Privacy Notice

Last updated: September 30, 2026

This Privacy Notice describes how The Nuclear Company and its affiliates ("TNC," "we," or "us") collect and process personal information / personal data in relation to your use of our services, website www.thenuclearcompany.com, and other websites, mobile applications, or platforms we own where this Privacy Notice is linked.

Depending on where you live, a supplemental privacy notice may apply to you. The supplemental privacy notice applicable to you prevails over the information provided in this Privacy Notice. Please follow the links and review the supplemental privacy notice describing how we process personal information / personal data for these regions. To exercise any applicable rights, please follow the instructions provided under the section "Exercising Your Rights" in the supplemental privacy notice.

1. Personal Information We Collect

A. Information You Choose to Give Us

• Contact information, including name, work email, and employee ID from TNC’s single sign-on.
• Information provided or accessed in connection with the services we provide, including text, forms, photos, and files you create or upload in any NOS module.
• Payment information to complete purchase transactions.
• Information required to process job applications and evaluate employee candidates.

B. Information Automatically Collected by Using Our Website

• Your device data and how you interact with our website, including IP address, browser type, device location, and unique device identifier.
• Cookies and similar technology. Please review the cookie technology section below for more information.
• Usage information, including the pages or content you view and searches on our website.

2. How We Use Information We Collect

We may process this information to:

• Fulfill or meet the reason you provided the information.
• Provide, offer, support, personalize, or develop our website and services.
• Create, maintain, customize, and secure your account with us.
• Process your requests, purchases, transactions, and payments and prevent transactional fraud.
• Provide you with support and respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses.
• Help maintain the safety, security, and integrity of our website, applications, databases and other technology assets.
• Test, research, analyze, and conduct product development to develop and improve our website, and related services.
• Respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
• Evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us is among the assets transferred.
• Communicate with you about your job application with us and evaluate your potential employment with us.
• Send promotional messages, marketing, advertising, and other information that may be of interest to you based on your preferences.
• Personalize, measure, and improve our advertising to you.
• Fulfill any other use that we describe when you provide the information.

3. Disclosing, Sharing, and Selling Information.

A. Disclosing Personal Information

We may disclose your personal information to a service provider for a business purpose. When we disclose personal information for a business purpose, we enter into a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract.

We disclose personal information as stated below:

• With data analytics, cybersecurity, cloud service, consultants, financial, legal, and other similar providers that support our business.
• With Software/IT service providers we use to support our business and who are bound by contractual obligations to keep personal information confidential and use it only for the purposes for which we disclose it to them.
• When we believe sharing is necessary to protect our rights, preserve safety, investigate fraud or other wrongdoing.
• When required by law, which includes complying with any court order, law, or legal process, including responding to a government or regulatory request.
• In connection with the sale, transfer or financing of TNC's business or its assets, including a bankruptcy proceeding or to our affiliates.
• For any other purpose we disclose to you when you provide the information.

B. Sharing Personal Information for Personalized Advertising

In this Privacy Notice, "sharing" means disclosing a consumer's personal information to third parties for cross-context behavioral advertising. "Cross-context behavioral advertising" refers to the targeting of advertising to a consumer based on the consumer's personal information obtained from the consumer's activity across websites and applications, other than those with which the consumer intentionally interacts. In the preceding twelve months, TNC has not "shared" personal information with third parties for the purposes of personalized advertising.

C. Selling Personal Information

In the preceding twelve months, TNC has not sold personal information to any third parties and does not sell personal information pertaining to minors under the age of 16.

4. Information Security and Retention

We use reasonable administrative, technical, and physical security measures to protect the personal information we retain and to help ensure that it is used in accordance with this Privacy Notice.

We will retain your personal information for the period necessary to fulfill the purposes outlined in this Privacy Notice unless longer retention is required by law or for auditing purposes. To determine the appropriate retention period for personal information, we consider applicable laws, the volume and nature of the personal information, its purpose, and the potential risk of harm from its unauthorized use or disclosure.

