Privacy

Last updated: June 8, 2022

We at Duke Energy Corporation, along with our subsidiaries and affiliates, including but not limited to, Piedmont Natural Gas Company, Inc. (collectively, "Duke Energy"), respect your concerns about privacy. This Digital Privacy Policy describes the types of personal information we may obtain through our websites and mobile apps, how we may use the information, with whom we may share it, and the choices available regarding our use of the information. The policy also describes the measures we take to safeguard your personal information and how you can contact us about our privacy practices.

This Digital Privacy Policy applies to the personal information we obtain through Duke Energy's websites and mobile apps (collectively, the "Digital Services"). The policy does not apply to any Duke Energy website, mobile app or service that has a separate privacy policy or notice.

Information We Obtain

The types of personal information we may obtain about you through our Digital Services include:

• contact information (such as name, phone and fax number, email address and mailing and service address);
• information used to create your online account and other account-related information (such as username, password, security questions and answers, account number, and any content you choose to store in your account);
• demographic information, such as date of birth, gender and other background information (such as your ethnicity if you inquire about programs applicable to minorities);
• Social Security number, driver's license number, tax identification number and other government-issued identification numbers;
• payment information, such as name, billing address, bank account information, and payment card details (including payment card number, expiration date and security code), some of which is collected and stored by our third-party payment processor on our behalf;
• information related to your transactions with us, such as your payment history;
• social media handles;
• information you provide in the course of applying for a job with us, such as details about your education, work and military history, legal work eligibility status and background check information; and
• other personal information in content you submit to us, such as information you provide to us when you create or modify your online account, contact us through emails or our Digital Services, respond to surveys, use our forums, and complete any registration, including those related to receiving communications on select advocacy topics, or self-service transaction forms.

We may obtain some information about you from third parties. For example, during the Start Service process, Duke Energy supplements the information you provide through our Digital Services with additional data received from third-party sources. We also may supplement your information with additional information we receive from a credit check performed when you apply for certain services. This information helps us to verify, update and correct the information our customers provide to us and enables us to determine if a deposit will be needed to provide you with services.

We also may collect other information about you through our Digital Services in ways for which we provide specific notice or otherwise with your consent.

Note that our "Building Our Energy Future" virtual reality ("VR") application does not collect or process any data, information, or content that is about or associated with a person, device, or unique identifier (including anonymized or hashed user IDs) that is obtained directly from a VR device or its developer (including microphone or camera data, or headset position or hand tracking data).

Automated Collection of Data

When you interact with our Digital Services or open our emails, we may obtain certain information by automated means, such as browser cookies, web beacons, device identifiers, server logs, and other technologies. A "browser cookie" is a text file that we save on your device when you use our Digital Services. Cookies allow us to uniquely identify users and to store information or settings. A "web beacon," also known as an Internet tag, pixel tag or clear GIF, is a clear picture file that allows us and third parties to store information about your interactions with our Digital Services, such as how you use the Digital Services and view our content.

We may use these automated technologies to collect information about your devices, browsing actions, and usage patterns. The information we obtain in this manner may include your device IP address, Internet service provider, identifiers associated with your devices, domain name, device and operating system type and characteristics, web browser characteristics, language preferences, information about your interactions with and preferences on our Digital Services (such as clickstream data), the webpage from which you link to or from our Digital Services, dates and times of access to our Digital Services, and other information about your use of our Digital Services. These technologies help us (1) remember your information so you will not have to re-enter it; (2) track and understand how you use and interact with our Digital Services; (3) tailor our Digital Services around your preferences; (4) measure the usability of our Digital Services; (5) understand the effectiveness of our communications; (6) identify, diagnose and resolve technical issues; and (7) otherwise manage and enhance our Digital Services (and our other products and services) and help ensure they are working properly.

You can manage cookies through your web browser. Most web browsers will tell you how to stop accepting new browser cookies, how to be notified when you receive a new browser cookie and how to disable existing cookies. You can find out how to do this for your particular browser by clicking "help" on your browser's menu or by visiting www.allaboutcookies.org. In addition, your mobile device settings may allow you to prohibit mobile app platforms (such as Apple and Google) from sharing certain information obtained by automated means with mobile app developers and operators such as us. Please note, however, that without cookies and similar technologies we use, you may not be able to take full advantage of all features of our Digital Services. Our Digital Services currently do not respond to "Do Not Track" signals.

