PRIVACY POLICY

Effective Date: January 1, 2024

Your privacy is important to Alimentation Couche-Tard Inc., Couche-Tard Inc., Circle K Stores Inc., Mac’s Convenience Stores Inc., Mac’s Convenience Stores LLC, Holiday Stationstores, LLC, TMC Franchise Corporation and their subsidiaries and affiliates in Canada and the United States (collectively, “Circle K”, “we”, “us” or “our”). In the United States and Canada, our stores are primarily operated under the Couche-Tard, Circle K, Holiday, Mac’s, Corner Store, Kangaroo Express and On the Run banners (for more information about our banners, please visit: https://corpo.couche-tard.com/en/our-company/our-brands/). This Privacy Policy applies to our activities in Canada and the United States and describes our practices with respect to the collection, use and disclosure of personal information, as well as any rights you may have with respect to your personal information (as defined in the Definition of “Personal Information” section below).

Depending on where you reside, you may have additional rights. Please refer to the Additional Information for Certain Jurisdictions section below.

Table of Content

1. Scope and Application
2. Definition of “Personal Information”
3. What Personal Information do we Collect?
4. How we Collect Personal Information
5. How we Use Personal Information
6. How we Share Personal Information
7. How we Manage Consent
8. How Can You Change Your Privacy Choices?
9. How we Store and Safeguard Personal Information
10. Children Privacy
11. Additional Information for Certain Jurisdictions
12. Changes To Our Privacy Policy
13. Who Can You Contact With Privacy Questions?

1. Scope and Application

This Privacy Policy relates to the personal information collected by Circle K. This Privacy Policy applies whenever you interact with us, including when you visit our stores, visit one of our websites or use one of our mobile applications on which this Privacy Policy is posted, sign up to be a part of any of our programs (for example, we may offer loyalty programs in certain jurisdictions), enroll into one of our subscription services (for example, our Car Wash or Sip&Save subscription services) promotions, contests or events, purchase our products or products from our stores, apply to become a franchisee or otherwise receive our services. If you are a job candidate, please review our Privacy Notice for Candidates.

2. Definition of “Personal Information”

“Personal information” is any information that identifies, or could be reasonably associated with, an individual and their household (collectively, “individual” or “you”). This may include, for example, your name, contact information, email address, and information relating to your account with us (as the case may be). It may also include other types of more technical information, but only when this information can identify you as an individual. Information that is aggregated and/or anonymized and cannot be associated with an identifiable individual is not considered to be personal information. Please note that the definition of personal information may differ in various jurisdictions.

3. What Personal Information do we Collect?

We limit the collection of personal information to what is reasonably required to fulfill the purposes for which it was collected. We collect personal information in a variety of ways detailed in the How we Collect Personal Information section.

Personal information we collect may include:

• Identifiers and contact information, such as your name, email and postal addresses, telephone number, Internet Protocol (IP) address (if it can identify you as an individual), device identifier or account information (for example, if you have downloaded one of our app or you have created an account upon signing up for our services, such as our car wash services);

• Demographic data, such as date of birth or gender;

• Transactional information, such as history of purchases made using a payment or credit card provided by Circle K (for instance, the Easy Pay card) and information generated by your participation in our loyalty program, as applicable (e.g. the number and amount of transactions by type, location/store of purchase, product code information, brand, quantity purchased, date, time, payment method used, promotional offers used in connection with the transaction, etc.);

• Browsing activity on our websites and apps, such as page and offers viewed, opt-out preferences, email bounce backs, click-throughs, content on social media, and IP addresses, if it can identify you as an individual (as further detailed in the How we Collect Personal Information section);

• Payment information, such as credit or debit card number when you make purchases;

• Geolocation information may be collected when you use our websites and apps, although this information may not always identify you as an individual;

• Information collected through technologies in our stores, including CCTV, anonymous video analytics technologies, or other types of video cameras and sensors, if it can identify you as an individual (as further detailed in the How we Collect Personal Information section); and

• Any other information you provide to us (as further detailed in the How we Collect Personal Information section).

4. How we Collect Personal Information

We collect personal information in a variety of ways, including: directly from you, from business partners, from technologies used at our locations, through online technologies (such as when you are interacting with us through our websites and apps), from third-party social networks and other third parties. Circle K encourages you to review the privacy policies of third parties as well. Third parties involved may use tracking methods such as but not limited to cookies to achieve their own business goals and purposes by relating and combining information about your usage of our websites and apps to any other personal information they may have collected on you.

