1. INTRODUCTION AND SCOPE

This privacy policy (this "Policy") describes how Holley Performance Products Inc., and its affiliates ("us", "we", or "our") collect, handle, secure, share and use the personal data of users ("Users" or “your”) of www.holley.com, our mobile application(s), any other sites or applications that reference this Policy, as well as other transactions with us, such as in connection with our payment of contingency award claims (the "Services").

Users may provide their personal data directly to us when using the Services – in which case we shall act as a controller of Users' personal data.

To receive this notice in another format (for example, audio, large print, braille) please contact us using the contact details in section 15 below.

In this Policy, as applicable, personal data includes the meaning given to personal information under the Australian Privacy Act.

2. WHAT PERSONAL DATA DO WE PROCESS AND HOW IS IT COLLECTED

The types of personal data we collect will depend on your relationship with us, such as whether you are a Holley customer, website or app user, job applicant, employee (in applicable jurisdictions), or another third party such as an existing or potential business partner.

Users may upload the following types of personal data when using the Services, which we may then collect, use, store and transfer in accordance with this Policy:

The following types of personal data may be automatically logged when Users access and use the Services, which we may then collect, use, store and transfer in accordance with this Policy:

Mobile Applications

As used in this Policy “mobile applications” refers to all applications which are owned or operated by Holley (including but not limited to the Holley Sniper EFI and Dinan PCU mobile application) and are downloaded and/or used on your mobile device(s). Where you provide your consent to use of your personal data when accessing and/or using our mobile application(s), we will handle your personal data in accordance with the practices described in this Policy.

If you sign up and create an account on a mobile application, we may collect and process certain information, which includes but is not limited data listed above. This data may be used, if consent is provided, for marketing purposes as described in this Policy, and we will always respect your preferences including if you choose to withdraw your consent at any time.

When using a Holley mobile application (e.x. Holley Sniper EFI), we may automatically collect certain information, including but not limited to data listed above. All automatic information is collected anonymously and is aggregated to allow Holley to increase the overall user experience.

Cookie Policy

This cookie policy (“Cookie Policy”) explains how we use Cookies when you visit Holley.com or one of our affiliated websites (“Website”) and explains what these Cookies are and why they are used. For clarity, we use cookies, pixel tags, and local objects (collectively referred to in this notice as “Cookies”). We desire to use Cookies to help improve your experience on our Website, and to provide you with services and products that are relevant and important to you. We do not use Cookies to directly identify you, or to attempt to track you on an individualized basis. Any analytics that Holley uses is on an aggregate and de-identified basis.

This Cookie Policy may be updated from time to time in order to reflect, for example, changes to the cookies we use or for other operational, legal, or regulatory reasons. Please visit this Cookie Policy regularly to stay informed about our use of Cookies. The date at the top indicates when the Policy was last updated.

What are Cookies?

Cookies are small data files that are placed on your computer or mobile device when you visit the Website. Cookies are widely used in order to make websites work or to work more efficiently, as well as provide reporting and analytics information.

Cookies set by the Website are called “first-party cookies.” Cookies set by parties other than the Website are called “third-party cookies.” Third-party cookies enable third-party features or functionality to be provided on or through the Website (e.g., advertising, analytics, etc.).

What are the types of Cookies?

• Strictly Necessary Cookies are essential in order to enable you to move around the Website. These are temporary Cookies that last only as long as your web browser or application is open, and are used for technical purposes such as enabling better navigation on the online service. Without these Cookies, services you have asked for cannot be provided. Once you close your browser, the Cookie disappears.
• Performance Cookies are stored on your device for longer periods and are used for various performance purposes including tracking the number of visitors to the online service and information such as the number of views a page gets, how much time a user spends on a page, and other pertinent web statistics. Information here is stored in aggregate form or on a de-identified basis. These Cookies are used exclusively to improve the performance of the Website and its online services, and the user experience.
• Functional Cookies enable the Website to save information which has already been entered (such as user names, language choices, and your location), so that it can offer you improved and more personalized functions. This can also help speed up your interactions with the Website and improve your Website experience. Functional Cookies are also used to enable features you request, such as playing videos.
• Analytics Cookies are used with our web analytics services from third parties. These services use Cookies that operate using information such as IP address, device ID, browser information, geolocation, content viewed, or other similar information for the purpose of analyzing and measuring how visitors use the online services and specific functions and features. The information use and privacy practices of such third parties are described in that third party’s privacy policies and Cookies notices, not this Cookies Notice.
• Marketing Cookies are used to deliver advertisements to you based on your interests and preferences. These Cookies are also used to obtain insights when you have interacted with our online advertisements. Data for advertising or marketing purposes includes information such as IP address, browser type, general location (municipality, not home or street address), date and time of visit, domain type, and activity on the online service. We use and share data from these Cookies with our advertising and marketing partners that enable us to present you with advertising on other sites, or with marketing information, based on your previous interaction with our online service. These Cookies also limit the frequency with which an advertisement appears and measure the effectiveness of advertising campaigns by determining whether you have visited an advertised webpage or our online service. We may permit selected marketing partners to match and identify you using this information.
• We also place Cookies of third parties that track your interactions with our Website and that third party’s website, content, advertisements, website links, and/or other online services. Third-party Cookies are managed by third-party service providers that also provide us with statistical or analytical information and help us provide you with advertisements that we believe would be relevant for you. The information use and privacy practices of such third parties are described in that third party’s privacy policies and Cookies notices, not this Cookies Notice.

