BELL CONNECT PRIVACY POLICY

Last Updated: August 14, 2026

This Privacy Policy explains how Bell Flavors & Fragrances. Bell Flavors & Fragrances, Inc., and its global subsidiaries and affiliates (collectively, “Bell”, the “Company”, “we“, “us“, “our“) collect, use, and disclose Personal Information in connection with the Bell Connect platform (the “Platform” or our “Services”). Bell Connect is an invitation-only, business-to-business platform that lets authorized users of our customer organizations browse products, request free product samples, and interact with product content. Bell Connect also includes a file-sharing feature used by Company staff to share content with external recipients, as described below.

By accessing or using Bell Connect, you agree to this Privacy Policy. If you do not agree, please do not use the Platform. Because Bell Connect is available only to users invited by the Company, you will typically access it through credentials the Company issues to you.

SCOPE OF THIS POLICY

This Privacy Policy applies to the Bell Connect Platform, which has two components, both operated by the Company:

• The Bell Connect sample platform: an invitation-only product library where authorized users of our customer organizations browse products (including products they have previously purchased or sampled and products in their flavor catalog), comment on and favorite products, and add products to a cart to request free samples.
• Bell Connect share links: a file-sharing feature that lets Company staff send files, folders, or workspace mini-sites to external recipients. This feature is addressed in its own section below.

This Policy does not apply to any third party’s website, product, or service, even if it links to or from the Platform.

1. Information We Collect

Bell Connect is designed to collect only the limited Personal Information needed to operate the Platform. Not all of the information below is collected about every individual. The categories below track those defined under the California Consumer Privacy Act (“CCPA”). This chart also reflects information we may begin collecting within the next 12 months as the Platform evolves (noted as “forward-looking”).

A Note on Sensitive Personal Information

Sensitive Personal Information (“SPI”) is broadly defined under different data privacy laws and may include:

• Your racial or ethnic origin
• Your political opinions
• Your religion or other beliefs
• Your health, biometric or genetic characteristics
• Any trade union membership
• Your sexuality (information about your sex life or sexual orientation)
• Any criminal background
• Precise geolocation
• The content of your private communications (other than messages you may send to us)

The Company does not seek to collect SPI through Bell Connect, and the Platform is not designed to collect it. If we ever collect SPI, we will do so only as permitted by law or with your consent. Consistent with applicable law, you may limit certain uses or disclosures of your SPI. You may exercise this right by contacting us at privacy@bellff.com. We do not sell sensitive data, and, consistent with applicable law, we will obtain your consent before processing sensitive data for any purpose that requires it or before selling any sensitive data.

1. How We Collect Your Personal Information

Generally, there are three ways we collect your Personal Information:

• Information the Company Creates for You
• Information You Provide To Us
• Information We Collect from Other Sources
• Information We Collect Automatically

1. Information the Company Creates for You

Bell Connect does not offer public sign-up. User accounts are created internally by the Company. When the Company sets up your account, it records your first name, last name, email address, and an organization code that associates you with your customer organization. You do not create a username or password; instead, you log in using your email address together with a one-time, two-factor verification code sent to you at each visit.

1. Information You Provide to Us

When you use the Platform, you may provide:

• User-generated content, such as comments you post about products and products you favorite. Within the sample platform, comments are visible only to other users within your own organization.
• Sample requests, when you add products to your cart to request free samples. The cart is used to request samples (not to make purchases) and no payment or transaction occurs on the Platform.
• Shipping and freight billing account information, such as a UPS or FedEx account number that you or your organization choose to enter so that expedited shipping of your samples can be billed directly to that carrier account. Providing a carrier account number is optional; if you do not provide one, we ship samples using our standard method. We use this information only to arrange, ship, and bill the sample you request, and we disclose it to the applicable carrier and to our fulfillment providers for that purpose. We do not use carrier account numbers for marketing, and no payment is processed on the Platform.

1. Information We Receive from Other Sources

Much of the information on the Platform comes from the Company’s own systems rather than from you directly:

• Account details (your name, email address, and organization code) are provided by the Company when your account is created, as described above.
• Product data is pulled through an application programming interface (API) from the Company’s internal product lifecycle management (PLM) system and is organized at the organization level.
• Shipping information for sample requests is managed by your Company salesperson and may be a corporate or home address. On the Platform, only the city and state associated with a shipping address are displayed; the street address is not shown.

