GHOSTWORKS MARINE, INC.

PRIVACY POLICY

Last Modified: September 4, 2025

GHOSTWORKS MARINE, INC. (“GHOSTWORKS,” “we,” “us,” or “our”) values its customers, their information, their privacy, and their trust. This Privacy Policy (“Policy”) applies to information collected online from users of the GHOSTWORKS website at www.ghostworksmarine.com. (the “Site”) and explains how we collect, use, and protect that information. This Policy applies to GHOSTWORKS’ collection, use, processing, storage, and transfer of information from the Site. For the purposes of this Policy, unless otherwise noted, references to the Site includes email correspondence or use of GHOSTWORKS’ online forms or other electronic messages between you and the Site.

Throughout this Policy, we refer to the term “Personal Information.” “Personal Information” means data which identifies, describes, is associated with, or could be linked to an individual, such as a name, birthdate, postal address, email address, telephone number, driver’s license number, Social Security Number or other government-issued identification number, credit card number, or other unique identifiers.

Personal Information does not include anonymous or aggregated data that can no longer be used to identify a specific person, even if combined with other data. Also, we may collect information related to businesses, companies, institutions, or other entities rather than individuals (“Business Information”). We do not consider Business Information, such as title, employer’s name, work email, work phone number, work address, and other similar business information, to be Personal Information.

Please note that the products and services offered on this Site are intended for users who reside in the United States. If you visit our Site from a country outside the United States, please note that the data protection laws in the country in which you reside may be different from the data protection requirements in the United States. Information that we may collect from you in connection with your use of this Site will be processed in accordance with federal and state laws of the United States.

Information We Collect

We collect information about you in several ways: 1) directly from you; 2) indirectly from you via your use of the Site; and 3) from third parties.

Information Collected Directly From You

When you contact us through our Site or online forms, we will collect certain Personal Information about you so that we may verify your identity, adequately respond to your inquiry or assist you in purchasing products. To do this, we collect information from you when you visit our Site, send us questions or communicate with us through the Site, register with us, place an order, fill out a form, or provide information in connection with other activities, services, features, or resources we make available on the Site. We may collect information including your first and last name, email address, phone or fax number, date of birth, and the contents of any messages you may send us. Specifically, the information we collect and the purpose associated is as follows:

Activity

Potential Information Collected

Access to the Site

Internet Protocol (IP) address; browser type and language; Internet Service Provider (ISP), referring and exit Sites and applications; Site pages viewed while on the Site; operating system; date/time stamp of activity; clickstream data; whether you are a first-time or a returning user; links you clicked on while in the Site; and your flow and

navigation path through the Site

Place or pay for an order or invoice

Name, email address, phone number, address, credit card information

Apply for a job through the Site

Name, phone number, email address, LinkedIn profile page, your desired employment type, your available start date, job title, desired salary, current location, resume/cover letter, name of your reference, reference phone number, reference email address, any additional information provided by you. This information may also be

collected by BambooHR. Their privacy policy is available at https://www.bamboohr.com/legal/privacy-policy.

Sign up to receive communications

Name, email address, company name, phone number, location, contents of your inquiry

Communicate through the Site

Name, email address, contents of your communication with us

The personal information we collect from you is used to provide you with our products and services in a timely manner, to answer your inquiries, and to allow you to apply for jobs.

Information Collected Indirectly from You

When you visit our Site, we may collect information about your visit and maintain that information in our web server logs, which are records of the activities on our Site. The servers automatically capture and store the information electronically. Examples of the information we may collect include: Internet Protocol (IP) address; browser type and language; Internet Service Provider (ISP), referring and exit Sites and applications; Sites viewed while on the Site; operating system; date/time stamp of activity; clickstream data; whether you are a first-time or a returning user; links you clicked on while in the Site; and your flow and navigation path through the Site. We use this information in a deidentified and aggregated fashion to help us administer the site, analyze its usage, protect the Site and its content from inappropriate use, and improve your Site experience.

Cookies

GHOSTWORKS does not use cookies to track information related to users of our Site. Such tracking is done by third-party Google Analytics, which may use technologies such as “cookies” to remember certain information about you, remember your preferences, or recognize you when you return to the Site. Cookies also help compile aggregate data about Site traffic and Site interaction so that we can improve our Site and protect our Site from fraud. The Google Analytics policies can be found at https://policies.google.com/technologies/partner-sites.

A cookie is a text file that is stored on your computer. As text files, cookies cannot read information on your hard drive, run programs, or deliver viruses to your computer.

Most browsers are set to accept cookies automatically. You can set your browser to decline all cookies automatically or to prompt you for a response each time a cookie is offered. If you decline cookies, you may find that you cannot access all of our Site’s features.

During your browsing session, we use “session” cookies to store information and monitor Site function. These session cookies are installed during your browsing session and are deleted when the browsing session has ended.

When Deleted

Purpose

Google Analytics

To collect non-identifying information about your browsing and use activity on the Site to improve Site operation and your experience using the Site.

Third party cookie associated with forms

30 minutes after leaving Site

Provides unique code to vendor operating our job application and information request form to allow vendor to know that request came from this Site.

In some parts of our Site and through email messages, you will find a “click-through URL” linked to content on our Site. We track this click-through data to help us determine interest in particular topics and measure the effectiveness of our customer communications. If you prefer not to be tracked in this way, you should not click such links in our email messages.

We also use log files when you visit our Site. Log files track IP addresses, browser type, Internet Service Provider (ISP) identity, referring/exit pages, platform type, data/time stamp, and number of clicks. We utilize this information in our legitimate interest in administering the Site, preventing fraud, tracking Site navigation in the aggregate, and gathering broad demographic information for aggregate use.