5. Cookies and Tracking Technologies

Cookies

Our websites use "cookies" and other tracking technologies to gather information about your interactions. Cookies are small text files that are stored on your hard disk assigned to the browser you are using and through which certain information flows to the place that sets the cookie (here by us or third-party providers). This information may include demographic data, browser type, IP address, pages visited, activities conducted on the page, and the day and time of your visit. TNC collects the following categories of cookies:

• Essential website cookies: These cookies are strictly necessary to provide you with services available through our websites and to use some of its features, such as access to secure areas.

We do not currently honor "do not track" signals from a web site browser. Please refer to your computer browser help instructions for more information on cookies and other related technologies and how to manage their use. If you refuse or delete cookies, you will need to repeat the process if you use another computer or change browsers. If you refuse or delete cookies, some of the functionality of our websites could potentially be impaired.

6. Your Rights

Depending on where you live, you may have rights related to your personal information. These rights are described in the supplemental privacy notice. You may exercise any of the rights consistent with applicable law by contacting us at legal@thenuclearcompany.com and following the instructions provided in the supplemental privacy notice document, under the "Exercising Your Rights" section. We may ask you to verify your identity before taking further action on your request

7. Other Important Information

A. Linked Websites

Our websites may contain links to other websites. We assume no responsibility for the content, privacy policies, or practices of any third-party websites. You expressly relieve us from any and all liability arising from your use of any third-party website, or from the content of any third-party website.

B. Children's Privacy

Our website does not target or knowingly collect any information from individuals under the age of 18.

C. Changes to our Privacy Notice

It is our policy to post any changes we make to our Privacy Notice on this page with a notification that the Privacy Notice has been updated on our website home pages. If we make material changes to how we treat the personal information we collect, we will notify you through a prominent notice on our website home pages, in addition to any other means necessary to fulfill our legal requirements. The date the Privacy Notice was last revised is identified at the top of Page 1.

8. Contact Information

For questions regarding this Privacy Notice, you may contact us at any of the following addresses. To exercise your consumer rights, depending on where you live, please follow the instructions provided in the supplemental privacy notice, under the "Exercising Your Rights" section.

Email: legal@thenuclearcompany.com

Last updated: September 30, 2026

1. Overview

If you reside in California, Nevada or Europe, the supplemental privacy notice applicable to you prevails over the information provided in this Privacy Notice. To exercise any of the rights described below consistent with applicable law, please follow the instructions provided in the "Exercising Your Rights" section of this document.

To comply with your request, we may ask that you verify your identity for security purposes before we take further action. Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child. To designate an authorized agent, please contact us via the methods noted above.

2. California

This supplements the information contained in the Privacy Notice and applies solely to individuals who reside in the State of California. To exercise any of the rights described below consistent with applicable law, please follow the instructions provided in the "Exercising Your Rights" section of this document.

1. Personal Information We Collect

We collect information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household ("personal information").

In the last twelve months, we have collected the following categories of personal information from consumers:

We obtain this information from the various categories of sources:

• Directly from you. For example, from the information you submit to log into our NOS application.
• Indirectly from you. For example, from observing your interactions in the NOS application.

2. How We Use, Disclose, Share, and Sell Information We Collect.

Please read the Privacy Policy to learn how we use, disclose, share, and sell personal information we collect.

3. Your Rights.

A. Right to Access and Data Portability

You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request, we will disclose to you:

• The categories of personal information we collected about you.
• The categories of sources for the personal information we collected about you.
• Our business or commercial purpose for collecting, selling, or sharing the personal information.
• The categories of third parties with whom we disclose that personal information.
• The specific pieces of personal information we collected about you (also called a data portability request).
• Whether we sold, shared, or otherwise disclosed your personal information for a business purpose.

B. Right to Delete

You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies. We may deny your deletion request if retaining the information is necessary for us to:

• Protect against malicious, deceptive, fraudulent, or illegal activity.
• Debug products to identify and repair errors that impair existing functionality.
• Exercise free speech or ensure that other consumers may exercise their free speech.
• Comply with the California Electronic Communications Privacy Act.
• Engage in public or peer-reviewed public interest research if deletion may seriously impair the research's achievement and if you previously provided informed consent.
• Use the information internally, as reasonably expected by consumers.
• Use the information internally, compatible with the law and context you provided it.
• Comply with a legal obligation.

C. Right to Correct

You have the right to request that we correct inaccurate personal information, taking into account the nature of the personal information and the purposes for processing the personal information. Once we receive and confirm your verifiable consumer request, we will use commercially reasonable efforts to correct the inaccurate personal information.

D. Right to Non-Discrimination

We will not discriminate against you for exercising any of these rights. Unless permitted by California law, we will not:

• Deny you goods or services.
• Provide you a different level or quality of goods or services.
• Charge you different prices or rates for goods or services, including granting discounts or benefits, or imposing penalties.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

However, we may offer you certain financial incentives permitted by California law that can result in different prices, rates, or quality levels. Any permissible financial incentive we offer will reasonably relate to your personal information's value and contain written terms that describe the program's material aspects. Participation in a financial incentive program requires your prior affirmative consent, which you may revoke at any time.

E. Right to Opt Out of the Sale of Personal Information

TNC does not sell personal information.

F. Right to Opt Out of Sharing Personal Information for Personalized Advertising

TNC does not share personal information for personalized advertising.

G. Right to Limit the Processing of Sensitive Personal Information

TNC does not process sensitive personal information beyond what is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services.

H. Rights Under California's "Shine the Light" Law

California's "Shine the Light" law (Civil Code Section § 1798.83) permits California residents that use our website to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes.

3. Nevada

This supplements the information contained in the Privacy Notice and applies solely to individuals who reside in the State of Nevada. To exercise any of the rights described below consistent with applicable law, please follow the instructions provided in the "Exercising Your Rights" section of this document.

1. How We Collect, Use, Disclose, and Sell Information.

We collect information about Nevada residents through a website or online service: first and last name; home or physical address; email address; telephone number; social security number; online or physical identifier; or other information that, combined with an identifier, makes the information personally identifiable ("covered information" or "personal information"). For more information about the information we collect and how we use, disclose, and sell personal information, please read the Privacy Notice.

2. Reviewing and Requesting Changes to Your Information.

You may review and request changes to your personal information collected through TNC's website or online services.

3. Opting Out of the Sale of Personal Information.

You may submit a verified request that TNC not sell your personal information.

4. Exercising Your Rights

Depending on where you live, the rights described in this supplement may apply to you. To exercise your rights compatible with applicable law, please submit a verifiable consumer request via legal@thenuclearcompany.com.

A. Verifiable Consumer Requests

Your verifiable consumer request must provide sufficient information that allows us to reasonably verify you are the person about whom we collected information and describe your request in sufficient detail that allows us to properly respond to it. We cannot respond to your request if we cannot verify your identity and confirm that the information relates to you.

Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child. To designate an authorized agent, please contact us via the methods noted above. If you are a California resident, you can designate an authorized agent to make a request on your behalf only if: (1) the authorized agent is a natural person or a business entity registered with the Secretary of State of California; and (2) you sign a written declaration that you authorize the authorized agent to act on your behalf. If you use an authorized agent under California law to submit a request to exercise your rights, please have the authorized agent take the following steps in addition to the steps described above:

• Mail a copy of your signed written declaration authorizing the authorized agent to act on your behalf; and
• Provide any information we request in our response to your email to verify your identity. The information requested will depend on your prior interactions with us and the sensitivity of the personal information at issue.

If you provide an authorized agent with power of attorney pursuant to California Probate Code sections 4121 to 4130, it may not be necessary to perform these and we will respond to any request from such authorized agent in accordance with the CCPA.

California residents may make a verifiable consumer request twice within a 12-month period, free of charge, unless the request is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

B. Response Time

We will respond to verifiable consumer requests within the time allotted under applicable law, generally forty-five (45) days of its receipt. If we require more time (up to 45 days), we will inform you of the reason and extension period in writing in compliance with applicable law.

C. Response Content

Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request's receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance in compliance with applicable law.

D. Method of Response

You do not need to create an account with us to make a verifiable consumer request. However, if you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

5. Europe

Last updated: September 30, 2026

This Supplemental Privacy Notice applies to the processing of Personal Data, subject to all applicable privacy and data protection laws of the European Union and the European Economic Area, Switzerland, the United Kingdom, (the "Notice"), by us through its website, products, and services (the "Services"). It describes how we collect, use, and disclose such Personal Data, your rights and choices with respect to your Personal Data, and how you can contact us if you have any questions or concerns.