More specifically, we collect personal information in the following ways:

A. DIRECTLY FROM YOU

We may collect personal information directly from you in our stores (including through our point-of-sales systems and other in-store interactive tools such as the LIFT screens), by mail, by email, over the telephone, through our websites and apps or in any other direct manner, for instance when you make a purchase, give us feedback on our stores and the products for sale in our stores, participate in a contest or survey, complete a franchise application, or make a request to our customer service.

For example:

Circle K offers many programs and services through which we may collect personal information directly from you, for instance: our brands’ main websites (e.g., https://www.circlek.com/, https://www.couche-tard.com/ and http://www.holidaystationstores.com/), gamification websites on which you may participate into a contest, our brands’ main apps (the Circle K, Couche Tard and Holiday apps), the Circle K Inner Circle loyalty program, the Circle K Easy Pay program, the Circle K EV chargers, our subscription services (such as the Car Wash and Sip&Save programs), our interactive LIFT screens at the point-of-sale, contests and sweepstakes or our newsletters.

B. FROM BUSINESS PARTNERS

Occasionally, we may receive personal information from business partners with whom we offer certain products at our stores or to provide certain programs. We may also receive your personal information from other sources with your consent or when authorized by law.

For example:

• We may participate in the loyalty programs of our business partners, such as fuel companies and grocers, to allow participating customers to earn points and redeem rewards at our locations. In such case, your participation is subject to the privacy policy of our business partner and we collect from you and receive from our partners the information necessary to allow you to participate in the program.

• We may receive your personal information from business partners with whom we organize contests, such as television stations, in order to allow you to redeem your prize at our stores.

C. AUTOMATICALLY FROM TECHNOLOGIES USED AT OUR LOCATIONS

We may collect personal information through various types of technologies used in our stores. These can include video surveillance, sensors or other similar types of systems that we may use from time to time.

For example:

• We use video surveillance in areas surrounding our premises for security purposes, to protect against theft, to prevent damage to our properties, and to prevent fraud.

• We may also use anonymous video analytic, which allows us to track the number of individuals in our stores and consider certain demographic information without identifying them. This technology helps us managing our stores, understanding our customer base and improving customer experience.

• In certain selected and clearly identified stores, where we offer a frictionless experience, we may use video cameras and sensors to allow our customers who have signed up for frictionless check-out services to make purchases without having to go through the cashier.

• In certain selected and clearly identified stores where we conduct research projects, such as the Connect Store at McGill Retail Innovation Lab, we may use video cameras and sensors (using Wi-Fi tracking, Bluetooth, RFID and similar technologies) to map individuals’ movements in the store and identify what items they take. This allows us to better understand in-store customer experience and to allow our customers who have signed up for frictionless check-out services to make purchases without having to go through the cashier.

D. THROUGH ONLINE TECHNOLOGIES

With your consent or as permitted under applicable law, we may collect certain types of information electronically when you interact with our websites and apps, emails, social media accounts, online advertising, or through the use of our or a third party’s technologies, which include cookies, web beacons or single pixel gifs or analytics engines. This information helps us understand what actions you take on our websites and apps and allows them to work correctly.

We may combine this information with other information collected in-store or online such as your transaction history. We do this to support our customer understanding using website and mobile analytics and to provide you with more tailored advertising and marketing campaigns. This includes serving interest-based advertising to you, subject to your right to withdraw consent. To learn more about the privacy choices available to you, please visit How Can You Change Your Privacy Choices? section below.

For example:

• We may use your location or language preference to auto-select features when you visit our websites or download our apps.

• We may use your personal transaction information to provide you with interest-based advertisements on products that we believe may interest you (e.g. products that you purchase frequently).

• We may collect, combine and categorize your personal information on an aggregated basis to identify purchasing patterns to help us analyze our businesses to better serve our customers.

The technologies we use include:

• Cookies, which are small text files that are saved on your computer when you visit a website so that information can be saved between visits, such as your login credentials or language preferences. For example, cookies allow you to log in quickly when you visit our websites.

• Web beacons, and single pixel gifs, which are small image files that have information about you, such as your IP address, that can be downloaded when you visit a website or open an e-mail. This allows us to understand your online behaviour, monitor our email delivery, and provide you with interest-based advertising. These tools also allow our third-party tracking tools to gather information, such as your IP address, and provide this back to us in an anonymized, aggregate form (i.e. in a manner that prevents us from identifying you personally). Aggregate information refers to personal information compiled and expressed in a summary form where no personal identifiers are included.

• Web analytics tools such as Google Analytics, which uses cookies to analyze your use of our websites and apps, to create reports about visitor and user activities for us and to provide further services associated with the use of our websites and apps.

• Analytics engines, which pull usage data from multiple sources and help manage and collect this data to use for personalization, interest-based advertising, customizing content and other methods to gain insights into our customers’ needs and preferences.

