Personnel Privacy Notice

Last Updated: March 9, 2026

This Personnel Privacy Notice (“Notice”) describes how J.Crew Group, LLC, 225 Liberty St., New York, NY 10281, USA and our brands and subsidiaries (including but not limited to J.Crew Inc., J.Crew, crewcuts, J.Crew Factory and Madewell) (collectively, “J.Crew”, “we”, or “us”) processes personal information of our current employees, former employees, independent contractors, freelancers, consultants, and job applicants (together, “Personnel” or “you”).

Nothing in this Notice should be construed to interfere with our ability to process personal information for purposes of complying with our legal obligations or for investigating alleged misconduct or violation of J.Crew policies or law. This Notice is not intended to create any express or implied promise or contract for employment.

This Notice covers the twelve (12) months prior to the Last Updated Date. We will update this Notice at least annually. If our practices materially differ from this Notice, we will provide a supplemental, pre-collection notice of the new practices. Otherwise, this Notice serves as our Notice at Collection for purposes of the California Consumer Privacy Act, as amended (“CCPA”).

J. Crew collects Protected Health Information (“PHI”), as defined and covered by the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”), in its capacity as a self-insured health plan sponsor. This Notice does not cover our collection, use, disclosure, or otherwise processing of your PHI. Such processing is covered by the HIPAA Notice of Privacy Practices, which you may request from HRprivacy@jcrew.com.

PPERSONAL INFORMATION WE COLLECT, USE, AND DISCLOSE
We collect your personal information directly from you, such as when you apply for a position or become employed or engaged by us (e.g., identification/identity data, contact details, educational and employment data), or others during the course of your recruitment and hiring process, employment or engagement, as applicable, including third parties, service providers, background check and other employment screening vendors, references, or other public data sources).

We collect, disclose, and retain personal information as follows:

Category of Personal Information	Examples of Personal Information Collected and Retained	Categories of Recipients
1. Identifiers	Real name, alias, postal address, unique personal identifiers, online identifier, Internet Protocol address, e-mail address, and account name.	Disclosures for Business Purposes: General IT, software, and other business Vendors (as defined below) HR Vendors and providers (for example, compensation, benefits, management, and development) Governmental entities (for example, in relation to our obligations to determine employment eligibility and responding to requests pursuant to legal or regulatory process) Other parties (e.g., professional advisors (accountants, lawyers) and litigants) Sale/Share: N/A
2. Personal Records	Name, signature, description, address, telephone number, and financial information (e.g., payment card information).	Disclosures for Business Purposes: General IT, software, and other business Vendors HR Vendors and providers (for example, compensation, benefits, management, and development) Governmental entities (for example, in relation to our obligations to determine employment eligibility and responding to requests pursuant to legal or regulatory process) Other parties (e.g., professional advisors (accountants, lawyers) and litigants) Sale/Share: N/A
3. Biometric Data	In some circumstances, we may collect your photograph and facial biometric information for security-related purposes (for example, for identification verification when you call the IT Help Desk).	Disclosures for Business Purposes: General IT, software, and other business Vendors HR Vendors and providers (for example, compensation, benefits, management, and development) Government entities (for example, in relation to our obligations to determine employment eligibility and responding to requests pursuant to legal or regulatory process) Other parties (e.g., professional advisors (accountants, lawyers) and litigants) Sale/Share: N/A
4. Personal Characteristics or Traits	In some circumstances, we may collect personal information that is considered protected under U.S. law, such as age, gender, nationality, race or information related to medical conditions.	Disclosures for Business Purposes: General IT, software, and other business Vendors HR Vendors and providers (for example, compensation, benefits, management, and development) Government entities (for example, in relation to our obligations to determine employment eligibility and responding to requests pursuant to legal or regulatory process) Other parties (e.g., professional advisors (accountants, lawyers) and litigants) Sale/Share: N/A
5. Account Details/Commercial Information	Records of products or services purchased or obtained in the human resources context, such as benefits you have signed up for.	Disclosures for Business Purposes: General IT, software, and other business Vendors HR Vendors and providers (for example, compensation, benefits, management, and development) Government entities (for example, to respond to requests pursuant to legal or regulatory process) Other parties (e.g., professional advisors (accountants, lawyers) and litigants) Sale/Share: N/A
6. Internet Usage Information	When you use our online systems or otherwise interact with us online, we may collect browsing history, search history, and other information regarding your interaction with our systems or other sites, applications, or content.	Disclosures for Business Purposes: General IT, software, and other business Vendors HR Vendors and providers (for example, compensation, benefits, management, and development) Government entities (for example, responding to requests pursuant to legal or regulatory process) Other parties (e.g., professional advisors (accountants, lawyers)) Sale/Share: N/A
7. Geolocation Data	If you use our systems or interact with us online, we may gain access to the approximate, and sometimes precise, location of the device or equipment you are using, or the location from which you are accessing our systems. We also track the location of J.Crew-owned equipment.	Disclosures for Business Purposes: General IT, software, and other business Vendors HR Vendors and providers (for example, compensation, benefits, management, and development) Government entities (for example, responding to requests pursuant to legal or regulatory process) Other parties (e.g., professional advisors (accountants, lawyers)) Sale/Share: N/A
8. Sensitive Personal Information	Government-Issued ID Numbers (Social Security number, driver’s license, state ID card, or passport number) Account Log-In; Financial Data (account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account); Precise Geolocation; Personal Characteristics (racial or ethnic origin, religious or philosophical beliefs, or union membership); Health Information (personal information collected concerning an individual’s health); Sex Life/ Sexual Orientation (personal information collected concerning an individual’s sex life or sexual orientation); Communication Content (contents of mail, email, and text messages, other than where J.Crew is the intended recipient of the communication, if J.Crew equipment is used).	Disclosures for Business Purposes: General IT, software, and other business Vendors, premises security and telephone operator services HR Vendors and providers (for example, compensation, benefits, management, and development) Corporate credit card and fraud detection services Vendors Government entities (for example, in relation to our obligations to determine employment eligibility and responding to requests pursuant to legal or regulatory process) Other parties (e.g., professional advisors (accountants, lawyers)) Sale/Share: N/A
9. Sensory Data, Recordings/Electronic Communications	We may collect audio, electronic, or similar information when you visit our business premises (video security recordings). We may collect your photograph and biometric information for security-related purposes.	Disclosures for Business Purposes: General IT, software, and other business Vendors, premises security and telephone operator services Government entities (for example, responding to requests pursuant to legal or regulatory process) Other parties (e.g., professional advisors (accountants, lawyers)) Sale/Share: N/A
10. Professional or Employment Information	Professional, educational, or employment-related information.	Disclosures for Business Purposes: General IT, software, and other business Vendors HR Vendors and providers (for example, compensation, benefits, management, and development) Government entities (for example, responding to requests pursuant to legal or regulatory process) Other parties (e.g., professional advisors (accountants, lawyers)) Sale/Share: N/A
11. Non-public Education Records	Education records directly maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, schedules, identification codes, financial information, or disciplinary records.	Disclosures for Business Purposes: General IT, software, and other business Vendors HR Vendors and providers (for example, compensation, benefits, management, and development) Government entities (for example, in relation to our obligations to determine employment eligibility and responding to requests pursuant to legal or regulatory process) Other parties (e.g., professional advisors (accountants, lawyers)) Sale/Share: N/A
12. Inferences from Personal Information Collected	We may draw inferences from other information we collect about you. (For example, based on your performance or other information we have about you, we may recommend skills training that may benefit you.)	Disclosures for Business Purposes: General IT, software, and other business Vendors HR Vendors and providers (for example, compensation, benefits, management, and development) Government entities (for example, responding to requests pursuant to legal or regulatory process) Other parties (e.g., professional advisors (accountants, lawyers)) Sale/Share: N/A

