Last modified: 10/3/2024

Introduction

Endure Energy, and its subsidiaries and affiliates, including Sunoco LP (collectively, the “Company”), recognize the importance of protecting an individual’s private information that is in the Company’s possession. This Privacy Policy (“Policy”) establishes guidelines for the Company’s collection, protection, usage, and sharing of Personal Identifiable Information.

This Policy describes the types of information we may collect from you or that you may provide when you visit our websites or our social media sites (the websites and social media sites collectively referred to as our “Sites“), or register to purchase our products, use our services or attend our events, and our practices for collecting, using, maintaining, protecting, and disclosing that information.

This Policy applies to information we collect on the Sites; and in email, text, and other electronic messages between you and the Sites. It does not apply to information collected by us offline or through any other means, including on any other website operated by any third-party, or by any third-party, including through any application or content (including advertising) that may link to or be accessible from or on the Sites.

Please read this Policy carefully to understand our policies and practices regarding your information and how we will treat it. If you do not agree with our policies and practices, your choice is not to use our Sites. By accessing or using these Sites, you agree to this Policy. This Policy may change from time to time (see Changes to Our Privacy Policy below). Your continued use of these Sites after we make changes is deemed to be acceptance of those changes, so please check the Policy periodically for updates.

Users Outside the United States of America

If you are a resident of a country within the European Union or are otherwise accessing our site from outside the United States of America, by using this site and providing us your information, you hereby explicitly acknowledge and agree to (i) the transfer of such information to the United States and (ii) the collection, use and disclosure of your personally identifiable information in accordance with this Policy. If you do not agree with this transfer, collection, use, or disclosure, please do not use the Sites.

Children Under the Age of 18

If you are under 18, do not use or provide any information on the Sites. Our Sites are not intended for children under 18 years of age. No one under age 18 may provide any information to the Sites. We do not knowingly collect personal information from children under 18. If we learn we have collected or received personal information from a child under 18 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 18, please contact us at officeofethicsandcompliance@energytransfer.com.

Information We Collect About You and How We Collect It

We collect several types of information from and about users of our Sites, including information:

• By which you may be personally identified, such as name, postal address, e-mail address, telephone number or any other identifier by which you may be contacted online or offline (“personal information“); and
• About your location, internet connection, the equipment you use to access our Sites, and usage details.

We collect this information:

• Directly from you when you provide it to us.
• Automatically as you navigate through the site. Information collected automatically may include usage details, IP addresses, and information collected through cookies and other tracking technologies.

Lawful Basis

We will use consent as a lawful basis for collecting, using, maintaining, protecting, and disclosing personal information. Please note that by accessing the Sites, you consent to the collection, processing, and disclosure of personal information.

Information You Provide to Us
The information we collect on or through our Sites may include:

• Information that you provide by completing forms on our Sites. This includes information provided at the time of registering to use our Sites or to attend one of our programs, posting material, or requesting products or services. We may also ask you for information when you report a problem with our Sites.
• Records and copies of your correspondence (including your email addresses) if you contact us.
• Your search queries on the Sites.

You also may provide information to be published or displayed (hereinafter, “posted“) on public areas of the Sites, or to be transmitted to other users of the Sites or third parties (collectively, “User Contributions“). Your User Contributions are posted and transmitted to others at your own risk. Although you may set certain privacy settings for such information, please be aware that no security measures are perfect or impenetrable. Additionally, we cannot control the actions of other users of the Sites with whom you may choose to share your User Contributions. Therefore, we cannot and do not guarantee that your User Contributions will not be viewed by unauthorized persons.

Information We Collect Through Automatic Data Collection Technologies
As you navigate through and interact with our Sites, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:

• Details of your visits to our Sites, including traffic, location, and other communication data and the resources you access and use on the Sites.
• Information about your computer and internet connection, including your IP address, operating system, and browser type.

Your IP address is automatically assigned to your computer by your Internet Service Provider. An IP address may be identified and logged automatically in our server log files whenever a user accesses the Sites(s), along with the time of the visit and the visited page (s). Collecting IP addresses is standard practice and is done automatically by many websites, applications, and other services. We use IP addresses to calculate usage levels, diagnose server problems, and administer the Sites(s). We may also derive your approximate location from your IP address.

The information we collect automatically is only statistical data and does not include personal information. It helps us to improve our Sites and to deliver a better and more personalized service by enabling us to:

• Estimate our audience size and usage patterns.
• Store information about your preferences, allowing us to customize our Sites according to your individual interests.
• Speed up your searches.
• Recognize you when you return to our Sites.