Site Analytics

We use third-party Site analytics software from third-party providers, specifically, Google Analytics, in connection with our Site to gather data such as age, gender, and interests to provide advertising targeted to suit your interests and preferences.

You may opt out of the automated collection of information by third-party ad networks for the purpose of delivering advertisements tailored to your interests, by visiting third party pages and using their opt out methods.

This analytics software helps us target our online ads based on information collected directly from you or by automated means, like cookies. These companies also use automated technologies to collect information when you click on our ads, which helps track and manage the effectiveness of our marketing efforts.

GHOSTWORKS utilizes analytics software provided by Google Analytics. Google Analytics collects information associated with the Site (like information about your browser, network, and device, web pages visited before and during your view of the Site, and your IP address) that is not used to identify a user. This information helps us better understand how visitors use our Site, detect and defend against fraud and other security risks, and present advertisements, products, and/or services of interest to you.

Information We Collect From Third Parties

We may collect information that others provide about you when you use the Site or obtain information from other sources and combine that with information we collect through the Site.

Third Party Services. If you link, connect, or login to your account with a third-party social media service (e.g., Facebook, Google, Instagram, Yelp, ), the third-party service may send us information such as your registration and profile information from that service. This information varies and is controlled by that service or as authorized by you via your privacy settings at that service.
Other To the extent permitted by applicable law, we may receive additional information about you, such as demographic data or fraud detection information, from third party service providers and/or partners, and combine it with information we have about you. For example, we may receive fraud warnings from service providers like identity verification services for our fraud prevention and risk assessment efforts. Other examples of such providers include, but are not limited to, backend processing, fulfillment, and automation, email management, authentication, form processing, Site usage tracking, and database hosting and management.

Third-Party Use of Cookies and Other Tracking Technologies

Some content or applications, including advertisements, on the Site are served by third parties, including advertisers, ad networks and servers, content providers and application providers. First-party or third-party cookies may be used alone or in conjunction with web beacons or other tracking technologies to collect information about you when you use our Site. A first-party cookie is a cookie set by the domain name that appears in the browser address bar. A third-party cookie is a cookie set by (and on) a domain name that is not the domain name that appears in the browser address bar. It might be set as part of a side resource load (image, JS, iframe, etc., from a different hostname) or an AJAX HTTP request to a third-party server. The information that first-party and third-party cookies collect may be associated with your Personal Information or they may collect information, including Personal Information, about your online activities over time and across different Sites and other online services (i.e., tracking such activities). They may use this information to provide you with interest-based (behavioral) advertising or other targeted content. We do not control these third parties’ tracking technologies or how they may be used. If you have any questions about an advertisement or other targeted content, you should contact the responsible provider directly.

Children’s Information

Our Site is not directed at children. We do not knowingly collect Personal Information from anyone under the age of 18. If you are a parent or guardian and believe your child has provided us with Personal Information without your consent, please contact us by using the information in the “Questions and Contact Information” section, below, and we will take steps to remove such Personal Information from our systems.

Use of Personal Information

We use information that we collect about you or that you provide to us, including any Personal Information, for one or more of the following purposes:

To present our Site and its contents to you;
To provide you with information and respond to your questions on services that you request from us and information on new services, discounts, special promotions or upcoming events, and features or offers that we believe will be of interest to you;
To provide you with customer support;
To improve and further develop the products and services we offer on this Site;
To protect and maintain the security and integrity of our Site and its infrastructure;
To authenticate information you provide to us;
To protect our rights and property or the rights and property of others;
To detect, prevent and respond to fraud, intellectual property infringement, violations of our Terms of Use, violations of law and any misuse of the Site or our products or services;
To comply with any legal obligations imposed on us;
To pursue legal remedies available to us, limit our damages, and comply with judicial proceedings, court orders, or lawful requests from governmental authorities and for other legal purposes;
To process transaction payments, including, but not limited to, product and/or service fees, and payments, refunds and reimbursements for any products or services that you choose to purchase from us;
To notify you about information regarding or changes to our Site, our policies, terms, or any services we offer or provide;
To allow you to participate in interactive features on our Site;
For internal purposes, such as Site and system administration or internal audits and reviews;
To notify you of data privacy incidents or provide you with legally required information;
In any other way we may describe and for which we obtain your consent when you provide the information and you give your

We use log file information to: (a) remember information so that you will not have to re-enter it during your visit or the next time you visit the Site; (b) monitor the effectiveness of our Site and services; (c) monitor aggregate metrics such as total number of visitors, traffic, and demographic patterns; (d) diagnose or fix technology problems reported by our users or engineers that are associated with certain IP addresses; and, (e) help you efficiently access your information after you sign in. We may use the information we have collected from you to enable us to display advertisements to our advertisers’ target audiences. Even though we do not disclose your Personal Information for these purposes without your consent, if you click on or otherwise interact with an advertisement, the advertiser may assume that you meet its target criteria.

We only use your Personal Information for the original purposes it was given and to further our legitimate interests, such as to provide information about our organization and services, and to communicate with Site visitors. Personal Information is used also to provide you with a more enjoyable, convenient online experience. We may use your Personal Information to send you requested information, to personalize content for you, to compile, analyze, and better understand user data, demographics and behavior, and to detect, investigate, and prevent activities that may violate our policies or be illegal. We may also use your Personal Information to communicate with you about events, products and services we believe you might find of interest and to administer marketing materials and surveys in which you might participate.

We also use the information automatically collected about you during your use of the Site, as described above, to improve the effectiveness of our Site, operations, mobile experience, or marketing efforts, to prevent against fraud and theft, and otherwise to protect our Site’s visitors and our organization.

Our employees, contractors eand agents may view your Personal Information to perform their jobs and address your needs. We authorize their access to your Personal Information on a need-to-know basis to provide you with information or services, or for one of the other reasons listed in this policy, and always in connection with a contractual obligation to protect the privacy of that information.

