Additional Proxy Soliciting Materials (Form DEFA14A)

UNITED STATES

SECURITIES AND EXCHANGE COMMISSION

Washington, D.C. 20549

SCHEDULE 14A

Proxy Statement Pursuant to Section 14(a) of the

Securities Exchange Act of 1934

(Amendment No. )

Filed by the Registrant ☒

Filed by a party other than the Registrant ☐

Check the appropriate box:

Victoria's Secret & Co.

(Name of Registrant as Specified in its Charter)

(Name of Person(s) Filing Proxy Statement, if other than the Registrant)

Payment of Filing Fee (Check all boxes that apply):

On May 18, 2026, Victoria's Secret & Co. (the "Company") launched a website, VSPathtoPotential.com (the "Website"), in connection with the Company's 2026 Annual Meeting of Shareholders. A copy of the materials can be found below.

VICTORIA'S SECRET &CO. Home Our Board News & Resources How to Vote Contact Legal Notices Protect Victoria's Secret & Co.1s Momentum VS&Co's Transformation is Creating Value for Shareholders Since the announcement of Ms. Super's appointment in August 2024, VS&Co has delivered a total shareholder return ("TSR") of 141%, significantly outperforming the peer group used by research analysts, the S&P 500 Consumer Discretionary Distribution Retail index and the S&P 600.1

Home Our Board News & Resources How to Vote Contact Legal Notices Cookiesand Tracking Technologies This site uses strictly necessary cookies to ensure secure navigation and core functionality. No analytics, advertising. tracking cookies are used. Privacy Policy

Increase In Median Analyst Pnce Target Since TSR Since Announcement of Hillary Super's Announcement of Hillary Super's Appointment Appointment as CEO on Aug 14, 2024 as CEO on Aug. 14, 2024 141% • "of Buy Ratings 2 Total Shereholder Return PrlceTarget2 +155% +103% +114% Ml(-ln~Anliyttprb 283% ~-ao~1 r r r $67.00 I 38% 27% $17.50 (14%) S&P500 S&P600 Peers Used by Analysts Consumer Aug2024 Today Discretionary Retail Index 1 anal~t Source: Factset as ofMay 15, 2026. measured against price at close on unaffected date ofAugust 13, 2024, the 2. Median oflatest research tarfJ.!l_t prices as ofMarl§. date before the public announcement ofMs. Supels appointment. Analyst peer group Includes peers ~measured against median oflatest analyst research referenced by at least one analyst In Initiating coverage research reports and Is comprised ofAbercrombie & target prices as ofAugust 13, 2024, the date before the pub/le Fitch, American Eagle, Gap, Urban Outfitters, Levi, Buckle, Garters, Torrid, Lululemon, Arltzla, Bath & Body announcement ofMs. Super's appointment %ofBuy Ratings Works, Gaprt, DIiiard's, Genesco, J.J/11, Kohl~, Macy's, The Chlldren~ Place, Tiffy's, Tapestry, zumfez, H&M, Includes analyst research reports that Issue price targets. Indus tr/a de Dlseno Text II (Inditex) and Vera Bradley. The S&P 500 Consumer Discretionary Distribution & Reta// Index Is a point of comparison referenced by BBRC In Its pub/le fetter dated May 4, 2026. The Path to Potential Strategy is Driving VS&Co's Transformation and Unlocking Value Supercharge Our Bra Recommit to PINK Fuel Growth in Beauty Evolve our Brand Authority Projection and Go-to-Reignited PINK, Grew $1B business Market Startegy Reasserted leadership delivered strongest with Bombshell, in bras growth year in a America's #1 fragrance Grew our customer file decade for the first time in years and are gaining market share Your vote on the WHITE card protects this strategy. How to Vote >

Our Director Nominees Regular Refreshment The Right Skills Three new independent, highly The Board has the right mix of skills qualified directors added since 2022. and perspectives to continue creating value for shareholders. Hillary Super Donna James Irene Chang Britt Chief Executive Officer. Victoria's Secret & Co. President and Chief Executive Officer, Lardon & Former President and Divisional Chief Executive Officer. Associates Pepperidge Farm Sarah Davis Jacqueline Hernandez Rod Little Former President Loblaw Companies Limited Founder and Chief Executive Officer. New Majority Ready Chief Executive Officer. Edgewell Personal Care Company David McCrelght LauLauren Peters Anne Sheehan Former Chief Executive Officer. CarMax, Inc. Former Chief Financial Officer. Foot Locker. Inc. Former Chair of Investor Advisory Committee. Securities and Exchange Commission

VICTOR IA·~ SE(;Rl;T &Co X Hillary Super Hillary Super is a dynamic and transformative retail leader with over three decades of experience driving growth and innovation across renowned fashion brands. As CEO and board member of Victoria's Secret & Co., she combines her extensive industry and merchant expertise, creative insight, and operational discipline to drive the company's transformation and execute long-term strategic initiatives. With a keen understanding of consumer preferences. including a deep understanding of the intimates. apparel. and beauty categories. Hillary excels at spotting trends and driving brand resonance. She has a talent for assembling high-performing teams and amplifying their ideas into bold. high-impact outcomes. Before joining VS&Co. she served as CEO and board member of Savage X Fenty, where she showcased her ability to understand and cater to consumer needs while staying ahead of market trends. Prior to that, Hillary was the Global CEO of Anthropologie Group, where she successfully led the turnaround of the women's apparel and accessories business. positioning the brand as a global lifestyle leader across fashion, beauty, and home. Earlier in her career, Hillary held key merchandising and operational leadership roles at Gap, Old Navy, American Eagle Outfitters, and Guess?. Through these roles, she earned a reputation as a visionary leader, trusted for her expertise in women's retail. brand evolution, and her ability to forge strong connections with customers. Today, Hillary's passion for building high-performing teams, delighting the customer at every turn and understanding consumer behavior continues to shape the future of Victoria's Secret & Co.. further cementing its place as the leader in the intimates industry. V ICTO RIA'S SECRET &CO. X Donna James Donna is a seasoned veteran of public company boardrooms. having served as a director at ten public companies over the past two decades. Donna's financial expertise and leadership experience as an executive and public company director. coupled with her deep understanding of VS&Co, its history, and the industry in which it operates, equip her with the wisdom and skills to effectively lead the VS&Co Board. She was instrumental in the CEO search process and the creation of the Company's Path to Potential strategy. Donna is also a proven value-creator. evidenced by an average total shareholder return of 349%. outperforming the S&P 500 by 196% during her time on multiple public company boards.1 Donna is not afraid to ask tough questions and challenge management's strategies and assumptions. She engages regularly with the investor community and is a valued sounding board for the CEO and other members of the executive leadership team. 1 Source: FactSet (5/8/26), Company filings. Total shareholder returns' average over length of tenure are compared against S&P 500 average and assume dividends are re-invested on ex-dividend date. Donna James's directorship at Marathon Petroleum includes her position as independent director from July 2011 through October 2018 but not subsequently as board advisor:. Other directorships included are Victoria's Secret, Hartford Insurance, American Electric Power, Boston Scientific, Bath & Body Works, Time Warner, Coca-Cola Europacific Partners and CNO Financial Group.

Vi TORIA EC RET & CO. X Irene Chang Britt Irene has a broad range of experience and skills pertinent to global business operations, especially within the retail industry, gained from her numerous leadership positions and public directorships, including at sector-leading consumer companies. Irene led Campbell's second largest global reportable segment. with net sales exceeding $2.4 billion annually during her tenure. She has significant experience in business transformation and is an expert in human capital management. branding. and marketing. Irene is a thoughtful and strategic leader of the Human Capital and Compensation Committee. As Chair of the committee, Irene leads the critical work of overseeing VS&Co's executive compensation program and succession planning for the executive management team. She guided the development of VS&Co's inaugural executive compensation program and is constantly exploring ways to more effectively motivate executives and integrate their interests with those of our stockholders. V I T RI A' E RET& 0 . X Sarah Davis A seasoned public company executive and director. Sarah served as Chief Financial Officer, Chief Administrative Officer, and President of Loblaw Companies Limited, one of Canada's largest omnichannel retailers of grocery, pharmacy, and beauty products with over $53 billion CAD in revenue in fiscal 2021. At Loblaw. Sarah had a broad portfolio of responsibilities including corporate strategy, supply chain. information technology, real estate, and human resources. When Sarah retired from the company in 2021. the Loblaw loyalty program had 16 million members. almost one for every household in Canada. Sarah brings value to the VS&Co Board through her corporate finance expertise and public company board experience. Her knowledge as an accountant and experience in various executive leadership roles are critical to leading the strategic and oversight functions of the Audit Committee.

