Privacy & Data Protection Policy

AQNOVA MARKETPLACE

Global Legal Footer Framework

Comprehensive Compliance & Platform Governance Reference

(MASTER)

The Complete Global Privacy Policy Governing Personal Data Processing on the AqNova Platform

Effective Date: April 7, 2026 | Version 1.0 | Arivon Holding Corporation

This Privacy & Data Protection Policy ("Privacy Policy" or "Policy") is issued by Arivon Holding Corporation, operating the AqNova Marketplace ("AqNova," "we," "us," "our"). It sets out, in full and in plain language, how AqNova collects, uses, stores, transfers, and protects the personal data of every individual who interacts with the AqNova Platform — whether as a Buyer, Vendor, Referral Partner, or Visitor.

This Policy applies globally and constitutes AqNova's master privacy disclosure. It is supplemented by regional addendums (published at [aqnova.co/privacy/regional]) where local law requires additional disclosures, rights, or notices beyond those contained herein. Where a regional addendum conflicts with this master Policy on a matter of local law, the regional addendum governs for users in that jurisdiction.

This Policy is incorporated by reference into the Platform Terms & Conditions (Section 2) and operates alongside the Privacy & Data Protection Overview (Section 3.0), Cookie Policy (Section 3.2), Data Subject Rights Portal Guide (Section 3.3), and Data Retention Schedule (Section 3.4).

3.1.1 Who We Are — Data Controller Details

AqNova Marketplace is operated by Arivon Holding Corporation, a company incorporated under applicable law and registered as follows. For the purposes of all applicable data protection laws worldwide, Arivon Holding Corporation is the data controller — the entity that determines the purposes and means of processing your personal data through the Platform.

If you are located in the European Union or United Kingdom, AqNova has designated (or is in the process of designating) a local Article 27 representative to act as your point of contact for GDPR and UK GDPR matters. Contact details for the EU and UK representatives are available at [aqnova.co/privacy/representatives] and by emailing gdpr@aqnova.co.

3.1.2 Personal Data We Collect — Eight Categories

We collect personal data in eight distinct categories. Each category is described below, together with the specific data elements it encompasses and the circumstances in which it is collected. We collect only what is genuinely necessary for the purposes described in this Policy.

Category 1 — Identity Data

Identity data is information that identifies you as an individual. We collect:

Full legal name (required for account registration and, for Vendors, for KYC verification).

Username or display name (chosen by you at registration; may differ from legal name).

Date of birth (collected for age verification purposes; we verify you meet the minimum age requirement for your jurisdiction; we do not retain full date of birth beyond what is necessary for verification in most cases).

Gender (optional and self-identified; collected only where you choose to provide it for personalization purposes).

Profile photograph (optional; uploaded at your discretion to personalize your account).

Government-issued identity document type and reference number (collected for Vendor KYC verification only; held in encrypted form; access is strictly restricted to authorized verification staff).

Identity data is used for: account creation and management; fraud prevention and identity verification; regulatory compliance (AML/KYC); and personalizing your Platform experience. We do not use identity data to infer sensitive characteristics beyond what you have explicitly provided.

Category 2 — Contact Data

Contact data is information that enables us to reach you. We collect:

Email address (required; used for account access, transactional notifications, and, with your consent, marketing communications).

Telephone or mobile number (required for two-factor authentication; used for delivery notifications where relevant; used for account security alerts).

Billing address (required for payment processing and tax compliance).

Delivery / shipping address (required for order fulfillment; stored for convenience if you choose to save addresses in your account).

Business address (required for Vendors as part of storefront disclosure obligations under applicable e-commerce laws).

Contact data is used for: account authentication; sending order confirmations, shipping updates, and receipts (mandatory transactional communications); sending security and fraud alerts; delivering customer support; and — with your consent — sending marketing and promotional communications.

Category 3 — Financial Data

Financial data is information related to your payment methods and financial transactions. We collect differently depending on whether you are a Buyer or a Vendor:

Buyers:

Payment method type (e.g., credit card, debit card, PayPal, Apple Pay, M-Pesa — we store the method type and last four digits of card numbers for display purposes only; we never store full card numbers, CVV/CVC codes, or full card expiry dates).

Billing address associated with the payment method (used for fraud verification and tax compliance).

