TradePort Intelligence Privacy Policy

Effective and last updated: October 8, 2026

TradePort Intelligence is a business-to-business petroleum and energy market-intelligence platform operated by Gaflex Energy International Inc., an Ontario corporation ("TradePort," "we," "us," or "our").

This Privacy Policy explains how we collect, use, disclose, protect, and retain personal information when you visit tradeportintel.com, create or use a TradePort account, subscribe to our services, contact us, or when your information appears in our market-intelligence database. It is written to meet the requirements of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, other Canadian provincial privacy laws.

1. Who We Are

TradePort Intelligence is a product of:

Gaflex Energy International Inc. Ontario, Canada Website: tradeportintel.com Email: go@tradeportintel.com Telephone: +1 (437) 771-6133

TradePort provides structured research and intelligence on petroleum and energy markets, including petroleum products and specifications, buyers and sellers, refineries, ports and terminals, vessels and cargo activity, trade movements, market sources, companies and counterparties, and publicly and commercially available market information.

TradePort is designed for business and professional users in the petroleum, energy, commodity, trading, logistics, refining, maritime, and related industries.

2. Accountability and Privacy Officer

We are responsible for personal information under our control. We have designated a Privacy Officer who oversees our compliance with this policy and applicable privacy law:

Privacy Officer Gaflex Energy International Inc. / TradePort Intelligence Email: go@tradeportintel.com Telephone: +1 (437) 771-6133

3. Information We Collect

3.1 Account and registration information

When you create or maintain an account, we may collect your full name, business name, job title, business email address, telephone number, business address, country and province or state, login credentials, subscription details, account preferences, and the information needed to administer your account. Where an account is created on behalf of a company, some information may also relate to that organization.

3.2 Subscription and payment information

When you purchase a subscription, we collect the information needed to establish your subscription, confirm payment, issue invoices and receipts, process refunds, manage billing, prevent fraud, and keep transaction records. This may include billing name, billing address, transaction amount and currency, subscription selected, payment status, invoice details, transaction date, limited payment-method information (such as card type and last four digits), and payment-provider transaction identifiers.

Payments are processed by Stripe, Inc. and its affiliates ("Stripe"). TradePort does not collect or store full payment card numbers or card security codes on its own systems. Stripe processes payment information under its own privacy policy and terms and may process it in the United States and other countries.

3.3 Technical and usage information

When you use TradePort, we automatically collect information such as IP address, browser type, operating system, device type, pages or screens accessed, dates and times of access, referring pages, session information, authentication and security events, error and diagnostic information, and general usage information. We use this to operate, secure, troubleshoot, and improve TradePort.

3.4 Communications

We keep the communications you send us, including support requests, inquiries, and correspondence about our services, and our responses.

3.5 Information about other people

If you give us information about another person, such as a colleague, customer, supplier, or business contact, you are responsible for having the authority and any required consent to do so. Please do not give us sensitive personal information about anyone unless it is necessary for a legitimate business purpose and you are legally permitted to share it.

4. Market-Intelligence Database and Individuals Named in It

A central part of TradePort is the collection, organization, analysis, and presentation of petroleum and energy market information. This information mostly concerns companies, facilities, vessels, products, and commercial activity rather than individuals. It may include company names and websites, business locations, commercial roles (buyer, seller, charterer, trader, supplier, and similar), petroleum products and specifications, origins and destinations, ports, terminals, refineries, vessel details, cargo and shipment information, trade activity, commercial relationships, source references, and dates of market activity.

Information about individuals. In some cases this information identifies or relates to an individual, such as a company representative or contact. This is limited to business contact information, such as name, job title or role, employer, business email address, business telephone number, and business address, and to the individual's professional role in a commercial activity. We do not intentionally collect sensitive personal information (such as health, financial-account, or government-identification information) for the database.

Sources. We obtain this information from public and commercial sources, including company websites, public corporate and regulatory filings, public trade and shipping information, industry publications, commercial databases, market-research sources, and information supplied by business users.

Purpose. We use business contact information in the database only to help our subscribers identify market participants and communicate with them about legitimate business and commercial matters related to their role. We do not use it for unrelated purposes and do not sell it as a stand-alone mailing list.

Your choices. If you believe your personal information appears in the TradePort database, you may ask us to confirm what we hold, correct it, or remove it. Contact the Privacy Officer using the details in Section 17. We will act on valid requests as described in Section 12, subject to the limits described there.

