Privacy Statement Arkham Technologies INC.

I.PURPOSE

This Privacy Statement has been prepared by ARKHAM TECHNOLOGIES INC., (hereinafter referred to as "Arkham”) with address at 255 Giralda Ave Floor 5, Coral Gables, FL, 33134, with the purpose of explaining the methods, means, and purposes it applies within its organization to collect, use, and/or share information and/or personal data of its customers. This is done in its capacity as the data controller, processor, and/or authorized third party. This applies when customers visit their website, purchase their products and/or services, or simply request information.

The creation of this Privacy Statement aims to ensure that the processing of information and/or personal data carried out by Arkham is fully compliant with and adheres to the General Data Protection Regulation (EU Regulation 2016/679, the "GDPR") and the California Consumer Privacy Act of 2018 (the "CCPA"), as well as best privacy practices. This is done with the goal of consistently demonstrating the following (proactive responsibility):

Compliance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity, and confidentiality.

II.SCOPE AND APPLICATION.

Arkham places the respect of its customers' privacy at the core and therefore commits to protect it through the effective implementation of this Privacy Statement.

This Privacy Statement is mandatory for all processes involving the processing of information and/or personal data carried out by the organization. This covers the entire process from the point of collection, usage, and exploitation to deletion or retention as applicable. This always guarantees legitimate and informed processing by Arkham

It is important to specify that this Privacy Statement does not apply to any information that may be obtained from third-party websites and/or applications (including advertisements) that are accessible from the Arkham website. Therefore, Arkham is not responsible for the policies and practices of third parties, and it is recommended to review the privacy policies of each website and/or application visited.

It is essential that Arkham’s customers, before visiting their website, purchasing their products and/or services, or simply requesting information, become acquainted with this Privacy Statement to understand how Arkham will handle it. This includes the information and/or personal data that will be collected, how it will be used and/or transferred, etc.

Should the customer visit the website, purchase their products and/or services, or simply request information (regardless of the contact method), it will be considered that they agree to this Privacy Statement and accept its terms and conditions.

Arkham reserves the right to make changes and/or modifications to this Privacy Statement; therefore, it is recommended that customers review it periodically.

III. INFORMATION COLLECTED BY ARKHAM.

The information and/or personal data that Arkham may process from its customers originates from the situations described below:

1. Directly from customers who contract any of the products and/or services offered by Arkham, solely for the interest and/or benefit of the customers themselves and/or the organization they represent. These include the following:

a) Identifiers: full names, email addresses, addresses, phone numbers, dates of birth, IP addresses.
b) Confidential information: Payment information, billing details (invoice number, date of service rendered, date of sending invoice, contact name and tax ID of seller, name, contact, tax ID of buyer, description of each product or service, cost per unit of product, tax rates, total amount owed with currency), financial information, and official identifications.

Legal Basis for Processing: The processing of this data is essential for (i) the execution and/or fulfillment of contractual and/or legal obligations that Arkham enters into with its customers, as well as to provide the contracted services and/or products, (ii) to comply with legal obligations by Arkham, and (iii) to satisfy legitimate interests pursued by Arkham as long as the rights and freedoms of its customers are not affected.

2. From the browsing on websites that customers and/or interested individuals in the products and/or services offered by Arkham may perform; through the use of standard automated collection tools such as "cookies, web beacons, tracking pixels, tags," and other tools. This information demonstrates how our website is used and how interactions occur with Arkham.

Legal Basis for Processing: The processing of this data is essential for the satisfaction of legitimate interests pursued by Arkham as long as the rights and freedoms of its customers are not affected.

Arkham does not process special categories of personal data from its customers.

Arkham does not process personal data of children under 18 years of age under any circumstances. In case Arkham mistakenly collects personal data of minors under 18 years of age, immediate steps will be taken for its deletion. If anyone becomes aware that a minor under 18 years of age has sent information to Arkham, they are requested to contact Arkham through their Data Protection Officer, whose contact details are provided in Section VIII of this Privacy Statement, for immediate deletion.

IV. HOW ARKHAM USES CUSTOMERS' INFORMATION.

Arkham uses the information collected from its customers for the following purposes:

- Developing, improving, and enhancing its products and/or services.
- Providing customers with results, samples, and statistics aimed at depicting their current financial state.
- Showing growth projections based on the information provided by the customer.
- Designing products upon customer request.
- Invoicing the products and/or services acquired by the customer.
- Filing tax declarations.
- Promptly responding to comments, complaints, suggestions, questions, and/or requests for product and/or service acquisition.
- Communicating products, services, and/or offers.
- Monitoring and analyzing trends, uses, and activities related to our products and/or services.
- Detecting and preventing fraud, malicious activities, and other illegal activities.
- Maintaining the integrity and security of the products and/or services marketed.