• With respect to our mobile applications, we use Identifier for Advertising for iOS and Google Advertising ID for Android.

• Tools that help protect against inappropriate uses, such as Google Invisible reCAPTCHA, which collects hardware and software information, such as device and application data and the results of integrity checks, as well as unique online identifications such as IP address, and sends that data to Google for analysis.

You may delete or disable certain of these technologies at any time via your browser. However, if you do so, you may not be able to use some of the features on our websites. To learn more about the privacy choices available to you, please visit How Can You Change Your Privacy Choices? section below.

E. THIRD-PARTY SOCIAL NETWORKS

We may collect your personal information if you interact with us through our social media pages and accounts (e.g. Facebook, Twitter, Instagram). For instance, we collect the personal information these social media platforms allow us to collect from our followers. We may also collect any content you upload to our social media pages and accounts (including photos or videos).

In addition, third-party social networks that provide interactive plug-ins to enable social network features (e.g., to connect to Facebook) on our websites and apps may use cookies to gather information on your use of the websites and apps. How this collected data is used by a third party is dependent on the privacy policy of the social network which is available on the appropriate parties’ website. We may also obtain and use analytical and statistical information from third-party social networks to help us measure performance and effectiveness of content we display on social networks, for example, by measuring impressions and clicks on the content Circle K promotes.

F. FROM OTHER THIRD PARTIES

In certain cases, we may collect personal information from other categories of third parties, but only with your consent or as permitted or required by applicable law. Third parties may include credit report agencies or background check providers.

5. How we Use Personal Information

We may use all categories of Personal Information detailed in the What Personal Information do we Collect? section above to provide you with our programs, products and services, to manage our business operations and make hiring decisions, to communicate offers and information we think might interest you, to generally enhance your customer experience with us, and as otherwise permitted or required by law.

Learn more about how we use your personal information for: PROVIDING OUR PROGRAMS, PRODUCTS AND SERVICES, MANAGING OUR BUSINESSES, MARKETING AND ADVERTISING, and CONDUCTING MARKET RESEARCH AND DATA ANALYTICS.

We use your personal information for the following purposes:

A. PROVIDING OUR PROGRAMS, PRODUCTS AND SERVICES

We use your Personal Information in order to provide our programs, products available in our stores and services, for instance:

• Processing your transactions and returns;

• Verifying your identity;

• Determining your eligibility for a program, product, service or promotion;

• Responding to your inquiries;

• Allowing you to earn loyalty points and redeem rewards;

• Responding to your requests or taking or verifying instructions from you;

• Enabling your participation in contests, promotions, surveys or chats;

• Processing your applications (for instance, a franchise application);

• Creating, administering, and maintaining your accounts;

• Allowing you to make purchases at our stores without having to check out at the cashier, if you have subscribed to this service;

• With your consent, verifying your credit when such verification is necessary for certain of our products, services or programs.

B. MANAGING OUR BUSINESSES

We use your Personal Information to manage our business, for instance:

• Notifying you of changes to your account or our websites and apps’ services, terms, conditions or policies and to provide you administrative messages, updates, legal notices, technical notices or security alerts;

• Deploying and managing our information technology applications and systems, including managing our websites and apps;

• Managing and facilitating the use of our websites and apps, which may include using cookies and other similar technology (as further detailed in the How we Collect Personal Information section);

• Maintaining the security of the public and our customers, employees and property (e.g., through video surveillance) (as further detailed in the How we Collect Personal Information section);

• Making assortment and pricing decisions;

• Protecting us and third parties from errors and fraud;

• Monitoring and investigating incidents and managing claims;

• Maintaining our programs, products and services; and

• Meeting our contractual, legal and regulatory obligations.

C. MARKETING AND ADVERTISING

We use your Personal Information to market our stores, brands (including Circle K, Couche-Tard, Holiday, Sloche, Provi-Soir, Froster, K Freeze, Polar Pop, etc.), programs, products, services, special offers, promotions, contests or events, and those of third parties who may sell their products within our stores, that we believe may be of interest to you. We may do this in a variety of ways:

• By communicating with you by email, telephone, SMS, direct mail and social media;

• By delivering online advertisements relevant for you;

• By customizing the content you see on our websites and apps; and

• By customizing product recommendations through our interactive in-store screens.

If you no longer wish to receive commercial electronic messages, please let us know by following the unsubscribe directions provided in every commercial electronic message. For more information on managing your marketing preferences, see the How Can You Change Your Privacy Choices? section below.

