Cross-Border Data Transfer Notice

AQNOVA MARKETPLACE

Global Legal Footer Framework

Comprehensive Compliance & Platform Governance Reference

CROSS-BORDER DATA TRANSFER NOTICE

&

THIRD-PARTY DATA SHARING DISCLOSURE

Global Transfer Safeguards, Mechanisms & Third-Party Sharing Obligations — Master Edition

Effective Date: April 7, 2026 | Version 1.0 | Arivon Holding Corporation

3.5.1 Why Data Crosses Borders — The Nature of Global Marketplace Operations

AqNova operates as a genuinely global e-commerce marketplace. By design, the Platform connects buyers and vendors located in different countries, routes transactions through international payment networks, deploys cloud infrastructure distributed across multiple geographic regions, and engages specialist service providers located around the world. The international transfer of personal data is therefore an operational necessity — not a choice — for AqNova to deliver its services to users across more than 25 countries.

AqNova is deeply aware that international data transfers carry regulatory and privacy implications for users in many jurisdictions — particularly those subject to GDPR, UK GDPR, LGPD, PIPL, DPDPA, and equivalent high-protection frameworks. This Notice provides full transparency about where your data goes, why it goes there, and what safeguards protect it in transit and at the destination.

3.5.2 Destination Countries — Where Your Data Is Transferred

AqNova transfers personal data to the following countries and regions in connection with its Platform operations. The legal basis for each transfer (the mechanism relied upon) is identified in the columns below:

This table will be updated whenever AqNova adds a new destination country or changes a transfer mechanism. The current version and date are recorded in the document header. Users may request a point-in-time copy of the transfer destination list by contacting dpo@aqnova.co.

A. What Are SCCs?

Standard Contractual Clauses (SCCs) are pre-approved contractual terms adopted by the European Commission that provide appropriate safeguards for international data transfers from the EEA to countries that do not benefit from an adequacy decision. SCCs create binding obligations between the exporting entity (AqNova as data exporter) and the receiving entity (the importer) to ensure that the importer processes the transferred data to an equivalent standard of protection as required under GDPR.

B. Which SCCs Does AqNova Use?

AqNova uses the Standard Contractual Clauses adopted by European Commission Implementing Decision (EU) 2021/914 of June 4, 2021 ('New SCCs'), which replaced the 2004 and 2010 SCCs. The 2021 SCCs comprise four modules:

Module 1 (Controller-to-Controller): used where AqNova transfers personal data to a third party acting as an independent data controller for its own purposes (e.g., payment processors where they act as independent controllers; logistics carriers).

Module 2 (Controller-to-Processor): used where AqNova transfers personal data to a service provider that processes data only on AqNova's instructions (e.g., cloud hosting providers, analytics tools, fraud detection services).

Module 3 (Processor-to-Processor): used where AqNova, acting as a processor on behalf of a Vendor, engages a sub-processor in a third country.

Module 4 (Processor-to-Controller): used in limited circumstances where AqNova processes data as a processor and transfers back to the controller located in a third country.

C. SCC Supplementary Measures

AqNova implements the following supplementary measures alongside SCCs, consistent with EDPB Recommendations 01/2020 on measures that supplement transfer tools:

Encryption: all personal data is encrypted in transit (TLS 1.2/1.3) and at rest (AES-256). Encryption keys are held by AqNova and not provided to the importing entity, except to the extent necessary for the importing entity to process the data for its authorized purpose.

Pseudonymization: where technically feasible without impairing the legitimate processing purpose, personal data transferred to analytics and marketing providers is pseudonymized (e.g., hashed email addresses, device IDs rather than full profiles).

Data minimization: only the minimum necessary data for the specific transfer purpose is included in each cross-border transfer.

Access controls: AqNova's DPAs with all importers include requirements that access to transferred data is restricted to personnel with a documented need-to-know and subject to appropriate authentication.

Contractual protections: all SCC-based transfers include provisions requiring the importer to: notify AqNova of any government access requests; challenge overreaching requests where legally permitted; notify AqNova of any breaches affecting the transferred data; and cooperate with AqNova's audit rights.

D. Obtaining SCC Documentation

Copies of AqNova's executed SCCs, or the relevant modules, are available to EU/EEA data subjects and supervisory authorities upon lawful request. To request a copy, contact dpo@aqnova.co with the subject line 'SCC Documentation Request.' AqNova may redact commercially sensitive information that is not necessary to demonstrate the adequacy of the safeguards.