VI TORIA'S SEC RET & CO. X Jacqueline Hernandez Jacqueline brings business and cultural fluency in many ofVS&Co's key markets, notably U.S. Hispanic and North America. As VS&Co develops and executes its go-to-market strategy through the lens of a product-led entertainment brand, the Board and management team benefit greatly from Jacqueline's insights and experience in brand transformation and multimedia marketing. When it comes to multicultural and youth consumer marketing, Jacqueline is an expert. Her business leadership experience makes her a trustworthy authority on long-term and short-term strategic planning, brand transformation, and consumer insights. VI CTO RIA'S E RET & CO. X Rod Little Rod brings 30 years of experience in the global consumer goods industry, significant public company leadership and finance experience, and a strong track record of driving results. As Chief Executive Officer of Edgewell Personal Care Company, one of the world's largest manufacturers and marketers of personal care products in the shaving. grooming. sun and skin care categories. Rod accelerated growth and margin expansion of a highly profitable business. Rod has also served as Chief Financial Officer for three publicly traded companies. Before beginning his career in the consumer goods industry, Rod served as an officer in the United States Air Force for five years. As the CEO of a multinational. publicly traded consumer products company with decades of experience in the industry, Rod's guidance strengthens our ability to unlock long-term stockholder value through informed oversight of our strategic initiatives.

VITORiA' E RET&CO. X David Mccreight David has over twenty years of executive leadership experience leading prominent retail brands in highly competitive and fast-evolving marketplaces. He is an expert in omnichannel retail strategy and brand transformation, especially within the women's apparel and accessories industry. David served as Chief Executive Officer of Lulu's Fashion Lounge, Inc .. a digitally-native fashion brand, and as President of URBN. Inc .. a multi-billion dollar. multi-brand, multi-channel international retailer. David also served as Chief Executive Officer of Anthropologie, where he led the company's transformation from a store-centric brand to a best-in-class omnichannel platform while enhancing the brand experience. David's vast retail experience and expertise bring significant value to the VS&Co Board, especially as the Board oversees the refinement and execution of our long-term strategic growth plan. VITORiA" SECRET&CO. X Lauren Peters Lauren is a seasoned financial executive and Certified Public Accountant with over 30 years of financial experience in the retail industry. During her executive career at Foot Locker, Lauren led development of the strategic planning process, digital transformation, and several acquisitions and divestitures. Her leadership experience with consumer focused, omnichannel, global retailers, together with her financial and strategic planning expertise and public company board experience. make her an asset to the VS&Co Board. Lauren's accomplishments as Chief Financial Officer of Foot Locker are evident in the way she provides strategic counsel and guidance to the VS&Co Board and Audit Committee. Lauren knows what it takes to be successful in the competitive specialty retail environment.

V I TORIA E RET&CO. X Anne Sheehan Anne is a renowned governance expert, having served as Chair of the SEC's Investor Advisory Committee for eight years and as Director of Corporate Governance at Cal ST RS, one of the largest pension funds in the United States, for ten years. In these and other roles, Anne was a leader in navigating complex legislative, regulatory, and shareholder relations affairs. Anne is a founder of the Investor Stewardship Group and serves on the advisory board of the Rock Center for Corporate Governance at Stanford Law School. Anne utilizes her deep knowledge, understanding of investor perspectives, and experience in all aspects of corporate governance to lead the Nominating and Governance Committee and provide valuable insight to the Board. Anne has seen it all when it comes to corporate governance and investor relations. She is a trusted leader in this space and knows the players, options, risks, and opportunities. Your Boa rd is - Decisive action to strengthen leadership -appointed Hillary Super as CEO Overseeing a New - Supported the management team as they execute Phase of Momentum the Path to Potential strategy The Board's actions have directly resulted in - Drove operational discipline through targeted VS&Co's successful turnaround. Continuing this investment in stores, digital and customer momentum and creating long-term shareholder experience; emphasis on higher-quality sales; value remain the Board's top priorities. increased focus on cost control - Oversaw refresh of over half of the senior leadership team following Hillary's appointment

Track Record of Engagement with BBRC The Board is disappointed that BBRC and its Chairman, Brett Blundy, have launched a campaign that appears to be a response to the Board's decision not to appoint him as a director. Engagement has unfolded as follows. 2021-2023 Early engagement Across multiple years of interactions, Mr. Blundy's primary focus has been to obtain a Board seat. 2023 First evaluation At Mr. Blundy's request for a Board seat, the Board conducted a thorough and independent January 2024 Board rejected Mr. Blundy After a thorough evaluation, the Board rejected Mr. Blundy's candidacy due to concerns over the significant reputational risk appointment would pose to VS&Co. May 2025 Board adopted a rights plan Following BBRC's rapid increased share accumulation, the Board adopted a limited duration shareholder rights plan designed to protect the best interests of all shareholders.

Track Record of Fall 2025 Engagement with Board rejected Mr. Blundy a second time BBRC Mr. Blundy once again requested to be appointed to the Board, and following a thorough vetting The Board is disappointed that BBRC and its process, the Board rejected Mr. Blundy's Chairman, Brett Blundy, have launched a candidacy, concluding his appointment would introduce serious reputational, legal, conflict-of-campaign that appears to be a response to interest. and governance risks. the Board's decision not to appoint him as a director. Engagement has unfolded as follows. November 2025 Board offered resolution The Board proposed a framework for a collaborative resolution - a mutually agreed director, input on a capital-allocation review, and a longer-term information-sharing agreement. Mr. Blundy responded by repeatedly demanding to be added to the Board and threatening a proxy contest May 2026 BBRC launched proxy contest BBRC launched a withhold campaign. The Board remains focused on executing the Path to Potential strategy.

The Path Forward The Board Remains Focused on Delivering Value for Our Shareholders The Board has full confidence in the Path to Potential strategy and the leadership team's ability to continue executing, and unanimously supports VS&Co's Chair Donna James. We believe BBRC's proxy campaign distracts from the progress the Company is making and threatens the momentum of its Path to Potential strategy. VICTORIA'S SECRET&CO. Home News & Resources Howto Vote Contact Legal Notices Privacy Policy © 2026 Victoria's Secret & Co. All rights reserved.

Information Center News & Resources Shareholder Materials May 18th 2026 VS&Co Letter to Shareholders Highlighting Strong Performance, Significant Shareholder Value Creation and Continued Momentum Under Current Leadership May 11th 2026 Victoria's Secret and Co. Letter to Shareholders Highlighting Outperformance May 11th 2026 Victoria's Secret and Co. Supplement to Definitive Proxy Statement May 1st 2026 Victoria's Secret and Co. Definitive Proxy Statement Press Releases May 18th 2026 Victoria's Secret & Co. Issues Letter to Shareholders Highlighting Strong Performance, Significant Shareholder Value Creation and Continued Momentum Under Current Leadership May 6th 2026 Victoria's Secret & Co. Files Supplement to Definitive Proxy Statement and Sends Letter to Shareholders Highlighting Outperformance May1st2026 Victoria's Secret & Co. Board Comments on BBRC's Distracting Proxy Contest; Underscores Significant Outperformance and Board's Commitment to Acting in the Best Interest of Shareholders View All News & Resources Support Need help voting your shares? If you have any questions or require any assistance with voting your shares, please call the Company's proxy solicitor. Contact lnnisfree M&A >

Shareholder Action How to Vote Your vote is important. To ensure your shares are represented at the Annual Meeting, please submit your vote promptly Your Vote Matters Use the WHITE proxy card and vote "FOR" all 9 VS&Co nominees. With your support, VS&Co can continue to focus on executi ng its Path to Potential strategy and delivering value for shareholders. Annual Meeting - June 11,2026 Three Ways to Submit Your Vote Internet Telephone Mail Submit your proxy online via the Submit your proxy by calling toll-free If you do not have access to a touchinternet by accessing the website in the U.S. or Canada the number tone telephone or to the internet, specified on your universal WHITE specified on your enclosed universal please sign, date, and return the proxy card. Then,follow the WHITE proxy card. Then, follow the universal WHITE proxy card that was instructions provided on the voting voice prompts. enclosed with your mailed proxy, site. You will be required to provide the unique control number found Allow su fficieni mail time to ensure your proxy is received before Submit your poxy online by accessing the website specified on on the universal WHITE proxy card that was enclosed with your the Annual Meeting. you can use the postage-paid envelope your universal WHITE proxy card, then, follow the mailed proxy. enclosed with your mailed proxy. provided on the voting site.

