Effective date: 14 January 2026

Introduction

Welcome to the Privacy Policy of OG Markets Limited, d/b/a OG.com (“OG.com”, we, us, our).

We respect your privacy, and we are committed to protecting your personal information. This Privacy Policy will inform you as to how OG.com handles your personal information when using any of our products, services, or applications, including our websites and mobile applications and third-party services that are accessible through our websites and mobile applications (together the “Services”).

Please note that our Services are not intended for minors below the age of 18 years, and we do not knowingly collect data relating to minors.

If you are not a United States resident, please discontinue using our Services.

Contents:

1. Important information and who we are
2. The information we collect about you
3. How is your personal information collected
4. How we use your personal information
5. Disclosures of your personal information
6. Personal information security
7. Personal information retention
8. Your legal rights
9. Children's privacy
10. Notice to California residents

Addendum 1: U.S. Biometric Information Privacy Policy

Important information and who we are

Purpose of this Privacy Policy

OG.com complies with and respects all applicable privacy laws including, when applicable, the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”), the Illinois Biometric Information Privacy Act (“BIPA”), among others. This Privacy Policy describes your privacy rights and how you can exercise these rights.

It is important that you read this Privacy Policy together with any other notice or policy that we may provide on certain occasions when we are collecting or processing Personal Information about you so that you are fully aware of how and why we are using your information. This Privacy Policy supplements but is not intended to override those other notices or policies. If you do not agree with our policies and practices, your choice is not to use our Services. By accessing or using the Services you agree to this Privacy Policy and consent to our data practices set forth herein.

Changes to the Privacy Policy and Your Duty to Inform Us of Changes

We review and update our Privacy Policy from time to time. Please refer to the effective date at the top to determine when the most recent version took effect. Your continued use of our Services after we make changes is deemed to be acceptance of those changes, so please check the policy periodically for updates. It is important that the Personal Information we hold about you is accurate and current. Please keep us informed if your Personal Information changes.

Third-Party Services

Some of our Services may utilize, incorporate, include links to, or enable access to third-party websites, plug-ins, products, or services (“Third-Party Services”). Visiting or using Third-Party Services may allow third parties to collect or share information about you in accordance with their responsibility for their privacy and data security practices. For example, the Third-Party Services include access to a U.S. Commodity Futures Trading Commission (“CFTC”) designated contract market (“DCM”) provided by North American Derivatives Exchange, Inc. (“NADEX”) and ancillary supporting financial services provided by Foris DAX, Inc. (“FDI”). We may collect information on behalf of third parties that they require from you to provide you with access to the Third-Party Services. We do not control Third-Party Services and are not responsible for their privacy and data security practices. Further, links to Third-Party Services are not an endorsement or recommendation of such Third-Party Services. We encourage you to read the privacy notice of every Third-Party Service you visit or use.

The information we collect about you

Personal information is a broad term which includes information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. It does not include data where the identity has been removed (de-identified data).

The only Personal Information about you that we use for our own purposes are your name, username (or similar identifier), email address, and Technical Data. All other Personal Information we collect from you are solely collected on behalf of the third-party service providers who provide the Third-Party Services, and our role with respect to such other Personal Information is solely to collect and pass on the Personal Information to the third-party service providers.

The definition of personal information includes the specific pieces of personal information which we have described below. Depending on whether and how you use our Services, we may collect, use, store and transfer different kinds of personal information about you which we have grouped in categories as follows:

Certain personal information may be sensitive and used only in accordance with applicable law.

Biometric Data

We collect certain biometric data (e.g., visual image of you from a selfie photo and/or a photo identification document, from which we derive face scan information – face geometry and related information) on behalf of the third-party service providers that provide the Third-Party Services. We do not collect any biometric data for our own purposes. You should consult the third-party service providers’ privacy policies and notices to determine their data handling practices. Among other things, the third-party service providers may use your biometric data, in conjunction with their sub-contractors (such as identity verification technology vendors), to verify your identity for onboarding purposes and/or to authorize certain transactions or activities.

We collect such biometric data on behalf of our third-party service providers to facilitate their providing to you, in a manner consistent with compliance requirements and applicable law (including but not limited to AML and KYC compliance and applicable biometric data privacy laws, such as the Illinois Biometric Information Privacy Act), the Third-Party Services to which you request access. Due to the nature of such compliance and legal obligations, the purpose for which we initially collect such biometric information from you may be ongoing, recurring, and/or indefinite for as long as you maintain an account with us and retain access to the Third-Party Services through your account with us.

