Privacy Policy

Bath & Body Works, Inc., Bath & Body Works Direct, Inc., and Bath & Body Works, LLC (“BBW,” “we,” “us,” or “our”) respect your concerns about privacy. Through this Privacy Policy (“Policy”), we want you to know what personal information we collect, how we use it, to whom we sell or share it, how long we retain it, how we safeguard it, and how you can exercise your privacy rights. Unless indicated otherwise, this Policy applies only to personal information collected through the websites, microsites, mobile applications, in-store transactions, calls or text messages, and other online services of the Bath & Body Works brand and lines of business that expressly adopt or link to this Policy, and then only to the extent indicated (collectively, the “Services”).

Contents
This Policy addresses these topics:

What information do we collect and how do we use it
How is technology used to serve our advertisements on other online services and what choices do you have
How do our Services interact with third-party services and content
What information do we share with, or disclose to, third parties and our sister brands
What choices do you have over how your information is used
How do you update your personal information
How do we protect personal information
Do we collect children’s personal information
Where is personal information stored and processed
Whom should you contact with questions or concerns
How will we communicate updates to our Policy
How disputes concerning our Policy are resolved
Supplemental Privacy Notice for Consumers in Certain States provides additional information on the following topics for residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia (collectively, “Certain States”):

What information do we collect and disclose
What are your data rights in Certain States
How is Sensitive Personal Information processed
What is our retention policy for each category of personal information
What information do we collect and how do we use it
Next

Information You Provide
We collect personal information when you visit our Services, including when you make purchases; create a reward account; communicate with our chatbots or voicebots; speak with Customer Care; engage with our mobile applications; subscribe to email and mobile messaging; participate in surveys; enter contests or sweepstakes; or interact with special-event or program offers. Our Services may also give you the option to upload or share pictures or videos of yourself and others.
Information Your Devices Provide
When you interact with our Services, we obtain certain information by automated means, including the following:

a. Geolocation Information
We may obtain information about your approximate and, with your permission, precise geolocation when you access or use our Services: for example, via your browser and device, our store locator page, or our mobile applications. For more details, please see “What choices do you have over how your information is used” below.

b. Navigational Information
When you access our Services, your computer, phone, or other device may provide navigational information, such as browser type and version, service-provider identification, IP address, the site or online service from which you came, and the site or online service to which you navigate.

c. Device Information
We may obtain information about the computer or mobile device you use to access our Services, including the hardware model; operating system and version; device identifiers, such as Apple’s Identifier for Advertisers (IDFA) and Android’s Advertising ID; mobile network information; and website or app usage information.

d. Cookies, Clear Gifs, Analytics Services, and Similar Technologies
To better understand how you interact with our Services, we collect information using cookies, clear gifs (also known as web beacons or web bugs), analytics services (such as session replay software), and similar technologies. Cookies and clear gifs help us to do things like secure, improve, and deliver our Services; provide better customer service; tailor and improve your online experience; provide personalized ads; understand how and when you navigate our site or view our email; and honor special deals you viewed from a third party’s site.
We also use third-party-provided analytics services, device identifiers, web storage, and other similar technologies and services, to collect information about your interactions with our content and Services. For example, session replay services consist of an analytics application that allows us to analyze your interaction with our Services to better identify errors and optimize our Services. Such technologies and third-party-provided services may observe or record your activities when using our Services, including movements, scrolling, visit duration, clicks, and other interactions.
To facilitate our Services, we enable our third-party service providers to be part of your communications and interactive experiences. When you interact or communicate with us, you are also interacting and communicating with or through our third-party service providers and their technologies (session replay being an example). These technologies help us to understand which of our interactive experiences online users prefer and allow us to associate your online navigational information and purchases and interactions (both online and offline) with your personal information. We may associate this information to deliver products and services to you; improve our business; transact business; recognize other devices within your household; and market our products and services on this and other online services through a variety of media like email, mobile advertising, direct mail, and social media.
For information about your options with respect to cookies and clear gifs, see “What choices do you have over how your information is used” below.

