California Privacy Policy and Notice at Collection

Last Modified: [9/17/2026] Effective Date: [9/17/2026] | Last Reviewed on: [9/17/2026]

This California Privacy Policy and Notice at Collection ("Notice") supplements the information contained in the Privacy Policy ("General Privacy Policy") applicable to Quicksilver Scientific, Inc. and its subsidiaries, including on behalf of our family of brands (Quicksilver Scientific®, Naba™) (collectively, "Quicksilver," "us," "we," or "our"). As used in this Notice, the "Quicksilver Sites" means the websites from which we link to this Notice, including https://www.quicksilverscientific.com/, https://www.quicksilvervault.com/, https://pro.quicksilverscientific.com/, and https://naba.com, together with our e-stores and other online products and services. This Notice applies solely to California residents that are "Consumers" ("consumers" or "you") as defined in the California Consumer Privacy Act of 2018 ("CCPA"). Any terms defined in the CCPA have the same meaning when used in this Notice. In the event of a conflict between this Notice and any other Quicksilver policy, statement, or notice, this Notice will prevail as to California Consumers and their rights under the CCPA.

This Notice covers how we may currently collect, use, disclose, and share California Consumers' "Personal Information" ("PI") as defined by the CCPA, as well as our historical collection, use, disclosure, and sharing of such PI during the twelve months preceding the Effective Date. However, this Notice does not apply to information exempt from the notice obligations of the CCPA, such as medical information governed by the Confidentiality of Medical Information Act. The information we collect about our job applicants, employees, contractors, or other workforce members is not covered in this Notice.

Consistent with the CCPA, the term "personal information" as used in this Notice does not include deidentified information. With respect to deidentified information, we: (1) take reasonable measures to ensure that deidentified information cannot be associated or reassociated with the consumer or household that it was originally about; (2) maintain and use deidentified information only in deidentified form and do not attempt to reidentify it (except as necessary as part of the process of confirming the information cannot be reidentified); and (3) do not disclose deidentified information to any third party unless the third party enters into a contract obligating it to comply with the earlier two points.

Collection, Use, Disclosure, and Sharing of PI

Generally, we collect, retain, use, disclose, and share your PI to provide you with our products and services (collectively, "Services") and as otherwise related to the operation of our business. In addition, we may collect, use, disclose, and share your PI as required or permitted by applicable law, or as directed by you, in accordance with this Notice.

Collection, Use, and Disclosure of PI

We collect PI directly from you, automatically as you navigate our websites, and from third parties. Third-party sources include digital marketing providers (social media and other online advertising and marketing providers, brand managers, marketing brokers, digital advertising publishers, and similar vendors) and our partners and delivery carriers (partners from whom you may order our products, and the service providers we use to fulfill orders).

We collect, use, and disclose PI for the CCPA-defined business purposes in the list below, and also for the purposes described in our General Privacy Policy (our operational purposes) (collectively, our "Business Purposes").

• Auditing related to a current interaction with the consumer and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards;

• Detecting security incidents, protecting against malicious, deceptive, or illegal activity, and prosecuting those responsible for such activity;

• Debugging to identify and correct errors that impair existing intended functionality;

• Short-term, transient use in which PI is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer's experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction;

• Providing Services, including fulfilling orders, processing payments, shipping goods, maintaining and servicing your account with us, verifying your information, providing customer support, analytic services, and similar functions and services;

• Providing advertising and marketing services to you;

• Undertaking internal research for technological improvement and demonstration;

• Quality and safety assurance, and improving, upgrading, and enhancing the Services;

• Complying with applicable laws, regulations, and oversight obligations, engaging with law enforcement and other governmental bodies, and enforcing our legal rights and remedies.

The categories of third parties to which we disclose PI for Business Purposes include contractors and service providers that support our business purposes, digital marketing providers, partners and delivery carriers, and government entities. The categories of PI disclosed to service providers and contractors for Business Purposes include identifiers, California Customer Records information, commercial information, and internet or similar network activity. We make disclosures to government entities, for example, in connection with investigating fraud, enforcing our rights, or as required by law. We may also disclose PI to a buyer or other successor in the event of a merger, acquisition, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Quicksilver's assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding.

The table below describes the CCPA-defined categories of PI that we collect, use, and disclose for Business Purposes.

Categories of PI Collected, Used, and Disclosed for Business Purposes

Sensitive Personal Information

We also collect the following CCPA-defined category of "sensitive personal information," and we disclose the information for Business Purposes to the same categories of third parties identified above:

• A consumer's account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account, for example to process purchases and link them to your account.

