Privacy Policy

1. Scope and Applicability

This Policy applies to all personal data processed by NorthQuinn in connection with the Site, including data submitted through contact forms, data collected automatically through web server infrastructure and analytics tools, and data received through electronic communications initiated through or in connection with the Site.

This Policy does not apply to:

• Personal data processed pursuant to a separate written engagement agreement, statement of work, or services contract between NorthQuinn and a client entity, which shall be governed by the data handling provisions of such agreement;
• Personal data of NorthQuinn employees, contractors, or applicants, which is subject to separate internal data practices; or
• Third-party websites or services linked from the Site, which maintain their own independent privacy practices.

This Policy is incorporated by reference into NorthQuinn's Terms and Conditions. Capitalized terms not defined herein have the meaning ascribed to them in the Terms and Conditions.

2. Definitions

3. Personal Data We Collect

3.1 Data You Provide Directly

When you submit an inquiry through the Site's contact form, you may provide the following categories of Personal Data:

• Identity Data: First name, last name;
• Contact Data: Email address;
• Professional Data: Company or organization name, job title (if voluntarily provided); and
• Communications Content: The subject and free-text body of your message.

Submission of the contact form is entirely voluntary. You are not required to provide Personal Data to browse informational content on the Site.

3.2 Data Collected Automatically

When you access the Site, certain technical information is collected automatically through standard web server infrastructure and analytics tools:

• Device and Browser Data: Browser type and version, operating system, device type;
• Network Data: IP address, approximate geolocation derived from IP address at country and region level only, internet service provider;
• Usage Data: Pages visited, time spent on individual pages, referring URL, clickstream data; and
• Session Data: Date and time of access, session duration, error logs.

This data is collected in aggregate form to understand how the Site is used, identify technical issues, and improve Site content and performance. NorthQuinn does not use automatically collected data to identify individual users, build behavioral advertising profiles, or share such data with data brokers.

3.3 Data NorthQuinn Does Not Collect

NorthQuinn does not collect Sensitive Personal Data through the Site. NorthQuinn does not collect biometric identifiers, precise geolocation data, or data concerning children under the age of thirteen (13). If you believe you have inadvertently submitted Sensitive Personal Data, contact us immediately using the information in Section 16.

3.4 De-Identified and Aggregate Data

NorthQuinn may create aggregate, anonymized, or de-identified data derived from Personal Data by removing or altering identifying information. Such de-identified data is no longer Personal Data under this Policy and may be used for any lawful business purpose without restriction.

4. How We Use Personal Data

NorthQuinn Processes Personal Data only for the lawful purposes set forth below. Where applicable law requires a legal basis, we rely on the following:

No Sale or Sharing for Behavioral Advertising

NorthQuinn does not sell your Personal Data. NorthQuinn does not share your Personal Data with third parties for cross-context behavioral advertising. NorthQuinn does not receive monetary or other valuable consideration in exchange for disclosing your Personal Data to advertisers, data brokers, or any analogous commercial intermediary.

5. Disclosure of Personal Data

NorthQuinn does not disclose Personal Data to third parties except as described in this Section.

5.1 Service Providers

NorthQuinn engages third-party Service Providers to support Site operations. These Service Providers receive Personal Data only to the extent necessary to perform their contracted functions and are contractually prohibited from using Personal Data for any other purpose. Current Service Providers relevant to Site operations include:

• Resend, Inc.: Transactional email delivery service used to route contact form submissions to NorthQuinn. Personal Data submitted through the contact form is transmitted to Resend's infrastructure for delivery. Resend's practices are governed by its own privacy policy and processed under NorthQuinn's executed data processing agreement.
• Cloudflare, Inc.: Website hosting, DNS management, content delivery network services, and security infrastructure. Cloudflare may process network-level data (including IP addresses) as part of providing infrastructure services. NorthQuinn has entered into Cloudflare's Data Processing Addendum governing the processing of Personal Data. Cloudflare is certified under the EU-U.S. Data Privacy Framework and relies on that framework, together with its Standard Contractual Clauses, for EEA data transfers. Further information is available at cloudflare.com/privacypolicy.

