit to our Sites. You can delete these cookies via your browser settings. See below for further details on how you can control third party targeting cookies.

What are your options if you do not want cookies on your computer?
You can review your Internet browser settings, typically under the sections “Settings”, "Help," or "Internet Options," to exercise choices you have for certain cookies. If you disable or delete certain cookies in your Internet browser settings, you might not be able to access or use important functions or features of our Sites, and you may be required to re-enter your log-in details.
To learn more about the use of cookies [for Google Analytics] and to exercise choice regarding such cookies, please visit https://tools.google.com/dlpage/gaoptout.
To learn more about certain cookies used for Interest based advertising by third parties, including through cross-device tracking, and to exercise certain choices regarding such cookies, please visit the Digital Advertising Alliance, Network Advertising Initiative, Digital Advertising Alliance-Canada, European Interactive Digital Advertising Alliance or your device settings.

6. Data Subject Rights

Where required by applicable law, you have the right to obtain confirmation that we maintain certain Personal Data relating to you, to verify its content, origin, and accuracy, as well as the right to access, review, port, delete, or to block or withdraw consent (when your consent is legally required) to the processing of certain Personal Data (without affecting the lawfulness of us having processed based on consent before its withdrawal), by contacting us as provided in Section 10 below.
In particular, you have the right to object to our use of Personal Data for direct marketing at any time. Please note that we may retain certain Personal Data as required or permitted by applicable law. When requesting the exercise of any of your rights, we may request specific information from you to confirm your identity and, accordingly, verify and respond to such requests.

7. Data Security

We maintain technical and organizational measures to protect Personal Data from loss, misuse, alteration, or unintentional destruction. However, no security measure can guarantee against compromise. You also have an important role in protecting your Personal Data. You should not share your username and password with anyone, and you should not re-use passwords across more than one website. If you have any reason to believe that your username or password has been compromised, please contact us as soon as practicable using the information provided in Section 10 below.

8. Cross-Border Data Transfers

We transfer Personal Data to various jurisdictions as necessary for the purposes described above, including to jurisdictions that may not provide the same level of data protection as your home country. For example, Personal Data collected from jurisdictions outside North America will typically be transferred to the United States or Canada for processing. We provide appropriate protection for cross-border transfers as required by law for international data transfers. With respect to transfers originating from the European Economic Area ("EEA"), we implement standard contractual clauses approved by the European Commission, and other appropriate solutions to address cross-border transfers as required by applicable law. Where permitted by such laws, you may request a copy of the suitable mechanisms we have in place by contacting us as detailed below.

9. Other Information

(i) What is the legal basis of processing?
Some jurisdictions require an explanation of the legal basis for the collection and processing of Personal Data. We have several different legal grounds on which we collect and process Personal Data, including: (a) as necessary to perform a transaction (such as in order to provide the Services you requested); (b) as necessary to comply with a legal obligation (such as when we use Personal Data for record keeping to support compliance with tax laws); (c) consent (where you have provided consent as appropriate under applicable law, such as for direct marketing or certain cookies); and (d) as necessary for legitimate interests (such as when we act to maintain our business generally, including maintaining the safety and security of our Sites). With respect to legitimate interests, given that we are a Business-to-Business (B2B) company, we typically collect and process limited Personal Data about commercial contacts and other individuals acting in their business capacities, as part of our overall effort to reduce the privacy impact on individuals.

(ii) What are the consequences of not providing Personal Data?
You are not required to provide all Personal Data identified in this Statement to use our Sites or to interact with us offline, but certain functionalities will not be available if you do not provide certain Personal Data. If you do not provide certain Personal Data, we may not be able to respond to your request, perform a transaction with you, provide certain incentives or rebates, or provide you with marketing that we believe you would find valuable.

(iii) Do we engage in automated decision-making without human intervention?
With the exception of in the provision of financial services, we do not use automated decision-making without human intervention, including profiling, in a way that produces legal effects concerning you or otherwise significantly affects you.

(iv) Do our Sites honor do not track ("DNT") signals sent via browsers?
Given the divergent practices of companies that offer browsers and the lack of a standard in the marketplace, we do not respond to DNT signals at this time.

(v) How long do we retain Personal Data?
We typically retain Personal Data related to marketing activities for as long as you accept marketing communications from us, and upon request we will securely delete such data in accordance with applicable law. For Personal Data that we collect and process for other purposes described above, we typically retain such Personal Data for no longer than for the period necessary to fulfill the purposes outlined in this Statement and as otherwise needed to address tax, corporate, compliance, litigation, and other legal rights and obligations.

(vi) Are third-party websites governed by this Statement?
Our Sites may contain links and references to other websites administered by unaffiliated third parties. This Statement does not apply to such third party websites. When you click a link to visit a third party website, you will be subject to that website's privacy practices. We encourage you to familiarize yourself with the privacy and security practices of the linked third party websites before providing any Personal Data on that website.
We are active on social media, including Facebook, YouTube, Twitter, Instagram, and LinkedIn (“Social Media”). Our Sites allow you to connect and share data with Social Media. Anything you post on Social Media is public information and will not be treated confidentially. We may post (or re-post) on our Sites and our Social Media pages any comments or content that you post on our Social Media pages. Your use of Social Media is governed by the privacy policies and terms of the third parties that own and operate those Social Media properties and not by this Statement.

(vii) How does Nutrien handle employee and contractor privacy issues?
As mentioned earlier in this Statement, Personal Data about our job applicants, employees, and contractors are addressed through separate policies accessible to those individuals on other websites and are outside the scope of this Statement.

(viii) How will we handle any changes to this Statement?
We may update this Statement from time to time as our Services and privacy practices change, or as required by law. The effective date of this Statement is posted above, and we encourage you to visit our Site periodically to stay informed about our privacy practices. We will post the updated version of the Statement on our Sites when applicable.

10. Contact Us

If you have questions or comments regarding this Statement or our privacy practices, please contact:

• Send an email to privacymanager@nutrien.com
• Write to us at 3005 Rocky Mountain Avenue, Loveland, CO 80538
• Call us at 970.685-3326

You may also have the right to raise a question or concern with the relevant government data protection authority in the jurisdiction in which you reside.