Privacy Notice

Section AThis Notice

SummaryThis Notice explains how we Process Personal Data. This Notice may be amended or updated from time to time, so please check it regularly for updates.

This Notice is issued by Macrodeep Inc., a Delaware corporation operating the Macropay Merchant of Record platform (together with its affiliates, "Macrodeep", "Macropay", "we", "us", and "our"). It is addressed to individuals outside our organisation with whom we interact in the course of our business as an authorised reseller of digital products, including customers, visitors to our Sites, users of our products or services, employees and representatives of customers and third-party suppliers or vendors, applicants for employment, and visitors to our premises (together, "you"). Please note that not all provisions of this Notice will apply to you and your Personal Data, as this will depend on your specific relationship with Macropay.

Defined terms used in this Notice are explained in Section M below.

This Notice may be amended or updated from time to time to reflect changes in our practices with respect to the Processing of Personal Data, or changes in applicable law. We encourage you to read this Notice carefully, and to regularly check this page to review any changes we might make in accordance with the terms of this Notice. We will provide notice and seek your consent for material changes where required by applicable law.

This Notice was last updated on 22 May 2026.

You may also have certain rights regarding the information we collect about you. Specifically, the rights of Data Subjects of the EEA are explained in Section I below. Consumers residing in certain U.S. states (including California, Virginia, Colorado, Connecticut, Utah, and others) may find information on their rights in Section K below.

Section BCollection of Personal Data

SummaryWe collect or obtain Personal Data when it is provided directly to us, in the course of our relationship with you (e.g., if you appoint us as your authorised reseller of digital products or if you make a purchase from Macropay), when you make Personal Data public, when you visit our Sites, when you register to use any of our Sites, products, or services, or when you interact with any third-party content or advertising on a Site. We may also receive Personal Data about you from third parties.

We collect or obtain Personal Data about you from the following sources:

• Data provided to us: we obtain Personal Data when such data is provided to us (e.g., where you contact us via email or via our Sites, or by any other means, when you provide us with your business card, or when you submit a job application).
• Data we obtain in person: we obtain Personal Data during meetings, at trade shows, during visits from sales or marketing representatives, in person interviews or at events we attend.
• Collaborations: we obtain Personal Data when you collaborate with us in research or in an advisory/consultancy capacity.
• Relationship data: we collect or obtain Personal Data in the ordinary course of our relationship with you (e.g. we provide a service to you, or to your employer).
• Data you make public: we collect or obtain Personal Data that you manifestly choose to make public, including via social media.
• Site data: we may collect or obtain Personal Data when you visit any of our Sites or use any features or resources available on or through a Site.
• Registration details: we collect or obtain Personal Data when you use, or register to use, any of our Sites, products, or services.
• Content and advertising information: if you interact with any third party content or advertising on a Site (including third party plugins and cookies) we may receive Personal Data from the relevant third party provider of that content or advertising.
• Third party information: we collect or obtain Personal Data from third parties who provide it to us (e.g. credit reference agencies; KYC providers; identity-verification vendors; fraud-prevention networks; sanctions screening services; law enforcement authorities).

We also create Personal Data about you in certain circumstances, such as records of your interactions with us, and details of your past interactions with us. We may also combine Personal Data from any of our Sites, products, or services, including where that data is collected from different sources.

Section CCategories of Personal Data We Process

SummaryWe Process: your personal details, demographic data, your contact details, records of your consents, purchase and payment details, information about our Sites, information about your interactions with our content or advertising, and any views or opinions you provide to us.

We Process the following categories of Personal Data about you, depending on your relationship with us:

• Personal details: given name(s) and preferred name, unique personal identifiers, online identifiers, IP address, government-issued ID numbers (where required for KYC), driver's licence number and passport numbers.
• Demographic information: gender, sex, date of birth, nationality and language preferences.
• Contact details: correspondence address, postal address, telephone number, email address, online messaging details and social media details.
• Experience: professional history, educational background and employment-related information.
• Consent: consents you have provided to us and any related information.
• Purchase details: records of purchases and prices you have purchased, your purchasing history, geolocation data and the consignee's personal details.
• Financial account and payment information: invoice records, payment records, billing address, payment method, cardholder or account holder name, card payment identifiers, credit and debit card details, payment amount and payment date.
• Data relating to your use of our Sites and product: device type, operating system, browser type, browser settings, IP address, language settings, dates and times of connecting to a Site, security login details, API request metadata, and usage data.
• Employer details: where you interact with us in your capacity as an employee of a third party, the name, address, telephone number and email address of your employer.
• Content and advertising data: records of your interactions with our online advertising and content, records of advertising and content displayed on pages displayed to you, and any interaction you may have had with such content or advertising.
• CCTV recordings and visit logs: records of your visit to our office premises.
• Views and opinions: any views and opinions that you choose to send to us, or publicly post about us on social media platforms.