Currency preference (stored to display prices in your preferred currency).

Vendors:

Bank account name and masked account number (used for payout disbursement; full account numbers are held by our Payment Processor, not by AqNova directly).

Bank sort code or routing number (for payout processing; held by Payment Processor).

Tax identification number (EIN, VAT number, GST number, TIN — required for tax reporting compliance in applicable jurisdictions).

Payout history and settlement records (maintained for 7 years for tax and audit purposes).

Financial data is used for: processing payments and disbursing vendor payouts; fraud detection and prevention; tax reporting and regulatory compliance; and maintaining legally required financial records. All payment data is processed through PCI-DSS Level 1 certified payment processors. AqNova implements field-level encryption for all sensitive financial data stored within its own systems.

Category 4 — Transaction Data

Transaction data is a record of all commercial activities you conduct on the Platform. We collect:

Order history: products purchased (Buyers) or sold (Vendors); quantities; prices paid; transaction dates and times; order reference numbers.

Product categories: the categories of goods involved in each transaction (used for tax classification, fraud analytics, and — in aggregate — platform improvement).

Delivery status and tracking information: carrier name, tracking number, delivery confirmation timestamps.

Returns, refunds, and disputes: records of return requests submitted, refunds issued, Buyer Protection claims, and dispute outcomes.

Invoice records: VAT invoices, commercial invoices, and receipts generated for each transaction (retained for 7–10 years for tax compliance).

Promotional code and discount usage: codes redeemed at checkout and their effect on transaction value (used for fraud detection and marketing analytics).

Transaction data is used for: order fulfillment and customer support; tax reporting and regulatory compliance; fraud detection (pattern analysis across transactions); Buyer Protection claims processing; platform analytics and improvement; and, in aggregate, providing Vendors with sales performance insights through the Vendor Dashboard.

Category 5 — Technical Data

Technical data is information automatically generated by your device and network when you interact with the Platform. We collect:

IP address (used for geolocation — country and approximate city — for regulatory compliance, currency settings, fraud detection, and Platform personalization; IP addresses are considered personal data in many jurisdictions and are handled accordingly).

Device type, model, and operating system (used for Platform compatibility, fraud detection, and technical troubleshooting).

Browser type and version (used for Platform rendering and compatibility; combined with other signals for fraud detection).

Browser fingerprint (a combination of technical device characteristics used exclusively for fraud detection and bot identification; this data is processed under legitimate interests with appropriate safeguards).

Screen resolution and display settings (used for Platform rendering optimization).

Time zone and language settings (used to display appropriate currency, language, and localized content).

Session identifiers (temporary identifiers for your browsing session; expire at session end).

Error logs and crash reports (used to identify and fix technical issues on the Platform).

Technical data is used for: ensuring the Platform functions correctly on your device; detecting and preventing fraud, bot activity, and account takeover; improving Platform performance; and legal compliance (e.g., IP address records in connection with contractual acceptance). Technical data is never used to build individual advertising profiles.

Category 6 — Usage Data

Usage data is information about how you interact with the Platform. We collect:

Pages and products viewed, clicked, or searched (used to understand navigation patterns and improve product discovery).

Time spent on pages and features (used for platform improvement and identifying usability issues).

Scrolling and click behavior (used in aggregate for UX analysis; individual-level behavioral profiling is not used for advertising).

Cart additions and abandonments (used to improve the checkout experience and, where you have consented, to send cart abandonment reminders).

Checkout funnel progression (used to identify friction points in the purchase process).

Feature usage (which Platform features you use and how frequently; used for product development decisions).

Referring URL and exit URL (the page from which you arrived at AqNova and the page you visited after leaving; used for marketing analytics and SEO with your consent for analytics cookies).

Usage data is collected primarily through cookies and similar tracking technologies. Please see the Cookie Policy (Section 3.2) for full details of how these technologies operate and how you can manage your preferences.

Category 7 — Marketing & Communications Preferences Data

Marketing preferences data is information about your communication choices and interests. We collect:

Email marketing subscription status: whether you have opted in to receive marketing emails from AqNova; the date of opt-in; the version of the consent notice presented at the time of consent.

Push notification preferences: whether you have enabled push notifications through the AqNova mobile app (where applicable) and your notification category preferences.

