Mercury Investor Privacy Policy

This Investor Privacy Notice ("Notice") applies to individuals and entities who provide personal information to Mercury Technologies, Inc. ("Mercury," "we," "us," or "our") in connection with the actual or potential purchase or sale of Mercury securities. It describes how we collect, use, share, and protect your personal information.

This Notice is separate from Mercury's general Privacy Policy, which applies to customers who use Mercury's banking and financial products. If you are also a Mercury customer, both notices apply to your respective interactions with us.

1. Who This Notice Covers

This Notice applies to:

• Individuals (including employees and former employees of Mercury who are selling stock, and prospective purchasers) who submit personal information in connection with an investment in Mercury
• Entities (including investment funds, family offices, trusts, and other legal entities) whose authorized representatives submit information on the entity's behalf
• Brokers and intermediaries who transmit investor information to Mercury on behalf of prospective purchasers or sellers

2. Information We Collect

The specific information we collect depends on whether you are participating as an individual or on behalf of an entity. We collect information necessary to evaluate whether to approve a requested transaction and to register any transfer of Mercury stock in our records, including the following categories of personal information:

• Contact information and personal identifiers, such as your full name; information about related persons, where relevant; email address; mailing address; date of birth; and government-issued identifiers (e.g., SSN or ITIN).
• Demographic information, such as age, citizenship, and marital status.
• Financial and commercial information, such as transaction-related communications and correspondence.
• Professional or employment information, such as entity information and tax identifiers.
• Sensitive personal information. Under certain laws, some information we collect may be considered sensitive personal information, including: government-issued identifiers (identity documents, SSN, or ITIN) and citizenship. We only use or disclose this information as permitted by law.
• Other personal information you choose to provide.

3. How We Collect Your Information

We collect information in the following ways:

• Directly from you, when you complete our investor intake form or correspond with us
• Through brokers and intermediaries, when you engage a platform to facilitate a transaction and that platform transmits your information to us
• From publicly available and third-party sources, including government, corporate, and sanctions records.

4. How We Use Your Information

We may use the information we collect to:

• Review and determine whether to approve your transaction and complete transfer documents.
• Communicate with you about the transaction and respond to requests.
• Screen and verify. For example, we may screen against sanctions lists, verify eligibility, and conduct due diligence as part of evaluating whether to approve your transaction.
• Prepare tax reporting and maintain records of completed transactions.
• Comply with applicable laws and regulations, and as otherwise permitted by law.

Where applicable, we rely on performance of a contract, compliance with legal obligations, and our legitimate interests in operating and protecting our business.

5. How We Disclose Your Information

We disclose investor information only as necessary for the purposes described in this Notice. In the past 12 months, we have disclosed the categories of personal information described in Section 2 to the following:

• Service Providers and Business Partners that provide services to us, such as screening, data processing, document management, and recording share transfers. They may receive contract information and personal identifiers, demographic information, financial and commercial information, professional or employment information, and Sensitive Personal Information, as needed for their services.
• Transaction counterparties, such as the selling stockholder and their representatives, who may receive limited contact, professional, and transaction-related information needed to complete the transaction.
• Regulators, law enforcement, or other government entities where required by law, or if we have a good faith belief that disclosure is necessary or appropriate, such as to respond to a court order or protect our rights.

We do not “sell” or “share” personal information, as those terms are defined under applicable U.S. privacy laws.

6. International Data Transfers

Mercury is headquartered in the United States. If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with data transfer restrictions, your information may be transferred to and processed in the United States.

Where required, we rely on appropriate safeguards recognized under applicable law, which may include standard contractual clauses, to govern transfers of personal data from the EEA or UK to Mercury's U.S. systems.

7. How Long We Retain Your Information

We retain investor information only as long as necessary, and use the following factors to determine the retention period:

• Maintain our corporate and share transfer records
• Comply with legal, tax, accounting and regulatory obligations
• Establish, exercise, or defend our legal rights

8. Your Privacy Rights

Depending on where you live, you may have rights under applicable law, which may include:

• Know what personal information we have collected about you
• Request deletion of your personal information (subject to legal exceptions, including our retention obligations under securities and tax law)
• Correct inaccurate personal information
• Opt out of the sale or share of personal information (we do not sell or share personal information)
• Non-discrimination for exercising your rights

To submit a data rights request, please contact us at legal@privacy.com with "Investor Privacy Request" in the subject line. We will respond within the timeframe required by applicable law. We may need to verify your identity before processing your request.

9. AI-Assisted Processing

Mercury may use AI tools to assist with research, screening, and drafting, with human review of outputs. We take steps to prevent your information from being used to train third-party models.

10. Changes to This Notice

We may update this Notice from time to time to reflect changes in our practices or applicable law. When we make material changes, we will update the "Last Updated" date at the top of this Notice.

11. Contact Us

If you have questions about this Notice or wish to exercise your privacy rights, please contact us at legal@mercury.com.