California Privacy Policy

Effective Date: December 29, 2025

GATX Corporation and its affiliated entities (“GATX”) are committed to respecting your privacy and protecting your personal information. This California Privacy Policy applies to any California residents about whom we have collected personal information for purposes of providing our products and services to our customers (collectively, “you”). This primarily includes personal information about California residents who are employed by or otherwise represent businesses and other legal entities with which GATX does business and engages on a business-to-business basis as a business contact, representative, or prospective lead (hereafter, “B2B Data”).

We provide this California Privacy Policy to comply with applicable privacy laws, including the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (together, the “CCPA”). The CCPA provides California residents with rights to receive certain disclosures regarding the collection, use, and sharing of personal information, as well as rights to access, correct, delete, and restrict the sale, use, and disclosure of certain personal information we collect about them, unless exceptions apply. California residents also have the right not to receive discriminatory treatment by us for the exercise of your privacy rights under the CCPA. If you are a California resident, you may submit a request to exercise these rights as provided in the Your Privacy Rights section below.

For the purposes of this California Privacy Policy, except where a different definition is noted, “personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household. Personal information does not include publicly available information; lawfully obtained, truthful information that is a matter of public concern; information that has been de-identified or aggregated; or information covered by certain sector-specific privacy laws, as consistent with state law. Any capitalized term used and not otherwise defined in this California Privacy Policy has the meaning assigned to it in our Privacy Policy.

This California Privacy Policy governs personal information collected for business-to- business purposes. To learn more about our privacy practices with respect to personal information collected for employment-related purposes, please refer to our California Employee Privacy Policy.

If you are a visually impaired individual, an individual with another disability, or an individual seeking support in another language, you may access this California Privacy Policy by emailing us at contactgatx@gatx.com.

GATX may collect, or has collected, the following categories of personal information over the past twelve (12) months:

1. Identifiers, which includes first and last name; postal address; email address; telephone number; company name; and company title.
2. Personal information described in California Civil Code § 1798.80(e), which includes first and last names; signatures; and telephone number.
3. Characteristics protected under California or federal law, which includes your date of birth, age, or age range; gender or gender identity; marital status; and education level.
4. Commercial information, which includes records of personal property; products or services purchased, obtained, or considered; or other purchasing histories or tendencies.
5. Internet or other electronic network activity information, which includes cookie identifiers; browser software; IP address; your computer’s operating system; the website that referred you to our site and/or the search terms you entered into a search engine to reach our site; internet service provider (“ISP”); date/time stamp; clickstream data; and device platform, version, and other device characteristics which may include settings such as Wi-Fi, Bluetooth, and Global Positioning System (“GPS”).
6. Corporate financial information, which includes bank name, routing number, and account number.
7. Audio, electronic, visual, thermal, olfactory, or similar information, which includes photographic images; and call and voicemail recordings.
8. Professional or employment-related information, which includes employer name; employment history; business unit or division; job title or role; manager/supervisor; office location; and professional memberships.
9. Education information, which includes education and training history; and other qualifications and certifications.
10. Inferences drawn from the personal information listed above.

Please note that because of the overlapping nature of certain of the categories of personal information identified above, which are required by state law, some of the personal information we collect may be reasonably classified under multiple categories.

Sensitive personal information. Certain of the personal information that we collect, as described above, may constitute “sensitive personal information” under California law, including:

• Social security number
• Driver’s license, state identification card, or passport number; and
• Gender or gender identity.

We do not collect, sell, or share the personal information of individuals under 16 years of age.

We may collect personal information about you from the following categories of sources:

• From you, including through our websites, portals and other web applications (our “Websites”), in-person or via email, telephone, electronic messaging, postal mail, social media, or anywhere else where this Policy is referenced or linked.
• From other individuals, including our business partners, their employees and representatives, and our other employees and contractors.

We may supplement the information described above with information we obtain from other sources, including from both online and offline data providers.

We may use the personal information we collect about you for the following purposes:

• To present our Websites and their contents to you.
• To provide you access to our Websites;
• To provide you with information, products, or services that you request from us.
• To fulfill any other purpose for which you provide it.
• To provide you with notices about your account, including expiration and renewal notices.
• To notify you about changes to our Websites or any products or services we offer.
• To maintain and improve our Websites, products, and services.
• To allow you to participate in interactive features on our Websites.
• To comply with our legal, compliance, and regulatory obligations;
• In any other way we may describe when you provide the information.
• For any other purpose with your consent.

The sensitive personal information that we collect as described in Section 1 above may be used for any of the above purposes.