Not all categories or examples of specific personal information listed in this Notice may be collected about you depending on how you interact with us, your work location, your job responsibilities, etc.

PURPOSES FOR COLLECTING AND USING PERSONAL INFORMATION
We collect and use your personal information for human resources (“HR”) purposes and to operate our business. The specific reasons for which we use your personal information depend on the context in which your personal information is collected and processed. In general, we collect and use your personal information to:

Conduct recruitment and hiring activities;

Complete background checks, identification verification, and other pre-employment screenings;

Complete employee intake/ onboarding/ off-boarding;

Maintain personnel records;

Process compensation, reimbursements, and timekeeping;

Book employee travel;

Administer benefits, internal personnel programs, and training and educational programs;

Ensure the health, safety and security of you and J.Crew and its personnel, premises, and systems;

Manage Personnel and their performance;

Communicate with you to request your feedback and respond to your questions;

Disclose it to our service providers, contractors or processors that perform services for us (together, “Vendors”);

Investigate, prevent or take action in response to suspicious, illegal or fraudulent activities, or any other activity that may threaten someone’s safety or violate our policies or other obligations; and

Comply with our legal obligations and support internal compliance processes.

PURPOSES FOR DISCLOSING PERSONAL INFORMATION
We may disclose your personal information with third parties in the following circumstances:

With your consent or at your direction;

With Vendors, agents, consultants, contractors and other third parties requiring access to personal information to carry out work on our behalf and improve the products and services they provide to us, such as providers of HR services, benefits, web hosting, shipping and delivery, payment processing, fraud prevention, analytics, marketing, advertising and customer service;

To agencies or your prospective employers for purposes of employment verification, identification and/or as a reference;

In connection with administering health and other employee benefits;

In connection with, or during negotiations of, any business transaction where all or a portion of J.Crew or our assets are acquired by or merged with another company, such as a merger or acquisition, sale of company assets, joint venture, corporate reorganization, financing, or transfer, or in the unlikely event of insolvency, bankruptcy, or receivership;

With our current and future parents, affiliates, subsidiaries and other companies under common control and ownership; and

In exigent circumstances, such as (1) if we are required to do so by law or legal process, such as for compliance with law enforcement or national security requests, court order or subpoena; (2) to law enforcement authorities, judiciary or other government officials; (3) if necessary to protect your, our or others’ rights, property, safety, or other vital interests; (4) enforce our policies or contracts; (5) collect amounts owed to us; or (6) when we believe, in good faith, disclosure is necessary or appropriate to prevent physical harm or financial loss in connection with an investigation or prosecution of suspected or actual illegal activity.

