# **Privacy Policy** _Last Updated: December 20, 2025_ This **Privacy Policy** describes the information collection, use, retention and sharing practices of **Royalty Exchange Inc.** (“ **Royalty Exchange**”, “ **we**”, “ **us**”, “ **our**”) and its affiliates and subsidiaries when you interact with us through our website, [royaltyexchange.com](https://royaltyexchange.com/) (the “ **Website**”), or other digital products on which this Privacy Policy appears (collectively, the “ **Services**”). As used in this Privacy Policy, “personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a natural person (i.e. data subject). Personal information includes “personal data”, as such term is defined under applicable data privacy laws. ## OUR ROLE IN DATA PROCESSING To the extent the General Data Protection Regulation (“ **GDPR**”), Regulation (EU) 2016/679, and the UK Data Protection Act 2018 (“ **DPA**”) apply (collectively referred to in this Privacy Policy as “EU or UK data protection laws”), the entity responsible for the collection and use (processing) of your personal data is Royalty Exchange Inc., the data controller. You can contact Royalty Exchange at privacy@royaltyexchange.com or by mailing a letter to: ATTN: Privacy Department 1550 Larimer St. #769. Denver, CO 80202. ## PERSONAL INFORMATION WE COLLECT, WHY AND FOR HOW LONG We collect personal information as you engage with our Services, including when you: - **Contact us**. When you contact us, we collect, from you, your _personal identifiers_ (name, email address, telephone number, country, subject of inquiry) and any additional information you choose to include in your message. We use this information to respond to your questions or inquiries and to troubleshoot where necessary. To the extent the EU or UK data protection laws apply, the legal basis for the processing of this information is that it is necessary for the performance of the service requested by you. - **Create an account.** When you create an account, we collect, from you, your _personal identifiers_ (name, email address, telephone number, username/password), _commercial information_ (type of account), and _financial information_ (bank account information). We use this information to create and maintain your account, communicate with you, and facilitate your access to the Services. We use your financial information to assess your eligibility to participate in the marketplace and share this information with our financial services providers to implement fund transfers and collect payments. To the extent the EU or UK data protection laws apply, the legal basis for this processing activity is the performance of a contract. If you do not provide this information, we will not be able to set up your account or process your transactions. - **Connect your account**. When you connect your account to your royalty account provider(s), we collect (via web scraping tools), your _commercial information_ (royalty data, royalty earnings) and _personal identifiers_ (name) from the relevant royalty account provider(s). We use this information to facilitate the valuation of your royalties, provide deal options on the marketplace, as well as share it with our royalty management service providers for purposes of standardizing your royalty statements prior to publicizing them on the marketplace. To the extent the EU or UK data protection laws apply, the legal basis for this processing activity is the performance of a contract and/or to provide the services you requested us to provide. - **Interact with the chat feature**. When you interact with the chat feature on our Website, we collect, from you, your _internet or other electronic network activity information_ (location, IP address, device identifiers) and any additional information you choose to provide in the chat. We use this information to respond to your questions or inquiries and troubleshoot where necessary. We only retain this information if you choose to provide your contact information, in which case we will retain this information until you request us to delete it. - **Subscribe to our newsletter.** When you subscribe to our newsletter, we collect, from you, your _personal identifiers_ (email address). We use this information to send you news about our products and services. To the extent the EU or UK data protection laws apply, the legal basis for this processing is your consent. You may revoke your consent at any time with effect moving forward by clicking the “unsubscribe” link included within each email we send to you. However, we will continue to send you necessary service-related messages. Our communications contain tracking technologies, to analyze whether a predefined action took place by a recipient, such as opening our communications and other engagement metrics such as timestamps, delivery status, whether an email was forwarded, clicks within an email, as well as sender and recipient addresses to better adapt and distribute our communications. When you opt-in to our marketing communications, you will be automatically opted-in to the use of these technologies. You