Privacy Policy.

Welsbach Corporate Solutions L.L.C.-FZ, part of the Welsbach Group ("Welsbach", "we", "us" or "our"), is a financial-consultancy and economic-advisory firm that helps high-growth companies access global capital markets, including through SPAC transactions, de-SPAC mergers, initial public offerings, direct listings, reverse takeovers, mergers and acquisitions, and public and private capital raising.

We are committed to protecting the privacy of the individuals whose personal data we handle. This Privacy Policy explains what personal data we collect, why and how we use it, who we share it with, how we transfer it internationally, how long we keep it, and the rights available to you. It applies whether you visit our website, engage us as a client, interact with us as an investor, sponsor, counterparty or adviser, apply to work with us, or otherwise deal with us.

Please read this Policy together with any additional notice we may give you at the point we collect your data, our Cookie Policy, and - where you are the representative of a client or counterparty - the confidentiality terms in our engagement and non-disclosure agreements.

This Policy covers personal data - information relating to an identified or identifiable individual - that we process as a controller, meaning where we decide why and how it is processed. It addresses our processing under the principal data-protection laws relevant to our business, including the EU General Data Protection Regulation (GDPR) and the UK GDPR, the United Arab Emirates Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL), the Singapore Personal Data Protection Act 2012 (PDPA), and the Hong Kong Personal Data (Privacy) Ordinance (PDPO), as applicable to the data in question.

In some engagements we handle personal data on behalf of a client - for example, materials placed in a virtual data room for a specific transaction. Where we act as a processor or on a client's instructions, the client's own privacy notice governs that data and this Policy applies only to the limited extent we act as a controller. This Policy does not apply to third-party websites or services we link to, which have their own privacy notices.

Unless a separate notice tells you otherwise, the controller of your personal data is:

Welsbach operates internationally as part of the Welsbach Group, with a head office in the United Arab Emirates and a presence and operations across Asia, the Middle East, Europe, the Americas and beyond. We may share personal data within the Group where necessary for the purposes described in this Policy, subject to appropriate safeguards and, for cross-border sharing, the transfer protections described in Section 15.

The categories of personal data we collect depend on how you interact with us. They include:

• Website visitors and enquirers: your name, employer, job title, email address, telephone number and the content of any message; and, collected automatically, your IP address, device and browser information, pages viewed, documents downloaded, referral source, approximate location, and cookie and consent preferences.
• Clients and their personnel: identity and contact details of founders, directors, CFOs, management, shareholders and company representatives; onboarding and know-your-customer information (which may include identity-document details); financial information, projections and business plans; and transaction, due-diligence, board and governance information relating to the engagement.
• Investors and SPAC sponsors: name, business contact details, professional profile (including LinkedIn), role and firm, investment mandate and track record, and records of our interactions with you, which we use to identify suitable capital partners and to make introductions.
• Counterparties and advisers: names, roles and contact details of professionals at SPAC sponsors, investment banks, auditors, law firms, accountants and consultants involved in a transaction, and related correspondence.
• Recruitment candidates: your CV, employment and education history, references, interview notes and assessments, right-to-work and identity information, and background-check results where applicable.
• Vendors and suppliers: contact, contract, invoice and payment details, including banking details where you are an individual supplier.
• Event, newsletter and marketing contacts: your name, email, employer and role, registration and attendance data, and your subscription and communication preferences.

We do not seek to collect special-category or sensitive personal data (such as data revealing health, race, religion or political opinions) as part of our services. If such data appears incidentally - for example within an identity document or a due-diligence file - we handle it in accordance with law and only where a valid condition for doing so applies.

We obtain personal data from: you, when you contact us, engage us, apply for a role, subscribe or attend an event; our clients, who provide information about their personnel, shareholders and transactions; publicly available and subscription sources, including professional networks, company registries, market databases and news, which we use to research and identify investors, sponsors and counterparties; third parties involved in a transaction, such as advisers, counterparties and data rooms; and service providers, such as screening, analytics and marketing tools. Where we compile information about investors and sponsors for outreach, that information typically comes from professional and public sources and from our own dealings with you.