Information Derived Through or Provided by Others
Affiliated entities, sister brands, vendors, social media networks, and advertising networks may provide us with, or supplement, information about you. We may use this information for a variety of operational or marketing purposes, such as to correct shipping information, personalized ads, improve our business, and transact business.
Third-Party Analytics and Personalization Services
We use third-party analytics services to analyze site metrics and performance, analyze our visitors’ preferences, address technical issues, optimize our Services for better user experiences, and serve personalized content to you through the use of some or all of the technologies described above.
How We Use the Information We Obtain
We use the personal information we obtain through the Services to:

deliver our Services;
process your online orders;
facilitate payment and transactions;
create and manage your online account;
personalize your online experience;
provide customer service;
include you in surveys and contests;
enable you to post your content, such as comments, images or videos;
facilitate networks of online social activity centered around our products and services;
improve our Services, the manner in which offers are made on our Services, and the interactions and experience visitors have with our Services;
develop, train, use, and improve AI tools and models (including those provided by third-party service providers) with the personal information described in this Policy for certain business purposes, such as to analyze customers’ experiences and activities with us, to improve the efficiency, quality, and speed of our business operations, to support communications with you and make product recommendations (such as through our chatbots and voicebots), to generate business content, and to provide personalized experiences;
enable you to interact with third-party content service providers, whether by linking to their sites, viewing their content within our online environment, or by viewing our content within their online environment;
market our products and services that may be of interest to you;
create aggregated, permanently de-identified, or anonymized information for statistical purposes, which we will maintain and use in a non-individually identifiable form and will not attempt to re-identify the data; and
administer technology and ensure technology integrity (including, for example, by maintaining and improving networks; and identifying and fixing problems).
Back to Top

How is technology used to serve our advertisements on other online services and what choices do you have
Prev
Next

We and third parties collect information about your online activities to provide you with advertising about products and services tailored to your interests, including for cross contextual behavioral advertising. To serve this advertising, these third-party companies place, use, or rely on the technologies described above (e.g., cookies, clear gifs, and similar technologies) to obtain information about customer interactions with us through our Services and third parties’ online services.

You may opt out of some of these technologies through Your Privacy Choices. We also recognize Global Privacy Control (GPC) signals from your web browser or web browser extension to effectuate the same preferences. For more information about GPC, please visit Global Privacy Control.

You may also specify your preferences through a centralized registry. To learn about how to opt out of interest-based advertising in general, click NAI Opt Out . Your mobile device settings may allow you to prevent mobile app platforms (such as Apple and Google) from sharing certain information obtained by automated means with app developers like us and other businesses.

Please note that if you disable your cookies and similar technologies, certain features of our Services may be disabled, and you could limit the functionalities we provide when you visit our Services.

How do our Services interact with third-party services and content
Prev
Next
We link to third-party sites and services, or otherwise display third-party content through our Services, for your convenience and information. These third-party sites and services may operate independently from us, and we are not responsible for these third parties’ information practices. The privacy practices of the relevant third parties, including details on the information they may collect about you, are subject to the privacy statements of these parties.

Here are examples of the types of third-party content and services available through or via our Services:

Interactive Maps
We may facilitate easy access to the online maps of content providers like Apple or Google to help you get quick location, driving, and contact information for our stores.
Sweepstakes, Contests, and Survey Sites
We may work with third-party service providers to run sweepstakes, contests, and surveys. Navigation to these sites may be seamless so that it appears you’re still using our Services. In these cases, the third party’s privacy policy may apply to any personal information you provide in connection with the event. Please take note of who’s running the event in question; and the terms, conditions, and policies that apply.
Social Networking and other Third-Party Sites and Services
We may facilitate easy access to third-party sites and online services, like social networks and other services that host user-generated content. This may include easy click-through access, the ability for you to share content on third-party services, or even “single sign-on” to these services. The third party’s privacy policy applies to any information or content you provide through these services.

