Introduction

This Privacy Policy ("Policy") describes how GMS Holding Co., LLC, on behalf of and for the benefit of itself and certain of its subsidiaries and affiliates, including FuelFox Operating Co., LLC and FuelFox IP Co., LLC (collectively, "FuelFox," "we," "us," or "our"), collects, uses, discloses, retains, and protects Personal Information when providing services through our FoxBot Analytics website ("FoxBot"), and through any of its associated functionalities or services that link to this Policy (collectively, the "Services").

FuelFox provides onsite mobile fueling services to commercial clients. The FoxBot Analytics Services provide real-time analytics of commercial customer fueling data, telematics on FuelFox trucks, and commercial accounting data. The FoxBot Analytics Services may be accessed by FuelFox personnel and commercial customers' designated users ("you," "your," or "users").

Our Services are hosted and operated in the United States. If you reside outside the United States, your information will be processed in accordance with U.S. law and this Policy.

Please note that this Policy applies to anyone who uses or accesses our Services, regardless of whether you use the Services via a computer, mobile device, tablet, or other medium (collectively, your "Equipment").

Your use of the Services is subject to our Terms of Service, and may be subject to other agreements between us, where applicable. For example, information processed under your Franchise Agreement remains subject to that agreement and applicable law. This Policy does not apply to the practices of companies that we do not own or control, or to individuals whom we do not employ, engage, or manage.

Please read this Policy carefully to understand our policies and practices regarding your Personal Information and how we will treat it. If you do not agree with this Policy, do not access, register with, or use the Services. By accessing, registering with, or using the Services, you acknowledge that you have read, understood, and agree to this Policy. This Policy may change from time to time (see Changes and Amendments). Your continued use of the Services after we revise this Policy means you accept those changes, so please check this Policy periodically for updates.

Information We May Collect

For purposes of this Policy, "Personal Information" is any information that identifies, relates to, describes, or is reasonably capable of being associated with a particular person. Personal Information does not include information that is publicly available or de-identified. You may always choose not to share your Personal Information with us; however, if you choose not to provide or allow us to collect certain Personal Information, such as account login and registration information, you may be unable to use the Services.

We do not collect information that may be considered sensitive personal information under applicable law.

We may collect the following information from or about users of the Services:

• Identifiers: such as your name, business mailing address, Internet Protocol address, business email address, account name, login credentials, or other similar identifiers.
• Other Personal Information: such as signature, business telephone number, employer information, and title.
• Internet or other electronic network activity information: such as browsing history, search history, and information regarding your interaction with and use of the Services. Equipment information such as IP address, browser type and settings, operating system and version, language and time-zone, device identifiers, and other Equipment information. Technical information, including your internet connection and usage details when you interact with the Services, such as clickstream to, through, and from our Services; page response times, error logs, page interaction information, or methods used to browse into or away from a page. Session and security information such as authentication state, multi-factor status, and fraud or abuse indicators.
• Geolocation Data: Such as your imprecise location via city, state, or zip code when accessing and using the Services.
• Professional or Employment-Related Information: Such as your company of employment and title to receive access to the Services.

How We Collect Information

We may collect Personal Information from or about users of the Services in the following ways:

Directly from You. We collect information you provide to us when you interact with our Services, such as when you register, create, or update your account or profile, complete forms, or when you otherwise contact us through other means of communication through the Services, such as customer support.

Automatically through Cookies and Other Automatic Data Collection Technologies. We may automatically collect certain types of Personal Information as you access, interact with, or use our Services. For example, we may use "cookies" and "web beacons" (also called "clear gifs" or "pixel tags"), to obtain certain information when you use or access our Services. We may use information automatically collected to:

• Estimate our audience size and usage patterns.
• Store your preferences, so that we may customize our Services according to your individual interests.
• Speed up your searches.
• Recognize you when you return to our Services.

The technologies we use for this automatic data collection may include:

• Cookies (or browser cookies). A cookie is a small file placed on your device when you interact with the Services. You may refuse to accept or disable cookies by activating the appropriate setting on your browser or device. However, if you select this setting, you may be unable to access certain features of the Services.
• Web Beacons. Some parts of the Services may contain tiny graphics with a unique identifier known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs), similar in function to cookies, and may be used, for example, to track the online movements of users and for other related statistics.

Additionally, when you interact with the Services, there are third parties that may use automatic collection technologies to collect information about you or your Equipment. These third parties may include analytics companies, your device manufacturer, and your internet or mobile service providers. Such third parties may use tracking technologies to collect information about you when you use the Services. The information they collect may be associated with your personal information or they may collect information, including personal information, about your online activities over time and across different websites, apps, platforms, and other online services. We do not control these third parties' tracking technologies or how they may be used. If you have any questions about a third party's privacy practices, you should contact the responsible provider directly.

Information from Business Partners and Service Providers. We may receive Personal Information about you from vendors and service providers we hire to help us run our business, including the companies that host or operate our Services, send emails for us, provide marketing and analytics services, or host our content. We may combine that information with Personal Information we collect directly from you. We also may receive personal information from business partners that we engage to share user information with us.

Integration with Other Applications and Services

The Services may interoperate with, or allow you to link, connect, or integrate your account with limited, approved third-party applications or services that are not owned or controlled by us to provide requested features (for example, connecting a QuickBooks Online ("QBO") company via OAuth 2.0 to enable read-only accounting analytics). We connect to the integrated service and retrieve only the information necessary to deliver the Services and as permitted by you or your organization.

For integrations with third-party applications or services, the information you provide to that third-party service will be subject to that third party's privacy policy and practices once it is shared, and we are not responsible for the privacy, security, or data handling practices of those third parties.

You may disable or disconnect an integration at any time within the integrated service or the Services, as available; re-authorization may be required to resume our data access. For general information about accounting platform scopes and supported data types, please refer to the applicable platform's terms and practices.

How We Use Information

We may use Personal Information to:

• Create and manage user accounts.
• Provide you with the Services and any contents, features, information, products, or services that we make available through the Services.
• Personalize your user experience and tailor interactions with you.
• Develop, maintain, analyze, improve, optimize, measure, and report on our Services and their features and how users interact with them. Our analysis may include the use of technology like machine learning and large language models, which may include training these models. We do not engage in automated decision-making that produces legal or similarly significant effects on individuals.
• Carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection.
• Monitor progress of our franchisees, prepare financial performance representations for our Franchise Disclosure Document, and provide services to former customers serviced by former franchisees.
• Respond to your inquiries, requests, and feedback, and to send administrative notices about service status, maintenance, or changes to the Services and this Policy, Terms of Service, or other agreements with you.
• Enforce our Terms of Service, this Policy, or other applicable policies or agreements with you.
• Protect the rights, property, or safety of our business, employees, customers, or others, including for cybersecurity and fraud protection.
• Facilitate a merger, acquisition, bankruptcy, dissolution, reorganization, sale of some or all of our assets, financing, acquisition of all or a portion of our business, a similar transaction or proceeding, or steps in contemplation of such activities (e.g., due diligence) and/or to facilitate any other activity in connection with the creation, development, offering, provision, or servicing of our products and services.
• Use for any purpose permitted or required by law, disclosed to you at the time of collection, or with your consent, as permitted by law.

No Personal Data Sale, Targeted Advertising, or Profiling

We do not sell your Personal Information nor do we use or share your Personal Information for targeted advertising or profiling through the Services. If our practices change in the future to include any activities that are considered a personal data sale or sharing, including targeted advertising, or profiling, under applicable law, depending on where you live, we will update this Policy and, where required, honor your rights and choices, consistent with applicable law.

Disclosure of Information

We may disclose aggregated or de-identified information that cannot reasonably be used to identify an individual or specific outlet, without restriction.

