Purpose – To provide you as an Aera Energy LLC (“Aera”) employee, job applicant, royalty owner, individual who is associated with a vendor, newsletter subscriber or community stakeholder for Aera, a California resident (“Covered Individuals”), with a comprehensive description of our online and offline practices regarding the collection, use, sale, sharing, and retention of your Personal Information; and to inform you about the rights you have regarding your Personal Information and provide information necessary for you to exercise those rights. You can exercise your rights through (1) this link to our Privacy Portal, which includes instructions for making a request, the process we use to verify the request made by you and a contact for questions or concerns about this policy or (2) calling (661) 665-5000 and asking to make a privacy data request or “DSAR” request. If you are an employee, you can also exercise your rights through Success Factors, by clicking on the link on the “Privacy Statement” tab. A. The Personal Information We Collect We may collect the following categories of Personal Information about you:

Identifiers, which include first and last name; home or other mailing or billing addresses; email address; telephone numbers; driver’s license information; emergency contact details; social security number; bank account information; government-issued identification number and related information; photographic images; personnel number; and other account or user identification information

Professional or employment-related information, which includes salary; benefits and entitlement data; bonus amounts; bonus payments; business unit/division; company/entity; compensation data; employment contract information; disciplinary action; start date, end date, and reason for termination; expense details; hours of work; job application details; job title/role; line/reporting manager; office location; performance rating; previous work history; professional memberships; information about references or background check references; salary/wage information; travel booking details and travel history; employee identification number; access permissions; and workers compensation claim information

Education information, which includes academic transcripts; education and training history; educational degrees; grades; languages; and qualifications/certifications

Information relating to Internet activity or other electronic network activity, which includes cookie identifiers; tracking pixels containing an ID number; online tracking technology; browser software; your computer’s operating system; the website that referred you to our site; the browser and operating system used to reach our site;  the date/time stamp; clickstream data; and device platform, version, and other device characteristics which may include settings such as Wi-Fi, Bluetooth, and Global Positioning System (“GPS”)

Geolocation data, which includes GPS data; locational information based upon your IP address; cell network data; and other similar locational data which may be collected from various devices including your mobile device(s)

Audio, electronic, or visual information, which includes records of voicemails; video monitoring information; and facilities physical access records

Information not listed above and related to characteristics protected under California or federal law, which includes your age/date of birth, hire and death; children’s and dependents’ names; criminal history; criminal records; drug test results; gender; marital status; nationality; racial or ethnic origin; veteran status; disability status; marital status; and trade union membership

Sensitive Personal Information, which covers items listed in the definition below, including social security number, government identification numbers, financial account numbers, precise geolocation, and sensitive demographic information

Other Personal Information not listed above and described in California Civil Code § 1798.80(e), which includes medical and health insurance information

  B. Where We Get Your Personal Information. We may get your Personal Information from:

You when you join or apply to join us as an employee

You when you obtain and use Aera benefits for yourself and family members

You when you use our systems to record time, provide work history and professional organization data, provide educational data, create expense reports, update Personal Information and use our electronic systems and tools

You when you participate in employee resource groups or our employees’ political action committee

Your references

You and others when complaints are lodged with us

Providers of background check information

Employment actions that generate it, including payroll, performance evaluation, disciplinary action, time logging, tax records, work history, work location records, safety and site monitoring, investigations and litigation activity and internal communications that are part of conducting our business

You when you provide us information to facilitate payments as a royalty owner with claims for payment from us and for related communications

You when you become a vendor in connection with claims for payment from us and for related communications

You when you sign up to receive communications from us through our newsletter or as a stakeholder

  C. What We Do With Your Personal Information We do not sell or share your Personal Information.  We may collect or use your Personal Information for the following purposes:

Administering payroll and benefits

Consideration for employment (including screenings, interviews, and background checks)

To operate, maintain and secure information technology systems

Legal compliance, risk management and audits

Protecting legal rights, safety, privacy, and property of us and others

Fulfilling tax and other government filing requirements

Training

Workforce communications

Workforce management (e.g., performance reviews; evaluations; internal investigations)

Administering employee groups (e.g. employee resource groups and our employees’ political action committee)

Taking other actions to which you consent

Updating your Personal Information

  We may collect or use your Sensitive Personal Information for any of the purposes listed above. We may disclose any of the collected Personal Information, including Sensitive Personal Information, to third parties for business purposes, in each case for the purposes described above.  The categories of third parties to whom we disclose your Personal Information include:

Third Party Categories	Type of Personal Information Provided
	Identifier	Employment/ Professional	Education	Internet	Geolocation	Audio/Visual Electronic	Protected	Sensitive	Other
Benefits service providers	•	•					•	•
IT and systems service providers		•		•	•	•		•
Professional services providers and business consultants	•	•	•	•	•	•	•	•	•
Training service providers				•	•
Employment service providers including background and drug testing services	•	•					•	•
Charitable Giving service providers	•	•		•
Community Engagement organizations and Trade organizations	•	•		•
Government services	•	•	•		•		•	•
Corporate Owners	•	•		•		•		•

  We do not use or disclose Sensitive Personal Information for purposes other than to perform the services you would reasonably expect, such as the actions discussed above regarding what we do with your Personal Information, including to:

• Detect security incidents,
• Resist malicious, deceptive, fraudulent, or illegal actions directed at us,
• Ensure safety of people, and
• for short-term, transient uses,

in each case as reasonably necessary and proportionate to the use. D. How Long We Keep Your Personal Information Except as otherwise permitted or required by applicable law or regulation, we will only retain your Personal Information for as long as necessary to fulfill the purposes we collected it for, as required to satisfy any legal, accounting, or reporting obligations, or as necessary to resolve disputes. To determine the appropriate retention period for Personal Information, we consider applicable legal requirements, the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your Personal Information, and whether we can achieve those purposes through other reasonable means. We will specify the retention periods for your Personal Information in our data retention policies. Under some circumstances we may anonymize your Personal Information so that it can no longer be associated with you. We reserve the right to use such anonymous and de-identified information for any legitimate business purpose without further notice to you or your consent. Once you are no longer a Covered Individual, we will retain and securely destroy your Personal Information in accordance with our data retention policies and applicable laws and regulations. E. What Rights Do You Have Regarding Your Personal Information You have the right:

• to request to know what Personal Information we have collected about you, including:
  • the categories of Personal Information collected,
  • the categories of sources from which the Personal Information is collected,
  • the business or commercial purpose for collecting, selling, or sharing Personal Information,
  • the categories of third parties to whom we disclose Personal Information,
  • how long we intend to retain each category of Personal Information or the criteria used to determine that period, and
  • the specific pieces of Personal Information we have collected, each of which is set forth above;
• to request us to delete Personal Information that we have collected from you, subject to certain exceptions permitted by law;
• to request us to correct inaccurate Personal Information that we maintain about you;
• to receive non-discriminatory treatment by us for the exercise of privacy rights conferred by law, including your right not to be retaliated against for exercise of legal rights.
• to opt-out of the sale or sharing of your Personal Information.  However, we do not sell or share your Personal Information.
• to request us to limit the use or disclosure of your Sensitive Personal Information to those uses necessary for us to provide goods or services to you as permitted by law. We will not use or disclose your Sensitive Personal Information after you have exercised any right you may have to limit such use or disclosure, unless you subsequently provide consent for the use of your Sensitive Personal Information for additional purposes.

You can exercise your rights through (1) this link to our Privacy Portal, which includes instructions for making a request, the process we use to verify the request made by you and a contact for questions or concerns about this policy or (2) calling (661) 665-5000 and asking to make a privacy data request or “DSAR” request. If you are an employee, you can also exercise your rights through Success Factors, by clicking on the link on the “Privacy Statement” tab. Any request you submit to us is subject to an identification and residency verification process (“Verifiable Consumer Request”) as permitted by California Privacy Law. We will not fulfill your request unless you have provided sufficient information that enables us to reasonably verify that you are the Covered Individual about whom we collected the Personal Information. To verify your status, you must provide us with first name, last name, email address and such other information as we may request. These rights are also subject to various exclusions and exceptions under applicable laws. You may also designate an authorized agent, in writing or through a power of attorney, to request to exercise the above rights on your behalf.  If you should use an authorized agent to exercise your various rights under California Privacy Law, we may require that you provide your authorized agent with written permission to exercise your various rights and to verify your own identity with us. If your agent does not submit proof that they have been authorized by you to submit verified requests for disclosure and deletion, we reserve the right to deny such a request that we have received and will explain to your agent why we have denied such request. Your authorized agent may submit a request to exercise these rights by submitting the letter of authorization or power of attorney to this link. We currently do not collect household data. If we receive a request submitted by all members of a household, we will individually respond to each request. We will not be able to comply with any request by a member of a household under the age of 13, as we do not collect Personal Information from any person under the age of 13. We will respond to your request within forty-five (45) days after receipt of a Verifiable Consumer Request not more than twice in a twelve (12) month period. We reserve the right to extend the response time by an additional forty-five (45) days when reasonably necessary and provided consumer notification of the extension is made within the first forty-five (45) days. Definitions Terms that are used in this Privacy Statement that are defined in California Privacy Law have the meanings given to them in the California Privacy Law. “California Privacy Law” means the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020, as amended from time to time. “Personal Information” is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a Covered Individual or their household. Personal information does not include publicly available information or information that has been de-identified. “Publicly available” means information that is lawfully made available from federal, state, or local government records. “Publicly available” does not mean biometric information collected by a business about a Covered Individual without their knowledge. “Sensitive Personal Information” is information that reveals a Covered Individual’s:

• social security, driver’s license, state identification card, or passport number.
• account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
• precise geolocation.
• racial or ethnic origin, religious or philosophical beliefs, or union membership.
• mail, email, and text message content unless we are the intended recipient of the communication.
• genetic data.
• biometric information uniquely identifying the Covered Individual.
• health data.
• sex life or sexual orientation information.

“sell” includes selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means a consumer’s personal information for monetary or other valuable consideration. “share” is to disclose Personal Information of a Covered Individual to a third party “for cross-contextual behavioral advertising,” which is not part of Aera’s business model and consists of interest-based advertising or retargeted advertising based on Personal Information from a Covered Individual’s interactions with Aera. Contact Information You can contact us by writing to Aera Energy at 10000 Ming Avenue, Bakersfield, CA 93311-1302 or calling (661) 665-5000.