What information do we share with, facilitate access to, or disclose to, third parties and our sister brands
Prev
Next

We may share information about you with certain third parties, as described below, and as otherwise described in this Policy.

Our Affiliated Entities
We may share the information we collect about you, such as your postal and email address, customer preferences and purchase history, with affiliated entities that operate our sister brands so they may market to you. If you don’t want this information shared with our affiliated entities, follow the instructions below in “What choices do you have over how your information is used”.
Service Providers, Processors, and Contractors
We provide or make available personal information, and your communications and interactive experiences with us, to third-party service providers, processors, and contractors whom we engage to provide services to us. These third-party services are integrated into the data and communications processing activities that are covered by this Policy. When you interact or communicate with us, you are also interacting and communicating with or through our third-party service providers and their technologies. These processing services and activities include fulfilling orders; processing payments; providing customer service through chatbots or voicebots; monitoring, recording, and using calls or text messages; monitoring activity on our Services; delivering surveys and related analysis (which could be combined with Services usage analytics); maintaining databases; hosting and operating our microsites, mobile websites and mobile applications; administering, sending and monitoring emails and text messages; delivering direct or online advertisements as described above; and providing consulting services.
For example, our automated chatbots and voicebots are provided to you by our third-party service providers, who process, record, and retain all chats (including the content of chats and information relating to your interactions) on our behalf. Some functionalities and experiences within our Services, such as our voicebot experiences, are facilitated by artificial intelligence (“AI”), including generative artificial intelligence (“GenAI”).

We provide or make available personal information to social networks to identify customers who are common to both parties. This enables us to market to you on these social networks.

Third-Party Payment Processors and Payment Platforms
We provide or make available personal information (including purchase and payment details) to third-party payment processors and payment platforms to facilitate your transaction. There are also instances where you may interact directly with these payment processors and platforms through our Services. Please review the privacy policies of these third parties to learn more about how they treat your personal information.
Other Marketers
We may sell or share your personal information with other marketers to send you offers for their products or services. We will obtain your consent for selling or sharing where required by applicable law. We may occasionally provide you with the opportunity to opt in to receive email messages from third parties. If you do opt in, we’ll share your email address with the specific third party in question. Please review the privacy policies of these third parties to learn more about how they treat your personal information.
Law Enforcement and Emergency Response
We also may disclose personal information about you in the following circumstances: (a) if we are required to do so by law or legal process (such as a court order or subpoena); (b) in response to requests by government agencies; (c) to establish, exercise, or defend our legal rights; (d) when we believe disclosure is necessary or appropriate to prevent physical or other harm or financial loss; (e) in connection with an investigation of suspected or actual illegal activity; or (f) otherwise with your consent.
Sale or Merger
We reserve the right to transfer your personal information in the event we sell or transfer all or a portion of our business assets (including, without limitation, in the event of a merger, demerger, spin-off, acquisition, joint venture, reorganization, dissolution, or liquidation).

What choices do you have over how your information is used
Prev
Next
We offer you certain choices in connection with the personal information we obtain about you.

Email
You may opt out of the Bath & Body Works email list by following the instructions located at the bottom of each commercial email. If you opt out, we may still send you operational or transactional messages, such as password-reset or account related information. You may also call us at 1-800-756-5005. For assistance, contact us via Telecommunications Relay Service (TRS) by dialing 711, or by using an Internet Protocol Relay Service.
Mobile Text Messaging
If you’ve signed up for mobile text messaging offers but later decide you no longer wish to receive these offers, simply follow the opt-out instructions included in the mobile message. We may send a final text message confirming instructions or asking for clarification regarding the scope of the opt-out request. Data and message rates may apply.
Mobile Push Notifications/Alerts
We may send push notifications or alerts to your mobile device. You can deactivate these messages at any time by changing the notification settings on your mobile device.
Location Information
You may have the ability to turn location-based services on and off by adjusting the settings of your Internet browser or mobile device or, for some devices, by adjusting the permission settings for our mobile apps to access your location information. Instructions for adjusting or disabling the location settings on our mobile app can be found here.
Postal Mail
If you’d like to specify your preferences for our postal mail, simply follow the instructions on the mailer; or dial 1-800-395-1001 (for our US and Canada customers) or +1-937-438-4197 (for our customers elsewhere). To reduce postal mail, click here select “Mailing Address Add/Update” as the topic, select “Unsubscribe me from the mailing list” as the Request Type, then complete and submit the form.
Cookies and Clear Gifs
Visit “How is technology used to serve our advertisements on other online services, and what choices do you have” to learn about how to specify your preferences over our use of cookie and similar technologies.