Look for the WHITE proxy card. To support VS&Co's Board, vote ONLY on the WHITE proxy card. Disregard any other-colored proxy cards you may receive.. Vote "FOR" all 9 VS&Co nominees Support Need help voting your shares? If you have any questions or require any assistance with voting your shares, please call the Company's proxy solicitor. Contact Innisfree M&A >

Get in Touch Contact If you have any questions or require any assistance with voting your shares, please call the Company's proxy solicitor. Proxy Solicitor Innisfree M&A Incorporated For shareholder questions & voting assistance Shareholders - Toll-Free Shareholders - International + 1(877)750-0831 +1(412)232-3651 From the U.S. and Canada From al/ otter countries Banks & Brokerage Firms +1 (212)750-5833 Collect Victoria's Secret & Co. Investor Relations Media Relations Victoria's Secret & Co. Victoria's Secret & Co. Brooke Wilson [email protected] [email protected] Edelman Smithfield Innisfree M&A External Communications Proxy Solicitor [email protected] See above for phone numbers

Forward-Looking Statements This communication contains forward-looking statements within the meaning of the U.S. Private Securities Litigation Reform Act of 1995. These statements, which may be identified by words such as "estimate," "commit," "will," "target," "forecast" "goal" "project" "plan," "believe," "seek," "strive," "expect," "anticipate," "intend," "continue," "potential" or similar expressions, involve risks and uncertainties, many beyond the Company's control, that could cause its actual results to differ materially from those expressed or implied in the forward-looking statements. These risks and uncertainties are described in greater detail in "Item 1A. Risk Factors" in the Company's 2025 Annual Report on Form 10-K filed with the Securities and Exchange Commission ("SEC") on March 20,2026 and other SEC filings made by the Company. All forward-looking statements are madeonly as of the date of this communication. Except as may be required by law, the Company assumes no obligation to make publicly available any update or other revisions to any of the forward-looking statements contained in this communication.

victoria'sSecret&Co. This Policy was last updated on January 1,2026 The following Privacy Notice ("Notice") explains how Victoria's Secret and its associated brands and subsidiaries, including Victoria's Secret, Victoria's Secret PINK, Victoria's Secret Beauty, and Victoria's Secret Swim (collectively, "Victoria's Secret," "VS," "we," "our," or "us"), processes personal information we collect from and about you when you engage with us on our websites, blogsites, microsites, and mobile websites (each, a "Site"), our mobile applications (each, an "App"), and our social media pages, including your use of interactive features, widgets, plug-ins, content, downloads, and/or other online services that we own and control (our "Features," and, collectively with our Sites and Apps, our "Platforms") where a link to this Privacy Notice is posted. This Privacy Notice also applies to personal information we collect offline, such as when you visit our retail stores or attend VS events, or when we communicate with you by phone, text, e-mail, or chat (collectively, our "Services"). As referred to in this Notice, "Victoria's Secret" refers to Victoria's Secret Direct Brand Management, LLC, or Victoria's Secret Stores Brand Management, LLC, and other companies affiliated with these companies. This Privacy Notice applies to customers, prospective investors, job applicants and former employees, and other visitors to and users of our Platforms and Services ("you'' or "consumers"). Job applicants should also refer to our Job Applicant Privacy Addendum located at the end of this Privacy Notice. Individuals currently employed by Victoria's Secret should refer to the applicable VS Associate Privacy Notice. For purposes of this Privacy Notice, the term "personal information" means information related to an identified or identifiable person. VS processes personal information in accordance with applicable laws, which vary by region. Where required, separate region-specific terms are included at the end of this Privacy Notice. This Notice also covers rights and choices you have under applicable laws related to your personal information. These rights may vary depending on where you live. See the section "Your Privacy Rights and Choices" and region-specific terms for more information. PERSONAL INFORMATION WE COLLECT VS collects various types of personal information about you through our Platforms and Services in three primary ways: directly from you, automatically, and from other sources.

Collected directly from you. You provide us with your personal information when you create an account, sign up to get our emails, buy from us, or contact us. You may provide us with contact information, account and loyalty information, and commercial and communications records, as well as content you generate and submit to us. Read more below about the types of information we collect directly from you: • Account and Loyalty Information-When you create a VS customer account or participate in the VS & PINK Rewards Program, we collect your Contact Information (described below), as well as other optional information you may give us to personalize your profile, such as your birth month and day, clothing sizes, style and shopping preferences, personal interests and traits, and product wish list. We also maintain records about your VS shopping and purchase history, including items you add to your VS and PINK online shopping bag. • Contact and Identification Information-When you make product purchases, exchanges, or returns, or when you otherwise request our Services or interact with us on our Platforms, we may collect information such as your (or your gift recipient's) name, phone number, e-mail address, billing and shipping address. We may also collect your driver's license number, social security number, or other government identification number when you submit an application as part of the Victoria's Secret Credit Card Program. • Commercial Records-When you make product purchases, exchanges, or returns, or when you redeem loyalty rewards or other promotional incentives, we collect your payment information and other details about your order. When you visit our Platforms, we may also collect your location information when you select your geographic region for customized language and currency options. • Communications Records-When you interact with VS via email, phone, text, or online chat, or any other remote or inperson communication method, we may collect, record, and transcribe the information and content you share with us, including information such as your Contact Information (described above) and the content, details, and circumstances surrounding the communication. • Customer Submitted Content-You may choose to interact with us and share your information on public forums like our social media pages and community spaces on our Platforms, provide feedback and product reviews on our Platforms or through our other Services, or participate in surveys or submit photos and other personal information when you participate in our VS & PINK Creator Program. Collected automatically. We collect information about you automatically when you visit our Platforms and stores and interact with us through our Services. We use automated tracking technologies such as cookies, pixels, and other similar technologies, server logs, and other tools on our website or apps to collect personal information from your device or browser when you engage with VS. We may automatically collect personal identifiers, device and usage information, location information, as well as information about your internet activity, and certain other audio, visual, and electronic information. Read more below about the methods we use and what personal information we automatically collect about you: Personal Identifiers-VS uses elements of your contact information to create pseudonymous identifiers, such as a customer ID, that we use internally to manage the personal information we collect and maintain about you, such as your Commercial Records and Account and Loyalty Information (each described above), and other information we may collect about you, like your online purchasing histories, preferences, behaviors, and interests. Device and Usage Information-VS uses automated tools and technologies to automatically collect device, usage, and activity information when you access our Platforms, use our Services, interact with our advertisements, and visit certain third-party websites and apps. VS may store this information in log files. Many tools and technologies we use are provided by third parties. Using these tools, VS may collect the following types of personal information about you: Device, Usage, and Performance Data: We collect certain information about the device you use to access VS Platforms and certain third-party sites and apps, including things like the device model, operating system and version, and browser version. We also collect information about how you use and interact with our Platforms and Services via your device, including through use of session replay technology. Examples of such information include the dates and times you access certain sites and your activities and behaviors on certain pages or screens you view (such as how long you spend on pages or screens and the routes by which you access them, products viewed, hyperlinks clicked, mouse movements, page or screen scrolling, and keystrokes). We may also collect information about searches you conduct on our Platforms, and technical information like app crashes and other system activity.