5.2 Legal Obligations and Protective Disclosures

NorthQuinn may disclose Personal Data to governmental authorities, law enforcement, regulators, courts, or other authorized parties where NorthQuinn determines in good faith that disclosure is required or reasonably necessary to:

• Comply with a subpoena, court order, legal process, or binding governmental demand;
• Fulfill legal obligations under applicable federal, state, or foreign law;
• Investigate, prevent, or take action with respect to actual or suspected fraud, illegal activity, or violations of NorthQuinn's Terms and Conditions;
• Protect the rights, property, or safety of NorthQuinn, its personnel, or the public; or
• Enforce or defend NorthQuinn's legal rights and agreements.

Where legally permitted, NorthQuinn will endeavor to notify affected individuals prior to disclosing Personal Data pursuant to legal process.

5.3 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, asset sale, financing, or other change in corporate control, Personal Data held by NorthQuinn may be among the assets transferred to or evaluated by a successor or acquiror. NorthQuinn will use commercially reasonable efforts to provide prior notice and ensure that any successor entity is bound by data handling terms no less protective than those set forth in this Policy. If a successor entity's practices differ materially, affected individuals will be provided the opportunity to exercise applicable rights under Section 10 or Section 11 prior to such change becoming effective.

5.4 With Your Consent

NorthQuinn may disclose Personal Data to additional third parties where you have provided explicit, informed consent prior to such disclosure. You may withdraw consent at any time without affecting the lawfulness of Processing prior to withdrawal.

6. International Data Transfers

NorthQuinn is based in the United States. If you access the Site from outside the United States, your Personal Data may be transferred to, stored, and Processed in the United States, where privacy laws may not provide equivalent protection to the laws of your jurisdiction.

6.1 Transfer Mechanisms

For Personal Data transferred from the European Economic Area ("EEA"), the United Kingdom ("UK"), or Switzerland to the United States, NorthQuinn relies on the following transfer mechanisms as applicable:

• Standard Contractual Clauses (SCCs): The European Commission's Standard Contractual Clauses (Commission Implementing Decision 2021/914/EU, applied by module based on the nature of the transfer) govern EEA-to-U.S. transfers. Where NorthQuinn relies on SCCs, NorthQuinn conducts a Transfer Impact Assessment ("TIA") prior to or contemporaneously with initiating such transfers, assessing the legal framework of the destination country and implementing supplementary technical and organizational measures as warranted by the TIA findings. TIA documentation is maintained in NorthQuinn's internal data governance records and is available to competent supervisory authorities upon request.
• International Data Transfer Agreement (IDTA): The UK International Data Transfer Agreement approved by the UK Information Commissioner's Office, in the version current as of the transfer date, governs UK-to-U.S. transfers.
• EU-U.S. Data Privacy Framework: NorthQuinn has evaluated participation in the EU-U.S. Data Privacy Framework ("DPF"), the UK Extension to the DPF, and the Swiss-U.S. Data Privacy Framework administered by the U.S. Department of Commerce. As of the effective date of this Policy, NorthQuinn has not self-certified to the DPF. Accordingly, SCC-based transfers with accompanying TIAs serve as the operative mechanism for EEA and Swiss Personal Data. NorthQuinn will update this Section promptly upon completing DPF self-certification.
• Adequacy Decisions: Where the European Commission, UK Secretary of State, or Swiss Federal Council has issued an adequacy decision covering the destination country or a recognized certification framework, NorthQuinn may rely on such decision as the operative transfer mechanism.