D. CONDUCTING MARKET RESEARCH AND DATA ANALYTICS

We may use your personal information in order to conduct market research and data analytics by tracking and analyzing your information for the following purposes:

• Improving or developing new products, services, programs, promotions, contests or events, and to better understand our customer base and behavior;

• Managing and developing our business and operations;

• Improving our programs, products, and services (e.g. improving our websites and apps);

• Understanding customer needs and preferences and customizing how we tailor and market products and services to our customers based on their interests;

• Measuring the effectiveness of our marketing; and

• Understanding how visitors interact with our websites and apps and ensure they work correctly.

When possible, we will use your information in an aggregated and/or de-identified format.

6. How we Share Personal Information

We may share your personal information within Circle K and companies within our corporate group or with our third party business partners (companies with which we provide programs, products or services) and service providers (companies operating on our behalf) for the purposes described in this Privacy Policy and in accordance with applicable law. We may also share your personal information with third parties for statistical or scholarly research purposes, always in compliance with applicable law. We will not share your personal information with any non-affiliated third party without your prior consent, other than as provided in this Privacy Policy or as otherwise authorized by applicable law. We do not sell your personal information to any organization or person; the only exception to this would be if we sell or transfer any part of our business. Depending on where you reside, you may have additional rights. Please refer to the Additional Information for Certain Jurisdictions section below for more information on our practices specific to the law applicable to you.

Learn more about how we may share personal information: WITHIN THE CIRCLE K GROUP, with third party BUSINESS PARTNERS, with third party SERVICE PROVIDERS, with academic institutions and research partners for specific RESEARCH projects (such as the Connect Store at McGill Retail Innovation Lab), in the course of a SALE OR TRANSFER OF BUSINESS OR OTHER TRANSACTION for OTHER PERMITTED REASONS, and WITH YOUR CONSENT.

A. WITHIN THE CIRCLE K GROUP

Circle K affiliates and subsidiaries in Canada, the United States and internationally may share personal information with each other and use it for the purposes described in this Privacy Policy. This allows Circle K and each entity within the group to comply with applicable laws, regulations and requirements and ensures that your information is consistent, accurate and up-to-date. In addition, it increases the quality and relevance of the services you receive and improves your interactions with Circle K through easier access to your information within the group.

B. BUSINESS PARTNERS

We may share your personal information with third party business partners with whom we associate to provide certain products or services. We only share the personal information required for our business partners to offer the relevant products or provide the relevant programs or services.

For example:

We may participate in loyalty programs offered by our business partners, such as fuel companies or grocers, and we may need to share personal information about our participating customers to allow them to earn points and redeem rewards at our locations.

C. SERVICE PROVIDERS

In the course of providing our programs, products, services, promotions, contests and events we may share all categories of personal information detailed in the section What Personal Information do we Collect? with third party service providers who perform services on our behalf. These service providers help us operate our business, technology systems and applications, internal procedures, infrastructure and advertising and marketing. They provide services to us, such as fulfilling purchases, processing credit card payments, performing credit checks, sending emails and postal mail, call centres, data hosting, contest administration, providing advertisements, and analytics services (e.g. tracking effectiveness of our marketing campaigns and analyzing usage of our websites and apps).

For example:

• Personal information collected from contest participants may be shared with our contest administrator to contact selected winners.

• We use payment card providers, credit card providers and loyalty program providers that will have access to subscribers’ personal information as required to provide their services to Circle K.

D. SALE OR TRANSFER OF BUSINESS OR OTHER TRANSACTION

We may disclose personal information to a third party in connection with a sale or transfer of business or assets, an amalgamation, reorganization or financing of parts of our business (including the proceedings of insolvency or bankruptcy). In the event the transaction is completed, your personal information will remain protected by applicable privacy laws. In the event the transaction is not completed, we will require the other party not to use or disclose your personal information in any manner whatsoever and to completely delete such information, in compliance with applicable laws.

E. RESEARCH

We may disclose information collected in certain selected and clearly identified stores where we conduct research projects with academic institutions and research partners for statistical or scholarly research purposes. When possible, we will share information for such purposes in aggregated and/or de-identified format.

For example:

We may disclose to researchers working at the McGill Retail Innovation Laboratory the information collected through video cameras and other sensors deployed in the Connect Store located on the campus of McGill University that provide a frictionless check-out experience or are used to test experimental retail systems and methods, who may use this information, on an aggregated and/or de-identified basis, for research purposes.

F. OTHER PERMITTED REASONS

Applicable laws may permit or require the use, sharing, or disclosure of personal information without consent in specific circumstances (e.g., when investigating and preventing suspected or actual illegal activities, including fraud, or to assist government and law enforcement agencies). These circumstances include situations when permitted or required by law or when necessary to protect our group of companies, our employees, our customers, or others. If this happens, we will not share more personal information than is reasonably required to fulfill that particular purpose.

G. WITH YOUR CONSENT

Other than the purposes listed above, we may, with your implied or express consent, share or disclose your personal information outside of our group of companies, in accordance with applicable laws.

7. How we Manage Consent

By subscribing to our programs, products and services and/or submitting information to us in connection with using our programs, products and services, you are providing your consent to the collection, use and disclosure of personal information as set out in this Privacy Policy. In some cases, your consent may be “implied” i.e. your permission is assumed based on your action or inaction at the point of collection, use or sharing of your personal information.

We will generally obtain consent when we want to use personal information for a new purpose or for a purpose other than those stated at the time of collection in this Privacy Policy or in the terms and conditions of a specific program, product, service, contest, promotion or event you signed up for, participated in or purchased. You may be entitled under applicable law to withdraw your consent (except in limited circumstances, including legal or regulatory requirements or as a result of your contractual obligations with us). For information on how to manage your privacy preferences, please see the How Can You Change Your Privacy Choices? section below.

If you choose not to provide us with certain personal information or if you withdraw your consent, where such withdrawal is available, we may not be able to offer you the programs, products, services, contests, promotions, events or information that you requested or that could be offered to you.

8. How Can You Change Your Privacy Choices?

We want you to clearly understand your choices and make informed decisions about your privacy options. There are several options available for you to manage your privacy preferences, including, for example: managing your preferences within your account when applicable, contacting us directly, changing your browser settings on your device, and/or, where available, using third party unsubscribe functionality.

Learn more about how to change your privacy choices WITHIN YOUR ACCOUNT, WHEN YOU REGISTER OR BY CONTACTING US DIRECTLY and USING THIRD PARTY UNSUBSCRIBE FUNCTIONALITY.

A. WITHIN YOUR ACCOUNT

If you have an account with us, you can update your preferences where customer preference options are available through the relevant program, product or service. More specifically, users of the Circle K and/or Couche-Tard mobile application may request to have their account deleted within the mobile application.

B. WHEN YOU REGISTER OR BY CONTACTING US DIRECTLY

You may opt in to receiving email or SMS marketing communications at the time that you register for our programs, products or services, enter our contests or promotions or any time thereafter through your online account(s). We may also have your implied consent to send you such marketing electronic communications under applicable laws.

You may opt out of receiving email or SMS marketing communications, by clicking “unsubscribe” within any marketing email you receive, following the opt-out instructions provided when you receive a marketing SMS, or, in certain instances, through your online account (if you have created one).

You may also withdraw your consent to other forms of marketing and advertising or to the use of your personal information for market research and analytics by communicating with the applicable Privacy Office as indicated in the section Who Can You Contact With Privacy Questions? Below.

Please note the following regarding withdrawal of consent or changes in your privacy preferences:

• Even if you have opted out of receiving marketing communications from us, we may still contact you for transactional purposes, in compliance with applicable laws (e.g., for customer service, product information, service or reminder notices, or recalls). We may also need to contact you with questions or information regarding your customer service inquiries; and

• It may take some time for all of our records to reflect changes in your preferences (e.g., if you request that you not receive personalized marketing communications from Circle K, your preference may not be captured for a promotion already in progress).

C. USING THIRD PARTY UNSUBSCRIBE FUNCTIONALITY

With your consent or as permitted under applicable law, we may use third parties (e.g., web companies or social media platforms) that use certain technologies to analyze your browsing behaviour as you visit our websites and apps. You can manage your privacy preferences with respect to certain third parties, such as Google and Facebook, by using the unsubscribe functionality within their platforms. Please note that disabling, blocking or deleting some of these technologies, such as cookies, may cause you to lose the functionality of certain features on our websites and apps.

For example, Google Analytics uses cookies to analyze your browsing behaviour on our websites. This information is not provided to us in a personally identifiable format and is collected through your ad settings on your device or browser. If you would like to opt out of Google’s ad settings, please go to www.google.com/settings/ads or use the Google opt out browser add-on located at https://tools.google.com/dlpage/gaoptout.

For more information about interest-based ads, or to opt out of having your web browsing information used for behavioral advertising purposes, please visit http://www.aboutads.info/choices/ and https://optout.networkadvertising.org/. Your web browser or device may also include features or settings that allows you to opt out of having certain information collected through apps used for behavioral advertising purposes; for more information, consult the settings of your browser or device.

We also may embed links to other websites, including social media websites, on our websites and apps. For more information about social media plug-in protocols, such as “Like” buttons on Twitter, Facebook or Instagram and their impact on your privacy rights, please visit the appropriate social media help centre (e.g., Facebook’s Help Center at https://www.facebook.com/help/).