SMS/text message marketing consent: recorded separately from email consent; opt-in required in all jurisdictions.

Marketing topic preferences: product categories and interests you have indicated you are interested in receiving communications about.

Communication channel preferences: your preferred method of receiving non-transactional communications.

Opt-out and unsubscribe records: date and method of any opt-out or unsubscribe action; maintained to honor your preferences and as a compliance record.

Marketing and communications preference data is used exclusively for: sending you marketing communications that you have consented to receive; suppressing marketing communications to users who have opted out; and compliance with marketing consent obligations under CAN-SPAM (US), CASL (Canada), the EU ePrivacy Directive, UK PECR, Brazil's LGPD, and equivalent frameworks. Your marketing preferences can be updated at any time through your account settings or by clicking the unsubscribe link in any marketing email.

Category 8 — Sustainability Profile Data

Sustainability profile data is a distinctive data category reflecting AqNova's identity as a curated sustainable marketplace. We collect:

Sustainability interest categories: product categories you have browsed or purchased in — such as organic food, clean energy products, eco-friendly home goods, electric vehicle accessories, Fair Trade goods, and zero-waste products — which indicate your sustainability interests and preferences.

Certification preferences: certification types you have filtered by or shown preference for (e.g., USDA Organic, Fair Trade, FSC, B Corp, Energy Star).

Sustainability goals (optional): if you have completed AqNova's optional sustainability preferences questionnaire, the responses you provided about your personal sustainability priorities.

Purchase-derived sustainability indicators: inferences drawn from your purchase history about your likely sustainability preferences (e.g., consistent purchase of zero-packaging products suggests a low-waste preference). These inferences are used only for product recommendations and are never shared with third parties as individual-level profile data.

3.1.3 How We Collect Personal Data

We collect personal data through three primary channels:

A. Information You Provide Directly

You provide data directly when you: register an account; complete checkout; fill in your profile; upload product listings (Vendors); contact customer support; participate in surveys or promotions; sign up for marketing communications; submit reviews or ratings; complete KYC verification; or apply for the Founding Vendor Program or Referral Partner Program.

B. Information We Collect Automatically

We automatically collect technical and usage data (Categories 5 and 6 above) when you visit the Platform through cookies, web beacons, pixels, server logs, and similar technologies. We deploy these technologies subject to the consent framework described in our Cookie Policy (Section 3.2). Most analytical and marketing cookies require your consent before activation. Essential cookies, which are necessary for the Platform to function, operate without consent on the basis of legitimate interests/necessity.

C. Information We Receive From Third Parties

We receive personal data from third parties in the following circumstances:

Identity verification providers: we receive verification outcomes (pass/fail) and, where necessary, document reference data from our KYC/AML service providers during vendor onboarding.

Payment processors: we receive confirmation of payment authorization, payment method type, and fraud scoring signals from payment processing partners.

Logistics partners: we receive delivery confirmation, tracking milestones, and delivery exception alerts from shipping carriers.

Social login providers: if you choose to register or log in using a third-party social or identity provider (e.g., Google Sign-In, Apple Sign In), we receive the specific data elements you authorized the provider to share (typically name, email address, and profile picture).

Referral partners: where you arrive at AqNova through a referral link from a Vendor Referral Partner, we receive a referral code and the referring partner's identifier for commission attribution purposes.

Fraud detection networks: we receive fraud risk signals and alerts from industry fraud prevention networks for the purpose of protecting all Platform users from financial fraud.

3.1.4 Purposes of Processing — Why We Use Your Data

We use your personal data only for the purposes described below. We do not repurpose personal data for uses that are incompatible with the original collection purpose without obtaining a new legal basis and, where required, your consent.

A. Order Fulfillment

We process your personal data to accept and process orders placed on the Platform; verify payment authorization; transmit order details to the applicable Vendor for fulfillment; coordinate order dispatch and delivery with logistics partners; track delivery progress and notify you of shipping updates; handle returns, refunds, and Buyer Protection claims; and provide post-sale customer support.

This is the core operational purpose for which the Platform exists. Without this processing, AqNova cannot function as a marketplace. Legal basis: performance of a contract (GDPR Art. 6(1)(b); LGPD Art. 7(V); POPIA § 11(1)(a); equivalent in all applicable jurisdictions).