We also may receive your mobile device's precise geolocation. We may use this information to provide you with location-based services, such as to assist you with finding a nearby payment location. This information is not stored by us for future use. Your device may provide you with a notification when the Digital Services attempt to collect your precise geolocation. Location services can be turned off within the settings of your mobile device.

How We Use the Information We Obtain

We may use the information we obtain about you to:

• provide and manage our services, including to process, evaluate, communicate and fulfill requests, inquiries and claims we receive in connection with our services;
• create, manage, administer and communicate with you about your account, including identifying and authenticating you so you may access your account or use certain features of our Digital Services;
• personalize your experience with our Digital Services (such as to tailor content and information we may communicate to you, and to offer location-based and personalized content and communications);
• provide customer and technical support;
• process, evaluate and respond to requests, inquiries and applications we receive in connection with our services;
• provide you with information about Duke Energy;
• provide you with information about select advocacy topics in your jurisdiction, including legislative hearings and petitions and opportunities to engage with local officials;
• subject to applicable law, communicate about and administer our services, events, surveys, programs and promotions (such as by sending alerts, promotional materials, newsletters and other marketing communications);
• manage career opportunities with us, including for recruitment purposes, candidate screening and evaluation, and employee onboarding;
• perform data analytics (such as crash analytics, offer acceptance rates, market research, trend analysis, data aggregation and anonymization, financial analysis and customer segmentation);
• operate, evaluate and improve our business (including administering, enhancing and improving our services; developing new services; managing our communications and customer relationships; and performing accounting, auditing, billing, reconciliation and collection activities);
• protect against and prevent fraud and other unlawful activity, unauthorized transactions, claims and other liabilities;
• conduct investigations and comply with and enforce applicable legal requirements, relevant industry standards, contractual obligations, and our policies and terms (such as our privacy policies and Terms of Use); and
• maintain and enhance the safety and security of our services, network, information, customers, employees and others.

We also may use the information we obtain about you in other ways for which we provide specific notice and obtain your consent if required by applicable law. We may combine information we obtain about you (such as through our Digital Services or from third parties) for the purposes described above.

Third-Party Online Analytics Services

Through our Digital Services, we may obtain personal information about your online activities over time and across third-party apps, websites, devices and other online services. We use third-party online analytics services on our Digital Services, such as those of Google Analytics. The service providers that administer these analytics services use automated technologies to collect data (such as email, IP addresses, cookies and other device identifiers) to evaluate, for example, use of our Digital Services and to diagnose technical issues. For more information about how Google Analytics collects and processes data and the Google Analytics opt-out browser add-on, please visit https://policies.google.com/privacy#infocollect and https://policies.google.com/technologies/partner-sites.

In our Digital Services, we may use certain Google Analytics advertising features, such as Remarketing with Google Analytics, Google Display Network Impression Reporting, Google Analytics Demographics and Interest Reporting, and integrated services that require Google Analytics to collect data for advertising purposes, including the collection of data via advertising cookies and identifiers. In connection with these Google Analytics advertising features, Google Analytics may collect data about your traffic via Google advertising cookies and identifiers. To learn more about how Google uses this information, please visit www.google.com/policies/privacy/partners/. If you do not want Google Analytics to use this information for the purpose of serving you targeted ads, you may opt out of certain Google Analytics advertising features by visiting the Google Ads Settings page available at https://adssettings.google.com/.

Online Tracking and Interest-Based Advertising

Through our Digital Services, both we and certain third parties may collect information about your online activities to provide you with advertising about products, services and corporate initiatives tailored to your individual interests. Where required by applicable law, we will obtain your consent for the processing of your personal information for direct marketing purposes. You may see our ads on other websites or mobile apps because we participate in advertising networks. Ad networks allow us to target our messaging to users considering demographic data, users' inferred interests and browsing context. These networks track users' online activities over time by collecting information through automated means, including through the use of browser cookies, web beacons, device identifiers, server logs and other similar technologies. The networks use this information to show ads that may be tailored to individuals' interests, to track users' browsers or devices across multiple websites and apps, and to build a profile of users' online browsing and app usage activities. The information our ad networks may collect includes data about users' visits to websites and apps that participate in the relevant ad networks, such as the pages or ads viewed and the actions taken on the websites or apps. This data collection takes place both on our Digital Services and on third-party websites and apps that participate in the ad networks. This process also helps us track the effectiveness of our marketing efforts.