We use personal data to:

• respond to enquiries and provide information about our services;
• provide our advisory and consulting services, including SPAC and listing advisory, Target-to-SPAC Matching (TTSM^™), M&A and capital-raising support, and post-listing services;
• identify, research and contact investors and SPAC sponsors, run outreach campaigns, and arrange calls, meetings and introductions;
• prepare transaction materials, including teasers, cost-simulation models and TTSM review reports, and coordinate diligence and execution;
• onboard clients and counterparties and carry out anti-financial-crime, sanctions and know-your-customer checks, including onboarding with our U.S. chaperone broker-dealer where required;
• administer our relationship with you, including contracting, billing and record-keeping;
• operate, secure, personalise and improve our website and communications;
• send newsletters, market insights, thought leadership and event invitations where you have subscribed or where we are otherwise permitted to do so;
• recruit and assess candidates;
• comply with legal, regulatory and professional obligations, including securities-law disclosure and record-keeping; and
• establish, exercise or defend legal claims and protect our rights, property and safety and those of others.

Where the GDPR or UK GDPR applies, we rely on the following legal bases, and we will not process your data without one:

• Performance of a contract - to provide services to, and administer our relationship with, clients and counterparties, and to take steps at your request before entering a contract.
• Legitimate interests - to develop and carry on our business, including B2B relationship-building and deal origination (researching and contacting investors, sponsors and counterparties), securing and improving our website, and preventing fraud and financial crime. We rely on legitimate interests only where our interests are not overridden by your interests or fundamental rights, and we carry out a balancing assessment where required.
• Consent - for non-essential cookies and certain electronic marketing, and for retaining candidate data in a talent pool. Where we rely on consent you may withdraw it at any time, without affecting processing already carried out.
• Legal obligation - to comply with anti-money-laundering, know-your-customer, securities, tax and record-keeping requirements, and lawful requests from regulators and authorities.
• Vital interests - in the rare case that processing is necessary to protect someone's life.
• Public interest - we do not generally rely on this basis; where a disclosure serves an important public interest recognised by law (for example, certain regulatory matters), we will identify it.

Under the UAE PDPL, we process personal data with your consent or where processing is necessary for the performance of a contract, to comply with a legal obligation, to protect vital interests, or for our legitimate interests, consistent with the PDPL's lawful-processing grounds. Under the Singapore PDPA, we collect, use and disclose personal data with consent (including deemed consent) or under an applicable exception or legitimate-interests / business-improvement basis, having given the required notification. Under the Hong Kong PDPO, we collect personal data for lawful purposes directly related to our functions and use it consistently with those purposes or with your consent. We will tell you if we need to rely on a new basis for a new purpose.

Our website uses cookies and similar technologies. Strictly necessary cookies are required for the site to function and to keep it secure. Performance and analytics cookies help us understand how the site is used so we can improve it. Marketing cookies help us measure and tailor our communications. Preference cookies remember your choices.

Except for strictly necessary cookies, we set non-essential cookies only where you have consented through our cookie banner, and you can change or withdraw your choices at any time using the cookie settings on our website.

We record your consent through our consent-management tooling. Where we use analytics and marketing tags, these are described, together with the specific cookies we set and their durations, in our Cookie Policy, which forms part of this Policy.

We distinguish between relationship communications - messages relating to a service, transaction or enquiry you are involved in - and promotional communications, such as newsletters, market insights, thought leadership (including any Substack publication) and event invitations.

We send promotional communications where you have subscribed or otherwise consented, or where we are permitted to contact an existing business contact about related services and you have not objected. Every promotional message includes an easy way to unsubscribe, and you can also contact us at any time to opt out; we maintain a suppression list so that we honour your choice. Opting out of promotional messages does not stop necessary service or transaction communications.

