Legal

PRIVACY POLICY
& DATA PROTECTION

Last updated: March 8, 2026

1. Introduction and Scope

French Village Karting ("we," "us," or "our"), located in Fredericton, New Brunswick, Canada, is committed to protecting the personal information of all individuals who interact with our website and investor outreach platform (the "Platform"). This Privacy Policy explains how we collect, use, disclose, and protect your personal information in accordance with:

›The Personal Information Protection and Electronic Documents Act (PIPEDA), Canada's federal private-sector privacy law;

›Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25 / Bill 64), as amended and in full force since September 22, 2023;

›The Maine Online Data Privacy Act (MODPA) and applicable Maine consumer privacy regulations, to the extent they apply to residents of the State of Maine, USA.

By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with its terms, please discontinue use of the Platform immediately.

2. Data Protection Officer (DPO)

In compliance with PIPEDA and Quebec Law 25, French Village Karting has designated a Data Protection Officer responsible for overseeing compliance with applicable privacy laws and handling all data-related inquiries.

Anderson Pereira de Andrade

Data Protection Officer — French Village Karting

Email: [email protected]

Phone: +1 (647) 671-5067

Address: Fredericton, New Brunswick, Canada

3. Personal Information We Collect

We collect personal information only to the extent necessary for the purposes described in this Policy. The categories of information we may collect include:

Category	Examples	Purpose
Identity	First name, last name	Account creation, communications
Contact	Email address, phone number	Meeting scheduling, notifications
Financial	Investment tier preference, accredited investor status	Investor qualification, legal compliance
Technical	IP address, browser type, session token	Security, NDA consent logging
Survey	Leisure preferences, demographic group	Market research (anonymized)
Preferences	Language, notification opt-in	Personalized experience

We do not collect sensitive personal information such as health data, racial or ethnic origin, political opinions, or biometric data.

4. Legal Basis for Processing

Under PIPEDA and Quebec Law 25, we rely on the following legal bases for processing your personal information:

Consent: When you create an investor account, submit a survey, or express interest in the investment opportunity, you provide explicit consent to the collection and use of your personal information for those specific purposes.

Contractual Necessity: Processing your name, email, and scheduling information is necessary to fulfill the service of booking and conducting private investor meetings.

Legitimate Interest: We have a legitimate interest in maintaining the security of our platform, preventing fraud, and ensuring that only qualified investors access financial projections.

Legal Obligation: We may process and retain certain data to comply with securities regulations (FCNB — Financial and Consumer Services Commission of New Brunswick) and applicable tax laws.

5. How We Use Your Personal Information

We use your personal information exclusively for the following purposes:

›To create and manage your investor account on the Platform;

›To schedule and confirm private investment meetings via Google Calendar;

›To send transactional emails (meeting confirmations and 24-hour reminders) via SendGrid;

›To record and timestamp your acceptance of the Non-Disclosure Agreement (NDA) and confidentiality terms;

›To conduct anonymized market research analysis from survey responses;

›To notify the project owner of new registrations and expressions of interest;

›To comply with applicable securities regulations and maintain audit records;

›To improve the security and functionality of the Platform.

We do not use your personal information for automated decision-making or profiling that produces legal or similarly significant effects.

6. Disclosure and Data Sharing

We do not sell, rent, or trade your personal information to third parties. We may share your information only in the following limited circumstances:

Service Providers: We use Google Calendar (Google LLC) for meeting scheduling and SendGrid (Twilio Inc.) for transactional email delivery. These providers act as data processors under contractual agreements that require them to protect your information.

Legal Requirements: We may disclose your information if required by law, court order, or government authority, including the FCNB, the Office of the Privacy Commissioner of Canada, or the Commission d'accès à l'information du Québec.

Business Transfer: In the event of a merger, acquisition, or asset sale, your information may be transferred to the successor entity, subject to the same privacy protections described in this Policy.

Cross-border transfers: Our platform infrastructure may involve data processing in Canada, the United States, and the European Union. All transfers are conducted under appropriate safeguards, including contractual clauses consistent with PIPEDA Schedule 1 and Quebec Law 25 Article 17 requirements for cross-border data transfers.

7. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes described in this Policy, or as required by law:

Data Type	Retention Period
Investor account data	7 years from last activity (securities compliance)
NDA consent records	10 years (legal obligation)
Meeting records	7 years from meeting date
Survey responses	3 years (anonymized after 1 year)
Session tokens	7 days (automatic expiry)

8. Your Privacy Rights

Depending on your jurisdiction, you have the following rights regarding your personal information:

Right of Access

Request a copy of the personal information we hold about you (PIPEDA Principle 9; Law 25 Art. 27; MODPA §9702).

Right to Rectification

Request correction of inaccurate or incomplete personal information (PIPEDA Principle 9; Law 25 Art. 28).

Right to Erasure

Request deletion of your personal information, subject to legal retention obligations (Law 25 Art. 28; MODPA §9702(4)).

Right to Withdraw Consent

Withdraw your consent at any time, subject to legal or contractual restrictions (PIPEDA Principle 3).

Right to Data Portability

Receive your personal information in a structured, commonly used format (Law 25 Art. 27; MODPA §9702(3)).

Right to Object

Object to the processing of your personal information for certain purposes (MODPA §9702(5)).

To exercise any of these rights, please contact our Data Protection Officer at [email protected]. We will respond within 30 days of receiving your request, as required by PIPEDA and Quebec Law 25. Maine residents may also file a complaint with the Maine Attorney General's Office.

9. Security Measures

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, disclosure, alteration, or destruction. These measures include:

›Password hashing using bcrypt with a minimum work factor of 10;

›Session tokens stored exclusively in browser localStorage with a 7-day expiry;

›NDA consent records include IP address and timestamp for audit purposes;

›All data transmission occurs over HTTPS/TLS 1.2 or higher;

›Access to the investor management dashboard is restricted to the verified project owner via OAuth authentication;

›Database access is restricted to server-side processes only — no direct client-side database queries.

In the event of a privacy breach that poses a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada (and the Commission d'accès à l'information du Québec if applicable) within 72 hours of becoming aware of the breach, in accordance with PIPEDA's breach notification requirements and Quebec Law 25 Article 3.5.

10. Cookies and Tracking Technologies

We use limited technical cookies and browser storage. For full details, please see our Cookie Policy. In summary:

›Strictly necessary: Session authentication token stored in localStorage (key: inv_session). Required for platform functionality. Cannot be disabled.

›Analytics: We may use anonymized analytics to understand platform usage. No personally identifiable information is transmitted to analytics providers.

›No advertising cookies: We do not use any advertising, retargeting, or third-party tracking cookies.

11. Children's Privacy

The Platform is intended exclusively for adults aged 18 years or older who meet the definition of an accredited investor under applicable Canadian securities law. We do not knowingly collect personal information from individuals under the age of 18. If we become aware that a minor has provided us with personal information, we will delete it promptly.

12. Quebec-Specific Provisions (Law 25)

For residents of Quebec, the following additional provisions apply in accordance with the Act Respecting the Protection of Personal Information in the Private Sector (Law 25):

›Privacy Impact Assessments (PIAs): We conduct PIAs before implementing any new technology or process involving personal information, as required by Law 25 Article 3.3.

›Governance Policy: This Privacy Policy constitutes our publicly available governance rules regarding personal information, as required by Law 25 Article 3.2.

›Automated decision-making: We do not use automated decision-making systems that produce legal or similarly significant effects on individuals.

›Right to deindexation: You may request that we cease disseminating your personal information or deindex any hyperlink attached to your name, where applicable.

›Complaints: Quebec residents may file a complaint with the Commission d'accès à l'information (CAI) at www.cai.gouv.qc.ca.

13. Maine-Specific Provisions (MODPA)

For residents of the State of Maine, USA, the following rights apply under the Maine Online Data Privacy Act and applicable Maine consumer privacy regulations:

›Right to know: You have the right to know what personal data we collect, how it is used, and with whom it is shared.

›Right to opt out: You have the right to opt out of the sale of your personal data. We do not sell personal data.

›Right to non-discrimination: We will not discriminate against you for exercising any of your privacy rights.

›Sensitive data: We do not collect sensitive personal data as defined under Maine law without your explicit consent.

›Complaints: Maine residents may file a complaint with the Maine Attorney General's Office at www.maine.gov/ag.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify registered investors of material changes by email at least 30 days before the changes take effect. The "Last updated" date at the top of this page will always reflect the most recent revision. Continued use of the Platform after the effective date constitutes acceptance of the updated Policy.

15. Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact our Data Protection Officer: