MAIN NAVIGATION PRIVACY POLICY EFFECTIVE DATE: May 11, 2018 LAST REVISED: July 22, 2021 Welcome to the Global Privacy Policy, which applies to websites, mobile apps and other online and/or offline services that are owned and operated by Global Partners LP’s operating subsidiaries, including without limitation, Global Montello Group Corp., Drake Petroleum Company, Inc., Warex Terminals Corporation, Global Companies LLC and/or Alliance Energy LLC (collectively, “Global”, “we” or “us”). Thank you for taking the time to read it. We appreciate that you trust us with your information. We wrote this Privacy Policy to help you make informed decisions by describing what we do with the information you entrust to us and how you can control your personal information. We’ve tried to keep legal and technical jargon to a minimum but, if you still have questions after you read our Privacy Policy, please let us know by contacting us: by e-mail at customerservice@alltown.com, or by telephone at 1-781-894-8800, or by U.S. mail at 800 South Street, Suite 500, Waltham, MA 02453. WHERE THIS PRIVACY POLICY APPLIES This Privacy Policy applies to your use of any website now or in the future related to Global’s retail locations (collectively, “Global Websites”, including without limitation alltown.com, alltownfresh.com, jiffymartstores.com, myhoneyfarms.com, pandhtruckstop.com, tbirdminimarts.com, mymrmikes.com and xtramart.com), any loyalty program now or in the future operated by Global (collectively, “Loyalty Programs”, including without limitation the Alltown Neighborhood Perks™ program, the Alltown Insiders™ program, the Honey Money®loyalty program and the Jiffy Mart™ Rewards program) and any mobile application, website or other digital service in or to which this Privacy Policy is posted or linked. For simplicity, we refer to all of these as “Services.” If a particular Service has its own privacy policy, then that privacy policy — and not this one – applies. INFORMATION WE COLLECT Information you give us. You must create a Loyalty Account (defined in the Terms of Service) to use certain Services. Of course, we collect all of the information that you give us in connection with your Loyalty Account. If you create a Loyalty Account, then you must choose at least a user name and personal identification number or password and provide to us basic information which are necessary for the account to work, such as your email address. You also may decide to tell us your Loyalty Account preferences. For certain Loyalty Programs (defined in the Terms of Service), you also may provide your credit card and other payment-related information to a mobile payment provider when you link a credit card to your Loyalty Account. Your payment information is made available to Global in a single use encrypted format when you make a payment from your Loyalty Account. Global does not store or maintain your credit card information. When you participate in surveys, you give us your responses to our questions. When you choose to participate in our Promotions (defined in the Terms of Service) or any of the Loyalty Programs (defined in the Terms of Service), we collect the information that you use to register or participate. If you contact our customer service team, we collect the information you give us. We may monitor or record your online or telephone discussions with our customer service team for training purposes and to ensure service quality. We will announce when your telephone calls are recorded, as required by law. If you give us information about other people (such as when you send others a product as a gift), we collect the information you give us to process your request. When You Connect with the Services through Social Media Certain Services may link with social media platforms and social media plug-ins (e.g., the Facebook “Like” button, ‘”Share to Twitter”‘ button) (collectively, “Social Media”). When accessing the Services through a Facebook or other Social Media account, we may (depending on the applicable settings) automatically receive information from the Social Media platform. We may collect and use this information for the purposes described in this Privacy Policy or at the time the information was collected. Information Collected from Your Use of the Services We collect information through our server logs. A server log is a list of the activities that a server performs. Our servers automatically collect and store in server logs the following information: your browser type, browser language, the date and time of your request and certain cookies that identify your browser or account. We may use various technologies to automatically collect information from your web browser, computer or device when you use the Services. Please see Section 3 for more information about the data collection technologies that we use and how we use them. Location Data If you are accessing the Services through one of our mobile applications, we collect precise geolocation (latitude and longitude) data (“Location Data”) as part of the functionality of the Services. We can collect Location Data when you grant permission (“allow”) through your mobile device’s operating system settings and, for some Services, in your Loyalty Account settings, too. Once you give us permission, we can collect Location Data through your mobile device’s GPS, Bluetooth or Wi-Fi connections and from your wireless carrier. Once you give us permission, the collection of your Location Data occurs when you are using a mobile application. If you decline permission for us to collect your Location Data, (a) we will not collect your Location Data, and (b) you may not have access to all features available through the Services. We collect your IP address. In some cases, your IP address may give us your location but not your precise geolocation. So, we don’t consider IP address Location Data. Stuff Google Wants to Make Sure You Know about Google Maps: Some of the Services may use Google Maps to determine your location. When Google Maps is part of the Services you choose to use, you also are subject to Google’s Privacy Policy at http://www.google.com/policies/privacy. Some of this information is collected through the data collection technology described in Section 3. COOKIES AND OTHER DATA COLLECTION TECHNOLOGY What is Data Collection Technology? We use different kinds of technology to collect information when you interact with the