How do you update your personal information
Prev
Next
You may update or modify your billing- and shipping-related information, and other account information, by logging onto our Services (e.g., Your Account on bathbodywoorks.shop) or by calling us at 1-800-756-5005. For assistance, contact us via Telecommunications Relay Service (TRS) by dialing 711, or by using an Internet Protocol Relay Service.

How do we protect personal information
Prev
Next
We maintain administrative, technical, and organizational safeguards designed to protect the personal information we collect through our Services against accidental, unlawful or unauthorized destruction, loss, alteration, access, and acquisition.

Our administrative and organizational safeguards include implementing, maintaining, and training employees on company privacy and information security policies and procedures. Our technical safeguards include maintaining policies and standards that are designed to protect company systems and data, and a cybersecurity program overseen by our executive leadership team.

Do we collect children’s personal information
Prev
Next
Our Services are designed for a general audience and are not directed to children. We do not knowingly collect or solicit personal information from children (i.e., under the age of 13 or other relevant ages) through our Services. If you believe a child under such age may have provided us with personal information, please contact us as specified in the “Whom should you contact with questions or concerns” section of this Policy.

Where is personal information stored and processed
Prev
Next
Our employees involved in data processing and our servers are based in Columbus, Ohio, US, and other locations throughout the United States. We work with affiliated and unaffiliated service providers or processors in the United States, Canada, India, and other jurisdictions around the world.

Whom should you contact with questions or concerns
Prev
Next
General Inquiries
If you have general questions about our Policy, please contact us. Or contact us via:

ATTN: Privacy Matter
Bath and Body Works, Inc.
3 Limited Parkway
Columbus, OH 43230
USA

How will we communicate updates to our Policy
Prev
Next
This Policy may be updated periodically to reflect changes in our personal information practices. Changes to the Policy will be posted on this page. For significant changes, we will notify you by posting a prominent notice on our Services indicating at the top of the Policy when it was most recently updated.

How disputes concerning our Policy are resolved
Prev
Next
By using the Services, you agree to be bound and abide by our posted Terms of Use (the “Terms”) and this Policy. PLEASE SEE SECTION 11 IN OUR TERMS REGARDING YOUR LEGAL RIGHTS IN ANY DISPUTE INVOLVING OUR SERVICES, INCLUDING MANDATORY ARBITRATION AND A WAIVER OF RIGHTS TO A JURY TRIAL OR CLASS ACTION.

Supplemental Privacy Notice for Consumers in Certain States
Prev
If you are a California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia consumer (“Certain States”), the information below also applies to you, in addition to our Privacy Policy. For clarity, the information below applies to personal information we collect both on our Services and offline, such as in our physical retail stores.