The technologies we use for automatic data collection may include:

• Cookies (or browser cookies). A cookie is a small file placed on your computer’s hard drive. You may refuse to accept browser Cookies by activating the appropriate setting on your browser. However, if you select this setting you may be unable to access certain parts of our Sites. Unless you have adjusted your browser setting so that it will refuse cookies, our system may issue cookies when you direct your browser to our Sites. We use both session and persistent cookies on the Sites and we use different types of cookies to run the Sites:
• Essential/strictly necessary cookies: Some cookies we use are essential to the functioning of the Sites.
• Analytical/performance cookies: Allow us to recognize and count the number of visitors and see how visitors move around the Sites when using them. This helps us improve the way the site functions.
• Functionality cookies: Used to recognize you when you return to the Sites. This enables us to personalize our content for you, greet you by name, and remember your preferences.
• Targeting cookies: Record your visit to the Sites, the pages you have visited, and the links you have followed. We will use this information to make the Sites more relevant to your interests.
• Flash Cookies. Certain features of our Sites may use locally stored objects (or Flash cookies) to collect and store information about your preferences and navigation to, from, and on our Sites. Flash cookies are not managed by the same browser settings used for browser cookies. For information about managing your privacy and security settings for Flash cookies, see Choices About How We Use and Disclose Your Information.
• Web Beacons. Pages of the Sites may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit the Firm, for example, to count users who have visited those pages or opened an email and for other related website statistics (for example, recording the popularity of certain website content and verifying system and server integrity).
• Google Analytics. We use Google Analytics to track how you and others use certain Sites in order to manage and improve those Sites. Google Analytics collects information such as how often users visit this site, what pages they visit when they do so, and what other sites they used prior to coming to this site. Google Analytics collects only the IP address assigned to you on the date you visit this site, rather than your name or other identifying information. We do not combine the information collected through Google Analytics with personally identifiable information. For information on how Google uses this information, and how you can control the usage of that information, please see https://policies.google.com/privacy?hl=en-US.
• Google Adwords. We use the various Google Adwords features to advertise on third party websites, including Google, to previous visitors to the Sites. With Google Ads Remarketing, third- party vendors use Cookies (including third-party Cookies such as those from DoubleClick) to provide our advertisements on the internet based upon your past visits to the Sites, and with Demographics and Interest Reporting, we use aggregate data provided (such as age, gender, and interests) to understand and communicate better with visitors to the Sites. You may opt out of Google’s use of Google Adwords by adjusting your advertising settings.

Third-Party Use of Cookies and Other Tracking Technologies

Some content or applications, including advertisements, on the Sites are served by third parties, including advertisers, ad networks and servers, content providers, and application providers. When you use our website, these third parties may use cookies to collect information about you. The information they collect may be associated with your personal information or they may collect information, including personal information, about your online activities over time and across different websites and other online services.

They may use this information to provide you with interest-based (behavioral) advertising or other targeted content.

We do not control these third parties’ tracking technologies or how they may be used. You should contact the responsible provider directly if you have any questions about an advertisement or other third-party service. For information about how to opt out of targeted advertising from many providers, see Choices About How We Use and Disclose Your Information below.

How We Use Your Information

We use information that we collect about you or that you provide to us, including any personal information :

• To present our Sites and their related contents to you.
• To determine if we can provide you with information, products, or services you request from us, and to do so if possible.
• To fulfill any other purpose for which the information is provided.
• To carry out our obligations and enforce our rights arising from any contracts between you and us, including for billing and collection.
• To notify you about changes to our Sites or any products or services we offer or provide.
• In any other way we may describe when you provide the information.
• For any other purpose with your consent.

While registration may not be required for you to use a Site, there may be circumstances in which you choose to register for our products or services, to attend our events or to receive ongoing updates from Company. In these cases, we may contact registrants to invite them to our events, provide them with information about our services, publications, and products, or for other marketing purposes.

Disclosure of Your Information

We may disclose aggregated information about our users, and information that does not identify any individual, without restriction.

We may disclose personal information that we collect or that you provide as described in this Policy:

• To contractors, service providers, and other third parties we use to support our business and who are bound by contractual obligations to keep personal information confidential and use it only for the purposes for which we disclose it to them.
• To fulfill the purpose for which you provide it.
• For any other purpose disclosed by us when you provide the information.
• With your consent.

We may also disclose your personal information:

• To comply with any court order, law, or legal process, including response to any government or regulatory request.
• To enforce or apply our Terms and Conditions and other agreements, including billing and collection.
• If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of the Company, our clients, or others.
• To enforce or apply our Terms and Conditions and other agreements.

Choices About How We Use and Disclose Your Information

We strive to provide you with choices regarding the personal information you provide to us. We have created mechanisms to provide you with the following control over your information:

• Tracking Technologies and Advertising. You can set your browser to refuse all or some browser cookies or to alert you when cookies are being sent. To learn how you can manage your Flash cookie settings, visit the Flash player settings page on Adobe’s website. If you disable or refuse cookies, please note that some parts of this site may be inaccessible or not function properly.
• Information about the Company. If you do not wish to have your contact information used by the Company to promote our own or third-party products or services, you can opt-out by sending us an email stating your request to privacyoffice.mailbox@energytransfer.com If we have sent you a promotional email, you may send us a return email asking to be omitted from future email distributions.

We do not control third-party collection or use of your information to serve interest-based advertising. However, these third parties may provide you with ways to choose not to have your information collected or used in this way. You can opt-out of receiving targeted ads from members of the Network Advertising Initiative (“NAI“) on the NAI’s website.