We will retain personal information for as long as needed or permitted in light of the purpose(s) for which it was obtained. The criteria used to determine our retention periods include: (i) the length of time we have an ongoing relationship with you; (ii) whether there is a legal obligation to which we are subject; (iii) whether there is a privacy right that has been exercised with respect to the personal information (such as a request to delete); and (iv) whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation, or regulatory investigations).

We do not sell or share your personal information as those terms are defined under California law.

We may disclose your personal information to the following categories of service providers and third parties:

• Our employees. We may disclose your personal information to our employees consistent with the purposes identified in Section 3 above.
• Our affiliates. We may disclose your personal information to our affiliates consistent with the purposes identified in Section 3 above.
• Service providers. We may disclose your personal information to our service providers to provide services to or on behalf of GATX, such as marketing, analytics, hosting, technical support, and other services. These third parties have access to your personal information only to perform these tasks on our behalf and are obligated not to disclose or use the information for any other purpose.
• Affiliate and business transfer. If GATX is involved in a merger, acquisition, or asset sale, your personal information may be transferred. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.
• Legal compliance and harm prevention. We may disclose your personal information as we believe necessary (i) to comply with applicable law, rules, and regulations; (ii) to enforce our contractual rights; (iii) to investigate possible wrongdoing in connection with our company; (iv) to protect and defend the rights, privacy, safety, and property of GATX, you or others; and (v) to respond to requests from courts, law enforcement agencies, regulatory agencies, and other public and government authorities.

If you are a California resident, you have the right to make the following requests under applicable California law in relation to your personal information, subject to certain exceptions:

• Right to Know. You have the right to, up to twice in a 12-month period, request what personal information we collect, use, disclose, and/or sell, and to whom, as applicable.
• Right to Delete. You have the right to request, under certain circumstances, the deletion of your personal information that we collect.
• Right to Opt-Out of Sale or Sharing. You have the right to opt-out of the sale or sharing of your personal information as those terms are defined under California law. Please note that GATX does not currently sell or share personal information that is subject to this California Privacy Policy.
• Right to Limit Use and Disclosure. You have the right to limit the use or disclosure of your sensitive personal information to only the uses necessary for us to provide our products and services to you, or for certain other purposes authorized by California law. We will not use or disclose your sensitive personal information after you have exercised your right unless you subsequently provide consent for the use of your sensitive personal information for additional purposes.
• Right to Correct. You have the right to request the correction of your inaccurate personal information.
• Right to Non-Discrimination. You have the right not to receive discriminatory treatment for the exercise of the privacy rights described in this section.

How to submit a request. You may exercise any of the rights described in this section by emailing us at contactgatx@gatx.com or by calling us at 312-621-6200 or 800-428-8161.

Any request you submit to us is subject to an identification and residency verification process (“Verifiable Consumer Request”) as permitted by the CCPA. We will not fulfill your request unless you have provided sufficient information that enables us to reasonably verify that you are the consumer about whom we collected the personal information. To verify you, you must provide us with first and last name, email address and/or telephone number. These rights are also subject to various exclusions and exceptions under applicable laws.

You may also designate an authorized agent, in writing or through a power of attorney, to request to exercise the above rights on your behalf. If you should use an authorized agent to exercise your various rights under the CCPA, we may require that you provide your authorized agent with written permission to exercise your various rights and to verify your own identity with us. If your authorized agent does not submit proof that they have been authorized by you to submit verified requests for disclosure and deletion, we reserve the right to deny such a request that we have received and will explain to your authorized agent why we have denied such request. The authorized agent may submit a request to exercise these rights by emailing the letter of authorization or power of attorney to contactgatx@gatx.com.

We currently do not collect household data. If we receive a request submitted by all members of a household, we will individually respond to each request. We will not be able to comply with any request by a member of a household under the age of 13, as we do not collect personal information from any person under the age of 13.

We will confirm receipt of your request within ten (10) business days. We will respond to a Verifiable Consumer Request within forty-five (45) days after receipt with information covering the twelve (12) month period preceding receipt, provided that we will respond no more than twice in a twelve-month period. We reserve the right to extend the response time by an additional forty-five (45) days when reasonably necessary and provided consumer notification of the extension is made within the first forty-five (45) days.

If you have any questions about this California Privacy Policy or wish to exercise one of your privacy rights, please contact us using the following information:

GATX Corporation
233 S Wacker Drive
Chicago, IL 60606-7147
contactgatx@gatx.com
312.621.6200 or 800.428.8161

or at

GATX Corporation
233 S Wacker Drive
Chicago, IL 60606-7147
Attention: Chief Privacy Officer, Niyi Adedoyin
PrivacyOfficer@gatx.com