6.2 Supplementary Technical Measures

Where NorthQuinn's TIA identifies elevated risk in the destination jurisdiction — including risk of government access to data in transit or at rest — NorthQuinn implements supplementary technical measures, including end-to-end encryption of Personal Data in transit using TLS 1.2 or higher, access controls limiting personnel access to Personal Data on a strict need-to-know basis, and data minimization practices limiting the categories and volume of Personal Data transferred. Supplementary measures are assessed on a transfer-by-transfer basis and documented in TIA records.

6.3 EU Representative (Article 27 GDPR)

Under Article 27 of the GDPR, controllers established outside the EEA that process EEA Personal Data are required to designate an EU-based representative, unless the processing is occasional, does not include large-scale processing of Special Categories of Personal Data, and is unlikely to result in a risk to the rights and freedoms of natural persons. NorthQuinn's current Site operations involve only occasional contact form submissions and web analytics from EEA residents and do not involve systematic or large-scale processing. NorthQuinn therefore relies on the "occasional processing" exemption in Article 27(2)(a) GDPR for current Site operations.

Forward-looking obligation: When NorthQuinn's AVERY platform becomes operational at production scale in customer environments that may include EEA residents' Personal Data, the "occasional processing" exemption will no longer apply. NorthQuinn will designate an EU Representative pursuant to Article 27 GDPR before initiating such processing. The identity and contact information of the designated EU Representative will be published in this Section at that time.

Requests regarding transfer mechanisms, TIA documentation, or supplementary measures may be directed to privacy@northquinn.com.

7. Data Retention

7.1 Retention Periods

7.2 Deletion and Anonymization

Upon expiration of the applicable retention period, NorthQuinn will securely delete or anonymize Personal Data consistent with its internal data lifecycle procedures. Where complete deletion is technically impracticable (such as data present in encrypted backup archives), NorthQuinn will isolate and protect such data from further Processing until deletion becomes feasible.

7.3 Deletion Requests

You may request deletion of your Personal Data at any time pursuant to Section 10 or Section 11, as applicable. NorthQuinn will honor valid deletion requests to the extent required or permitted by applicable law, including exceptions for legal holds, regulatory compliance, and fraud prevention.

8. Security of Personal Data

NorthQuinn implements administrative, technical, and physical safeguards designed to protect Personal Data against unauthorized access, acquisition, disclosure, alteration, or destruction. These measures include, without limitation:

• Transmission of Personal Data over encrypted HTTPS connections using industry-standard TLS protocols;
• Access controls limiting personnel access to Personal Data on a need-to-know basis;
• Logical separation of operational environments; and
• Periodic review of security practices consistent with applicable professional standards.

No information security program is impenetrable. NorthQuinn cannot guarantee absolute security against all possible threats. In the event of a security incident resulting in unauthorized access to Personal Data that triggers notification obligations under applicable law, NorthQuinn will comply with all such obligations.

If you believe your interaction with the Site is no longer secure or you suspect unauthorized access to your Personal Data, contact NorthQuinn immediately using the information in Section 16.

8.3 Breach Notification

In the event of a Personal Data breach that is likely to result in a risk to the rights and freedoms of natural persons, NorthQuinn will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with Article 33 of the GDPR. Where a breach is likely to result in a high risk to affected individuals, NorthQuinn will also notify those individuals without undue delay under Article 34 GDPR, unless a statutory exemption applies (such as where appropriate technical measures render the Personal Data unintelligible).

For U.S.-based individuals, NorthQuinn will provide notification of security incidents affecting Personal Data in accordance with the applicable state breach notification law or laws, which vary by jurisdiction as to timing, content, and delivery requirements. NorthQuinn maintains internal procedures to identify applicable notification obligations and respond accordingly.

9. Cookies and Similar Technologies

9.1 Technologies in Use

NorthQuinn uses a minimal set of cookies and similar technologies solely for site security and aggregate, anonymized analytics. NorthQuinn does not use advertising cookies, behavioral tracking technologies, or any cookie-based cross-site profiling.