Identifiers: We collect certain data points that can be used to directly identify you or your device. These identifiers can recognize you over time and across VS Platforms and other third-party platforms and services, and include things like your IP address, device and browser identifiers, advertising IDs (such as the ID for Advertising (IDFA) on Apple devices, and the Advertising ID on Android devices), cookies, pixels, beacons, and other tracking technologies, and other types of identifiers. ¦ internet Activity We use cookies, pixels, beacons, embedded scripts, and other tracking technologies to collect information about your visits to our Platforms, your use of our Services, and how you interact with our advertisements. We may also collect information about the websites or apps you visit before and after interacting with our advertisements, using our Services, or visiting our Platforms. See below for more information about these tracking technologies. Location information: If you enable your device settings to permit device location tracking, we may collect information about your precise location in order to direct you to the nearest VS store location or for other purposes. You can change these preferences at any time in your device settings. Analytics and Inferences-When you communicate with us through our Services, such as contacting VS customer service, or interact with us or visit our online Platforms, we use automated tools and technologies that automatically collect and infer information about you from those interactions and other information we may collect from other sources. We may use these technologies to collect or infer information described above like identifiers, Internet Activity, and Location Information, as well as other audio, visual, or electronic data. These technologies include session replay, which is a tool that records your behavioral interactions with our site and app, and which we use for quality assurance purposes. These and other analytics tools assist with data analysis to help improve customer experience on our Platforms, and which, depending on the tool, may also help us to infer or generate information about you, such as your product preferences and other interests. See the "Tracking Technologies" section below for more information about the tracking technologies we use. In-Store- Theft Prevention, Safety and Security- When you visit our stores in-person, we automatically collect personal information about you for purposes of safety, security, and theft prevention. We may collect some of the information listed above like Identifiers and Location Data. We may also collect other audio, visual, and electronic information about you through in-store Closed-Circuit Television (CCTV) video recordings. See below for more information about other theft-prevention devices like Radio Frequency Identification (RFID), which does not collect your personal information. Wi-Fi Network Access-When you visit some VS stores in-person, we may allow you to connect to the VS Wi-Fi network via access points. Connecting to our Wi-Fi network allows us to collect certain information about you and your device, such as your Device and Usage Information, Internet Activity, and Location Information, as described above. Tracking Technologies-To better understand how you interact with VS Platforms and Services both online and offline, as well as to offer you a more personalized shopping experience, VS may collect information about you using cookies, pixels, clear-gifs, web beacons, tags, and similar tracking technologies. A cookie is a small amount of data that's stored by your browser on your device. A pixel (also known as a clear-gif, web beacon or tag) is a small graphic image on a web page, webbased document or email message.ln addition to personalizing your shopping experience and serving you advertising tailored to your specific interests, these types of tracking technologies are used to collect information about your interactions with our Platforms and Services, including information about the site, page, document, or email that you viewed and when you viewed it. They are also used to maintain items in your shopping cart and remember you and your online purchases when you visit VS Platforms. Some of these technologies are considered necessary to the operation of our Platforms and cannot be turned off. Others, such as targeted advertising cookies, are optional, and you can change your preferences at any time by visiting the Cookie Preference Center. Collected from other sources. These sources can include our contractors, service providers, social media platforms, and other third-party companies, as well as publicly available sources. These sources we partner with may collect and share information with us about you such as Personal Identifiers, Internet Activity, and Location Information (as described above), as well as inferences about your shopping interests and other preferences. Read more below about our sources and what data they provide to us or collect on our behalf:

Contractors-We engage independent contractors and third-party consultants to support and assist us in performing business activities that may involve the collection and processing of personal information about you. When they collect your personal information on our behalf, they do so only for defined business purposes and do not use your personal information for their own purposes. Service Providers-We engage third party companies to support and assist us in performing business activities that may involve the collection and processing of personal information about you. When they collect your personal information on our behalf, they do so only for defined business purposes and do not use your personal information for their own purposes. Social Media Platforms and Other Media Services-We partner with social media platforms (such as Facebook, Instagram, and Pinterest) and other media services to learn more about how you interact with VS advertising, promotions, services, and other content we share through those channels, as well as learn more about how you interact with other sites, apps, and content. These partners may provide us with Personal Identifiers, Device and Usage Information, and Analytics and Inferences (all defined above) about you, as well as information related to their social media services (subject to the platform's privacy practices). Other Third Parties-We partner with third-party data providers that supply us with information to help us learn more about our customers. These partners may provide us with Personal Identifiers, Device and Usage Information, and Analytics and Inferences (all defined above) about you, which may be in identifiable or aggregated form. When we partner with other companies for co-sponsored promotions and product offerings, these companies may provide us with personal information about you like Contact Information, Commercial Records, and Personal Identifiers (all defined above). Radio Frequency Identification (RFID) Technology Notice: We place RFID tags on our merchandise to maintain inventory, ensure adequate product availability, and to monitor and prevent fraud. No personal information is stored on RFID tags, only product and inventory information, and the RFID information is not linked to your account when you make a purchase. The RFID tags can be removed after purchase. HOW WE USE PERSONAL INFORMATION v We use personal information for the following purposes: Enhancing Your Shopping Experience: Identifying you when you visit our Platforms or stores, and personalizing content and experiences offered to you. Completing Transactions: Receiving, processing, and fulfilling your orders and other transactions. Communication: Connecting with you in response to your inquiries or requests. Marketing: Advertising and marketing our products and services, and those of our business partners, including analyzing and improving the way we present ad campaigns on our Platforms and across third-party sites. Business Purposes: Operating our business and creating and improving our products and services. Fraud Prevention: Detecting, preventing, and responding to security incidents and malicious, deceptive, fraudulent, or illegal activity on our Platforms and in our stores. Legal Obligations: Supporting compliance with our legal and regulatory obligations, including protecting our legal rights and defending against legal claims. Other: For other reasons with your consent or as permitted by law. HOW WE SHARE PERSONAL INFORMATION v In addition to the specific situations discussed elsewhere in this Notice, we may share personal information in the following situations:

Affiliates and Acquisitions. We may share personal information with our affiliates (e.g., parent company, sister companies, subsidiaries, joint ventures, or other companies under common control). If a company acquires or enters negotiations to acquire, our company, business, or assets, we may share personal information with that company. Public. Some of our websites may allow for comments or reviews in a public forum. If you post on these pages, what you share may be publicly available. Service Providers. We share your personal information with service providers. Service providers help us to run our Platforms, conduct surveys, run sweepstakes and contests, provide technical support, process payments, fulfill orders, and more. These service providers do not use your personal information for their own purposes-only to perform services for VS. Professional Services. We may share personal information with our professional service providers, such as auditors or lawyers. They do not use your personal information for their own purposes-only to perform services for VS. Other Disclosures with Your Consent. We may share your personal information with third parties when you consent or direct us to. Other Disclosures to Third Parties. We may share personal information to cooperate with law enforcement, participate in a legal process, or for legal compliance. For example, we may share your information if we sell and/or transfer all or a portion of our business assets, or purchase all or a portion of a third party's business assets, in connection with proposed or complete sale, purchase, or merger events, as well as acquisitions, joint ventures, reorganization, dissolution, or liquidation. We may share your personal information to establish or exercise our rights, to defend against legal claims, to investigate, prevent, or act on possible illegal activities, threats to safety of person or property, or a violation of our policies. Your information may also be shared to ship products to you. Victoria's Secret Credit Card Program. We partner with Comenity Bank, which is part of Bread Financial, to offer you the Victoria's Secret Credit Card, the PINK Credit Card, the Victoria's Secret Mastercard Credit Card, and the PINK Mastercard Credit Card. When you apply for any of these cards through our Platforms, the personal information you provide in your application is shared with Comenity Bank. Visit https://c.comenity.net/victoriassecret/ for more information. International Purchases and Shipments. We partner with Global-E to support product purchases, shipping, and delivery for our customers in certain international destinations. You may provide certain personal information, such as your contact and payment information, directly to Global-E when you make a purchase on an international checkout page. VS and Global-E will exchange personal information about you to facilitate the purchase, shipment, and delivery of our products. YOUR PRIVACY RIGHTS AND CHOICES All visitors who interact with our Platforms and Services have the right to make certain privacy elections with respect to their personal information, such as opting out of targeted advertising, promotional marketing, and more. You may have other privacy rights and choices available to you depending on where you live and the applicable laws in your jurisdiction. Region-specific privacy rights may include the right to access, delete, and correct your personal information, and the right to opt-out of certain types of processing. These rights, and how they may apply to you, are all explained in the region-specific sections at the end of this Privacy Notice. We never discriminate against anyone for exercising their privacy rights. Read more about your privacy rights and choices below: Opt-Out of Targeted Advertising-You can change your preferences related to targeted advertising and opt-out of sharing your personal information with third parties for purposes of targeted advertising by following the steps below: Cookie Preference Center: You can update your cookie preferences by visiting the Cookie Preference Center. Your elections are browser- and device-specific, so you will need to renew this choice each time you clear your browser and any time you visit our site using a new browser or device. Some cookies that are essential to the operation of our Platforms cannot be turned off. Others, such as those that support targeted advertising, are optional.

Browser Signals: VS sites are enabled to recognize universal opt-out mechanisms such as Global Privacy Control (GPC) signals (for more information on GPC visit: https://globalprivacycontrol.org/). GPC is a universal signal you can elect to turn on that communicates your privacy preferences to participating platforms. If our VS sites recognize that your browser has enabled GPC signals, we will honor your opt-out privacy preferences on that browser. GPC signals are browser- and device-specific, so you will need to set these signals for each browser and device you use to access VS sites. Opt-Out of Promotional Marketing-You can change your preferences related to promotional marketing messages by following the steps below: Email-You may opt-out of the Victoria's Secret and PINK email marketing list by following the instructions located at the bottom of each commercial email or by completing the Email Unsubscribe Request Form. Text Messages-If you sign up to receive promotional text messages from us but later want to opt-out, simply follow the opt-out instructions included in our latest promotional text message to you. All text messages you receive from VS and PINK are subject to our Text Message Terms and Conditions. Direct Mail- To specify your preferences for getting direct mail from us, simply follow the instructions on the mailer, or dial 1-800-411-5116 (for our US and Canada customers); and +1-937-438-4197(for our customers elsewhere). End Mobile Push Notifications and Alerts-You can enable or deactivate push notification messages at any time by changing the notification settings on your mobile device. Turn Off Device Location Sharing-Location-based services can be turned on or off at any time by adjusting the settings of your browser or mobile device. Additionally, for mobile apps, you can adjust your location sharing permissions in the app settings on your device. HOW TO SUBMIT A PRIVACY RIGHTS REQUEST You may have privacy rights available to you depending on where you live and the laws in your jurisdiction. To submit a privacy rights request online, please follow the process listed below applicable to your relationship with VS. In the request webform, you will select your residential location and request type and enter limited personal information that we will use for purposes of verifying your identity and fulfilling your request. Alternatively, you may call us at 1-800-411-5116|. We will comply with your request in accordance with our obligations under applicable law. We never discriminate against anyone for exercising their privacy rights. For residents of the U.S., Canada, and the European Economic Area, please review the applicable region-specific sections at the end of this Privacy Notice for additional information about your privacy rights. For job applicants, please review the Job Applicant Privacy Addendum at the end of this Privacy Notice to find out more about how to exercise your privacy rights. VICTORIA'S SECRET CUSTOMERS Right to Access, Deletion, and Correction: Certain jurisdictions provide consumers with the right to request access to, or deletion or correction of, their personal information. To submit a request, visit the Your Privacy Rights webform. Request for List of Third-Party Disclosures: Certain jurisdictions provide consumers with the right to request a list of third parties to which VS has disclosed their personal information. To submit a request, visit the Your Privacy Rights webform. Request to Opt-Out of Targeted Advertising or Sellinq/Sharinq: Certain jurisdictions provide consumers with the right to opt-out of the processing of their personal information for purposes of targeted advertising, as well as the sharing or selling of their personal information, as defined under applicable laws. To submit a request, visit the webform located here: Opt-Out of Targeting, Selling, and Sharing. Authorized Agents: To submit a request as an authorized agent on behalf of a consumer, follow the applicable process above. When filling out the webform, add your email address and information about the individual for whom you are submitting the request in the other required fields. Please add your name and phone number in the Request Details field and an indication that you are submitting the request as an authorized agent.

VICTORIA'S SECRET CURRENT AND PROSPECTIVE INVESTORS Right to Access, Deletion, and Correction: Certain jurisdictions provide residents with the right to request access to, or deletion or correction of, their personal information. To submit a request, visit the investor privacy rights webform located here: Investor Privacy Rights. Request for List of Third-Party Disclosures: Certain jurisdictions provide residents with the right to request a list of third parties to which VS has disclosed their personal information. To submit a request, visit the investor privacy rights webform located here: Investor Privacy Rights. Request to Opt-Out of Targeted Advertising or Selling/Sharing: Certain jurisdictions provide residents with the right to opt-out of the processing of their personal information for purposes of targeted advertising, as well as the sharing or selling of their personal information, as defined under applicable laws. To opt-out, visit this page: Investor Opt-Out of Targeting, Selling, and Sharing, HOW WE SAFEGUARD AND RETAIN PERSONAL INFORMATION v VS maintains appropriate technical and organizational measures to keep your personal information safe. However, no method of internet transmission or electronic storage of personal information is fully secure, and we cannot guarantee its security. Read more below about protection of your personal information: Our Platforms and Services may permit you to create an account. You are responsible for selecting a unique and complex password and keeping it confidential. You are responsible for any access to or use of your account by someone who has obtained your password, regardless of whether you approved of such access or use. Notify us immediately if you become aware of unauthorized use of your password or account We keep your personal information for as long as necessary to fulfill the purposes in this Notice unless a longer retention period is required or permitted by law. This includes the purposes of satisfying legal, accounting, or reporting requirements. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the information. We also weigh the potential risk of harm from unauthorized use or disclosure of the information, the purposes for which we obtained the information and whether we can meet those purposes through other means, as well as applicable legal requirements. INTERNATIONAL DATA TRANSFERS v VS is a global company. We send data between and among our global affiliates for business purposes, as well as to our service providers located in countries all over the world. Read more below about how your personal information is transferred internationally: Personal information originating in the EEA, Quebec, and elsewhere may be transferred to, stored in, and processed by individuals located in other countries outside of those originating jurisdictions, where laws regarding the protection of personal information may be less stringent than the laws that apply in your jurisdiction. Where applicable, we perform these transfers pursuant to mechanisms required under applicable data transfer laws such as the Standard Contractual Clauses (SCCs) required under the Regulation (EU) 2016/679 (General Data Protection Regulation (GDPR)). Our employees involved in data processing and our servers are based in Columbus, Ohio, US, and other locations throughout the United States, Canada, India, and the Netherlands, as well as other global locations. We work with affiliated and unaffiliated service providers in the United States, the United Kingdom, India, China, and other jurisdictions around the world. By submitting your personal information to us you agree to the transfer, storage, and processing of your data in a country other than your country of residence including, but not limited to, the jurisdictions listed above. We and our service providers may disclose your personal information if we are required or permitted by applicable law or legal process, which may include lawful access by foreign courts, law enforcement or other government authorities in the jurisdictions in which we or our service providers operate. CHILDREN'S PRIVACY