To learn how to opt out of ad network interest-based advertising in the U.S., please visit www.aboutads.info/choices and http://www.networkadvertising.org/choices/.

Information Sharing

We do not sell or otherwise share personal information about you except as described in this Digital Privacy Policy.

• Subject to applicable law, we may share your personal information with our affiliates and subsidiaries for the purposes described in this Digital Privacy Policy.
• We may share your personal information with service providers who perform services for us or on our behalf, such as those related to payment processing, database and web hosting, email service providers, map service providers, sweepstakes administrators, credit reporting agencies, advertising and marketing, electronic bill payment services or debt collection, data analytics, advocacy campaigns and administrative or management functions. We do not authorize these service providers to use or disclose the information except as necessary to perform services on our behalf or comply with legal requirements.
• We may share your information with third parties who are providing the product, service or information that you have requested.
• With your consent, we also may share your information with third parties who may send you promotional materials and marketing or advocacy communications about products, services or campaigns that may be of interest to you.
• We may disclose personal information about you (1) if we are required to do so by law or legal process (such as a court order or subpoena), (2) to law enforcement authorities or other government officials to comply with legal requests, (3) when we believe disclosure is necessary to prevent physical harm or financial loss, (4) to establish, exercise or defend our legal rights, (5) in connection with an investigation of suspected or actual fraud or illegal activity or (6) otherwise with your consent.

We reserve the right to transfer any information we have about you in the event of a potential or actual sale or transfer of all or a portion of our business or assets (including in the event of a merger, acquisition, joint venture, reorganization, divestiture, dissolution, liquidation or other corporate restructuring).

Regulatory Requirements

Some state laws, and certain state utility commissions with regulatory oversight of our utility service territories, require that certain customer information be protected from disclosure to our affiliate companies. The relevant laws and codes of conduct may be found here:

Your Choices

We offer you certain choices in connection with the personal information we obtain about you. To update your preferences, limit the communications you receive from us or submit a request, please contact us as specified in the How to Contact Us section of this Digital Privacy Policy or adjust the privacy settings in the Digital Service, as applicable.
You will receive email communications from us in connection with your use of our Digital Services and other services, such as when you sign up for an account online, perform an online transaction (for example, paying your bill or requesting a new password) or provide your email address to a customer contact representative. You may also receive email communications from us about new products and services. To opt out of receiving marketing emails from us, use the one-click unsubscribe link at the bottom of the email you received. In some instances, Duke Energy will co-brand with another company. Please be aware that the privacy policy referenced at the bottom of the webpage governs the collection of information on that page.

If you are a California consumer, please see the section of this Privacy Policy called "California Consumer Privacy Statement" for more information about your privacy rights.

Third-Party Websites and Features

Our Digital Services may transfer you to or provide links to third-party websites or provide you access to certain third-party features (such as the ability to view third-party videos and content or connect to certain social networks or third-party services through our Digital Services) for your convenience and to provide selected services or functions. These third-party websites and features may use cookies to collect information on our sites, including via plug-ins and widgets. These third parties may operate independently from us. The privacy practices of the relevant third parties, including details on the information they may collect about you, are subject to the privacy statements of these parties, which we strongly suggest you review. To the extent any linked services or third-party features are not owned or controlled by us, Duke Energy is not responsible for these third parties' information practices.

How We Protect Personal Information

We maintain administrative, technical and physical safeguards designed to protect personal information against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use.

Children's Personal Information

Certain of Duke Energy's Digital Services are directed to children and teens located in the United States, including children under age 13. We do not knowingly collect or solicit personal information from children under age 13 without parental consent, unless permitted by law. If we become aware that we have collected personal information from a child under age 13 without parental consent or unless otherwise permitted by law, we will delete it in accordance with applicable law. If you believe that a child may have provided us with personal information without parental consent or otherwise not permitted by law, please contact us as specified in the How to Contact Us section of this Digital Privacy Policy.

Duke Energy is committed to protecting the privacy of children who use our Digital Services. This Section of the Digital Privacy Policy explains our information practices in the United States with respect to information provided by children under the age of 13. Please note that this Section of the Digital Privacy Policy applies regardless of whether your child uses a computer, mobile phone, tablet, or other device to access our Digital Services.

