Privacy Policy.

Effective date: June 17, 2026.
Last updated: June 17, 2026.

1. Who we are and what this policy covers

This Privacy Policy applies to the websites operated by 4orm Finance ("4orm Finance," "we," "us," "our"), including 4ormfinance.com and its subdomains, 4ormex.com, and 4ormedc.com. 4orm Finance is a Canadian corporation with offices in Calgary, Vancouver, and Edmonton.

This Policy is designed to comply with the federal Personal Information Protection and Electronic Documents Act (PIPEDA), the Alberta Personal Information Protection Act (Alberta PIPA), the British Columbia Personal Information Protection Act (BC PIPA), and Quebec's Act respecting the protection of personal information in the private sector (Law 25, as amended).

2. Information we collect

We collect personal information that you provide to us directly when you:

• Request access to the 4orm Finance data room (name, email, firm or organization, phone number, investor classification, allocation range, timeline, and area of interest).
• Contact us through our websites or by email.
• Subscribe to research, briefs, or investor updates.

We also collect limited technical information automatically when you visit our websites, including IP address, browser type, device type, pages visited, and referring URL. Our default analytics are first-party and privacy-preserving. Third-party trackers (e.g., advertising or social pixels) are off by default and are only enabled if you grant consent through our cookie banner.

3. How we use information

We use personal information to:

• Review access requests to the data room and arrange introductory conversations.
• Communicate with prospective institutional and accredited counterparties.
• Comply with applicable Canadian securities, anti-money-laundering, and privacy laws.
• Maintain, secure, and improve our websites.

Automated decision-making. 4orm Finance does not currently use automated decision-making (within the meaning of Quebec Law 25 s.12.1) to produce legal effects or significantly affect any individual. If we deploy such processing in the future, we will inform affected individuals before or at the time of the decision and offer the opportunity to submit observations.

4. Consent

By submitting information to us through a website form, you consent to our collection and use of that information for the purposes described in this Policy. For marketing communications, we obtain a separate express consent (an unticked checkbox) consistent with Canada's Anti-Spam Legislation (CASL). You may withdraw consent at any time by contacting our Privacy Officer (see above).

5. Disclosure of information

We do not sell or rent personal information. We may disclose information to:

• Service providers acting on our behalf under contractual confidentiality and data-protection obligations (including cloud hosting, email, data room, and analytics providers).
• Legal, accounting, and other professional advisors.
• Canadian regulatory authorities and law enforcement as required by applicable law.
• A successor entity in connection with a corporate transaction (subject to appropriate confidentiality protections).

6. Cross-border processing

Some of our service providers are located outside Canada (including in the United States) and may store or process personal information outside of Canada. Personal information stored outside of Canada may be subject to the laws of those jurisdictions, including lawful requests for access by foreign courts, law enforcement, and national security authorities. We require all service providers to maintain protections that are reasonable in the circumstances and comparable to those required under Canadian law.

This notice is provided in compliance with Alberta PIPA s.13.1 (notification of foreign service providers) and Quebec Law 25 (cross-border transfer assessment requirements).

7. Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected or as required by applicable Canadian law. Typical retention periods:

• Data room access requests: retained for the duration of the relationship plus seven (7) years following the last interaction, consistent with securities-law record-keeping expectations.
• Marketing consent records (CASL): retained for three (3) years from the date consent was provided or withdrawn.
• Site analytics and logs: retained for thirteen (13) months unless required for fraud or security investigation.

When personal information is no longer needed, we securely destroy, erase, or anonymize it in accordance with applicable law.

8. Your rights

Subject to applicable Canadian privacy law, you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Withdraw consent to the collection, use, or disclosure of your information (subject to legal or contractual restrictions).
• Request portability of your information in a structured, commonly used technical format (Quebec Law 25, s.27).
• Request deletion or de-indexing of your information where applicable (Law 25, s.28.1).
• Make a complaint about our handling of your information.

To exercise any of these rights, contact our Privacy Officer at compliance@4ormfinance.com. We will respond within 30 days.

9. Security

We use commercially reasonable administrative, technical, and physical safeguards to protect personal information against loss, theft, and unauthorized access, use, disclosure, copying, or modification. These include encryption in transit and at rest, access controls, multi-factor authentication for administrative access, and regular security review.

Breach notification. If a breach of security safeguards involves a real risk of significant harm, we will notify affected individuals and the applicable Privacy Commissioner (Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner of Alberta, the Office of the Information and Privacy Commissioner for British Columbia, or the Commission d'accès à l'information du Québec) as required under PIPEDA, PIPA, and Law 25.

10. Cookies and tracking technologies

4orm Finance websites use cookies and similar technologies. Essential cookies are required for the site to function. Analytics and marketing cookies are off by default and are only set if you grant consent through our cookie banner.

You can manage your preferences at any time by clearing your browser's local storage and reloading the site, which will trigger the cookie banner again. We do not use third-party trackers for advertising on our own properties.

11. Children

Our websites are not directed to individuals under the age of majority in their province of residence. We do not knowingly collect personal information from children. If you believe we have collected such information, contact our Privacy Officer.

12. Privacy Officer and complaints

Our Privacy Officer is identified at the top of this Policy and is responsible for compliance with this Policy and applicable Canadian privacy law. To raise a concern, request access, or make a complaint, email compliance@4ormfinance.com.

If you are not satisfied with our response, you may contact the applicable Canadian privacy regulator:

• Office of the Privacy Commissioner of Canada (OPC): priv.gc.ca
• Office of the Information and Privacy Commissioner of Alberta (OIPC AB): oipc.ab.ca
• Office of the Information and Privacy Commissioner for British Columbia (OIPC BC): oipc.bc.ca
• Commission d'accès à l'information du Québec (CAI): cai.gouv.qc.ca

13. Changes

We may update this Privacy Policy from time to time. Material changes will be posted to this page with a revised "Last updated" date. Where required by law, we will give advance notice or seek renewed consent.

14. Contact

4orm Finance
Privacy Officer: Chad Johnston, Founder
Email: compliance@4ormfinance.com
Calgary, AB