Section DPurpose and Legal Basis for Processing

SummaryWe Process Personal Data and Sensitive Personal Data for a range of purposes. Macropay does not sell your Personal Data for monetary consideration.

The purposes for which we Process Personal Data and the standard legal bases we rely on to perform such Processing are set out in the table below.

These legal bases may vary by jurisdiction as required to comply with applicable law. In some jurisdictions (including Canada), our general legal basis for Processing your Personal Data will instead be your express or implied consent, subject to limited statutory exceptions.

Where it becomes necessary to Process your Sensitive Personal Data for any reason, we do so: to comply with applicable law; to detect and prevent crime; to establish, exercise or defend legal claims; or with your express consent prior to Processing. If you provide Sensitive Personal Data to us, you must ensure that it is lawful for you to disclose such data to us.

Section EDisclosure of Personal Data to Third Parties

SummaryWhere we provide your Personal Data to other parties, we do so with a legitimate purpose in mind, and in accordance with applicable law.

We may share your Personal Data in a limited number of circumstances, including to:

• you and, where appropriate, your appointed representatives;
• where relevant, Suppliers to the extent necessary to provide a product or service requested by you;
• legal and regulatory authorities, upon request, or for the purposes of reporting any actual or suspected breach of applicable law or regulation;
• accountants, auditors, consultants, lawyers and other outside professional advisors to Macropay, subject to binding contractual obligations of confidentiality;
• third-party Processors (such as payment services providers, KYC vendors, fraud-prevention networks, cloud-infrastructure providers, communication services), located anywhere in the world, subject to the requirements noted below in this Section;
• any relevant party, regulatory body, governmental authority, law enforcement agency or court, to the extent necessary for the establishment, exercise or defence of legal claims and with applicable jurisdiction;
• any relevant party, regulatory body, governmental authority, law enforcement agency or court, for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties;
• any alternative payment provider or reseller appointed by the Supplier or other third party acquirer(s) or successor(s) in title, including but not limited to a sale or transfer of all or any relevant portion of our business or assets, reorganisation, dissolution or liquidation;
• any relevant third-party provider, where our Sites use third party advertising, plugins or content. If you choose to interact with any such advertising, plugins or content, your Personal Data may be shared with the relevant third party provider. We recommend that you review that third party's privacy notice before interacting with its advertising, plugins or content;
• any other relevant third-party outsourced service providers, where our Sites use third parties to perform certain functions otherwise performed by Macropay, subject to binding contractual obligations of confidentiality.

If we engage a third-party Processor to Process your Personal Data, the Processor will be subject to binding contractual obligations including, as required, a Data Processing Agreement.

Section FInternational Transfer of Personal Data

SummaryWe transfer Personal Data to recipients in other countries. Where we transfer Personal Data from the UK/EEA to a recipient outside the UK/EEA that is not in an Adequate Jurisdiction, we do so on the basis of Standard Contractual Clauses and with appropriate safeguards.

Because our business is international, we transfer Personal Data among Macrodeep Inc. and its affiliates, and to third parties who Process Personal Data on our behalf as noted in Section E above, in connection with the purposes set out in this Notice. This may involve transfers to countries with different data protection laws than those in your location. As a result, your Personal Data may be subject to the laws of those countries, including laws that may permit or require disclosure to legal, regulatory or national security authorities.

Where applicable, we may rely on exemptions (for example, transfers necessary to establish, exercise, or defend legal claims). Otherwise, if we transfer Personal Data from the UK/EEA to countries not deemed to be in an Adequate Jurisdiction, we use Standard Contractual Clauses and other appropriate safeguards. You may request a copy of these by contacting privacy@macropay.ai.

