Threat Intelligence Operations Notice

This Threat Intelligence Operations Notice ("TI Notice") is issued by NorthQuinn Inc., a Delaware corporation ("NorthQuinn," "we," "us," or "our"). It constitutes a supplemental data processing notice that extends NorthQuinn's Privacy Policy to cover personal data processed in connection with NorthQuinn's threat intelligence research infrastructure, including honeynets, deception technology deployments, and adversary telemetry collection systems (collectively, "Threat Intelligence Infrastructure"). This TI Notice supplements, and should be read in conjunction with, the Privacy Policy. In the event of a conflict between this TI Notice and the Privacy Policy with respect to the subject matter herein, this TI Notice controls.

1. Scope and Relationship to Privacy Policy

NorthQuinn's Privacy Policy governs the collection and processing of personal data through www.northquinn.com and related site infrastructure. That scope does not encompass data processed in connection with NorthQuinn's Threat Intelligence Infrastructure, which operates independently of the public-facing website and involves materially distinct data categories, processing purposes, legal bases, and retention frameworks.

This TI Notice governs the processing of personal data collected or generated by NorthQuinn-operated Threat Intelligence Infrastructure, including:

• Honeynets and honeynet nodes deployed by NorthQuinn in any geographic jurisdiction;
• Deception technology deployments, including honeypots, honey tokens, and decoy services operating under controlled NorthQuinn infrastructure;
• Sensor telemetry collection systems that observe and record adversarial activity directed at NorthQuinn-operated infrastructure; and
• Downstream analytical environments that ingest, process, or store data originating from the foregoing sources.

This TI Notice does not govern:

• Personal data collected through NorthQuinn's client engagement infrastructure, which is governed by the applicable services agreement between NorthQuinn and the relevant client entity;
• Personal data of NorthQuinn employees or contractors; or
• Personal data submitted through www.northquinn.com, which is governed exclusively by the Privacy Policy.

2. Definitions

Capitalized terms used in this TI Notice and not otherwise defined herein have the meanings ascribed to them in the Privacy Policy or, as applicable, in Regulation (EU) 2016/679 (the "GDPR"). The following additional terms apply specifically to this TI Notice:

3. Categories of Data Collected

NorthQuinn's Threat Intelligence Infrastructure collects only data that is voluntarily transmitted by an unauthorized party in the course of an unsolicited interaction with that infrastructure. NorthQuinn does not collect data from authorized users, legitimate network traffic, or incidental third parties who have not directed interactions at the Threat Intelligence Infrastructure.

The following categories of Adversary Telemetry are collected:

4. Legal Basis for Processing

4.1 Applicable Legal Basis

NorthQuinn processes Adversary Telemetry on the legal basis of legitimate interests pursuant to Article 6(1)(f) of the GDPR. NorthQuinn has conducted a legitimate interest assessment ("LIA") as required by applicable guidance, the material findings of which are set forth in Sections 4.2 through 4.4 below.

4.2 Legitimate Interest Pursued

NorthQuinn pursues the following legitimate interests through the processing described in this TI Notice:

Cybersecurity research and threat intelligence development:

Systematically documenting adversary TTPs, malware families, command-and-control infrastructure, and attack campaigns to develop actionable threat intelligence for NorthQuinn's own defensive operations and for contribution to the broader security community;

Protection of NorthQuinn's information systems:

Identifying adversarial tooling, infrastructure, and techniques directed at NorthQuinn-operated systems in order to develop and validate detection logic and hardening measures;

Protection of the broader internet community:

Contributing indicators of compromise, malware samples, and threat intelligence to publicly accessible threat intelligence databases and coordinated disclosure programs, enabling third-party defenders to detect and respond to the same adversarial activity; and

Prevention and deterrence of cybercrime:

Supporting the security research community and law enforcement ecosystem through responsible disclosure of novel adversarial techniques and indicators.