9.2 What NorthQuinn Does Not Use

NorthQuinn does not deploy: advertising or retargeting cookies; third-party tracking pixels; social media tracking widgets that report back to social platforms; session replay tools; or any other technology that tracks your behavior across websites or builds advertising profiles.

9.3 Managing Cookies

You may configure your browser to block or delete cookies. Blocking strictly necessary Cloudflare security cookies may impair the Site's ability to serve content securely. Browser-specific cookie management instructions are available in your browser's help documentation. Cookie opt-out preferences are typically stored in a cookie; clearing cookies may reset your preferences.

9.4 Do Not Track

NorthQuinn honors the intent of browser-based Do Not Track ("DNT") signals. Because NorthQuinn does not engage in cross-site behavioral tracking or serve targeted advertising, NorthQuinn's practices are consistent with DNT signal intent regardless of whether a DNT header is received. NorthQuinn does not sell or share Personal Data as defined under the CCPA/CPRA.

10. U.S. State Privacy Rights

NorthQuinn recognizes privacy rights afforded to residents of U.S. states that have enacted comprehensive consumer privacy legislation. Enacted statutes include, without limitation: the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA); the Virginia Consumer Data Protection Act (VCDPA); the Colorado Privacy Act (CPA, effective July 1, 2023); the Connecticut Data Privacy Act (CTDPA, effective July 1, 2023); the Utah Consumer Privacy Act (UCPA); the Texas Data Privacy and Security Act (TDPSA, effective July 1, 2024); the Oregon Consumer Privacy Act (OCPA, effective July 1, 2024); the Montana Consumer Data Privacy Act (MCDPA, effective October 1, 2024); the Delaware Personal Data Privacy Act (DPDPA, effective January 1, 2025); the Iowa Consumer Data Protection Act (ICDPA); the Indiana Consumer Data Protection Act; the Tennessee Information Protection Act; the Florida Digital Bill of Rights; and similar statutes enacted or taking effect following this Policy's last amendment date. NorthQuinn monitors legislative developments and will apply applicable rights as statutes take effect. The following rights may be available to you depending on your state of residence, subject to the thresholds, exemptions, and definitions in each applicable statute.

10.1 Summary of Rights

• Right to Know / Access: The right to request disclosure of the categories and specific pieces of Personal Data NorthQuinn has collected, the categories of sources from which it was collected, the business or commercial purposes for collection and use, and the categories of third parties with whom it has been disclosed.
• Right to Correction: The right to request correction of inaccurate Personal Data that NorthQuinn maintains about you, taking into account the nature of the data and the purposes of Processing.
• Right to Deletion: The right to request that NorthQuinn delete Personal Data collected about you, subject to exceptions for legal obligations, completion of transactions, security investigations, free speech, internal uses consistent with reasonable expectations, legal claims, and other uses permitted by applicable law.
• Right to Portability: The right to receive a copy of Personal Data you have provided to NorthQuinn in a structured, commonly used, machine-readable format, where technically feasible and required by applicable law.
• Right to Opt-Out of Sale or Sharing: The right to opt out of the "sale" or "sharing" of your Personal Data for cross-context behavioral advertising as defined under applicable state law. As stated in Section 4, NorthQuinn does not sell Personal Data and does not share Personal Data for cross-context behavioral advertising; this right is accordingly not presently applicable to NorthQuinn's practices.
• Right to Non-Discrimination: The right not to receive discriminatory treatment for exercising privacy rights. NorthQuinn will not deny, degrade, or condition services based on your exercise of rights under this Section.
• Right to Limit Sensitive Data Use: Where applicable state law provides, the right to direct NorthQuinn to limit its use of Sensitive Personal Data. NorthQuinn does not collect Sensitive Personal Data through the Site; this right is accordingly not presently applicable to NorthQuinn's practices.

