MAGELLAN PRIVACY POLICY

Last Modified: September 5, 2023 This Privacy Policy explains how Magellan Midstream Partners, L.P. (“Magellan”, “we”, “us” or “our”) collects, uses, shares, and otherwise processes personal data in connection with our websites, including http://magellanlp.com/ and other websites we own and operate that link to this Privacy Policy (the “Sites”), the Magellan Midstream mobile application (the “App”), and the related content, platforms, services, products, and other functionality offered on or through our services (collectively, the “Services”). This Privacy Policy does not address our privacy practices relating to Magellan job applicants, employees, and other personnel. Please note this Privacy Policy is not a contract and does not create any legal rights or obligations. Data We Process Through Our Customers to Provide Our Services. Data protection laws sometimes differentiate between “controllers” and “processors” of personal data. A “controller” determines the purposes and means (or the why and the how) of processing personal data. A “processor,” which is sometimes referred to as a “service provider,” processes personal data on behalf of a controller subject to contractual restrictions. In providing our Services, we may collect personal data about our customers’ end users or other individuals, or we may collect personal data on our customers’ behalf (all of which we call “Customer Data”). When we process Customer Data, we have contractually committed ourselves to only process such information on behalf and under the instruction of the respective customer, who is the data controller. This Privacy Policy does not apply to such processing.

1. WHAT IS PERSONAL DATA?

When we use the term “personal data” in this Privacy Policy, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to a person or household. It does not include aggregated or de-identified information that is maintained in a form that is not reasonably capable of being associated with or linked to a person.

2. HOW WE COLLECT AND USE PERSONAL DATA

Personal Data Collected from Individuals.

The categories of personal data we collect submitted to us by individuals through the Services may include:

Contact information, including first and last name, business email address, company name, phone number, your country or region, and communication preferences. We use this information to fulfill your requests, such as when you sign up to view our webcasts, and to communicate with you directly.
Account information, including personal and/or business information that you provide when you register for an account to use our Services. This may include your first and last name, email address, and username and password. If you are an administrator for your company, we will also collect information to create your company account and profile, including business financial information such as FEIN, ACH debit information, ABA transit number, and account number. We use this information to administer your account, provide you with the relevant Services and information, communicate with you regarding your account and your use of the Services, and for customer support purposes.
Inquiry and communications information, including information provided to one of our email addresses, via chat, or via phone. This also includes contact information provided on our Services. We use this information to investigate and respond to your inquiries, and to communicate with you, to enhance the services we offer to our users and to manage and grow our organization.
Information collected through the use of the Services, including any files, documents, videos, images, data, or information you choose to upload or transmit through your communications with us, your communications with other users, or your use of the Services (collectively, “User Content”). User Content and any information contained in the User Content, including personal data you may have included, is stored and collected as part of the Services. We use the User Content to provide you with the Services.
Business representative contact information, including information from a business representative in connection with the performance of the agreement or potential agreement with us. This information may include your first name, last name, company contact information (e.g., email, phone, address), job title, and any other information related to the performance of the agreement with us.
Personal Data from Affiliates and Third Parties.

We also obtain personal data from affiliates and third parties, which we often combine with personal data we collect either automatically or directly from an individual.
Our affiliates. We may receive personal data from other companies and brands owned, operated or controlled by Magellan, or under common ownership with Magellan.
Your employer / company. If you engage in our Services through your employer or company, we may receive information from the company such as name and contact information.
Service providers. Our service providers that perform services solely on our behalf, such as communications providers or analytics providers, collect personal data and may share some or all of this information with us. The information may include contact information, and information about how you use the Services. We may use this information to administer and facilitate our Services.
Social media. When an individual interacts with our Services through various social media networks, such as when someone “Likes” us on Facebook or follows us or shares our content on Google, Facebook, LinkedIn, or other social networks, we may receive some information about individuals that they permit the social network to share with third parties. The data we receive is dependent upon an individual’s privacy settings with the social network. Individuals should always review and, if necessary, adjust their privacy settings on third-party websites and social media networks and services before sharing information and/or linking or connecting them to other services. We use this information to operate, maintain, and provide to you the features and functionality of the Services, as well as to communicate directly with you, such as to send you email messages about products and services that may be of interest to you.
Other sources. In addition to third-party data providers, we may also collect personal data about individuals that we do not otherwise have from, for example, publicly available sources, or through transactions such as mergers and acquisitions. We use this information to operate, maintain, and provide to you the features and functionality of the Services, as well as to communicate directly with you.