B. Account Management

We process your personal data to create, maintain, and secure your account; verify your identity at login; send security alerts for suspicious account activity; process account preference changes; and manage account closure and data deletion requests.

Legal basis: performance of a contract (account terms); legitimate interests (account security). Multi-factor authentication operates on legitimate interests (protecting users from account takeover) with optional user consent for the specific MFA method.

C. Fraud Prevention & Platform Security

We process your personal data — including technical data, transaction history, behavioral signals, and device fingerprints — to detect and prevent fraudulent transactions, payment fraud, account takeover, bot activity, and other forms of Platform abuse. This processing is ongoing and automated, supported by machine learning models trained on anonymized fraud patterns.

Fraud prevention is one of AqNova's most critical processing activities. Without it, Buyers would be exposed to financial fraud and Vendors would be exposed to fraudulent orders and chargebacks at scale. Legal basis: legitimate interests (fraud prevention; protecting users; maintaining Platform integrity). A Legitimate Interests Assessment (LIA) is maintained for this processing activity and is available on request from dpo@aqnova.co.

D. Marketing & Communications

We process your contact data and marketing preferences to send you:

Transactional communications: order confirmations, shipping notifications, payment receipts, security alerts, account notices. These are non-optional and sent on the basis of contract performance/legitimate interests.

Marketing communications: promotional emails, product recommendations, personalized offers, AqNova news and updates. These are sent only with your explicit opt-in consent (where required by applicable law) and you may unsubscribe at any time.

Sustainability-focused content: curated sustainability tips, new eco-product arrivals, vendor spotlights. Sent to users who have expressed an interest in sustainability content, subject to consent.

Legal basis: consent (GDPR Art. 6(1)(a); ePrivacy Directive; CASL; LGPD Art. 7(I)) for marketing communications; contract performance / legitimate interests for transactional communications. Consent records are maintained in our Consent Management Platform.

E. Analytics & Platform Improvement

We process aggregated and pseudonymized usage data to understand how the Platform is used; identify technical issues and usability friction points; measure the effectiveness of new features; optimize Platform performance; and develop new products and services. Individual-level behavioral profiling is used only to the extent necessary for fraud detection and personalization, as described in this Policy.

Legal basis: legitimate interests (improving the Platform for all users). Where analytics require the use of non-essential cookies, consent is obtained through the Cookie Consent Manager (Section 3.2).

F. Personalization & Product Recommendations

We use your transaction history, search behavior, browsing patterns, and sustainability profile data to personalize search results, product recommendations, and homepage content to reflect your interests. Our recommendation algorithms are designed to surface products that are genuinely relevant to your expressed preferences — not to maximize time on site or expose you to irrelevant advertising.

Legal basis: legitimate interests (improving user experience through relevance; ensuring users find products that meet their needs). Where personalization involves profiling that may have significant effects on individuals, you have the right to object and to request human review (see Section 3.1.8).

G. Regulatory Compliance & Legal Obligations

We process personal data to comply with our legal obligations, including: anti-money laundering (AML) and Know Your Customer (KYC) requirements; tax reporting and record-keeping obligations; product recall cooperation with regulatory authorities; compliance with court orders and lawful government requests; data protection law compliance (including responding to data subject rights requests and breach notifications); and compliance with trade sanctions screening obligations.

Legal basis: legal obligation (GDPR Art. 6(1)(c); equivalent provisions under all applicable national laws). We do not use legal obligation as a pretext to process more data than is genuinely required by the applicable legal requirement.

H. Vendor Onboarding & Business Relationship Management

For Vendors, we process personal and business data to verify Vendor identity and eligibility for Platform participation; conduct KYC/AML screening; process Vendor applications and the Founding Vendor Program; manage the Vendor Account and store setup; process payouts and tax reporting; provide Vendors with sales analytics and performance data; and manage Vendor compliance with Platform policies.

Legal basis: contract performance (Vendor Agreement); legal obligation (AML/KYC and tax requirements); legitimate interests (Platform integrity and fraud prevention).