Arkham may create encrypted and/or pseudonymized information for the purpose of developing, improving, and enhancing its products and/or services.

Arkham will implement the best technological, technical, and organizational measures approved and accepted in privacy matters to ensure that the information used cannot be attributed to any customer.

V. HOW ARKHAM SHARES CUSTOMERS' INFORMATION.

Under no circumstances does Arkham rent and/or sell personal data and/or information belonging to its customers.

The situations in which Arkham may share customers' information are as follows:

- With suppliers, business partners, and/or service providers when it is necessary for the fulfillment of legal obligations.
- With authorities when it is necessary to comply with legal requirements and/or obligations.
- With authorities when it is necessary for the satisfaction of legitimate interests and/or protection of rights owned by Arkham.
- With business partners, acquirers, and/or sellers in cases where Arkham merges, demerger, and/or undergoes restructuring.
- With possible subsidiaries and/or affiliates of Arkham.
- When Arkham obtains consent.

VI. INTERNATIONAL DATA TRANSFERS.

Arkham may transfer customers' information to countries other than their residence for processing and/or storage. In particular, Arkham may transfer information to Mexico and/or other countries where it has a presence and/or where its affiliates, business partners, and service providers are located. These countries may not have data protection laws equivalent to those in your country of residence.

Regardless of where Arkham processes customers' information, Arkham ensures to take necessary measures to protect the information in accordance with this Privacy Statement and applicable local data protection laws.

Among the measures Arkham will implement are the Standard Contractual Clauses of the European Commission for transfers of personal information from the European Economic Area (EEA) or Switzerland to us, and equivalent measures for transfers of personal information from the United Kingdom.

Arkham also offers customers the option to enter a Data Processing Appendix (DPA) that contains the Standard Contractual Clauses for transfers between Arkham and its customers. We also employ supplementary measures to ensure that your information is adequately protected.

VII. RIGHTS AND CHOICES REGARDING DATA PROTECTION OF ARKHAM'S CUSTOMERS.

Arkham retains customers' personal data and/or information only for the period necessary to perform the services and/or products that customers have contracted, except for data that must be retained for a longer period due to legal reasons.

The rights and/or options that Arkham's customers have regarding their information and/or personal data may vary depending on their place of residence.

Customers residing in California, United States, can review the specific section corresponding to their jurisdiction in this Privacy Statement.

Irrespective of the above, Arkham's customers have the following rights:

- Right to information and access to personal data.
- Right to transparency.
- Right to rectification and erasure.
- Right to data portability.
- Right to object and automated individual decisions.
- Right to restriction of processing.

Arkham ensures that customers can exercise the rights independently and free of charge.

Arkham's customers can exercise the rights by sending a written request via email to the address privacy@arkham.finance; The request should include the following:

- Full name.
- Email address for notifications.
- Official identification or any official document to validate the customer's identity.
- If the right is being exercised by a legal representative, accompanying documentation to prove the conferred representation.
- Description and/or specification of the right to be exercised, clearly outlining the desired request, and attaching any documents supporting the request.
- Date and signature.

Arkham will address requests to exercise any right as quickly as possible and will respond within a maximum of 30 days from the moment Arkham receives the request. The response time will depend on the complexity of the request, which can be extended by an equivalent period whenever there is a justified reason and depending on the complexity of the request.

Regardless of the above, Arkham encourages its customers to communicate any concerns, doubts, or suggestions regarding this Privacy Statement by contacting us sending a email to the address privacy@arkham.finance

Data subjects and/or concerned parties have the right to file a complaint and/or report to the competent data protection authority in their jurisdiction of residence regarding any dissatisfaction with the processing of their information and/or personal data.

Arkham employs and implements accepted and approved security tools in the industry, as well as internal procedures and strict guidelines to prevent misuse and/or unlawful disclosure of information and/or personal data.

Arkham's employees are bound by confidentiality obligations.

The fact that Arkham implements appropriate and suitable security measures regarding the personal data and/or information it processes, reducing inherent risks significantly, does not imply that there is no likelihood of any impact. Therefore, Arkham requests that if anyone becomes aware of any possible data breach or security vulnerability, they contact Arkham immediately through their Data Protection Officer, whose contact information was provided earlier.