We may also collect other categories of sensitive personal information, including PI concerning a consumer's health, racial or ethnic origin, religious or philosophical beliefs, union membership, sex life or sexual orientation, or the contents of his or her mail, email, or text messages if: (i) the consumer happens to disclose such PI to our customer support team; or (ii) we collect such PI by subpoena or other legal process due to investigating fraud or enforcing our rights.

We do not use or disclose sensitive personal information for any purposes that would require a consumer to exercise a right to limit processing according to California law, and we do not sell or share sensitive personal information. We also do not use automated decision-making technology ("ADMT") to make any significant decision concerning you, as those terms are defined in the CCPA and its implementing regulations, without the opportunity for human review. To the extent we use ADMT in connection with our Sites, such use is limited to website analytics, ad measurement, personalization, and security purposes, and does not involve decisions that produce legal or similarly significant effects concerning you.

Deletion of PI After Fulfilling the Purpose of Collection

We delete your PI after retention is no longer reasonably necessary to fulfill the purposes for which the PI was collected and in accordance with our records retention practices. When assessing retention periods, we examine whether it is necessary to retain the personal data collected and, if retention is required, reasonably endeavor to retain the personal data for the shortest possible period permissible under law. We store your personal information as necessary to comply with our legal obligations, resolve disputes, and enforce and exercise our agreements and rights, or if it is not technically and reasonably feasible to delete your personal information. Please see below for information regarding whether you may be entitled to request that your information be deleted.

Sharing, Cookies, and Similar Technologies

When you use our Sites, we and our partners collect information, which may include PI, from your browser and devices using a variety of methods, such as cookies, web beacons, tracking pixels, tag management systems, and other similar technologies. Our Sites use cookies to help keep track of items you put into your shopping cart, including when you have abandoned your cart, and this information is used to determine when to send cart reminder messages via SMS. We use cookies and similar technologies for the following Business Purposes:

• To analyze and understand how consumers access, use, and interact with our Sites, and consumer preferences;

• To assess, secure, protect, optimize, and improve the performance of our Sites;

• To obtain aggregate data about traffic and interaction on our Sites, conduct analytics, identify trends, and obtain statistics;

• To target advertising and content across our Sites and third-party sites and services;

• To provide or make available certain features or portions of our Sites;

• To serve you with relevant ads and content, including recommending products based on your preferences;

• To manage, improve, and measure our advertising campaigns;

• To match information that we hold with personal information in third-party platforms' databases to create custom audiences and tailor advertising to your interests on the Internet, including social media; and

• As necessary to respond to your requests.

Some of these activities involve sharing the categories of PI listed in the chart below. The categories of third parties with which we share the PI include advertising networks, digital marketing providers, data analytics providers, social networks, and similar vendors, each of which may use this information for their own advertising and marketing activities.

Categories of PI Sold or Shared

We do not disclose your PI to third parties in exchange for money. However, in connection with the marketing purposes described above, we may "sell" or "share" the categories of PI listed in the chart above within the broad definitions adopted under the CCPA and other state privacy laws. We do not sell or share: (i) sensitive personal information; (ii) your mobile phone number, SMS opt-in status, or SMS consent information; or (iii) PI about individuals who we have actual knowledge are, or who we reasonably should know to be, under the age of 16. Consistent with amended CCPA regulations, we treat personal information of consumers we have actual knowledge are under 16 years of age as sensitive personal information. Additionally, we do not share PI to the extent doing so is prohibited by law. Please see "CCPA Privacy Rights" below for information regarding exercising your rights to opt out of the sale or sharing of your PI.

SMS/Text Message Marketing Program

We offer an SMS/text message marketing program (the "SMS Program"). Participation is entirely voluntary. After you provide your mobile number and opt in, you consent to receive recurring automated text messages (SMS, MMS, and RCS) from us at the number you provided, which may include notifications related to your orders and marketing messages. Your consent to receive text messages is not a condition of any purchase.

Message frequency varies. Message and data rates may apply. You may reply STOP at any time to unsubscribe, or reply HELP for assistance. You may also contact us using the information in the "Contact Information" section below. For the full terms governing our text messaging program, please see the applicable Messaging Terms & Conditions.

We will not share, sell, rent, or transfer your mobile phone number, SMS opt-in status, or SMS consent information to any third parties or affiliates for their marketing or promotional purposes. Any sharing of your mobile phone number is limited to service providers or vendors acting on our behalf solely to operate, deliver, and support the SMS Program, and such providers are contractually restricted from using this information for any other purpose. This commitment applies regardless of any other data-sharing practices described in this Notice.