4.3 Necessity Assessment

The processing described in this TI Notice is necessary to achieve the legitimate interests identified in Section 4.2. The data can be obtained only through direct observation of unsolicited adversarial activity. No less privacy-invasive means exist to achieve equivalent research outcomes, because:

• Adversary TTPs and novel malware variants cannot be documented through synthetic generation or publicly available datasets alone, as they reflect real-world operational behavior that is not available by any other lawful means;
• Attribution and actor clustering across campaigns requires correlation of behavioral and network-layer indicators that are only generated through live interaction with adversarial tooling;
• The Threat Intelligence Infrastructure presents only the minimum functionality required to elicit meaningful adversarial interaction; and
• Data collection is passive and limited to what is voluntarily transmitted by the interacting party; NorthQuinn does not perform active exploitation, scanning, or outbound solicitation in connection with the Threat Intelligence Infrastructure.

4.4 Balancing Test

NorthQuinn has assessed the interests, rights, and freedoms of data subjects against the legitimate interests identified in Section 4.2 and concludes that those legitimate interests are not overridden, for the following reasons:

Nature of data subjects:

All data subjects whose personal data is processed under this TI Notice are parties who have, without authorization, directed adversarial activity at NorthQuinn-operated infrastructure. None are customers, legitimate users, or authorized parties with respect to the Threat Intelligence Infrastructure. The reasonable expectation of a party engaged in unauthorized network access activity does not include a legitimate privacy interest in the fruits of that unauthorized activity;

Voluntary transmission:

All Adversary Telemetry is data that the data subject voluntarily transmitted in the course of initiating and pursuing an unauthorized interaction. NorthQuinn receives only what the data subject affirmatively transmits;

Data minimization:

Collection is confined to what is transmitted to the Threat Intelligence Infrastructure; NorthQuinn does not enrich, supplement, or combine Adversary Telemetry with third-party data sources for the purpose of identifying natural persons;

Pseudonymization:

Source IP addresses and other directly identifying elements are pseudonymized before ingestion into downstream analytical environments, materially reducing the risk of identification of natural persons in the course of downstream processing;

Research purpose limitation:

Processing is conducted exclusively for the Research Purpose defined in Section 2; Adversary Telemetry is not used for commercial profiling, behavioral advertising, or any purpose unrelated to cybersecurity research and defense; and

Community benefit:

The outputs of the processing, in the form of threat intelligence contributions, materially benefit the broader internet community's ability to detect and defend against the same adversarial activity, representing a significant public interest in cybersecurity.

NorthQuinn's LIA documentation, including a complete record of the balancing assessment, is maintained in NorthQuinn's internal data governance records and is available to competent supervisory authorities upon request directed to privacy@northquinn.com.

5. Data Minimization and Pseudonymization

5.1 Collection Limitation

NorthQuinn collects only data that is affirmatively and voluntarily transmitted by an adversarial party to or through the Threat Intelligence Infrastructure in the course of an unsolicited interaction. NorthQuinn does not collect data from or about parties who have not initiated an interaction with the Threat Intelligence Infrastructure. NorthQuinn does not supplement Adversary Telemetry with data obtained from third-party data brokers, commercial databases, open-source intelligence aggregation tools, or any other external source for the purpose of re-identifying pseudonymized data.

5.2 Pseudonymization of Source IP Addresses

Source IP addresses collected by the Threat Intelligence Infrastructure are pseudonymized via cryptographic one-way hashing prior to ingestion into any downstream analytical environment, including NorthQuinn's AVERY platform training datasets. The hashing process employs a per-dataset cryptographic salt that is maintained separately from the pseudonymized dataset under access controls limiting access to authorized personnel. The salt and the pseudonymized dataset are not stored in conjunction with each other in any production analytical environment. Re-identification of pseudonymized source IP addresses from the hashed output alone is computationally infeasible without access to the relevant salt material.

5.3 Incidental Third-Party Data

NorthQuinn's Threat Intelligence Infrastructure is designed to capture data transmitted by adversarial parties and is not positioned on any network path used by legitimate or authorized users. In the event that an adversarial party transmits data derived from third-party systems (such as harvested credential sets, exfiltrated file contents, or staged data from previously compromised hosts), such data may be incidentally captured as Adversary Telemetry. NorthQuinn applies the procedures in Section 5.4 to identify, segregate, and process such incidental third-party data.

