Phillips 66 Workforce Identity Verification – Notice at Collection

Index

Last Updated:  June 5, 2026

This Phillips 66 Workforce Identity Verification – Notice at Collection (“Notice”) applies to employees, contractors, and other workforce members of a company or companies within the Phillips 66 group of companies (“Phillips 66,” “we,” “us,” “our”) who are asked to complete an identity verification process when contacting the Phillips 66 IT Service Desk for certain high-risk account requests.

This Notice supplements our Phillips 66 Personal Data Privacy Policy, available in the Phillips 66 Policy Center for authorized workforce members and does not apply to personal data processed through other Phillips 66 services, websites, or employment processes. For those, please refer to the Phillips 66 Privacy Statement.

In response to increasingly sophisticated attacks targeting information technology systems and, given the critical sector in which Phillips 66 operates, we are strengthening verification requirements for permission and password changes that may be vulnerable to such attacks.

Phillips 66 uses Trusona, a third-party identity verification service provider, to support this process and you may see Trusona referenced in verification messages or screens.

What Personal Data We Collect and Process

When you complete the identity verification process, Phillips 66 and our service providers may collect and process the following categories of personal data for identity verification:

  • Workforce identifiers and contact information (e.g., name, email address, phone number). 
  • Government-issued identity document information (e.g., driver’s license, state ID, passport, national ID), including information encoded in a machine-readable zone or barcode where applicable.
  • Geolocation data (such as precise or near-precise location from device/network signals during the identity verification session). 
  • Identity attributes from the document (e.g., date of birth, age, and sex/gender as encoded in your identity document or where shown). 
  • Device, network and session information (e.g., IP address, device/browser information, and other security signals). 
  • Verification results (e.g., pass/fail outcome and a transaction/reference number).

California residents: Under California law, some of the information above may be considered Sensitive Personal Information, such as government ID numbers and precise geolocation.

How We Use Your Personal Data

We  process the personal data described above for the following purposes:

  • To confirm your identity before completing certain high-risk account recovery actions (for example, password resets, MFA re-enrollment, and account unlocks) to prevent unauthorized access to Phillips 66 systems and accounts.
  • To validate identity attributes using verification sources/providers where available. At this time, authoritative verification against issuing authority records is only available for U.S. driver’s licenses via the American Association of Motor Vehicle Administrators (AAMVA) network. For non-U.S. IDs, verification relies on document integrity checks and other fraud signals, and this Notice may be updated if verification sources are added in the future.
  • To assess the integrity of the identity document and verification session, including detecting indicators of manipulation or spoofing (for example, whether an ID image appears altered or captured from a screen rather than a physical document) and validating machine-readable information where applicable.
  • To detect fraud signals where available, including indicators that a verification session may be compromised (for example, SIM-swap/number-integrity signals where supported by Mobile Network Operators in some countries).
  • To maintain an audit record of identity verification transactions, as required by applicable cybersecurity regulations and Phillips 66’s internal security policies.
  • To comply with legal obligations, including access control requirements under applicable cybersecurity laws and regulations.

UK/Germany lawful basis: For workforce members in the United Kingdom and Germany, we process this personal data where necessary based on our legitimate interests in securing workforce accounts, preventing fraud and unauthorized access, and protecting Phillips 66 systems, data, and operations. This supports Phillips 66’s security compliance obligations relating to cybersecurity, access control, and information security, particularly where traditional challenge questions are no longer adequate. If you do not have government-issued identification available, or prefer not to provide it, an alternative verification method will be made available.

Singapore residents: We provide this Notice to meet Personal Data Protection Act (PDPA) notification requirements, and we process personal data for account security and fraud prevention under applicable PDPA bases, including the legitimate interests exception where relevant.

India residents: If you choose to proceed, you voluntarily provide your personal data (including government ID information) for the purpose of identity verification and fraud prevention in connection with your IT Service Desk request. If you do not want to proceed, you may stop and request an alternate verification method. The IT Service Desk may not be able to complete certain high-risk account recovery actions until identity is verified.