can avoid downloading the pixel by rejecting the download of images in the email. - **Interact with us on social media**. When you interact with our social media pages on social networking websites, such as Facebook, X, LinkedIn, Instagram, and YouTube (each a “ **Social Media Page**” and collectively, “ **Social Media Pages**”), we collect basic engagement metrics and use it to tailor content and marketing and use it to improve the user experience as set forth in this section. Please note that we do not control the use or storage of the information that you have posted to any social networking websites. This information is collected and processed by the social networking websites for their own purposes, including marketing. ## DATA RETENTION Unless otherwise stated in this Privacy Policy, we retain your personal information (i) for as long you maintain an account with us, (ii) until we receive a valid request to delete the information, in which case we will delete or anonymize the information after receiving the request, (iii) until we no longer need the information to fulfill the purposes for which we collected it, or (iv) until the information is no longer needed for a service provider or contractor’s operational purpose(s). We use the following criteria to determine whether it remains reasonably necessary to retain your personal information for such purposes or a service provider or contractor’s operational purpose(s): (i) whether there is a retention period required by statute or regulations; (ii) the existence of actual or threatened litigation for which we are required to preserve the information; (iii) the statutes of limitations for potential legal claims; and (iv) generally accepted best practices in our industry, including in relation to the safety and security of our properties and assets. ## HOW WE SHARE YOUR PERSONAL INFORMATION 1. **General Sharing** Royalty Exchange shares personal information as described in the **PERSONAL DATA WE COLLECT, WHY AND FOR HOW LONG** section, and generally in the following instances: - **Within Royalty Exchange.** We share your personal information within Royalty Exchange for the legitimate business purposes of efficiently and effectively providing the Services, such as accounting and customer service support. Access to your personal information is limited to those on a need-to-know basis. - **Other users.** We share personal information with other users on an as-needed basis to facilitate transactions. - **In the event of a corporate reorganization**. We would share personal information with third parties, including the buyer or target (and their agents and advisors) for the purpose of facilitating and completing the transaction. - **For legal purposes.** We share personal information where we are legally required to do so, such as in response to court orders, subpoenas, governmental/regulatory bodies, law enforcement or legal process. ## YOUR INFORMATION CHOICES You have the following choices with respect to your personal information: - **Correct or View Your Information.** You may send an email to [privacy@royaltyexchange.com](mailto:privacy@royaltyexchange.com) to correct or view certain personal data of yours in our possession. - **Opt Out of Google Analytics.** You can download the Google Analytics opt-out browser, which can be accessed [here](https://tools.google.com/dlpage/gaoptout). - **Opt Out of Meta Pixel**. You can opt out of displaying Facebook ads and sharing by visiting your Facebook [Ad Settings](https://www.facebook.com/settings?tab=ads). ## YOUR DATA SUBJECT RIGHTS Individuals in the European Union and United Kingdom are entitled to certain rights under General Data Protection Regulation (“ **GDPR**”) and the Data Protection Act 2018 (“ **DPA**”), respectively. To the extent these laws apply to our processing of your personal data, you are entitled to the following rights: - **Right to access:** For any of the processing described above, you have the right to ask us for copies of your personal data. - **Right to rectification:** For any of the processing described above, you have the right to ask us to rectify personal data you think is inaccurate or incomplete. - **Right to erasure:** You have the right to ask us to erase your personal data except when the legal basis for the processing is to fulfill our legal obligations or to carry out a task in the public’s interest. ## INFORMATION SECURITY We implement appropriate technical and organizational security measures, such as access controls and encryption, to protect the personal information that we collect and maintain from unauthorized access, destruction, use, modification, or disclosure. However, no security measure or modality of data transmission is 100% secure. ## CHILDREN’S PRIVACY The Services are not intended for anyone under the age of eighteen (18). We do not knowingly collect the personal information of anyone under the age of eighteen (18). If we learn that we have collected or received personal information from individuals under the age of eighteen (18), we will delete the personal information.