3.5.4 Transfer Mechanism 2 — UK International Data Transfer Agreements (IDTAs)

Following the UK's departure from the European Union, the UK GDPR (retained in domestic law as the UK version of GDPR under the European Union (Withdrawal) Act 2018) requires its own transfer safeguards for transfers of personal data from the United Kingdom to countries outside the UK that do not benefit from a UK adequacy regulation. The UK International Data Transfer Agreement (IDTA) is the UK's equivalent of the EU SCCs.

A. IDTA — Key Features

The IDTA was issued by the UK Information Commissioner's Office (ICO) and came into force on 21 March 2022. AqNova uses the IDTA for all transfers of personal data from the United Kingdom to non-adequate third countries, including transfers to the United States (AqNova's principal operating jurisdiction).

The IDTA incorporates a mandatory Table of contents specifying: the parties; the transferred data; the transfer purpose; the applicable modules; and any supplementary measures. AqNova completes a separate IDTA (or addendum to EU SCCs using the UK Addendum to EU SCCs) for each material UK-to-third-country transfer relationship.

B. UK Addendum to EU SCCs

Where AqNova has already executed EU SCCs with an importer for EU-to-third-country transfers, AqNova adds the UK Addendum (approved by the ICO and laid before Parliament on 2 February 2022) to extend the SCC relationship to UK-origin personal data without requiring a separate IDTA. This reduces administrative duplication for importers that receive data from both EU and UK operations.

C. US-UK Data Bridge

On October 17, 2023, the US-UK Data Bridge extension to the EU-US Data Privacy Framework (DPF) came into effect. UK companies may transfer personal data to US organizations that are certified under the DPF (including the UK Extension) without needing to use an IDTA or UK Addendum. AqNova evaluates DPF-certified US recipients to determine whether reliance on the Data Bridge is appropriate, alongside its standard IDTA-based arrangements.

3.5.5 Transfer Mechanism 3 — Adequacy Decisions

An adequacy decision is a formal determination by a data protection authority or legislative body that a third country, territory, or sector provides an essentially equivalent level of data protection to the originating jurisdiction. Where an adequacy decision is in place, personal data may flow to the recognized country without the need for SCCs, IDTAs, or other safeguards.

A. EU Adequacy Decisions (European Commission)

The European Commission has issued adequacy decisions for the following countries, territories, and sectors relevant to AqNova's operations:

B. UK Adequacy Regulations

The UK has independently issued adequacy regulations covering the following countries (where transfers from the UK do not require IDTA or UK Addendum):

EU and EEA member states: recognized as adequate by UK adequacy regulations (SI 2021/1772).

Countries covered by UK adequacy: Andorra, Argentina, Canada (commercial sector), Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Republic of Korea, Switzerland, Uruguay, and the US under the UK-US Data Bridge.

AqNova maintains a current list of UK-adequate countries and monitors UK adequacy updates through ICO notifications. Changes to UK adequacy status are incorporated into AqNova's transfer mechanism review cycle.

C. Adequacy Decisions from Other Jurisdictions

3.5.6 Transfer Mechanism 4 — Binding Corporate Rules (BCRs)

Binding Corporate Rules (BCRs) are a set of legally binding data protection rules that a corporate group can adopt to facilitate intra-group international transfers of personal data from the EEA and UK. BCRs must be approved by a lead supervisory authority within the EU (with consistency mechanism review by all relevant SAs) or the ICO (for UK BCRs).

A. AqNova's BCR Status

AqNova is in the process of developing and preparing BCRs for submission to the applicable lead supervisory authority. BCR submission is targeted for Q4 2026. Once approved, BCRs will serve as the primary transfer mechanism for intra-group transfers between Arivon Holding Corporation entities, replacing SCC-based intra-group arrangements.

During the period prior to BCR approval, all intra-group international transfers are governed by executed EU SCCs (Module 1, Controller-to-Controller) and, for UK-origin transfers, UK IDTAs or UK Addenda to EU SCCs, supplemented by AqNova's group-wide privacy and security policies which are contractually binding on all group entities.

B. BCR Requirements

AqNova's BCRs will, upon approval, provide binding protections including: application of GDPR-equivalent standards to all personal data processed within the group; legally enforceable rights for data subjects against any group entity; data subject complaint mechanisms; regular compliance audits; and an obligation to report any breaches affecting BCR-covered data to the lead supervisory authority.