1. Information We Collect Automatically

The Platform does not currently use cookies, pixels, tags, web beacons, session-replay, or heat-mapping technologies, and does not currently collect IP addresses or device identifiers.

As the Platform develops, and consistent with applicable law, we may begin to collect limited technical information automatically, such as your IP address, device identifier, browser type, and information about how you interact with the Platform, for purposes such as security, troubleshooting, and analytics. If and when we introduce cookies or similar tracking technologies, we will update this Policy and, where required, provide additional notice or obtain consent.

Mobile Application

We make certain Services available through our mobile application, Bell Connect (the “App”). The App is available to approved users and provides access to the same Platform features described in this Policy, including a personalized product experience, product information and documentation, sample requests, and requesting tracking and status updates. The App collects and uses the same categories of Personal Information described in this Policy and does not collect any additional categories. The App does not use cookies or similar tracking technologies, does not use advertising or analytics software development kits (SDKs), and does not collect precise geolocation data. If you download the App from the Apple App Store or Google Play, those providers may collect information about your download and use of the App in accordance with their own privacy policies. You may stop the App’s collection of information by uninstalling it, and you may access, update, or delete your account information as described in “How to Exercise Your Choices.”

Cookies and Similar Technologies

Bell Connect does not currently use cookies or similar tracking technologies, and we do not currently use marketing or advertising pixels (such as social-media advertising pixels). We do not sell your Personal Information or use it for cross-context behavioral advertising.

If we introduce cookies or similar technologies in the future, we will describe them here and, where required by law, provide a mechanism to manage them. Most browsers can be set to reject or delete cookies through their settings.

• How We Use Your Personal Information

Consistent with applicable law, we use the Personal Information described above to:

1. Provide and operate the Platform, including authenticating your login, displaying product content relevant to your organization, and enabling comments, favorites, and sample requests.
2. Fulfill sample requests, by facilitating your requests for free samples through the Company’s internal systems.
3. Communicate with you about your account and your use of the Platform, and to send you service or informational messages (for example, notices about Platform availability or changes to our policies).
4. Maintain, secure, and improve the Platform, including troubleshooting, protecting against fraud or misuse, and understanding how the Platform is used through analytics.
5. Comply with law and enforce our rights, including meeting legal, regulatory, and contractual obligations and protecting the rights, safety, and property of the Company, our users, and others.
6. With your consent, or at your direction, for any other purpose disclosed to you at the time.

Email and Text Communications

We may send you informational or transactional messages relating to your account and the operation of the Platform (for example, login codes or notices that the Platform is unavailable). If we send promotional or marketing emails, those messages will comply with applicable law, including the CAN-SPAM Act, and will include a way to unsubscribe. We will only send marketing text (SMS) messages if you have provided affirmative opt-in consent, and you may withdraw that consent at any time.

Use of Personal Data to Train Large Language Models

We do not collect, use, or sell personal data for the purpose of training large language models (LLMs), whether directly or indirectly through our vendors or service providers. If our practices change, we will update this Privacy Policy to disclose whether, and for what purposes, personal data is used for LLM training.

1. Disclosing Your Personal Information

We do not sell your Personal Information. We may disclose your Personal Information in the following limited circumstances:

• Within the Company, including to our affiliates and to Company personnel (such as your salesperson) who need it to operate the Platform and fulfill sample requests.
• To our service providers. We use trusted third-party service providers who process Personal Information on our behalf and under contract. In particular, Catalyst XL builds and hosts the Bell Connect Platform and processes user registrations and related data in providing those services to us. Our service providers are contractually limited to using Personal Information to provide services to us.
• When required by law or to protect rights. We may disclose Personal Information where necessary or appropriate to comply with applicable law or legal process, respond to lawful requests from public authorities, or protect the rights, safety, or property of the Company, our users, or others. Consistent with applicable law, we do not sell Personal Information to any government or law-enforcement entity, including any governmental unit that we know has engaged in or supported civil immigration enforcement within the preceding six months, except where we are presented with a valid warrant issued by a court that particularly describes the Personal Information to be disclosed. We maintain internal procedures for evaluating and responding to government and law enforcement requests accordingly.
• No Sale of Personal Information. We do not sell information about individuals, and we do not share it for cross-context behavioral advertising. We also do not sell sensitive data or precise geolocation data. We do not sell the Personal Information of any individual we know to be a minor, and do not use a minor’s personal data for targeted advertising.
• In connection with a corporate transaction. We may disclose or transfer Personal Information in connection with, or during negotiations of, a merger, acquisition, financing, reorganization, sale of assets, or bankruptcy.
• At your direction, when you ask us to share information with a third party.