DATA RETENTION
J.Crew generally retains personal information during the application and recruitment process, during employment, and after employment for as long as necessary to fulfill the purposes for which the personal information was collected and as required by applicable law. We may also retain personal information for longer periods where there is a reasonable basis for retaining such information, including without limitation in connection with the establishment, exercise, or defense of legal claims.

PROTECTING PERSONAL INFORMATION
J.Crew uses technical, physical and administrative safeguards intended to protect you and your personal information. We take commercially reasonable security measures appropriate to the level of information we maintain. Even with safeguards, security cannot be perfectly guaranteed. Please remember to exercise caution when sharing your information with others and take appropriate measures to protect your own personal information, such as by using strong passwords and not sharing your credentials.

YOUR PRIVACY RIGHTS

OPT-OUT OF PROMOTIONAL COMMUNICATIONS. YOU CAN OPT OUT OF RECEIVING PROMOTIONAL COMMUNICATIONS FROM US AT ANY TIME.

To opt out of direct mail (such as catalogs and postcards), please contact us at help@jcrew.com.

To opt out of promotional emails and text messages, please follow the instructions provided in those communications or contact us at help@jcrew.com.

Correct or Update Your Information. You can request updates or corrections to your personal information.

To update information stored in your account, log into your Workday account and make the appropriate update or correction.

To make updates or correction to information not stored in your Workday account, contact your HRBP for additional guidance.

NON-DISCRIMINATION
As an equal opportunity employer, J.Crew prohibits the use of data collected under this policy to discriminate in any manner prohibited by applicable federal, state, and/or local law.

CONTACT US
If you have any questions, comments, or concerns about our privacy practices, please contact us by e-mail at HRprivacy@jcrew.com or by phone at 1-866-467-8688 and entering service code 358#. Please note that email communications will not necessarily be secure; accordingly, you should not include sensitive information in your email correspondence with us.

CALIFORNIA RESIDENTS
The following provisions are designed to address California-specific requirements and supplements the general disclosures in this Notice. As of January 1, 2023, California Personnel have the rights described below, subject to certain exceptions and limitations. J.Crew will not discriminate against California Personnel based on exercise of these rights.

Right to Know (Categories): You can request to know the categories of personal information we collected about you, the categories of sources for the personal information we collected about you, our purpose for collecting your personal information, and the categories of third parties to whom we disclosed your personal information.

Right to Know (Specific Pieces): You can request to know the specific pieces of personal information we collected about you.

Right to Delete: You can request we delete your personal information.

Right to Correct: You can request we correct inaccuracies in your personal information.

Right to Opt-out of Selling/Sharing: We do not “sell” or “share” (as defined in the CCPA) personal information collected from or about Personnel.

Right to Data Portability. You may request a copy of your personal information in a portable and readily usable format that allows you to transfer the personal information to another entity without hinderance, to the extent technically feasible.

Right to Limit Use and Disclosure of Sensitive Personal Information. You can request that we limit certain processing of certain types of sensitive personal information. At this time, we do not process sensitive personal information for purposes other than those identified and permitted under the CCPA.

Right to Opt-out of Automated Decision-Making: We do not use automated decision-making.

YOUR PRIVACY RIGHTS MUST BE A VERIFIABLE CONSUMER REQUEST
Once we receive your request, for the security of your personal information and our own legal obligations, we will require you to verify your identity with us. If we are unable to verify a privacy rights request, we are unable to honor the request. Unless we suspect fraud, we do not verify requests to opt-out of Sell/Share/Target or to limit the use of sensitive personal information.

HOW TO EXERCISE YOUR PRIVACY RIGHTS

      You May Submit Your Request Directly

You may submit a request to exercise your California privacy rights by contacting us by e-mail at HRprivacy@jcrew.com or calling us at 1-866-467-8688 and entering service code 358#. Please be aware that we do not accept or process privacy rights requests from California Personnel or their authorized agent through other means (e.g., via fax, chats, social media etc.).

      Your Authorized Agent May Submit Your Request for You

California Personnel may use an authorized agent to submit a privacy rights request on their behalf, subject to our verification of the agent and the agent’s authority to submit requests on behalf of California Personnel. Authorized agents of California Personnel can submit a request to exercise privacy rights by contacting us by e-mail at HRprivacy@jcrew.com or calling us at 1-866-467-8688 and entering service code 358#. Generally, we will request that an agent provide proof that the California Personnel gave the agent signed permission to submit the request. As permitted under applicable law, we may also require the California Personnel who is the subject of the request to either verify their own identity or directly confirm with us that they provided the agent permission to submit the request. Once the agent’s authority is confirmed, they may exercise rights on the California Personnel’s behalf.

      OUR RESPONSES TO YOUR PRIVACY RIGHTS REQUESTS

J.Crew will make commercially reasonable efforts to identify personal information that we process. We reserve the right to direct you to where you may access and copy responsive personal information yourself (e.g., a self-serve portal).