If you transfer Personal Data directly to Macrodeep Inc. or any affiliate outside the UK/EEA, that transfer is made at your direction. However, from the point we receive your Personal Data, we will process it in line with this Notice.

Section GData Security

SummaryWe have implemented appropriate technical and organisational security measures to protect your Personal Data against unauthorised or unlawful Processing, and against accidental loss, destruction or damage.

We use appropriate technical and organisational security measures to protect your Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access, and other unlawful or unauthorised forms of Processing, in accordance with applicable law. These include encryption in transit and at rest, role-based access controls, audit logging, and regular penetration testing.

We are not to be held responsible for the security of the manner in which you send your Personal Data to us.

Section HData Retention

SummaryWe take every reasonable step to ensure that your Personal Data is only retained for as long as it is needed in connection with its lawful purpose.

We take every reasonable step to ensure that your Personal Data is only Processed for the minimum period necessary for the purposes set out in this Notice.

We will retain Personal Data in a form that permits identification only for as long as you have an ongoing relationship with us or as required or permitted by applicable law (including to comply with our legal obligations, resolve disputes and enforce our agreements).

In any case, in line with our internal policies, we retain your Personal Data for the duration of the applicable limitation period under the applicable law (and a short administrative period thereafter) and while any claim, investigation or dispute that relates to you or the product or service you have purchased from us is ongoing.

Once the periods noted above, each to the extent applicable, have concluded, we will permanently delete or destroy your Personal Data or anonymise it (where permitted by applicable law).

Section IYour Rights

SummaryBased on where you reside, you may have a number of rights in relation to your personal data under applicable data protection laws. In some cases it will be necessary to provide evidence of your identity before we can give effect to these rights.

Subject to applicable law, you may have the following rights regarding the Processing of your Personal Data:

• the right to withhold your Personal Data from us, although this may affect or prevent us from delivering our Site, and any products or services to you;
• the right to request access to, or copies of, your Personal Data, together with information regarding the nature, Processing and disclosure of that Personal Data;
• the right to request rectification of any inaccuracies in your Personal Data;
• the right to request, on legitimate grounds, erasure of your Personal Data or restriction of Processing of your Personal Data;
• the right to have your Personal Data transferred to another Controller, in a structured, commonly used and machine-readable format, to the extent applicable;
• where we Process your Personal Data on the basis of your consent, the right to withdraw that consent, although this may affect or prevent us from delivering our Site, and any products or services to you (and noting that in some circumstances, legal requirements may prevent you from withdrawing your consent); and
• the right to lodge complaints regarding the Processing of your Personal Data with a Data Protection Authority where you reside.

Subject to applicable law, you may also have the right to object to the Processing of your Personal Data.

To exercise one or more of these rights, or to ask a question about these rights or any other provision of this Notice, or about our Processing of your Personal Data, you may submit your request to our Privacy Officer by email at privacy@macropay.ai. We will in certain cases request you to provide evidence of your identity.

Section JCookies and Similar Technologies

SummaryWe Process Personal Data by using Cookies and similar technologies. For more information, please see our Cookie Notice.

When you visit our Site we may place Cookies on your device, or read Cookies already stored on your device. We use necessary Cookies to operate and secure our Site, and non-essential Cookies (with your consent where required by applicable law) for purposes such as analytics, advertising and marketing. This may include recording information about your device, browser, preferences and browsing habits. We Process Personal Data through Cookies and similar technologies in accordance with our Cookie Notice. You can manage your Cookies choices at any time by clicking Cookie Preferences in our Site footer.

Section KAdditional Information for Consumers in the United States

SummarySeveral U.S. state privacy laws provide residents with additional rights regarding their personal data. The disclosures in this Section apply to the extent required by applicable law.

In the past 12 months, we have collected the categories of Personal Data set out in Section C of this Notice. We collect and use these categories of Personal Data for the business purposes described in Section D of this Notice. We share the Personal Data with the third parties mentioned in Section E of this Notice. You can exercise your consumer rights using the procedure described in Section I of this Notice.