In addition, we may disclose Personal Information as follows:

• To our affiliates or subsidiaries;
• To contractors, service providers, and other third parties we use to support our business;
• To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of FuelFox's assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us about our users is among the assets transferred;
• To fulfill the purpose for which you provide it;
• For any other purpose disclosed by us when you provide the information;
• With your consent, consistent with applicable law;
• To comply with any court order, law, or legal process, including to respond to any government or regulatory request;
• To enforce our rights arising from any contracts entered into between you and us, including the Website Terms of Service, this Policy, other agreements between us where applicable, and for billing and collection; or
• If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of FuelFox, our customers, or others.

How We Protect Information

We use commercially reasonable administrative, technical, and physical safeguards designed to protect your Personal Information from unauthorized access, use, disclosure, and loss. While we strive to protect your Personal Information, you acknowledge that (i) there are security and privacy limitations of the internet which are beyond our control; (ii) the security, integrity, and privacy of any and all information and data exchanged between you and the Services cannot be guaranteed; and (iii) any such information and data may be viewed or tampered with in transit by a third-party, despite our best efforts.

Retention

We will retain and use your Personal Information only for the period necessary for the purposes for which we collect it, with your consent (consistent with applicable law), and/or for as long as otherwise permitted or required by law, such as maintaining the Services, operating our organization, complying with our legal obligations, resolving disputes, and for safety, security, and fraud prevention. This means that we consider our legal and business obligations, potential risks of harm, and nature of the information when deciding how long to retain it and for what purposes.

Transfer of Data

Depending on your location, your Personal Information may be transferred to, stored in, and processed in devices located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ than those from your home jurisdiction. If you are located outside the United States and choose to provide Personal Information to us, please note that we transfer the data to the United States and process it there. Your consent to this Policy followed by your submission of such information represents your consent to such transfers.

Your Rights and Choices

We provide mechanisms you can use to control certain uses and disclosures of your Personal Information and rights you may have under state law, depending on where you live.

• Marketing. If you do not wish us to use your Personal Information to promote our own or third parties' products or services, you may opt-out by replying to any promotional email we have sent you or following the opt-out links on that message. This opt-out generally will not apply to information provided to us to provide the requested service or other service-based activities.
• Accessing, Updating, and Deleting Your Information. If you have an account with us, you may access your Personal Information and make updates to or delete your Personal Information. If not, you may contact us as provided below and request that we update, delete, or provide with access to your Personal Information, consistent with your rights under your respective U.S. state law. We will accommodate your request to change information whenever possible, consistent with applicable law and any agreements in place between you and us.
• Cookies and Other Automatic Data Collection Technologies. Please see the Cookies and Other Automatic Data Collection Technologies section above for information on how to manage these technologies.
• Location Information. As noted, when you access or use our Services, we may collect certain information about your device's imprecise location. You can opt out of allowing us to collect and use such information about your device's location through the device's privacy settings or by refusing access to such information. However, if you choose to opt out, some Services features may become inaccessible or not function properly.
• Targeted Advertising. Please see the No Personal Data Sale, Targeted Advertising, or Profiling section above for information on our current practices.

Additional Data Subject Rights

In addition to the rights noted above, you may have additional or complementary rights under one or more state or local laws, some of which are noted below.

Depending on in which U.S. state you are resident, you may have the following rights related to your Personal Information:

• The right to know what Personal Information we process about you.
• The right to request certain Personal Information that we process about you be deleted.
• The right to request we correct Personal Information we have about you which you believe is incorrect.
• The right to have certain Personal Information we process about you returned to you in an accessible and useable format upon your request, if such request is technically feasible.
• The right to opt-out of having your Personal Information processed in such a way that enables us to create a profile of inferences about you or for targeted advertising purposes. Please note, we do not use Personal Information for these purposes.
• The right to limit the use of your Sensitive Personal Information. Please note, we do not sell your Personal Information as that term is defined by applicable law.
• The right to opt-out of the sale of your Personal Information. Please note, we do not sell your Personal Information as that term is defined by applicable law.
• The right to opt-out of any profiling in furtherance of decisions that produce legal or similarly significant effects. Please note that we do not use your Personal Information in this manner.
• The right to exercise your data subject rights free from discriminatory treatment.
• California Residents. If you are a California resident, you may have additional personal rights and choices with regard to your personal information. For example, California's "Shine the Light" law (Civil Code Section § 1798.83) permits users of a covered website that are California residents to request certain information regarding the covered businesses' disclosure of personal data to third parties for their direct marketing purposes. At this time, we do not engage in this type of disclosure. Notwithstanding the foregoing, it is our Policy not to share covered Personal Information of individuals with third parties for their direct marketing purposes if the individual has exercised their cost-free right to opt-out of such sharing for such purposes.

Exercising Your Data Subject Rights

To exercise any applicable data subject rights, please submit a request to Ben Morris at bmorris@fuelfox.net or (205) 807-6787, or use the contact details provided below.

How We Verify Data Subject Rights Requests

We may require that your identity be verified prior to processing verifiable rights requests. If your request requires verification, we will verify your identity by comparing the information we have about you against the information we receive when you submit your request. If we do not have enough information to verify your identity, we may request additional information from you, consistent with applicable law. We may deny a rights request if we are unable to verify your identity.

Authorized Agents

Some U.S. states permit their residents to designate an authorized agent to submit requests to exercise certain data subject rights on the individual's behalf. Even if you use an authorized agent to submit a request on your behalf, pursuant to applicable law, we may still require that you verify your identity depending on the nature of the request and sensitivity of the information at issue.

If you are an authorized agent submitting a request on behalf of an individual, please submit a request using the contact information provided in the Contact Us section below. You must include a copy of the written, signed permission indicating that you are permitted to act on that person's behalf.

Appealing a Denied Data Subject Rights Request

In some circumstances, we may deny your request to exercise one or more of the rights described above. Some U.S. states permit their residents to appeal a denied data subject rights request. Depending on in which U.S. state you reside, if you disagree with our decision to deny your request or any portion of your request, you may appeal our decision within sixty (60) days of receipt of notice that your request has been denied. If you submit an appeal to a denied request more than sixty (60) days after you have been notified of our decision to deny the request, we may deny your appeal. If you submit a timely appeal, we will respond within forty-five (45) days of our receipt of your appeal.

If you wish to appeal a decision, please clearly and plainly describe your basis of disagreement with our decision by responding through the same means by which we communicated our decision or by submitting your appeal using the information provided in the Contact Us section below. We will review your appeal and either amend or uphold our decision. In either case, we will provide a written explanation of the reason for the decision. This decision will be final.

Links to Third Parties

Our Services contain links to other websites, applications, or services that are not owned or controlled by us, including, without limitation, QuickBooks Online. Please be aware that we are not responsible for the privacy practices of such third parties. We encourage you to be aware when you leave FoxBot and to read the privacy statements of any third-party services that may collect your Personal Information before using their services or providing any information to them.

Minors' Information

Our Services are commercial services intended for users 18 years of age and over. We do not knowingly collect, sell, or share Personal Information of individuals under 18. If you are under 18, please do not use our Services and please do not share your Personal Information with us.

Material Changes and Amendments to Privacy Policy

It is our policy to post any changes we make to our Privacy Policy on our website and within the Services. If we make material changes to how we treat our users' Personal Information, we will provide notice of such changes consistent with applicable law. The date the Privacy Policy was last revised is identified at the top of the page. You are responsible for visiting the Services and this Privacy Policy to check for any changes. If you object to any change, please stop using our Services.

Contact Us

To exercise your data subject rights or ask questions about this Policy or our privacy practices, please contact us through your account administrator or at:

FuelFox
Attn: Ben Morris
2222 Arlington Ave. S
Birmingham, AL 35205
(205) 807-6787
bmorris@fuelfox.net