Fleetcor Europe Privacy Policy

This policy was lasted updated on 26 October 2020.

At Fleetcor Technologies, Inc., through our affiliates operating the Allstar, epyx, Fleetcor, The Fuelcard Company, Keyfuels, r2c, Travelcard, Tankpas.nl, Transit card and CCS brands, and servicing the Shell fuel card (collectively, “Fleetcor”, “we”, “our” or “us”), we respect your privacy. We have implemented this privacy policy to outline how Fleetcor uses personal data relating to its customers, prospective customers, fuel card holders, web users and other individuals who interact with us.

If you are applying for a role at one of our companies, then please see our dedicated job applicant privacy policy instead.

Fleetcor considers your privacy to be important. We are committed to protecting the privacy of the information you provide to us, including your personal data. This policy describes the types of personal data we collect, how we use that data, with whom we share it, the choices you can make about our use of such data, your privacy rights and how the law protects you. We also describe the measures we take to protect the security of your personal data and how you can contact us about our privacy practices.

Who we are

To understand who your data controller is please see the section entitled “How to reach us”.

We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to our privacy policy and how we handle your personal data. Details about how to contact our DPO can be found in the “How to reach us” section of this privacy policy.

Information we collect

As a provider of fuel card and expense management, and vehicle network services to businesses, we may have a direct relationship with you, and you may choose to provide personal data to us in connection with that relationship or we may collect it via other means. The data we collect about you may include:

Contact information

Login details

Financial information

Content you provide to us

Technical information about your device and website usage

Transaction history

Information about your characteristics and preferences

Page 1 of 25

V6.20200811

Vehicle registration numbers and location

Information including your ID – date of issue, expiry, number, issuing body and address (for identification purposes).

To find out more please click here.

How we collect your information

We use different methods to collect data from and about you, depending upon the nature of our relationship. This may include through direct interactions we have with you, through the use of automated technologies (e.g. cookies) and from third parties or publicly available sources.

To find out more please click here.

How we use your data

Depending on the nature of our relationship with you, we may use your data to:

Process an application for an account you apply for.

Provide the services our customers have signed up for.

Process your transactions.

Administer your online account.

Protect ourselves against fraud and money laundering, verify your identity and to detect, investigate and prevent crime.

Provide you with information about our products and services.

Allow you to participate in interactive features e.g. via the website such as via our live chat function.

Operate, evaluate and improve our business.

Perform analysis (including anonymisation) of your data.

Comply with our legal obligations, applicable industry standards and our policies.

Administer the contracts we have with our customers, including to update contracts and to correspond with our customers about our services and the contracts.

Other ways which we notify you of at the time of its collection or use.

To find out more please click here.

Data we share and receive

We do not sell or otherwise disclose your data, except as described in this privacy policy. We may share your data with the following parties:

Page 2 of 25

V6.20200811

Other members of the Fleetcor group.

If you are a fuel card holder, we will share transaction history and data usage information with your employer/the company you represent.

If you are a 1link user, other subscribers of the 1link services.

Providers of transaction services, such as card issuers, merchants, payment processors and other suppliers to assist with the transactions and administration of the fuel card services.

Marketing and data analytics companies.

Our commercial partners who sell similar products and services.

Partners who provide features on our websites.

IT suppliers.

Risk and fraud prevention agencies and monitoring providers.

Credit reference agencies.

Our insurers and professional advisers.

Regulators and other government agencies including, but not limited to, public authorities, regulators, the police and other law enforcement agencies.

Any company to whom we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets, along with its professional advisers.

We do not authorise any third parties that we share data with to use or disclose your data except as necessary to perform certain services on our behalf, to comply with legal requirements or as detailed under the Credit Reference Agencies section of this policy. We require these third parties, through our contractual arrangements with them, to appropriately safeguard the privacy and security of the data they process on our behalf.

We may also receive data about you from the following third parties:

Social media platforms.

Your employer.

Credit reference agencies: information relating to credit score/suitability for products.