Services or with certain third parties. Cookies are small text files that are sent to or accessed from your web browser or your computer’s hard drive. A cookie typically contains the name of the domain (internet location) from which the cookie originated, the “lifetime” of the cookie (i.e., when it expires) and a randomly generated unique number or similar identifier. A cookie also may contain information about your computer, such as user settings, browsing history and activities conducted while using the Services. Web beacons (also called pixel tags or clear GIFs) are another type of data collection technology. A web beacon is computer code that enables us to monitor user activity and website traffic. To learn more about cookies and web beacons, visit www.allaboutcookies.org. The Services may use the following cookies: Strictly necessary cookies, which are required for the operation of the Services. Without them, for example, you would not be able to register or log in for the Services that we offer. Analytical/performance cookies, which allow us to recognize and count the number of visitors, to learn how visitors navigate the Services and to help us to improve the way Services function. Functionality cookies, which are used to recognize you when you return to the Services. Targeting cookies, which record your visits to the Services, the pages you visited and the links you followed. Targeting cookies helps us to deliver ads or messages that are relevant to you and your interests. We also share this information with third parties to identify and send you relevant messages. Interaction cookies, which allow you to recommend us on Social Media. Stuff Google Wants to Make Sure You Know about Google’s Data Collection Technology: We use Google Analytics which is a Google service that uses data collection technology to collect information about use of the Services and report website trends. Google requires disclosure about all Analytics features and inclusion of information about how “use of first-party cookies (such as the Google Analytics cookie) or other first-party identifiers, and third-party cookies (such as Google advertising cookies) or other third-party identifiers” and how they are used together. What is Collected through Our Data Collection Technology? The data collection technology that we use collects: Your IP address, computer or mobile device type and operating system, access times, referring website address. Your browser type and language. Your time zone. Location Data (if you are using a mobile application and you consent to providing it) – see LOCATION DATA above. Device identifiers – IMEI/UDID (a numeric identifier for your mobile device) and MAC address (another kind of numeric identifier for your mobile device). Why Use Data Collection Technology? Data collection technology helps us improve your experience of the Services by, for example, storing your password so you do not have to re-enter it each time you use the Services, customizing your experience, helping us analyze usage, technical and navigational metrics and detecting and preventing fraud. We may allow advertising services to use data collection technology to display personalized advertising in the Services and to measure the number of targeted ads displayed and their performance, such as how many people clicked on the ad. Can I Control Data Collection Technology? You can opt out of Google Analytics by visiting www.google.com/settings/ads or by downloading the Google Analytics opt-out browser add-on at https://tools.google.com/dlpage/gaoptout. To opt-out of personalized advertising generally, visit DAA Opt-Out Page (web browser only) or AppChoices (applications only). Opting out does not mean you will not see advertising – it means you won’t see personalized advertising from the companies that participate in the opt-out programs. Also, if you clear your cookies, you many need to opt-out again. Some web browsers (including some mobile web browsers) provide settings that allow you to control or reject cookies or to alert you when a cookie is placed on your computer. You also may be able to reject device identifiers by activating the appropriate setting on your mobile device. Although you are not required to accept cookies or mobile device identifiers to use the Services, if you block or reject them, you may not have access to all features available through the Services. What about Do Not Track Signals? Some web browsers (including Safari, Internet Explorer, Firefox and Chrome) have a “Do Not Track” (“DNT”) feature that tells a website that a user does not want to have his or her online activity tracked. If a website that responds to a DNT signal receives a DNT signal, the browser can block that website from collecting certain information about the browser’s user. Not all browsers offer a DNT option and DNT signals are not yet uniform. For this reason, many businesses, including Alltown, do not respond to DNT signals. HOW WE USE INFORMATION We use the information that we collect: To deliver the Services Create and manage your Account. Provide you with customer support and respond to your requests for information Complete transactions that you request. Manage and communicate with you about the Services. To administer the Loyalty Programs and Promotions Verify your eligibility. Deliver prizes and Points. For analytics and marketing Combine and analyze information collected through the Services. Combining information enables us to better understand users’ activities across the Services, to create a single set of information from all of ways that we interact with you, to deliver more personalized advertising and to understand how our advertisements perform. Develop and display Content (defined in the Terms of Service) tailored to your interests. Perform website or mobile application analytics. Communicate with you by email, postal mail, telephone, Social Media or mobile device about products or services that we think will interest you. To learn about what you and other users like so we can improve the Services Administer focus groups and surveys. Conduct research and analysis to improve our products and services and customer service. To prevent and detect fraud For legal compliance Comply with law legal requirements. Assist law enforcement (see HOW WE HANDLE A LAW ENFORCEMENT REQUEST FOR USER INFORMATION below). Enforce or exercise our rights in our Terms of Service. HOW