See Addendum 1 – Biometric Information Privacy Policy.

Aggregate, De-identified, and Anonymized Information

We may also collect, use, and share information that has been anonymized or de-identified, including statistical or demographic data, for any purpose ("Aggregate Consumer Information"). For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregate Consumer Information with your personal information so that it can directly or indirectly identify you, we treat the combined data as Personal Information pursuant to applicable law.

If You Refuse to Provide Personal Information

Where we need to collect personal information by law, or under the terms of a contract we have with you, and you refuse to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you, including the ability to offer or provide or continue to provide Services or other functionality.

How is your personal information collected

We use different methods to collect information from and about you including through:

Direct interactions. You may give us your Identity Data, Social Identity Data, Contact Data, Financial Data, Profile Data and Marketing and Communications Data by directly interacting with us, including by filling in forms, providing a visual image of yourself via the Services, by email, through the OG.com mobile application or otherwise. This includes personal information you provide when you:

• Visit or use the Services
• Apply for, access or attempt to access the Services
• Create or modify an account
• Subscribe to our publications
• Request marketing to be sent to you
• Enter a competition, promotion or survey, including through social media channels
• Give us feedback or contact us

Automated technologies or interactions. As you interact with us via our Services, we will automatically collect Technical Data about your equipment, browsing actions, activity, and patterns. We collect this data by using cookies, server logs, and other similar technologies. We will also collect Transactional Data, Investment Data and Usage Data. We may also receive Technical Data and Marketing and Communications Data about you if you visit other websites employing our cookies. You may find more information about how we use cookies and make adjustments to certain preferences through the Cookie Preferences section available within the Services.

Third parties or publicly available sources. We also obtain information about you, including Social Identity Data from third parties or publicly available sources. These sources may include:

• Fraud and crime prevention agencies
• Credit bureaus
• Customer referring you
• Marketing partners and analytics providers
• Other publicly available databases and information
• Third-Party Services

How we use your personal information

We will only use your Personal Information in accordance with applicable law and in accordance with this Privacy Policy. For the most part, we will use your Personal Information in the following ways:

• To provide Services (directly and through third-party service providers)
• To facilitate your access to Third-Party Services
• When necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests
• To comply with a legal obligation
• For business purposes and in accordance with this Privacy Policy
• When you use our Services, our authorized partners may collect categories of personal information about you and use this data for their own purposes. This activity may qualify as a sale under the California Consumer Privacy Act (“CCPA”). Under the CCPA, you can make choices to allow or prevent such uses.

Purposes for which we will use your personal information

We have set out below an illustrative example of the common ways we may use your Personal Information, when used for our own purposes:

• To register you as a new customer
• To carry out and comply with legal and compliance obligations
• To process and deliver the Services and any features and functionality
• To prevent abuse of our Services and promotions
• To manage our relationship with you which will include notifying you about certain changes to our terms or Privacy Policy, asking you to leave a review, take a survey or keeping you informed of our business and product development
• To keep our records updated and to evaluate how customers use our products/services
• To manage, process, collect and transfer payments, fees and charges, and to collect and recover payments owed to use
• To ensure proper management of our payments, fees and charges and collection and recovery of payments owned to us
• To manage risk and crime prevention including performing anti-money laundering, counter terrorism, sanction screening, fraud and other background checks, detect, investigate, report and prevent financial crime in broad sense, obey laws and regulations which apply to us and response to complaints and resolving them
• To enable you to partake in a prize draw, competition or complete a survey
• To gather market data for studying customers' behavior including their preference, interest and how they use our products/services, determining our marketing campaigns and growing our business
• To administer and protect our business, the Services, and social media channels including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data
• To deliver relevant content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you
• To use data analytics to improve our website, products/services, marketing, customer relationships and experiences
• To make suggestions and recommendations to you about goods or services that may be of interest to you
• To use the services of social media platforms or advertising platforms some of which will use the personal information they receive for their own purposes, including marketing purposes

Marketing

We strive to provide you with choices regarding certain Personal Information uses, particularly around marketing and advertising.