Other Uses of Personal Data.

In addition to the above, we may use personal data:

To administer the Services and manage our organization and its day-to-day operations;
To communicate with you and respond to your inquiries (including through the use of automated tools leveraging artificial intelligence);
To respond to your emails, comments, questions, or requests for customer services;
To conduct research and analytics on our customer and end user base and our Services;
To improve and customize our Services to address the needs and interests of our customer base and other individuals we interact with;
Test, enhance, update, and monitor the Services, or diagnose or fix technology problems;
To help maintain the safety, security and integrity of our property and Services, technology assets, and business;
To facilitate corporate business transactions, such as a merger, acquisition, joint venture, or financing or sale of company assets, or in the event of insolvency, bankruptcy, or receivership;
To defend, protect, or enforce our rights or applicable contracts and agreements;
To prevent, investigate, or provide notice of fraud or unlawful or criminal activity;
To comply with legal obligations; and
For any other purpose we may describe when you provide the information.

3. COOKIES AND OTHER DATA COLLECTION TECHNOLOGIES

We, our affiliates, and certain third parties automatically collect information you provide to us and information about how you access and use the Services when you visit our online Services, read our emails, or otherwise engage with us, such as through chat services. We typically collect this information through a variety of tracking technologies, including (i) cookies or small data files that are stored on an individual’s computer and (ii) other, related technologies, such as web beacons, pixels, embedded scripts, location-identifying technologies and logging technologies (collectively, “tracking technologies”), and we may use third parties or technologies to collect this information. Information we collect automatically about you may be combined with other personal data we collect directly from you or receive from other sources.

We, our affiliates, and certain third parties may use cookies and other tracking technologies to automatically collect usage and device information, such as:

Information about the computer, tablet, smartphone, or other device you use, such as your IP address, browser type, Internet service provider, device type/model/manufacturer, operating system, mobile carrier, model and manufacturer, phone number, date and time stamp, and a unique ID that allows us to uniquely identify your browser, mobile device, or your account (including, for example, a persistent device identifier), and other such information. We may also work with third parties to employ technologies, including the application of statistical modeling tools, which permit us to recognize and contact you across multiple devices.
Information about the way you access and use our Services, for example, the site from which you came and the site to which you are going when you leave our services, how frequently you access the Services, whether you open emails or click the links contained in emails, whether you access the Services from multiple devices, and other browsing behavior and actions you take on the Services.
Information about how you use the Services, such as the pages you visit, the links you click, and other similar actions. We may also use third-party tools to collect information you provide to us or information about how you use the Services and may record your mouse movements, scrolling, clicks and keystroke activity on the Services and other browsing, search behavior. These tools may also record information you enter when you interact with our Services or engage in chat features through our Services. We also log certain event data for maintaining quality and tracking errors. The data we collect for these purposes includes server, name of event, time, and user ID.
Information about your location, such as general geographic location that we or our third-party providers may derive from your IP address.
Analytics information, which may be collected using third-party analytics tools such as Google Analytics to help us measure traffic and usage trends for the Services and to understand more about the demographics of our users. You can learn more about Google’s practices at http://www.google.com/policies/privacy/partners and view its opt-out options at https://tools.google.com/dlpage/gaoptout.