In addition to the rights set out in Section I, if you reside in California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Delaware, Montana, Iowa, Indiana, Tennessee, or any other state with a comprehensive consumer privacy law, you are additionally entitled to the following rights:

• Right to opt out of a Sale or Sharing of your Personal Information. We do not sell your personal information for monetary benefit. However, some third party Cookies and similar technologies placed on our Site may be considered a 'sale' or 'share' under U.S. state privacy laws. You can manage your Cookie choices at any time by clicking Cookie Preferences in our Site footer.
• Right to limit the use and disclosure of any Sensitive Personal Data.
• Right to Non-Discrimination. Consumers have the right to be free from discrimination when they exercise their rights under the applicable state privacy law.

Privacy requests (including requests to know or delete data) can be submitted by email to privacy@macropay.ai.

We do not offer financial incentives or a price or service difference to encourage consumers to provide personal information.

Appeal

If we deny your privacy request, you may appeal by following the process set out in Section I above. If you are not satisfied with the outcome, you may submit a complaint to the appropriate state regulator.

Authorized Agent

You may use an authorized agent to submit a privacy request on your behalf where permitted by applicable law. We may require proof of the agent's authority (such as a copy of a lawful power of attorney or written authorisation from you) and verification of your identity before processing the request.

Section LDetails of the Controller

SummaryMacrodeep Inc. acts as the Controller for the purposes of this Privacy Notice.

For the purposes of this Notice, the relevant Controller is:

• Macrodeep Inc. — a Delaware corporation, with registered office at 16192 Coastal Highway, Lewes, Delaware 19958, United States, and principal place of business at 548 Market Street #98432, San Francisco, California 94104, United States. Macrodeep Inc. operates the Macropay Merchant of Record platform.

Privacy enquiries: privacy@macropay.ai. General contact: help@macropay.ai.

Section MDefinitions

"Adequate Jurisdiction"

means a country or territory recognised as providing an adequate level of protection for Personal Data under an adequacy decision made, from time to time, by (as applicable) (i) the Information Commissioner's Office and/or under applicable UK law (including the UK GDPR), and/or (ii) the European Commission under the EU GDPR.

"Controller"

means the entity that decides how and why Personal Data is Processed. In many jurisdictions, the Controller has primary responsibility for complying with applicable data protection laws.

"Cookie"

means a small file that is placed on your device when you visit a website (including our Sites). In this Notice, a reference to a "Cookie" includes analogous technologies.

"Data Protection Authority"

means an independent public authority that is legally tasked with overseeing compliance with applicable data protection laws.

"EEA"

means the European Economic Area.

"GDPR"

means the General Data Protection Regulation ((EU) 2016/679) ("EU GDPR"); the Data Protection Act 2018 and the UK General Data Protection Regulation 2016/679 (as implemented by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019 and the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2020) (the "UK GDPR"), as applicable.

"Merchant of Record"

means the licensed reseller of software and digital products — the role carried on by Macrodeep Inc. through the Macropay platform.

"Personal Data" and "Personal Information"

means information that is about any individual, or from which any individual is directly or indirectly identifiable, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual.

"Process", "Processing" or "Processed"

means anything that is done with any Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

"Processor"

means any person or entity that Processes Personal Data on behalf of the Controller (other than employees of the Controller).

"Product"

means the Supplier's software product(s) and/or digital content and any subsequent updates and upgrades thereto agreed to be resold or distributed by Macropay.

"Sensitive Personal Data"

means Personal Data about race or ethnicity, political opinions, religious or philosophical beliefs, trade union membership, biometric data, physical or mental health, sexual life, any actual or alleged criminal offences or penalties, national identification number, or any other information that is deemed to be sensitive under applicable law.

"Site"

means any website operated, or maintained, by us or on our behalf, including macropay.ai and its subdomains.

"Standard Contractual Clauses"

means (i) where the EU GDPR applies, the contractual clauses annexed to the European Commission's Implementing Decision 2021/914 of 4 June 2021; and (ii) where the UK GDPR applies, the template Addendum B.1.0 issued by the UK's Information Commissioner's Office and approved by Parliament in accordance with s119A of the Data Protection Act 2018 and the accompanying Mandatory Clauses, as updated from time to time and/or replaced by any further version.

"Supplier"

means a party which has appointed Macropay to be the authorised reseller of its Products.

"UK"

means the United Kingdom.