Corporate Policies

To continue delivering on the trust that our partners, customers and employees place in us every day, Whirlpool Corporation is committed to a robust catalog of policies that promote privacy, security and just treatment for all.

Anti-Competitive Behavior

Whirlpool Corp. is strongly committed to complying with antitrust laws around the world. The company has a robust antitrust compliance program that involves every level of the company (including senior leadership) and includes mandatory antitrust policies, compliance procedures and controls, an extensive training program and processes for periodic review, monitoring and auditing. We regularly update our antitrust compliance program to address changing business conditions, developments in antitrust law and enforcement and emerging risks.

Anti-Corruption

We do business the right way. This means that we do not tolerate bribery or corruption of any kind. Moreover, it means that we are actively adhering to this principle in all aspects of our business. In addition to our Integrity Manual, Whirlpool Corp. maintains a global anti-corruption policy, which provides guidance and details of our anti-corruption commitment and expectations.

With leadership driven by our Executive Committee, the Global Ethics and Compliance Steering Committee and Global Ethics and Compliance Team, and leveraging global and cross-functional resources, We use an anti-corruption program to identify and mitigate potential corruption risks. This includes:

• Risk-based policies and procedures
• Online and in-person facilitated training
• Risk-based audits to monitor, mitigate and eradicate corruption risks

Due Diligence Program

Our global due diligence program, which is applicable to all of Whirlpool Corp.’s third-party relationships, evaluates potential and future ethics and compliance risks, including risks of corruption that may be presented through our third-party relationships. For corruption and bribery risks, as well as other high-risk issues, our escalation policies guide us to engage with our Executive Committee and/or the Audit Committee of the Whirlpool Corp. Board of Directors in order to inform and involve senior leaders in matters that may pose significant risk to the company and our culture of integrity.

On a quarterly basis, the Global Ethics and Compliance Team reviews Integrity Line cases that may involve allegations of corruption and bribery with the Global Ethics and Compliance Steering Committee. These quarterly meetings and reports are designed to actively engage global senior leaders in the oversight and response to anti-corruption matters, including addressing policy enhancements, implementing controls and procedures, aligning on targeted risk-based trainings and engaging input on sustaining the company’s strong culture of compliance and commitment to anti-corruption efforts.

For Whirlpool Corp., bribery means more than just money changing hands. If the intent is corrupt, anything of value⁠—no matter how small and of what nature—can be considered a bribe. Bribery of a government official or any person or entity is illegal. Many countries also prohibit commercial bribes. Further, we do not permit facilitation payments.

We believe that corruption occurs when there is an abuse of trust or our values are compromised for an improper gain or advantage. We maintain strict controls to prevent and detect corruption. We consistently communicate that we all must apply good judgment to prevent even the perception of wrongdoing.

Human Rights

Whirlpool Corp. supports the human rights of everyone we work with and expects our global business partners to do the same. This has been a long-standing commitment of our company as evidenced in Our Integrity Manual, Supplier Code of Conduct and various other policies, procedures, and internal and public communications and commitments. In June 2022, we formally documented our commitment with the issuance of our Global Human Rights Policy. The policy clearly states our belief in global human rights, and that our business practices reflect that commitment to provide that every person who works for us throughout all of our global operations does so of their own free will, in a safe and healthy environment. Our policy states that we oppose discrimination, slavery and child labor and have controls and protections to avoid them. Further, we support diversity and wage parity, and respect the rights of our employees to associate with whom they choose and to be involved in politics outside of work. These values remain reflected in Our Integrity Manual. Moreover, our Integrity Line can be used both internally and externally to bring concerns about human rights issues to our attention. In addition to our internal commitment to human rights, we strive to hold our suppliers and business partners accountable to comply with these same principles through our Supplier Code of Conduct.

Cybersecurity

We work hard to earn and keep the trust of our stakeholders. To this end, we continue to invest in managing cybersecurity risk, in protecting our information assets and ensuring the integrity of our computing environment at the enterprise level. We have a cybersecurity awareness program that includes training, simulated phishing exercises and outreach publications on our company portal. Our security monitoring and incident response functions are managed centrally by our Global Security Operations Center, and we continue to mature our defensive security capabilities in support of our business imperatives.

Our Board is responsible for overseeing and holding senior management accountable for our global information security and privacy programs. This includes understanding our business needs and associated risks and reviewing management’s strategy and recommendations for managing cybersecurity and privacy risks. In line with this oversight responsibility, the Audit Committee receives reports on cyber program effectiveness periodically, and the Board of Directors receives a full presentation at least annually on cybersecurity-related trends and program updates.

Consumer Privacy

We respect privacy. We are transparent about the data we collect and the purposes for which it will be used—and we work hard to ensure its safety. Through corporate policies and procedures, training and awareness initiatives, risk assessment and management controls, our global privacy program provides that all information shared with us is processed in accordance with all applicable legal requirements and global best practices. Our leadership champions our privacy program and oversees its development closely. We leverage technical solutions to automate every possible aspect of our privacy program, strengthening its effectiveness. We operationalize the program’s effectiveness through documented processes and procedures which are subjected to periodic audits.

Whirlpool Corp.’s third-party risk management process is designed to evaluate and assess the data privacy risks presented by engagement with a particular third party. Specifically, the program allows us to assess risk by examining a third party’s classification of data, volume of data to be handled, services provided by the third party and a third party’s use of subcontractors. This assessment, coupled with a security scorecard and contract language, including a standard security and privacy exhibit and additional third-party diligence data, including external certifications (e.g., ISO 27001, SOC1) is used to assess and later mitigate the residual risk of engagement with a particular third party. Modeled on the ISO 27001:2013 standard, the security and privacy exhibit requires the third party to maintain adequate measures to ensure data security and requires those contractual provisions to be extended to subsequent third parties (i.e., sub-processors). Once approved, these third parties are required to undergo periodic reassessments.

We monitor legal and regulatory developments globally to keep abreast of new privacy requirements worldwide. We regularly review our privacy program to promote compliance with all relevant privacy laws and regulations.

Launched new, mandatory cybersecurity and privacy training

Recognizing that our employees have a professional, legal and ethical responsibility to protect and secure the data entrusted to us, in 2022 we launched and required all salaried Whirlpool Corp. employees to complete a mandatory Global Cybersecurity and Privacy training covering information security, end-user security policies, remote working, phishing and email security, digital threats and breach response.

Tax