Disclosure of Your Information

We will not sell, rent, or lease any information we collect from you to others. We will not make your Personal Information available to any unaffiliated parties, except as follows:

To employees, agents, Site vendors, and/or contractors who may use it on our behalf or in connection with their relationship with us;
To our affiliates, service providers, and third parties identified herein [e.g., analytics, vendor partners] for marketing purposes, building targeted ad campaigns, and providing you information about us or our services.
To others, including law enforcement, if we believe such release is reasonably necessary to comply with law or legal process; enforce or apply the applicable GHOSTWORKS Terms of Use, if reasonably necessary to protect our operations, members, or users; detect, prevent or otherwise address fraud, security, or technical issues; protect the rights, property, or safety of others; in a matter of public safety or Policy; or as needed in connection with the transfer of our assets or in connection with investor relations. In the event of an insolvency, bankruptcy, or receivership, your Personal Information may also be transferred as a business asset.

In addition, we may share aggregate, non-individual information, incapable of identifying a person, with third parties for lawful purposes. We will not disclose any of your Personal Information except when we have your permission or under special circumstances, such as when we believe in good faith that the law requires it or under circumstances described in this Policy.

Access and Consent to Use of Your Personal Information

If you believe that the Personal Information that we have collected about you is incomplete, inaccurate, or not up to date, or if you would like to review and/or request changes or deletion of that information, please see the contact information in the “Questions and Contact Information” section.

If you do not consent or want to withdraw your consent for us to collect, use, or disclose your Personal Information as described in this Policy, please use the contact information provided in the “Questions and Contact Information” section. In your request, please identify the Personal Information at issue and the collection, use, or disclosure you wish to stop.

Denying or withdrawing consent may not allow us to provide you with some or all the products, services, or information you request.

You may opt out of receiving marketing-related emails, targeted advertising messages, or promotional offers from GHOSTWORKS by clicking the "unsubscribe" link at the bottom of any email you receive from us or emailing us at minerva@ghostworksmarine.com.

If you opt out from receiving marketing emails or text messages, we may still need to send you communications about your account and other matters. If you agreed to receive future marketing communications directly from a third party through our Site, you will need to contact that party to opt out of such communications. This process may be outlined on that party's privacy policy. We do not control third parties’ collection or use of your information to serve interest-based advertising. However, these third parties may provide you with ways to choose not to have your information collected or used in this way. You can opt out of receiving targeted ads from members of the Network Advertising Initiative (“NAI“) on the NAI’s Site .

State Specific Requirements

For more information regarding your state-specific rights, please refer to the notices at the following links:

CALIFORNIA PRIVACY NOTICE

STATE-SPECIFIC POLICIES

Your Canadian Rights

If you are a Canadian resident, you have the right to access the Personal Information that we collect and process. You may also request that we rectify or erase Personal Information, restrict the processing of your Personal Information or object to the processing of your Personal Information. In addition, you have the statutory right to file a complaint with a competent data protection authority.

To exercise these rights, please submit your specific request by using the information in the “Questions and Contact Information” section below. If your identity can be authenticated, we will comply with your request if possible or will notify you otherwise.

European Economic Area

The following section, in conjunction with the information above, describes GHOSTWORKS’ data practices in accordance with the GDPR.

Legal Basis of Processing

We will only process the Personal Information subject to the GDPR as it is described in this Privacy Policy if we have a lawful basis for doing so:

Individuals have given their consent for one or more specific purposes;
Provision of Personal Information is necessary for the performance of an agreement and/or for any pre-contractual obligations;
Processing is necessary for compliance with a legal obligation;
Processing is related to a task that is carried out in the public interest or in the exercise of official authority vested in GHOSTWORKS; or
Processing is necessary for the purposes of the legitimate interests pursued by GHOSTWORKS or by a third

Access to Information and Your Rights

For United Kingdom and EU residents subject to the GDPR, you have certain rights relating to your Personal Information, subject to local data protection laws. These rights may include:

To access your Personal Information held by us (right to access);
To rectify inaccurate Personal Information and, taking into account the purpose of processing the Personal Information, ensure it is complete (right to rectification);
To erase/delete your Personal Information, to the extent permitted by applicable data protection laws (right to erasure; right to be forgotten);
To restrict our processing of your Personal Information to the extent permitted by law (right to restriction of processing);
To transfer your Personal Information to another controller or processor, to the extent possible (right to data portability);
To object to any processing of your Personal Information carried out on the basis of our legitimate interests (right to object).
Where we process your Personal Information for direct marketing purposes or share it with third parties for their own direct marketing purposes, you can exercise your right to object at any time to such processing without having to provide any specific reason for such objection;
To the extent we base the collection, processing, and sharing of your Personal Information on your consent, to withdraw your consent at any time, without affecting the lawfulness of the processing based on such consent before its withdrawal.

To exercise these rights, please submit your specific request by using the information in the “Questions and Contact Information” section below.

Timeframe for Responding to Requests

GHOSTWORKS will respond to your request within thirty (30) days of receipt. The period of response may be extended to forty-five

(45) or sixty (60) days if more time is required. In that event, we will inform you of the reason and extension period in writing.

Fee

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded.

Security of your Personal Information

We implement a variety of security measures to help protect your personal information from unauthorized access, disclosure, alteration and destruction, which include holding your personal information on a secured network with limited access. This information is required by GHOSTWORKS to be kept confidential. Although we use our best efforts to ensure the security and confidentiality of your personal information, unfortunately, no data transmission can be guaranteed to be 100% secure. Thus, we cannot guarantee or warrant the security of any information you transmit to us and you do so at your own risk. You should only access our Site within a secure environment and you remain solely responsible for the security of your computer or other device at all times.