9. How we Store and Safeguard Personal Information

We take the security of your personal information very seriously and are committed to protecting your privacy by using a combination of administrative, physical, and technical safeguards. Your personal information may be stored in foreign jurisdictions, in which case it will be subject to foreign laws. We will store your personal information in accordance with our retention policies or as otherwise required or permitted by law.

Learn more about HOW WE PROTECT PERSONAL INFORMATION, WHERE WE KEEP PERSONAL INFORMATION AND CROSS-BORDER TRANSFERS, [WF1] and HOW LONG WE KEEP PERSONAL INFORMATION.

A. HOW WE PROTECT PERSONAL INFORMATION

We employ organizational, physical and technological measures to protect the confidentiality of personal information and to safeguard personal information against loss or theft, as well as unauthorized access, disclosure, copying, use or modification, in light of, among other things, the sensitivity of the information and the purposes for which it is to be used. These safeguards also apply when we dispose of or destroy your personal information. We use reasonable safeguards to ensure that our service providers protect your personal information wherever it is used or stored.

We implement a combination of policies and internal practices to protect your personal information, including:

• A designated Privacy Officer tasked to monitor our compliance with applicable privacy laws;

• Internal policies and procedures that define the roles and responsibilities of our employees throughout the life cycle of an item of information and limit their access to that information on a “need-to-know” basis and the retention of destruction of personal information;

• Procedures for responding to complaints or inquiries related to privacy, including related any confidentiality incident involving personal information;

• If the information is collected or stored electronically, technical safeguards such as encryption, firewalls, passwords, anti-virus software and similar measures;

• Contractual protections and other measures to ensure that service providers with whom we share personal information maintain adequate protections and security standards. For example, we generally require our service providers to limit their use and retention of personal information to that which is necessary to perform their services and to notify us in the event of an actual or suspected confidentiality incident. We also attempt to monitor and verify their compliance with these requirements in a variety of ways (e.g., on-site inspections (where possible), surveys and interviews, proof of certification).

• Employee training in privacy and information security. 

Our objective is to prevent any unauthorize access, data loss, misuse, and unauthorized sharing of modification to personal information in our control. We also use these protection measures when we delete or destroy your personal information.B. WHERE WE KEEP PERSONAL INFORMATION AND CROSS-BORDER TRANSFERS

We may share personal information within the Circle K group of companies, including in Canada, the United States and the European Union. Some of our service providers may also access, process or store your personal information outside of the country or the province where we are located and where you reside. As a result, when your personal information is used or stored in a jurisdiction other than where you are residing, it may be subject to the law of this foreign jurisdiction, including any law permitting or requiring disclosure of the information to the government, government agencies, courts and law enforcement in that jurisdiction.

C. HOW LONG WE KEEP PERSONAL INFORMATION

We will store your personal information in accordance with our retention policies or as otherwise required or permitted by law, after which your personal information will be securely destroyed or anonymized (so the information no longer identifies you).

10. Children Privacy

We do not knowingly request or collect personal information from children under 14 years of age without prior verifiable consent of his or her parent or legal guardian and complying with any other legal requirements. If we become aware that we have unknowingly collected personal information about a child without verifiable parental or legal guardian consent, we will delete this information from our records or take reasonable steps to de-identify the information.

11. Additional Information for Certain Jurisdictions

11.1. U.S. State-Specific Privacy Notice (“U.S. State Notice”)

This U.S. State Notice applies to “Consumers” as defined under consumer privacy laws in California and Virginia, specifically the California Consumer Privacy Act, including as amended by the California Privacy Rights Act (collectively, the “CCPA”) and the Virginia Consumer Data Protection Act (“VCDPA”). This U.S. State Notice is a supplement to this Privacy Policy. In the event of a conflict between any other Circle K policy, statement, or notice and this U.S. State Notice, this U.S. State Notice will prevail as to Consumers and their rights under CCPA and VCDPA. If you are an employee, former employee, independent contractor or job applicant please refer to the California HR Data Privacy Policy.

Section 11.1.1 covers Circle K’s Collection, Use, and Sharing of Personal Information as defined under CCPA and VCDPA. Section 11.2.1 describes your Rights under CCPA and VCDPA. and explains how to exercise those rights.

11.1.1. Collection, Use, and Sharing of Personal Information

This U.S. State Notice is designed to provide you with notice of (a) our recent, historical data practices over the prior 12 months (from the Effective Date listed at the top of this Privacy Policy) and (b) our current data practices such that it is also meant to provide you with notice of Personal Information we collect and the purposes for which we process Personal Information.

(a) Use of Personal Information.

