PRIVACY STATEMENT

Last Updated: 12 April 2023

HF Sinclair Corporation, its segments, divisions, subsidiaries and affiliates worldwide, (collectively, “HF Sinclair”) respect your concerns about privacy. This Privacy Statement applies to our use of personal information that we collect through our websites and mobile apps that link to this notice (collectively, the “Online Services”) or anywhere else we display or reference this Privacy Statement.

This Privacy Statement describes the type of personal information we obtain about individuals, how we may use the information, with whom we may share it and the choices available regarding our use of the information. The Privacy Statement also describes the measures we take to safeguard personal information and how individuals can contact us about our privacy practices and their privacy rights.

This Privacy Statement applies only to HF Sinclair and does not address the privacy practices of our business partners, such as our dealers or distributors. The privacy practices of our business partners may be subject to their own privacy notices describing how they process personal information.

Click on one of the links below to jump to the listed section:

• Information We Obtain About You
• How We Use the Information We Collect
• Third-Party Analytics Services
• Online Tracking and Interest-Based Advertising
• Information Sharing
• Cross-Border Transfer of Your Personal Information
• How We Protect Your Personal Information
• Retention of Personal Information
• Your Rights and Choices
• Questions About the Privacy Statement
• Children
• Changes to This Privacy Statement

1. Information We Obtain About You

   We obtain personal information about you in various ways in connection with your use of our Online Services. The types of personal information we may obtain include:

   • Contact information, including your name, company, telephone number, and postal and email address;
   • Professional information, including your job title, company name, industry, and professional and employment background;
   • Personal characteristics, including your age and birthdate;
   • Account information, including login information, account preferences and other account details;
   • Payment information, including billing and delivery address and payment card details (such as card number, expiration date and security code);
   • Device information, as described in the Automated Data Collection section below;
   • Information about your interest in or use of our products and services, including order history, preferences or tendencies, product interest, purchase volume, project length, or product sample requests;
   • Job application information, including your resume and any additional application information provided to us (for example, employment history and education); and
   • Any other information you submit through our Online Services or interactions with us, such as through forms, surveys, registration pages, emails, calls, comments, customer support tools and other features on our Online Services.

   We may collect this information when you use our Online Services or otherwise interact with us (for example, call or email us). In some cases, we also may obtain your personal information from other parties, such as from your representatives, business associates or references, our affiliates or vendors, or other third parties with whom we work. We also may obtain other personal information about you from publicly available sources and in ways that we describe at the time of collection.

   Automated Data Collection

   When you interact with our Online Services or open our emails, we may obtain certain information by automated means, such as through cookies, web server logs, web beacons (including pixels and tags), scripts, and other technologies. These technologies help us (1) remember your information so you do not have to re-enter it; (2) track and understand how you use and interact with the Online Services; (3) tailor the Online Services to your preferences; (4) measure the usability of the Online Services and the effectiveness of our communications; (5) authenticate your identity, protect against fraud and provide our products and services; and (6) otherwise manage and enhance our products and services, and help them work properly.

   We may use these automated technologies through our Online Services to collect information about your device, browsing actions, usage patterns and location. We obtain information about your device and web browser in this manner such as your device IP address, general location information, unique device identifiers, device type and model, device characteristics and settings, browser settings and characteristics, operating system type and version, language and country preferences, usage statistics, referring emails and web addresses, and other device details. We also may obtain information about your interactions with our Online Services, such as pages visited, links clicked, features used, referring or exit URLs, dates and times of usage, session information, clickstream and page-scroll data and other information about your interactions with our Online Services.

   Through these automated technologies, we may track information about your online activities over time and across third-party websites and apps. Your browser may tell you how to be notified about certain types of cookies and how to restrict or disable them. Please note that without cookies, you may not be able to enjoy all of the features of our Online Services. For mobile devices, you may be able to manage how your device and browser share certain device data by adjusting the privacy and security settings on your device. Please see our “Cookie Policy Statement” for more information on our use of cookies.

   We also may collect your device’s geolocation information through GPS, Bluetooth, WiFi signals and other technologies. Your device’s operating system may provide you with a notification when our app attempts to collect your precise geolocation. Please note that if you decline to allow the app to collect your precise geolocation, you may not be able to use all the features through our app.