To prevent unauthorized access, maintain data accuracy, and ensure the correct use of information, we maintain appropriate physical, electronic, and managerial procedures to safeguard and secure the information and data stored on our system.

When personal information (such as a credit card number) is transmitted by GHOSTWORKS to other Sites, it is protected through the use of encryption. While no computer system is completely secure, we believe the measures we have implemented reduce the likelihood of security problems to a level appropriate to the type of data involved.

Links to Other Sites

Our Site may contain links to, or advertisements about, non-GHOSTWORKS Sites. Other sites may also reference, advertise, or link to the GHOSTWORKS Site. You may be able to post content to third party Social Networking Sites on which we maintain a presence. If you choose to do this, we will provide information to the Social Networking Site(s), and receive information from them, in accordance with your elections. You acknowledge and agree that you are solely responsible for your use of those Sites and that it is your responsibility to review the applicable terms of use and privacy policies. We are not responsible for the availability, accuracy, content, products or services of third-party Social Networking Sites.

While you are using the Site, you may be linked or directed to other third-party Sites that are beyond our control. These third-party Sites may have privacy policies and terms of use which differ from ours. Please carefully review these policies. We are not responsible for any actions or policies of such third parties.

Retention and Accuracy of Personal Information

We do our best to ensure that the Personal Information we hold, and use is accurate. We rely on the individuals we do business with to disclose to us all relevant information and to inform us of any changes. We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless otherwise required by law. We will only keep your personal information for as long as it is necessary for the purposes set out in this privacy notice, unless a longer retention period is required or permitted by law (such as for tax, accounting or other legal requirements).

When we have no legitimate business need to process your personal information, we will either delete or anonymize it, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

Data Transfer

We may maintain your Personal Information on computers and servers located outside of your state of residence, country, or economic region.

We may arrange for the data to be passed on to one or more order processors (e.g., providers, web service providers, newsletter distribution providers), responsible sales offices, sales representatives or partner companies, who will also use the personal data exclusively for the stated purposes. The transmission of your data entered in the forms is encrypted in all cases. Any further transfer of

your personal data to third parties will only take place with your consent, unless there is a legal obligation to do so or in order to protect the rights, property and safety of GHOSTWORKS. Insofar as external service providers come into contact with personal data, we require mandatory legal, technical and organizational measures to comply with data protection regulations.

Changes to the Policy

From time to time, we may change this Policy and will notify you of material changes by posting the changed or modified Policy on our Site. Any changes will be effective immediately upon the posting of the revised Policy unless otherwise specified.

A Note to Parents Regarding the Children’s Online Privacy Protection Act:

Our Site is a general audience Site that is neither designed nor intended to collect personal information from children. GHOSTWORKS cares about the safety and privacy of children online and complies with the Children’s Online Privacy Protection Act of 1998 (COPPA). COPPA and its accompanying FTC regulation establish United States federal law that protects the privacy of children using the Internet. Children under the age of 13 should not send us any personal data, including your email. If you are under the age of 13 and would like to contact us, please ask your parent or legal guardian to contact GHOSTWORKS on your behalf. We ask that parents supervise their children while online.

Should GHOSTWORKS becomes aware we have received personal information pertaining to persons under 13, we will promptly attempt to obtain parental consent or delete the personal information from our servers. If you want to notify us of our potential receipt of information by children under 13, please email us at legal@ghostworksmarine.com.

Questions and Contact Information

For any questions or concerns you may have regarding this Privacy Policy and our information and data collection and use practices, please contact us at:

VIA MAIL: Ghostworks Marine, Inc., 475 Holland Ave., Holland, Michigan, 49424 VIA EMAIL: legal@ghostworksmarine.com.

You may also request, at any time, that we review, change or delete your personal information or your preferences to receive any emails, products or services from us. To do so, please send us a written request as set forth above.

Purpose

CALIFORNIA PRIVACY NOTICE

Last Modified: September 4, 2025

This California Privacy Notice (the “Privacy Notice”) supplements the information contained in the Privacy Policy (“Policy”), located on the GHOSTWORKS website (the “Site”), and applies solely to individual residents of the State of California ("consumers," “residents,” or "you"). This Privacy Notice applies to GHOSTWORKS MARINE, INC., and its affiliates (collectively, “GHOSTWORKS,” “we,” “us,” or “our”), and describes how we collect, use, disclose, and otherwise process Personal Information of individual residents of the State of California, either online or offline, within the scope of the California Privacy Rights Act (“CPRA”).

When we use the term “Personal Information” in this Privacy Notice, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Any other terms defined in the CPRA have the same meaning when used in this Privacy Notice.

Personal Information We Collect

We may collect Personal Information from and about you for a variety of purposes. To learn more about the types of Personal Information we collect, the sources from which we collect or receive Personal Information, and the purposes for which we use this information, please refer to the “Information We Collect” section in our Policy.

We have collected the following categories of Personal Information from consumers within the last twelve (12) months:

Categories

Examples

Collected

Categories of Sources

Identifiers

Name , address, email address, phone number, etc.

We may share this information with trusted partners and third-party service providers to communicate on our behalf, and provide you with promotional content or other information from GHOSTWORKS that may be of interest to you, and for the purposes outlined in our Privacy Policy.

Categories

Examples

Collected

Categories of Sources

Personal Information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))

A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.

We only collect the information in this category when you provide it directly to us. We may share this information with trusted partners and third-party service providers to communicate on our behalf, and for the purposes outlined in our Privacy Policy

Some personal information included in this category may overlap with other categories.

Protected classification characteristics under California or federal law

Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation,

veteran or military status,

We only collect the information in this category when you provide it directly to us. We may share this information with trusted partners to communicate on our behalf, and for the purposes outlined in our Privacy Policy.