3.1.5 Legal Bases for Processing — Global Framework

Every processing activity we conduct must rest on a valid legal basis under applicable data protection law. The following table maps our principal processing activities to their legal bases across the frameworks most relevant to our global user base:

A. Where We Rely on Legitimate Interests

Where we rely on legitimate interests as our legal basis, we have conducted a Legitimate Interests Assessment (LIA) balancing our interests against your rights and freedoms. Our primary legitimate interests include: preventing fraud and protecting all Platform users from financial harm; maintaining Platform security and integrity; improving the Platform experience for all users; and providing you with relevant personalized content that enhances your use of the Platform.

You have the right to object to processing based on legitimate interests at any time (see Section 3.1.8 — Your Rights). Where you object, we will cease the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is for the establishment, exercise, or defense of legal claims.

B. Where We Rely on Consent

Where consent is the applicable basis, we will seek it clearly and separately for each purpose. You may withdraw consent at any time without affecting the lawfulness of processing that took place before withdrawal. To withdraw consent: update your preferences in account settings; click the unsubscribe link in any marketing email; or contact privacy@aqnova.co. Consent withdrawal for non-essential cookies can be managed through our Cookie Consent Manager at any time.

3.1.6 Who We Share Your Data With

We share your personal data only with the parties described below, and only to the extent necessary for the specific purpose of the sharing. We never sell your personal data. We never share your personal data with advertising networks for third-party behavioral advertising without your explicit consent.

A. Vendors (for Order Fulfillment)

When you place an order, we share with the applicable Vendor the data necessary to fulfill your order: your name, delivery address, order details (products, quantities, special instructions), and contact information for delivery coordination. Vendors are contractually prohibited from using your personal data for any purpose other than fulfilling your order and providing post-sale support for that order. Vendors cannot use your contact information for unsolicited marketing, and they cannot transfer your data to third parties for their own purposes.

B. Payment Processors

We share payment-related data with our payment processing partners — which may include Stripe, PayPal, Adyen, local payment providers (M-Pesa, PIX, UPI, SPEI, and others), and card networks — for the purpose of processing your payment, managing chargebacks, and conducting fraud screening. Payment processors are independent data controllers for their own regulatory compliance purposes and operate under PCI-DSS Level 1 certification. AqNova does not store your full payment card details.

C. Logistics & Shipping Partners

We share your name, delivery address, and order reference number with logistics carriers and fulfillment partners for the purpose of arranging delivery and providing you with tracking information. Where you have provided a telephone number for delivery notifications, this may also be shared with the carrier. Logistics partners process this data solely for delivery services.

D. Identity Verification & KYC Providers

For Vendor onboarding, we share identity and business registration data with our KYC/AML verification partners for identity verification and sanctions screening purposes. These providers act as data processors under AqNova's instruction and are subject to Data Processing Agreements (DPAs) that restrict processing to the stated purpose.

E. Technology & Infrastructure Partners

We use cloud infrastructure, security, analytics, and operational software tools provided by third-party technology partners. Personal data processed in or through these systems is covered by DPAs that require processors to maintain appropriate security measures, process data only as instructed, and not engage sub-processors without authorization. Our current list of material sub-processors is maintained at [aqnova.co/privacy/sub-processors].

F. Legal & Regulatory Authorities

We may disclose personal data to law enforcement agencies, regulatory authorities, courts, or government bodies where required to do so by applicable law, valid legal process (such as a court order, search warrant, or compelled regulatory disclosure), or where necessary to protect the safety of our users or third parties. AqNova reviews all government data requests for legal sufficiency and challenges requests that are overbroad, legally deficient, or inconsistent with applicable law, to the extent permitted.

We publish a Law Enforcement Request Report as part of our annual Privacy Transparency Report, disclosing the volume and nature of government requests received and our response rates.

G. Business Transfer

In the event of a merger, acquisition, reorganization, or sale of all or substantially all of AqNova's business assets, personal data may be transferred to a successor entity as part of the transaction. We will notify you of any such transfer and your rights in connection with it, in accordance with applicable law, including providing you with the opportunity to delete your account before the transfer takes effect, where feasible.

H. With Your Consent

We may share your personal data with third parties not described above where you have given your explicit, informed consent to the specific sharing. This may include participation in AqNova partner promotions, third-party loyalty programs, or co-branded features. Consent is always sought separately for each such sharing and can be withdrawn at any time.

3.1.7 International Data Transfers

AqNova operates as a global marketplace. Your personal data may be transferred to, stored, and processed in countries other than your country of residence — including the United States (our principal place of business), countries where our cloud infrastructure is hosted, and countries where our vendors and partners are located. These transfers are necessary to operate the Platform and fulfill your orders.