Why does the Website use cookies?

The Website uses first- and third-party Cookies for several reasons. As described above, some Cookies are required for technical reasons in order for the Website to operate. Essential cookies are strictly necessary to provide you with services available through the Website and to use some of its features, such as access to your account. Other cookies, such as performance and functionality cookies, are used to enhance the performance and functionality of the Website but are non-essential to their use. However, without these cookies, certain functionality may become unavailable.

We desire to use Cookies to help improve your experience on our Website, and to provide you with services and products that are relevant and important to you. We do not use Cookies to directly identify you, or to attempt to track you on an individualized basis. Any analytics that Holley uses is on an aggregate and de- identified basis.

How can I control cookies?

You can exercise your right to accept or reject certain Cookies by clicking “Your Privacy Rights” at the bottom of the screen when you first visit our Website, and setting your preferences under “Manage Consent Preferences.” This cookie consent manager allows you to select which categories of cookies you accept or reject. Unless otherwise offered on the Website, essential cookies cannot be rejected as they are strictly necessary to provide you with services. At any time, you can update your Cookie preferences online by clicking in the lower left corner “Do Not Sell My Personal Information” icon.

Please note that your Internet browser allows you to change your cookie settings, including deleting and blocking them. These settings are usually found in the “Privacy and Security” or “Preferences” sections of the “Settings” menu of your Internet browser. You can use the “Help” option in your Internet browser for more details.

To opt out of being tracked by Google Analytics across all websites, visit http://tools.google.com/dlpage/gaoptout.

We do not respond to Do Not Track (“DNT”) preferences. However, some third-party sites do keep track of your browsing activities when they serve your content, which enables them to tailor what they present to you. If you are visiting such sites, your browser allows you to set the DNT signal on your browser so that third parties know you do not want to be tracked.

The specific types of first- and third-party cookies served through the Website and the purposes they perform are described in the table below:

How can I control cookies on my browser?

Visit your browser’s help menu for more information on managing cookies, as the process may vary. In addition, most advertising networks offer you a way to opt out of advertising. If you would like to find out more information, please visit the Digital Advertising Alliance.

Contact Us

If you have any questions about our use of Cookies, you may write to us at Holley Performance Products Inc., 2445 Nashville Road, Suite B1, Bowling Green, KY 42101.

Special Categories of Personal Data

We do not collect any special categories of personal data about Users (this includes details about race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences. However, in the case of contingency award claims, we are required in some jurisdictions to collect your Social Security or applicable tax ID number and to obtain a completed Form W-9 or equivalent as applicable. We use this information to process your request, order or award, and to contact you with any questions about your request, order, or award. For security reasons, we do not recommend that you send non-public personal information, such as passwords, social security numbers, or bank account information, etc., to us by email.

Children

The features, programs, promotions and other aspects of our Services requiring the submission of personal data are not intended for children. We do not knowingly collect personally identifiable information from children under the age of 13. If you are a parent or guardian of a child under the age of 13 and believe they have disclosed personal data to us please contact us using the contact details in section 15 below. A parent or guardian of a child under the age of 13 may review and request deletion of such child's personal data as well as prohibit the use thereof.

If you do not provide us with your Personal Data

You may choose not to provide us with your personal information. There are some circumstances where you can deal with us anonymously or use a pseudonym, such as if you are seeking general information about our products or services rather than a customized individual quote. Where we do not have your personal information, or if you have withdrawn consent (when consent is the primary legal basis for handling your information), we may not be able to contact you, process your requests or employment application, or provide our Services to you.

3. HOW WE USE PERSONAL DATA

The above examples are a non-exhaustive overview only of how we may collect and use your personal information, and more detail may be provided to you in a separate privacy notice when you contact us or, where relevant, in a separate contractual arrangement with you.