Accuracy and independent verification. Third-party and public information changes over time, and we do not guarantee that it is complete, current, or error-free. Users should independently verify commercially significant information before relying on it for transactions, investment decisions, compliance decisions, or other material business decisions.

5. How We Use Personal Information

We use personal information only for purposes that a reasonable person would consider appropriate in the circumstances, including:

• Providing the service: creating and administering accounts, authenticating users, providing access and subscription features, maintaining preferences, and providing customer support.
• Billing and payments: processing subscriptions and payments, issuing invoices and receipts, managing billing, processing refunds, reconciling transactions, and keeping financial records.
• Security and fraud prevention: protecting accounts and systems, detecting and investigating unauthorized access or suspicious activity, preventing fraud, and enforcing our security controls.
• Platform operations: operating and maintaining the platform, troubleshooting, monitoring performance and reliability, diagnosing errors, and improving functionality.
• Market intelligence: organizing market information, maintaining our research databases, improving search and discovery, connecting related information, identifying inconsistencies, maintaining data quality, and developing and improving our products and services.
• Communications: responding to inquiries, sending account, subscription, security, and administrative notices, and, where permitted by law, information about TradePort.
• Legal and regulatory purposes: complying with applicable laws (including sanctions, trade-control, anti-money-laundering, tax, and accounting requirements), responding to lawful requests, enforcing our agreements, protecting our legal rights, and resolving disputes.

If we want to use personal information for a new purpose that is not described in this policy, we will identify the new purpose and obtain consent where the law requires it.

6. Consent

Where required by law, we obtain your consent before collecting, using, or disclosing your personal information. Consent may be express, or implied where permitted by law and where the purpose is reasonably apparent, such as when you create an account or provide your details to request a service. We seek express consent where information is sensitive or where you would not reasonably expect the use.

You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent may mean we can no longer provide some or all of our services. Some collection, use, and disclosure is permitted by law without consent, such as where required by law or where the information is business contact information used to communicate with you about your business role.

7. Disclosure of Personal Information

We do not sell personal information.

We disclose personal information only where reasonably necessary to operate our business and provide TradePort, including to:

• Service providers that perform services for us, such as payment processing (including Stripe), application infrastructure, data storage, security, communications, technical support, system maintenance, and professional services. They may use the information only to perform services for us, and we require them to protect it appropriately.
• Legal and regulatory authorities, where required or permitted by law, including to comply with a court order, legal obligation, or lawful government request; to investigate suspected unlawful activity; or to protect our rights, property, users, or systems.
• Professional advisers, such as lawyers, accountants, auditors, and insurers, who are bound by duties of confidentiality.
• Business-transaction counterparties, if Gaflex Energy International Inc. or TradePort is involved in a merger, acquisition, financing, restructuring, sale of assets, or similar transaction. In that case the information will be protected by confidentiality commitments and used only as permitted by this policy and applicable law.

With your consent or at your direction, we may also disclose information to other parties, for example if you ask us to.

8. Marketing Communications

We send commercial electronic messages only as permitted by Canada's Anti-Spam Legislation (CASL), which means with your express or implied consent and with a working unsubscribe mechanism. You may unsubscribe at any time using the link in any marketing message or by contacting us. Unsubscribing from marketing does not stop service, billing, security, or account notices.

9. Cookies and Similar Technologies

We use cookies, session technologies, local storage, and similar mechanisms that are reasonably necessary to operate the website and application. These maintain sessions, keep you signed in, protect security, remember preferences, support functionality, and help us understand technical performance and reliability.

Where we use non-essential cookies or similar technologies in a way that requires consent under applicable law, we will give notice and obtain consent first. You can control cookies through your browser settings, but disabling some cookies may affect how TradePort works.

10. Data Security and Breach Response

We protect personal information with administrative, technical, and organizational safeguards appropriate to its sensitivity, which may include access controls, authentication, encryption where appropriate, restricted administrative access, security monitoring, system safeguards, secure payment processing, and internal security procedures. No internet-based system can be guaranteed completely secure, and we cannot guarantee absolute security of information transmitted online.

If a breach of security safeguards involving your personal information creates a real risk of significant harm, we will notify you, report it to the Office of the Privacy Commissioner of Canada and any other applicable regulator, and keep records of breaches, as required by law.

11. Retention

We keep personal information only as long as reasonably necessary for the purposes for which it was collected, including to provide services, maintain accounts, process subscriptions and payments, provide support, maintain business records, comply with legal, tax, accounting, and regulatory requirements, resolve disputes, enforce agreements, and protect our legitimate business interests.