If Arkham becomes aware of any security breach in its systems that compromises the information and/or personal data it processes, corrective measures will be applied immediately. Arkham will notify the competent supervisory authority no later than 72 hours after the incident.

The notification to the competent authority will include at minimum:

- Description of the nature of the personal data security breach, including, if possible, the categories and approximate number of affected data subjects, and the categories and approximate number of affected personal data records.
- Name and contact details of the data protection officer or another contact point from which more information can be obtained.
- Description of the potential consequences of the personal data security breach.
- Description of measures taken or proposed by Arkham to remedy the personal data security breach, including, if applicable, measures taken to mitigate potential negative effects.

VIII. CHANGES TO ARKHAM'S PRIVACY STATEMENT.

Arkham reserves the right to change this Privacy Statement. In the case of material changes, Arkham will prominently post a notice on its website. Interested parties can check the date of the last version of this Privacy Statement at the end of the document. If you do not agree with any changes to this Privacy Statement, you should cease using the services and/or products provided by Arkham.

Arkham recommends that you periodically review this Privacy Statement or when you interact with Arkham in other ways.

IX. SPECIAL PROVISIONS FOR INDIVIDUALS RESIDING IN CALIFORNIA, UNITED STATES.

This section of the Privacy Statement addresses the requirements established in the California Consumer Privacy Act of 2018 (Cal. Civ. §§ 1798.100-1798.199) ("CCPA").

The provisions in this section complement what is outlined in the Privacy Statement. Therefore, if you require a description of the data collection, use, and disclosure practices, you should read the entire Privacy Statement.

Categories of Personal Information.

The categories of personal information as defined by the CCPA that Arkham may collect are as follows:

- Identifiers.
- Categories of personal information listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)) (e.g., name, address, email address).
- Characteristics of protected classifications under federal or California law.
- Commercial information (e.g., transaction data).
- Internet or other similar network activity.
- Geolocation data (e.g., general location derived from an IP address).
- Professional or employment-related information.
- Inferences drawn from the categories of personal information listed above.

Categories of Recipients of Personal Information.

The categories of personal information (including confidential information) outlined previously may be disclosed in the cases and to the individuals specified in Section V "HOW ARKHAM SHARES CUSTOMERS' INFORMATION" of this Privacy Statement.

Sources of Personal Information.

The methods by which Arkham obtains the categories of personal information listed above are specified in Section III "INFORMATION COLLECTED BY ARKHAM" of this Privacy Statement.

Purposes for Which We Use Personal Information.

Arkham uses personal information for the purposes described in Section IV "HOW ARKHAM USES CUSTOMERS' INFORMATION" of this Privacy Statement.

Retention Period Criteria.

Arkham retains customers' personal data and/or information only for the period necessary to perform the services and/or products that customers have contracted, except for data that must be retained for a longer period due to legal reasons (e.g., to comply with applicable tax or accounting legal requirements).

CCPA Rights and Requests.

The rights that can be exercised under the CCPA with respect to the personal information processed by Arkham are as follows:

- Right to know, correct, and delete personal information: With this right, you can request (i) access to specific pieces of personal information that Arkham has collected, (ii) correction of inaccurate personal information that Arkham holds about its customers, and/or (iii) deletion of personal information provided no exceptions apply.

Arkham will review and respond to the request in accordance with the CCPA and will also verify that no exceptions apply under the CCPA. Arkham may need to request additional personal information, such as email address, state of residence, or postal address, to verify your identity and protect against fraudulent requests.

- Right to opt-out of the sale or sharing of personal information: With this right, you can request to opt-out of the "sale" or "sharing" as defined under the CCPA.

It is noted that Arkham does not sell personal information, as defined by the CCPA, meaning the exchange of personal information for monetary payment. However, because the definitions of "sale" and "sharing" under the CCPA may cover sharing information with certain types of advertising and marketing partners, Arkham offers California residents the right to opt-out of any sale or sharing of such personal information.

The aforementioned rights under the CCPA can be exercised according to the procedure outlined in Section VII "RIGHTS AND CHOICES REGARDING DATA PROTECTION OF ARKHAM".

Arkham guarantees individuals the right to be free from discrimination for exercising any of the rights established under the CCPA and/or any other applicable legal provisions.

Last updated: September 2023.