Thorntons Refreshing Rewards Privacy Statement

Thorntons brand and the Refreshing Rewards® program is owned and operated by BP Products North America Inc., under the brand of "Thorntons" (collectively, "Thorntons", "we" or "us" or "our"). Thorntons is a participating brand in the "Refreshing Rewards™" reward program owned and operated by BP (which provides loyalty offers at participating locations under bp brand Thorntons). Thorntons takes your privacy seriously and is committed to protecting your personal information. This Privacy Statement informs you how we process and protect your personal information.

This Statement applies to data collection and privacy practices of Thorntons in respect of the Refreshing Reward program and all personal information collected offline at Thorntons merchant locations, during any written, electronic, and oral communications with Thorntons representative parties, or by our Thorntons services online (collectively, the "Services"). Thorntons online Services include the website located at https://www.refreshingrewards.com and all corresponding webpages and websites that link to this Statement ("Site"), Thorntons Refreshing Rewards mobile application (e.g., Apple iOS apps, etc.) (collectively and individually, ("App"); and any other content, applications, features, functionality, information and services offered by us though the Site and/or the Apps.

Use of our Services is subject to the Refreshing Rewards Terms and Conditions, which you can view here and this Privacy Statement. Please read the Terms and Conditions, and this Privacy Statement carefully before you use our Services. By using our Services, you accept the Terms and Conditions and accept our privacy practices described in this Privacy Statement. If you cannot accept the Terms and Conditions and the practices outlined in this Privacy Statement, you must not use or access our Services.

We may modify this Statement at any time, without prior notice and If we make changes, we will notify you by revising the date at the top of this Statement. We will provide you with advanced notice if we make any material changes to how we collect, use or disclose your personal information that impacts your rights under this Statement. If you continue to access or use our Services after receiving the notice of changes, you acknowledge your acceptance of the updated Statement.

In addition, we may provide you with real-time disclosures or additional information about the personal information handling practices of specific parts of our Services. Such notices

may supplement this Statement or provide you with additional choices about how we process your Personal Information.

We collect personal information when you use our Services, create an account with us or submit personal information to us. The types of personal information that we may collect about you include:

• Name, Contact and Biographical Information, such as name, email address, phone number, postal address, similar contact data and date of birth.
• User Credentials, such as username, password, and similar information used to create an account and use our Services.
• Payment Data, such as a payment account number, credit card information, and billing address.
• Device Data and Online Activity Information, such as information collected by automated means as described in the Cookies and Other Tracking Technologies section below.
• Location Information, such as precise geolocation, to the extent you have configured your device to permit us to collect such information (You can turn off location data collection at any time in your device or browser settings)
• Commercial Information, such as information relating to your purchases and transactions at Thorntons locations and other products or services obtained through the Refreshing Rewards loyalty program.
• Interests and Preferences, such as information provided when you use our Services.
• Communications and Interactions, such as any information you submit to us through our Site, the Thorntons app, or interactions with us, including through forms, surveys, registrations, emails, calls, comments, support tools, and other features on the Site or other communications.

We collect this personal information when you use our Services or interact with us, such as when you submit your information through the Services or communicate with us, or through automated means as described below. We also obtain your personal information from other sources, including our affiliates and subsidiaries, our partners, our vendors, third-party online services, and social media platforms. In addition, we may obtain other personal information about you in ways that we describe at the time of collection.

We may use cookies, tags, and similar technologies to automatically collect information on our Services. These tracking technologies allow our technology providers to collect information including your IP address, your mobile device identifier, the type of internet browser you are using, operating system, referral URLs, date/time stamps, pages viewed, and simple keyword tags. Cookies or tags are bits of code that allow our technology partners to collect the information described above. We also use web pixels to analyze usage patterns on our Site. The use of pixels allows Thorntons to record that a particular device, browser, or application has visited a particular webpage.

a. Cookies.

Cookies are small web files that a site or its provider transfers to your device's hard drive through your web browser that enables the site's or provider's system to recognize your browser and remember certain information.