1. Personal Data We Collect

In this Notice, "Personal Data" means any information relating to an identified or identifiable individual. We may collect Personal Data about you from various sources described below.

2. Information Provided by You

• Communications. When you contact us via a contact form, email, or log into our application, you provide us with Personal Data, such as your name and contact details, and the content, date, and time of our communications.

If necessary, your Personal Data may be passed on for the purpose of responding to your enquiry between our group legal entities. This happens because we procure IT services and other services within the Group. The transfer takes place on the basis of internally concluded contracts.

As soon as your enquiry has been fulfilled to your satisfaction, the data will be stored in accordance with statutory retention obligations and deleted accordingly after these have expired (Legal basis: Art. 6 para. 1 lit. of GDPR (legitimate interest)).

• Careers. If you apply for a job with us, you may provide us with your resume, name, contact details, and any other relevant information. If you become an employee, we collect additional information, such as your family information, beneficiary selections, banking information, and other relevant information for employment, payroll, and benefit purposes, and we may collect certain sensitive Personal Data such as trade union membership data or biometric data for identity verification.
• Support Information. When you request support services, we will process your Personal Data such as your name and the contact details you use to contact us, as well as information on the reasons for your support request, and any additional information you may provide in that context.

Where applicable, we may indicate whether and why you must provide us with your Personal Data as well as the consequences of failing to do so. For example, it may be necessary for you to disclose certain Personal Data in order for us to provide the Services to you.

Our Services are not intended for use by children under the age of 16.

3. Information Collected from Other Sources

• Third Parties. We may obtain Personal Data about you from third parties such as background check vendors and other entities. This information may include background information for job candidates and other similar information.
• Social Media. We operate company pages on the following social media sites: X (Twitter), Instagram and LinkedIn, and YouTube. When you visit our social media presence, personal data, including the IP address of the respective provider, is processed and cookies are used for data collection. Please refer to the privacy policy of the respective service to find out exactly what information is transmitted. There you will also find information about contact options and ways to restrict the processing of this data.

We would also like to point out that you use the respective services and their functions on your own responsibility. This applies in particular to the use of interactive functions (e.g. sharing, commenting or rating).

The providers of the social media services have provided us with corresponding agreements – in most cases these are agreements on joint responsibility for data processing. The use of social media is based on our legitimate, operational interest.

• Legal basis: legitimate interest

4. Information We Collect by Automated Means

• Social media. We may collect Personal Data via social media tools, widgets, or plug-ins to connect you to your social media accounts. These features may allow you to sign in through your social media account, share a link, or post directly to your social media account. When you visit a website that contains such tools or plugins, the social media or other service provider may learn of your visit. Your interactions with these tools are governed by the privacy policies of the corresponding social media platforms.
• Cookies. We may collect Personal Data via cookies and similar technologies (see section 5 of this Notice for more information).

5. How We Use Personal Data

We use the Personal Data we collect for the following purposes:

• Providing Services, including to operate, maintain, support, and provide our Services (Legal Basis: Contract).
• Communicating with You, including to contact you for administrative purposes (e.g., to provide services and information that you request or to respond to comments and questions) or to send you marketing communications, including updates on promotions and events, relating to products and services offered by us (Legal Basis: Contract or Legitimate Interest).
• Personalization, including to customize our Services to you and provide you with the most relevant marketing and advertising materials (Legal Basis: Legitimate Interest).
• Analytics and Product Development, including to analyze usage trends and preferences in order to improve our Services, and to develop new products, services, and features (Legal Basis: Legitimate Interest).
• Customer and Vendor Relationship Management, including to track emails, phone calls, and other actions you have taken as our customer or vendor (Legal Basis: Legitimate Interest).
• Aggregation. We may aggregate or anonymize Personal Data and use the resulting information for statistical analysis or other purposes (Legal Basis: Legitimate Interest).
• Administrative and Legal, such as to address administrative issues or to defend our legal rights and to comply with our legal obligations and internal policies as permitted by law (Legal Basis: Legitimate Interest).
• Evaluating Potential Job Candidates. If you apply for a job with us, you may provide us with your resume, name, contact details, and any other relevant information (Legal Basis: Contract).