CCPA Privacy Rights

California Consumers have the right to exercise certain privacy rights under the CCPA. California Consumers may exercise these rights via an authorized agent who meets the agency requirements of the CCPA. Any request you submit to us, other than a request to opt out of the sale or sharing of your PI, is subject to an identification and residency verification process ("Verifiable Consumer Request"). We will not fulfill your CCPA request to know, delete, or correct unless you have provided sufficient information for us to reasonably verify you are the Consumer about whom we collected PI. We will not require you to verify your identity, create an account, or complete any unnecessary step in order to process a request to opt out of the sale or sharing of your PI.

To verify your identity, we may confirm your full legal name, home address, and last two purchases. We reserve the right to ask you to provide additional information in order to help verify your identity. We will only use PI provided in a request to verify the requestor's identity or authority to make it.

Some personal information we maintain about Consumers is not sufficiently associated with a Consumer for us to be able to verify that it is a particular Consumer's personal information (e.g., clickstream data tied only to a pseudonymous browser ID). As required by the CCPA, we do not include that personal information in response to Verifiable Consumer Requests. If we cannot comply with a request, we will explain the reasons in our response.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

A. The Right to Know

1. Categories

You have the right to send us a request, no more than twice in a twelve-month period, for any of the following for the period that is twelve months prior to the request date:

• The categories of PI we have collected about you.

• The categories of sources from which we collected your PI.

• The business or commercial purposes for our collecting, selling, or sharing your PI.

• The categories of third parties to whom we have sold, shared, or disclosed your PI.

• A list of the categories of PI disclosed for a business purpose in the prior 12 months, or that no disclosure occurred.

2. Specific Pieces

You have the right to make or obtain a transportable copy, no more than twice in a twelve-month period, of your PI that we have collected in the period that is 12 months prior to the request date and are maintaining. For data portability requests, we will select a format that, to the extent technically feasible, is readily usable and should allow you to transmit the information from one entity to another without hindrance.

Please note that PI is retained by us for various time periods, so we may not be able to fully respond to what might be relevant going back 12 months prior to the request.

B. The Right to Deletion

Except to the extent we have a basis for retention under the CCPA, you may contact us at the phone number or email address posted below to request that we delete your PI that we have collected from you and are maintaining. We will delete or deidentify personal information not subject to an exception from our records and will direct our service providers to take similar action. Our retention rights include, without limitation, completing transactions and services you have requested or that are reasonably anticipated, detecting security incidents, legitimate internal business purposes including maintaining business records, complying with law, exercising or defending legal claims, and cooperating with law enforcement. Note also that we are not required to delete PI that is publicly available, and we are not required to delete lawfully obtained, truthful information that is a matter of public concern.

You may alternatively exercise more limited control of your PI by canceling or modifying the email marketing communications you receive from us, by following the unsubscribe instructions at the bottom of each email. This will not affect subsequent subscriptions, and if your opt-out is limited to certain types of emails the opt-out will be so limited. Please note that we reserve the right to send you certain communications relating to your account or use of our Services, such as administrative and service announcements, and these transactional messages may be unaffected if you choose to opt out from receiving our marketing communications.

C. The Right to Opt Out of Sale or Sharing of PI

You have the right to opt out of the sale of your PI and of the sharing of your PI with third parties for cross-context behavioral advertising. You may exercise this right by:

• Updating your preferences through the "Your Privacy Rights" link on our Sites;

• Clicking the "Do Not Sell or Share My Personal Information" link on our Sites;

• Calling us at 303-531-0861; or

• Emailing us at privacy@quicksilverscientific.com.

You do not need to create an account with us to submit an opt-out request, and we will confirm to you that your request has been processed. Adjusting the settings on your browser may also help you exercise control over browser-based cookies and other sharing.

Another option available to you is to engage Global Privacy Control ("GPC") settings. On browsers, browser extensions, or devices that support GPC functionality, it can generally be engaged by manipulating the browser or device settings. When we detect a valid GPC or other opt-out preference signal, we will process it as a request to opt out of the sale or sharing of your PI associated with the browser or device from which the signal was sent, and, where we can reasonably associate that browser or device with a consumer account or other identifier by which we know you, we will apply your opt-out to your account across all associated browsers and devices. If you use different browsers or profiles, you may need to enable the preference signal in connection with each browser and profile for us to associate the signal with you. If you delete or reset your browser settings, you may need to re-enable your opt-out preference signal. Not all websites respond to GPC signals in the same way.