What information do we collect and disclose
We may collect the following categories of personal information about you:
Identifiers (personal) (for example, name, alias, postal address, unique personal identifier, online and device identifier, IP address, email address, account name and number, telephone number, postal address).
Identifiers (others) (for example, insurance policy number, certain financial information, and health insurance information).
Personal characteristics, histories, and associations (including, for example, marital status, gender, age, and characteristics of protected classification under California or federal law).
Commercial Information (for example, products or services purchased, obtained, or considered; marketing histories; purchasing histories or tendencies; purchase profiles; shopping and retail browsing channel preferences; online browsing and website interaction histories; and direct marketing histories).
Biometric information (for example, signature; and physical characteristics).
Computing or mobile-device information and internet or other electronic-network-activity information (for example, online advertisement engagements; and cookies, tags, and similar device or user identifying information).
Geolocation information (approximate and precise) (including, for example, through the mobile app).
Audio and visual information (for example, videos you upload with a review or in-store security cameras).
Professional or employment-related information (for example, applications, professional history, and work history).
Education information (for example, education history when applying for an open position).
Inferences (for example, predictive information, purchase profiles, shopping profiles and characteristics).
Sensitive personal information (for example, social security number; driver’s license number or other state identification card number; login credential; and precise geographic information).
Financial information (for example, banking details and income level).
Payment card and transaction information (for example, credit card number; debit card number, and other financial information).
Household information (for example, family size and composition).
Incident-related information (for example, statements; or insurance, or similar claims).
We may have collected personal information about you from the following categories of sources:
You (for example, through your use of our Services).
Your computing or mobile devices.
Our technology (for example, through observed consumer interactions with us and through our Services).
Our Services and systems.
Our vendors.
Public records.
Our customers’ associations (e.g., through refer-a-friend or -family programs).
Social media networks.
Advertising networks.
Unaffiliated third parties.
We may collect, sell, share, or process personal information about you for the purposes described in the “How We Use the Information We Obtain” section of the Policy and for the following business or commercial purposes:
Facilitate accounting, auditing, and reporting.
Deliver analytics (machine generated through computing/mobile devices for performance, monitoring, personalization, and order processing).
Deliver advertising through technology (including, for example, to facilitate personalized content, remarketing, online display ads, and interest-based ads).
Deliver advertising through direct or mass media (including, for example, via email, SMS, telephone, post, and broadcasts).
Facilitate affiliate marketing.
Administer claims management, handling, and insurance.
Respond to incidents.
Deliver customer service.
Pursue legal matters.
Deliver and/or optimize website, mobile-app, and e-commerce services.
Facilitate information security.
Facilitate fraud monitoring and prevention.
Deliver logistics (including, for example, order management, shipping, and fulfillment).
Develop customer information for personalization.
Process, fulfill, and ship orders.
Deliver shopping and customer engagement (including events and experiences, such as contests, sweepstakes, previews, and shows).
Deliver social media engagement.
Conduct surveys.
Administer technology and ensure technology integrity (including, for example, by maintaining and improving networks; and identifying and fixing problems).
Process transactions and payments.
Develop, review, and test products and services.
Deliver Wi-Fi and similar online services (including in store-service).
Perform miscellaneous services.
We may have disclosed, sold, or shared your personal information with certain categories of service provider, contractors, processors, or third-parties as described below.
Categories of Personal Information Collected Categories of Service Provider, Contractor, or Processor to Whom Information is Disclosed for a Business Purpose Categories of Third-Party to Whom Information is Sold or Shared
Identifiers (Personal)
Analytics insights provider
Advertising vendor
Direct marketing (e.g., email, text, telephone, postal) vendor
Affiliated brands and entities
Contextual online experience provider
Customer service provider
Customer information provider
Data center
Event or experience provider
Focus group service
Fraud monitoring and prevention
Human resources service provider
Information security service provider
In-store Wi-Fi provider
Logistics provider, e.g., order management and fulfillment
Payment and transaction processor
Process, services, or technology development or improvement vendor
Product review vendor
Social media platform
Technology administration and integrity provider (including for maintaining and improving networks; identifying problems; and fixing problems)
Vendor, performing services in their own name through an independent consumer relationship, e.g., via consent
Vendor (miscellaneous) services
Advertising technology provider (including for online advertising) affiliated brand or entity
Affiliate marketer
Social media platform
Survey company
Identifiers (Other)
Fraud monitoring and prevention
Human resources service provider
