9.1 How to Exercise Your Rights

To exercise any right, please contact us using one of the following methods: Email: [email protected] — include “Data Rights Request” in the subject line

We will acknowledge your request within 72 hours and respond within 30 days (extendable by a further 60 days for complex requests, with notice). We will not charge a fee for reasonable requests. We may ask you to verify your identity before processing your request.

9.2 California-Specific Rights (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). BX does not sell personal data as defined by CCPA, nor do we share personal data for cross-context behavioural advertising. You have the right to opt out of any future sale or sharing and to non-discrimination for exercising your privacy rights. Submit California-specific requests to [email protected] with “CCPA Request” in the subject.

9.3 Supervisory Authorities

If you are dissatisfied with our response to a privacy concern, you have the right to lodge a complaint with your local data protection authority:

• EU data subjects: the data protection authority in your EU member state (e.g., Agencia Española de Protección de Datos (AEPD) for Spain; www.aepd.es).

• UK data subjects: Information Commissioner’s Office (ICO); www.ico.org.uk.

• New Zealand data subjects: Office of the Privacy Commissioner; www.privacy.org.nz.

• California residents: California Privacy Protection Agency (CPPA); www.cppa.ca.gov.

10. Farm Data and the EU Data Act

EU DATA ACT (Regulation (EU) 2023/2854) — IN FORCE SEPTEMBER 2025

The EU Data Act grants users the right to access and port machine-generated data produced through the use of IoT devices and connected services, including agricultural sensors and precision farming equipment. BX is committed to full compliance with these rights.

Where you use BX-connected field sensors, soil monitors, or other data-generating equipment:

• You retain ownership of your raw farm data (sensor readings, field observations, GPS coordinates).

• You have the right to receive a machine-readable export of your farm data at any time, free of charge, via your account settings or by requesting it from [email protected].

• You may request that BX transfer your farm data directly to a third-party service provider you designate.

Derived AI insights, benchmarks, and anonymised aggregated outputs generated by BX from your data are BX intellectual property and are not subject to portability rights under the Data Act. These rights are available to all BX users, not only those in the EU.

11. Security

BX takes the security of your personal data seriously. We implement appropriate technical and organisational measures to protect your data against unauthorised access, accidental loss, alteration, or disclosure. These measures include:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256).

• Role-based access controls with audit logging for all access to personal data.

• Access to customer data within internal operational tools (including project management, support ticketing, and consultancy planning tools) is restricted to authorised BX staff on a strict need-to-know basis. All such tools are covered by Data Processing Agreements. Where BX staff handle customer data in the course of consultancy or planning work, this is done under confidentiality obligations and in accordance with this Policy.

• A bug bounty programme to identify and address security vulnerabilities.

• Annual third-party penetration testing — planned as part of BX’s ongoing security programme.

• Incident response procedures with defined escalation and notification timelines.

In the event of a personal data breach that poses a risk to your rights and freedoms, BX will notify the relevant supervisory authority within 72 hours of becoming aware of the breach (where required by GDPR), and will notify affected data subjects without undue delay where the breach poses a high risk.

12. Children’s Privacy

The BX platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact [email protected] and we will delete it promptly.

13. Automated Decision-Making and Profiling

BX does not make solely automated decisions that produce legal or similarly significant effects about you as defined by GDPR Article 22. SAM AI generates advisory outputs to assist human decision-making by farm operators — all AI-generated outputs are recommendations only and are subject to human review and judgment. Where you opt in, BX may include your anonymised farm performance data in aggregated benchmarking analytics (e.g., yield comparisons against anonymised peer farms). This feature is opt-in only; benchmarks are derived exclusively from data contributed by farms that have explicitly consented to participate. Aggregated benchmarking analytics do not involve profiling of individual natural persons and no individual farm is identifiable in any benchmark output.

14. Third-Party Websites and Links

Our website and platform may contain links to third-party websites or integrations with third-party services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you use.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by:

• Email notification to the account holder’s registered email address, at least 14 days before the change takes effect (for material changes affecting your rights).

• In-platform notice on your next login.

• Updating the “Effective Date” at the top of this Policy.

If you do not accept the revised Policy, you may close your account and request deletion of your data. Your continued use of the platform after the effective date constitutes acceptance of the revised Policy. Previous versions of this Policy are archived and available on request.

16. How to Contact Us

PRIMARY PRIVACY CONTACT

BX Technologies Limited

Attn: Privacy Team Email: [email protected]

Subject line: “Privacy Enquiry” or “Data Rights Request”

RESPONSE TIMES

Acknowledgement: within 72 hours Full response: within 30 calendar days Complex requests: up to 90 days (with notice)

Appendix A — Jurisdiction-Specific Supplements

This Policy is written to the Highest Common Denominator standard, meaning all rights and protections described above apply globally. The supplements below provide additional statutory notices required in specific jurisdictions.

A1 — EU/EEA Supplement (GDPR)

The legal bases for processing are as set out in Section 3. Where we rely on legitimate interests, you may object at any time. You have the right to lodge a complaint with your national data protection authority. BX Technologies Limited is a UK-incorporated company that processes personal data of EU data subjects. BX is currently reviewing its obligations under Article 27 GDPR regarding the appointment of an EU representative and will update this Policy and publish representative contact details at bx.tech/privacy-policy once that review is complete.

A2 — UK Supplement (UK GDPR)

This Policy also constitutes BX’s privacy notice under the UK GDPR and Data Protection Act 2018. The UK supervisory authority is the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Reports to the ICO can be made online at ico.org.uk/make-a-complaint.

A3 — California Supplement (CCPA/CPRA)

For California residents: BX does not sell or share personal information as defined by CCPA/CPRA. No financial incentives are offered in exchange for personal data. You have the right to non-discrimination for exercising CCPA rights. You may designate an authorised agent to make requests on your behalf. We do not knowingly sell or share personal information of California residents under 16 years of age.

A4 — New Zealand Supplement (Privacy Act 2020)

BX holds personal information in accordance with the New Zealand Privacy Act 2020. You have the right to access and correct your personal information. Complaints may be made to the Office of the Privacy Commissioner (privacy.org.nz). BX complies with the Information Privacy Principles set out in the Privacy Act 2020.

A5 — Chile Supplement (Ley 19.628 / Ley 21.719)

BX processes personal data of Chilean residents in accordance with Ley 19.628 sobre Protección de la Vida Privada and, where applicable, Ley 21.719 (new data protection framework, enacted December 2023 with transitional provisions in force). You have rights of access, rectification, cancellation, and opposition (ARCO rights). Contact: [email protected].

A6 — Peru Supplement (Ley 29733)

BX processes personal data of Peruvian residents in accordance with Ley 29733 (Ley de Protección de Datos Personales) and its Reglamento (D.S. No. 003-2013-JUS). You have ARCO rights. Personal data databases involving Peruvian residents are operated under the principles of legality, consent, purpose, proportionality, and security. Contact: [email protected].

A7 — Spain Supplement (LOPDGDD)

BX processes personal data of Spanish residents in accordance with the Ley Orgánica 3/2018 de Protección de Datos Personales y garantía de los derechos digitales (LOPDGDD). On receipt of a valid erasure request from a Spanish resident, BX applies the bloqueo de datos procedure described in Section 5.1. Complaints may be directed to the Agencia Española de Protección de Datos (AEPD) at www.aepd.es.

Glossary