We may disclose your PI for the following purposes, which are not a sale or share: (i) if you direct us to share PI; (ii) to comply with your requests under the CCPA; (iii) disclosures amongst the entities that constitute Quicksilver as defined above; (iv) as part of a merger or asset sale; and (v) as otherwise required or permitted by applicable law.

D. The Right to Correct Inaccurate PI

You have the right to ask that we correct the personal information we may have collected about you if that information is inaccurate. To correct your PI, please revise the PI yourself by logging into your account or, if that is not possible, please reach out to us at the contact information below. Upon verification of the contested PI, we will correct or delete the incorrect PI.

E. The Right to Non-Discrimination

We will not discriminate against you in a manner prohibited by the CCPA because you exercise your CCPA rights. Unless permitted by applicable law, we will not deny you goods or services, charge you different prices or rates (including through granting discounts or other benefits, or imposing penalties), provide you a different level or quality of goods or services, or suggest that you may receive a different price, rate, level, or quality of goods or services.

F. The Right to Limit the Use and Disclosure of Sensitive Personal Information

California Consumers have the right to limit the use and disclosure of their sensitive personal information to those uses that are necessary to perform the services or provide the goods reasonably expected by an average consumer, and to certain other purposes permitted under the CCPA (such as security, fraud prevention, and short-term, transient use). As described above under "Sensitive Personal Information," we do not use or disclose sensitive personal information for purposes that would require us to offer you the ability to limit such use, and therefore we are not required to provide a "Limit the Use of My Sensitive Personal Information" link. If our practices change such that this right becomes applicable, we will update this Notice and provide the means to exercise it.

Authorized Agents

Only you, or someone legally authorized to act on your behalf, may make a request to know, delete, or correct related to your PI. To designate an authorized agent if you are a California resident, the agent must be a natural person or a business entity that is registered with the California Secretary of State. If you would like to designate an agent to act on your behalf, you and the agent will be required to provide us with proof of the agent's identity and proof that you gave the agent signed permission to submit a request on your behalf. Additionally, you will be required to verify your identity by providing us with certain PI as described above, or provide us with written confirmation that you have authorized the agent to act on your behalf.

This subsection does not apply when an agent is authorized to act on your behalf pursuant to a valid power of attorney. Any such requests will be processed in accordance with respective state law pertaining to powers of attorney.

Response Timing and Format

We will confirm receipt of your request within ten (10) business days. If you do not receive confirmation within the 10-day timeframe, please contact us at privacy@quicksilverscientific.com.

We endeavor to substantively respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing.

If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. Any disclosures we provide will only cover the 12-month period preceding our receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

Data Security and Breach Notification

We maintain reasonable administrative, technical, and physical safeguards designed to protect your PI against unauthorized access, use, or disclosure. In the event of a breach of the security of the system involving your PI, we will notify affected California residents in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement and any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system, as required by applicable California law.

Other California Privacy Rights

California's "Shine the Light" law (Civil Code Section § 1798.83) may require certain covered businesses, in response to a consumer request, to provide either: (i) information about the business's disclosure of the consumer's PI to third parties for those third parties' direct marketing purposes, or (ii) a cost-free opportunity to opt out of such disclosures.

California residents may request information about our disclosure of PI to third parties for those third parties' direct marketing purposes by contacting us using the information in the "Contact Information" section below. Please note that because consumers' rights under Shine the Light and the CCPA are not the same and exist under different laws, we may respond separately to each type of request.

Changes to Our Privacy Notice

We reserve the right to amend this Notice at our discretion and at any time. When we make changes to this Notice, we will post the updated notice on our Sites and update the Notice's Last Modified date. This includes any changes to the terms of our SMS Program; material changes affecting the SMS Program will be communicated in accordance with applicable law and, where required, your renewed consent will be obtained. Your continued use of our Sites following the posting of changes constitutes your acceptance of such changes.

Contact Information

If you have any questions or comments about this Notice, the ways in which we collect and use your information described here and in the General Privacy Policy, including our SMS Program, your choices and rights regarding such use, or wish to exercise your rights under California law, please contact us at:

• Phone: 303-531-0861

• Privacy Email: privacy@quicksilverscientific.com

• Support Email: support@quicksilverscientific.com | support@naba.com

• Websites: https://www.quicksilverscientific.com/ | https://www.quicksilvervault.com/ | https://pro.quicksilverscientific.com/ | https://naba.com

• Postal Address: Quicksilver Scientific, Inc., Attn: Privacy, 1960 Cherry St., Louisville, Colorado 80027

To complete your request, you will be required to respond to any follow-up inquiries we may make, and we may deny your request if you do not do so.