Vendor, performing services in their own name through an independent consumer relationship, e.g., via consent
Not applicable
Personal Characteristics, History, and Associations
Analytics insights provider
Advertising vendor
Direct marketing (e.g., email, text, telephone, postal) vendor
Affiliated brands and entities
Contextual online experience provider
Customer service provider
Data center
Event or experience provider
Focus group service
Fraud monitoring and prevention
Human resources service provider
Information security service provider
Process, services, or technology development or improvement vendor
Product and fit tester
Social media platform
Solutions (miscellaneous) provider
Vendor, performing services in their own name through an independent consumer relationship, e.g., via consent
Vendor (miscellaneous) services
Advertising technology provider (including for online advertising) affiliated brand or entity
Affiliate marketer
Social media platform
Survey company
Commercial Information
Analytics insights provider
Advertising vendor
Direct marketing (e.g., email, text, telephone, postal) vendor
Affiliated brands and entities
Contextual online experience provider
Customer service provider
Data center
Event or experience provider
Focus group service
Fraud monitoring and prevention
Human resources service provider
Information security service provider
Process, services, or technology development or improvement vendor
Product and fit tester
Social media platform
Solutions (miscellaneous) provider
Vendor, performing services in their own name through an independent consumer relationship, e.g., via consent
Vendor (miscellaneous) services
Advertising technology provider (including online advertising), or affiliated brand or entity
Affiliate marketer
Social media platform
Survey company
Biometrics Not applicable Not applicable
Computing or Mobile Device Information, and Internet or Other Electronic Network Activity Information of End Users
Analytics insights provider
Advertising vendor
Direct marketing (e.g., email, text, telephone, postal) vendor
Affiliated brands and entities
Contextual online experience provider
Data center
Fraud monitoring and prevention
Information security service provider
In-store Wi-Fi provider
Solutions (miscellaneous) provider
Technology administration and integrity provider (including for maintaining and improving networks; identifying problems; and fixing problems)
Vendor, performing services in their own name through an independent consumer relationship, e.g., via consent
Social media platform
Vendor (miscellaneous) services
Advertising technology provider (including online advertising), or affiliated brand or entity
Affiliate marketer
Social media platform
Survey company
Geolocation (Approximate and Precise)
Analytics insights provider
Advertising vendor
Affiliated brands and entities
Contextual online experience provider
Customer service provider
Data center
Fraud monitoring and prevention
Human resources service provider
Information security service provider
In-store Wi-Fi provider
Logistics provider, e.g., order management and fulfillment
Vendor, performing services in their own name through an independent consumer relationship, e.g., via consent
Social media platform
Advertising technology provider (including online advertising), or affiliated brand or entity
Social media platform
Affiliate marketer
Survey company
Audio and Visual Information
Analytics insights provider
Advertising vendor
Affiliated brands and entities
Contextual online experience provider
Customer service provider
Data center
Fraud monitoring and prevention
Vendor, performing services in their own name through an independent consumer relationship, e.g., via consent
Advertising technology provider (including online advertising), or affiliated brand or entity
Affiliate marketer
Social media platform
Survey company
Professional or Employment-Related Information
Human resources service provider
Focus group service
Vendor, performing services in their own name through an independent consumer relationship, e.g., via consent
Not applicable
Education Information
Human resources service provider
Focus group service
Vendor, performing services in their own name through an independent consumer relationship, e.g., via consent
Not applicable
Inferences (Predictive Information)
Analytics insights provider
Advertising vendor
Direct marketing (e.g., email, text, telephone, postal) vendor
Affiliated brands and entities
Contextual online experience provider
Customer service provider
Data center
Event or experience provider
Focus group service
Fraud monitoring and prevention
Human resources service provider
Information security service provider
Process, services, or technology development or improvement vendor
Product and fit tester
Social media platform
Solutions (miscellaneous) provider
Vendor, performing services in their own name through an independent consumer relationship, e.g., via consent
Vendor (miscellaneous) services
Advertising technology provider (including online advertising), or affiliated brand or entity
Affiliate marketer
Social media platform
Survey company
Sensitive Personal Information
Customer service provider
Human resources service provider
Fraud monitoring and prevention
Information security service provider
Logistics provider, e.g., order management and fulfillment
Payment and transaction processor
Not applicable
Financial Related Information
Customer service provider
Human resources service provider
Payment and transaction processor
Not applicable
Payment Card and Transaction Information
Customer service provider
Fraud monitoring and prevention
Information security service provider
Logistics provider, e.g., order management and fulfillment
Payment and transaction processor
Not applicable
Household Information
Analytics insights provider
Direct marketing (e.g., email, text, telephone, postal) vendor
Not applicable
Incident-Related Information
Information security service provider
Fraud monitoring and prevention
Vendor, performing services in their own name through an independent consumer relationship, e.g., via consent
Not applicable