VS Platforms and Services are designed for a general audience and are not directed to or intended for use by children or minors. We do not knowingly collect or solicit personal information from children or minors under the age of 18 through our Platforms or Services. If we become aware that we have collected personal information from a minor, we will promptly delete the information from our records. To request deletion of personal information relating to a minor under the age of 18, please reach out to us at the contacts listed in the "Contact Us" section of this notice. THIRD PARTY APPLICATIONS, WEBSITES, AND PLATFORMS Through our Platforms, we may provide links to websites and other third-party content or services that VS does not own or operate. You may also interact with VS content, products, and ads through channels operated by third parties, such as social media sites and apps, where those third parties may separately collect information about you. Additionally, when you provide information to us on our Platforms that are operated by third parties, such as when you use our apps on a third-party platform through your mobile device, these third-party platform operators may separately collect information about you. The information collected by these third- party operators is subject to their privacy policies, not this Privacy Notice, and VS is not responsible for the data processing practices of these third parties. UPDATES TO OUR PRIVACY NOTICE This Privacy Notice may be updated from time to time to reflect changes in our privacy practices regarding your personal information. If any significant changes are made, we will notify you by placing a prominent notice on our relevant Platforms. In certain situations, we may notify you in other ways, such as by e-mail, about material changes to our Privacy Notice. CONTACT US From anywhere in the world, you may contact our privacy office for more information about our privacy practices. If you are located in the United States or Canada, you may write to our privacy officer or contact us by phone at: ATTN: Privacy Officer Victoria's Secret & Co. Legal Department 4 Limited Parkway Reynoldsburg, OH 43068 US & Canada Phone: 1-800-411-5116 If you are located anywhere else in the world, you may write to our privacy officer at the address listed above, or contact us by phone at: International Phone: 1-937-438-4197 For data subjects in the United Kingdom and European Union: If you believe that your privacy rights under the GDPR have been violated, you have a right to lodge a complaint with your local supervisory authority. U.S. PRIVACY ADDENDUM AND CALIFORNIA NOTICE AT COLLECTION v Privacy laws in some U.S. jurisdictions, including California, Connecticut, Delaware, and others, may grant residents of those states the right to make certain privacy requests listed below, subject to certain exceptions and limitations. We never discriminate against anyone for exercising their privacy rights. Read on to learn more about the privacy rights that may be available to you, including the Notice at Collection for California residents: Request Access-You can ask us for a copy of the personal information we have collected about you. In certain jurisdictions, you may also ask us to provide you with a categorical or specific list of third parties to which we have disclosed personal information about you.

Request Deletion-You can ask us to delete the personal information we have collected about you. Request Correction-You can ask us to correct inaccuracies in the personal information we have collected about you. Request to Opt-Out of Certain Processing-You can opt-out of your personal information being sold or shared with certain third parties or being used for targeted advertising. How to Submit Privacy Rights Requests You may have privacy rights available to you depending on where you live and the laws in your jurisdiction. To submit a privacy rights request online, please follow the process listed below applicable to your relationship with VS. In the request webform, you will select your residential location and request type and enter limited personal information that we will use for purposes of verifying your identity and fulfilling your request. Alternatively, you may call us at 1-800-411-5116. We will comply with your request in accordance with our obligations under applicable law. We never discriminate against anyone for exercising their privacy rights. For job applicants, please review the Job Applicant Privacy Addendum at the end of this Privacy Notice to find out more about how to exercise your privacy rights, VICTORIA'S SECRET CUSTOMERS Right to Access. Deletion, and Correction: Certain jurisdictions provide consumers with the right to request access to, or deletion or correction of, their personal information. To submit a request, visit the Your Privacy Rights webform. Request for List of Third-Party Disclosures: Certain jurisdictions provide consumers with the right to request a list of third parties to which VS has disclosed their personal information. To submit a request, visit the Your Privacy Rights webform. Request to Opt-Out of Targeted Advertising or Sellinq/Sharinq: Certain jurisdictions provide consumers with the right to opt-out of the processing of their personal information for purposes of targeted advertising, as well as the sharing or selling of their personal information, as defined under applicable laws. To submit a request, visit the webform located here: Opt-Out of Targeting, Selling, and Sharing. Authorized Agents: To submit a request as an authorized agent on behalf of a consumer, follow the applicable process above. When filling out the webform, add your email address and information about the individual for whom you are submitting the request in the other required fields. Please add your name and phone number in the Request Details field and an indication that you are submitting the request as an authorized agent. VICTORIA'S SECRET CURRENT AND PROSPECTIVE INVESTORS Right to Access. Deletion, and Correction: Certain jurisdictions provide residents with the right to request access to, or deletion or correction of, their personal information. To submit a request, visit the investor privacy rights webform located here: Investor Privacy Rights. Request for List of Third-Party Disclosures: Certain jurisdictions provide residents with the right to request a list of third parties to which VS has disclosed their personal information. To submit a request, visit the investor privacy rights webform located here: Investor Privacy Rights. Request to Opt-Out of Targeted Advertising or Selling/Sharing: Certain jurisdictions provide residents with the right to opt-out of the processing of their personal information for purposes of targeted advertising, as well as the sharing or selling of their personal information, as defined under applicable laws. To opt-out, visit this page: Investor Opt-Out of Targeting, Selling, and Sharing. Right to Appeal We make every reasonable effort to fulfill your privacy rights reguests. However, where we are unable to fulfill your request, some U.S. jurisdictions provide you with the right to appeal. If we provide you with a message stating that we have rejected or limited your-request, we will also provide you with a link to an appeal form and instructions on how to lodge an appeal. We will process your appeal in accordance with applicable laws.

Notice at Collection and Other Disclosures for California Residents California law requires us to disclose the following supplemental Information about our privacy practices. If you are a California resident, the following Notice at Collection disclosures apply to you in addition to the rest of the Notice. Summary of Victoria's Secret Privacy Practices This section provides a summary of VS privacy practices. It describes the categories of personal information we may have collected from you in the past 12 months, the purposes for which we collect and use it, and when we may disclose such personal information. It also addresses "selling" or "sharing" your personal information, as those terms are defined by applicable data privacy laws. VS does not sell your personal information for money. VS collects these categories of consumer personal information: Personal Identifiers: your name, contact information (including postal address, phone number, and email address), and, as applicable, government issued identification such as driver's license number, Social Security Number CSSN), or National Identification Number (NIN). Customer Records Information: as applicable, bank account number, credit card number, debit card number, and other transaction records including information about your purchases, payments, and transactions, such as your contact information, payment and billing details, and shipping address. Commercial Information: information about products or services you purchase, obtain, or consider, loyalty program transactions, and other purchasing records and tendencies. Internet or Other Electronic Network Activity Information: browsing history, search history, and other online activity and usage Information, such as Information regarding your interactions with our Platform or other Internet websites, applications, advertisements, or other content, and content you share in public forums on our Platform or through social media and other third-party digital platforms. Location Data: we may collect your general location data based on your IP address. With your consent, we may also collect your geolocation based on information from your mobile device. Audio, Video, or Electronic Information: audio and electronic records of your communications when you engage with us through any of our Platforms and communication channels, in-store video monitoring such as CCTV, information collected through other anti-theft tools In-store and on our Platforms, and call recordings and analytics.