We may process Users' personal data under more than one lawful basis depending on the specific purpose for which we are using the personal data. If a User has provided consent to processing and subsequently withdraws that consent we may still process that User's personal data where we have another lawful basis for doing so. Where more than one lawful basis has been set out in the table above, Users should contact us if they need details about the specific lawful basis that we are relying on to process their personal data.

Where we need to collect personal data by law or under the terms of a contract that we have with a User and the User fails to provide that personal data when requested, we may not be able to perform the contract it has with the User (for example, to provide access to the Services).

4. SHARING OF PERSONAL DATA

We may share Users' information (including email address or contact information) with the following categories of third parties:

We require all our data processors and any other third party that we provide Users' personal data to respect the security of Users' personal data and to treat it in accordance with applicable law.

We do not allow our data processors to use Users' personal data for their own purposes and only permit them to process Users' personal data for specified purposes and in accordance with our instructions. We do not share your SMS consent with third parties.

5. MARKETING

Users may receive marketing communications from us if they have requested such communications from us or if they have purchased goods or services from us and they have not opted out of receiving future marketing communications.

We will obtain Users' explicit consent before we share their personal data with any company outside of our group of companies for marketing purposes. If a User does not wish to receive marketing information from us, the User can opt-out by contacting us using the contact details in section 15 below or by clicking the opt-out link in our electronic marketing communications.

6. INTERNATIONAL TRANSFERS

Users' personal data collected by us in the United Kingdom (UK) or European Economic Area (EEA) or Australia will not be transferred outside of the UK or the EEA or Australia without additional contractual or other measures that have been adopted or approved by the UK Government or the European Commission (or, in Australia, the Office of the Australian Information Commissioner) being taken.

Some businesses within the Holley group have relationships with other entities overseas. The countries in which these recipients may be located will vary from time to time, but may include the United States. In addition, some businesses in the Holley group may have relationships with overseas service providers to help manage information technology needs. The types of information we disclose depends on your relationship with us.

7. SECURITY OF PERSONAL DATA

We protect personal data from misuse and unauthorized access by using appropriate physical, technical, administrative, and organizational security measures, including (where appropriate):

• the encryption of data during transfer;
• the compartmentalization of data and access control;
• the ability and process of purging data no longer required;
• the ability to ensure the ongoing confidentiality;
• the regular assessing and evaluating of technical and organizational measures;

All of our employees, contractors and data processors who have access to, and are associated with, the processing of personal data in connection with the Services are obligated to keep the personal data confidential and not use it for any other purpose than to carry out the services they are performing for us. While we will use all reasonable efforts to safeguard Users' personal data when you send it to us, you should keep in mind that no internet transmission is ever completely secure or error free, and for this reason we urge all customers and associates to consider carefully what information you provide via our online services as you balance convenience with security (as factors beyond our control include the security of the device you use to communicate with us and steps to protect your login and password). If you reasonably believe that there has been unauthorized use or disclosure of your personal information, please contact us using the contact details in section 15 below.

8. RETENTION OF PERSONAL DATA

We will only retain Users' personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of the personal data, the purposes for which we process the personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Details of retention periods for personal data are available from us on request using the contact details in section 15 below.

9. LEGAL RIGHTS

Users may have the following rights, as data subjects, under applicable data protection laws in relation to their personal data:

To exercise any of the rights set out above, please contact us using the contact details provided in section 15 below. Where the User has any such rights under applicable laws, we will respond to any such rights that a User wants to exercise within forty-five (45) days of receiving the request, unless the request is complex, in which case it may take longer.

We may need to request specific information from a User to help it confirm that User's identity and that User's right to access its personal data (or to exercise any of its other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact the User to ask it for further information in relation to its request to speed up our response.

Please be aware that there are exceptions and exemptions that apply to some of the rights, which we will apply in accordance with the applicable data protection laws.

10. LINKS TO OTHER SITES

Our Services may contain links to other webites to help provide useful information to Users. These sites may require you to input information for their data collection purposes. These sites may have separate privacy and data collection practices, independent of our practices, and Users use and access to such sites is subject to those terms and policies. We have no responsibility or liability for these independent policies or actions and is not responsible for the privacy practice or the content of such websites.

11. ADDITIONAL U.S. STATE PRIVACY DISCLOSURES

Depending on your state of residency, you may be able to exercise additional rights granted by applicable law in relation to the personal information about you that we have collected (subject to certain limitations). For residents of the STATES OF CALIFORNIA, COLORADO, CONNECTICUT, UTAH, NEVADA, AND VIRGINIA, this additional U.S. State Privacy Disclosures (“Disclosures”) supplement the information about our personal information processing practices relating to individual residents of these States. Unless otherwise expressly stated, all terms defined in our Policy retain the same meaning in these Disclosures.