We do not have actual knowledge that we sell or share personal information of consumers under the age of 16. Also, we do not use or disclose any sensitive personal information for purposes other than those authorized by you or as permitted by law. For more information on our policy regarding sensitive personal information, please click “How is Sensitive Personal Information processed”.

What are your data rights in Certain States
a. Consumer Requests
You have the right to access, up to twice in a 12-month period (depending on the law in your state), the personal information we have about you. In addition, you may have the right to request that we delete or correct certain personal information that we have collected from you. To submit a request, visit Your Data Rights or call us at 1-800-756-5005 to request: Access / Confirmation Correction / Rectification Deletion / Erasure

For assistance, contact us via Telecommunications Relay Service (TRS) by dialing 711, or by using an Internet Protocol Relay Service. To help protect your privacy and maintain security, we take steps to verify your identity before granting access to specific pieces of personal information or complying with a deletion or correction request.

b. Authorized Agent Requests
To submit a request as an authorized agent on behalf of a California consumer, visit Your Data Rights. On the form, you will need to add your email address and information about the individual for whom you are submitting the request in the other required fields. Please add your name and phone number in the Request Details field and an indication that you are submitting the request as an authorized agent. We will require the authorized agent to verify its own identity and submit proof that the consumer has given signed permission for the authorized agent to submit the request.
To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request.

c. Appeals
We will make every reasonable effort to fulfill Your Data Rights request. However, if we are unable to fulfill your request, we will provide you with instructions to appeal, as applicable for your state. We may also have a person from our Privacy Team reach out to you with additional questions or to address your specific concerns.

d. Do Not Sell or Share My Personal Information / Targeted Ad Preferences
You have the right to opt out of certain processing activities, such as “targeted advertisings” and “sales” or “sharing” of personal information, as those terms are defined under the respective state’s privacy law, and profiling in furtherance of decisions that produce legal or similarly significant effects. This right can be exercised by you or an authorized agent. If you are a resident of a Certain State, you may submit your request to opt out by visiting Your Privacy Choices or calling us at 1-800-756-5005. For assistance, contact us via Telecommunications Relay (TRS) Service by dialing 711, or by using an Internet Protocol Relay Service.
We also recognize Global Privacy Control (“GPC”) signals from your web browser or web browser extension to opt you out of the selling or sharing of any personal information that is derived through your web browser. For more information about GPC, please visit Global Privacy Control.

e. Shine the Light Rights
Under California law, we provide you with a cost-free means to opt out of our sharing your information with third parties with whom we do not share the same brand name, if that third party will use it for its own direct marketing purposes. Visit Your Privacy Choices to make your request.

f. Right to Non-Discrimination or Retaliatory Treatment for Exercise of Privacy Rights
You, whether as a consumer, employee, former employee, applicant, or contractor, have the right to exercise your privacy rights without receiving discriminatory or retaliatory treatment. If you exercise any of your privacy rights, including the right to restrict the selling or sharing of your personal information, you will not be treated differently from those who do not exercise their privacy rights.

