Land Owners Contact info@highpeakenergy.com 817-850-9200 Privacy Policy HIGHPEAK PRIVACY POLICY This is the Privacy Policy of HighPeak Energy, Inc. dba HighPeak (“HighPeak” or “we” or “us” or “our”). HighPeak Energy is an independent oil and natural gas company with our offices located at 421 W. 3rd Street, Suite 1000 Fort Worth, Texas 76102, and 303 W. Wall Street, Suite 2202 Midland, Texas 79701. HighPeak offers various oil and gas related services (“Services”) and collects, uses, and discloses Personal Data, as outlined in this Privacy Policy, to improve our Services and our business; for advertising and marketing; and to provide you products and the Services in your contract with us. INTRODUCTION The concept of online privacy includes the right to decide what personal information you choose to submit and how that information will be used. To protect user privacy, we strive to make users aware of the kinds of information we collect from them, explaining why we collect that information, how we use it, and whether it will be shared with others. This Privacy Policy relates to data about you and your interaction with our Services, provides legally required information (for EU residents), and lists your rights in relation to your personal data. PERSONAL DATA “Personal Data” is information that can be used to identify you directly or indirectly and includes such things as your full name, email address, phone number, location, and cookie and network identifiers. We need to process certain of your Personal Data in order to fulfil our contractual obligations to you and to provide you with our Services. Where we ask for your consent to process your Personal Data, you have the right to withdraw such consent as described in this Privacy Policy. Please note, however, we may be unable to provide you certain Services that require the use of Personal Data. Even where your consent would otherwise be required, we may process your Personal Data in accordance with our legitimate interests under applicable law. COLLECTION OF PERSONAL DATA Information collected automatically When users surf the HighPeak website, we may collect certain Personal Data using cookies and other technologies, such as web beacons, geolocation, and IP addresses. We use browser cookies for functionality and for personalization, performance/analytics, and for advertising. Our Use of Cookies section contains more information. Information collected via online form Personal Data collected includes name, company name, phone number, email address, and city submitted by a user in the “contact us” form. This Personal Data is not distributed to parties outside of HighPeak unless a trusted third party is providing services for us. Such identifying information is used only for responding to users’ comments or questions and is not made available for other purposes. Information collected by direct request We collect Personal Data from you when you request information or place an order with us for products or services or when you use our facilities to perform functions under a contract with us. This Personal Data may include name, address, phone number, email address, company name, location data, and payment information. DISCLOSURE OF PERSONAL DATA We do not sell, trade, or otherwise transfer to third parties any user personally identifiable information unless the trusted third party assists us in conducting our business or providing services to clients or their users. We only transfer such information if those third parties agree to keep your information confidential. We may release certain analytics for improvement of our website and to better understand our users’ needs. We may also release user information when we believe release is required to comply with the law, enforce our website policies, or protect ours and others’ rights, property, or safety. Thus, we may disclose your Personal Data to the following, including: Vendors who are our business partners, marketing partners, and service providers who support us to provide our Services. Advertising and Marketing providers for advertising and marketing HighPeak and our Services. Legal Compliance. If permitted or required by law, we will disclose Personal Data to law enforcement, government or regulatory bodies, or other authorized authorities so as to comply with laws, regulations, court orders, or other legal obligations, to assist in investigations, protect and defend our rights, to enforce our terms and conditions, or for crime prevention. Business Sale, Acquisition, or Reorganization. We may disclose Personal Data in connection with a contemplated or an actual reorganization of our business, related to the financing, sale, acquisition, or other transaction involving the disposal of all or part of our business or assets, including for the due diligence needed to decide whether to proceed with a transaction. LEGAL BASIS FOR PROCESSING DATA We process your Personal Data for a variety of different purposes described below. Under the GDPR we must have a valid lawful legal basis for doing so. A legal basis can among other things, include consent, performance of a contract, or the legitimate interests of our business. Contracts We may process your Personal Data in order to perform our contractual obligations to you such as us providing services or fulfilling purchases you have made, contacting you regarding issues with your use of the Services, providing the Services, or when your Personal Data needs to be provided to our service providers so we can fulfill the terms of our contract with you for the Services. Court Orders or Governmental Requirements We may process your Personal Data to comply with laws, regulators, court orders, or other legal obligations, or for pursuing legal process. Legitimate Interests We may process your Personal Data to operate our business and provide the Services for HighPeak’s “legitimate interests” under the law, except where such interests are overridden by your fundamental rights which require protection of personal data. Legitimate interests may include a need: To communicate with you regarding the