We use first-party and third-party cookies for the following purposes: to make our Services function properly; to provide a secure browsing experience during your use of our Services; to collect passive information about your use of our Services; to measure how you interact with our marketing campaigns; to help us improve our Services; and to remember your preferences for your convenience.

We use the following types of cookies on our Services accessed via the Site

• Strictly Necessary Cookies. These cookies are essential because they enable you to use our Services. For example, strictly necessary cookies allow you to access secure areas on our Services. Without these cookies, some services cannot be provided. These cookies do not gather information about you for marketing purposes. This category of cookies is essential for our Services to work, and they cannot be disabled.
• Functional Cookies. We use functional cookies to remember your choices so we can tailor our Services to provide you with enhanced features and personalized content. For example, these cookies can be used to remember your name or preferences on our Services. We do not use functional cookies to target you with online marketing. While these cookies can be disabled, this may result in less functionality during your use of our Services.
• Performance or Analytic Cookies. These cookies collect passive information about how you use our Services, including webpages you visit and links you click. We use the information collected by such cookies to improve and optimize our Services. We do not use these cookies to target you with online marketing. You can disable these cookies.
• Advertising or Targeting Cookies. These cookies are used to make advertising messages more relevant to you. They perform functions like preventing the same ad from continuously reappearing, ensuring that ads are properly displayed for advertisers, and in some cases, selecting advertisements that are based on your interests. Our third-party advertising providers may use these cookies to build a profile of your interests and deliver relevant advertising on other sites. As of the date of this Privacy Statement, we do not utilize Advertising or Targeting Cookies. However, in the event we begin to use them, you may disable the use of these cookies, as set forth below.

b. Other Tracking Technologies.

To see how successfully our marketing campaigns or other Site goals are performing we sometimes use conversion pixels, which fire a short line of code to tell us when you have clicked on a particular button or reached a particular page (e.g., a thank you page once you have completed the procedure for subscribing to one of our services or have completed one of our forms). We also use web pixels to analyze usage patterns on our Site. The use of pixels allows Thorntons to record that a particular device, browser, or application has visited a particular webpage.

c. Your Cookie and Other Tracking Technology Choices

First-Party Cookies. You can use the browser with which you are viewing this Site to enable, disable or delete cookies. To do this, follow the instructions provided by your browser (usually located within the "Help", "Tools" or "Edit" settings). Please note, if you set your browser to disable cookies, you may not be able to access secure areas of the Site. Also, if you disable cookies other parts of the Services may not work properly. You can find more information about how to change your browser cookie settings at http://www.allaboutcookies.org.

Mobile Advertising: You can opt out of having your mobile advertising identifiers used for certain types of advertising by accessing the settings in mobile device and following the instructions. If you opt-out, we will remove all data about you and will not collect any further data.

Third-Party Cookies. To opt-out of third-party advertising networks and similar entities that use advertising cookies go to http://www.aboutads.info/choices. Once you click the link, you may choose to opt out of such advertising from all participating advertising companies, or only advertising provided by specific advertising entities. For more information about third-party advertising networks and similar entities that use these technologies, please see http://www.aboutads.info/consumers

We will only use your personal information as described in this Statement or as disclosed to you prior to such processing taking place for the following reasons.

Operating Our Business

• To Provide You with Our Services - We will use your personal information to provide information or perform Services that you request.
• For Internal Use - We use your personal information for the purposes of furthering our business, including improving our Site's content and functionality by analyzing where, on which types of devices and how our Site is used, how many visitors we receive, and where they click through to the Site from. We also use it to remember you in case you re-visit our Site, so we will know if you have already been served with surveys or (where Site content is undergoing testing) which version of the content you were served.

Communicating with You

• To Provide You with Service-Related Communications. We will send you administrative or account-related information to keep you updated about your account and the Services. Such communications may include information about Statement updates, confirmations of your account actions or transactions, security updates or tips or other relevant transaction-related information. We process your contact information to send you such communications. Service-related communications are not promotional in nature. You are not able to unsubscribe from such communications, otherwise, you may miss important developments relating to your account or the Services.
• To Provide Customer Support or Respond to You. We collect any information that you provide to us when you contact us. Without your Personal Information, we cannot respond to you or ensure your continued use and enjoyment of the Services.