2. How We Use the Information We Collect

   We may use the information we obtain about you for a number of purposes, including:

   • Services: To provide our products and services. This includes communicating with you about our products and services, responding to inquiries and offering customer support, processing and fulfilling transactions, personalize your experience with our products and services (including our Online Services), administering your account with us, and other activities related to our provision of services. We use this information to carry out our contractual obligations and for our legitimate business interests in providing our services and maintaining our customer relationships.
   • Marketing: For advertising and direct marketing. This includes to contact you about services, events or programs that may be of interest to you and to administer participation in surveys, sweepstakes, promotions or other programs. We use this information for our legitimate business interests in developing and promoting our business and will obtain your consent where required by applicable law.
   • Research and Analytics: For research and analytics related to the development of products and services, customer satisfaction, marketing and other research purposes. This includes to perform market research and trend analysis and compile, anonymize or aggregate personal information for our business purposes. We use this information for our legitimate business interests in analyzing how customers use our products and services, developing and keeping our services (including Online Services) updated and relevant, informing our marketing strategy and growing our business.
   • Recruiting: To manage career opportunities with us, including for recruitment purposes, candidate screening and evaluation and employee onboarding. We use this information to carry out our contractual obligations and for our legitimate business interests in managing our workforce.
   • Safety and Security: To protect our rights, safety, property and business partners. This includes verifying your identity and protecting against fraud and other criminal activity, preventing misuse and troubleshooting technical issues. We use this information to comply with our legal obligations and for our legitimate business interests in maintaining our business, providing and maintaining our products and services (including the Online Services), network security, and preventing fraud
   • Legal and Compliance: To comply with and enforce applicable legal requirements, relevant industry standards and our policies. This includes responding to legal process or law enforcement requests, investigating complaints or potentially illegal activities, exercising our rights and remedies, defending ourselves from claims against us, or satisfying any audit or government reporting obligations and requests. We use this information to comply with a legal obligations and for our legitimate business interests in maintaining our business, and exercising and securing our rights and obligations.
   • Operations: To operate, evaluate and improve our business, such as to analyze and enhance the products and services we offer (including our Online Services), develop new products and services, fulfill our obligations to our customers and others, manage our business relationships (such as with current or prospective customers, vendors and business partners), and perform administrative functions related to our services (such as accounting, auditing and other internal functions). We use this information to carry out our contractual obligations, to comply with our legal obligations, and for our legitimate business interests in maintaining and developing our business and customer relationships, and complying with our other obligations.

   We also may use the information in other ways for which we provide specific notice at the time of collection or otherwise with your consent.

   Where we are required by law to collect personal information or need to do so under the terms of a contract we have with you (or are trying to enter into with you), and you fail to provide that information when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with our products or services, or consider you for a career opportunity). We indicate personal information that is required at the time we collect it from you.



3. Third-Party Analytics Services

   We use third-party analytics services on our Online Services, such as Google Analytics. The providers of these analytics services use technologies such as cookies and web beacons to help us analyze your use of the Online Services. The information collected through these means may be disclosed to or collected directly by these services. To learn more about Google Analytics, please visit https://www.google.com/policies/privacy/partners/.



4. Online Tracking and Interest-Based Advertising

   You may see our ads on other websites or apps because we use third-party ad services on our Online Services. Through these ad services, we can tailor our messaging to individuals considering demographic data, inferred interests and browsing context. These ad services track information about your online activities over time and across third-party websites and apps by collecting information through automated means, including through the use of cookies, web server logs, web beacons and other similar technologies. These ad services may collect data about your visits to websites and apps that participate in these services, such as the pages or ads you view and the actions you take on the websites or apps. This data collection takes place both on our Online Services and on third-party websites and apps that participate in these ad services. These ad services use this information to show you ads that may be tailored to your individual interests. This process also helps us track the effectiveness of our marketing efforts.

   To learn how to opt out of interest-based advertising in the U.S., please visit www.aboutads.info/choices, www.networkadvertising.org/choices/, and http://preferences-mgr.truste.com/. In the EEA and UK, please visit www.youronlinechoices.eu/ or www.youronlinechoices.com/uk/, and in Canada visit www.youradchoices.ca/.