Services, including to provide you notices regarding changes to our terms and to address and respond to your requests, inquiries, and complaints. To send you surveys in connection with our Services. To assist in the investigation of suspected illegal or wrongful activity, and to protect and defend our rights and property or the rights or safety of third parties. To develop, provide, and improve our Services. To enforce our agreements or this Privacy Policy or agreements with third parties. Consent For residents in the EU, if there is no other legal basis, affirmative consent is required. While in the U.S., you typically provide consent when you receive this Privacy Policy. For the following reasons, if we are not already authorized to process the Personal Data under applicable law, processing data requires affirmative consent in the EU. Marketing We may ask for your consent to contact you by telephone, post and/or email about products, promotions, industry developments, or services which we think may be of interest to you, and for other marketing purposes. Research We may ask for your consent to use your Personal Data for research purposes. Use of Cookies Our website uses cookies to improve user experience. A “cookie” is a small text file that a web server stores in the browser software. When the browser makes a connection to the server (for example, when requesting a web page from the same domain that created the cookie), the browser sends the info to the server. Some cookies recall Personal Data previously indicated by a web user. Cookies can remember, for example, login information, preferences, and shopping cart contents. Other cookies, using non-Personal Data, often placed by our partners or other third parties, are used for analytics, marketing, or advertising. Cookies may record information such as Internet domain and host names; Internet protocol (IP) addresses; browser software, operating system types; clickstream patterns; and dates and times that our site is accessed. We use analytics technologies to improve our site and Services. Cookies can be controlled within the web browser you are using. To disable cookies, you must adjust your web browser’s settings. For information on how to disable cookies, refer to your browser’s documentation. EU RESIDENTS MAY WITHDRAW CONSENT If you are an EU resident, you may at any time withdraw the consent you previously provided for the processing of your Personal Data by contacting us at info@highpeakenergy.com, and we must comply so long as we are not required by applicable law or professional standards to retain such information. Anytime you want to stop receiving marketing messages, you can click the “unsubscribe” link included in our email marketing messages. This will remove you from future email marketing mailings. DATA RETENTION Your Personal Data will be retained to comply with any legal obligations, to resolve disputes, and to enforce our agreements, and we will keep it for as long as you maintain an account or as it is otherwise necessary to provide you the Services. Where permissible, we will delete your Personal Data upon your request, as further described in the Access to, Modification, and Deletion of Personal Data section of this Privacy Policy. Transfer and storage of Personal Data HighPeak’s systems, and our associated Services and systems, may be stored on servers in the United States. U.S. data protection and privacy laws do not offer the same level of protection as laws for those who are EU residents. When you use our Services and when you submit your Personal Data, you agree to the transfer, storage, and or processing of your Personal Data in the United States. ACCESS TO, MODIFICATION, AND DELETION OF PERSONAL DATA EU Residents You have the right in certain circumstances to request confirmation from us as to whether or not we are processing your Personal Data, and where we are processing your Personal Data. You also have the right to request access to, modification of, or deletion of your Personal Data. Further, you have the right in certain circumstances to review the Personal Data concerning you that you provided to us and have the right in certain circumstances to transmit such data to another controller. To exercise your rights with respect to your Personal Data, please contact us at info@highpeakenergy.com. As permitted by law, certain data elements may not be subject to access, modification, and/or deletion. Please note, however, we may be unable to provide you certain Services that require the use of Personal Data if you request deletion of Personal Data. Furthermore, we may charge for this service and will respond to reasonable requests as soon as practicable and as required by law. THIRD-PARTY AND GEOLOCATION POLICY HighPeak does not transfer personal information provided by covered individuals to third parties without security due diligence being conducted by HighPeak to ensure the transferees meet the HighPeak-approved level of security. As a company operating strictly within the United States and remotely in the EU, HighPeak will only use Delivery Centers located inside the continental United States or EU. WEBSITE SECURITY MEASURES AND OTHER WEBSITES Although our network is protected by security safeguards consistent with our business and sector of the industry, we cannot guarantee or fully prevent any security risk related to accidental data loss, destruction, or damage to Personal Data. This Privacy Policy only applies to our website. Our site or Services may provide a link or otherwise provide access to another website or Internet location; however, those links are provided only for your convenience. We have no control over, do not review, and are not responsible for any other sites, their content, or any goods or services available through them. CONTACT US For questions regarding this Privacy Policy, please contact the Privacy Officer, Shena Hutto, at: info@highpeakenergy.com, 817-850-9200 or by mail at: HighPeak Energy, Inc 421 W. 3rd Street, Suite 1000 Fort Worth, Texas 76102 LAST UPDATED: August 23, 2020 © 2020, HIGHPEAK ENERGY Privacy Policy