Effective Date: August 10, 2026 NanoXplore Inc. (“NanoXplore,” “we,” “us” or “our”) is committed to protecting personal information and respecting privacy. This Policy explains how we collect, use, disclose, retain, protect and otherwise process personal information. It is intended to comply with applicable privacy laws, including Québec’s Act respecting the protection of personal information in the private sector, as modernized by Law 25, other applicable Canadian privacy legislation and, where applicable, the General Data Protection Regulation (“GDPR”).  

1. Scope and Accountability

This Policy applies to personal information in NanoXplore’s possession or control, regardless of format, including personal information collected through our websites, communications, commercial activities and interactions with customers, prospective customers, investors, visitors and other individuals. It also applies where service providers process personal information on our behalf. This public-facing Policy does not govern employee or supplier personnel information handled in an employment or supplier-management context, which is addressed through NanoXplore’s internal privacy practices and notices. Business contact information that the law treats as public may be subject to different rules.  

2. Consent and Transparency

Where consent is required, NanoXplore seeks consent that is clear, free, informed, specific and limited to the time needed for the stated purpose. A written request for consent will be presented separately from other information. Express consent will be obtained where required for sensitive personal information. In other cases, applicable law may permit processing without consent. At or before collection, we identify the purposes and means of collection, the categories of information collected, applicable rights, whether providing information is optional or mandatory, the consequences of refusing, and relevant third parties or locations outside Québec, as required by law. This Policy applies only to NanoXplore’s websites and activities; linked third-party sites are governed by their own privacy policies. You may withdraw consent, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent does not affect prior lawful processing and may limit our ability to provide certain products or services. Contact the Privacy Officer to exercise this choice.  

3. Personal Information We Collect

We collect only personal information that is necessary for identified, serious and legitimate purposes. Depending on your relationship with us, this may occur when you contact us, request information, use our websites, apply for an opportunity, visit our premises, participate in an event or otherwise interact with NanoXplore. “Personal information” means information about a natural person that directly or indirectly allows that person to be identified. Certain information may be sensitive because of its medical, biometric or otherwise intimate nature, or the context in which it is used or disclosed. Personal information may include contact and identification details; business contact and correspondence information; transaction, service and relationship information; website and device information such as IP address, browser, operating system, identifiers and activity data; preferences and consent records; security and access records; and any other information you choose to provide. We generally collect personal information directly from you. We may also collect it from authorized representatives, service providers, business partners, publicly available sources or other third parties, with consent or where permitted by law. If another person provides us with information about you, that person must be authorized to do so. Our websites and services are not directed to children under 14. We do not knowingly collect personal information from a child under 14 without consent from the holder of parental authority or tutor, unless otherwise permitted by law.  

4. How We Use Personal Information

NanoXplore may use your personal information for the following purposes:

• to identify you as a user of our website and as a client of our stores, if applicable;
• to establish and maintain our business relationship with you;
• to provide you with ongoing service;
• to improve our products and service offerings, including the use of this website;
• to communicate with you when you submit questions, comments or suggestions;
• to provide you with information about our business, products and services that may be of interest to you;
• to comply with our legal obligations.

We may also use de-identified or aggregated information for analytics, reporting, research and service improvement where it cannot reasonably identify an individual. We do not use personal information for a new purpose unless that purpose is consistent with the original purpose, consent is obtained, or law permits or requires the use.  

5. Disclosure, Service Providers and Transfers Outside Québec

We disclose personal information only as necessary for identified purposes, with consent where required, or as permitted or required by law. Recipients may include affiliates, professional advisers, technology and hosting providers, payment or administrative service providers, logistics providers, regulators, law enforcement and parties to a proposed or completed business transaction. Access within NanoXplore is limited to personnel who need the information to perform their duties. We use contractual and organizational measures to require service providers to protect personal information, limit its use to authorized purposes, report confidentiality incidents, assist with rights requests and securely return or destroy information when appropriate. Before communicating personal information outside Québec or entrusting a person outside Québec with its collection, use, disclosure or retention, NanoXplore conducts a privacy impact assessment that considers the sensitivity of the information, the purpose, applicable safeguards and the legal framework in the destination. Transfers occur only where the assessment supports adequate protection, and are governed by a written agreement where required. Personal information may therefore be processed or stored outside Québec or Canada, where it may be subject to foreign laws and lawful access by courts, governmental or law-enforcement authorities. In all cases, we seek to disclose no more personal information than is reasonably necessary for the circumstances.  

