This Privacy Policy (the "Policy") describes our practices regarding the collection, storage, usage, and disclosure of data that relates to identified or identifiable individuals ("personal data" and "data subjects / you", respectively) who use the products, services, information, content, and materials that are offered, operated or made available by us to you, including through our website located at https://rf-boston.com/ (the "Website"), or otherwise (collectively, the "Services"). The Services are owned and offered by RF Boston, LLC (together with its affiliated companies and assigns, "RF Boston, LLC", "we", "our", or "us") and are designed to facilitate your real estate investments.

Sometimes we collect personal data automatically when an individual interacts with the Services and sometimes, we collect personal data directly from an individual. At times, we may collect personal data about an individual from other sources and third parties (such as our Service Providers), sometimes even before our first direct interaction with an individual.

Specifically, this Policy describes our practices regarding:

If you are a User or Visitor, please read this Policy carefully and make sure that you fully understand it. You represent that you are entitled to submit personal data (as defined below) to RF Boston, LLC for use for the purposes set forth herein, without any obligation by RF Boston, LLC to pay any fees or be subject to any restrictions or limitations.

You are not legally required to provide us with any personal data. If you do not wish to provide us with your personal data, or to have it processed by us or any of our Service Providers (as defined below), please do not provide it to us and refrain from any interaction with us or with the Website or use of the Services.

1. Data Collection & Processing

When we use the term "personal data" in this Policy, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an individual. It does not include aggregated or de-identified information that is maintained in a form that is not reasonably capable of being associated with or linked to an individual.

We may collect or generate the following types of personal data about individuals through the Services:

• We collect the following data from Visitors of the Website who visit or otherwise interact with the Website, online ads and content, emails, various sales and marketing channels, and integrations or communications under our control: Usage, login credentials, and device information (connectivity, technical and aggregated usage data, such as user agent, IP addresses and approximate location based upon such IP addresses, device data like type, OS, device id, browser version, locale and language settings used), activity logs, session recordings, log-in credentials to the Services, and inferred or presumed data generated from their use of the Services, as well as any other information you choose to provide us with.
• We collect the following data from participants at our events, and any other prospective customer or partner: Contact details (such as name, email, phone number, call and video recordings), as well as any other information you choose to provide us with.
• We collect the following information from individuals who have opened a User Account on the Website: Contact details, communication history, billing and contracts, and preferences (such as name, email, phone number, our communications including sensory information such as call and video recordings and transcriptions thereof, feedback and testimonials received, contractual and billing details, as well as any expressed, presumed or identified needs, preferences, attributes and insights relevant to our potential or existing engagement, purchasing details including interest and/or purchase history), as well as any other information you choose to provide us with.
• We collect the following Personal Data from Loan Applicants: Financial and identifying information (such as passport/government ID/social security number, date of birth, driver's license, nationality, or certain biometric information; salary, salary slips, bank number, legal address, tax identification number or its equivalent; credit score, other credit information including consumer credit reports, past and present mortgages; personal and business finances and banking relationships, past and present employment, business, investment earnings and records, bank accounts, court cases, stock holdings, or bankruptcies), as well as any other information you choose to provide us with. To the extent any of this information is considered sensitive, your explicit consent will be requested prior to any sensitive data processing.

2. Data Uses

We use your personal data as necessary for the following purposes, in reliance on the lawful bases described below:

• Facilitating, operating, and providing the Services — using your contact information, financial information, log-in credentials, and any other information you provide. Legal basis: Performance of a Contract; Legitimate Interest.
• Monitoring and analyzing use of the Services — using usage, login, and device information. Legal basis: Legitimate Interest.
• Improving user experience and our offerings — using connectivity, technical and aggregated usage data, activity logs, session recordings, and inferred data. Legal basis: Legitimate Interest.
• Providing customer service and technical support — using your contact information and messages to support. Legal basis: Performance of a Contract; Legitimate Interest.
• Enhancing data security and preventing fraud — using connectivity, technical data, government IDs, biometric information, and other identifying data. Legal basis: Performance of a Contract; Compliance with legal obligations; Legitimate Interest.
• Complying with court orders, warrants, and applicable laws — using information described in Section 1. Legal basis: Compliance with legal obligations.
• Contacting you with service-related and promotional messages — using your contact information (email and phone number). Legal basis: Performance of a Contract; Consent (where applicable); Legitimate Interest.
• Facilitating and optimizing marketing campaigns and advertising — using your contact information and data collected through cookies and analytic tools. Legal basis: Consent (where applicable); Legitimate Interest.
• Exploring and pursuing growth opportunities — using your contact information. Legal basis: Legitimate Interest.
• Facilitating events, contests, and promotions — using your contact information. Legal basis: Consent (where applicable); Legitimate Interest.
• Offering complementary third-party services — using your contact information. Legal basis: Performance of a Contract; Legitimate Interest; Consent (when shared with a third party).
• Creating aggregated, anonymized, or de-identified data — using information described in Section 1. Legal basis: Performance of a Contract; Compliance with legal obligations; Legitimate Interest.

If you reside or are using the Services in a territory governed by privacy laws under which "consent" is the only or most appropriate legal basis for processing, your acceptance of our Terms of Service and/or the provisions contained in the loan documents and this Policy will be deemed as your consent to the processing of your personal data for all purposes detailed in this Policy, unless applicable law requires a different form of consent. If you wish to revoke such consent, please contact us at 617.908.0612 or at info@rf-boston.com.

3. Data Location

We and our authorized Service Providers maintain, store, and process personal data in the United States of America for the proper performance and delivery of the Services, or as may be required by law.

While privacy laws may vary between jurisdictions, RF Boston, LLC is committed to protecting personal data in accordance with this Policy and customary industry standards, and such appropriate lawful mechanisms and contractual terms requiring adequate data protection, regardless of any lesser legal requirements that may apply in the jurisdiction to which such data is transferred.

RF Boston, LLC is headquartered in the United States.

4. Data Retention

We retain personal data for as long as we deem it reasonably necessary in order to maintain and expand our relationship and provide you with the Services and offerings; in order to comply with our legal and contractual obligations; or to protect ourselves from any potential disputes, all in accordance with our data retention policy and applicable laws.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process your personal data, and the applicable legal requirements.

Please note that except as required by applicable law or our specific agreements with you, we will not be obligated to retain your personal data for any particular period, and we are free to securely delete, anonymize, or restrict access to it for any reason and at any time, with or without notice to you.

If you have any questions about our data retention policy, please contact us by email at info@rf-boston.com.

5. Data Disclosure

Relative to Users (including Loan Applicants) and Visitors, we disclose personal data in the following ways:

• Service Providers: We may engage selected third-party companies and individuals to perform services on our behalf or complementary to our own. Such service providers include hosting and server co-location services, communications and content delivery networks (CDNs), data security services, billing and payment processing services, fraud/money laundering/terrorism funding detection and prevention services, identity verification and screening services, web and product analytics, email distribution and monitoring services, session or activity recording services, remote access services, content transcription and analysis services, performance measurement, data optimization and marketing services, social and advertising networks, content and data enrichment providers, event production and hosting services, email, voicemail, support, enablement and customer relation management systems, and our legal, financial and compliance advisors (collectively, "Service Providers"). Our Service Providers may have access to personal data depending on each of their specific roles and purposes in facilitating and enhancing the Services, and may only use the data as determined in our agreements with them.
• RF Boston, LLC Subsidiaries and Affiliated Companies: We may share personal data internally within our group for the purposes described in this Policy. In addition, should RF Boston, LLC undergo any change in control or ownership, including by means of merger, acquisition, or purchase of substantially all or part of its assets, personal data may be shared with or transferred to the parties involved in such an event. Personal data may also be disclosed in the event of insolvency, bankruptcy, or receivership.
• Third-Party Services: We may engage selected business and channel partners, resellers, distributors, and providers of professional services in connection with the Services. In such instances, we may share relevant contact and usage details with the respective third-party provider, and in certain cases, you may be required to directly engage with such provider and accept its specific terms and privacy policy.
• Event Sponsors: If you attend an event or webinar organized by us, or download or access an asset on the Website related to such an event or other activity involving third-party sponsors or presenters, we may share your personal data with them. If you do not wish for your personal data to be shared, you may choose not to opt-in during event/webinar registration or elect not to have your badge scanned.
• Sharing Your Feedback or Recommendations: If you submit a public review or feedback, we may (at our discretion) store and present your review on the Website and in the Services. If you wish to remove your public review, please contact us at info@rf-boston.com.
• Legal Compliance: We may disclose or allow government and law enforcement officials access to your personal data in response to a subpoena, search warrant, or court order (or similar requirement), or in compliance with applicable laws and regulations. Such disclosure or access may occur if we believe in good faith that: (a) we are legally compelled to do so; (b) disclosure is appropriate in connection with efforts to investigate, prevent, or take action regarding actual or suspected illegal activity, fraud, or other wrongdoing; or (c) such disclosure is required to protect our legitimate business interests.
• Protecting Rights and Safety: We may share personal data with others if we believe in good faith that this will help protect the rights, property, or personal safety of RF Boston, LLC and our employees, any of the Visitors or Users, or any members of the general public.

Relative to a Loan Applicant's Loan Application which is approved:

You are hereby directing us to disclose certain of your personal data with certain Loan Service Third Parties (as defined below) for the limited purpose of conducting an assessment on the risk factors involved in the loan and on the potential profitability such Third Party may collect should they decide to purchase the rights to such loan from RF Boston, LLC. Any such Third Party is contractually bound to not conduct any further processing activities or other independent usage of your personal data.

Loan Service Third Parties: As further detailed in the Loan Terms, the Loan Service may include the disclosure of certain elements of your personal data with pre-approved Loan Service Third Parties. These Loan Service Third Parties are contractually bound to process such personal data solely for the purpose of conducting an assessment on the risk factors involved in the loan. In the event that a Loan Service Third Party purchases the rights to a loan, the personal data provided will continue to be subject to the limited usage set forth in a Data Sharing Agreement ("DSA") between RF Boston, LLC and such Loan Service Third Party. For further information regarding disclosure to Loan Service Third Parties, please contact us at info@rf-boston.com.

For the avoidance of doubt, RF Boston, LLC may share personal data in additional manners, pursuant to your explicit approval, or if we are legally obligated to do so, or if we have successfully rendered such data non-personal, non-identifiable, and anonymous.

6. Cookies and Data Collection Technologies

We and our Service Providers use "cookies", anonymous identifiers, pixels, container tags, and other technologies in order to provide the Services and ensure that they perform properly, to analyze our performance and marketing activities, and to personalize your experience.

Cookies are packets of information sent to your web browser and then sent back by the browser each time it accesses the server that sent the cookie. Some cookies are removed when you close your browser session ("Session Cookies"). Some last for longer periods ("Persistent Cookies"). We use both types.

We use Persistent Cookies to remember your log-in details and make it easier for you to log in the next time you access your User Account. We may also use HTML5 local storage or Flash cookies for the above-mentioned purposes.

While we do not change our practices in response to a "Do Not Track" signal in the HTTP header from a browser or mobile application, you can manage your cookie preferences through your browser settings. Please bear in mind that disabling cookies may complicate or even prevent you from using the Services.

We use the following third-party tools to support analytics, marketing, and customer relationship management. These tools may collect and process personal data as described in their respective privacy policies:

7. Communications

We engage in service and promotional communications through email, phone, SMS, and notifications.