Data brokers.

Our commercial partners.

Public databases.

Regulators and other government agencies.

If you would like to receive a full list of our suppliers and other third parties who we share your data with or receive your data from then you can get in touch with us using the details provided in the section “How to reach us?”.

Credit Reference Agencies

Page 3 of 25

V6.20200811

In order to process applications we will supply personal information you provide to credit reference agencies (CRAs) and they will give us information about you, such as about your financial history. We do this to assess creditworthiness and product suitability, check your identity, manage your account, trace and recover debts and prevent criminal activity. We will also continue to exchange information about you with CRAs on an ongoing basis, including about your settled accounts and any debts not fully repaid on time. CRAs will share your information with other organisations.

CRAIN (Credit Reference Agency Information Notice) is a document produced by the three Credit Reference Agencies- Experian, Equifax and TransUnion (formerly Callcredit)- that explains the use of personal data they receive from third parties about individuals and/or their businesses in relation to credit activity. CRAIN has been produced in conjunction with the Information Commissioner’s Office (ICO).

The CRAIN, the identities of the CRAs and the ways in which they use and share personal information, are explained in more detail at http://www.experian.co.uk/crain/index.html.

Where your data may be sent

As with any multinational organisation, we are often required to transfer data internationally. Accordingly, your personal data may be transferred globally (if your data is collected within the European Union, this means that your data may be transferred outside of it).

This includes transfers that have been identified in the previous section “Who do we share your data with and for what purposes”.

To find out more please click here.

How we keep your information secure

Fleetcor will take appropriate technical and organisational security measures to secure your personal data and to protect it from loss, misuse or alteration. Personal data that we hold about you is stored on our secure servers or those of our appointed suppliers. Our web pages that collect your data are secured with Secured Socket Layers (SSLs).

Where we have given you (or where you have chosen) a password which enables you to access certain parts of our website, you are responsible for keeping this password confidential. We ask you not to share this password with anyone.

Fleetcor maintains an information security program that is designed to:

Secure and maintain confidentiality of your personal data.

Protect against anticipated threats or hazards to security or integrity of your data.

Protect against unauthorised access to or use of your data that could result in substantial harm or inconvenience to you or your entity if compromised.

Comply with applicable laws.

Page 4 of 25

V6.20200811

How long we may keep your data

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Details of retention periods for different aspects of your personal data can be requested by contacting the DPO.

In some circumstances you can ask us to delete your data, please see “Your Rights and Choices”.

In some circumstances we may anonymise your personal data (so that it can no longer be associated with or be used to identity you) for research or statistical purposes in which case we may use such data indefinitely without further notice to you.

Children’s privacy

Fleetcor’s websites are not intended for use by children, especially those under the age of 18. No one under the age of 18 should provide any personal data or participate in any forums, chats, or online discussions. Minors under the age of 18 are prohibited from applying for emails, newsletters and/or products or services, on our websites. If we identify that we have received any such personal data we will delete it.

Your rights and choices

You may have some or all of the following rights in respect of personal data about you that we hold:

∙Request us to give you access to it.

∙Request us to rectify it, update it, or erase it.

∙Request us to restrict our using it, in certain circumstances.

∙Object to our using it, in certain circumstances.

∙Where legally possible, withdraw your consent to our using it.

∙Data portability, in certain circumstances.

∙Opt out from or objecting to our using it for direct marketing.

∙Lodge a complaint with the supervisory authority in your country (if there is one).

You are able to exercise these rights by contacting us using the details set out at in the “How to reach us” section below.

Please visit our cookie policy to learn about how you can also exercise your rights in relation to our use of cookies, web beacons and similar technologies.

To find out more please click here.

Page 5 of 25

V6.20200811

How to reach us

If you have any questions about our privacy policy, including any requests to exercise your legal rights in relation to the data we hold on you, then please contact the relevant DPO using the details set out below:

Page 7 of 25

V6.20200811

If your country of residence has a data protection authority, you have a right to contact it with any questions or concerns. If we cannot resolve your questions or concerns, you also have the right to seek judicial remedy before a national court.

Updates to this privacy policy

We will update this policy from time to time to reflect changes in our business. We will inform you of these changes as required under applicable laws.

Page 9 of 25

V6.20200811

Fleetcor Europe Privacy Policy (Long Form)

This policy was lasted updated on 26 October 2020.

At Fleetcor Technologies, Inc., through our affiliates operating the Allstar, epyx, Fleetcor, The Fuelcard Company, Keyfuels, r2c, Travelcard, Transit card, Tankpas.nl and CCS brands, and servicing the Shell fuel card (collectively, “Fleetcor”, “we”, “our” or “us”), we respect your privacy. We have implemented this privacy policy to outline how Fleetcor uses personal data relating to its customers, prospective customers, fuel card holders, web users and other individuals who interact with us.

If you are applying for a role at one of our companies, then please see our dedicated job applicant privacy policy instead.

Fleetcor considers your privacy to be important. We are committed to protecting the privacy of the information you provide to us, including your personal data. This policy describes the types of personal data we collect, how we use that data, with whom we share it, the choices you can make about our use of such data, your privacy rights and how the law protects you. We also describe the measures we take to protect the security of your personal data and how you can contact us about our privacy practices.

Who we are

To understand who your data controller is please see the section entitled “How to reach us”.

We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to our privacy policy and how we handle your personal data. Details about how to contact our DPO can be found in the “How to reach us” section of this privacy policy.

Information we collect

As a provider of fuel card and expense management, and vehicle network services to businesses, we may have a direct relationship with you, and you may choose to provide personal data to us in connection with that relationship or we may collect it via other means. The data we collect about you may include:

Contact information

Login details

Financial information

Content you provide to us

Technical information about your device and website usage

Transaction history

Information about your characteristics and preferences

Vehicle registration numbers and location

Page 10 of 25

V6.20200811

Information including your ID – date of issue, expiry, number, issuing body and address (for identification purposes).

Contact information

If you are a customer of ours, a card holder or otherwise interact with us (e.g. through our website) then we will collect certain basic contact information about you. This may include your name, postal address, email address, phone number and fax number.

In the event that you are a representative or employee of one of our customers then we may also collect the name of your employer/the company your represent, your role at the company and job title. If you are a customer of our vehicle tracking service then this may include the location of your vehicle and its journey history.

Login details

If you have an online account with us, then we will store your username and password in order to manage your access to our platforms.

Financial information

This may include your fuel card number, credit/debit card details, bank account information and details we collect about your credit status if we conduct a credit report.

Know your client information

This may include your date of birth and personal address, passport number, driving licence number and/or national insurance number.

If you are a director or beneficial owner of a prospective customer then we may capture and use your personal data to conduct credit and anti-money laundering checks.

Please bear in mind that we may collect and consult your personal data in public registers and public sources (e.g. via the internet) as part of the know your client process.

Content you provide to us

For instance, you may get in touch with us via our website or by telephone, we may email you or vice versa or you may send us feedback via a survey form.

Technical information about your device and website usage

If you use our website or mobile applications then we will install certain cookies and web beacons on your device. The details of how we use these technologies is further outlined in our cookie policy.

Through cookies, web beacons and similar technologies we may collect details about your device, such as IP address, internet browser type and operating system. We may also collect information about your browsing activity, such as how you use our website, the pages you have visited, the date and time of each visit and the URLs of any websites that re-directed you to our website.

Transaction history

If you are a card holder, then we will collect records of your transactions on that card, including the location date and time of the transaction and the cost of the fuel, goods or services.

Location data

Page 11 of 25

V6.20200811

If you are a card holder, then we will collect information on the location of any transactions carried out on the card.

With your consent, we will access location-based information or collect location markers from your mobile device or based on your IP address. We will use this information to provide you with notifications related to our locations. We do not use this information to specifically locate you for any reason other than to provide you with the service. If you have allowed us to utilise your location information in the past and wish to revoke the permissions, please change the settings on your device.

Vehicle location data

Some of our services may involve the use of a vehicle telematics system. Some telematics systems provide us with use of, disclosure of or access to location information and mileage as permitted by law.

Use of the telematics system is subject to the terms and conditions and privacy policy posted by the applicable telematics systems provider.

Information about your characteristics and preferences

We may collect certain details about you and your preferences (as a prospective customer, customer and/or card holder). This may include your purchasing behaviour and preferences.

How we collect your information

We use different methods to collect data from and about you, depending upon the nature of our relationship. This may include through direct interactions we have with you, through the use of automated technologies (e.g. cookies) and from your employer, third parties or publicly available sources.

Direct interactions

You may provide us with your data by completing forms (e.g. through our website) or by corresponding with us by post, phone, email or otherwise. This includes data you provide when you:

Apply for a product or service on our website or through one of our sales associates.

Create an account on our websites.

Sign up to receive information (e.g. subscribe to our email marketing list).

Participate in promotions or surveys.

Provide us with feedback.

Otherwise communicate with us.

Automated technologies

As part of the processing of your personal data, decisions may be made by automated means. This means we may automatically decide that you pose a fraud or money laundering risk if our processing reveals your behaviour to be consistent with money laundering or known fraudulent conduct, or is inconsistent with your previous submissions, or you appear to have deliberately hidden your true identity. You have rights in relation to automated decision making: if you want to know more please contact the DPO.

Page 12 of 25

V6.20200811

If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services or financing you have requested, or to employ you, or we may stop providing existing services to you.

As you interact with our website, we may automatically collect technical information about your equipment, browsing actions and patterns. We collect this personal data by using cookies, and other similar technologies. We may also receive technical data about you if you visit other websites employing our cookies. Please see our cookie policy for further details.

Third party or publicly available sources

We may receive personal data about you from various third parties and public sources, including financial institutions and payment processors, credit reference agencies, credit institutions and commercial information services. For further details about the third parties that Fleetcor may collect and provide your personal data to see the section of this privacy policy entitled ”Data we share and receive”.

How we use your data

Depending on the nature of our relationship with you, we may use your data to:

Process an application for an account you apply for.

Provide the services our customers have signed up for.

Process your transactions.

Administer your online account.

Protect ourselves against fraud and money laundering, verify your identity and to detect, investigate and prevent crime.

Carry out checks in relation to your creditworthiness.

Provide you with information about our products and services.

Allow you to participate in interactive features e.g. via the website such as via our live chat function.

Operate, evaluate and improve our business.

Perform analysis (including anonymisation) of your data.

Comply with our legal obligations, applicable industry standards and our policies.

Administer the contracts with our customers, including to update contracts and to correspond with our customers about our services and the contracts.

Other ways which we notify you of at the time of its collection or use.

The table below sets out further information about the purposes for which we use data about you, with the corresponding categories of data processed in each case and the legal basis that we rely upon for its use.

Page 14 of 25

V6.20200811

Page 16 of 25

V6.20200811

contractual arrangements with them, to appropriately safeguard the privacy and security of the data they process on our behalf.

We may also receive data about you from the following third parties:

Social media platforms.

Your employer.

Credit reference agencies: information relating to credit score/suitability for products.

Data brokers.

Our commercial partners.

Public databases.

Regulators and other government agencies.

If you would like to receive a full list of our suppliers and other third parties who we share your data with or receive your data from then you can get in touch with us using the details provided in the section “How to reach us?”.

Credit Reference Agencies

In order to process applications we will supply personal information you provide to credit reference agencies (CRAs) and they will give us information about you, such as about your financial history. We do this to assess creditworthiness and product suitability, check your identity, manage your account, trace and recover debts and prevent criminal activity. We will also continue to exchange information about you with CRAs on an ongoing basis, including about your settled accounts and any debts not fully repaid on time. CRAs will share your information with other organisations.

