> For the complete documentation index, see [llms.txt](https://docs.novalink.technology/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.novalink.technology/privacy-and-data-protection/us-state-privacy-addendum.md). # US State Privacy Addendum ## (CCPA / CPRA and other US state laws) California Consumer Privacy Act and equivalent state-law provisions **Published notice — status, accuracy and right to amend.** This document is published by the Company in good faith for general information and transparency. It is current only as of its stated date and is provided “as is,” without warranty of completeness or accuracy; it may contain errors or omissions and does not constitute legal, financial, tax, or investment advice, an offer or solicitation, or any guarantee. The Company may revise, correct, update, supplement, or withdraw this document at any time without prior notice, and the version published on the NovaLink Transparency Portal is the controlling current version and supersedes any earlier copy. Where this document conflicts with a signed agreement between you and the Company, or with applicable law, that signed agreement or applicable law prevails. If you believe anything here is inaccurate or out of date, please contact so we can review it and, where appropriate, correct it. To the maximum extent permitted by law, the Company accepts no liability for any reliance placed on this document. **Document ID:** NL-USPRIV-01 **Version:** 1.0 **Status:** Issued **Issuing entity:** NodeLink USA, Inc. (Delaware C-Corporation; Delaware file no. 10606222) — US Distribution **Applies to:** personal information of US residents collected in connection with US distribution and sales **The NovaLink entities:** Ntech Link Technologies Ltd, Co. No. 2195904 (Store Operator) · Auralink Nova Technology L.L.C, Dubai, Reg. No. 1607764 (Technology Provider) · NodeLink USA, Inc., Delaware, File No. 10606222 (US Distribution) **Effective date:** 22 May 2026 **Contact:** ### 1. Purpose and the responsible US entity This Addendum (the "US Addendum") supplements the Company Privacy and Cookies Policy with provisions required by the California Consumer Privacy Act of 2018 (Cal. Civ. Code § 1798.100 et seq.) as amended by the California Privacy Rights Act of 2020 ("CCPA/CPRA"), and with cross-references to similar laws of other US states (Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, Texas TDPSA, and the comprehensive privacy laws of Oregon, Montana, Indiana, Iowa, and Delaware). Where this Addendum is in conflict with the Privacy and Cookies Policy, this Addendum prevails for residents of the relevant US state. Within The Link Group, the entity responsible for market entry, distribution and sales in the United States is the Company, a corporation incorporated in the State of Delaware (Delaware file no. 10606222), with its office at 169 Madison Ave, STE 92116, New York, NY 10016. For the purposes of the CCPA/CPRA and the other US state privacy laws referenced in this Addendum, the Company is the "business" (and, where those terms are used, the "controller") in respect of the personal information of United States residents that it collects in connection with that activity. The NovaLink platform itself is operated by the Company (British Virgin Islands); where the personal information of a US resident is also processed by the platform, a US resident may exercise the rights set out in this Addendum against either entity through the contact channels in Section 10. The full group structure is described in the Corporate Structure & Entity Register (NL-ORG-01). ### 2. Categories of personal information collected | CCPA category (Cal. Civ. Code § 1798.140(v)) | Examples in the Company | Sources | | -------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | ---------------------- | | Identifiers (A) | Name, email, account ID, IP address, device IDs | You | | Customer Records (B) | Address, phone, KYC documents | You | | Characteristics of protected classifications (C) | Not collected | — | | Commercial information (D) | Transaction history, subscriptions purchased, products linked | You; HMall | | Biometric information (E) | Selfie / liveness for KYC | You | | Internet activity (F) | Platform usage, dashboard interactions, chatbot transcripts | Your interaction | | Geolocation (G) | IP-derived country of access; Nx1/Hx1 Home Station reported public IP | Your network | | Sensory data (H) | Selfie image | You | | Professional/employment (I) | Country Distributor / corporate role where applicable | You | | Education (J) | Not collected | — | | Inferences (K) | User segment for product improvement (limited) | The Company processing | | Sensitive personal information (Cal. Civ. Code § 1798.140(ae)) | Government IDs for KYC; precise geolocation not collected unless required for tax or sanctions screening; biometric (selfie) for liveness | You | ### 3. Sale and sharing of personal information The Company does not "sell" personal information as that term is defined in CCPA § 1798.140(ad), and does not "share" personal information for cross-context behavioural advertising as that term is defined in § 1798.140(ah). The Company does not offer a "Do Not Sell or Share My Personal Information" link because there is no such activity to opt out of; nevertheless, residents may still submit an opt-out request and the Company will record it. ### 4. Use of sensitive personal information The Company uses sensitive personal information (KYC IDs and biometric selfies) only for the limited purposes set out in § 1798.121(a) — to perform the services requested, to detect security incidents, to resist malicious or fraudulent actions, to ensure physical safety, for short-term transient use, to perform services on behalf of the Company, and to verify quality. The Company will not use sensitive personal information for inferences about a consumer's characteristics. ### 5. Retention See Section 5 of the Data Minimisation & Retention Policy and Section 1 of the Privacy and Cookies Policy. The maximum retention period is 5 years for KYC, AML, and transactional records. Sensitive personal information is retained only for the period necessary to verify identity and to comply with the BVI Anti-Money Laundering Regulations 2008. ### 6. Consumer rights | Right | Statutory basis | How to exercise | | ---------------------------------- | -------------------------------------------------- | ---------------------------------------------------------------- | | Right to know | § 1798.110, § 1798.115 | or in-platform Privacy Requests form | | Right to delete | § 1798.105 | | | Right to correct | § 1798.106 | In-platform self-service; or | | Right to opt out of sale/sharing | § 1798.120 | Not applicable (see Section 3); request will be recorded if made | | Right to limit use of sensitive PI | § 1798.121 | | | Right to data portability | § 1798.130 | In-platform export | | Right to non-discrimination | § 1798.125 | The Company does not retaliate against exercise of rights | | Right to appeal a denial | Equivalent rights under VCDPA / CPA / CTDPA / UCPA | | ### 7. Authorized agents A consumer may use an authorized agent (CPRA Regulation § 7063) to submit a request on their behalf. The Company requires: * Signed written permission from the consumer authorising the agent; * Verification of the consumer's identity directly with the Company (KYC re-verification light); * Agent's identification and a description of their authority. ### 8. Children The Company does not knowingly sell or share the personal information of consumers under 16 years of age. The Terms (Section 2.1) require all Users to be 18 or older. ### 9. Other US states — operational position | State | Statute | The Company position | | ---------------------------------------- | ------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Virginia | Virginia Consumer Data Protection Act (VCDPA) | Honored: access, deletion, correction, portability, opt-out of targeted advertising/sale/profiling. The Company does not engage in targeted advertising or sale. | | Colorado | Colorado Privacy Act (CPA) | Honored. Universal Opt-Out Mechanism (Global Privacy Control) recognised. | | Connecticut | CTDPA | Honored. | | Utah | UCPA | Honored. | | Texas | TDPSA | Honored from effective date. | | Oregon, Montana, Indiana, Iowa, Delaware | Comprehensive privacy laws (effective 2024–2025) | Honored. | ### 10. Contact Privacy requests: | Appeals: Toll-free request line for California residents: a US toll-free number is to be activated by December 2027, in line with § 1798.130(a)(1) for businesses that operate exclusively online — currently the Company falls within the email-only exception under § 1798.130(a)(1)(A) but is choosing to provide additional channels.