A. Safeguards for International Transfers

Whenever we transfer personal data internationally, we implement appropriate safeguards to ensure that your data receives a level of protection equivalent to that required in your jurisdiction. The safeguards we use include:

EU Standard Contractual Clauses (SCCs): for transfers from the EEA to countries without an EU adequacy decision, we use the European Commission's Standard Contractual Clauses (Commission Implementing Decision 2021/914/EU).

UK International Data Transfer Agreement (IDTA): for transfers from the United Kingdom, we use the UK IDTA or an addendum to the EU SCCs, as appropriate.

Adequacy Decisions: for transfers to countries that have received formal adequacy recognition from the European Commission or the UK Secretary of State (e.g., Canada, Japan, South Korea, Israel, New Zealand, Switzerland, and others), we rely on adequacy as the transfer basis.

Binding Corporate Rules (BCRs): AqNova is in the process of developing and seeking approval for BCRs to cover intra-group international transfers. We anticipate BCR submission in Q4 2026.

Transfer Impact Assessments: for all SCC-based transfers, we conduct documented Transfer Impact Assessments to assess whether the legal framework of the recipient country provides equivalent protection and to identify supplementary measures where needed.

Other jurisdiction-specific mechanisms: for transfers from Brazil (LGPD Art. 33 standard contractual clauses), South Africa (POPIA § 72 binding agreements), Australia (APP 8 contractual obligations), Singapore (PDPA contractual obligations), and other jurisdictions, we implement the mechanisms required by local law.

You can obtain copies of the specific transfer safeguards we apply, where permitted by applicable law, by contacting dpo@aqnova.co.

3.1.8 Your Privacy Rights — What You Can Ask Us To Do

You have meaningful rights over your personal data. The rights available to you depend on your jurisdiction of residence, but AqNova's highest-common-denominator approach means we honor the broadest set of rights across all applicable frameworks for all Platform users. The full Data Subject Rights Portal is available at [aqnova.co/privacy/rights].

A. Right to Know / Right of Access

You have the right to ask us what personal data we hold about you, why we hold it, who we share it with, how long we retain it, and what rights you have in relation to it. We will provide you with a copy of your personal data in a commonly used electronic format. We aim to respond within 30 days globally. EU/UK users: 1-month response period per GDPR Art. 15. California users: 45-day response period per CCPA. Brazil users: 15-day response period per LGPD Art. 18. India users: 15-day response period per DPDPA 2023.

B. Right to Correction / Rectification

You have the right to ask us to correct personal data that is inaccurate or incomplete. For most data fields (name, address, contact details, preferences), you can update your information directly through your account settings. For data that cannot be self-corrected (e.g., KYC-verified information, tax records), please contact privacy@aqnova.co with supporting documentation.

C. Right to Deletion / Erasure

You have the right to ask us to delete your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected; where you withdraw consent and no other legal basis applies; or where we are processing data unlawfully. We will honor erasure requests unless we are required or permitted by applicable law to retain the data (e.g., for tax records, AML records, or active legal proceedings). Where we cannot fully comply with an erasure request, we will explain why and describe the specific data we are required to retain.

D. Right to Data Portability

You have the right to receive a copy of the personal data you have provided to us, in a structured, commonly used, machine-readable format (e.g., JSON or CSV), and to transfer that data to another service provider. Portability applies to data processed on the basis of contract or consent, where the processing is carried out by automated means. You can access your data export through your account settings or by contacting privacy@aqnova.co.

E. Right to Restrict Processing

You have the right to ask us to restrict (pause) the processing of your personal data in certain circumstances — for example, while you contest the accuracy of the data we hold, or while an objection to processing is being assessed. During a restriction, we will continue to store your data but will not process it for other purposes.

F. Right to Object / Opt-Out

You have the right to object at any time to our processing of your personal data for the following purposes:

Direct marketing: you have an unconditional right to object to processing for direct marketing purposes. We will stop sending marketing communications promptly upon receipt of your objection.

Profiling for recommendations and personalization: you have the right to object to profiling based on your interests and behavior. We will stop personalized recommendations. You will still be able to use the Platform but will receive generic rather than personalized content.