Security, Compliance and Enforcement

• To Support the Security of the Services. We care about keeping you secure and safe while using our Services. Keeping you safe requires us to process your Personal Information, such as your device information, activity information and other relevant information. We use such information to combat spam, malware, malicious activities or security risks; improve and enforce our security measures; and to monitor and verify your identity so that unauthorized users do not gain access to your information. We cannot ensure the security of our Services if we do not process your personal information for security purposes.
• To Enforce Compliance with Our Terms and Agreements or Policies. When you access or use our Services, you are bound to our Terms and Conditions and this Statement. To ensure you comply with them, we process your personal information by actively monitoring, investigating, preventing and mitigating any alleged or actual prohibited, illicit or illegal activities on our Services. We also process your personal information to: investigate, prevent or mitigate violations of our internal terms, agreements or policies and enforce our agreements with third parties and business partners.
• To Maintain Legal and Regulatory Compliance. Our Services are subject to certain laws and regulations which may require us to process your Personal Information. For example, we process your personal information to pay our taxes, to fulfill our business obligations, ensure compliance with employment and recruitment laws or as necessary to manage risk as required under applicable law. Without processing your personal information for such purposes, we cannot perform the Services in accordance with our legal and regulatory requirements.

Administer Our Rewards Programs

To Operate the Refreshing Rewards program. We use your information to operate the refreshing reward program, for example to ensure that you can take advantage of the offers we make through the use of our Services, provide other services related to the program and ensure that the applicable Terms and Conditions are observed. We also use your personal information related to the refreshing rewards program for the following purposes:

• To Send You Relevant Direct Marketing Communications – As part of the registration process, you will be asked to indicate your preferences for receiving Thorntons marketing communications containing information and offers about Thorntons products, promotions, and services and those of our partners in the program. These communications may, depending on your selected preferences, be sent from Thorntons by email, text, push notification, and mail. You can opt out of receiving these direct marketing communications at any time by following the instructions set out in each marketing communication or by changing your preferences within your account settings on the app, or on the Refreshing Rewards website, or by contacting guestservices@mythorntons.com
• To Provide You Personalized Offers – Thorntons will use your information to analyze and understand your shopping behavior based on your purchases at our locations so that we can provide you with personalized offers and marketing communications which we think will be of interest to you. To help us better understand you as a customer, we will also analyze how you use the refreshing reward program and how you interact with our app and other marketing channels, including assessing the effectiveness of our offers and marketing communications. As part of this, we can show or send you tailored Thorntons offers and advertisements when you are browsing the internet using cookies. Please visit section 2 of this Privacy Statement to find out more about our cookie usage.
• To Conduct Customer Research and Surveys – We will use your Refreshing Rewards data to send you invitations by email to participate in voluntary surveys so that we can improve the Refreshing Rewards program, our offers and customer communications.

We will also analyze and use your data to carry out research into how customers are interacting with Thorntons and the Refreshing Reward program so that we can improve our products, services, and customer communications.

We may disclose the categories of personal information described above as follows:

• Within Our Corporate Organization. Thorntons is a part of a corporate organization that has many legal entities, business processes, management structures and technical systems. Thorntons may share your personal information within this organization to provide you with the Services and take actions based on your request and provide you with complimentary offers from participating Thorntons. Where this is the case, we do this under a comprehensive, flexible, and global compliance framework which implements appropriate measures and safeguards to ensure that your personal information is protected in accordance with applicable data protection laws.
• Service Providers. We may share your personal information with service providers acting on our behalf to help us operate our Services and for marketing purposes. These service providers can only use your data in accordance with our written instructions and must comply with information security protections we have put in place.
• Marketing Partners. We may share your personal information with other entities that offer affiliated services, such as BP branded credit cards or other redemption offers that enable you to redeem the benefit of the Services. We also may share your personal information with advertising services, brands and other marketing partners in order to provide you with more customized and complementary offers.
• To Maintain Legal and Regulatory Compliance. We have the right to disclose your personal information as required by law, or when we believe that disclosure is necessary to protect our rights and/or comply with a judicial proceeding, court order, request from a regulator or any other legal process served on Thorntons. If there is a takeover, sale or purchase of our business, we may disclose your personal information to the new (or prospective) owner of the business.