Promotional Offers From Us

We may use your Personal Information to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services, and offers may be relevant for you. You may receive marketing communications from us if you have requested information from us or used the Services and have not opted out of receiving that marketing.

Opting Out

You can ask us to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you. Further, you can let us know directly that you prefer not to receive any marketing messages by emailing [email protected].

When you opt-out of receiving these marketing messages, this will not apply to service messages which are directly related to use of our Services (e.g. change in the terms and conditions or this Privacy Policy).

Cookies

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of the Services may become inaccessible or not function properly. For more information about the cookies we use, please review the Cookie Preferences available within the Services.

Sale or Transfer of Business We may need to process your Personal Information in connection with or during the negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction, or proceeding involving all or a part of our shares, business or assets.

Disclosures of Your Personal Information

We may share your Personal Information with our third-party service providers, agents, subcontractors, and other associated organizations, our group companies and affiliates in order to complete tasks, provide the Services, and use of the OG.com website and mobile application to you on our behalf, and otherwise fulfill our obligations. When using third-party service providers, we request they respect the security of your Personal Information and treat it in accordance with the law.

We may share your Personal Information and other data you provide to us for the following purposes:

• To facilitate the provision of Third-Party Services by the third-party service providers who provide such services.
• To verify your identity.
• To detect and prevent fraud, money laundering, terrorist financing, and other financial crimes and illicit activities.
• To facilitate the provision of services and relevant business operations to support our delivery of the Services and related aspects to you.
• To improve our information, technology, and security systems including websites and mobile applications.
• To provide customer service.
• To promote our Services if you submit a product review or post content on public areas of our Services, or social media accounts.
• To transfer our rights and duties under the relevant terms and conditions governing the use of any Services (to the extent allowed).
• To comply, in our belief, with a legal request or to protect or enforce our rights, including to comply with an applicable law or regulation, or in response to a request for information if we believe disclosure is in accordance with any applicable law, regulation, or legal process, to protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability, and to protect the rights, property, and safety of us or others.
• To evaluate, effectuate, or otherwise transfer your personal information as part of a proposed or actual sale, merger, restructuring, transfer, or exchange of all or a portion of our assets to another company.

The categories of third parties with whom we may share your personal information for the purposes listed above include:

• Companies and organizations that assist us in processing, verifying or refunding transactions or orders
• Identity verification agencies
• Fraud or crime prevention agencies
• Anyone to whom we lawfully transfer or may transfer our rights and duties under the relevant terms and conditions governing the use of any of the Services
• Any third party because of any restructure, sale or acquisition of our group or any affiliates
• Regulatory and law enforcement authorities, where the law allows or requires us to do so

We disclose Personal Information to third parties only in accordance with applicable law.

Personal Information Security

While there is an inherent risk in any information being shared over the internet, we have put in place commercially reasonable security measures to prevent your Personal Information from being accidentally lost, used, damaged, or accessed in an unauthorized or unlawful way, altered, or disclosed. In addition, we limit access to your Personal Information to those employees, agents, contractors and other third parties who have a legitimate business need to know. They will only process your Personal Information on our instructions. You are also responsible for taking reasonable steps to protect your information against unauthorized disclosure or misuse such as by maintaining the confidentiality of your Personal Information.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any relevant regulator of a qualifying breach when required.

Personal Information retention

How long will you use my personal information for?

To determine the appropriate retention period for Personal Information, we consider the amount, nature, and sensitivity of the Personal Information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

Here are some exemplary factors which we usually consider when determining how long we need to retain your Personal Information and data:

• if we are dealing with a complaint;
• if we reasonably believe there is a prospect of litigation in respect to our relationship with you or if we consider that we need to keep information to defend possible future legal claims, the respective personal information (e.g., email addresses and content, chats, letters) will be kept in accordance with the statutory limitation period applicable following the end of our relationship;
• to comply with any applicable legal and/or regulatory requirements with respect to certain types of personal information, including relevant sanctions regimes:
• • under the Bank Secrecy Act, and its related statutes, if applicable, we are obliged to retain your Personal Information for a period of at least 5 years after the end of our relationship;
• information needed for audit purposes;
• in accordance with relevant industry standards or guidelines;
• in accordance with our legitimate business need to prevent abuse of the promotions that we launch. We will retain a customer’s personal information for the time of the promotion and for a certain period after its end to prevent the appearance of abusive behavior.

