Privacy Policy for Investor Relations

1. Categories of individuals that this information notice concern

The purpose of this policy is to provide information about how personal data are processed by CTW Inc. ("CTW","we," "us," or "our"), as personal data controller. This information notice is addressed to the persons interested in CTW's investor relations such as investors and potential investors, their proxies and representatives, visitors to the Investor Relations Portal, journalists, people interested in investments.

2. Personal data processing

The purpose of personal data processing by CTW Inc. is to:

communicate with persons contacting CTW in the investor relations matters. Within the communication, CTW may send you materials, reports, information, invitations or offers regarding CTW and CTW's investor relations,
faciliate and perform any operations or transactions with investors, their proxies or representatives,
organizing or co-organizing events regarding CTW and CTW's investor relations (including conferences, lectures),
ensuring and managing the security of IT systems, if you visit this website.

The legal basis for personal data processing is:

your consent to process your personal data and contact you (for possibly directing materials, reports, information, invitations or offers regarding CTW, Inc. and its investor relations, for performing the operations, handling offers that you submitted to CTW),
necessity to perform a contract with you (e.g. when you are an investor and there are any operations on shares),
necessity to comply with legal obligations (e.g. such as obligations on financial instruments provisions, tax obligations and similar in case of managing the operations and transactions with investors),
our legitimate interest (i.e. conducting activities regarding CTW's investor relations, maintaining relationships with you, handling your claims, enabling you to participate in our events and providing you with necessary information),
ensuring financial security of CTW's operations and the security of IT networks.

Personal data processed are usually your name, surname, e-mail address, telephone number and other information provided by you within the course of communication, in particular in the form available on the investor relations website.

3. Personal data sharing

When you use our website, we collect data in system logs, which are used to store a chronological record containing information about events and activities related to the IT system used to provide our services. Such records are collected automatically. Depending on the circumstances, we may also process other categories of personal data.

Providing your personal data is voluntary, however, if you fail to provide all the details significant in specific circumstances, the communication process may be hindered or impossible to conduct.

Data storing period: until the consent is withdrawn, for a period arising from provisions of law or as long as necessary to pursue a legitimate interest of the Controller or a third party.

4. Third country transfer

We may transfer your personal data to other group entities, our service providers, and other third-party recipients around the world, particularly in regions such as the European Economic Area, Japan, China and the United States. These transfers will only occur when necessary for the purposes outlined in this Privacy Policy, where there is a legal basis for the transfer, and when appropriate data transfer mechanisms are in place. If you have any questions about the safeguards in place for these transfers, please contact us at contact@ctw.inc.

5. Personal data sharing

If it occurs that we are legally obliged to do so, we may provide your personal data to entities and public bodies authorized to process such data on the basis of legal regulations (for instance tax office, financial regulatory bodies, courts, prosecutor's office).

When necessary, we may share your personal data when a need to protect the rights or property of CTW or applicable third parties occurs.

Sometimes, we may need assistance from our contractors (business partners and service providers, advisors) in order to maintain our business operations. Consequently, we may share your personal data with other entities who support us in conducting activities, in particular advisors, IT service providers, marketing service providers), services in the scope of archiving and destruction of documents, legal, finance and accounting services, investment, brokerage insurance services, business consulting.

As a safeguard to protect your privacy, we arranged:

data processing agreements with our support partners who act as our processors or,
sharing personal data agreements/clauses, where our partner is also a data controller of your personal data, where we ensure that your personal information is only used in accordance with our instructions and with the initial purpose of processing your data, and that the use by the third party is in accordance with the applicable law requirements or our contractual arrangements.

6. Third country transfer

7. Rights of the data subjects

In connection with personal data processing, the persons whose data are processed shall have the right to (respectively):

demand that the Controller provides access to the personal data being processed,
demand that the Controller rectifies the personal data being processed,
demand that the Controller erases the personal data being processed,
demand that the Controller restrictions the processing of personal data,
object to the processing of personal data,
portability of personal data,
withdraw his or her consent for the processing of personal data, whereas its withdrawal shall not affect the legality of processing executed on the basis of such consent before its withdrawal.

Please note that your rights under respective privacy laws are not unconditional. Therefore, an attempt to invoke any of the rights might not lead to an action. We have to analyse first whether it is admissible to exercise your request.

You also have the right to lodge a complaint with the data protection supervisory authority. We encourage you, however, to always contact us first when you have any problems or doubts regarding the personal data processing by us.

8. Updates to the privacy policy

This privacy policy is subject to updates. The current notice shall each time be published at the website.

Last updated: July 24, 2025.