Processing based on legitimate interests: you may object to other processing based on legitimate interests. We will assess your objection and cease processing unless we can demonstrate compelling legitimate grounds.

California opt-out (CCPA/CPRA): California residents have the right to opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising. AqNova does not sell personal information. You may submit a Do Not Sell or Share request at [aqnova.co/privacy/do-not-sell] or by contacting privacy@aqnova.co. AqNova honors the Global Privacy Control (GPC) browser signal.

Sensitive personal information (CPRA): California residents have the right to direct AqNova to limit its use of sensitive personal information to uses necessary to perform the services reasonably expected by an average consumer.

G. Right to Human Review of Automated Decisions

AqNova does not make binding automated decisions about individual users — such as permanent account bans, denial of services, or financial determinations — without human review of the relevant circumstances. Where automated systems flag an account for suspension, enforcement, or restriction, a human reviewer assesses the automated recommendation before final action is taken (except for immediate security suspensions to prevent ongoing fraud, which are reviewed promptly after the protective action is taken).

You have the right to request human review of any automated decision that affects you significantly. To exercise this right, contact privacy@aqnova.co with the subject line "Automated Decision Review."

H. Right to Non-Discrimination

We will not penalize you, degrade your service, charge you a higher price, or deny you access to the Platform because you have exercised any privacy right. The right to non-discrimination applies in all jurisdictions where we operate, regardless of whether it is specifically mandated by local law.

I. Right to Withdraw Consent

Where processing is based on your consent, you can withdraw that consent at any time by updating your account preferences, clicking the unsubscribe link in any marketing communication, or contacting privacy@aqnova.co. Withdrawal of consent does not affect the lawfulness of processing that took place before withdrawal.

J. How to Exercise Your Rights

3.1.9 Data Retention & Deletion

We keep your personal data for no longer than is necessary for the purposes for which it was collected, or as required by applicable law. The table below summarizes our retention periods for each principal data category. The complete Data Retention Schedule (Section 3.4) provides an exhaustive category-by-category breakdown.

When the applicable retention period expires, we delete personal data from our live systems and from backup systems within 90 days of the live deletion. Deletion is accomplished by secure erasure (overwriting) or by destruction of the storage medium, as appropriate to the data type and storage technology. Where full deletion is not technically feasible (e.g., in encrypted database archives), we apply anonymization so that the data can no longer be linked to any individual.

3.1.10 Automated Decision-Making & Profiling

AqNova uses automated processing and profiling in the following contexts. We are committed to transparency about these systems and to ensuring that automated processing does not produce decisions with significant effects on individuals without appropriate human oversight.

A. Automated Systems We Use

B. Your Rights Regarding Automated Processing

In connection with automated processing that may produce significant effects, you have the following rights:

Right to be informed: this section constitutes our disclosure of automated processing that may significantly affect you.

Right to human review: you may request that a human review any automated decision that significantly affects your account, your payouts, or your ability to use the Platform. Contact privacy@aqnova.co with the subject line "Automated Decision Review — [describe the decision]."

Right to object: you may object at any time to profiling for marketing or recommendation purposes. We will cease personalization immediately upon your objection.

Right to explanation: you may request a meaningful explanation of any automated decision that has been applied to your account. We will explain the principal factors that influenced the decision.

These rights apply regardless of your jurisdiction, consistent with AqNova's highest-common-denominator standard. GDPR Article 22 and equivalent provisions under LGPD, DPDPA, PIPA, and other frameworks provide the specific legal framework for these rights in each jurisdiction.

3.1.11 Cookies & Tracking Technologies

We use cookies and similar tracking technologies (including web beacons, pixels, and local storage) to operate the Platform, measure performance, and — with your consent — deliver personalized content and marketing. This section provides a summary; the full Cookie Policy (Section 3.2) provides comprehensive details of every cookie category we use, the specific cookies deployed, and how to manage your preferences.

A. Types of Cookies We Use

Strictly Necessary Cookies: Required for the Platform to function (e.g., session cookies, authentication tokens, shopping cart cookies). These cookies cannot be disabled as they are essential for the service you have requested. No consent is required for these cookies.

Functional Cookies: Remember your preferences and settings (e.g., language, currency, saved addresses) to provide a more personalized experience. These cookies operate on the basis of our legitimate interests in providing a convenient user experience; you can disable them in the Cookie Manager but doing so may affect Platform functionality.