Illinois Residents – Biometric Information Privacy Act Disclosure

Unless otherwise required by an order from a court of competent jurisdiction or applicable law, if you are an Illinois resident, we may retain your biometric identifiers and biometric information until the earlier of (i) the initial purposes for collecting or obtaining such identifiers or information, including the purposes identified above, have been satisfied, or (ii) for three (3) years following your last interaction with us, whichever occurs first. As set forth in the “Biometric Information” section above, due to the nature of the compliance and legal obligations with which we must comply in order to provide certain services or products to you, the purpose for which we initially request biometric information from you may be ongoing, recurring, and/or indefinite for as long as you maintain an account with us.

See Addendum 1 – Biometric Information Privacy Policy.

Please note that under certain conditions, you can ask us to delete your Personal Information.

1. Your legal rights

Under certain circumstances, you may have certain rights in relation to your Personal Information:

• Right to know about Personal Information collected, and how it is used and disclosed.
• Right to request correction of certain Personal Information.
• Right to request deletion of certain Personal Information.
• Right to opt-out of the sharing of certain Personal Information.

If you wish to exercise any of the rights set out above or if you want to raise a question, complaint or a concern about our privacy policy and practices, please contact us at [email protected]. You may also contact us at our toll-free telephone number, +1 8665656679.

When allowed by applicable law and required, we will take steps to disclose and deliver to you, free of charge, your Personal Information accordingly. We may also contact you to ask you for further information in relation to your request to speed up our response.

If you are a California resident, you also have the right to know about Personal Information sold. In addition, you may also opt out of the sale of your personal information by clicking on the “Do Not Sell/Share My Personal Information” link here.

Non-Discrimination

You will not receive a discriminatory treatment if you choose to exercise any of the rights conferred to you above.

If you want to make a request under the CCPA through a natural person or a business entity authorized to act on your behalf, please beforehand contact us and in a timely manner we will provide you with a reply on how to designate such a person.

Children's Privacy

OG.com respects the privacy of children, and we are committed to complying with the Children’s Online Privacy Protection Act (herein called “COPPA”). We do not knowingly collect Personal Information from children under the age of thirteen (13). If you are a parent or guardian and you are aware that your child under the age of 13 has provided us with personally identifiable information, please contact us. If we become aware that we have collected personally identifiable information from children without verification of parental consent, we take steps to remove that information from our servers.

Notice to California Residents

This section supplements the information above and applies solely to California residents who use our Sites and Services.

Personal Information Collected and Disclosed

We collect and share personal information that is identified below in addition to the information identified above. The following table describes the collection, use, and sharing of personal information collected by us or our service providers within the last twelve (12) months. For a detailed description of the data included in each category, see Section 2. Personal Information We Collect.

Opting Out of the Sale/Sharing of Your Personal Information

If you are a California resident, you have the right to know about the sale of your personal information and the right to opt out of the sale of your personal information. When you use our Services, our authorized partners may collect categories of personal information about you and use this data for their own purposes. This activity may qualify as a sale under the California Consumer Privacy Act. To exercise your right to opt out, click on this “Do Not Sell or Share My Personal Information“ link.

Exercising Your Rights as a California Consumer

You may request that we:

• Provide you with the categories of personal information we have collected or disclosed about you in the last twelve months; the categories of sources of such information; the business or commercial purpose for collecting or selling your personal information; and the categories of third parties with whom we shared personal information.
• Correct your personal information that is inaccurate.
• Provide access to and/or a copy of certain information we hold about you.
• Delete certain information we have about you.

If you wish to make a request under the CCPA through a natural person or business entity authorized to act on your behalf, please contact us in a timely manner beforehand and we will provide you with information about how to designate such a person.

To exercise any of the above rights, please contact us at [email protected]. You may also contact us at our toll-free telephone number, +1 8665656679.

Complying with your request to exercise any of the rights above may require us to verify your identity. Any personal information we collect for this purpose will be used only for the purpose of verification or as otherwise required by law.

ADDENDUM 1 – OG.com U.S. Biometric Information Privacy Policy

Effective date: 14 January 2026

This Biometric Information Privacy Policy (this “Policy”) is an addendum to the OG.com – U.S. Privacy Policy (the “Privacy Policy”) and is applicable to users residing in the United States of America.

