ESG PROGRESS AT MARRIOTT INTERNATIONAL → 76 ESEG PROAR TMS ORINOL PUBLIC POLICY Indicator Description Response and / or References 415 Management approach 2021 Serve 360 Report (“Public Policy”, p. 57) Political Activity – Policies, Oversight and Disclosure 415-1 Political contributions 2021 Serve 360 Report (“Public Policy”, p. 57) Political Activity – Policies, Oversight and Disclosure CUSTOMER HEALTH AND SAFETY Indicator Description Response and / or References 416 Management approach Marriott’s Global Safety & Security Team provides training, policy enforcement, and technical expertise in safety and security management to help minimize harm and losses to our customers, associates, stakeholders, and business. The team is trained to assess and respond appropriately to potential threatening situations and our hotels work closely with local, state, federal, and international authorities. In the United States, Marriott’s Be Safe program also aims to increase accountability at the leadership level for implementing and supporting safety initiatives. We also work with local security authorities, including the U.S. Department of State and Department of Homeland Security when establishing security protocols for some of our hotels. We also tailor individual security measures to each hotel and review those measures often. In 2020, due to the global pandemic, Global Safety & Security played an integral part in the development of Marriott’s COVID-19 Response Plan. 2021 Serve 360 Report (“Our Global COVID-19 Community Response”, p. 16) Commitment to Clean Commitment to Clean FAQ Business Conduct Guide (“Health Safety and Security, p. 37) 416-1 Assessment of the health and safety impacts of product and service categories Through our Global Food Safety program, we tailor individual safety and security measures to each hotel, conducting self-inspections using our food safety standards as guidelines. As part of our program, Marriott also has a comprehensive food safety management system to control risk factors that may lead to foodborne outbreaks. We also implement active managerial controls, including training, vendor specifications, quality control, and other monitoring procedures. CUSTOMER PRIVACY Indicator Description Response and / or References 418 Management approach 2021 Serve 360 Report (“Data Privacy and Cybersecurity”, p. 56) 2020 Annual Report (“Technology, Information Protection and Privacy Risks”, p. 21-23) Privacy Center 418-1 Substantiated complaints concerning breaches of customer privacy and losses of customer data At the end of February 2020, Marriott identified that an unexpected amount of guest information may have been accessed through an application used by Marriott-branded hotels to help provide services to guests at hotels. Upon discovery, the company confirmed that the login credentials were disabled, immediately began an investigation, implemented heightened monitoring, and arranged resources to inform and assist guests. Marriott sent emails to guests whose information was involved and set up a dedicated website and call center resources with additional information for guests, including a list of steps guests involved could consider taking and information about enrolling in a personal information monitoring service offered free of charge by Marriott and provided by a third party. Marriott also notified relevant authorities and is supporting their investigations. 2021 Serve 360 Report (“Data Privacy and Cybersecurity”, p. 56) Marriott International Notifies Guests of Property System Incident