Analytics Cookies: Collect aggregate information about how users interact with the Platform to help us improve. Analytics cookies require your consent. We use anonymized or pseudonymized data for analytics where possible.

Marketing & Targeting Cookies: Used only with your explicit consent to measure the effectiveness of marketing campaigns and, where you have consented, to deliver relevant advertisements across third-party platforms. AqNova does not use marketing cookies for behavioral advertising on AqNova's own Platform; marketing cookies relate to our own campaign measurement.

B. Managing Your Cookie Preferences

You can manage your cookie preferences at any time through the Cookie Consent Manager, accessible via the "Privacy Settings" link in the Platform footer, or by contacting privacy@aqnova.co. You can also configure your browser to reject cookies, although this may affect Platform functionality. AqNova honors the Global Privacy Control (GPC) browser signal for California and other applicable users.

3.1.12 Children's Privacy

The Platform is not directed at children under the age of 18 (or the applicable age of majority in your jurisdiction). AqNova does not knowingly collect personal data from children under 13 (or under 16 for EU users in jurisdictions applying the GDPR Article 8 age threshold). If you believe your child has provided personal data to AqNova without your consent, please contact safety@aqnova.co immediately. We will promptly delete the child's data and terminate their account.

Age verification mechanisms are built into the registration process. We cooperate with parental oversight requests and comply with the Children's Online Privacy Protection Act (COPPA, US), GDPR Article 8, the UK Age Appropriate Design Code, and equivalent provisions in all applicable jurisdictions.

3.1.13 Data Security

We implement a comprehensive suite of technical and organizational measures to protect your personal data from unauthorized access, disclosure, alteration, destruction, or accidental loss. Key measures include:

Encryption in transit (TLS 1.2/1.3) and at rest (AES-256) for all personal data stored on our systems.

PCI-DSS Level 1 compliant payment processing for all card and payment data.

Multi-factor authentication (MFA) available and encouraged for all user accounts; mandatory for all AqNova staff with access to personal data systems.

Role-based access controls (RBAC) ensuring that personal data is accessible only to staff with a documented need for access.

Regular penetration testing and security audits by independent third-party security experts.

Web Application Firewall (WAF), DDoS mitigation, and intrusion detection systems.

Mandatory annual data protection and security training for all AqNova staff.

Data Protection Impact Assessments (DPIAs) for new high-risk processing activities.

No security system is impenetrable. In the event of a data breach that is likely to result in risk to your rights and freedoms, we will notify you and the applicable regulatory authority as required by applicable law. Our breach notification obligations and timelines are set out in the Privacy & Data Protection Overview (Section 3.0.11).

3.1.14 Regional Addendums — Jurisdiction-Specific Disclosures

This master Privacy Policy is supplemented by regional addendums that contain additional disclosures, rights notices, and regulatory information required by specific jurisdictions. Regional addendums are published at [aqnova.co/privacy/regional] and are incorporated into this Policy by reference. The following addendums are currently available or in development:

3.1.15 Policy Updates & Version History

We may update this Privacy Policy periodically to reflect changes in our data practices, changes in applicable law, or Platform developments. When we make material changes to this Policy — meaning changes that significantly affect how we collect, use, or share your personal data, or that significantly affect your rights — we will:

Notify you by email at the email address registered to your account at least 30 days before the changes take effect (60 days for EU/UK users per DSA requirements; 15 days for changes required by regulatory action).

Display a prominent notice on the Platform's homepage and in your account dashboard during the notice period.

Provide a clear, plain-language summary of what has changed and why.

Obtain renewed consent where the applicable legal basis for a processing activity changes to require consent.

The version history of this Policy, including a description of changes in each version, is maintained at [aqnova.co/privacy/changelog]. Continued use of the Platform after the effective date of any updated Policy constitutes acceptance of the updated terms, except where applicable law requires affirmative consent for material changes.

3.1.16 Contact Us — Privacy Inquiries & DPO

AqNova Marketplace | Global Legal Footer Framework | Section 3.1: Privacy & Data Protection Policy (Master)

© 2026 Arivon Holding Corporation. All rights reserved. Effective April 7, 2026. Version 1.0.