As described in the Cookies and Other Tracking Technologies section, we may share your personal information by allowing third-party advertising and analytics services to collect personal information via automated technologies on our Services for targeted advertising purposes. We also may share personal information we collect through our loyalty programs and at our locations (such as purchase information) with certain advertising services, brands and other marketing partners in order to provide you with more customized and complementary offers based on your purchase history. The personal information shared with these third parties may include name and contact information, commercial information (such as your purchase history), device data and online activity information, location information, and interests and preferences. These kinds of sharing may be considered a "sale" or processing of personal information for targeted advertising under applicable law.

Depending on where you reside, you may have the right to opt out of the sale of your personal information or processing of your personal information for targeted advertising. To opt out of such sales or sharing of your personal information, please contact us us by phone at 1-866-473-0017 or by email at guestservices@mythorntons.com.

Depending on where you reside, you may have the right to (1) request access to, (2) correction of, (3) deletion of your personal information; and (4) opt-out of the processing of your personal information for purposes of targeted advertising, certain profiling, or the sale of your personal information. In addition, you may have the right to obtain your personal data in a portable and, to the extent technically feasible, readily usable format. To exercise these rights, please contact us by phone at 1-866-473-0017 or by email at guestservices@mythorntons.com. You may appeal our decision with respect to a request you have submitted by emailing us at guestservices@mythorntons.com.

We take precautions to protect data and information under our control from misuse, loss, or alteration. Our security measures include industry-standard physical, technical, and administrative measures to prevent unauthorized access to or disclosure of your information, to maintain data accuracy, to ensure the appropriate use of information, and otherwise safeguard your personal information.

Please recognize that protecting your personal information is also your responsibility. We ask you to be responsible for safeguarding your password, secret questions and answers, and other authentication information you use to access our Services.

Thorntons is a part of BP. BP operates globally therefore, we may require your personal information to be transferred to other countries where necessary to provide the Services. Where we transfer personal information to other wholly owned BP entities, we do this under a comprehensive, flexible, and global compliance framework which implements appropriate measures and safeguard (including EU standard contractual clauses) to ensure that your personal information is protected in accordance with applicable data protection laws.

We will retain your personal information only for as long as necessary to fulfill the purposes for which it was collected as noted in section 3 and section 13(b). We may retain some of your personal information for a longer period insofar as it may be necessary to defend or prosecute any legal claim(s)

We retain the information you provide when you register, together with information we collect about you and your use of the program, for the duration of your membership of the program. If you request account deletion, we will delete, aggregate, or deidentify your associated account data so that it no longer identifies you. We may also continue to use the aggregated or deidentified form of data for statistical and analytical purposes.

Our Site or the App may contain links that take you to third-party sites or apps. This Statement does not apply to those third-party sites or apps. We recommend that you read the privacy statements of any other sites that you visit or apps that you download and use as we cannot accept responsibility for the privacy practices of these sites or apps which may be different to ours.

Our Services are not directed to, and we do not knowingly collect personal information from children under the age of 18. If you are under 18, please do not attempt to fill out our forms or send any personal information about yourself to us. If we become aware that a child under 18 has provided us with Personal Information, we will take steps to delete such information from our files.

We are committed to ensuring that your personal information is kept accurate and up to date. However, it is up to you to update it with any changes. You can update your contact details and other data via your account settings in the Thorntons app or on the Refreshing Rewards website. Please notify us at guestservices@mythorntons.com if there are any further changes that you would like our assistance on, providing us with sufficient information to enable us to identify you, so that any changes can be made.

