Protecting your private information is our priority. This Statement of Privacy applies to derbyenergy.ogp2.connect2vna.com and Derby Energy, LLC (including all of it’s subsidiaries and affiliates) and governs data collection and usage. For the purposes of this Privacy Policy, unless otherwise noted, all references to Derby Energy, LLC include derbyenergy.ogp2.connect2vna.com and Derby. The Derby web portal is an informational and business web portal. By using the Derby web portal, you consent to the data practices described in this statement.

Collection of your Personal Information
In order to better provide you with products and services offered on our portal, Derby may collect personally identifiable information, such as your:

• First and Last Name
• Mailing Address
• E-mail Address
• Phone Number
• Social Security Number
• Bank Account Number

If you use the Derby web portal to make payments, we collect billing and credit card information. This information is used to complete the financial transaction.

We do not collect any personal information about you unless you voluntarily provide it to us. However, you may be required to provide certain personal information to us when you elect to use certain services available on the portal. These may include: (a) registering for an account on our Site; (b) sending us an email message; (c) submitting your credit card or other payment information when using business services on the owner portal. We will use your information for, but not limited to, communicating with you in relation to services you have requested from us. We also may gather additional personal or non-personal information in the future.

Use of your Personal Information
Derby collects and uses your personal information to operate its owner portal and deliver the services you have requested.

Derby may also use your personally identifiable information to inform you of other products or services available from Derby and its affiliates.

Automatically Collected Information
Information about your computer hardware and software may be automatically collected by Derby. This information can include: your IP address, browser type, domain names, access times and referring website addresses. This information is used for the operation of the service, to maintain quality of the service, and to provide general statistics regarding use of the Derby web portal.

Links
This web portal contains links to other sites. Please be aware that we are not responsible for the content or privacy practices of such other sites. We encourage our users to be aware when they leave our site and to read the privacy statements of any other site that collects personally identifiable information.

Security of your Personal Information
Derby secures your personal information from unauthorized access, use, or disclosure. Derby uses the following methods for this purpose:

• SSL Protocol
• Secure Unique Password Login
• SOC 1/ISAE 3402, SOC 2, SOC 3
• FISMA, DIACAP, and FedRAMP
• PCI DSS Level 1
• ISO 9001, ISO 27001, ISO 27017, ISO 27018

When personal information (such as a credit card) is transmitted, it is protected through the use of encryption, such as the Secure Sockets Layer (SSL) protocol.

We strive to take appropriate security measures to protect against unauthorized access to or alteration of your personal information. Unfortunately, no data transmission over the Internet or any wireless network can be guaranteed to be 100% secure. As a result, while we strive to protect your personal information, you acknowledge that: (a) there are security and privacy limitations inherent to the Internet which are beyond our control; and (b) security, integrity, and privacy of any and all information and data exchanged between you and us through this Site cannot be guaranteed.

Children Under Thirteen
Derby does not knowingly collect personally identifiable information from children under the age of thirteen. If you are under the age of thirteen, you must ask your parent or guardian for permission to use this web portal.

E-mail Communications
From time to time, Derby may contact you via email for the purpose of providing announcements, alerts, confirmations, surveys, and/or other general communication. In order to improve our Services, we may receive a notification when you open an email from Derby or click on a link therein.

If you would like to stop receiving marketing or promotional communications via email from Derby, you may opt out of such communications by Stakeholders may unsubscribe from emails by "replying STOP" or "clicking on the UNSUBSCRIBE button.".

External Data Storage Sites
We may store your data on secure servers provided by third party hosting vendors with whom we have contracted.

Changes to this Statement
Derby reserves the right to change this Privacy Policy from time to time. We will notify you about significant changes in the way we treat personal information by sending a notice to the primary email address specified in your account, by placing a prominent notice on our site, and/or by updating any privacy information on this page. Your continued use of the Site and/or Services available through this Site after such modifications will constitute your: (a) acknowledgment of the modified Privacy Policy; and (b) agreement to abide and be bound by that Policy.

Contact Information
Derby welcomes your questions or comments regarding this Statement of Privacy. If you believe that Derby has not adhered to this Statement, please contact Derby at:

Derby Energy, LLC

Attention: Owner Relations Portal

100 Park Ave., Suite 400

Oklahoma City, OK 73102

email: ownerrelations@derbyenergy.com

PH. 405-639-3786 | Fax 405-639-3793

Effective as of March 01, 2020