All of the information collected automatically through these tools allows us to improve your customer experience. For example, we may use this information to enhance and personalize your user experience, to monitor and improve our Sites and Services, and to improve the effectiveness of our Services, offers, communications, and customer service. We may also use this information to: (a) remember information so that you will not have to re-enter it during your visit or the next time you visit the site; (b) provide custom, personalized content, and information; (c) identify you across multiple devices; (d) provide and monitor the effectiveness of our services; (e) monitor aggregate metrics such as total number of visitors, traffic, usage, and demographic patterns on our website; (f) diagnose or fix technology problems; and (g) otherwise to plan for and enhance our services.

Please note that we link some of the personal data we collect through cookies with the other personal data that we collect about you and for the purposes described above.

For more information about your choices regarding cookies, please see the Your Choices[LINK] section below.

4. Our Disclosure of Personal Data

We may disclose your personal data:

To affiliates. We may disclose personal data between and among Magellan and its current and future parents, affiliates, subsidiaries, and other companies under common control or ownership with Magellan.
To your employer / company. If you interact with our Services through your employer or company, we may disclose your information to your employer or company, including another representative of your employer or company.
To service providers. We may share personal data with third-party service providers that perform business or operational services for us or on our behalf, as needed to carry out their work for us, such as website hosting, communications and webcasting, infrastructure provisioning, IT services, analytics services, and administrative services.
In connection with a business transaction or reorganization. We may take part in or be involved with a corporate business transaction, such as a merger, acquisition, joint venture, or financing or sale of company assets. We may disclose personal data to a third party during negotiation of, in connection with, or as an asset in such a corporate business transaction. Personal data may also be disclosed in the event of insolvency, bankruptcy, or receivership in compliance with applicable law.
In connection with legal obligations and rights. We may disclose personal data to third parties, such as legal advisors and law enforcement:
- in connection with the establishment, exercise, or defense of legal claims;
- to comply with laws or to respond to lawful requests and legal process;
- to protect the rights and property of Magellan, our agents, customers, and others, including to enforce our agreements, policies, and our Terms of Service;
- to detect, suppress, or prevent fraud;
- to reduce credit risk and collect debts owed to us;
- to protect the health and safety of us, our customers, or any person; or
- as otherwise required by applicable law.
With your consent or at your direction. We may disclose personal data about you to certain other third parties with your consent or at your direction, for example, if you choose to post content or share content on social media via the App.

5. YOUR CHOICES

Email Communications. From time to time, we may send you emails regarding updates to our Services and notices about our organization. If you wish to unsubscribe from such emails, simply click the “unsubscribe link” provided at the bottom of the email communication. Note that you cannot unsubscribe from certain services-related email communications (e.g., account verification, confirmations of transactions, technical or legal notices).

Modifying and Deleting your Information. If you have an account with us, you may update your account information and adjust your account settings by logging into your account. Please note that changes to your settings may require some time to take effect. If you have any questions about modifying or updating any information in your account, please contact us at web.notices@magellanlp.com.

Cookies. If you would prefer not to accept cookies, most browsers will allow you to: (i) change your browser settings to notify you when you receive a cookie, which lets you choose whether or not to accept it; (ii) disable existing cookies; or (iii) set your browser to automatically reject cookies. Please note that doing so may negatively impact your experience using our online Services, as some features and services on our online Services may not work properly. Depending on your device and operating system, you may not be able to delete or block all cookies. In addition, if you want to reject cookies across all your browsers and devices, you will need to do so on each browser on each device you actively use. You may also set your email options to prevent the automatic downloading of images that may contain technologies that would allow us to know whether you have accessed our email and performed certain functions with it.

6. LINKS TO THIRD-PARTY WEBSITES AND SERVICES

For your convenience, our Services may provide links to third-party websites or services that we do not own or operate. We are not responsible for the practices employed by any websites or services linked to or from the services, including the information or content contained within them. Your browsing and interaction on any other website or service are subject to the applicable third party’s rules and policies, not ours. If you are using a third-party website or service, you do so at your own risk. We encourage you to review the privacy policies of any site or service before providing any personal data.

7. CHILDREN’S PRIVACY

Our Services are not intended for children under the age of 13. We do not knowingly solicit or collect personal data from children under the age of 13. If we learn that any personal data has been collected inadvertently from a child under 13, we will delete the information as soon as possible. If you believe that we might have collected information from a child under 13, please contact us at web.notices@magellanlp.com.