Services Communications: We may contact you with important information regarding the Services, such as notifications of changes or updates, billing issues, log-in attempts, or password reset notices. Please note that you will not be able to opt out of receiving certain service communications that are integral to your use of the Services.

Promotional Communications: We may also notify you about new features, additional offerings, events, special opportunities, or any other information we think you will find valuable. We may provide such notices through any of the contact means available to us (e.g., phone, mobile, or email), through the Services, or through our marketing campaigns.

If you do not wish to receive promotional communications, you may notify RF Boston, LLC at any time by sending an email to info@rf-boston.com, changing your communications preferences in your profile settings, or by following the "unsubscribe", "stop", "opt-out", or "change email preferences" instructions contained in the promotional communications you receive.

8. Data Security

We implement reasonable industry-standard physical, procedural, and technical security measures designed to secure your personal data and to minimize the risks of theft, damage, loss of information, or unauthorized access or use of information. However, we cannot guarantee that the Services will be immune from any wrongdoings, malfunctions, unlawful interceptions or access, or other kinds of abuse and misuse.

You should take special care in deciding what information you send to us via the Services or email. Additionally, we are not responsible for the circumvention of any privacy settings or security measures contained within the Services or on Service Provider or Third Party sites.

9. Data Subject Rights

Individuals have rights concerning their personal data. Please contact us by email at info@rf-boston.com if you wish to exercise your privacy rights under any applicable law. Such rights may include — to the extent applicable — the right to know/request access to your personal data, the right to request rectification or erasure, the right to restrict or object to processing (including the right to direct us not to sell your personal data to third parties), the right to data portability, and the right to equal services and prices (e.g., freedom from discrimination).

Please note that when you ask us to exercise any of your rights, we may need to ask you to provide certain credentials to confirm your identity. We may then retain such additional data for legal, compliance, and auditing purposes.

The personal data we collect is not used for automated decision-making and profiling, except for automated processes in the context of marketing.

10. Data Controller/Processor

Certain data protection laws and regulations distinguish between two main roles for parties processing personal data: the "data controller", who determines the purposes and means of processing; and the "data processor", who processes the data on behalf of the data controller.

RF Boston, LLC is the "data controller" of User and Visitor information. With respect to such data, we assume the responsibilities of data controller (solely to the extent applicable under law), as set forth in this Policy. In such instances, our Service Providers processing such data will assume the role of "data processor".

For the Loan Applicant Data of those Loan Applicants with approved Loans, the DSA prohibits Loan Service Third Parties from making any further uses of the Loan Applicant personal data beyond the scope necessary for conducting the financial assessment of a loan or purchasing the rights to a loan. If the Loan Service Third Party decides to purchase the loan, the DSA also requires Loan Service Third Parties to comply with RF Boston, LLC's instructions when processing personal data.

11. Additional Notice & Contact Details

Updates and Amendments: We may update and amend this Policy from time to time by posting an amended version on the Website. The amended version will be effective as of the date it is published. We will provide prior notice if we believe any substantial changes are involved via any of the communication means available to us. After such notice period, all amendments shall be deemed accepted by you.

California Requirements: Do Not Track ("DNT") is a privacy preference that users can set in certain web browsers. Please note that we do not respond to or honor DNT signals or similar mechanisms transmitted by web browsers.

External Links: While the Services may contain links to other websites or services, we are not responsible for their privacy practices. We encourage you to read the privacy policies of each and every website and service you visit. This Policy applies only to the Services.

Children: The Services are not designed to attract children. We do not knowingly collect personal data from children and do not wish to do so. If we learn that a minor is using the Services, we will attempt to prohibit and block such use and will make our best efforts to promptly delete any personal data stored with us with regard to such minor. If you believe that we might have any such data, please contact us at info@rf-boston.com.

Contacting Us: If you have any comments or questions regarding this Policy or the Services, or if you have any concerns regarding your personal data held with us, please contact RF Boston, LLC's privacy support at info@rf-boston.com.