Categories

Examples

Collected

Categories of Sources

genetic information (including familial genetic information).

Commercial information

Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

N/A

Biometric information

Genetic, physiological, behavioral, and biological characteristics or activity patterns used to extract a template or other identifier or identifying information, such as fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.

N/A

Internet or other similar network activity

Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.

N/A

Geolocation data

Physical location or movements.

N/A

Sensory data

Audio, electronic, visual, thermal, olfactory, or similar information.

N/A

Categories

Examples

Collected

Categories of Sources

Professional or employment-related information

Current or past job history or performance evaluations.

We only collect the information in this category when you provide it directly to us, for example, in connection with a job application. We may share this information with trusted partners on our behalf, and for the purposes outlined in our Privacy Policy.

Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part

99))

Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.

Inferences drawn from other Personal Information

Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

We may share this information with trusted partners to communicate on our behalf, and for the purposes outlined in our Privacy Policy.

Not included in the definition of Personal Information is information that is publicly available, information that has been de-identified or aggregated, or information exempt from the purview of the CPRA, such as:

Protected Health Information (“PHI”) governed and protected by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), and the California Confidentiality of Medical Information Act (“CMIA”) or clinical trial data; and
Personal Information regulated by certain industry-specific privacy laws, such as the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA), California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994.

Purposes for Collection, Use, and Disclosure of Personal Information

Generally, we may collect, use, or disclose the Personal Information about you for one or more of the following purposes: (a) To fulfill or meet the reason you provided the information; (b) To administer our Site; (c) To market to you; (d) To address and remedy any inquiries or complaints made by or about you related to our services; (e) To recognize you and remember your information when you return to our Site; (f) To help maintain the safety, security, and integrity of our services, technology assets, and business; (g) To operate, maintain, and provide to you the features and functionality of our services; (h) To personalize your experience and to deliver custom content and product and service offerings relevant to your interests; and (i) To respond to law enforcement requests.

We may also use or disclose your Personal Information in accordance with your consent, when required by law to do so, or if it is necessary for a corporate transaction (such as a merger or acquisition). We will not collect additional categories of Personal Information or use the Personal Information for materially different, unrelated, or incompatible purposes without providing you additional notice.

Sharing of Personal Information

We may share the information we collect as described in this section of the Privacy Notice. We may share this information for the following reasons:

With Affiliates

We may share the information we collect with GHOSTWORKS affiliates (as listed in the Privacy Policy) to, among other things, provide the services you have requested or authorized and to help us manage the availability and connectivity of the Site.

With Employees, Contractors, and Agents

We may share information we collect with our employees, contractors, and agents, including third-party service providers, that perform services and functions at our direction and on our behalf, but their use of such information shall be limited to the performance of their duties and is consistent with our purposes for using such information.

With Other Third Parties for a Business Purpose or as Permitted or Required by Law:

We may share information about you with other parties (e.g., Google Analytics) for our business purposes, to send you products or services that you may be interested in, or as permitted or required by law, including: (a) to comply with a law, legal process or regulations; (b) responding to or cooperating with law enforcement authorities, other government officials or other third parties pursuant to a subpoena, a court order or other legal process; (c) to protect the vital interests of a person; (d) to protect our property, services and legal rights; (e) to companies we plan to merge with or be acquired by; and (f) to support our audit, compliance and governance functions.

California Rights and Choices

The CPRA provides California residents with certain rights regarding their Personal Information (subject to certain limitations at law). The following section describes your CPRA rights and explains how to exercise those rights.

Right to Access and Portability

Under the CPRA, California residents have the right to request that we disclose certain information about our collection and use of Personal Information over the last twelve (12) months. Once we receive and confirm your verifiable consumer request, in which we may have to gather further identifiable information in order to confirm your identity, we will disclose to you the following:

The categories of Personal Information we collected about you;
The categories of sources for the personal information we collected about you;
Our business or commercial purpose for collecting or selling that Personal Information;
The categories of third parties with whom we share that Personal Information;
The specific pieces of Personal Information we collected about you (also called a data portability request); and
If we disclose your Personal Information for a business purpose, identifying the Personal Information categories

Upon receiving a verifiable access request, we will deliver the accompanying information to you in a portable, easily readable electronic format.

Right to Deletion

The CPRA allows California residents the right to request that we delete any Personal Information about you that we collect and retain, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, in which we may have to gather further

identifiable information in order to confirm your identity, we will delete (and in turn direct our service providers to delete, if applicable) your Personal Information from our records, unless an exception applies.

We may deny a deletion request if retaining the information is necessary to:

Complete the transaction for which we collected the Personal Information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you;
Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity;
Debug products to identify and repair errors that impair existing intended functionality;
Comply with the California Electronic Communications Privacy Act (Cal. Penal Code 1546 seq.);
Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
Enable solely internal uses that are reasonably aligned with consumer expectations;
Comply with a legal obligation and requests from law enforcement agencies; and
Make other internal and lawful uses of that information that are compatible with the context in which you provided

Right to Opt-Out of the Sale or Sharing of Your Information

We do not sell Personal Information, as the term “sale” is defined in the CPRA, will not sell Personal Information in the future, and in the preceding twelve (12) months, have not sold any Personal Information. We may share your information with third-parties who assist us in providing you with the services you signed up for. We also may share information with third parties who assist us in operating our website and marketing our services. If you request, we will limit or cease sharing information we collect from you, if any, as directed. However, if you prevent the sharing of all information collected we may not be able to provide you with the services you have requested.