Accessing and Correcting Your Information
You may email us at privacyoffice.mailbox@energytransfer.com to request access to, correction, or deletion of any personal information you have provided us. We cannot delete your personal information except by deleting your user account. We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect.

If you delete your User Contributions from the Sites, copies of your User Contributions may remain viewable in cached and archived pages or might have been copied or stored by other Sites users. Our Terms and Conditions govern the access and use of information provided on the Sites, including User Contributions.

Your California Privacy Rights
If you are a California resident, California law requires that we provide you with a summary of your privacy rights under the California Online Privacy Protection Act (the “Act”), the Shine the Light Law (the “Law”), and the California Business and Professions Code and Civil Code (the “Codes”). As required by the Act, the Law, and the Codes, we will provide you with the categories of personally identifiable information we collect through this Sites and the categories of third-party persons or entities with whom such personally identifiable information may be shared for direct marketing purposes at your request. We are required to inform you, at your request: (1) the categories of personally identifiable information we collect and what third parties, we share that information with; (2) the names and addresses of those third parties; and (3) examples of the products marketed by those companies. We are also required to allow you to control who we can and cannot share that information with. To obtain this information, please send a request by email. When contacting us, please indicate your name, address, and personally identifiable information you do not want us to share with third parties. The request should be emailed to us at privacyoffice.mailbox@energytransfer.comand labeled “California Customer Choice Notice.” Please allow thirty (30) days for a response. Also, please note that there is no charge for controlling the sharing of your personally identifiable information or requesting this notice.

EU General Data Protection Regulation (GDPR) and Panamanian Data Protection Law

The Company is committed to complying with the General Data Protection Regulation (GDPR) and Panamanian Data Protection Law (Law 81 of 2019 and Executive Decree 285 of 2021) to ensure the protection and privacy of personal data obtained from our customers, employees, and other stakeholders.

We have implemented comprehensive data protection policies, procedures, and technical measures to safeguard personal data collected, processed, and stored by our organization. Our commitment to GDPR and Panamanian Data Protection Law includes the following:

Individual Rights
Where it is permitted by applicable law, you may have the following rights:

• Right of access. The data subject shall have the right to obtain from the controller confirmation as to whether personal data concerning them are being processed, and, where that is the case.
• Right to rectification. The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning them.
• Right to erasure (‘right to be forgotten’). The data subject shall have the right to obtain from the controller the erasure of personal data concerning them.
• Right to restriction of processing. The data subject shall have the right to obtain from the controller restriction of processing.
• Right to data portability. The data subject shall have the right to receive the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format.
• Right to object. The data subject shall have the right to object to processing of personal data concerning them.
• Automated Decision Making. The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling.

Submitting a Data Subject Request
Data subject requests should be made to privacyoffice.mailbox@energytransfer.com.

International Transfers
The Company may transfer personal data to other Company affiliates located worldwide in accordance with applicable law. The Company has taken steps to ensure that personal data receives adequate level of protection.

Records Retention
We will retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Statement, unless a longer retention period is required or permitted by law.

Data Security

We have implemented measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure. The safety and security of your information also depend on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Sites, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

Unfortunately, the transmission of information via the Internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of your personal information transmitted to our Sites. Any transmission of personal information is at your own risk. We are not responsible for circumventing any privacy settings or security measures on the Sites.

Changes to Our Privacy Policy

It is our policy to post any changes we make to the Policy on this page. If we make material changes to how we treat our users’ personal information, we will notify you through a notice on the appropriate Site. The date the Policy was last revised is at the top of the page. You are responsible for ensuring we have an up-to-date active and deliverable email address for you, and for periodically visiting our Sites and this Policy to check for any changes.

Contact Information

To ask questions or comment about this Policy and our privacy practices, contact us at officeofethicsandcompliance@energytransfer.com.

To register a complaint, contact us at officeofethicsandcompliance@energytransfer.com or use the confidential EthicsPoint Helpline at 1-888-332-3592, 1-800-228-5687, or online at www.energytransfer.ethicspoint.com. The confidential Helpline is administered by an independent third-party and is available 24-hours a day / 7 days a week.

CONFIDENTIAL HELPLINE

In the U.S. call either 1-800-228-5687
or 1-888-332-3592
In Panama call 507-839-2834
In Ireland call 1800-849-263
In the Netherlands call 0800-0201062
In Mexico, call 800 872 1664
In China, call 4006612097

or online at energytransfer.ethicspoint.com. Open to all employees, customers, vendors or other stakeholders.

Per the GDPR, you have the right to lodge a complaint with the Data Protection Authority (DPA).

• The Data Protection Commission (DPC) in Ireland can be contacted by

email: info@dataprotection.ie or call (01) 765 01 00 or 1800 437 437

• The Dutch Data Protection Authority (DPA) can be contacted by

email: FG@autoriteitpersoonsgegevens.nl or call (+31) (0)70 8888 660