Once we share Personal Information with another company in the circumstances above, that company’s handling of the information is governed by its own privacy practices.

Bell Connect Share Links

Separate from the sample platform, Bell Connect includes a file-sharing feature that Company staff use to share files, folders, or workspace mini-sites with external recipients (“Workspace”). This feature functions similarly to file-sharing tools such as Box or Google Drive, and it is hosted entirely by the Company (and its hosting provider, Catalyst XL).

If you receive a share link, you can view only the specific content that has been shared with you. You cannot log in to, browse, or otherwise access the broader Platform through a share link. Depending on the sensitivity of the shared content, a link may be one of the following types:

• Open link: opens automatically and is valid for approximately 7 days (used for internal purposes).
• Private link: requires you to enter an email address (which is not independently validated) and is valid for approximately 90 days.
• Two-factor link: requires a whitelisted email domain and is valid for approximately 6 months (used for content that is proprietary to the Company or a customer).

When you interact with a share link, we may process the email address you enter (for private and two-factor links) and information necessary to deliver and secure the shared content. We use this information to provide the file-sharing feature, control access to shared content, and maintain the security of the Platform.

Interactive features within a Workspace

A shared Workspace may include interactive features, such as newsletter sign-up, blog links, or a “Contact Us” link. If you use these features, we collect the information you provide, such as your email address for newsletter sign-up or your name, email address, and message for a contact request. We use this information to respond to you and, if you opt in, to send communications that you may unsubscribe from as described in “How to Exercise Your Choices.” Our blog and other linked resources may be governed by separate privacy policies, which we encourage you to review.

• Your Privacy Rights

Depending on where you live, you may have certain rights regarding your Personal Information. If you reside in California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, the following rights may apply, and we will honor them to the extent required by applicable law:

To exercise any of these rights, email us at privacy@bellff.com. We will take reasonable steps to verify your identity before responding, and you may use an authorized agent to submit a request on your behalf with proper verification. Certain information may be exempt from these requests under applicable law.

Global Privacy Control

Some browsers and browser extensions support the Global Privacy Control (“GPC”) signal, which allows users to opt-out of certain types of data processing, including the sale of personal data, at the browser level. This eliminates the need to opt out on each individual website. When we detect a GPC signal, we will make reasonable efforts to respect your choices as indicated by the GPC setting, in accordance with applicable law. Because the Platform does not currently use cookies or tracking technologies and does not sell Personal Information or engage in cross-context behavioral advertising, there is generally nothing to opt out of at this time. If we detect a GPC signal in the future once such processing exists, we will make reasonable efforts to honor it as required by applicable law. For more information about GPC, visit globalprivacycontrol.org.

• Other State Rights

CALIFORNIA “SHINE THE LIGHT” LAW/YOUR CALIFORNIA PRIVACY RIGHTS

California Civil Code Section 1798.83, also known as the “Shine The Light” law, permits consumers who are California residents, to request and obtain from us once a year, free of charge, information about the categories of Personal Information (as defined in the Shine the Light law), if any, that we disclosed in the preceding calendar year to third parties for those third parties’ direct marketing purposes. Our disclosure requirements apply only if we share our consumers’ Personal Information with third parties for them to directly market their own products to those consumers, instead of assisting us with our own business. The Company does not share Personal Information with third parties for their direct-marketing purposes. California residents may still submit questions or requests by emailing us at privacy@bellff.com.

• International Users and Data Transfers

Bell Connect is operated from the United States and is intended for organizations and users located in the United States. We do not market, offer, or target the Platform to individuals in the United Kingdom, the European Economic Area, or Switzerland. Individuals in those regions may be invited to the Platform by an existing customer organization and may choose to access it; if you do so, you are accessing a U.S.-based service at your own initiative.