Right to Limit Use and Disclosure of Sensitive Personal Information

Under the CPRA, with certain limitations, California residents have the right to limit the use of that resident’s sensitive personal information, as that term is defined in the CPRA, to that use which is necessary to perform the requested services or provide the goods requested. Under the CPRA, the following types of information are considered sensitive personal information:

A consumer’s social security, driver’s license, state identification card, or passport number;

A consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account;
A consumer’s precise geolocation;
A consumer’s racial or ethnic origin, religious or philosophical beliefs, or union membership;
The contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication;
A consumer’s genetic data;
Biometric information for the purpose of uniquely identifying a consumer;
Personal information collected and analyzed concerning a consumer’s health; or
Personal information collected and analyzed concerning a consumer’s sex life or sexual

Request Submissions

To exercise the access and deletion rights under the CPRA as described above, please submit a verifiable consumer request by completing the online form or email us at legal@ghostworksmarine.com.

Verifiable Consumer Requests

A verifiable consumer request may be submitted by a California resident or a person registered with the California Secretary of State that is authorized to act on your behalf. These requests for access, which can only be made twice during a twelve (12) month period, and deletion must:

Detail sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative; and
Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you.

Timeframe for Responding to Requests and Format

We will respond to your request within thirty (45) days of receipt.

The period of response may be extended to sixty (60) or ninety (90) days if more time is required. In that event, we will inform you of the reason and extension period in writing.

Fee

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded.

No Discrimination

The CPRA prohibits a business from discriminating against California residents for exercising the rights outlined above. We will not discriminate against you for submitting such requests by:

Denying goods or services to you;
Charging different prices or rates for goods or services, including through the use of discounts, benefits, or other penalties;
Providing a different level or quality of goods or services; and
Suggesting a different price or quality of goods or services will apply if rights are

No Financial Incentive

We do not offer any financial incentives or price or service differences in an attempt to influence a resident’s decision whether or not to exercise a right afforded to the consumer under the CPRA.

Children’s Information

Our Site is not directed at children. We do not knowingly collect Personal Information from anyone under the age of 18. If you are a parent or guardian and believe your child has provided us with Personal Information without your consent, please contact us by using the information in the “Contacting Us” section below, and we will take steps to remove such Personal Information from our systems.

Authorized Agent

A California resident may use an authorized agent to submit a right to access request or a request to delete. To use an authorized agent, the California resident must provide the agent with written authorization. In addition, the California resident may be required to verify

their own identity with us. GHOSTWORKS may deny a request from an agent that does not submit proof that they have been authorized by the California resident to act on their behalf. Such requirements, however, will not apply where a California resident has provided the authorized agent with power of attorney pursuant to Cal. Prob. Code Sections 4000 to 4465.

Updates to this Privacy Notice

We may update or change this Privacy Notice. The effective date at the top of this page states when this Privacy Notice was last revised. Any change to this Privacy Notice will become effective when we post the revised Privacy Notice on our Site. Your use of our Site means you accept our Privacy Notice.

If any change may materially and negatively affect the privacy of your Personal Information, we will use reasonable efforts to notify you in advance and give you a reasonable time to object to any changes.

We encourage you to periodically review this Privacy Notice to stay informed about how we collect, use, and share Personal Information.

Contacting Us

Use the contact information below if you have questions, concerns or complaints about this Privacy Notice or our privacy practices or would like additional information about GHOSTWORKS’ privacy practices.

Email Address: legal@ghostworksmarine.com

STATE-SPECIFIC POLICIES

State Name

Consumer Rights

How to Contact to Exercise Rights

California

If you are a California resident, you may have certain rights with respect to your Personal Information including the following rights:

1) The right to know, by way of our Policy and any specific inquiries you direct to us, where Personal Information we have about you comes from, what we use that information for, whether it is being disclosed or sold, and to whom it is being disclosed or sold;

2) The right to have access to any Personal Information we have in our possession or control regarding you;

3) The right to “opt-out” of GHOSTWORKS’ sale or sharing of your Personal Information to any third parties and to “opt-out” of any automated decision making or profiling;

4) The right, with some exceptions, to have your Personal Information deleted from GHOSTWORKS’ possession or control;

5) The right to receive equal service and pricing from GHOSTWORKS even if you exercise any of your privacy rights

6) The right to correct inaccurate personal information;

7) The right to receive your Personal Information to allow it to be moved to other companies; and

8) The right to restrict the processing of sensitive Personal Information.

California law permits users of the Site who are California residents to request certain information regarding our disclosure of Personal Information to third parties for their direct marketing purposes. A California resident may also use an authorized agent to submit a right to access request or a request to delete. To make such a request, to learn more, or if you have any questions or concerns about your California privacy rights, please visit the Privacy Notice for California Residents.

State Name

Consumer Rights

How to Contact to Exercise Rights

Colorado

If you are a Colorado resident, you may, upon request, have certain rights with respect to your Personal Information, including the following rights:

1) To opt-out of the processing of your Personal Information for purposes of targeted advertising, the sale of Personal Information; or profiling in furtherance of decisions that produce legal or similarly significant effects concerning you;

2) To confirm whether GHOSTWORKS is processing your Personal Information and to receive access to that Personal Information;

3) To correct inaccuracies in your Personal Information, taking into account the nature of the Personal Information and the purposes of the processing of your Information;

4) To delete your Personal Information; and

5) When exercising your right to access your Personal Information, to obtain the Personal Information in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance.

GHOSTWORKS will respond to any of the above requests within forty-five days. GHOSTWORKS may extend this deadline once by an additional forty-five days when reasonably necessary, taking into account the complexity and number of your requests, so long as we inform you of the extension within the initial forty-five-day response period along with the reasons for the extension.

If GHOSTWORKS declines to take action regarding your request, GHOSTWORKS shall inform you within the deadlines discussed above, along with the justification for that decision. Should you choose to, you may appeal the decision not to take action (or to take limited action) by submitting an appeal within fourteen days of receipt of GHOSTWORKS’ initial response.

