Investor Data Room Terms of Access and Privacy Notice

1. Parties, purpose and authorised recipient

These terms govern access to the private investor data room operated by INU Lab, a company established in Luxembourg, together with the relevant INU affiliates (“INU”). Access is personal to the invited recipient and may be used only to evaluate a potential investment in, financing of, or strategic relationship with INU (the “Permitted Purpose”). The recipient may not share credentials or allow another person to use the data room.

2. Confidential Information

“Confidential Information” means all non-public information made available through or in connection with the data room, including its existence and structure, documents, analyses, forecasts, financial information, product concepts, technology, software, designs, data, business plans and communications. It does not include information the recipient can document: (a) was lawfully known without confidentiality restriction before disclosure; (b) becomes public through no breach of an obligation; (c) is received lawfully from a third party without confidentiality restriction; or (d) is independently developed without using Confidential Information.

3. Confidentiality and permitted advisers

The recipient must protect Confidential Information with at least reasonable care and no less care than it uses for its own information of similar sensitivity. It may disclose Confidential Information only to directors, employees and professional advisers who need it for the Permitted Purpose and are bound by confidentiality obligations at least as protective as these terms. The recipient remains responsible for their compliance.

4. Restricted use, intellectual property and trade secrets

The recipient may not copy, reproduce, redistribute, publish, sell, commercially exploit, reverse engineer, decompile, scrape, systematically extract, benchmark for a competitor, use to train or evaluate an artificial-intelligence model, or upload Confidential Information to an external service without INU’s prior written consent. Screenshots, screen recordings and downloads are prohibited except where INU expressly enables them for the Permitted Purpose. Access grants no licence, ownership right or other intellectual-property right. All rights remain with INU or the relevant rights holder. Nothing in these terms limits protection available to qualifying trade secrets under Luxembourg or European Union law.

5. Security and incidents

The recipient must keep access codes and devices secure, use any trusted-device option only on a private device under the recipient’s control, and notify investors@inu-lab.com promptly of suspected loss, unauthorised access or disclosure. INU may suspend or revoke access at any time to protect the data room, Confidential Information or its legitimate interests.

6. Required disclosure

If law, regulation, court order or a competent authority requires disclosure, the recipient may disclose only what is legally required and, where legally permitted, must give INU prompt written notice and reasonable assistance to seek confidential treatment or a protective measure.

7. Return and deletion

On request, or when access ends, the recipient must stop using the Confidential Information and permanently delete or return copies under its control, except where retention is required by law, regulation or binding professional rules. Any retained copy remains protected by these terms and may not be used for another purpose.

8. No offer, commitment or reliance

Materials are provided for discussion and evaluation only. They do not constitute an offer, prospectus, recommendation, representation, warranty or commitment concerning securities or any transaction. Forecasts and forward-looking statements are uncertain. No representation or warranty is given as to completeness or accuracy except in a definitive written agreement signed by the relevant parties. The recipient must conduct its own assessment and obtain its own professional advice.

9. Privacy notice for data-room activity

Controller and contact: INU Lab, Luxembourg, is the controller for data-room access and activity records. Questions and data-protection requests may be sent to investors@inu-lab.com.

Purposes and legal bases: INU processes the records to authenticate users, administer and secure access, investigate misuse, preserve evidence of acceptance, operate the investor process and support proportionate follow-up. The principal legal basis is INU’s legitimate interests under Article 6(1)(f) GDPR in protecting confidential information, managing investor relations and maintaining security. Article 6(1)(b) GDPR may also apply where processing is necessary for steps requested before entering into a contract.

Data recorded: sign-ins, document opens, active reading time, language, device category, an approximate country code when available, a truncated network prefix, access decisions and acceptance evidence. INU does not use email tracking pixels, retain full IP addresses, record keystrokes, or inspect activity outside the data room.

Recipients and transfers: access is limited to authorised INU personnel and advisers and to processors needed to operate the room, including Microsoft 365 and SharePoint and Supabase. Where processing involves access or a transfer outside the European Economic Area, INU relies on an applicable adequacy decision or appropriate safeguards such as standard contractual clauses.

Retention: records are retained only as long as necessary for the purposes above. Operational activity records are normally reviewed for deletion 24 months after access ends. Acceptance, security and dispute evidence may be retained longer where reasonably necessary to establish, exercise or defend legal claims, taking account of applicable limitation periods.

Rights: subject to the GDPR, the recipient may request access, rectification, erasure, restriction or portability and may object to processing based on legitimate interests. The recipient may also lodge a complaint with Luxembourg’s National Commission for Data Protection (CNPD). INU does not make solely automated decisions producing legal or similarly significant effects from the activity analytics; the indicators are aids for human review and do not determine investor sentiment or intent.

10. Electronic acceptance, duration and remedies

Clicking “I accept” creates an electronic record of acceptance containing the terms version, timestamp and available security evidence. The confidentiality and restricted-use obligations continue for five years after the recipient’s last access. Obligations concerning trade secrets continue for as long as the information qualifies as a trade secret. The recipient acknowledges that unauthorised use or disclosure may cause harm not adequately remedied by damages alone; INU may seek injunctive or other interim relief in addition to any other available remedy.

11. Other agreements, governing law and jurisdiction

If a signed confidentiality or non-disclosure agreement applies, it prevails to the extent of any conflict. These terms and any non-contractual obligations arising from them are governed by the laws of the Grand Duchy of Luxembourg, excluding its conflict-of-law rules. Subject to mandatory law, the courts of Luxembourg City have exclusive jurisdiction.

12. Language, severability and changes

The English version controls; interface translations are provided for convenience. If a provision is unenforceable, the remaining provisions continue in effect and the affected provision is limited to the minimum extent necessary. A materially revised version requires a new acceptance before further access.