PRIVACY POLICY

Effective Date: January 1, 2026

This Privacy Policy (“Policy”) constitutes a statement of the data collection, processing, storage, and protection practices of Next Fraga Investments LLC, a limited liability company organized under the laws of the State of Florida (“Company,” “we,” “us,” or “our”), in connection with your (“User,” “Investor,” “you,” or “your”) access to and use of the Company’s website, digital interfaces, communications, services, and investment-related platform (collectively, the “Platform”). This Policy governs how the Company collects, uses, maintains, discloses, and safeguards personal and non-personal information obtained through the Platform and related interactions, including investor onboarding, verification processes, and ongoing communications.

BY ACCESSING, BROWSING, OR USING THE PLATFORM, OR BY SUBMITTING INFORMATION TO THE COMPANY, YOU EXPRESSLY ACKNOWLEDGE AND AGREE THAT YOU HAVE READ, UNDERSTOOD, AND CONSENT TO THE COLLECTION, USE, AND DISCLOSURE OF YOUR INFORMATION AS DESCRIBED IN THIS PRIVACY POLICY.

1. SCOPE AND APPLICABILITY

This Privacy Policy applies to all information collected, directly or indirectly, from individuals who access or interact with the Platform, including but not limited to prospective investors, approved users, advisors, and other participants.

The scope of this Policy includes:

A. Information submitted through onboarding, registration, or inquiry forms
B. Data collected during investor qualification and verification processes
C. Communications between you and the Company
D. Information obtained through third-party service providers engaged by the Company
E. Technical and usage data generated through interaction with the Platform

2. INFORMATION WE COLLECT

The Company may collect, process, and maintain various categories of information, including:

A. Personal Identification Information

Information that identifies or can be used to identify an individual, including:

1. Full legal name
2. Email address
3. Telephone number
4. Residential or business address
5. Date of birth
6. Government-issued identification details (e.g., passport, driver’s license), where required

B. Financial and Investor Qualification Information

Information necessary to evaluate eligibility for participation in private investment opportunities,
including:

1. Net worth and income ranges
2. Accreditation or qualified investor status
3. Investment objectives and experience
4. Risk tolerance and financial sophistication indicators
5. Banking or financial account details where relevant to transactions

C. Compliance and Verification Information

Information collected to satisfy legal and regulatory obligations, including:

1. Know Your Customer (KYC) documentation
2. Anti-Money Laundering (AML) screening results
3. Sanctions and watchlist checks
4. Source-of-funds and source-of-wealth information

D. Technical and Usage Data

Information automatically collected through interaction with the Platform, including:

1. IP address and approximate geolocation
2. Device identifiers and browser type
3. Operating system and access configuration
4. Session activity, navigation patterns, and timestamps

E. Communications and Correspondence

Information contained in or derived from communications with the Company, including:

1. Email correspondence
2. Submitted inquiries or requests
3. Uploaded documents and attachments
4. Records of discussions or interactions

F. Derived and Analytical Data

Information generated through internal analysis, including:

1. User engagement metrics
2. Risk scoring or categorization
3. Platform usage patterns

3. METHODS OF COLLECTION

The Company collects information through multiple channels, including:

A. Direct Collection

Information voluntarily provided by you through:

1. Account registration or onboarding
2. Investor qualification submissions
3. Forms, surveys, or inquiries

B. Automated Collection

Information collected through technological means, including:

1. Cookies and tracking technologies
2. Server logs and analytics systems
3. Security monitoring tools

C. Third-Party Sources

Information obtained from:

1. Identity verification and compliance providers
2. Financial institutions or transactional intermediaries
3. Public databases or regulatory sources

D. Communications

Information obtained through direct interactions, including:

1. Email exchanges
2. Calls or consultations

4. PURPOSES OF PROCESSING

The Company processes personal information for legitimate business and legal purposes, including:

A. Platform Administration and Access Control

1. Establishing and managing user accounts
2. Granting, restricting, or revoking access
3. Maintaining system integrity and security

B. Investor Qualification and Due Diligence

1. Evaluating eligibility for participation in private offerings
2. Verifying accreditation or investor status
3. Conducting suitability assessments

C. Legal and Regulatory Compliance

1. Satisfying AML, KYC, and sanctions obligations
2. Complying with applicable securities laws and exemptions
3. Responding to lawful requests from regulatory authorities

D. Communications and Disclosures

1. Providing notices, updates, and required disclosures
2. Responding to inquiries and requests
3. Delivering operational or transactional information

E. Platform Optimization and Security

1. Monitoring usage and performance
2. Detecting and preventing fraud, abuse, or unauthorized activity
3. Improving user experience and system functionality

F. Internal Business Operations

1. Recordkeeping and documentation
2. Risk management and compliance oversight
3. Strategic and operational analysis

5. LEGAL BASES FOR PROCESSING

To the extent applicable, the Company processes personal information on the basis of:

A. Performance of contractual obligations
B. Compliance with legal and regulatory requirements
C. Legitimate business interests, including platform operation and risk management
D. Consent, where expressly obtained

The Company processes personal data strictly in accordance with applicable law under one or more
of the following legal bases:

A. Performance of a contract or pre-contractual measures
B. Compliance with legal and regulatory obligations, including AML/KYC requirements
C. Legitimate interests pursued by the Company, provided such interests are not overridden by the

rights of the data subject

D. Explicit consent, where required

6. DISCLOSURE AND SHARING OF INFORMATION

The Company may disclose personal information in a controlled and limited manner to:

A. Service Providers

Third parties engaged to support operations, including:

1. Cloud infrastructure providers
2. Identity verification and compliance vendors
3. Data analytics and security providers

B. Professional Advisors

Including:

1. Legal counsel
2. Accountants and auditors
3. Compliance and regulatory consultants

C. Transactional and Financial Counterparties

Where necessary in connection with investment activities:

1. Lenders and financing entities
2. Investment vehicles or issuers
3. Co-investors or joint venture participants

D. Regulatory and Government Authorities

Where required by law or in response to lawful requests

E. Corporate Transactions

In connection with mergers, acquisitions, restructuring, or asset transfers

The Company does not sell personal information and does not disclose information for unrelated commercial exploitation

7. DATA RETENTION

Personal information is retained only for as long as necessary to:

A. Fulfill the purposes outlined in this Policy
B. Comply with legal, regulatory, and recordkeeping requirements
C. Resolve disputes and enforce agreements

Retention periods may extend beyond termination of the user relationship where required by law or
justified by legitimate business interests

8. DATA SECURITY

The Company employs commercially reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, or alteration.

A. Encryption of sensitive data where appropriate
B. Access restrictions based on role and necessity
C. Continuous monitoring for vulnerabilities and threats
D. Secure storage and infrastructure protocols

Notwithstanding these measures, no system can guarantee absolute security, and users acknowledge
the inherent risks associated with digital transmission and storage.

9. INTERNATIONAL DATA TRANSFERS

Information collected through the Platform may be transferred to, stored, and processed in the United States or other jurisdictions where the Company or its service providers operate

By using the Platform, you consent to such transfers and acknowledge that data protection laws may differ from those in your jurisdiction.

Where personal data is transferred outside of the user’s jurisdiction, the Company implements appropriate safeguards, which may include Standard Contractual Clauses (SCCs), data processing agreements, or other legally recognized transfer mechanisms.

Transfers are conducted only where adequate levels of protection are ensured in accordance with applicable law.

10. USER RIGHTS AND REQUESTS

Subject to applicable law, users may have rights to:

A. Request access to personal information
B. Request correction of inaccurate data
C. Request deletion of personal information
D. Restrict or object to certain processing activities
E. Request portability of data

The Company reserves the right to verify identity before fulfilling requests and may deny requests where permitted by law or where compliance would interfere with legal obligations.

11. COOKIES AND TRACKING TECHNOLOGIES

The Platform utilizes cookies and similar technologies to:

A. Enable core functionality
B. Maintain session integrity
C. Analyze usage and performance
D. Enhance user experience

Users may manage cookie preferences through browser settings; however, disabling certain technologies may impact functionality.

12. THIRD-PARTY SERVICES AND LINKS

The Platform may include links to third-party websites or services.

The Company does not control and is not responsible for:

A. The privacy practices of third parties
B. The accuracy or content of external sites

Users access third-party services at their own risk.

13. CHILDREN’S PRIVACY

The Platform is not directed to individuals under the age of eighteen (18), and the Company does not knowingly collect personal information from minors.

If such information is identified, it will be promptly deleted.

14. DATA ACCURACY AND USER RESPONSIBILITY

Users are responsible for ensuring that all information provided is accurate, complete, and current. The Company shall not be liable for decisions or outcomes resulting from inaccurate or incomplete information supplied by users.

15. AUTOMATED PROCESSING AND ANALYTICS

The Company may utilize automated systems to support:

A. Risk assessment and categorization
B. Compliance screening and monitoring
C. Platform analytics and optimization

Such systems are used as decision-support tools and do not independently determine investment outcomes

16. DO NOT TRACK SIGNALS

Due to the absence of a consistent industry standard, the Platform does not currently respond to “Do
Not Track” signals.

17. LIMITATION OF LIABILITY

To the fullest extent permitted by law, the Company shall not be liable for any indirect, incidental, consequential, or punitive damages arising from the processing, storage, or transmission of personal data, including unauthorized access resulting from circumstances beyond the Company’s reasonable control.

18. NO INVESTMENT ADVICE OR RELIANCE

The processing of personal data under this Policy does not constitute investment advice, financial advisory services, or a recommendation to participate in any investment. Users acknowledge that all investment decisions are made independently and at their own risk.

19. MODIFICATIONS TO THIS POLICY

The Company reserves the right to modify or update this Privacy Policy at any time.
Changes will be:

A. Posted on the Platform
B. Effective upon posting unless otherwise stated

Continued use constitutes acceptance of the revised Policy.

Approved by:
Next Fraga Investments LLC Management