Within forty-five days of receipt of your appeal, GHOSTWORKS shall inform you in writing of any action taken or not taken, in response to the appeal, including a written explanation of the reasons for the decisions. GHOSTWORKS may extend this period by sixty days where reasonably necessary, considering the complexity and number of requests serving as the basis for the appeal. If unsatisfied, you may file a complaint with the Colorado Attorney General athttps://coag.gov/file-complaint/.

State Name

Consumer Rights

How to Contact to Exercise Rights

Connecticut

If you are a Connecticut resident, you may, upon request, have certain rights with respect to your Personal Information, including the following rights:

1) To know what Personal Information we have collected about you, so long as revealing such information would not reveal a trade secret;

2) To obtain, where technically feasible, a copy of all the Personal Information that we have acquired about you;

3) To correct inaccuracies in your Personal Information, taking into account the nature of the Personal Information and the purposes of the processing of your Information;

4) To delete your Personal Information; and

5) To opt out of the processing of your data for the purposes of: a) targeted advertising, b) the sale of Personal Information, or c) profiling in furtherance of solely automated decisions that produce legal or similar significant effects on you.

GHOSTWORKS will respond to authenticated requests seeking any of the above requests within forty-five days.

State Name

Consumer Rights

How to Contact to Exercise Rights

Delaware

If you are a resident of Delaware, you may, upon request, have certain rights with respect to your Personal Information, including the following rights:

1) The right to confirm whether GHOSTWORKS is processing your Personal Information and to access the same;

2) The right to correct inaccuracies in your Personal Information;

3) The right to delete Personal Information provided by or obtained about you;

4) The right to obtain a list of the categories of third parties to which GHOSTWORKS has disclosed your Personal Information; and

5) The right to opt out of the processing of your Personal Information for the purposes of any of the following:

a. Targeted advertising;

b. The sale of Personal Information (with some exceptions);

c. Profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning you.

State Name

Consumer Rights

How to Contact to Exercise Rights

Florida

If you are a Florida resident, you may, upon request, have certain rights with respect to your Personal Information, including the following rights:

1) The right to confirm whether GHOSTWORKS is processing their personal data and the right to access the same;

2) The right to correct inaccuracies in their Personal Information;

3) The right to delete any or all Personal Information provided by you or obtained about you;

4) The right to obtain a copy of your Personal Information in a portable, readily usable format (if feasible);

5) The right to opt out of the processing of your Personal Information for targeted advertising, sale, or profiling in furtherance of a decision that produces a legal or similarly significant effect; and

6) The right to opt out of the collection of Personal Information collected through the operation of a voice recognition or facial recognition feature.

GHOSTWORKS will respond to any of the above requests within forty-five days. GHOSTWORKS may extend this deadline once by an additional fifteen days when reasonably necessary, taking into account the complexity and number of your requests, so long as we inform you of the extension within the initial forty-five-day response period along with the reasons for the extension.

State Name

Consumer Rights

How to Contact to Exercise Rights

Indiana

If you are an Indiana resident, you may, upon request, have certain rights with respect to your Personal Information, including the following rights:

GHOSTWORKS will respond to authenticated requests seeking any of the above requests within forty-five (45) days, unless extended for cause, by another forty-five (45) days.

1) The right to confirm whether GHOSTWORKS is processing your Personal Information and request access to the same;

2) The right to correct inaccuracies in the Personal Information you provided to GHOSTWORKS;

3) The right to obtain a copy, or representative summary, of the Personal Information about you possessed by GHOSTWORKS in a portable and readily usable format;

4) The right to delete the Personal Information that you provided to GHOSTWORKS and/or data otherwise obtained about you by GHOSTWORKS;

5) The right to opt out of the processing of your Personal Information for targeted advertising, profiling, and of the selling of your Personal Information; and

6) The right, as a parent or on behalf of a user known to be a child, to prevent the processing of sensitive data (as that term is defined by statute) about that child unless and until that parent or person on their behalf provides consent.

State Name

Consumer Rights

How to Contact to Exercise Rights

Iowa

If you are an Iowa resident, you may, upon request, have certain rights with respect to your Personal Information, including the following rights:

GHOSTWORKS will respond to authenticated requests seeking any of the above requests within ninety (90) days, unless extended, for good cause, by another forty-five (45) days.

1) The right to confirm whether GHOSTWORKS is processing your Personal Information and to access that data;

2) The right to delete the Personal Information that you provide to GHOSTWORKS;

3) The right to obtain a copy of the Personal Information that you provide to GHOSTWORKS in a portable readily usable format; and

4) The right to opt out of the sale of your Personal Information.

State Name

Consumer Rights

How to Contact to Exercise Rights

Montana

If you are a Montana resident, you may, upon request, have certain rights with respect to your Personal Information, including the following rights:

1) The right to opt-out of the sale by GHOSTWORKS of Personal Information and the use of Personal Information for targeted marketing and profiling;

2) The right to delete the Personal Information that you provided to GHOSTWORKS and/or data otherwise about you;

3) The right to confirm whether GHOSTWORKS is processing your Personal Information and request access to the same;

4) The right to correct inaccuracies in the Personal Information you provided to GHOSTWORKS;

5) The right to obtain a copy, or representative summary, of the Personal Information about you possessed by GHOSTWORKS in a portable and readily usable format;

6) The right, as a parent or on behalf of a user known to be a child, to prevent the processing of sensitive data about that child unless and until that parent or person on their behalf provides consent;

7) The right to appeal any decision by GHOSTWORKS not to provide information or take action pursuant to these rights.

GHOSTWORKS shall inform you in writing of any action taken or not taken, in response to the appeal, including a written explanation of the reasons for the decisions.