5.4 Automated Personal Data Screening

NorthQuinn employs automated screening procedures to identify personal data inadvertently present in Adversary Telemetry, including personal data embedded in payload artifacts, session telemetry, or transmitted credential sets. Upon identification, such personal data is segregated from the general Adversary Telemetry dataset, subjected to restricted access controls, and processed only to the extent necessary for the following purposes: (i) assessment of the nature and scope of any compromise from which such data may have originated; (ii) responsible disclosure to relevant parties where identification and disclosure are feasible and consistent with applicable law; and (iii) deletion or anonymization as promptly as practicable following the conclusion of any necessary assessment or disclosure process.

6. Retention

NorthQuinn applies the following retention framework to Adversary Telemetry, reflecting the nature of each data category and the Research Purpose for which it is processed:

Upon expiration of the applicable retention period, NorthQuinn will securely delete or irrevocably anonymize the relevant data consistent with its internal data lifecycle procedures. Where complete deletion is technically impracticable (such as data present in encrypted backup archives), NorthQuinn will isolate and protect such data from further analytical Processing until deletion becomes feasible.

7. No Active Solicitation

NorthQuinn's Threat Intelligence Infrastructure operates on a strictly passive observation basis. NorthQuinn does not engage in any of the following activities in connection with the Threat Intelligence Infrastructure:

• Outbound scanning, probing, or network reconnaissance directed at third-party systems;
• Active solicitation, enticement, or luring of adversarial parties via outbound communications of any kind;
• Advertising or promotion of the Threat Intelligence Infrastructure to attract interactions from unauthorized parties;
• Exploitation of vulnerabilities in third-party systems to capture adversarial traffic;
• Participation in or initiation of any form of hack-back, active defense, or offensive counter-operation against parties observed in Adversary Telemetry; or
• Any active engagement designed to entrap, deceive, or mislead parties outside the scope of passive network-layer presentation of the Threat Intelligence Infrastructure to the public internet.

All interactions captured by the Threat Intelligence Infrastructure are initiated exclusively by the interacting party. NorthQuinn's Threat Intelligence Infrastructure responds to inbound connection attempts in accordance with the emulated service profile; it does not initiate or solicit connections.

8. Operational Containment

NorthQuinn implements technical and organizational measures to ensure that the Threat Intelligence Infrastructure is operationally isolated and cannot be weaponized by adversarial parties against third-party systems. NorthQuinn does not publicly disclose the specific technical architecture, sensor placement, or network topology of its Threat Intelligence Infrastructure. The following categorical commitments govern operational containment:

Network isolation:

Threat Intelligence Infrastructure is deployed in network segments that are physically or logically isolated from NorthQuinn's production systems, client-facing infrastructure, and any environment containing customer or client data. No lateral network path exists between the Threat Intelligence Infrastructure and production environments.

Egress filtering:

Outbound network communication from Threat Intelligence Infrastructure is subject to strict egress controls designed to prevent adversarial parties from using NorthQuinn's infrastructure as a relay, proxy, or launchpad for attacks against third-party systems. Egress filtering is implemented at the network boundary and is not dependent on the correctness of application-layer controls.

Out-of-band log storage:

Adversary Telemetry logs are stored in out-of-band collection infrastructure that is not accessible from the Threat Intelligence Infrastructure itself, preventing adversarial parties who achieve interaction with the infrastructure from accessing, modifying, or deleting log records.

Absence of real credentials and pivot paths:

The Threat Intelligence Infrastructure does not contain real credentials, API keys, access tokens, or any authentication material that would provide meaningful access to NorthQuinn's production systems, client environments, or third-party services. No real pivot path exists from the Threat Intelligence Infrastructure to any system of value. Credential artifacts present within the Threat Intelligence Infrastructure are fabricated for the purpose of eliciting and observing credential-based adversarial activity.

9. International Transfers

NorthQuinn's Threat Intelligence Infrastructure may be deployed in data centers or cloud infrastructure located in jurisdictions outside the United States, including within the European Economic Area. Adversary Telemetry generated by infrastructure located in EEA jurisdictions may be transferred to NorthQuinn's analytical environments in the United States for processing in accordance with this TI Notice.