When we use the term “personal information” in these Disclosures, we mean any data or information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular natural person, or any other data or information that constitutes “personal data”, “personal information,” or “personally identifiable information” under applicable privacy and data protection laws. Personal information does not include:

• Publicly available information from government records.
• Deidentified or aggregated consumer information.
• Information excluded from applicable privacy and data protection laws’ scope, like:
• Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the California Confidentiality of Medical Information Act (“CMIA”), clinical trial data, or other qualifying research data.
• Personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (“FCRA”), the Gramm-Leach-Bliley Act (“GLBA”) or California Financial Information Privacy Act (“FIPA”), and the Driver’s Privacy Protection Act of 1994.

In particular, we have collected the following categories of personal information from consumers within the last twelve (12) months:

The features, programs, promotions, and other aspects of our services requiring the submission of personally identifiable information are not intended for children. We do not knowingly collect personally identifiable information from children under the age of 16. If you are a parent or guardian of a child under the age of 16 and believe they have disclosed personally identifiable information to us, please contact us at the address set forth below in section 15. A parent or guardian of a child under the age of 16 may review and request deletion of such child's personally identifiable information as well as prohibit the use thereof.

Use of Personal Information

We do not sell your personal information. We may use or disclose the personal information we collect for the purposes listed in the chart above. We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without first providing you notice.

Sharing Personal Information

We may disclose and have disclosed in the past twelve (12) months personal information to third parties for business purposes as set forth in the chart above. We only make these business purpose disclosures under written contracts that describe the purposes, require the recipient to keep the personal information confidential, and prohibit using the disclosed information for any purpose except for performing the contract. In the preceding twelve (12) months, we have not sold personal information. We may share information with third parties for the purpose of cross-context behavioral advertising. For opt-out options, please see the Your Privacy Choices portion below.

Data Retention

We will retain your personal information for no longer than is necessary for the purposes stated in this Policy unless otherwise extending the retention period is required or permitted by law or subject to our retention policies as may be in place from time to time. This data storage period may vary with scenario, product, and service. The standards we use to determine the retention period are as follows:

• The time required to retain personal data to fulfill business purposes, including providing products/services;
• Maintaining corresponding transaction/business records;
• Handling possible consumer queries or complaints and locating problems;
• Whether the consumer agrees to a longer retention period; and
• Whether the law, contracts, or other equivalencies have special requirements for data retention.

Your Privacy Choices

Depending on your state of residency, you may be able to exercise the following rights in relation to the personal information about you that we have collected (subject to certain limitations at law):

Right to Limit Use and Disclosure of Sensitive Personal Information

The only sensitive personal information we affirmatively collect from you is necessary to perform the services or provide the goods you requested. We may also periodically receive unsolicited information from you that includes sensitive personal information; we make no further use or disclosure of that unsolicited sensitive personal information. If you have questions about sensitive personal information, please see Exercising Limitation, Rectification, Data Portability, and Deletion Rights to contact us.

Right to Opt-Out of Personal Information Sharing

You will be opted in by default to the sharing of personal information as defined under the applicable privacy and data protection laws. You can opt out of the sharing of personal information at any time by clicking on this link (for account holders): https://www.holley.com/account/edit/. Please note, we do not track users across devices, so you will have to opt out from each device where you access our website or services.

Access to Specific Information and Data Portability Rights

You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request, we will disclose to you the following:

• The categories of personal information we collected about you.
• The categories of sources of the personal information we collected about you.
• Our business or commercial purpose for collecting that personal information.
• The categories of third parties with whom we share that personal information.
• The specific pieces of personal information we collected about you (also called a data portability request).
• If we disclosed your personal information for a business purpose, a list of the disclosures made identifying the personal information categories that each category of recipient obtained.

Correct/Rectify Personal Information

You have the right to rectify (correct, update, or modify) the personal information we collect about you. After making such a request, we will take commercially reasonable efforts to correct inaccurate personal information within 45 days of receiving the request. In the event an extension is needed, we may take an additional 45 days when reasonably necessary. In this case, we will provide you with a notice of extension within the first 45-day period.

Deletion Request Rights

You have the right to request that we delete any of your personal information that we have collected from you and retained, subject to certain exceptions. Once we receive your verifiable consumer request, we will delete (and direct our service providers/contractors/other third parties to delete) your personal information from our records unless an exception applies.