6. Cookies, Profiling and Privacy Settings

When you use our websites, we and our service providers may automatically collect technical and usage information, including IP address, browser and operating system, device or online identifiers, referring pages, access dates and times, and pages or content viewed or downloaded. We use cookies and similar technologies that are necessary to operate and secure our websites and, where permitted and with any consent required by law, to remember preferences, measure audience and performance, personalize content or advertising, and identify, locate or profile visitors. “Profiling” means collecting and using personal information to evaluate characteristics such as preferences, interests or behaviour. Any technology that identifies, locates or profiles users will be disclosed at or before use, together with information about how to activate or deactivate it. Privacy settings for non-essential functions are set to the highest level of confidentiality by default where required by law. You may manage optional cookies through available consent controls and browser settings; disabling certain technologies may affect functionality. Third-party analytics, social media and advertising providers may set or read their own technologies. Their handling practices are governed by their own privacy and cookie policies.  

7. Safeguards, Confidentiality Incidents and Retention

NanoXplore maintains reasonable physical, administrative and technological safeguards proportionate to the sensitivity, purpose, quantity, distribution and format of personal information. Measures may include role-based access, authentication, encryption where appropriate, monitoring, secure configuration, continuity and recovery controls, contractual requirements, training and periodic review. No safeguard is absolute. If a confidentiality incident occurs, NanoXplore will take reasonable measures to reduce the risk of harm and prevent recurrence, assess the risk of serious injury, notify affected individuals and the Commission d’accès à l’information where required, and maintain a register of confidentiality incidents in accordance with law. NanoXplore maintains privacy governance policies and practices addressing roles and responsibilities, information life-cycle controls, complaint handling, staff training, privacy impact assessments and incident management. Privacy impact assessments are conducted for projects involving the acquisition, development or redesign of information systems or electronic-service delivery systems that involve personal information, and in other circumstances required by law. We take reasonable steps to ensure that personal information used to make a decision about an individual is accurate, complete and up to date. Please inform us of relevant changes. We retain personal information only as long as necessary for identified purposes and to meet legal, regulatory, contractual, security and legitimate business requirements. At the end of the applicable retention period, we securely destroy it or anonymize it for serious and legitimate purposes using generally accepted best practices and criteria prescribed by law, where applicable.  

8. Your Rights, Requests and Complaints

Subject to applicable exceptions, you may request access to personal information we hold about you and information about how it has been handled; request correction of inaccurate, incomplete or equivocal information; request deletion where authorized; withdraw consent; obtain information about and submit observations concerning a decision based exclusively on automated processing; request cessation of dissemination or de-indexing or re-indexing in circumstances provided by law; and request portability of computerized personal information collected from you in a structured, commonly used technological format. Privacy Officer compliance@nanoxplore.ca Requests must be made in writing and should provide sufficient information to verify identity and locate the relevant records. We use identification information only for verification and will not disclose information unless identity is adequately confirmed. You may also contact the Privacy Officer with a question, concern or complaint about this Policy or our privacy practices. NanoXplore will respond within the period required by applicable law, generally 30 days under Québec law, subject to permitted extensions. If all or part of a request is refused, we will provide reasons and information about available recourse, as required. Individuals may also contact the Commission d’accès à l’information du Québec.  

9. Automated Decisions

If NanoXplore uses personal information to make a decision based exclusively on automated processing, we will inform the affected individual at or before the decision and, on request, provide the personal information used, the principal factors and parameters that led to the decision, and the right to have the information corrected. The individual may submit observations to a person in a position to review the decision.  

10. Individuals in the European Economic Area

This section applies where NanoXplore processes personal information subject to the GDPR. To the extent of any inconsistency, this section governs that processing.

10.1 Legal Bases and Sensitive Information

We process personal information on one or more lawful bases, including consent, performance of a contract, compliance with a legal obligation, protection of vital interests, or legitimate interests that are not overridden by individual rights. Where consent is relied upon, it may be withdrawn at any time. Special-category information is processed only where an applicable GDPR condition is satisfied.

10.2 EEA Rights and Transfers

Subject to legal conditions and exceptions, individuals may have rights of access, rectification, erasure, restriction, objection and data portability, and the right not to be subject to certain solely automated decisions. They may lodge a complaint with a competent supervisory authority. Transfers outside the EEA are made using an approved transfer mechanism and appropriate safeguards where required.  

11. Changes to This Policy

We may update this Policy when our practices, technologies or legal obligations change. We will post the revised version and its effective date on our website and, where required, provide notice using an appropriate method. Material changes will be communicated before they take effect where required by law.