10.2 California-Specific Disclosures (CCPA/CPRA)

In the preceding twelve (12) months, NorthQuinn has collected the following categories of Personal Information as defined under the CCPA: Identifiers (name, email address, IP address); Internet or Electronic Network Activity Information (browsing activity on the Site); and Professional or Employment-Related Information (company name, if provided). NorthQuinn has not sold or shared any such categories for cross-context behavioral advertising. California residents may submit requests under Section 10.3 and may direct unresolved complaints to the California Privacy Protection Agency or the California Attorney General.

10.3 Submitting a Rights Request

To exercise any rights under this Section, submit a verifiable request to privacy@northquinn.com with the subject line "Privacy Rights Request." Your request must include: (i) identification of the specific right(s) you wish to exercise; (ii) sufficient information to enable NorthQuinn to verify your identity as required under applicable law; and (iii) your state of residence. NorthQuinn will acknowledge receipt within ten (10) business days and respond substantively within the period required by applicable law (generally forty-five (45) calendar days, subject to permitted extensions). NorthQuinn may request additional information to complete verification. You may designate an authorized agent by providing written authorization or evidence of power of attorney; NorthQuinn may independently verify your identity before honoring agent-submitted requests.

10.4 Appeal Process

If NorthQuinn declines to take action on a request, you will be notified of the reason and your right to appeal. Appeals should be submitted to privacy@northquinn.com with the subject line "Privacy Request Appeal." NorthQuinn will respond within the period required by applicable law and inform you of the outcome and any available remedies, including the right to lodge a complaint with the applicable state supervisory or enforcement authority.

11. EEA and UK Data Subject Rights

If you are located in the European Economic Area or the United Kingdom, you have the following rights under Regulation (EU) 2016/679 (General Data Protection Regulation) or the UK GDPR, as applicable. NorthQuinn will respond to verifiable requests without undue delay and within one (1) calendar month, subject to permitted extensions of up to two (2) additional months for complex or multiple requests with prior written notice.

• Right of Access (Art. 15 GDPR): The right to obtain confirmation of whether NorthQuinn Processes your Personal Data and, if so, to receive a copy together with the information specified in Article 15(1).
• Right to Rectification (Art. 16 GDPR): The right to obtain without undue delay the correction of inaccurate Personal Data and the completion of incomplete Personal Data, including by means of a supplementary statement.
• Right to Erasure (Art. 17 GDPR): The right to request deletion of Personal Data where the data is no longer necessary for the purpose collected; consent has been withdrawn and no other legal basis exists; you have objected and there are no overriding legitimate grounds; Processing is unlawful; or deletion is required to comply with a legal obligation.
• Right to Restriction of Processing (Art. 18 GDPR): The right to request that NorthQuinn restrict Processing in specified circumstances, including during verification of accuracy disputes, pending assessment of legitimate interest grounds, or where Processing is unlawful but you oppose erasure.
• Right to Data Portability (Art. 20 GDPR): The right to receive Personal Data you have provided to NorthQuinn in a structured, commonly used, machine-readable format, and to transmit that data to another controller, where Processing is based on consent or contract and carried out by automated means.
• Right to Object (Art. 21 GDPR): The right to object at any time to Processing based on NorthQuinn's legitimate interests on grounds relating to your particular situation. NorthQuinn will cease such Processing unless it can demonstrate compelling legitimate grounds overriding your interests, rights, and freedoms, or unless Processing is necessary for legal claims.
• Rights Regarding Automated Decision-Making (Art. 22 GDPR): The right not to be subject to decisions based solely on automated Processing that produce legal or similarly significant effects. NorthQuinn does not engage in such automated decision-making through the Site.

To exercise any of the foregoing rights, contact NorthQuinn at privacy@northquinn.com. NorthQuinn will respond to rights requests within one (1) calendar month of receipt. NorthQuinn may extend this period by up to two (2) additional months for complex or multiple requests; if an extension is required, NorthQuinn will notify you within the initial one-month period with reasons for the extension.

If you remain unsatisfied with NorthQuinn's response, you have the right to lodge a complaint with a supervisory authority. NorthQuinn, as a U.S.-based controller with no EU establishment, does not have a lead supervisory authority under Article 56 GDPR. The competent supervisory authority for your complaint is the authority of the EU Member State in which you habitually reside or work, or in which the alleged infringement occurred. UK residents may lodge complaints with the Information Commissioner's Office (ICO) at ico.org.uk. Swiss residents may contact the Federal Data Protection and Information Commissioner (FDPIC) at fdpic.ch.

12. Children's Privacy

The Site is directed exclusively to business and professional audiences and is not intended for use by, and does not knowingly collect Personal Data from, children under the age of thirteen (13). NorthQuinn does not knowingly solicit or receive Personal Data from children, and the Site is not designed for or directed at children under any applicable law, including the Children's Online Privacy Protection Act ("COPPA").

If NorthQuinn becomes aware that it has inadvertently collected Personal Data from a child under the age of thirteen without verifiable parental consent, NorthQuinn will take commercially reasonable steps to delete such information as promptly as practicable. If you are a parent or legal guardian and believe your child has submitted Personal Data to NorthQuinn without your consent, contact NorthQuinn immediately at privacy@northquinn.com.

13. Security Research and Vulnerability Disclosure

NorthQuinn operates a Vulnerability Disclosure Program ("VDP") for security researchers who identify potential vulnerabilities in NorthQuinn-operated systems. The VDP is governed by NorthQuinn's Vulnerability Disclosure Policy, published at northquinn.com/security.html. Security research reports should be submitted to abuse@northquinn.com.

Personal data submitted through the VDP channel — including researcher contact information and technical proof-of-concept materials — is processed in accordance with NorthQuinn's Security Research Data Processing Notice, which supplements this Policy and provides GDPR Articles 13/14 disclosures specific to security research submissions.

Personal data generated by adversarial interactions with NorthQuinn's threat intelligence research infrastructure — including honeynets, deception technology deployments, and sensor telemetry collection systems — is processed in accordance with NorthQuinn's Threat Intelligence Operations Notice, which supplements this Policy with GDPR Article 6(1)(f) legitimate interest disclosures specific to threat intelligence infrastructure operations.

14. Third-Party Websites and Services

The Site may contain hyperlinks to third-party websites, tools, or resources not owned, operated, or controlled by NorthQuinn. This Policy applies solely to Personal Data collected by NorthQuinn through the Site and does not extend to information collected by third-party destinations accessed through such links.

NorthQuinn exercises no control over and assumes no responsibility for the content, privacy policies, or data practices of third-party websites. The inclusion of any link does not constitute an endorsement of the linked site or its operator. You access third-party websites at your own risk and are encouraged to review their privacy policies before submitting any Personal Data.

15. Changes to This Policy

NorthQuinn reserves the right to modify, update, or otherwise amend this Policy at any time in its sole discretion to reflect: (i) changes in applicable law or regulatory guidance; (ii) changes in NorthQuinn's data Processing activities; (iii) changes in technology or security practices; or (iv) other legitimate business developments. NorthQuinn will not apply material changes to previously collected Personal Data in a manner materially less protective than the terms in effect at the time of collection without providing prior notice and, where required by applicable law, obtaining your consent.

Material changes will be communicated by updating the "Last Amended" date at the top of this Policy and, where appropriate, by posting a notice on the Site homepage or providing direct notice to individuals whose contact information is on file. Your continued use of the Site following the effective date of any amendment constitutes your acceptance of the updated Policy. Prior versions of this Policy are available upon request at privacy@northquinn.com.

16. Contact Information

NorthQuinn Inc. is the Data Controller for Personal Data collected through the Site. All privacy-related inquiries, requests, complaints, and correspondence should be directed to:

NorthQuinn endeavors to resolve all privacy inquiries promptly and directly. If you are dissatisfied with NorthQuinn's response, you may have the right to escalate to the applicable data protection or consumer protection authority as described in Section 10 or Section 11.