Privacy Policy — Equity Stock Transfer

1. Overview

Equity Stock Transfer, LLC ("EST," "we," "us," or "our"), a Nant Global Finance company, is an SEC-registered transfer agent headquartered at 237 West 37th Street, Suite 602, New York, NY 10018. This Privacy Policy describes how we collect, use, disclose, and protect personal information in connection with:

our public website at www.equitystock.com (the "Site");
the shareholder and issuer portals we make available (including my.equitystock.com), where EST operates the portal; and
the transfer agency, registrar, and related services we provide (the "Services").

Certain shareholder and issuer portals are operated on software platforms licensed from third-party providers. Where those providers process personal information on our behalf, they do so under contracts that restrict their use of that information, as described in Section 5.

2. Our Role as a Transfer Agent

Understanding our role helps explain what information we hold and why:

Website visitors. If you browse the Site or submit a contact form, we collect the information described in Section 3(a) and 3(c) directly from you.
Shareholders of record. If you hold securities registered with an issuer for which EST serves as transfer agent, we maintain the official register of ownership on behalf of that issuer. Much of this information comes to us from the issuer, from your broker or other financial intermediary, from The Depository Trust Company ("DTC"), or from you in connection with a transfer, corporate action, or other transaction — not through this Site.
Issuer personnel and professional advisors. If you are a director, officer, employee, or advisor of an issuer client (or a banker or attorney working with one), we process your business contact information to deliver the Services.

Shareholder records are maintained as the official corporate records of the relevant issuer. Federal securities laws, including SEC recordkeeping rules applicable to registered transfer agents, govern how long and in what form we must keep them.

3. Information We Collect

(a) Information you provide to us

Inquiries and forms. Name, firm or company, email address, phone number, and the contents of your message when you contact us through the Site or by email or phone.
Transaction and account documentation. When you effect a transfer, request a legend removal, elect in a corporate action, enroll in a dividend reinvestment plan, or otherwise transact on the register, we may collect your name, mailing address, email address, phone number, date of birth, Social Security number or taxpayer identification number, government-issued identification, signature (including medallion signature guarantee documentation), banking and payment details, securities positions, and transaction instructions.
Portal credentials. Username, password, and authentication data when you register for a shareholder or issuer portal we operate.

(b) Information we receive from issuers and intermediaries

Shareholder registers and holder lists from issuers appointing us as transfer agent (including on conversion from a prior agent);
Position and settlement information from DTC and its nominee, Cede & Co.;
Instructions and supporting documentation from brokers, custodians, paying agents, and other financial intermediaries;
Information from issuers, underwriters, and their counsel in connection with offerings, listings, and corporate actions;
Public records and government sources, including state unclaimed property administrators.

(c) Information collected automatically

When you use the Site, we and our service providers automatically collect usage data such as IP address, browser type and version, device identifiers, operating system, referring pages, pages viewed, and the dates and times of visits, using cookies and similar technologies. See Section 6 and our Cookie Policy.

4. How We Use Information

We use personal information to:

Provide the Services — maintaining the shareholder register; processing issuances, transfers, and book-entry (DRS) movements; administering corporate actions, dividends and reinvestment programs, proxy voting and annual meetings, escrow and paying agency mandates, and escheatment;
Verify identity and prevent fraud — including signature and medallion guarantee review, anti-money-laundering (AML/KYC) checks and sanctions (OFAC) screening where applicable, and monitoring for unauthorized account activity;
Comply with law — including SEC rules applicable to registered transfer agents (such as recordkeeping and safeguarding requirements), federal tax reporting and withholding (for example, Forms 1099), state unclaimed property laws, and lawful requests from regulators and courts;
Operate, secure, and improve the Site and portals — diagnostics, analytics, and support;
Communicate with you — responding to inquiries and providing service-related notices; and
Market our Services — sending communications about EST services to business contacts, with the ability to opt out at any time.

We do not sell personal information, and we do not share personal information with third parties for cross-context behavioral advertising. We share personal information only as follows:

With the relevant issuer. The shareholder register is the issuer's corporate record. We provide issuers (and, at their direction, their counsel, auditors, proxy advisors, and other authorized representatives) with records relating to their own securities.
With service providers. We use third-party providers to support the Services, including transfer agency recordkeeping and shareholder-portal software platforms operated under commercial license, printing and mailing vendors, proxy distribution services, cloud hosting and information technology providers, payment processors, and identity verification services. Service providers are contractually limited to using personal information to perform services for us, and we oversee them consistent with SEC safeguarding requirements, including provisions requiring prompt notice to us of any breach of security affecting our customer information.
With market infrastructure. DTC, clearing and settlement systems, exchanges, and brokers and custodians acting on your instructions or those of the issuer.
With regulators, tax authorities, and state administrators. The SEC and other governmental authorities as required by law; the IRS and state tax authorities; and state unclaimed property administrators when accounts escheat.
Within our corporate family. With Nant Global Finance, Inc. and its affiliates where needed to operate, manage, and provide the Services, consistent with this Policy.
In legal and corporate events. To comply with legal process, to protect our rights and the security of the Services, or in connection with a merger, acquisition, financing, or sale of assets, subject to customary protections.