WHAT INFORMATION DO WE COLLECT?
Information your child provides directly
Some Duke Energy Digital Services enable your child to give us information directly. For example, your child may be asked to provide the email address of his or her parent or guardian in connection with registering for a Digital Service. With your consent, we may combine the parental email address information we collect from your child with information about your Duke Energy customer account.

Information about your child's use of the Digital Services
We may also collect information about your child's use of our Digital Services through software on the device your child uses and other means. For example, we may collect:

• Log information - such as the time and duration of your child's use of the Digital Service, and any information stored in cookies that we have set on the device.
• Device information - such as the hardware model, IMEI number and other unique device identifiers, MAC address, IP address, operating system versions, and settings.
• Other information about your child's use of the Digital Services, such as how your child interacts with content offered through a Service.

HOW DO WE USE YOUR CHILD'S INFORMATION?
We may use information we collect from your child for the following purposes:

• to provide a Digital Service or feature your child requests;
• to notify and communicate with you, the child's parent or guardian, about your child's use of the Digital Service;
• to provide customized content and provide personalized services based on your child's past activities on our Digital Services;
• for assessment and analysis of our market, customers, products, and services; and
• to understand the way people use our Digital Services so that we can improve them and develop new products and services.

TO WHOM DO WE DISCLOSE YOUR INFORMATION?
We will not disclose information collected from your child to third parties for their own independent marketing or business purposes without your further consent. However, we may disclose such information to the following entities:

• Service providers. We may disclose the information collected from your child to companies that provide services for or on behalf of us, such as companies that help our Digital Services to function. These entities are limited in their ability to use the information collected from your child for purposes other than providing services for us.
• Other Parties When Required by Law or as Necessary to Protect Our Services. There may be instances when we disclose information collected from your child to other parties:
  1. to comply with the law or respond to compulsory legal process (such as a search warrant or other court order);
  2. to verify or enforce compliance with the policies governing our Digital Services; and
  3. to protect the rights, property, or safety of Duke Energy Corporation, or any of our respective affiliates, business partners, or customers.
• Other Parties in Connection with Corporate Transactions. We may disclose information collected from your child to a third party as part of a merger or transfer, or in the event of a bankruptcy.

DATA RETENTION AND DELETION
As a parent or guardian, you can review or have the information collected from your child deleted. You may also refuse to permit further collection or use of the information. To do so, please email our Data Privacy Program at dataprivacy@duke-energy.com or contact us using the information below.

California Consumer Privacy Statement

Duke Energy Corporation

CALIFORNIA CONSUMER PRIVACY STATEMENT

Last Updated: July 1, 2021

This California Consumer Privacy Statement ("Statement") supplements the Digital Privacy Policy available at https://www.duke-energy.com/legal/privacy. It applies solely to California consumers and addresses personal information we collect both online and offline. This Statement does not apply to Duke Energy personnel. Sections 2-5 of this Statement do not apply to job applicants.

This Statement uses certain terms that have the meaning given to them in the California Consumer Privacy Act of 2018 and its implementing regulations (the "CCPA").

1. Notice of Collection and Use of Personal Information
We may collect (and may have collected during the 12-month period prior to the effective date of this Statement) the following categories of personal information about you:

• Identifiers: identifiers such as a real name, alias, postal address, unique personal identifier (such as a device identifier; cookies, beacons, pixel tags, mobile ad identifiers and similar technology; customer number, unique pseudonym, or user alias; telephone number and other forms of persistent or probabilistic identifiers), online identifier, internet protocol address, email address, account name, Social Security number, driver's license number, and other similar identifiers
• Additional Data Subject to Cal. Civ. Code § 1798.80: signature, physical characteristics or description, state identification card number, education, bank account number, credit card number, debit card number, and other financial information and medical information
• Protected Classifications: characteristics of protected classifications under California or federal law, such as race, color, national origin, age, sex, gender, marital status, medical condition, disability, citizenship status, and military and veteran status
• Commercial Information: commercial information, including records of personal property, products or services purchased, obtained, or considered, and other purchasing or consuming histories or tendencies
• Online Activity: Internet and other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding your interaction with websites, applications or advertisements
• Geolocation Data such as information we collect about your location through our Digital Services
• Sensory Information: audio, visual, electronic and similar information
• Employment Information: professional or employment-related information
• Inferences: inferences drawn from any of the information identified above to create a profile about you reflecting your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes

We may use (and may have used during the 12-month period prior to the effective date of this Statement) your personal information for the purposes described in the How We Use the Information We Obtain section of our Digital Privacy Policy and for the following business purposes specified in the CCPA:

• Performing services, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing advertising or marketing services, providing analytics services, or providing similar services
• Auditing related to a current interaction with you and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance
• Short-term, transient use, including, but not limited to, the contextual customization of ads shown as part of the same interaction
• Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity
• Debugging to identify and repair errors that impair existing intended functionality
• Undertaking internal research for technological development and demonstration
• Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us
• Managing career opportunities with Duke Energy

2. Sources of Personal Information
During the 12-month period prior to the effective date of this Statement, we may have obtained personal information about you from the following categories of sources:

• Directly from you, such as when you purchase or obtain our products or services
• Others who use our services such as your family or friends
• Your devices, such as when you visit our Digital Services
• Our affiliates and subsidiaries
• Vendors who provide services on our behalf
• Online advertising services and advertising networks
• Data analytics providers
• Government entities
• Operating systems and platforms
• Social networks

3. Sale of Personal Information
We do not sell your personal information in exchange for monetary consideration. We may allow certain third parties (such as online advertising services) to collect your personal information via automated technologies on our Digital Properties in exchange for non-monetary consideration. We share the categories of personal information listed below for online advertising purposes and to provide third-party social network features and functionality on our Digital Properties. You have the right to opt-out of this disclosure of your information, which may be considered a "sale" under California law.

During the 12-month period prior to the effective date of this Statement, we may have sold the following categories of personal information about you to online advertising services and social networks:

• Identifiers
• Online Activity
• Geolocation Data
• Inferences

We do not have actual knowledge that we sell personal information of minors under 16 years of age.

4. Sharing of Personal Information
During the 12-month period prior to the effective date of this Statement, we may have shared your personal information with certain categories of third parties, as described below.

We may have disclosed the following categories of personal information about you for a business purpose to the following categories of third parties:

Right to Know: You have the right to request, twice in a 12-month period, that we disclose to you the personal information we have collected, used, disclosed and sold about you during the past 12 months.
Right to Delete: You have the right to request that we delete certain personal information we have collected from you.
Right to Opt-Out of Sale: You have the right to opt-out of the sale of your personal information.
Shine the Light Request: You also may have the right to request that we provide you with (a) a list of certain categories of personal information we have disclosed to third parties for their direct marketing purposes during the immediately preceding calendar year and (b) the identity of those third parties.

How to Submit a Request. To submit an access request, complete the CCPA Right to Know Request Form. To submit a deletion request, submit the CCPA Right to Delete Request Form. To opt-out of the sale of your personal information to third parties, complete the CCPA Right to Opt-Out of Sale Request Form.

To submit a Shine the Light request, email us at dataprivacy@duke-energy.com.

To make a request as an authorized agent on behalf of another individual, complete either the CCPA Individual Requestor Authorized Agent Request Form or the CCPA Legal Entity Requestor Authorized Agent Request Form.

For questions or concerns about our privacy policies and practices, please contact us as described in the How to Contact Us section of our Digital Privacy Policy.

Verifying Requests. To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to your personal information or complying with your request. If you have an account with us, we may verify your identity by requiring you to sign in to your account. If you do not have an account with us and you request access to or deletion of your personal information, we may require you to provide any of the following information: name, email address on file, phone number on file, an address on file, and/or information associated with a recent transaction, such as a the total of your latest utility bill or purchase. In addition, if you do not have an account and you ask us to provide you with specific pieces of personal information, we may require you to sign a declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request.

Additional Information. If you choose to exercise any of your rights under the CCPA, you have the right to not receive discriminatory treatment by us. To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request.

Updates to Our Digital Privacy Policy

This Digital Privacy Policy may be updated periodically and without prior notice to you to reflect changes in our personal information practices. We will indicate at the top of the policy when it was most recently updated.

How to Contact Us

If you have any questions about this Digital Privacy Policy or our privacy practices, or if you would like us to update information we have about you, change your preferences or exercise other applicable privacy rights, please email our Data Privacy Program at dataprivacy@duke-energy.com or contact us using the information below:

Duke Energy	Duke Energy Progress	Piedmont Natural Gas
Contact Us	Contact Us	Contact Us