We may deny your deletion request if retaining the information is necessary for us, our service providers, contractors, or other third parties to:

• Complete the transaction for which we collected the personal information, provide a good/service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
• Debug products to identify and repair errors that impair existing intended functionality.
• Exercise free speech, ensure the right of another consumer to exercise their free speech rights or exercise another right provided for by law.
• Comply with other applicable privacy and data protection laws.
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, specifically if you previously provided informed consent and deleting that information may seriously impair or render impossible the research’s achievement.
• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
• Comply with a legal obligation.
• Make other internal and lawful uses of personal information that are compatible with the context in which you provided it.

Exercising Limitation, opt-out Rectification, Data Portability, and Deletion Rights

To exercise limitation, opt-out, access, rectification, data portability, and deletion rights described above, please submit a verifiable consumer request to us by:

• Email Address: [email protected]
• Accessing the following link (account holders): https://www.holley.com/account/edit/

Only you or a person authorized to act on your behalf may make a verifiable consumer request related to your personal information.

You may only make a verifiable consumer request for access or data portability twice within a 12-month period, unless allowed otherwise by applicable privacy and data protection law. The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to request and confirm the personal information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use personal information in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

Response Timing and Format

We will try our best to respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to 45 days), we will inform you of the reason and extension period in writing. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. Any disclosures will only cover the 12-month period preceding the receipt of the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another and allow you to further transmit information if you desire.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Non-Discrimination

We will not discriminate against you for exercising your applicable data privacy rights. Based solely on the exercise of your applicable data privacy rights, we will not:

• Deny you goods or services;
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits or imposing penalties;
• Provide you with a different level or quality of goods or services; or
• Suggest that you may receive a different price or rate for goods or services or a different level of quality of goods or services.

However, we may offer you certain financial incentives permitted by applicable data privacy rights that can result in different prices, rates, or quality levels. Any applicable data privacy rights-permitted financial incentive we offer will reasonably relate to your personal information’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior opt-in consent, which you may revoke at any time.

12. NON-U.S. USERS

You acknowledge that we are principally located in the United States and, accordingly, your information may be transferred to, processed, analyzed, and stored in the United States. If you are located outside of the United States, the information you provide to us may be transferred to the United States whose laws may not provide the same level of protection for your personal information as your home country.

In case you wish to verify which personal data is stored on your behalf, have it modified, corrected, or deleted please contact us using the contact details in section 15 below, and explicitly describe your request. You may also contact us at the aforesaid email address and advise us not to use the information you shared with us. By using our Website you consent to the adjudication of any disputes in the federal courts of, and in accordance with the laws of, the State of Kentucky.

13. SSL CERTIFICATES

All event registration and order information is transmitted via Secure Socket Layer (SSL) technology and is encrypted by the software before the information is sent across the Internet. Network Solutions has certified holley.com is a secure network for e-commerce transactions. Please be sure that your browser is SSL- enabled. In order to view our website the way it was intended we recommend that you use the latest internet browsers to avoid rendering issues. For optimum security you should always upgrade your browser software to the latest version.

14. YOUTUBE VIDEOS

Our website contains YouTube videos. These sites may have separate privacy and data collection practices, independent of our practices. Please see the YouTube Terms of Service and refer to Google's Privacy Policy. Users use and access to such videos is subject to those terms and policies.

15. HOW TO CONTACT US

To ask any questions regarding this Policy or to exercise any rights including to make a privacy complaint (and under applicable privacy laws you may have rights of access to and correction of your personal information) or to manage your communication preferences, please contact us using the following contact details:

Address: 2445 Nashville Road, Suite B1, Bowling Green, KY 42101

Telephone: +1 (866) 464-6553

Email: [email protected]

We will respond to your request for access to personal information we hold about you within the timeframes required by applicable laws and/or as soon as we reasonably can, including notifying you if we are unable to provide access (such as when we no longer hold the information) or if we are permitted by applicable law to refuse access.

Generally, we do not impose any charge for a request for access, but where permitted to do so by applicable law, we may charge you a reasonable fee for the retrieval costs associated with providing you with access.

You must keep us informed of any changes to your information, like your contact details or address, to ensure your details remain up-to-date.

For complaints about privacy, we will establish in consultation with you a reasonable process for seeking to resolve your complaint, including time frames provided by applicable laws.

16. AMENDMENTS TO THIS POLICY

We reserve the right to change, modify, add or remove portions of this Policy from time to time and in our sole discretion but will update Users that changes have been made by indicating on this Policy the date it was last updated. Your continued use of our Website following the posting of changes constitutes your acceptance of such changes.