Characteristics of Protected Classifications: In certain situations, with your consent, we may collect demographic information about you such as disability or health information In order to comply with applicable laws and to better provide you with accommodations in our stores and on our Platforms. Inferences Derived from Any Information Listed Above: we may use the above information we have about you to create certain inferences about your preferences, interests, and other personal demographics and characteristics. Biometric Information: in certain situations, for anti-fraud purposes we may collect and process biometric data to uniquely identify you. Sensitive Personal Information: in certain situations, and for specified, limited purposes, we may collect information about you that is classified as sensitive personal information, such as the following: account log in, driver's license number, state identification card or social security number, debit and credit card in combination with access codes, and precise geolocation, We collect this data to process transactions, comply with laws, manage our business, or provide services. VS collects, uses, and processes consumer personal information for these business and commercial purposes: Identifying you when you visit our Platforms or stores, and personalizing content and experiences offered to you. Receiving, processing, and fulfilling your orders and other transactions. Connecting with you in response to your inquiries or requests. Advertising and marketing our products and services, and those of our business partners, including analyzing and improving the way we present ad campaigns on our Platforms and across third-party sites. Operating our business and creating and improving our products and services. Detecting, preventing, and responding to security incidents and malicious, deceptive, fraudulent, or illegal activity on our Platforms and in our stores. Supporting compliance with our legal and regulatory obligations, including protecting our legal rights and defending against legal claims. For other reasons with your consent. VS retains consumer personal information for as long as necessary to fulfill the original purpose for collection. We may keep it longer in accordance with applicable law. VS discloses certain categories of consumer personal information to its service providers for the business, commercial, and operational purposes listed above, as well as to third parties for other purposes such as the following: Digital Service Providers: We engage third parties such as internet service providers (ISPs), cloud service providers (CSPs), and other systems to operate our Platforms and provide our services. These third parties may process Personal Identifiers, Internet or Other Electronic Network Activity Information, Location Data, and Audio, Video, or Electronic Information about you. Marketing, Advertising and Analytics Providers: We engage third parties such as marketing and advertising agencies, social networks, and data analytics companies to provide services that help us better reach customers with targeted advertising and other marketing campaigns. These third parties also help us measure the effectiveness of our marketing and advertising campaigns. They may process Personal Identifiers, Commercial Information, Internet or Other Electronic Network Activity Information, Location Data, Audio, Video, or Electronic Information, and inferences about you.

Information Providers: We engage third parties such as data suppliers and other information vendors that provide us with new information about customers so that we can enhance and improve our customer records. They leverage certain categories of customer information we share with them to identify and provide additional relevant customer information to VS. These third parties may process Personal Identifiers, Customer Records Information, Commercial Information, and Inferences about you. VS_provides you with an opportunity to opt-out of the use or disclosure of your personal information for purposes of targeted advertising and other activities deemed as "selling" or "sharing" under applicable privacy laws: To opt-out of sharing your personal information for purposes of targeted advertising or opt-out of personal information sharing with third parties that could constitute "selling" or "sharing" under applicable laws, submit a request here: Do Not Sell or Share My Personal Information. Sale and Sharing of Personal Information We are required to disclose whether the following categories of personal information are collected, shared with third parties for a "business purpose," or "sold," or transferred for "valuable consideration." The table below indicates the categories of personal information we collect and transfer in a variety of contexts. We do not ''sell" your personal data for money. Category of Personal Information Disclosures for a Sharing for Targeted Advertising Business Purpose Identifiers-this may include things like Analytics insights provider. Advertising networks. name, alias, postal address, unique Service providers (e.g., Affiliated marketer, personal identifier, online identifier, email advertisers, customer service). Social Media Platform, address, or account name. Affiliated brands and entities. Survey Company. Data centers. Payment and transaction processor. Social media platform. Technology administration and integrity provider. Third party financial services provider (credit card servicer). Financial information-this may include Analytics insights provider. N/A. bank account number, credit card number, Service providers. debit card number, and other financial Affiliated brands and entities. information. Payment and transaction processor. Third party financial services provider (credit card servicer). Government issued identification-this Analytics insights provider. N/A. may include things like social security Service providers. number, driver's license number, military or Affiliated brands and entities. veteran identification number, or state Third party financial services issued identification number. provider (credit card servicer). Commercial information-this may Analytics insights provider. Advertising networks. include information about products or Service providers. Affiliated marketer. services purchased, obtained, or Affiliated brands and entities. Social Media Platform. considered, or other purchasing or Data centers. Survey Company, consuming histories or tendencies. Social media platform.

Payment and transaction processor. Third party financial services provider (credit card servicer). Internet or other electronic network Analytics insights provider. Advertising networks. activity information-this may include Service providers. Affiliated marketer. browsing history, search history, and Affiliated brands and entities. Social Media Platform, information regarding an individual's Data centers. Survey Company. interaction with an internet website, app, or Social media platform. ad. Third party, performing services in their own name through an independent consumer relationship. . Geolocation data-this could include Analytics insights provider. N/A. precise or non-precise geolocation Service providers. information. Affiliated brands and entities. Data centers. Social media platform. Third party, performing services in their own name through an independent consumer relationship. In-store Wi-Fi provider. Audio, electronic, visual, thermal, Service providers. N/A. olfactory, or similar information Third party, performing services n their own name through an independent consumer relationship. Inferences drawn from any of the Analytics insights provider. Advertising networks, information listed above Service providers. Affiliated marketer. Affiliated brands and entities. Social Media Platform. Data centers. Survey Company. Social media platform. Third party, performing services in their own name through an independent consumer relationship. Additional categories of personal data Payment and transaction N/A. described in the California Customer processor. Records Service providers. statute (Cal. Civ. Code § 1798.80(e))-this * Third party, performing services may include signature, physical in their own name through an characteristics, or description independent consumer relationship. California Notice of Financial Incentive. VS offers discounts, promotions, and rewards to our customers enrolled in our optional Victoria's Secret and PINK loyalty rewards program, and, from time to time, VS also offers contests, sweepstakes, and other promotions in connection with our advertising campaigns ("Programs"). VS collects certain personal information from and about you through these optional Programs, such as your personal identifiers (such as your name and birthday), contact information (such as your email and shipping address), and commercial information (such as your purchasing history). Details of each program are further explained in the program offering. There is no obligation to opt in to these Programs, and you may opt-out at any time. Under California law, these Programs may be considered as offering you a "financial incentive" in exchange for your personal information. The value of your personal information to VS is commensurate with the value of the benefits you receive from these Programs, such as free or discounted products.

California Shine the Light. In accordance with California's Shine the Light law, VS provides you with a cost-free means to request to opt-out of our sharing your personal information to third parties with whom we do not share the same brand name, if that third party will use it for its own direct marketing purposes. To submit a request, simply complete the CA Shine the Light Request form. EEA PRIVACY ADDENDUM v If you are located in the European Economic Area ("EEA"), the following supplemental disclosures apply to you in addition to the rest of the Notice. Read on for more information about your privacy rights and VS privacy practices: Pursuant to the Regulation (EU) 2016/679 (General Data Protection Regulation ("GDPR")), where VS collects and processes the personal information of individuals located in the EEA, we process your personal information on the following legal bases: Consent-If VS requests consent for the processing of your personal information, you may decline or withdraw that consent at any time by following the opt-out procedures outlined in this Privacy Notice, or by following the same method by which you originally provided consent Performance of Contractual Obligations-To perform our commercial obligations, VS collects and processes your personal information when providing you with requested Services, completing your purchases, and fulfilling your product orders. When you order products on our VS Platforms or visit our stores to make a purchase, we may collect and process your payment, shipping, and contact information, and may communicate with you about your product orders and purchases. We also collect and process your personal information when you request other VS Services, such as contacting our customer services team for assistance. Compliance with Legal Obligations and Protection of Rights-It may become necessary for VS to process your personal information in order to comply with our applicable legal obligations, such as financial reporting, or to protect our rights and the rights of others. Legitimate Interests-To pursue our legitimate business interests, VS collects and processes your personal information when you visit our Platforms in order to provide you with content, such as advertising and other marketing, about our products, as well as to communicate with you about our products and Services. We may process your personal information to learn more about how you interact with our Platforms and Services and make improvements. VS may share your personal information with processors and other third parties as necessary to accomplish our legitimate business interests, including for advertising and other marketing purposes. Under GDPR, persons located within the EEA have the right to make certain privacy requests listed below, subject to certain exceptions and limitations. We never discriminate against anyone for exercising their privacy rights. Right to Know-You can ask us questions about how we collect and use your personal information. Right of Access-You can ask us for a copy of the personal information we have collected about you. Right to Erasure-You can ask us to delete the personal information we have collected about you. Right to Rectification-You can ask us to correct inaccuracies in the personal information we have collected about you. Right to Restrict Certain Processing-You can opt-out of your personal information being sold or shared with certain third parties or being used for targeted advertising. Right to Object to Certain Processing-You can opt-out of your personal information being sold or shared with certain third parties or being used for targeted advertising. How to Submit Privacy Rights Requests