8. CHANGES TO THIS PRIVACY POLICY

We reserve the right to change this Privacy Policy from time to time at our sole discretion. We will notify you about material changes in the way we treat personal data by sending a notice to the primary email address specified in your Magellan account, by updating the “Last Updated” date at the top of this Privacy Policy, or by placing a prominent notice on our Sites. It is your responsibility to review this Privacy Policy periodically.

9. CONTACT US

If you have any questions regarding this Privacy Policy, please send an email to web.notices@magellanlp.com.

10. Additional CALIFORNIA Privacy Disclosures

These Additional California Privacy Disclosures (“California Privacy Disclosures”) supplement the information contained in our Privacy Policy by providing additional information about our personal data processing practices relating to individual residents of California. For a detailed description of how we collect, use, disclose, and otherwise process personal data in connection with our Services, please visit our Privacy Policy. Unless otherwise expressly stated, all terms defined in our Privacy Policy retain the same meaning in these California Privacy Disclosures. The California Privacy Disclosures set out in this section do not describe our practices when we process Customer Data as a service provider on behalf of our customers in accordance with our contractual agreements with our customers.

Collection and Use of Personal data

In the last 12 months, we may have collected the following categories of personal data:

Identifiers, such as name, email address, telephone number, address, zip code, account username and password, or other similar identifiers.
Personal information, as defined in the California customer records law.
Protected classification characteristics, such as demographic data.
Internet/network information, such as your browsing history, log and analytics data, search history and information regarding your interaction with our website.
Geolocation data, such as information about your physical location collected from geolocation features on your device, including your IP address.
Professional/employment information, such as job title, department, employer, or business.
Other personal data, such as information and content you post to the Services and other information you submit to us, including inquiry and communication information when you contact us.
Inferences, including information generated from your use of the Services reflecting predictions about your interests and preferences.

For more information about our collection of personal data, the sources of personal data, and how we use this information, please see the How We Collect and Use Personal Data section of our Privacy Policy.

DISCLOSURE OF PERSONAL DATA

In the previous 12 months, we may have disclosed all of the categories of personal data we collect with third parties for a business purpose, as described in the Our Disclosure of Personal Data section of our Privacy Policy. The categories of third parties to whom we disclose your personal data for a business purpose may include: (i) other affiliates in our family of companies; (ii) our service providers and advisors; and (iii) your employer / company. With your consent or at your direction, we may also disclose your data (iv) to social media networks and (v) other users of our Services.

No Data Sales: We do not “sell” your personal data for monetary or other valuable consideration; and in the previous 12 months, we have not sold or shared your personal data with third parties for targeted advertising purposes.

Sensitive Information

The following personal data elements we collect may be classified as “sensitive” under certain privacy laws (“sensitive information”):

Account name and password.

As described in our Privacy Policy, we use account name and password to provide certain of our products and services.

We do not sell sensitive information, and we do not process or otherwise share sensitive information for the purpose of targeted advertising.

Deidentified Information

We may at times receive, or process personal data to create, deidentified information that can no longer reasonably be used to infer information about, or otherwise be linked to, a particular individual or household. Where we maintain deidentified information, we will maintain and use the information in deidentified form and not attempt to reidentify the information except as required or permitted by law.

DATA RETENTION

We retain personal data only for as long as is reasonably necessary to fulfill the purpose for which it was collected. However, if necessary, we may retain personal data for longer periods of time, until set retention periods and deadlines expire, for instance where we are required to do so in accordance with legal, tax, and accounting requirements set by a legislature, regulator, or other government authority.

To determine the appropriate duration of the retention of personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of personal data and if we can attain our objectives by other means, as well as our legal, regulatory, tax, accounting, and other applicable obligations.