State Name

Consumer Rights

How to Contact to Exercise Rights

Oregon

If you are an Oregon resident, you may, upon request, have certain rights with respect to your Personal Information, including the following rights:

1) The right to know whether GHOSTWORKS is processing their Personal Information and to request a copy of the same;

2) The right to know the categories of Personal Information being processed by GHOSTWORKS;

3) The right to know the categories of third parties to whom GHOSTWORKS has disclosed their Personal Information;

4) The right to correct inaccuracies in their Personal Information;

5) The right to have GHOSTWORKS delete their Personal Information (with some exceptions);

6) The right to opt out of the processing of their Personal Information for targeted advertising, sale, or profiling of you in a way that produces legal effects; and

7) The right to obtain copies of their Personal Information from GHOSTWORKS in a portable and useable format.

State Name

Consumer Rights

How to Contact to Exercise Rights

Tennessee

If you are a Tennessee resident, you may, upon request, have certain rights with respect to your Personal Information, including the following rights:

1) The right to confirm whether GHOSTWORKS is processing their personal data and request access to the same;

2) The right to delete the personal data that you provided to GHOSTWORKS and/or that GHOSTWORKS has obtained about you;

3) The right to obtain a copy, or representative summary, of the personal data about you possessed by GHOSTWORKS in a portable and readily usable format;

4) The right to correct inaccuracies in the personal data you provided to GHOSTWORKS;

5) The right to opt-out of the sale by GHOSTWORKS of personal information and the use of personal information for targeted marketing and profiling; and

6) The right to appeal any decision by GHOSTWORKS not to provide information or take action pursuant to these rights.

GHOSTWORKS will respond to any of the above requests within forty-five days. GHOSTWORKS may extend this deadline once by an additional forty-five days when reasonably necessary, taking into account the complexity and number of your requests, so long as we inform you of the extension within the initial forty-five- day response period along with the reasons for the extension.

GHOSTWORKS shall inform you in writing of any action taken or not taken, in response to the appeal, including a written explanation of the reasons for the decisions.

State Name

Consumer Rights

How to Contact to Exercise Rights

Texas

If you are a Texas resident, you may, upon request, have certain rights with respect to your Personal Information, including the following rights:

1) The right to have confirmed that an entity is processing the resident’s Personal Information and to access that personal data;

2) The right to correct inaccuracies in the resident’s personal data, taking into account the nature of the Personal Information and the purposes of the processing of the resident’s Personal Information;

3) The right to delete Personal Information provided by or obtained about the resident;

4) The right, if available in a digital format, to obtain a copy of the resident’s Personal Information that the resident previously provided to the controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another entity without hindrance; and

5) The right to opt out of the process of their Personal Information for the purposes of:

a. Targeted advertising;

b. The sale of Personal Information; or

c. Profiling in furtherance of a decision that produces a legal or similarly significant effect concerning the resident.

GHOSTWORKS will respond to any of the above requests within forty-five days. GHOSTWORKS may extend this deadline once by an additional forty-five days when reasonably necessary, taking into account the complexity and number of your requests, so long as we inform you of the extension within the initial forty-five- day response period along with the reasons for the extension.

GHOSTWORKS shall inform you in writing of any action taken or not taken, in response to the appeal, including a written explanation of the reasons for the decisions within sixty (60) days of receipt of your appeal. If unsatisfied, you may file a complaint with the Texas Attorney General at File a Consumer Complaint | Office of the Attorney General (texasattorneygeneral.gov) .

State Name

Consumer Rights

How to Contact to Exercise Rights

Utah

If you are a Utah resident, you may, upon request, have certain rights with respect to your Personal Information, including the following rights:

1) To confirm if we are processing your Personal Information and to access that data;

2) To delete Personal Information that you provided to us;

3) If technically feasible, to obtain a copy of data that you provided to us in a portable manner; and

4) To opt out of the processing of Personal Information for targeted advertising or sale.

GHOSTWORKS will respond to authenticated requests seeking any of the above requests within forty-five days.

State Name

Consumer Rights

How to Contact to Exercise Rights

Virginia

If you are a Virginia resident, you may, upon request, have certain rights with respect to your Personal Information, including the following rights:

1) To confirm whether or not GHOSTWORKS is processing your Personal Information and to access such Personal Information;

2) To correct inaccuracies in your Personal Information, taking into account the nature of the Personal Information and the purposes of the processing of the Personal Information;

3) To delete your Personal Information;

4) To obtain a copy of your Personal Information that you previously provided to GHOSTWORKS in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the Information to another controller without hindrance, where the processing is carried out by automated means; and

5) To opt-out of the Personal Information processing for purposes of targeted advertising, the sale of personal Information, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

Within sixty days of receipt of your appeal, GHOSTWORKS shall inform you in writing of any action taken or not taken, in response to the appeal, including a written explanation of the reasons for the decisions. If unsatisfied, you may file a complaint with the Virginia Attorney General at

https://www.oag.state.va.us/consumer-protection/index.php/file-a-complaint.

GHOSTWORKS MARINE, INC.

PRIVACY POLICY

Last Modified: September 4, 2025

Information We Collect

Children’s Information

Use of Personal Information

Disclosure of Your Information

Access and Consent to Use of Your Personal Information

State Specific Requirements

Your Canadian Rights

European Economic Area

Security of your Personal Information

Links to Other Sites

Retention and Accuracy of Personal Information

Data Transfer

Changes to the Policy

A Note to Parents Regarding the Children’s Online Privacy Protection Act:

Questions and Contact Information

Last Modified: September 4, 2025

Purposes for Collection, Use, and Disclosure of Personal Information

Sharing of Personal Information

California Rights and Choices

Updates to this Privacy Notice

Contacting Us

ABOUT

NEWS

CONTACT

SHOP

THERE IS NO SECOND.