3.5.7 Transfer Mechanism 5 — Equivalent Contractual Safeguards for Non-EU/UK Origins

For personal data originating from jurisdictions other than the EU/EEA and UK, AqNova implements jurisdiction-specific contractual safeguards that meet the transfer requirements of the applicable local data protection law. The following matrix sets out the contractual safeguards used for principal non-EU/UK origin jurisdictions:

3.5.8 Transfer Impact Assessments (TIAs)

For all international data transfers that rely on SCCs, IDTAs, or equivalent contractual mechanisms (rather than an adequacy decision), AqNova conducts and maintains a Transfer Impact Assessment (TIA) for each material transfer relationship. TIAs are required under EDPB Recommendations 01/2020 on measures that supplement transfer tools, and represent the European standard of due diligence for cross-border data transfers.

A. TIA Methodology

AqNova's TIA methodology follows the six-step process recommended by the EDPB:

Step 1 — Map all transfers: identify all personal data flows leaving the EEA/UK, including onward transfers from processors.

Step 2 — Identify the transfer tool: determine which Art. 46 mechanism (SCCs, BCRs, etc.) applies to each transfer.

Step 3 — Assess the third country legal framework: evaluate whether the legal framework of the destination country impairs the effectiveness of the transfer tool. Key factors: government access powers; independent oversight; available data subject remedies; history of legal conflicts with EU standards.

Step 4 — Identify supplementary measures: where the third country framework could impair SCC protections, identify and implement supplementary technical, contractual, or organizational measures to address identified gaps.

Step 5 — Implement supplementary measures: integrate identified measures into the transfer arrangement; amend DPAs as necessary.

Step 6 — Re-evaluate periodically: TIAs are reviewed annually and immediately upon any material change to the destination country legal framework or the nature of the transfer.

B. US Transfer — TIA Key Findings

The United States represents AqNova's most significant transfer destination (primary cloud infrastructure, payment processors, analytics, advertising measurement). Key TIA findings for US transfers:

Legal framework: US surveillance law — particularly FISA Section 702 and Executive Order 12333 — has historically raised concerns regarding government access to transferred data. The EU-US DPF (effective July 2023) was established specifically to address these concerns through binding commitments by the US government, including the establishment of the Data Protection Review Court (DPRC).

AqNova's supplementary measures for US transfers include: end-to-end encryption where applicable; pseudonymization; access minimization (each US service provider receives only the data elements necessary for its specific function); contractual notification obligations (processors must notify AqNova of any government access requests); and prohibition on 'back door' access.

AqNova monitors legal developments in the US-EU DPF — including any challenge proceedings before the CJEU — and will update its transfer mechanism if the DPF is invalidated.

C. China Transfer — TIA Key Findings

AqNova conducts a heightened TIA for any transfers involving Chinese residents' personal data, in light of China's broad national security and intelligence laws (including National Security Law 2015, Cybersecurity Law 2017, National Intelligence Law 2017, and Data Security Law 2021). AqNova's current approach is to minimize China-origin personal data transfers to the maximum extent possible and, where transfers are necessary, to: implement CAC-standard contractual provisions; file with the local CAC branch; apply strict data minimization; and encrypt all transferred data.

AqNova's TIA for China-destination transfers (e.g., transfers to suppliers or logistics providers in China) similarly applies heightened scrutiny and supplementary measures given the broad scope of Chinese government access to data held by Chinese entities.

3.5.9 Jurisdiction-Origin Transfer Mechanism Matrix

The following consolidated matrix maps each origin jurisdiction to the applicable transfer mechanisms used for outbound international data transfers:

3.5.10 Government Access to Transferred Data

A material concern for cross-border data transfers — particularly as assessed in Transfer Impact Assessments — is the extent to which government authorities in the destination country may lawfully access personal data transferred from the originating jurisdiction. AqNova has assessed this risk for its primary transfer destinations and has implemented the following policy and contractual protections:

AqNova publishes an annual Government Data Request Transparency Report as part of its Privacy Transparency Report, disclosing the number of government requests received by country, the number of requests challenged, the number complied with, and the approximate number of users affected. The report is published at [aqnova.co/privacy/transparency].

3.5.11 Your Rights in Connection with International Transfers

In connection with AqNova's cross-border data transfers, you have the following specific rights:

Right to information: you are entitled to know the destination countries of your personal data and the safeguards in place — this Notice constitutes that disclosure. For more specific information about a particular transfer, contact dpo@aqnova.co.

Right to a copy of transfer safeguards: EU/EEA data subjects have the right to obtain a copy of the SCCs or other transfer mechanism documents under which their data is transferred. Contact dpo@aqnova.co [Subject: Transfer Mechanism Copy Request] to request these documents.