Therefore, we retain personal data for as long as the individual continues to use our services for the purposes explained in the How We Collect and Use Personal Data section in our Privacy Policy. When an individual discontinues the use of our Services, we will retain their personal data for as long as necessary to comply with our legal obligations, to resolve disputes and defend claims, as well as, for any additional purpose based on the choices they have made, such as to receive marketing communications. In particular, we may retain certain personal data, including the personal data supplied when joining our Services, including complaints and any other personal data supplied during the duration of an individual’s contract with us for the Services until the statutory limitation periods have expired, when this is necessary for the establishment, exercise, or defense of legal claims.

Once retention of the personal data is no longer necessary for the purposes outlined above, we will either delete or deidentify the personal data, or if this is not possible (for example, because personal data has been stored in backup archives), then we will securely store the personal data and isolate it from further processing until deletion or deidentification is possible.

Your Privacy Rights

Depending on your state of residency and subject to certain legal limitations and exceptions, you may be able to exercise some or all of the following rights:

The right to know	The right to confirm whether we are processing personal data about you and to obtain certain personalized details about the personal data we have collected about you, including: The categories of personal data collected; The categories of sources of the personal data; The purposes for which the personal data were collected; The categories of personal data disclosed to third parties (if any), and the categories of recipients to whom this personal data were disclosed; The categories of personal data sold (if any), and the categories of third parties to whom the personal data were sold; and The categories of personal data shared for targeted advertising purposes (if any), and the categories of recipients to whom the personal data were disclosed for these purposes.
The right to access	The right to obtain access to the personal data we have collected about you.
The right to correction	The right to correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of the personal data.
The right to request deletion	The right to request the deletion of personal data that we maintain about you, subject to certain exceptions.
The right to non-discrimination	The right not to receive retaliatory or discriminatory treatment for exercising any of the rights described above. However, please note that if the exercise of the rights described above limits our ability to process personal data (such as in the case of a deletion request), we may no longer be able to provide you our products or services or engage with you in the same manner. In addition, the exercise of the rights described above may result in a different price, rate, or quality level of product or service where that difference is reasonably related to the impact the right has on our relationship or is otherwise permitted by law.

How to Exercise Your Privacy Rights

To Exercise Your Privacy Rights

Please submit a request by:

Filling out our online form; or
Calling 1-877-574-7667.

We will need to verify your identity and confirm you are a resident of a state that offers the request right(s) before processing your request. In order to verify your identity, we will generally either require the successful login to your account or the matching of sufficient information you provide us to the information we maintain about you in our systems. As a result, we require requests to include name, email address, and state of residency. Although we try to limit the personal data collected in connection with a request to exercise any of the above rights, certain requests may require us to obtain additional personal data from you. In certain circumstances, we may decline a request, particularly where we are unable to verify your identity or locate your information in our systems, or where you are not a resident of one of the eligible states.

<Authorized Agents In certain circumstances, you are permitted to use an authorized agent to submit requests on your behalf through the designated methods set forth above where we can verify the authorized agent’s authority to act on your behalf. In order to verify the authorized agent’s authority, we generally require evidence of either (i) a valid power of attorney or (ii) a signed letter containing your name and contact information, the name and contact information of the authorized agent, and a statement of authorization for the request. Depending on the evidence provided and your state of residency, we may still need to separately reach out to you to confirm the authorized agent has permission to act on your behalf and to verify your identity in connection with the request.

Appealing Privacy Rights Decisions

Depending on your state of residency, you may be able to appeal a decision we have made in connection with your privacy rights request. All appeal requests should be submitted by emailing us at web.notices@magellanlp.com with the subject line, “Privacy Request Appeal.”

Minors Under Age 16

We do not sell personal data of consumers we know to be less than 16 years of age unless they have opted in. Please contact us at web.notices@magellanlp.com to inform us if you, or your minor child, are under the age of 16.

If you wish to submit a privacy request on behalf of your minor child in accordance with applicable jurisdictional laws, you must provide sufficient information to allow us to reasonably verify your child is the person about whom we collected personal data and you are authorized to submit the request on your child’s behalf (i.e., you are the child’s legal guardian or authorized representative).