CRAIN (Credit Reference Agency Information Notice) is a document produced by the three Credit Reference Agencies- Experian, Equifax and TransUnion (formerly Callcredit)- that explains the use of personal data they receive from third parties about individuals and/or their businesses in relation to credit activity. CRAIN has been produced in conjunction with the Information Commissioner’s Office (ICO).

The CRAIN, the identities of the CRAs and the ways in which they use and share personal information, are explained in more detail at http://www.experian.co.uk/crain/index.html.

Where your data may be sent

As with any multinational organisation, we are often required to transfer data internationally. Accordingly, your personal data may be transferred globally (if your data is collected within the European Union, this means that your data may be transferred outside of it). This includes transfers that have been identified in the previous section “Who do we share your data with and for what purposes”.

Page 18 of 25

V6.20200811

When using personal data as described in this privacy policy, it may be transferred either within or outside the country or territory where it was collected, including to a country, territory or international organisation that may not have EU equivalent data protection standards.

For example, we may transfer your personal data to our vendors based outside the European Union. In all cases, the transfer will be on the basis of a European Commission adequacy decision or we will implement adequate measures, for example the EU Model Contracts, and including appropriate security measures, for the protection of personal data in those countries, territories or international organisations in accordance with applicable data protection laws. If you would like more information about any of the data transfer measures on which we rely please contact us using the details provided in the section “How to reach us”?.

How we keep your information secure

Fleetcor will take appropriate technical and organisational security measures to secure your personal data and to protect it from loss, misuse or alteration. Personal data that we hold about you is stored on our secure servers or those of our appointed suppliers. Our web pages that collect your data are secured with Secured Socket Layers (SSLs).

Where we have given you (or where you have chosen) a password which enables you to access certain parts of our website, you are responsible for keeping this password confidential. We ask you not to share this password with anyone.

Fleetcor maintains an information security program that is designed to:

Secure and maintain confidentiality of your personal data.

Protect against anticipated threats or hazards to security or integrity of your data.

Protect against unauthorised access to or use of your data that could result in substantial harm or inconvenience to you or your entity if compromised.

Comply with applicable laws.

How long we may keep your data

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Details of retention periods for different aspects of your personal data can be requested by contacting the DPO.

In some circumstances you can ask us to delete your data, please see “Your Rights and Choices”.

Page 19 of 25

V6.20200811

In some circumstances we may anonymise your personal data (so that it can no longer be associated with or be used to identity you) for research or statistical purposes in which case we may use such data indefinitely without further notice to you.

Children’s privacy

Fleetcor’s websites are not intended for use by children, especially those under the age of 18. No one under the age of 18 should provide any personal data or participate in any forums, chats, or online discussions. Minors under the age of 18 are prohibited from applying for emails, newsletters and/or products or services, on our websites. If we identify that we have received any such personal data we will delete it.

Your rights and choices

You may have some or all of the following rights in respect of personal data about you that we hold:

∙Request us to give you access to it.

∙Request us to rectify it, update it, or erase it.

∙Request us to restrict our using it, in certain circumstances.

∙Object to our using it, in certain circumstances.

∙Where legally possible, withdraw your consent to our using it.

∙Data portability, in certain circumstances.

∙Opt out from or object to our using it for direct marketing.

∙Lodge a complaint with the supervisory authority in your country (if there is one).

You are able to exercise these rights by contacting us using the details set out at in the “How to reach us” section below.

Please visit our cookie policy to learn about how you can also exercise your rights in relation to our use of cookies, web beacons and similar technologies.

You have the rights set out in the table below:

Right in respect of the data about you that we Further detail (note: certain legal limits to all these rights apply) hold

This is confirmation of:

How to reach us

If you have any questions about our privacy policy, including any requests to exercise your legal rights in relation to the data we hold on you, then please contact the relevant DPO using the details set out below:

Page 23 of 25

V6.20200811