Who We Share Your Personal Data With

Phillips 66 shares the personal data processed during identity verification with the following categories of entities, but only to the extent necessary for the purposes described above:

  • Service providers (for example, Trusona) that perform identity verification and fraud prevention services on our behalf. 
  • Mobile Network Operators (MNOs) and related verification providers used by our service providers, where phone-based verification signals are used (for example, to reduce fraud risk). 
  • Verification sources/providers, where needed to validate identity attributes associated with government-issued IDs (for example, U.S. issuing authority verification services via AAMVA).

Where personal data is transferred internationally, Phillips 66 applies appropriate safeguards required by applicable law. Additional information is available in the Phillips 66 Personal Data Privacy Policy and applicable country Addendum.

Phillips 66 does not “sell” or “share” personal data for cross-context behavioral advertising as part of the identity verification process.

How Long We Keep Your Personal Data

We retain personal data processed in accordance with this Notice for only as long as reasonably necessary for the purposes described herein, including: to complete the identity verification process; respond to the relevant IT Service Desk request; detect and investigate suspected fraud or security incidents and maintain required audit and security records (for example, identity verification outcomes, transaction references, and related Service Desk logs). 

The retention period may vary depending on the type of data and applicable legal, regulatory, security, and records management requirements. Verification records and audit logs are retained in accordance with Phillips 66 records retention requirements, after which they are securely deleted, anonymized or archived as permitted by applicable law.

For more information about how Phillips 66 handles personal data retention across its operations, please see the Personal Data Privacy Policy and the applicable Country Addendum.

Security Measures

Phillips 66 uses technical, administrative, and procedural safeguards to protect personal data processed under this Notice. These safeguards may include encryption in transit and at rest, access controls based on least privilege, and security monitoring and logging. We also require our service providers to maintain appropriate safeguards and contractual protections consistent with applicable data protection laws and Phillips 66 security requirements. No security measure is perfect, but we take reasonable steps to help protect personal data from unauthorized access, use, or disclosure.

Your Privacy Rights

Depending on the country and state where you reside, you may have rights with respect to the personal data we process in accordance with this Notice. These rights may include the right to know what personal data we have processed about you, the right to request correction of inaccurate personal data, and the right to request deletion of your personal data, subject to applicable exceptions.

California residents: Additional rights are described in the Phillips 66 California Privacy Statement, including the right to know the specific pieces of personal data collected, the right to opt out of the sale or sharing of personal data, and the right to non-discrimination for exercising your privacy rights. Phillips 66 does not sell or share personal information for cross-context behavioral advertising as part of this identity verification process. To exercise any of your rights directly or through the use of an authorized agent, you may submit a request through our webform or call us at 1.800.527.5476.

Canada residents: Your personal data may be processed by our service providers in the United States for identity verification and fraud prevention. To request information about these cross-border processing arrangements, please contact us at privacy@p66.com. 

UK residents: You have the right to access, correct, and in some cases to request erasure of, restrict or object to the processing of your personal data (including processing based on legitimate interests). You may lodge a complaint with us directly and lodge a complaint with the Information Commissioner’s Office (ICO) if you are unhappy with our response.

Germany residents: You have the right to access, rectify, erase, restrict, and port your personal data, and to object to processing. For employees of Phillips 66 based in Hamburg, the competent supervisory authority is the Hamburg Commissioner for Data Protection and Freedom of Information (Hamburgischer Beauftragter für Datenschutz und Informationssicherheit).

Singapore residents: You may request access to and correction of personal data we hold, subject to applicable PDPA exceptions.

India residents: You may request access to information about your personal data and request correction or erasure, subject to applicable law. You may also raise a grievance by contacting privacy@p66.com. 

For more information, please see our Phillips 66 Personal Data Privacy Policy together with applicable country Addendum, available in the Phillips 66 Policy Center.

Contact Us

If you have questions regarding this Notice or our processing of personal data, you may contact us at phillips66.com/contact.

UK residents: If you have any questions or complaints about this Notice or the processing of your personal data, please contact us at InformationManagementUK@p66.com. 

Germany residents: If you have any questions about the collection, processing, archiving, or transmission of your personal data, or wish to exercise your rights to information, correction, restriction, or deletion of data, as well as objection to a specific use of data, you may contact the Data Protection Officer directly at  datenschutz@p66.com.

Singapore residents: If you have any questions about this Notice or the use of your personal data, please contact the Singapore Data Protection Officers at dpo@p66.com.