6. Cookies & Online Tracking

The Site uses a consent-based cookie manager with three categories: strictly necessary cookies (always active), site analytics, and customer support chat. You can review and change your choices at any time via the Cookie Preferences link in the Site footer. Details of each cookie, its provider, and its lifetime appear in our Cookie Policy. The Site honors the Global Privacy Control (GPC) browser signal as an opt-out of any sharing that would constitute a "sale" or "share" under applicable state law.

Other than the Global Privacy Control signal described above, the Site does not respond to browser "Do Not Track" (DNT) signals, as no common industry standard for them has been adopted.

7. Data Security & Incident Response

As an SEC-registered transfer agent, EST maintains a written information security program with administrative, technical, and physical safeguards designed to protect customer information, consistent with SEC Regulation S-P as amended. Our program includes encryption of data in transit, access controls and least-privilege administration, employee training, vendor due diligence and oversight, and secure disposal of records containing personal information.

We maintain a written incident response program designed to detect, respond to, and recover from unauthorized access to or use of customer information. If an incident involving sensitive customer information occurs, or is reasonably likely to have occurred, we will notify affected individuals as required by Regulation S-P and applicable state breach notification laws — generally no later than 30 days after becoming aware of the incident, unless a permitted exception applies.

No method of transmission or storage is completely secure. Please safeguard your portal credentials and notify us immediately of any suspected unauthorized activity in your account.

8. Data Retention

We retain personal information for as long as necessary to provide the Services and as required by law. Because we are a registered transfer agent, many of our records are subject to mandatory minimum retention periods under SEC rules (including Rule 17Ad-7), and shareholder records may need to be maintained for the life of the issuer relationship and beyond. When determining retention beyond legal minimums, we consider the nature and sensitivity of the information, the purposes for which we process it, and applicable limitation periods for legal claims. Information that no longer must be retained is deleted or de-identified in accordance with our disposal procedures.

9. Your Rights & Choices

(a) State privacy rights

Depending on where you live, state privacy laws (including the California Consumer Privacy Act as amended by the California Privacy Rights Act, "CCPA/CPRA") may give you rights to know, access, correct, delete, or obtain a portable copy of personal information, to opt out of "sales" or "sharing," to limit the use of sensitive personal information, and to not be discriminated against for exercising those rights.

Please note that personal information we process as a registered transfer agent subject to federal financial privacy law (including the Gramm-Leach-Bliley Act and Regulation S-P) is generally exempt from many state privacy laws. Where an exemption applies, we may be unable to act on a request under those laws, but we will tell you so and will honor applicable rights under the federal framework.

To submit a request, email privacy@equitystock.com or call 212.575.5757. We will verify your identity before acting on a request and will respond within the time required by law (generally 45 days, extendable once by a further 45 days with notice). You may use an authorized agent, subject to proof of authorization and verification.

(b) Correcting your shareholder record

Registered holders may update their address, banking, and other account details through the shareholder portal or by contacting us with appropriate documentation. If you hold shares in "street name" through a broker or bank, your information is maintained by that intermediary — please contact them directly, as we cannot change records we do not hold.

(c) Marketing choices

You may opt out of marketing communications at any time using the unsubscribe link in the message or by contacting us. Service and regulatory communications (for example, corporate action notices and tax forms) are not marketing and will continue.

(d) Visitors from outside the United States

The Site and Services are operated from the United States and directed to U.S. issuers and their holders. If you access the Site from the European Economic Area, the United Kingdom, or Switzerland, personal information will be transferred to and processed in the United States. Where those laws apply to our processing, we rely on performance of a contract, compliance with legal obligations, and our legitimate interests in operating the Services as legal bases, and you may exercise applicable data subject rights (access, rectification, erasure, restriction, objection, and portability) by contacting privacy@equitystock.com. You may also lodge a complaint with your local supervisory authority.

We do not sell personal information for money, and we do not share personal information for cross-context behavioral advertising. If our use of analytics cookies could be considered a "sale" or "share" under applicable state law, you can opt out by disabling non-essential cookies in Cookie Preferences in the Site footer, or by browsing with a Global Privacy Control-enabled browser, which we honor automatically.

11. Children’s Privacy

The Site is not directed to children, and we do not knowingly collect personal information from children through it. As transfer agent, we may maintain records for securities held for the benefit of minors (for example, custodial UTMA/UGMA registrations); that information is provided by the custodian or issuer and is processed solely as part of the official shareholder records. If you believe a child has provided personal information through the Site, contact us and we will delete it.

12. Third-Party Websites

The Site links to websites we do not operate, including issuer websites, DTC, the SEC's EDGAR system, and portals operated on third-party platforms. Their privacy practices are governed by their own policies, which we encourage you to review.

13. Changes to This Policy

We may update this Privacy Policy from time to time. The "Effective date" above reflects the current version. For material changes, we will post a prominent notice on the Site (and, where required, notify you directly) before the change takes effect.

14. How to Contact Us

Equity Stock Transfer, LLC — Attn: Privacy

237 West 37th Street, Suite 602, New York, NY 10018

privacy@equitystock.com · 212.575.5757

Privacy Policy.