Generally, we collect, retain, use, and disclose your Personal Information to provide you services and as otherwise related to the operation of our business, the whole as further described above. The “Business Purposes” for which we collect, retain, use, and disclose your Personal Information are the following:

• the business and operational purposes described in sections 4 (How we Collect Personal Information), 5 (How we Use Personal Information), and 6 (How we Share Personal Information) above;

• the CCPA’s listed business purposes (below);

• the purposes that we otherwise notify you at the time of collection; and

• other purposes that are related to or compatible with the context in which we collected your Personal Information.

The CCPA’s listed business purposes are:

• Performing services, such as fulfilling your orders

• Providing advertising or marketing services

• Research and development and improving our products and services

• Quality assurance

• Security and fraud prevention

• Debugging and fixing errors

• Processing interactions and transactions (e.g., short-term, transient use of Personal Information)

• Managing interactions and transactions (e.g., auditing related to a current interaction with the consumer and concurrent transactions

Our third-party service providers may also use your Personal Information for some or all of the business purposes. Our third-party service providers may themselves engage services providers or subcontractors to enable them to perform services for us, which sub-processing is, for purposes of certainty, an additional business purpose for which we are providing you notice.

(b) Categories of Personal Information Collected and Shared with Third Parties.

The first column of the table below describes the categories of Personal Information we collect about you. The third column of the table describes, as to each category of Personal Information, the third parties with whom we shared your Personal Information for business purposes.

As discussed in detail further below, we do not believe that we have “sold” your Personal Information as that term is defined in the CCPA. As described above, third-party cookie operators (“Cookie Operators”) collect Personal Information that falls under the Identifiers (e.g., cookie ID, IP address, and other online IDs) and Internet Usage Information categories. To the extent we have sold Personal Information, which we do not believe we have, the categories of Personal Information would be Identifiers and Internet Usage information, and the recipients of each category of Personal Information would be Cookie Operators. Please see the section Rights under CCPA and VCDPA. below for information on how to exercise choice with respect to Personal Information collected by Cookie Operators.

(c) Sources of Personal Information.

See section How we Collect Personal Information above.

11.1.2. Rights under CCPA and VCDPA.

(a) Making a Request and Scope of Requests.

We provide Consumers the privacy rights under the CCPA and VCDPA as described in this section.

You have the right to exercise these rights via an authorized agent who meets the agency requirements of the CCPA and VCDPA and related regulations. Any request you submit to us is subject to an identity verification process (“Verifiable Consumer Request”) as described in the Verifying Your Request section below. We will not fulfill your request unless you have provided sufficient information for us to reasonably verify you are the consumer about whom we collected Personal Information. To make a request to know or delete, please submit your request to us by either:

• Calling us at our toll-free number: 1-833-662-0510

• Visiting our request portal: Individual Rights Request Form

You may also obtain information on how to make, and may submit, a request by asking a manager at any of our California and Virginia locations, who will refer to these same two methods. Note that some Circle K locations are independently owned and operated by franchisees, in which case a request to us will not include Personal Information collected independently by them that was not shared with us.

Some Personal Information we maintain about consumers is not sufficiently associated with enough Personal Information about the consumer for us to be able to verify that it is a particular consumer’s Personal Information when a Consumer request that requires verification pursuant to the CCPA’s or VCDPA’s verification standards is made (e.g., clickstream data tied only to a pseudonymous browser ID). We do not include that Personal Information in response to those requests. If we cannot comply with a request, we will explain the reasons in our response. You are not required to create a password-protected account with us to make a Verifiable Consumer Request. We will use Personal Information provided in a Verifiable Consumer Request only to verify your identity or authority to make the request and to track and document request responses, unless you also gave it to us for another purpose.

We will make commercially reasonable efforts to identify Consumer Personal Information that we collect, process, store, disclose and otherwise use and to respond to your California or Virginia Consumer privacy rights requests. We will typically not charge a fee to fully respond to your requests; provided, however, that we may charge a reasonable fee, or refuse to act upon a request, if your request is excessive, repetitive, unfounded or overly burdensome. If we determine that the request warrants a fee, or that we may refuse it, we will give you notice explaining why we made that decision. You will be provided a cost estimate and the opportunity to accept such fees before we will charge you for responding to your request.

(b) Verifying Your Request.

In order for us to look into your request, we first need to verify your identity, meaning that we need to make sure that you are the consumer we may have collected Personal Information about or a person who has been duly authorized to make the request on behalf of the consumer.

To verify your identity, we ask that you to provide us with, at a minimum, your full name and phone number or email, and the nature in which you have transacted or interacted with us (e.g., in store or online, or both). Depending on the nature of the request and whether we have the phone number or email address you have provided in our systems, we will request further information from you in order to verify that you are the consumer about whom we have collected information.

