Company: SBH
Filing Date: 2025-12-10
Form Type: DEF 14A
Source: 0001193125-25-313464
Chunk: 28

Company: Sally Beauty Holdings, Inc.
Filing Date: 2025-12-10
Form: DEF 14A
Chunk 28
---
 human trafficking, conflict minerals, land rights), “Employment Practices” (e.g., fair treatment, non-discrimination, wages and benefits, and freedom of association), and “Health and Safety” (e.g., occupational safety, occupational injury and illness, sanitation and housing).

In addition, we expect all suppliers to comply fully with all laws and regulations applicable to their business. Under our Supplier Code we may conduct an investigation or audit to confirm compliance and in some cases may terminate a business relationship due to non-compliance.

| SALLYBEAUTY HOLDINGS, INC. | 31 | 2025 Proxy Statement |

Our commitment to responsible sourcing and ethical business practices is also reflected in ourCode of Business Conduct and Ethics (Ethics Code), which applies to all SBH employees. The Ethics Code makes clear that we intend to operate “with regard to the welfare of SBH employees and for the protection of the environment and the general public.” Our Ethics Code requires employees to comply with our hazard communications program and to comply fully with all laws, rules and regulations affecting our business, including the national and local environmental and labor laws of our host nations and communities.

Our Board of Directors understands the critical importance of managing evolving risks associated with cybersecurity threats. Our Company is committed to protecting the privacy and security of customer information and the integrity of our information technology systems.

The Boardhas responsibility for overseeing risks related to the cybersecurity threat landscape, including data protection and security breach readiness. OurChief Information Security Officer (CISO)reports directly to theChief Information Officerand is responsible for the Company's cybersecurity risk management program that is tailored to address specific risks in the retail industry, using a flexible approach informed by our deep understanding of attacker methodologies, targeted assets, and industry best practices. On at least a quarterly basis, the CISO deliversa detailed report to the full Board --including Erin Nealy Cox, a cybersecurity expert -- on data protection and cybersecurity matters. The topics covered by these reports include risk identification and management strategies, cybersecurity strategy and governance structure, consumer data protection, the Company’s ongoing risk mitigation activities, learnings from data security incidents of peer companies, results of third-party assessments and testing, updates on annual associate training and other specific training initiatives.

We believe this accountability and reporting structure helps maintain the independence of the CISO while giving the Board direct and meaningful line-of-sight governance.

Numerous times per year, all employees receive simulated phishing attacks and are measured on how they interact with the attack and how quickly they report it. All employees participate in