All international transfers of Adversary Telemetry containing personal data are subject to the transfer mechanisms and supplementary technical measures described in Section 6 of the Privacy Policy (International Data Transfers), including Standard Contractual Clauses and accompanying Transfer Impact Assessments where applicable. The EEA-source provenance of data does not alter the pseudonymization and minimization obligations set forth in Section 5 of this TI Notice, which apply irrespective of the jurisdiction in which the data was collected.

Requests regarding the transfer mechanisms applicable to specific Threat Intelligence Infrastructure deployments may be directed to privacy@northquinn.com.

10. EU Representative (Article 27 GDPR)

NorthQuinn evaluates its obligations under Article 27 of the GDPR with respect to the processing described in this TI Notice on an ongoing basis. The processing of Adversary Telemetry generated by EEA-located Threat Intelligence Infrastructure constitutes processing of personal data of individuals in the EEA by a controller not established in the EEA, and accordingly falls within the territorial scope of the GDPR pursuant to Article 3(2) thereof.

NorthQuinn's current Threat Intelligence Infrastructure operations involving EEA-located data subjects are assessed against the criteria set forth in Article 27(2) GDPR, including the criteria relating to whether the processing is other than occasional and whether it involves systematic monitoring of EEA individuals on a large scale. NorthQuinn will designate an EU Representative pursuant to Article 27 GDPR before any Threat Intelligence Infrastructure deployment that meets the applicable thresholds for mandatory representative designation.

The identity and contact information of any designated EU Representative will be published in this Section and in Section 6.3 of the Privacy Policy at the time of designation. Pending such designation, inquiries regarding Article 27 obligations and representative designation status may be directed to privacy@northquinn.com. The forward-looking representative designation commitment set forth in Section 6.3 of the Privacy Policy applies equally to Threat Intelligence Infrastructure processing.

11. Data Subject Rights

11.1 Acknowledgment of Rights

NorthQuinn acknowledges that natural persons whose IP addresses or other identifying information appears in Adversary Telemetry are data subjects for purposes of the GDPR and applicable U.S. state privacy laws, and that such persons may hold rights with respect to that personal data notwithstanding the unauthorized nature of the activity that gave rise to its collection. NorthQuinn does not disclaim data subject rights on the basis that the processing was initiated by the data subject's own unauthorized conduct, except to the extent that applicable law expressly limits or extinguishes such rights in the relevant context.

11.2 Applicable Rights

Data subjects whose personal data is processed under this TI Notice may, subject to applicable law and the limitations described in Section 11.3, exercise the following rights by submitting a verifiable request to privacy@northquinn.com with the subject line "TI Notice Data Subject Request":

Right of Access (Art. 15 GDPR):

The right to obtain confirmation of whether personal data relating to the data subject is processed under this TI Notice and, if so, to receive a copy and the information specified in Article 15(1) GDPR;

Right to Erasure (Art. 17 GDPR):

The right to request deletion of personal data where the applicable grounds under Article 17(1) are established;

Right to Restriction (Art. 18 GDPR):

The right to request restriction of processing in the circumstances specified in Article 18(1);

Right to Object (Art. 21 GDPR):

The right to object to processing based on legitimate interests on grounds relating to the data subject's particular situation. NorthQuinn will cease processing unless it can demonstrate compelling legitimate grounds that override the data subject's interests, rights, and freedoms, or unless processing is necessary for the establishment, exercise, or defense of legal claims; and

U.S. State Privacy Rights:

Residents of U.S. states with applicable comprehensive privacy legislation may exercise the rights described in Section 10 of the Privacy Policy with respect to personal data processed under this TI Notice.

11.3 Verification and Limitations

Requests submitted under Section 11.2 must include reasonable identity verification information sufficient to enable NorthQuinn to identify the relevant personal data in its systems, including at minimum the source IP address or other identifying information with respect to which rights are being exercised, and the approximate time period during which the relevant interactions occurred. Requests that do not include sufficient identifying information to locate the relevant personal data may not be fulfilled.