We use technology, including third-party generative artificial-intelligence tools and large language models (LLMs), to help us process, review, analyse and prepare materials more efficiently. Consistent with our engagement and confidentiality terms, we may use such tools to process, review and assess information - which may include personal data within transaction and diligence materials - for the purpose of the relevant engagement.

Where we use these tools we apply safeguards: we take reasonable steps to select reputable providers offering appropriate contractual and security protections (including, where available, terms under which your data is not used to train the provider's models); we minimise the personal data we submit; and we keep human professionals responsible for our advice and work product. Our proprietary Target-to-SPAC Matching process evaluates companies and transactions to support our team; it does not make decisions about individuals.

We do not make decisions that produce legal or similarly significant effects on you based solely on automated processing. AI outputs support decisions made by our people, who exercise meaningful oversight and judgement. If this changes, we will update this Policy and provide any further information the law requires.

Much of the information we handle in transactions is highly confidential and may include material non-public information ("inside information") about companies and securities, as well as personal data about the individuals connected with a transaction. This includes confidential deal information, corporate and financial information, due-diligence materials, financial models, management presentations, virtual-data-room contents, and transaction documents.

We handle such information in accordance with our confidentiality and non-disclosure agreements and applicable securities laws. We restrict access to those who need it for the transaction, require recipients to protect it under obligations consistent with our own, and disclose it to counterparties, advisers and regulators only as necessary for the transaction or as required by law - including, where applicable, disclosure of our role or fees in regulatory filings such as registration statements. Where a transaction involves U.S. persons, relevant activity is conducted through our U.S. chaperone broker-dealer, Finalis Securities LLC (an SEC-registered, FINRA-member firm), consistent with applicable U.S. rules. Handling inside information also carries obligations under market-abuse and securities laws, which we and the transaction parties observe.

If you apply to work with us, we process your CV, employment and education history, references, interview notes and assessments, and - where relevant - right-to-work, identity and background-check information, to evaluate your application and manage the recruitment process. Our legal bases are our legitimate interests in assessing candidates and running a fair process, steps taken at your request before any employment contract, legal obligations (such as verifying the right to work), and, for keeping your details for future opportunities, your consent.

We keep candidate data for the recruitment process and for a limited period afterwards to deal with queries or challenges, after which we delete it unless you have agreed that we may keep it in our talent pool. You may ask us to update or delete your candidate data, or to withdraw your consent to talent-pool retention, at any time using the contact details in Section 20.

We share personal data only as necessary and under appropriate confidentiality and data-protection terms. Recipients may include:

• Service providers (processors) who support our operations - for example customer-relationship management, website hosting, cloud storage, email and productivity, video conferencing, document sharing and virtual data rooms, electronic signature, analytics, marketing and events, recruitment, screening, and AI tools.
• Professional advisers - law firms (including SPAC counsel), auditors (including PCAOB-registered firms), accountants and tax advisers, and compliance providers.
• Transaction parties and market participants - SPAC sponsors, investors, investment banks, our U.S. chaperone broker-dealer (Finalis Securities LLC), stock exchanges, transfer agents and settlement banks.
• Regulators, courts and authorities - including the UAE Securities and Commodities Authority, the U.S. Securities and Exchange Commission and FINRA, and other securities, tax and anti-financial-crime authorities, where required or permitted by law.
• Corporate transactions - a buyer or successor and its advisers if we reorganise, merge or sell part of our business, subject to confidentiality.

We do not sell your personal data.

Because we operate internationally, your personal data may be transferred to, and processed in, countries other than the one in which it was collected - including the United Arab Emirates, Singapore, the United Kingdom, the European Union, the United States, and other countries where we, our group, our service providers or transaction parties operate. Some of these countries may not provide the same level of data protection as your own.