Last Updated: January 1, 2023

https://www.bp.com/en_us/united-states/home/disclosure.html

This section applies only to California residents and does not apply to personal information collected about Thorntons personnel, job applicants or business partners. This section uses certain terms that have the meanings given to them in the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) and its implementing regulations (collectively, the "CCPA"). For more information about the personal information, we collect and how we collect it, please refer to sections 1 and 2 above.

1. Personal Information Categories We Collect. We may collect (and may have collected during the 12-month period prior to the Last Updated date of this section 13) the following categories of personal information when you use our Services:
   • identifiers such as a name, postal address, date of birth, unique personal identifier, online identifier, email, account name, phone number, your device's IP address, software, and identification numbers associated with your devices;
   • commercial information such as records of products or services purchased, obtained, or considered by you;
   • online activity, such as internet or other electronic information regarding your browsing history, search history, the webpage visited before you came to our Site, length of visit and number of page views, click-stream data, locale preferences, your mobile carrier, date and time stamps associated with transactions, and system configuration information.
   • your geolocation, to the extent you have configured your device to permit us to collect such information;
   • sensory information, such as audio recordings of your voice to the extent you call us, as permitted under applicable law; and
   • inferences about your preferences, characteristics, behavior and attitudes.
2. Purposes for processing personal information. We may use (and may have used during the 12-month period prior to the Last Updated date of this section 13) your personal information for the purposes described in section 3 and for the following business purposes:
   • Performing services, maintaining or servicing accounts, providing customer service and verifying customer information.
   • Providing advertising and marketing services.
   • Auditing that relates to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance.
   • Short-term, transient use, such as non-personalized advertising shown as part of your current interaction with us.
   • Helping to ensure security and integrity.
   • Undertaking activities to verify or maintain the quality or safety of our services or devices and to improve, upgrade, or enhance them.
   • Debugging to identify and repair errors; and
   • Undertaking internal research for technological development and demonstration.
3. Retention of Personal Information. We will retain your personal information in accordance with section 6 above, but in no case longer than the time period reasonably necessary to achieve the purposes described in section 3 and section 9(b), or any other notice provided at the time of collection, taking into account applicable statutes of limitation and records retention requirements under applicable law.
4. Sources of Personal Information. We may obtain your personal information from the following sources:
   • Directly from you, such as when you register for the Thorntons App or Site, when you contact us at by email, when you call us, when you use any of our social media channels
   • Your devices, such as when you use our Services
   • Our affiliates and subsidiaries
   • Service providers, contractors and other vendors who provide services on our behalf
   • Online advertising services
   • Data analytics providers
   • Operating systems and platforms
   • Social networks
5. Sale or Sharing of Personal Information. We may share your personal information by allowing certain third parties who may also be our service providers (such as online advertising and analytics services and social networks) to collect personal information via automated technologies on our Services for social networking and cross-context behavioral advertising purposes. We also may share personal information we collect through our loyalty programs and at our locations with certain advertising services, brands and other marketing partners in order to provide you with more customized and complementary offers based on your purchase history. These kinds of sharing may be considered sales of personal information or sharing of personal information for cross-context behavioral advertising purposes under the CCPA.
   
   We may sell or share for cross-context behavioral advertising purposes (and may have sold or shared during the 12-month period prior to the Last Updated date of this section 8), the following categories of personal information about you to online advertising services and social networks:
   
   Identifiers
   Commercial information
   Online activity
   Inferences
   
   To the extent we "sell" or "share" your personal information,, you have the right to opt-out of this disclosure of your information, as detailed below. We do not have actual knowledge that we sell or share the personal information of minors under 16 years of age.