NorthQuinn may decline or limit requests where:

• Fulfillment would require NorthQuinn to disclose information that would undermine the security, integrity, or operational effectiveness of the Threat Intelligence Infrastructure;
• Processing is necessary for the establishment, exercise, or defense of legal claims;
• Processing is subject to a legal hold or law enforcement preservation request;
• Applicable law provides that the relevant personal data has been pseudonymized and NorthQuinn does not retain sufficient re-identification material to fulfill the request; or
• Applicable law otherwise permits a restriction or exemption to the right being exercised.

NorthQuinn will respond to verifiable requests without undue delay and within one (1) calendar month, subject to permitted extensions. If NorthQuinn declines a request in whole or in part, it will provide written reasons and information regarding the data subject's right to lodge a complaint with the applicable supervisory authority. EEA residents may refer to Section 11 of the Privacy Policy for applicable supervisory authority contact information.

12. Sharing with Threat Intelligence Community

12.1 Community Sharing Practices

NorthQuinn shares threat intelligence outputs derived from Adversary Telemetry with the broader security community as part of its Research Purpose. Such sharing is conducted through established threat intelligence platforms and coordinated disclosure channels, including without limitation:

• MalwareBazaar (bazaar.abuse.ch) — for submission of malware samples and payload artifacts;
• ThreatFox (threatfox.abuse.ch) — for submission of indicators of compromise;
• DShield / SANS Internet Storm Center — for submission of network-level attack indicators;
• VirusTotal — for submission of malware samples and file-based indicators for community analysis;
• Shadowserver Foundation — for submission of IOCs and coordinated disclosure of novel threats;
• CISA ICS-CERT and analogous governmental cybersecurity agencies — for disclosure of threats affecting critical infrastructure or requiring regulatory notification; and
• MITRE ATT&CK knowledge base — for contribution of novel TTP documentation following responsible disclosure review.

12.2 Pseudonymization Before Community Sharing

NorthQuinn applies the following practices with respect to the personal data dimension of community sharing:

Source IP addresses:

Raw source IP addresses are pseudonymized prior to submission to any community threat intelligence platform where individual attribution is not necessary for the defensive purpose of the submission. Where submission of un-pseudonymized source IP addresses is necessary to enable effective blocking, detection, or attribution by recipient platforms or law enforcement, such submission is made only to platforms with applicable data governance frameworks (including Shadowserver Foundation, CISA ICS-CERT, and similar authorized recipients) and only to the extent necessary for the stated defensive purpose;

Malware samples and payload artifacts:

Malware samples and payload artifacts submitted to community platforms do not contain personal data in the ordinary course. Where NorthQuinn identifies personal data within a payload artifact (such as exfiltrated credential sets or third-party data embedded in malware), that personal data is removed or redacted prior to community submission; and

TTP and behavioral documentation:

Published research, threat intelligence reports, and MITRE ATT&CK contributions are reviewed prior to publication to ensure that they do not contain personal data of natural persons in a form that could enable identification of individuals, consistent with the responsible disclosure principles that govern NorthQuinn's research publications.

NorthQuinn's community sharing activities are consistent with the legitimate interest basis documented in Section 4 of this TI Notice. Community sharing is an integral component of the Research Purpose and serves the public interest in effective cybersecurity defense.

13. Contact

NorthQuinn Inc. is the Data Controller for personal data processed under this TI Notice. All inquiries, data subject requests, and correspondence relating to this TI Notice should be directed as follows:

NorthQuinn endeavors to resolve all inquiries under this TI Notice promptly and directly. If you are dissatisfied with NorthQuinn's response, you may have the right to escalate to the applicable data protection or consumer protection authority as described in Section 11 of the Privacy Policy.

This TI Notice was last amended on May 19, 2026. NorthQuinn reserves the right to modify this TI Notice to reflect changes in its Threat Intelligence Infrastructure operations, applicable law, or data governance practices. Material amendments will be communicated by updating the "Last Amended" date at the top of this page. Prior versions are available upon request.