Privacy
policy.

2. Who We Are

This Privacy Policy applies to the following entities, which together constitute Buxton Helmsley for purposes of this Policy:

• Buxton Helmsley, Inc., a holding company;
• Buxton Helmsley USA, Inc., an exempt reporting adviser;
• Buxton Helmsley Fund Management, LLC, which serves as manager of the fund; and
• Buxton Helmsley Fund GP, LLC, which serves as the general partner of the fund.

The entity responsible for the Site and for the processing described in this Policy is Buxton Helmsley, Inc., 1185 Avenue of the Americas, Floor 3, New York, NY 10036-2600.

3. Information We Collect

3.1 Information You Provide to Us

Depending on how you interact with the Site, we may collect the following categories of personal information that you provide to us:

• Identifiers and contact information, such as your name, postal address, email address, and telephone number.
• Investor onboarding and verification information, which we collect from persons who inquire about or subscribe for our securities or interests in a fund we manage. This may include date of birth, citizenship or nationality, government-issued identification (such as a driver's license or passport number), and a taxpayer identification number or Social Security number, together with supporting identity-verification documentation.
• Financial and suitability information, such as income, net worth, source of funds, investment experience and objectives, and information necessary to verify accredited-investor or qualified-purchaser status under applicable securities laws, including in connection with offerings conducted under Rule 506(c) of Regulation D.
• Account and authentication information, such as the username, password, and related credentials you use to access our investor portal.
• Communications, including the contents of inquiries, correspondence, and other communications you send to us.

The provision of personal information is voluntary. However, if you decline to provide certain information, we may be unable to respond to your inquiry, to provide you with access to the investor portal, or to evaluate or process your interest in our securities or fund interests.

3.2 Information We Collect Automatically

When you visit the Site, we and our service providers may collect certain information by automated means, including:

• your IP address and approximate location derived from it;
• your device type, operating system, and browser type;
• referring and exit pages, the pages and content you view, and the links you click; and
• the dates and times of your visits.

We collect this information using cookies and analytics tools, as described in Section 4.

3.3 Sources of Information

We collect personal information from the following sources: directly from you; automatically through your use of the Site; from third-party service providers that perform identity verification, accredited-investor verification, sanctions screening, and similar functions on our behalf; and from publicly available sources.

4. Cookies, Analytics, and Tracking Technologies

We use cookies and similar technologies on the Site. Cookies are small text files placed on your device. We use both session cookies (which expire when you close your browser) and persistent cookies (which remain until they expire or you delete them).

We categorize the technologies we use as follows:

• Essential cookies, which are necessary for the Site to function, including a cookie that records your cookie-consent choices. These are always active and do not require your consent.
• Analytics and performance technologies, which help us understand how visitors use the Site. We use Google Analytics and Vercel Analytics for this purpose. Google Analytics uses cookies, and we set those cookies only after you have consented through the consent banner presented when you first visit the Site. Vercel Analytics is designed to measure Site usage without using cookies and without collecting information that identifies you individually.

You may withdraw or change your consent at any time through the consent controls on the Site, and you may also block or delete cookies through your browser settings. If you disable certain cookies, some features of the Site may not function properly.

For more information about how these providers process information, please review the Google Analytics and Vercel privacy disclosures available on their respective websites.

Do Not Track. Because there is no commonly accepted industry standard for responding to browser "Do Not Track" signals, the Site does not respond to those signals. We instead manage non-essential cookies through the consent mechanism described above.

5. How We Use Your Information

We use personal information for the following purposes:

• to respond to your inquiries and provide information you request;
• to operate, maintain, secure, and authenticate access to the Site and the investor portal;
• to evaluate and process expressions of interest in, and subscriptions for, our securities and fund interests;
• to verify identity and to verify accredited-investor or qualified-purchaser status, and to conduct sanctions and other screening, where required or appropriate;
• to comply with applicable legal, regulatory, and tax obligations;
• to detect, prevent, investigate, and respond to fraud, security incidents, and unauthorized access;
• to operate, evaluate, and improve our business, the Site, and our services;
• with your consent, to send you communications about our offerings, from which you may opt out at any time; and
• to pursue our legitimate business interests in a manner consistent with applicable law and your rights.

6. How We Share Your Information

We do not disclose personal information except as described in this Policy. We may share personal information with the following categories of recipients:

• Service providers and professional advisers that process information on our behalf and under our instructions, including technology, hosting, and analytics providers, fund administration providers, auditors, accountants, legal advisers, and identity-verification and screening providers. These recipients are required by contract to protect personal information and to use it only to provide services to us.
• Affiliated entities within Buxton Helmsley, as identified in Section 2, for the purposes described in this Policy.
• Regulators, governmental authorities, courts, and law enforcement, where we believe disclosure is required by applicable law or legal process, or is necessary to establish, exercise, or defend legal claims, or to protect the rights, property, or safety of Buxton Helmsley or others.
• Counterparties to a corporate transaction, such as a financing, reorganization, merger, or sale or transfer of assets, subject to appropriate confidentiality protections.
• Other parties with your consent or at your direction.

7. We Do Not Sell or Share Personal Information for Advertising

We do not sell your personal information. We also do not share or otherwise use your personal information for cross-context behavioral advertising or other targeted advertising, and we do not disclose your personal information to third parties for their own marketing purposes. If we ever intend to change these practices, we will update this Policy and, where required, obtain your consent before doing so.

8. Communications Monitoring

We may monitor, record, and retain electronic communications, including email, that you exchange with us, for compliance, security, training, recordkeeping, and quality-assurance purposes, to the extent permitted by applicable law.

9. Third-Party Websites

The Site may contain links to websites operated by others. We do not control those websites and are not responsible for their content or privacy practices. We encourage you to review the privacy policy of any website you visit before providing personal information.

10. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, to comply with our legal, regulatory, and tax obligations, and to establish, exercise, or defend legal claims. In general:

• Investor and subscription records are retained for the duration of the relationship and for a period of up to six years thereafter, after which they are securely disposed of, unless a longer period is required by applicable law or is necessary to address a pending or anticipated legal claim.
• Site usage and analytics information is retained for no longer than twenty-four months, or the retention period applied by the relevant analytics provider, whichever is shorter.
• Marketing and contact information is retained until you opt out of communications or request its deletion, subject to any retention required by law.

When personal information is no longer needed, we securely delete or anonymize it.

11. Data Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against loss, misuse, unauthorized access, disclosure, alteration, and destruction. Our measures include:

• monthly penetration testing and vulnerability assessments, with remediation of identified issues;
• multi-factor authentication for access to the investor portal; and
• automated blocking of IP addresses after repeated unsuccessful login attempts.

Information transmitted between your browser and the Site is protected using encrypted connections (HTTPS/TLS).

No method of transmission over the internet, and no method of electronic storage, is completely secure. While we work to protect your personal information, we cannot guarantee its absolute security.

In the event of a security incident affecting your personal information, we will notify you, and any applicable regulators, as and to the extent required by applicable law.

12. International Users and Data Transfers

The Site is operated from the United States, and the information we collect is processed and stored in the United States and in other jurisdictions where our service providers operate. If you access the Site from outside the United States, you understand that your personal information may be transferred to, and processed in, the United States and other jurisdictions whose data-protection laws may differ from those of your jurisdiction. Where we transfer personal information across borders, we do so in accordance with applicable law and, where required, subject to appropriate safeguards, as described in Section 13.

13. Privacy Rights of Individuals in the European Economic Area and the United Kingdom

This Section applies to individuals located in the European Economic Area ("EEA") or the United Kingdom ("UK") whose personal data we process, including in connection with the marketing of our corporate securities (such as common stock and convertible notes) in those regions. For the purposes of the EU General Data Protection Regulation and the UK General Data Protection Regulation (together, "GDPR"), the controller of your personal data is Buxton Helmsley, Inc.

13.1 EU and UK Representatives

• EEA Representative: General Counsel, 1185 Avenue of the Americas, Floor 3, New York, NY 10036-2600.
• UK Representative: General Counsel, 1185 Avenue of the Americas, Floor 3, New York, NY 10036-2600.

13.2 Legal Bases for Processing

We process personal data of EEA and UK individuals on the following legal bases:

• Performance of a contract, or steps taken at your request prior to entering into a contract, where we process information to evaluate and process your interest in, or subscription for, our securities;
• Compliance with a legal obligation, where we process information to meet identity-verification, sanctions-screening, tax, or other legal requirements;
• Your consent, on which we rely to set analytics cookies and to send you marketing communications, and which you may withdraw at any time; and
• Our legitimate interests, where we process information to operate and secure the Site, to prevent fraud, and to operate and improve our business, provided those interests are not overridden by your interests or fundamental rights.

13.3 Your Rights

Subject to the conditions and exceptions in applicable law, you have the right to request access to your personal data; to request correction of inaccurate data; to request erasure of your data; to request restriction of, or to object to, our processing; to request portability of data you provided to us; and, where we rely on consent, to withdraw that consent at any time without affecting the lawfulness of prior processing. To exercise these rights, contact us using the details in Section 16. You also have the right to lodge a complaint with your local supervisory authority.

13.4 International Transfers

When we transfer personal data of EEA or UK individuals to the United States or other jurisdictions that have not received an adequacy decision, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, and, where applicable, on a service provider's certification under the EU-U.S. Data Privacy Framework and its UK extension.

13.5 Automated Decision-Making

We do not make decisions producing legal effects concerning you, or similarly significant effects, based solely on automated processing.

14. United States State Privacy Rights

Several U.S. states have enacted comprehensive consumer privacy laws. Based on its current size and operations, Buxton Helmsley does not meet the applicability thresholds of those laws and is not currently a covered business or controller under them. As a matter of practice, however, and regardless of whether any particular law applies, we will honor reasonable requests from U.S. residents to access, correct, or delete the personal information we hold about them, subject to verification of identity and to exceptions permitted by law, including information we are required to retain. As stated in Section 7, we do not sell or share personal information.

If you are a resident of a state with an applicable comprehensive privacy law, you may have additional rights under that law. To exercise any right described in this Section, please contact us using the details in Section 16. We will take reasonable steps to verify your identity by matching the information you provide with information we hold, and we may request additional information reasonably necessary to verify your request. We aim to respond within 45 days, and we will inform you if we require additional time.

California residents. Much of the personal information we collect from investors and clients is subject to, and collected pursuant to, the Gramm-Leach-Bliley Act, and is therefore exempt from the California Consumer Privacy Act. For personal information that is not exempt, the rights described above apply. We do not sell or share personal information, and therefore no "Do Not Sell or Share My Personal Information" mechanism is required.

15. Children's Privacy

The Site and our services are intended for adults who are at least 18 years of age. We do not knowingly collect personal information from anyone under 18, and we do not knowingly collect personal information from children under 13 in violation of the Children's Online Privacy Protection Act. If we learn that we have collected personal information from a child under 13, we will delete it. If you believe a minor has provided us with personal information, please contact us using the details in Section 16.

16. How to Contact Us

If you have any questions about this Privacy Policy, or if you wish to exercise any of the rights described above, please contact us at:

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this Policy and post the updated Policy on the Site. If we make material changes, we will provide additional notice as appropriate, which may include posting a prominent notice on the Site or, for investors and account holders, providing notice through the investor portal or by email. We encourage you to review this Policy periodically.