For a specific pieces request and a request to delete important data, we are required to verify a consumer’s identity to high degree of certainty, which may include matching at least three data points provided by the Consumer with data points maintained by us (and which we have determined to be reliable for the purpose of verifying the consumer), together with a signed declaration under penalty of perjury that the requestor is the consumer whose Personal Information is the subject of the request. If we cannot verify you to that standard, we will treat the request as a categories request or a standard deletion request, for which we require a reasonable degree of certainty based on matched data. If we are unable to verify you to that standard, we will refer you to this U.S. State Notice.

(c) Authorizing an Agent.

You may designate an authorized agent to submit your consumer request on your behalf by submitting a request in the manners described above. If you are an authorized agent who would like to make a request, we are required to ensure that a right to know or deletion request made by an agent is a Verifiable Consumer Request and allows us to request further information to ensure that the Consumer has authorized the agent to make the request on their behalf. Generally, we will request that an agent provide proof that the Consumer gave the agent signed permission to submit the request and we also may require the Consumer to either verify their own identity or directly confirm with us that they provided the agent permission to submit the request.

(d) Your California and Virginia Consumer privacy rights are as follows:

(i) Right of Access.

(ii) Right Rectification.

(iii) Right of Deletion.

(iv) Right to Opt-Out of Sales.

(v) Right to Non-Discrimination for Exercise of Privacy Rights.

(vi) Right of Restriction.

(vii) Right of Portability.

(viii) California “Shine the Light” Notice.

(e) California “Shine the Light” Notice.

We comply with California Civil Code Section 1798.83 (the “Shine the Light” law) by not sharing your Personal Information with third parties for their direct marketing purposes (as those terms are defined by that law) without your consent. If you are a California resident, you may request information about our compliance with the Shine the Light law by contacting us in the following ways:

• Postal Mail: Legal Department c/o Privacy Office, Circle K Stores Inc., 1130 West Warner Road, Building B, Tempe, Arizona 85824

• Visiting our request portal: Individual Rights Request Form

Please note that the CCPA and Shine the Light are different laws offering different rights and requests must be made separately.

(f) Other California Notices.

We disclose our tracking and “do not track” practices in the section (b) Categories of Personal Information Collected and Shared with Third Parties. above and California minor’s rights to certain removal of their posts in the Children Privacy section. If you have any questions about the Privacy Policy or practices described in it, you should contact us in the following ways:

• Postal Mail: Legal Department c/o Privacy Office, Circle K Stores Inc., 1130 West Warner Road, Building B, Tempe, Arizona 85824

• Visiting our request portal: Individual Rights Request Form

11.2. Nevada Residents

We do not believe we “sell” “covered information” of Nevada “consumers” as those terms are defined by Chapter 603A of the Nevada Revised Statutes. Though we do not believe we sell covered information, Nevada’s law requires us to provide a method for Nevada consumers to make requests to opt out of sale, which you can do by visiting our request portal: Individual Rights Request Form.

11.3. Canada Residents

If you wish to request access to or correction of your personal information in our custody or control, you may contact the applicable Privacy Office as described in the Who Can You Contact With Privacy Questions? section. Your right to access or correct your personal information is subject to applicable legal restrictions. Upon request, we will provide you with access to your personal information within a reasonable timeframe, in compliance with applicable laws. We may take reasonable steps to verify your identity before granting access or making corrections.

12. Changes To Our Privacy Policy 

We may make changes to this Privacy Policy from time to time. Any changes we make will become effective when we post a modified version of the policy on our websites and apps. If the changes we make are significant, we will provide a more prominent notice when required by applicable laws. By continuing to participate in our programs, and/or use our services or purchase our products after the modified version of the Privacy Policy has been posted or you have been informed of such update, you are accepting the changes to the Privacy Policy. If you do not agree to the changes in our Privacy Policy, it is your responsibility to stop participating in our programs, and/or using our services or purchasing our products. It is your obligation to ensure that you read, understand and agree to the latest version of the Privacy Policy. The “Effective Date” at the top of the Privacy Policy indicates when it was last updated.

13. Who Can You Contact With Privacy Questions?

If you have any questions about how we handle your personal information, please contact us as indicated below. If you have a program, product, service, or are participating in a promotion, contest or event that is offered by us with a third party, the third party may hold your personal information. If you have any questions or concerns, we will direct you to the appropriate party so that you may make enquiries as to that party’s privacy policies and practices.

By mail: If you are in the U.S.

Legal Department c/o Privacy Officer
Circle K Stores Inc.
1130 West Warner Road, Building B
Tempe, Arizona 85284
United States 

If you are in Canada

Legal Department c/o Privacy Officer
Alimentation Couche-Tard Inc.
4204 Industriel Boulevard
Laval, QC H7L 0E3
Canada

Toll-free number: 1-833-662-0510

Request Form: Individual Rights Request Form