Right to object: EU/EEA data subjects may object to specific international transfers based on legitimate interests (GDPR Art. 21). AqNova will assess the objection and provide a substantive response within the applicable timeframe.

Right to lodge a complaint: if you believe AqNova has transferred your personal data internationally without appropriate safeguards, you have the right to lodge a complaint with the applicable supervisory authority in your jurisdiction (see the Supervisory Authority Directory in Section 3.4.13).

3.6.1 Overview — Categories of Third-Party Recipients

AqNova shares personal data with third parties in the following 13 categories. In each case, AqNova shares only the minimum data necessary for the specific purpose of the sharing, on the basis of a valid legal ground, and subject to appropriate contractual safeguards. AqNova does not sell personal data to any third party. The following sections provide full disclosure of each category, consistent with GDPR Articles 13–14, CCPA § 1798.115, and equivalent transparency obligations worldwide.

3.6.2 Payment Processors

AqNova shares payment-related personal data with payment processing partners to authorize, settle, and manage transactions on the Platform. Payment processors receive only the data necessary to process the specific payment method used by the Buyer.

AqNova does not store full payment card numbers, CVV/CVC codes, or full bank account numbers in its own systems. All sensitive payment data is tokenized and held by PCI-DSS certified payment processors. AqNova stores only payment method type (e.g., Visa), last four digits for display, and the processor's payment token reference.

3.6.3 Logistics & Fulfillment Partners

When an order is dispatched by a Vendor, AqNova (or the Vendor directly) shares shipment-related personal data with logistics and delivery partners to arrange collection, transit, and delivery of the order.

Data shared: Buyer's full name; delivery address (street, city, postal code, country); contact telephone number (for delivery notifications and missed delivery callbacks); order reference number; declared package contents description (for customs purposes on cross-border shipments); package weight and dimensions.

Legal basis: contract performance — sharing this data is necessary to fulfill the purchase contract between the Buyer and Vendor.

Logistics partners: global carriers (DHL, FedEx, UPS, DPD, and equivalents); national postal services (USPS, Royal Mail, Canada Post, Australia Post, NIPOST, and equivalents); last-mile regional carriers in Africa, Asia, and Latin America.

Data processing restrictions: logistics carriers process the provided data solely for the purpose of delivering the specific shipment. They may not use delivery address data for marketing or profiling purposes.

Retention: logistics providers typically retain delivery records for 6–12 months for tracking and dispute purposes. AqNova retains logistics data for 7 years for tax and regulatory compliance.

3.6.4 Analytics & Performance Providers

AqNova uses analytics tools to understand how users interact with the Platform and to improve Platform performance, usability, and features.

3.6.5 Marketing & Advertising Platforms

AqNova shares limited pseudonymous data with advertising and marketing platforms for the sole purpose of measuring the effectiveness of AqNova's own marketing campaigns. This sharing is conducted only where users have given valid consent (through the Cookie Consent Manager for web users; through ATT opt-in for iOS users; through GAID settings for Android users). AqNova does not share personal data with advertising platforms for third-party behavioral advertising.

3.6.6 Fraud Prevention & Security Services

AqNova shares behavioral and technical signals with specialist fraud detection and platform security services to protect all users from financial fraud, account takeover, and bot activity.

Data shared: device fingerprint (non-personal technical signals); IP address (truncated for anonymization in analytics but full for fraud detection); browser/OS combination; transaction velocity patterns; account behavior signals; email address (hashed, for cross-network fraud signal matching).

Legal basis: legitimate interests — protecting all Platform users from fraud; preventing financial losses to Buyers, Vendors, and AqNova; maintaining Platform integrity. AqNova has conducted a LIA for this processing.

Providers: Sift Science (Sift, Inc., US); Kount (Equifax, US); equivalent fraud prevention network (to be finalized at go-live); Cloudflare Bot Management (Cloudflare, Inc., US).

Restrictions: fraud prevention providers may not use AqNova user signals to build advertising profiles, score users for purposes other than fraud detection, or share signals with third parties other than their own sub-processors under DPA.

Safeguards: DPA executed with each provider; EU SCCs for EEA transfers; strict data minimization (only fraud-relevant signals shared, not general profile data); data retained by fraud providers for a maximum of 13 months for fraud pattern analysis.

3.6.7 Identity Verification & KYC Providers

AqNova shares identity and business registration data with specialist identity verification and Know Your Customer (KYC) providers for the purpose of onboarding Vendor accounts and complying with applicable anti-money laundering (AML) and counter-terrorist financing (CTF) obligations.