In addition to the information we’ve provided to you in our Privacy Policy, we want to help you better understand how OG.com collects and treats biometric information. We collect biometric data solely on behalf of third-party service providers who provide the Third-Party Services, such as NADEX and FDI. We do not collect any biometric data for our own purposes. Further, we collect biometric data on behalf of third-party service providers only when doing so is necessary due to the technical mechanisms and limitations related to how the Third-Party Services are integrated with our website and mobile app. Where possible, your Personal Information (including biometric data) is collected directly by the third-party service providers.

The third-party service providers care about the security of your Personal Information and seek to protect you against fraud. Where permitted by law, the third-party service providers and their service providers use ID scanning and facial recognition technology to verify your identity and safeguard Personal Information as part of their security, compliance, and fraud prevention efforts. You should consult the third-party service providers’ privacy policies and notices to determine their data handling practices.

Biometric Data

When we refer to “biometric data,” we mean information about your physical or biological characteristics (sometimes called “biometric identifiers”) that identify you. Information like face scans may be considered biometric data if they are used to identify you by technical means. The definitions of biometric data vary under different states’ laws. For example, some states’ biometric laws don’t apply to driver’s license photos. Photos of you are not necessarily biometric data, but biometric data can be made or derived from processing the photo using certain technology.

As used in this policy, “biometric data” includes “biometric identifiers” and “biometric information”. “Biometric identifier” includes a scan of your face geometry. Biometric identifiers do not include physical descriptions that may appear on your identification documents such as height, weight, hair color, or eye color. “Biometric information” means any information based on an individual’s biometric identifier used to identify an individual by technical means.

Information Collected

When you consent to our collection and use of your biometric data, we (and/or the third-party service providers of the Third-Party Services and their service providers, such as identification verification technology vendors, working on their behalf) collect face scan information—face geometry information and related information—necessary to accomplish the purposes stated in this Policy, at points of collection, and/or in our Privacy Policy. We do not collect, use, store, or disclose your biometric data without your consent.

Purposes

We collect biometric data solely on behalf of third-party service providers who provide the Third-Party Services, such as NADEX and FDI. We do not collect any biometric data for our own purposes. The third-party service providers use your biometric data to verify or authenticate your identity, to detect and prevent fraud, and in furtherance of compliance with applicable anti-money laundering, “know your customer”, and sanctions screening obligations. Subject to the storage and retention guidelines below, we store and use your biometric data for these purposes for the duration of your engagement with us or as otherwise permitted by law.

Disclosure of Biometric Data

Unless otherwise required by law, your biometric data is accessible only to us, the third-party service providers of the Third-Party Services, and their service providers, which collect and process your data only on behalf of the third-party service providers to accomplish the purposes stated above. We do not share biometric data with any other third parties unless required by law. We do not sell, lease, trade or otherwise profit from your biometric data. We disclose your biometric data to the third-party service providers and their authorized service providers or other third parties if:

• You or your authorized representative consent to the disclosure (for example, by completing the identity verification process during onboarding or at other applicable points of collection using a photo of yourself and a photo ID);
• the disclosure completes a financial transaction requested or authorized by you or your authorized representative;
• the disclosure is required pursuant to a valid warrant, subpoena, or court order issued by a court of competent jurisdiction; or
• the disclosure is required by law.

Retention and Storage

We will collect, store, transmit, and protect your biometric data using a reasonable standard of care that is at least as protective as the way we collect, store, transmit, and protect other confidential and sensitive Personal Information.

Unless otherwise required by an order from a court of competent jurisdiction or applicable law, we will only retain biometric data until: (i) the initial purpose for collecting the biometric data has been satisfied, or (ii) for three (3) years following your last interaction with us or our Services, whichever occurs first, unless legally required to keep it for a different period. As set forth in the Privacy Policy, due to the nature of the legal obligations with which we must comply in order to provide certain services or products to you (or to facilitate the provision of certain services or products to you), the purpose for which we initially collect biometric information from you may be ongoing, recurring, and/or indefinite for as long as you maintain an account with us or retain access to the Third-Party Services.

For any questions regarding our use of biometric data or other privacy inquiries, please submit a request to our privacy team.