Notice of Financial Incentive / Bona Fide Loyalty Program Disclosure
We provide price discounts, coupons, services and other perks for (1) members of our rewards programs; (2) customers who buy specific products or use specific services; (3) recipients of our marketing who were presented with and took advantage of an incentive to sign up; (4) app subscribers who were presented with and took advantage of an incentive to download the app; and (5) entrants and winners of our sweepstakes (collectively “programs”). Consumers provide us with some personal information when they sign up for our programs. There is no obligation to opt in and consumers may opt out at any time.

We invest resources in and offer these programs to, among other things, enhance our relationship with you, show you the products and services we believe you’ll enjoy, and deliver value. The value to our business of any individual consumer’s personal information depends on a number of factors, including, for example, whether and to what extent you take advantage of these offerings, our ability to learn about you and your shopping preferences and history to show you products and services we believe you will enjoy, whether and to what extent you respond to our offers, and coupons, services, and perks, and whether we are able to enhance this information through our efforts described below.

Our ability to create any value from the programs is heavily based on our ability to develop and use information. We do not calculate the value of consumer information in our accounting statements. Rather, we make a good faith estimate for California residents. To the extent we create overall value from our programs for our business that could be directly or reasonably related to the value of customer information, the calculation method would include (1) the expenses associated with the program offer and associated operations, (2) the expenses related to the collection, retention and enhancement of customer’s personal information, and (3) all other expenses reasonably related to these programs.

You may opt into or opt out of our programs at any time through the means offered or delivered, or by contacting Customer Care or by using the Live Chat feature.
Back to Top

How is Sensitive Personal Information processed
We will only process sensitive personal information where it is reasonably necessary for the purposes of carrying out our legal obligations or exercising specific rights as permitted by law. Sensitive personal information is any information that reveals your race, ethnic origin, religious beliefs, mental or physical health condition, treatment, or diagnosis, sex life or sexual orientation, citizenship or citizenship status, genetic or biometric data, personal information of a known child, or precise geographic data. For example, we may share financial or other data to provide customer service, process or fulfill orders and transactions, verify your information, or process payments. For any other use, we will obtain your explicit consent. For example, if you consented to precise geographic location when installing our mobile app, we may use this information to provide you with store locations and distances to such locations. If you did not consent, we will use approximate geographic data or geographic data based on your input (e.g., zip code).

When installing the Bath & Body Works app, you may have given the app permission to access the precise geographic location data from your phone’s operating system. If you wish to change this setting, you may do so through the app. Within the app, go to the More function at the bottom of the screen. Then go to App Settings and find Permissions. Under Location Permission, you can turn off “Use precise location” if you wish to change to approximate location setting. You can also select “Don’t Allow” or “Ask every time.” Your phone-specific operating system may also allow you to change the permission settings. Please review your operating system instructions as they may be different for each operating systems and versions.
Back to Top

What is our retention policy for each category of personal information
We retain information as necessary to effectively service our customers; provide relevant product assortments and advertisements; assist you with customer service-related matters; and comply with our legal obligations. The need to retain personal information varies widely with the type of information and the purpose for which it was collected. We strive to ensure that personal information for the period required to fulfill the purposes for which it was collected and is deleted when no longer required per our retention policies.

This policy covers all information, including sensitive personal information, collected by us and stored on our owned or leased systems and media, regardless of location. It applies to both information collected and held electronically (including photographs, video and audio recordings) and information that is collected and held as hard copy or paper files. The need to retain certain information may be mandated by federal, state or local laws or regulations, legitimate business purposes, litigation hold, or any combination thereof.

We retain all categories of consumer personal information to:
service our customers who are actively engaging with us and for a set period thereafter;
comply with applicable labor, tax and immigration laws;
comply with other regulatory requirements;
investigate security incident or other investigation;
preserve Intellectual property rights; and
assist in defense or prosecution of any litigated or threatened matter.
When the retention period for the information as outlined above expires, we will destroy the information covered by this policy.

Privacy Policy

Login