Data shared: Vendor name; date of birth; government-issued ID type and reference number (not the full document image, unless required by the provider's verification process); business registration number; beneficial ownership declarations; liveness check data (where biometric verification is required).

Legal basis: legal obligation (AML Directives; BSA/FinCEN; PCMLTFA; FMPA Nigeria; applicable national AML laws); contract performance (Vendor Agreement requires identity verification).

Providers: Jumio (Jumio Corporation, US); Onfido (Onfido Ltd., UK); ComplyAdvantage (ComplyAdvantage Ltd., UK) — for sanctions screening; or equivalent providers selected at go-live.

Restrictions: KYC providers act exclusively as data processors; they process Vendor identity data solely for the purpose of AqNova's identity verification and sanctions screening; they may not use the data for their own commercial purposes or share it beyond their authorized sub-processors.

Retention: KYC documents and verification records are retained for 5 years from the end of the business relationship, consistent with AML record-keeping requirements. AqNova does not retain copies of full government-issued ID documents beyond the verification period unless specifically required by applicable AML law.

3.6.8 Cloud Infrastructure & Hosting Providers

All personal data collected and processed by AqNova is stored and processed on cloud infrastructure provided by leading cloud service providers. These providers do not process personal data for their own purposes — they provide the technical infrastructure on which AqNova's systems run.

Primary cloud provider: Amazon Web Services, Inc. (AWS), a subsidiary of Amazon.com, Inc. (US). Primary region: [US-East-1 / EU-West-1 — to be confirmed at go-live]. Backup regions for disaster recovery: [secondary regions to be disclosed]. AqNova uses AWS's EU-based infrastructure options (EU-West-1 Frankfurt or Ireland) for EU/UK data residency where required by applicable law or commercial arrangements.

Content Delivery Network (CDN) & DDoS Protection: Cloudflare, Inc. (US). Cloudflare processes network traffic metadata (IP addresses, request logs) to provide DDoS protection, WAF, and CDN services. AqNova has executed the Cloudflare DPA. EU SCCs in place for EEA traffic.

Email Infrastructure: Amazon SES (AWS) or equivalent email service provider for transactional email delivery. Email content (transactional notifications) may transit through AWS servers. AqNova's DPA with AWS covers this processing.

Data Processing Agreements: AqNova has executed DPAs with all cloud infrastructure providers that comply with the GDPR Art. 28 requirements, including GDPR-compliant sub-processor lists, audit rights, security measures, and data deletion obligations.

3.6.9 Customer Support Technology

AqNova uses customer support technology platforms to manage user inquiries, disputes, and platform communications. These platforms may process personal data in the course of providing their services.

Platform: Intercom, Inc. (US) — for live chat support and customer messaging. Intercom processes: user name; email address; conversation content; Platform usage context (page visited when support initiated); account status. Intercom acts as a data processor under AqNova's DPA. EU SCCs in place. Intercom data is retained for the duration of the support relationship plus 90 days.

Ticketing system: Zendesk, Inc. (US) or equivalent (to be confirmed at go-live) — for structured support ticket management. Processes: user contact details; issue description; resolution history. DPA executed; EU SCCs in place.

Vendor restrictions: customer support providers may only access user data as necessary to support AqNova's customer service function; they may not use this data for their own marketing or advertising; access controls limit support provider access to data directly related to active support interactions.

3.6.10 Regulatory Authorities & Law Enforcement

AqNova discloses personal data to regulatory and law enforcement authorities where required by applicable law. This category of sharing operates fundamentally differently from all others — it is not consensual or contractually structured, but is compelled by legal obligation.

3.6.11 Vendors — Buyer Data Sharing Framework

When a Buyer places an order, AqNova shares the Buyer's personal data with the applicable Vendor to the extent necessary for order fulfillment. This is the most fundamental data sharing on the Platform. The scope of Buyer data shared with Vendors and the obligations on Vendors in connection with that data are defined in the Vendor Agreement (Section 2.2) and are summarized here.

A. Data Shared with Vendors for Order Fulfillment

B. Vendor Data Processing Obligations

All Vendors who receive Buyer personal data through the Platform are subject to the following binding data protection obligations under the Vendor Agreement (Section 2.2), which incorporate GDPR Article 28-equivalent terms for EU/UK Vendors and equivalent protections for all other jurisdictions:

Purpose limitation: Vendor may use Buyer data only for fulfilling the specific order and providing order-related customer service. Buyer data may not be used for the Vendor's own marketing, profiling, or commercial purposes.