5. Information Sharing

   We share personal information as follows:

   • Within HF Sinclair: We share personal information with our affiliates for the purposes described in this Privacy Statement.
   • Our Partners: We may share your personal information with our business partners (such as your employer) and joint-marketing and sponsorship partners.
   • Service Providers: We also may share the information we obtain about you with third-party vendors and other entities to perform services on our behalf, such as providers of supplies, technology, communications, accounting, auditing, consulting, legal services, fraud prevention, security, advertising, marketing, hosting, analytics, and other services.
   • Social Networks: We may share your personal information with social media sites if you use those services to connect with us through the features on our Online Services.
   • Business Transfers: We reserve the right to transfer any personal information we have about you in the event we sell or transfer all or a portion of our business or assets (including in the event of a merger, acquisition, joint venture, reorganization, divestiture, dissolution or liquidation).
   • Others: We may disclose personal information (1) if we are required to do so by law or legal process, such as a court order or subpoena; (2) in response to requests by government agencies, such as law enforcement authorities; (3) to establish, exercise or defend our legal rights; (4) when we believe disclosure is necessary or appropriate to prevent physical or other harm or financial loss; (5) in connection with an investigation of suspected or actual illegal activity or (6) otherwise with your consent or as directed by your representative.



6. Cross-Border Transfer of Your Personal Information

   By using our Online Services or providing us with your information, you are directly transferring your information to us in the U.S., Canada or UK. In addition, we may transfer your personal information to other countries where we do business or where data recipients identified in the “Information Sharing” section above are located. We do so for the purposes described in this Privacy Statement, including to satisfy our legal or business obligations under the laws of those foreign jurisdictions. Those countries may not have the same data protection laws as the country in which you initially provided the personal information. When your personal information is transferred to these other countries (such as the U.S.), we will protect that information as described in this Privacy Statement or as otherwise required by applicable law.

   If you are located in the European Economic Area, Switzerland or UK, we will comply with applicable legal requirements regarding the provision of appropriate safeguards for the transfer of personal information to recipients in countries that are not deemed to provide an adequate level of data protection. These safeguards may include entering into EU or UK-approved Standard Contractual Clauses or other data transfer safeguards. You may request a copy of these safeguards by contacting us as described in the Questions About The Privacy Statement section below.



7. How We Protect Personal Information

   We maintain administrative, technical and physical safeguards designed to protect personal information against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use.



8. Retention of Personal Information

   To the extent required by applicable law, we retain your personal information for the time period reasonably necessary to achieve the purposes described in this Privacy Statement, or any other notice provided at the time of collection, taking into account applicable statutes of limitation and records retention requirements under applicable law. We may retain your personal information for a longer period in the event of a complaint or in reasonable anticipation of litigation.



9. Your Rights and Choices

   Subject to applicable law, you may have certain rights regarding personal information we have collected about you. These rights may include the right to (i) request access to the personal information we have collected about you, (ii) update or correct such information if you believe there is an inaccuracy, (iii) restrict the processing of your personal information, (iv) request deletion of your personal information, (v) object to our use of your personal information, or (vi) request transmission of your personal information to another data controller.

   If you would like to exercise any of these rights provided under your local law, please contact us at dataprivacy@hfsinclair.com. Where provided by law, you may withdraw consent you previously provided to us, and we will apply your preferences going forward as appropriate. This will not affect the lawfulness of our processing based on your consent prior to such withdrawal.

   You may have a right in some jurisdictions, including residents of Canada, the European Economic Area and the United Kingdom, to file a complaint with your local data protection authority. While you are not required to do so, we encourage you to contact us directly to discuss any concerns that you may have and to allow us an opportunity to address your concerns.



10. Questions About The Privacy Statement

    HF Sinclair Corporation will be the controller of your personal information collected for purposes described in this Privacy Statement. Where we provide you with our products and services, the HF Sinclair entity providing those products and services (or that you otherwise deal directly with) will also be the controller of your personal information. Where you apply for a job through our Online Services, the HF Sinclair entity you are applying for the role with will also be a controller of your personal information. We monitor feedback and seek to improve our services. If you have any questions about this Privacy Statement, the practices of this website, or your dealings with the website, or would like to provide comments, you can send us an e-mail at dataprivacy@hfsinclair.com or contact us by mail at HF Sinclair Corporation, c/o Legal & Compliance Department, 2828 N. Harwood St., Suite 1300, Dallas, Texas 75201.



11. Children

    HF Sinclair websites are designed for a general audience and are not directed to children under the age of 16. We do not knowingly solicit or collect personal information from anyone under the age of 18. If you believe your child’s personal information may be processed in the services, you can contact us using the information in the Questions About The Privacy Statement section to request that we delete the personal information.



12. Changes to This Privacy Statement

    We may update this Privacy Statement from time to time and without prior notice to you to reflect changes in our personal information practices. We will indicate at the top of the policy when it was most recently updated.