Certain records, such as billing, transaction, and tax records, are kept for at least the period required by law (generally six years for Canadian tax records). When personal information is no longer reasonably required, we will take reasonable steps to securely delete, destroy, or anonymize it, subject to legal and operational requirements.

12. Your Privacy Rights and How to Exercise Them

Depending on where you live and the law that applies, you may have the right to:

• ask whether we hold personal information about you and request access to it, including how it is used and to whom it has been disclosed;
• request correction of inaccurate or incomplete information;
• withdraw consent, subject to legal or contractual restrictions;
• request deletion or de-indexing where the law provides for it;
• challenge our compliance with this policy and applicable law; and
• complain to a privacy regulator.

How to make a request. Email or call the Privacy Officer (Section 17) and tell us your name, your business or organization (if any), the email address associated with your account (if any), the nature of your request, and enough detail to let us locate the records. We may need to verify your identity first. We will respond within 30 days of receiving your request, or tell you if we need a lawful extension and why.

Fees. We do not charge for access requests unless the law allows it, and we will tell you of any cost in advance.

Limits. Your rights are subject to legal exceptions. For example, we may refuse access where the information is subject to legal privilege, would reveal personal information about someone else, or cannot be disclosed for security or legal reasons, and we may have to keep information for legal, accounting, security, or fraud-prevention reasons. If we refuse a request, we will explain why and describe your options.

13. International Processing and Transfers

TradePort is based in Canada. Personal information may be processed or stored in Canada, the United States, or other countries where we or our service providers operate. Our payment processor, Stripe, may process payment data outside Canada, including in the United States.

When personal information is processed outside Canada, it is subject to the laws of that country, and courts, law-enforcement, and national-security authorities there may be able to access it. We use contracts and other reasonable measures to ensure comparable protection when service providers handle it for us. You may contact the Privacy Officer for more information about our service providers outside Canada.

14. Region-Specific Information

Quebec. If you reside in Quebec, you also have rights under Quebec's Act respecting the protection of personal information in the private sector, including the right to access, rectify, and (where applicable) receive a portable copy of your personal information, and to ask us to stop disseminating it or to de-index it where the law permits. Personal information about Quebec residents may be transferred outside Quebec as described in Section 13. Our Privacy Officer is the person responsible for the protection of personal information.

European Economic Area and United Kingdom. Where the GDPR or UK GDPR applies to our processing, our legal bases are performance of a contract (providing your account and subscription), our legitimate interests (operating, securing, and improving TradePort and maintaining our business-intelligence database, balanced against your rights), compliance with legal obligations, and consent where we request it. You have the right to access, correct, erase, restrict, or object to processing of your personal information, to data portability, to withdraw consent, and to complain to your local supervisory authority. Where we transfer personal information from the EEA or UK to Canada or elsewhere, we rely on an applicable adequacy decision or appropriate safeguards.

United States. We do not sell or share personal information as those terms are defined under U.S. state privacy laws, including the California Consumer Privacy Act, and we do not use it for targeted advertising. Residents of states with privacy laws may have rights to know, access, correct, delete, and opt out, and may exercise them by contacting us. We will not discriminate against you for exercising your rights.

15. Children's Privacy

TradePort is a business-to-business service and is not directed at children. We do not knowingly collect personal information from children. If you believe a child has given us personal information, please contact us and we will take steps to delete it.

16. Third-Party Websites and Changes to This Policy

Third-party websites. TradePort may link to external websites, publications, or market sources. We are not responsible for their privacy practices, content, or security, and you should review their policies before giving them personal information.

Changes. We may update this policy to reflect changes to our services, information practices, technology, or the law. We will post the updated version with a new "Last Updated" date and, for material changes, give notice through our website, the application, or account communications. Where the law requires fresh consent for a new use, we will obtain it.

17. Privacy Complaints and Contact Us

If you have a question, concern, or complaint about how we handle personal information, please contact us first so we can investigate and try to resolve it:

Privacy Officer Gaflex Energy International Inc. TradePort Intelligence Ontario, Canada Website: tradeportintel.com Email: go@tradeportintel.com Telephone: +1 (437) 771-6133

You also have the right to complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, where applicable, to a provincial regulator such as the Commission d'accès à l'information du Québec, the Office of the Information and Privacy Commissioner for British Columbia, or the Office of the Information and Privacy Commissioner of Alberta, or to your local data-protection authority if you are outside Canada.