No resale or onward transfer: Vendor may not sell, license, or transfer Buyer personal data to any third party, including the Vendor's own suppliers or logistics partners, without AqNova's prior written authorization.

Security: Vendor must implement appropriate technical and organizational measures to protect Buyer data against unauthorized access, disclosure, or loss, consistent with the sensitivity of the data and the applicable law.

Retention: Vendor must delete or destroy Buyer personal data within 30 days of order completion (or longer if required for a returns, dispute, or regulatory purpose) and must not retain it for any other purpose.

GDPR processor status: for EU/UK Vendors, the relationship between AqNova (as a controller of Buyer data) and the Vendor (as a processor of that data for order fulfillment) is governed by a controller-processor DPA (Article 28 agreement) embedded in the Vendor Agreement.

Breach notification: Vendor must notify AqNova at security@aqnova.co within 24 hours of discovering any actual or suspected breach affecting Buyer data received through the Platform.

Audit: Vendor must cooperate with AqNova's reasonable audit requests regarding data protection compliance, and must provide documentation of their data protection practices upon request.

3.6.12 Referral Partners — VRPP Data Sharing

AqNova shares limited data with Vendor Referral Partners (VRPs) who participate in the Vendor Referral Partner Program (VRPP) for the purpose of calculating and attributing referral commissions.

Data shared with referring VRPs: confirmation that a referred Vendor has completed registration and activated their account (binary — yes/no, no Vendor personal details beyond this confirmation); referral commission amount attributable to the referring VRP.

Data not shared: the referred Vendor's personal details, KYC information, sales volumes, payout amounts, or any Buyer data are not shared with referring VRPs.

Legal basis: contract performance (VRPP Agreement); legitimate interests (commission calculation and fraud prevention).

Safeguards: VRPs must comply with AqNova's data protection requirements under the VRPP Agreement, including restrictions on the use of any referral-related data for purposes other than their own commission records.

3.6.13 Business Transfers — Mergers, Acquisitions & Restructuring

In the event that Arivon Holding Corporation or AqNova undergoes a merger, acquisition, sale of all or substantially all of its assets, corporate restructuring, or similar business transaction, personal data held by AqNova may be transferred to the successor entity or acquiring party as part of the transaction.

If such a transaction occurs, AqNova will:

Provide advance notice to registered users via email and in-Platform notification as soon as practicable, subject to any confidentiality constraints associated with the transaction.

Disclose the nature of the transaction, the identity of the successor entity (or its country of incorporation if the specific identity cannot yet be disclosed), and the implications for users' personal data.

Ensure that the successor entity agrees, as a condition of the transfer, to honor the privacy commitments made in this Privacy Policy with respect to personal data transferred as part of the transaction. Where the successor entity's privacy practices differ materially from AqNova's, users will be notified and given the opportunity to delete their accounts before the transfer takes effect.

Provide users with the right to opt out of the transfer to the successor entity where applicable law permits and where the successor entity's practices differ materially from AqNova's.

3.6.14 Sub-Processor Register, Updates & Change Management

AqNova maintains a public Sub-Processor Register listing all third-party data processors that process personal data on AqNova's behalf. The register is accessible at [aqnova.co/privacy/sub-processors] and is updated whenever AqNova adds, changes, or removes a sub-processor.

A. Sub-Processor Change Notification

In compliance with GDPR Article 28(2) and equivalent provisions, AqNova provides advance notice of material sub-processor changes — specifically, the addition of a new sub-processor or substitution of an existing sub-processor — through the following process:

For EU/UK users: 30 days' advance notice via email and sub-processor register update, during which period EU/UK users may object to the specific sub-processor change. AqNova will assess all objections in good faith; where AqNova cannot address a legitimate objection without disproportionate operational impact, it will notify the objecting user and, where the user's objection relates to a material change in data protection standards, offer the user the option to terminate their account without penalty.

For all other users: sub-processor register updated with 14 days' advance notice. Opt-out of the relevant processing category available through account settings or privacy@aqnova.co.

B. Current Principal Sub-Processors Summary

3.6.15 Data Transfer & Sharing — Contact Information

AqNova Marketplace | Global Legal Footer Framework | Sections 3.5 & 3.6: Cross-Border Transfers & Third-Party Sharing

© 2026 Arivon Holding Corporation. All rights reserved. Effective April 7, 2026. Version 1.0.