We may have disclosed the following categories of personal information about you for a business purpose to the following categories of third parties:

Categories of Personal Information	Categories of Third Parties
Identifiers	Our affiliates and subsidiaries Vendors who provide services on our behalf Our joint marketing and business partners Professional services organizations, such as auditors and law firms Data analytics providers Internet service providers Operating systems and platforms Online advertising services and advertising networks Social networks Co-sponsors of contests, sweepstakes or other promotions Government entities
Online Activity	Our affiliates and subsidiaries Vendors who provide services on our behalf Our joint marketing and business partners Data analytics providers Internet service providers Operating systems and platforms Online advertising services and advertising networks Social networks Co-sponsors of contests, sweepstakes or other promotions
Geolocation Data	Our affiliates and subsidiaries Vendors who provide services on our behalf Our joint marketing and business partners Professional services organizations, such as auditors and law firms Data analytics providers Internet service providers Operating systems and platforms Online advertising services and advertising networks Social networks Co-sponsors of contests, sweepstakes or other promotions Government entities

7. California Consumer Privacy Rights. You have certain choices regarding your Personal Information, as described below.
8. Access: You have the right to request, twice in a 12-month period, that we disclose to you the personal information we have collected, used, disclosed, and sold or shared about you.
9. Correction: You have the right to request that we correct the personal information we maintain about you, if that information is inaccurate.
10. Deletion: You have the right to request that we delete certain personal information we have collected from you.
11. Opt-Out of Sale or Sharing: You have the right to opt-out of the sale of your personal information or the sharing of your personal information for cross-context behavioral advertising purposes.
12. Shine the Light Request: You also may have the right to request that we provide you with (a) a list of certain categories of personal information we have disclosed to third parties for their direct marketing purposes during the immediately preceding calendar year and (b) the identity of those third parties.
13. How to Submit a Request. To submit an access, correction or deletion request, or to opt out of the sale or sharing of your Personal Information, please contact us by phone at 1-866-473-0017or by email guestservices@mythorntons.com. To submit a request as an authorized agent on behalf of a consumer, please e-mail guestservices@mythorntons.com with the subject line Authorized Agent Request". To submit a Shine the Light request, please contact us at guestservices@mythorntons.com. In your request, please specify that you want a "California Privacy Rights Notice."
14. Verifying Requests. To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to your personal information or complying with your deletion or correction request. If you have an online account with us, we may verify your identity by requiring you to sign into your account. If you do not have an online account with us and you request access to, correction of or deletion of your personal information, we may require you to authenticate your email address on record with us or to provide information about your transactions or prior interactions with us. In addition, if you ask us to provide you with specific pieces of Personal Information, we may require you to sign a declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request.
15. Additional Information. If you choose to exercise any of your rights under the CCPA, you have the right to not receive discriminatory treatment by us. To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request.
16. Notice of Financial Incentive: The Refreshing Rewards Program offers members of the program certain loyalty promotions and benefits in connection with their disclosure of personal information to Thorntons. To participate in our loyalty program, or other offerings contained in the Services, we require your first and last name, email, phone number, date of birth, and zip code. We also collect the personal information mentioned in Sections 1 and 10(a) above in connection with your participation in the Services.

Subject to certain restrictions, we offer users who create an account and who participate in the Refreshing Rewards program the opportunity to be eligible for certain loyalty benefits, discounts, promotions, and giveaways. These offers include 5 cents to 25 cents off each gallon of fuel as well as convenience store food and drink discounts and giveaways. For more information on the terms of the Services, please click here. To participate in the Services, you must first consent to the Refreshing Rewards Terms and Conditions and create an account on the App or Site. You may withdraw from the Program at any time by accessing the deletion option in the App or by emailing us at guestservices@mythorntons.com. Because the Services offer loyalty benefits, discounts, promotions, and giveaways in exchange for the collection, retention, and the potential sale and sharing of the personal information required for your participation in the Services, they may be interpreted as a "financial incentive" program under California law. The loyalty benefits, discounts, promotions, and giveaways offered in connection with the Services are reasonably related to our good faith estimate of the value provided to Thorntons by your personal information. We estimate that the value to Thorntons of the personal information you provided to facilitate participation in the Services is reasonably related to the financial incentives less the expenses related to offering these financial incentives.

If you have questions relating to the handling of your personal information, please contact us by phone at 1-866-473-0017 or by email at guestservices@mythorntons.com. You can also contact us by mail Thorntons LLC, Attn: Privacy Matters, 2600 James Thornton Way, Louisville, Kentucky 40245.