To submit a privacy rights request online, please follow the process listed below applicable to your relationship with VS. In the request webform, you will select your residential location and request type and enter limited personal information that we will use for purposes of verifying your identity and fulfilling your request. Alternatively, you may call us at 1-937-438-41971. We will comply with your request in accordance with our obligations under applicable law. We never discriminate against anyone for exercising their privacy rights. For job applicants, please review the Job Applicant Privacy Addendum at the end of this Privacy Notice to find out more about how to exercise your privacy rights. VICTORIA'S SECRET CUSTOMERS To submit a privacy rights request, visit the Your Privacy Rights webform. VICTORIA'S SECRET CURRENT AND PROSPECTIVE INVESTORS To submit a privacy rights request, visit the investor privacy rights webform located here: Investor Privacy Rights. If you believe that your privacy rights under the GDPR have been violated, you have a right to lodge a complaint with your local supervisory authority. Cookies and Tracking Technologies Our Platforms use cookies and other tracking technologies as described below. See the "Tracking Technologies" section of this Notice for more information about how we use these technologies on our Platforms. See our Cookie Preference Center to learn more about how to update your cookie preferences. Strictly Necessary Cookies Technology Type Function User-Input Enables visitors' input, choices, or selections across their website experience. Examples include maintaining a shopping cart during a visit or a form throughout a transaction. Authentication Identifies visitors through the website after they log in. Security Helps to ensure our website's security when visitors request a service. For example, we use cookies to help secure account creation and login pages. Multimedia Player Ensures such things as image quality, network link speed, or buffer information for video and audio playback. Load Balancing Session Directs website traffic to a particular data center for the quickest website access and enables visitors to return to that data center if needed. Analytics and Personalization Cookies Technology Type Function Visitor Customization Stores preferences and visitor experiential histories: remembers language preference, product-page display preference, and whether certain visitor experiences should be displayed, such as email marketing signup, based on past experiences. These types of cookies are set only if you give consent. Analytics and Enables us to do things like estimate number of visitors, detect most used search-engine keywords that lead to Personalization a webpage, measure page load times, administer visitor surveys, identify navigation issues, serve personalized content on our websites and improve web capabilities. These types of cookies are set only if you give consent. Targeted Advertising Cookies Technology Type Function Social Media Plug-in These cookies from social media platforms (like Facebook and Instagram) facilitate content sharing on those platforms. These types of cookies are set only if you give consent.

Remarketing and Enables our advertising vendors to deliver tailored ads to our visitors on other websites. The ads are based on a interest Based visitor's combined online and offline (e.g. in-store) shopping history and experience with us, as well with our Advertising vendors" network of advertisers. These types of cookies are set only if you give consent CANADA PRIVACY ADDENDUM v If you are a resident of Canada, the following supplemental disclosures apply to you in addition to the rest of the Notice. Read on for more information about your privacy rights and VS privacy practices: Your Privacy Rights To submit a privacy rights request online, please follow the process listed below applicable to your relationship with VS. In the request webform, you will select your residential location and request type and enter limited personal information that we will use for purposes of verifying your identity and fulfilling your request. Alternatively, you may call us at 1-800-411-5116 We will comply with your request in accordance with our obligations under applicable law. We never discriminate against anyone for exercising their privacy rights. For job applicants, please review the Job Applicant Privacy Addendum at the end of this Privacy Notice to find out more about how to exercise your privacy rights. VICTORIA'S SECRET CUSTOMERS To submit a privacy rights request, visit the Your Privacy Rights webform. VICTORIA'S SECRET CURRENT AND PROSPECTIVE INVESTORS To submit a privacy rights request, visit the investor privacy rights webform located here: Investor Privacy Rights. Information about our Privacy Governance Policies and Practices We are committed to protecting personal information and have implemented a comprehensive set of policies and practices that govern our treatment of personal information. These policies and procedures include, among other things, the following: We have implemented policies and procedures to protect personal information in our custody and control from unauthorized access, use or disclosure. We have implemented processes to respond to data subject requests and complaints in a timely and effective manner. We have implemented a framework for the retention and destruction of personal information to ensure compliance with legal obligations, and to securely destroy personal information once no longer required. We have designated a Privacy Officer who is responsible for overseeing the company's compliance with privacy legislation. We have policies and trainings that defi ne the roles and responsibilities for our employees with respect to the treatment of personal information. We provide our employees with regular privacy training and awareness. JOB APPLICANT PRIVACY ADDENDUM v If you are applying for a career opportunity with Victoria's Secret and you are located in the European Economic Area ("EEA") or are a resident of Canada or the state of California in the U.S., the following disclosures apply to you In addition to the rest of the Notice. This section describes the types of personal information collected and processed by VS for job recruitment and hiring purposes, and related VS privacy practices. Individuals currently employed by Victoria's Secret should refer to the applicable VS Associate Privacy Notice. Read on for more information about your privacy rights and VS privacy practices:

Personal Information We Collect When you apply for a job with VS online or in person, or register for our VS&Co. candidate database, we collect various types of personal information directly from you, automatically, and from other sources. In addition to the types of personal information described in the rest of this Notice, we also collect the following personal information about you: Personal Identifiers: You may provide us with your name, contact information (including postal address, phone number, and email address), and government issued identification such as driver's license number, Social Security Number (SSN), or National Identification Number (NIN) as part of the application process. We may use this information to contact you, to complete the application process, and to carry out background checks that are considered relevant to the role for which you are applying. You may also create a username and password when you register for our VS&Co. candidate database. If you are offered a role with us, we may also collect personal information about your dependents, as well as your marital status, gender, full date of birth, bank account information, and emergency contact information during the employment onboarding process. • Professional or Employment-Related Information: You may provide us with your job history, references, education history, certifications, and other information related to your qualifications for a particular position with VS. How We Use Your Personal Information The personal information we collect about you during the application process is used for job recruitment purposes. In addition to the other ways we process personal information described in the rest of this Notice, we also process your personal information in the following ways in connection with the job recruitment and selection process: • To communicate with you about the status of your application and respond to your requests. • To send you job alerts and communicate with you about VS positions that may match your skills and interests, if requested. • To evaluate your candidacy for employment with VS using information we collect directly from you, as well as additional information we may obtain from third parties. • To perform a background check. • To maintain and create information for statistical purposes. How We Share Your Personal Information We share your personal information in the ways described elsewhere in this Notice. In connection with the job application and recruitment process, we may also share your personal information with service providers and contractors that evaluate employment applications and conduct background checks on our behalf. Your Privacy Rights and Choices Job applicants located within the EEA, or who reside in Canada or the state of California in the U.S. have the right to make certain privacy requests, subject to certain exceptions and limitations. See the applicable region-specific terms in this Notice for more information on your privacy rights. To submit a privacy rights request online, please follow the applicable process listed below. In the request webform, you will select your residential location and request type and enter limited personal information that we will use for purposes of verifying your identity and fulfilling your request. Alternatively, you may call us at 1-800-411-5116 We will comply with your request in accordance with our obligations under applicable law. We never discriminate against anyone for exercising their privacy rights. • Right to Access, Deletion, and Correction: Certain jurisdictions provide job applicants with the right to request access to, or deletion or correction of, their personal information. To submit a request, visit the job applicant privacy rights webform located here: Job Applicant Privacy Rights.. • Request for List of Third-Party Disclosures: Certain jurisdictions provide job applicants with the right to request a list of third parties to which VS has disclosed their personal information. To submit a request, visit the job applicant privacy rights webform located here: Job Applicant Privacy Rights.

Request to Opt-Out of Targeted Advertising or Sellina/Sharing: Certain jurisdictions provide job applicants with the right to optout of the processing of their personal information for purposes of targeted advertising, as well as the sharing or selling of their personal information, as defined under applicable laws. To opt-out, visit this page: Job Applicant Opt-Out of Targeting. Selling, and Sharing. VICTORIA'S Information SECRET Policies Privacy Policy Do Not Sell or Share My Personal Information Terms & Conditions Site Map Contact Us Web Accessibility Modern Slavery Transparency Statement Request Investor Relations Email Alerts Email Address J Subscribe 2026 Victoria's Secret & Co. Company. All Rights Reserved