Where your information is processed. The Platform is hosted in the United States, and Personal Information is processed and stored there. By using the Platform or submitting information to us, you understand that your Personal Information will be transferred to, stored in, and processed in the United States, which may have data protection laws that differ from those of your country of residence.

Company facilities outside the United States. Some Company facilities are located outside the United States, including in China. Access to Personal Information from these locations is limited to the authorized purposes described in this Policy and is subject to our internal access controls and confidentiality obligations.

Service providers. We use vendors and service providers that may process Personal Information in the United States and other countries where they operate. We require these providers to handle Personal Information consistent with this Policy and applicable law.

Retention. We retain Personal Information for no longer than necessary for the purposes described in this Policy, unless a longer retention period is required or permitted by law.

Questions and requests. If you have questions about how we handle your Personal Information, or wish to make a request regarding your information, contact us at privacy@bellff.com. We will respond consistent with applicable law and the rest of this Policy.

How to Exercise Your Choices

• Account information. Because accounts are created and managed by the Company, contact us at privacy@bellff.com to access, update, or delete your account information.
• Communication preferences. You can unsubscribe from email, mail, telephone and text message communications from us. To do so, call us at 1-847-291-8300 and ask to speak with the General Counsel, or email us at privacy@bellff.com We may still send you transactional or informational messages relating to the Platform.
• Global Privacy Settings. Some browsers and browser extensions support the Global Privacy Control (“GPC”) that can send a signal to the websites you visit indicating your choice to opt-out from certain types of data processing, including data sales. When we detect such a signal, we will make reasonable efforts to respect your choices indicated by a GPC setting as required by applicable law.
• Access, Correct, Delete or Restrict Processing of Your Personal Information. In some jurisdictions, you may have the right to access, modify or delete the Personal Information that we have about you. To exercise any of the rights granted in your specific jurisdiction as described above, please submit a verifiable consumer request to us by emailing us at privacy@bellff.com. You may only make a verifiable consumer request for access or data portability twice within a twelve (12) month period.
• Other State-Specific Privacy Rights. If you reside in a state with a state privacy law, you may have additional privacy rights. Our State Data Privacy Rights section to this Privacy Policy includes instructions on how you may exercise those rights.
• Verification & Authorized Agents. You may use an authorized agent to submit verifiable consumer requests on your behalf. An authorized agent is a natural person or a business entity that you have authorized to act on your behalf. We will take reasonable steps to verify your identity and requests, including by verifying your account information, residency or the email address you provide. If you are an authorized agent submitting a request on behalf of another individual, we may require proof of your written authorization before processing the request. We may deny a request from an authorized agent that does not submit proper verification proof.
• Exempt Information. Certain information may be exempt from such requests under applicable law such as information we retain for legal compliance and to secure our Services. We may need certain information in order to provide the Services to you; if you ask us to delete it, you may no longer be able to obtain or use the Services.
• Non-Discrimination. You will not receive discriminatory treatment by use for the exercise of any of your privacy rights described herein.

Children’s Privacy

Bell Connect is a business-to-business platform intended for authorized business users and is not directed to children. We do not knowingly collect Personal Information from children, and children are not permitted to use the Platform. Consistent with the Children’s Online Privacy Protection Act (“COPPA”), we do not knowingly collect Personal Information from children under the age of 13 (or a higher age where required by applicable law). If you believe a child has provided Personal Information through the Platform, please contact us at privacy@bellff.com so we can take appropriate action. We do not sell, or process for purposes of targeted advertising, the Personal Information of any use we know to be a minor, and we will not do so without any consent required by applicable law.  

Data Security and Retention

The security, integrity, and confidentiality of your Personal Information are important to us. We use technical, administrative, and physical safeguards designed to protect Personal Information against unauthorized access, disclosure, use, or modification. Access to the Platform requires email-based, two-factor authentication rather than stored usernames and passwords, and data is siloed by organization so that users see only content and comments associated with their own organization. No security measures are perfect or impenetrable. We retain Personal Information for as long as needed for the purposes described in this Policy, unless a longer period is required or permitted by law.

Other Important Legal Terms

The terms in this Privacy Policy and in our Terms of Use have legal importance and may be used by us in a legal proceeding, including to restrict certain claims by you or to limit your rights.