WE SHARE INFORMATION We share information: With your consent or at your request With Our Service Providers We use third parties to help us operate the Services. These third parties include marketing services, analytics providers, web hosting providers, call center providers, payment processors and data security consultants. With Other Global Businesses We share information we collect through the Services with other businesses in the Global family. With Other Companies We share your information with other companies that use the information that we share to conduct personalized advertising for us. For Corporate Transactions We may share and transfer information if we are involved in a merger, sale, acquisition, divestiture, restructuring, reorganization, dissolution, bankruptcy or other change of ownership or control on any Global business (in each case, whether in whole or in part). When Required by Law Applicable law may require us to disclose your information if: (i) reasonably necessary to comply with legal process (such as a court order, subpoena or search warrant), government investigation or other legal requirements or (ii) necessary for the prevention or detection of crime (subject in each case to applicable law). Please see HOW WE HANDLE A LAW ENFORCEMENT REQUEST FOR USER INFORMATION below. To Enforce Legal Rights We alsoshare information (i) if disclosure would mitigate our liability in an actual or threatened lawsuit; (ii) as necessary to protect our legal rights and legal rights of users, customers, business partners or other interested parties; (iii) to pursue available remedies or limit the damages; (iv) to enforce our agreements with you; and (v) to respond to an emergency. YOUR RIGHTS TO YOUR PERSONAL INFORMATION If you are a registered user of the Services, we provide you with tools and Account settings that help you to access, correct, delete or modify the personal information that you provided to us and associated with your Account. Contact customer service for help at customerservice@alltown.com. You also can deactivate and permanently delete your Account by calling 1-781-894-8800 or the customer service number printed on your Loyalty Program card, if applicable, providing the customer service agent with answers to your security questions and then telling the customer service agent to delete your Account. If you have signed up for the mobile payment application and wish to delete it, you can uninstall the application by using the standard uninstall process available as part of your mobile device or operating system. You can stop all future information collection by a mobile application by uninstalling it using the standard uninstall process available as part of your mobile device or operating system. If you uninstall the mobile application from your mobile device, the unique identifier associated with your mobile device will continue to be stored. If you re-install the application on the same mobile device, we will be able to re-associate this identifier to your previous transactions and activities. Push Notifications You may at any time opt-out from allowing us to send you push notifications by adjusting the permissions in your mobile device. Location Data You may prevent your mobile device from sharing your Location Data by adjusting the permissions on your mobile device or in some cases within the relevant mobile app. Text Messages We may send text messages with your prior consent. You can cancel text messages at any time by texting “STOP”. After you text “STOP”, we may send you an additional text message to confirm that you are unsubscribed. You will no longer receive text messages from that short code but you may receive text messages if you are subscribed to other text lists. If at any time you have questions about the text messages, text “HELP”. After you send “HELP” we will respond with instructions on how to use our service as well as how to unsubscribe. MESSAGE AND DATA RATES MAY APPLY. HOW WE PROTECT INFORMATION We use technical and organizational measures designed to protect your information against unauthorized access, theft and loss. Unfortunately, however, we cannot guarantee the security of information transmitted to or through the Internet. You are responsible for maintaining the security of your Account and the information in your Account. We may suspend your use of all or part of the Services without notice if we suspect or detect any breach of security. If you believe that your Account or information that you provided to us is no longer secure, please notify us immediately at 781-894-8800 or at the customer service number printed on your Loyalty Program card, if applicable. HOW LONG WE RETAIN INFORMATION We keep your personal information in identifiable form only as long as we need it for the lawful purpose for which we collected it or, if longer or shorter, to comply with law, to resolve disputes and to enforce agreements with you. HOW WE HANDLE A LAW ENFORCEMENT REQUEST FOR USER INFORMATION Alltown is committed to cooperating with law enforcement while respecting each user’s right to privacy. We respond to valid legal process issued in compliance with U.S. law. ABOUT CHILDREN’S PRIVACY We do not knowingly collect personal information from children under age 13 because they are not allowed to use the Services. If you know that a person under age 13 or between the ages of 13-18 has provided us with personal information without parental consent, please notify us immediately at customerservice@alltown.com, or by telephone at 1-781-894-8800 or at the customer service number printed on your Loyalty Program card, if applicable. WHEN THIS PRIVACY POLICY CHANGES From time to time, we will update this Privacy Policy to add information about new features or services. We will notify you before we make material changes to this Privacy Policy so that you have time to review the changes and decide whether you would like to continue to use the Services under the terms of the new Privacy Policy. HOW TO CONTACT US If you have any questions about this Privacy Policy, please contact us: by e-mail at customerservice@alltown.com, or by telephone at 1-781-894-8800 or at the customer service number printed on your Loyalty Program card, if applicable, or by U.S. mail at 800 South Street, Suite 500, Waltham, MA 02453. CONTACT US • MEDIA INQUIRIES • CAREERS • GIFT CARDS Terms Privacy Policy © 2021 Alliance Energy LLC.