Where we transfer personal data across borders, we put appropriate safeguards in place, which may include: transfers to countries recognised as providing an adequate level of protection; the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, and comparable contractual protections meeting the requirements of the UAE PDPL, the Singapore PDPA's Transfer Limitation Obligation and Hong Kong guidance; intra-group data-transfer agreements; and, where appropriate, your consent or the necessity of the transfer for a contract with you. You may ask us for more information about the safeguards we use by contacting us using the details in Section 20.

We maintain administrative, technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse or alteration. These include encryption of data in transit and, where appropriate, at rest; access controls on a least-privilege, need-to-know basis; multi-factor authentication; logging and monitoring; secure document-sharing and data-room controls; regular backups; vendor due diligence and contractual security commitments; staff confidentiality obligations and training; and incident-response procedures. No system can be guaranteed completely secure; if a personal-data breach occurs, we will act in accordance with our obligations, including notifying regulators and affected individuals where the law requires.

We keep personal data only for as long as necessary for the purposes described in this Policy, including to provide our services, to satisfy legal, regulatory, accounting, tax and securities record-keeping obligations, and to establish, exercise or defend legal claims. In deciding how long to keep data we consider its nature and sensitivity, the purpose, the potential for harm from unauthorised use or disclosure, applicable retention obligations, and whether the purpose can be achieved by other means. Broadly: enquiry and marketing data is kept until you opt out or it becomes stale; client and transaction records are kept for the engagement and a subsequent period reflecting limitation and regulatory requirements (including tail periods in our engagements); recruitment data is kept for the process and a limited period afterwards; and website and analytics data is kept for short periods according to the tool and your cookie choices. When data is no longer needed, we delete or anonymise it, or securely archive it where the law requires.

Subject to the applicable law and its conditions and exceptions, you may have the following rights over your personal data:

• Access - to be told whether we process your data and to obtain a copy of it.
• Correction - to have inaccurate or incomplete data corrected or updated.
• Deletion - to have your data erased in certain circumstances.
• Restriction - to ask us to limit our processing in certain circumstances.
• Objection - to object to processing based on our legitimate interests, and to object to direct marketing at any time.
• Portability - to receive certain data in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible.
• Withdrawal of consent - to withdraw consent at any time where we rely on it, without affecting prior processing.
• Complaint - to lodge a complaint with a data-protection authority (see Section 19).

The precise rights available to you depend on the law that applies to your data: these rights arise principally under the GDPR and UK GDPR; the UAE PDPL provides comparable rights of access, correction, deletion, restriction, portability, objection and to withdraw consent; the Singapore PDPA provides rights of access and correction (and, from its data-portability provisions once in force, portability); and the Hong Kong PDPO provides data-access and data-correction rights. To exercise your rights, contact us using the details in Section 20. We may need to verify your identity before acting, and we will respond within the period required by the applicable law (for example, one month under the GDPR/UK GDPR, extendable for complex requests, and thirty days under the UAE PDPL and Singapore PDPA, subject to their provisions). Exercising your rights is normally free, though we may charge a reasonable fee or decline where the law permits (for example, for manifestly unfounded or excessive requests).

If you have a concern about how we handle your personal data, please contact us first using the details in Section 20 so we can try to resolve it. You also have the right to complain to a data-protection authority. Depending on where you are and which law applies, this may include: the UAE Data Office; the Singapore Personal Data Protection Commission (PDPC); your local EU/EEA supervisory authority; the UK Information Commissioner's Office (ICO); or the Office of the Privacy Commissioner for Personal Data, Hong Kong (PCPD).

For any question about this Policy or your personal data, or to exercise your rights, please contact:

We may update this Policy from time to time to reflect changes in our business, technology, or legal and regulatory requirements. When we do, we will change the "Last updated" date above and post the revised Policy on our website. If we make material changes, we will provide a more prominent notice or, where appropriate, contact you directly. We encourage you to review this Policy periodically.

This Policy is effective from 5 August 2026 and replaces any previous privacy notice. Version 1.0.