Specifically, in using our Services or accessing the Site you agree:

• Limitation of Liability. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, UNDER NO CIRCUMSTANCES, INCLUDING, BUT NOT LIMITED TO, NEGLIGENCE, WILL WE BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL OR CONSEQUENTIAL DAMAGES THAT RESULT FROM OUR USE OF PERSONAL INFORMATION, EVEN IF WE ARE ADVISED BEFOREHAND OF THE POSSIBILITY OF SUCH DAMAGES, AND THE MAXIMUM AMOUNT OF DAMAGES FOR WHICH WE WILL BE LIABLE UNDER THIS AGREEMENT WILL BE THE GREATER OF THE FEES YOU PAID FOR ANY SERVICE IN CONNECTION WITH WHICH YOU PROVIDED YOUR PERSONAL INFORMATION, OR $100. (BECAUSE SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OR LIMITATION OF CERTAIN CATEGORIES OF DAMAGES, THE ABOVE LIMITATION MAY NOT APPLY TO YOU. IN SUCH JURISDICTIONS, OUR LIABILITY IS LIMITED TO THE FULLEST EXTENT PERMITTED BY SUCH LAW.) YOU SPECIFICALLY ACKNOWLEDGE AND AGREE THAT WE ARE NOT LIABLE FOR ANY DEFAMATORY, THREATENING, OFFENSIVE OR ILLEGAL CONDUCT OF ANY USER OF OUR SERVICES.
• Indemnification. You agree to indemnify and hold harmless us and each of our and their respective board members, directors, officers, managers, employees, shareholders, agents, representatives and licensors, from and against any and all losses, expenses, damages and costs, including reasonable attorneys’ fees, that arise out of your provision of any inaccurate or unauthorized Personal Information to us or your violation of this Agreement or any rights of another. We reserve the right to take over the exclusive defense of any claim for which we are entitled to indemnification under this section. In such event, you agree to provide us with such cooperation as is reasonably requested by us.
• Choice of Law. This Agreement will be governed by and construed in accordance with the laws of the State of Illinois without giving effect to any principles of conflicts of law.
• Statute of Limitations for All Claims. To the extent permitted by applicable law, you agree that regardless of any statute or law to the contrary or providing for a longer period, any claim or cause of action that you may have arising out of or related to use of the Services or this Agreement must be filed by you within one year after such claim or cause of action arose or be forever barred.
• Class Action Waiver. This is an important section that limits your right to bring a class action against us. You and the Company agree that each party may bring disputes against the other party only in an individual capacity, and not as a plaintiff or class member in any purported class or representative proceeding, including, without limitation, a federal or state class action lawsuit. However, nothing in this section limits your right or the Company’s right to bring a lawsuit against each other as an individual plaintiff. This provision applies to the maximum extent permitted by applicable law to all claims that arise under, in connection with, or relate to this Privacy Policy or the Personal Information you provide to us (whether your own or any other Personal Information you provide), Personal Information that is automatically collected by us and/or obtained by us from third parties; that arose under, in connection with, or relate to any previous privacy policy in effect or that otherwise arose before these terms went into effect; or that may arise in connection with or after or otherwise relate to your Personal Information (or any other Personal Information you provide to us) after termination of any business relationship we may have with you, including cancellation or deletion of your accounts if applicable.

Accessibility

We are committed to ensuring all functionality and content is accessible to all our customers.

Our ongoing accessibility work conforms toward the Web Content Accessibility Guidelines (WCAG) version 2.1, level AA criteria. These guidelines not only help make web content accessible to users with sensory, cognitive and mobility disabilities, but ultimately to all users, regardless of ability.

If you experience any difficulty in accessing any part of this website or this Policy you may contact us at privacy@bellff.com.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The “Last Updated” date at the top of this page indicates when it was last updated. If we make material changes, we will notify you either by email to the most recent email address provided to us, through a pop-up window on our homepages, or through another method as required by law. Any changes will become effective on the “Last Updated” date indicated above.

Where permitted by applicable law, after we post any changes on this page, your continued use of our website and/or Services following the posting of changes constitutes your acceptance of such changes.

Contact Us

If you have any questions or comments about this Privacy Policy, the ways in which we collect and use your Personal Information described here, your choices and rights regarding such use, or you wish to exercise your rights, please contact us as provided below.

To contact the person or persons with primary responsibility for directing these privacy practices, please email us at: privacy@bellff.com.