7. How We Disclose Personal Data

We may disclose Personal Data about you in the following circumstances:

• Group Entities. We may disclose Personal Data about you to our affiliates and subsidiaries. This happens because we procure IT services and other services within the Group. The transfer takes place on the basis of internally concluded contracts.
• Service Providers. We work with third parties to provide services such as hosting, maintenance, and support. These third parties may have access to or process your Personal Data as part of providing those services to us.
• Legal. We may disclose your Personal Data if it is necessary (i) for compliance with our legal obligations or (ii) to establish, exercise, or defend legal claims.
• Merger. Information about our users, including Personal Data, may be disclosed and otherwise transferred to an acquirer, successor, or assignee as part of any merger, acquisition, debt financing, sale of assets, or similar transaction, as well as in the event of an insolvency, bankruptcy, or receivership in which information is transferred to one or more third parties as one of our business assets.

8. Your Rights and Choices

As provided under applicable law and subject to any limitations in such law, you have the following rights:

• Access and Portability. You may ask us to provide you with a copy of the Personal Data we maintain about you, including a machine-readable copy of the Personal Data that you have directly provided to us, and request certain information about its processing.
• Rectification. You may ask us to update and correct inaccuracies in your Personal Data.
• Deletion. You may ask to have your Personal Data deleted as appropriate.
• Restriction. You may ask us to restrict the processing of your Personal Data or object to such processing.
• Objection. You have the right to object to the processing of Personal Data concerning you if we carry it out based upon our legitimate interests at any time. We will cease processing your Personal Data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or for the establishment, exercise or defense of legal claims.

If we process your Personal Data for direct marketing purposes, you have the right to object to the processing of your Personal Data for these purposes, including any profiling, at any time. Following your objection, we will no longer process your personal data.

• Consent Withdrawal. You may withdraw any consent you previously provided to us regarding the processing of your Personal Data at any time and free of charge. We will apply your preferences going forward. This will not affect the lawfulness of the processing before you withdrew your consent.
• Complaint. You may lodge a complaint with a supervisory authority, including in your country of residence, place of work, or where you believe an incident took place.

You may exercise these rights by contacting us using the contact details at the end of this Notice. Note that applicable laws contain certain exceptions and limitations to each of these rights.

9. International Data Transfers

We may transfer your Personal Data outside of the country in which it was collected and where the level of protection of Personal Data may be different than in your country. Personal Data may be transferred to United States, United Kingdom, Switzerland, the United Kingdom, and countries in the European Economic Area ("EEA"). If we do so, we will comply with applicable data protection laws, in particular by relying on an EU Commission adequacy decision, on contractual protections for the transfer of your Personal Data, or on another approved derogation for a specific situation, such as your explicit consent. For more information about how we transfer Personal Data internationally, or to obtain a copy of the safeguards we use for such transfers, please contact us as specified below.

10. Data Security and Data Retention

We use physical, managerial, and technical safeguards that are designed to improve the integrity and security of Personal Data that we collect, maintain, and otherwise process.

We take measures to delete or anonymize your Personal Data when it is no longer necessary for the purposes for which we process it, unless we are required by law to keep it for a longer period. When determining the retention period, we take into account various criteria, such as the type of products or services provided to you, the nature and length of our relationship with you, mandatory retention periods, and applicable statutes of limitations.

11. Third-Party Services

Our Services may contain features or links to websites and services provided by third parties. Any information you provide via these websites or services is provided directly to these third-party operators and is subject to their privacy policies, even if accessed through our Services. We encourage you to learn about these third parties' policies before providing them with your Personal Data.

12. Changes and Updates to this Notice

We may update this Notice from time to time to reflect changes in our privacy practices. We will follow applicable laws and regulations regarding notification of such changes.

13. Our Contact Information

The Nuclear Company is the entity responsible for the processing of your Personal Data. If you have any questions or comments about this Notice, our privacy practices, or if you would like to exercise your rights with respect to your Personal Data, please contact us by email at legal@thenuclearcompany.com.

In those countries where we are required to have appointed a data protection officer, you may contact the Data Protection Officer by sending an email to legal@thenuclearcompany.com with the subject heading “DPO Inquiry.”