Privacy Notice

Effective date: July 30, 2026

Nestview International, Inc. respects your privacy. This notice explains what personal information we collect across our websites, applications, programs, and properties, why we collect it, who receives it, how long we keep it, and the rights and choices available to you. We have written it to be read: plain language throughout, with precise terms where precision protects you.

If you are a resident of California or another United States state with a comprehensive privacy law, Section 9 is written for you. If you are in Canada, Section 10 applies. If you are in the European Union, the European Economic Area, or the United Kingdom, Section 11 applies.

Contents

1. Who we are and what this notice covers
2. Personal information we collect
3. Where personal information comes from
4. How we use personal information, and our legal bases
5. Cookies and similar technologies
6. How we share personal information
7. International transfers
8. How long we keep personal information
9. Your United States privacy rights
10. Your Canadian privacy rights
11. Your rights in the European Union and the United Kingdom
12. Minors
13. Security
14. Changes to this notice
15. How to contact us and submit requests

1. Who we are and what this notice covers

This notice is issued by Nestview International, Inc. ("Nestview," "we," "us," or "our"), a Florida corporation with its registered address at 1200 Brickell Ave., Miami, Florida 33131, United States. We are responsible, as the data controller, for the personal information described here, which means we decide how and why it is used.

In this notice, the "Nestview Group" means Nestview International, Inc. together with its subsidiaries, affiliates, and other entities under common ownership or control (each a "Group Company"). We are the controller for nestview.com and the Services listed below. Where a Service is operated by another Group Company and identified to you as such, that Group Company is the controller for that Service, and this notice applies to its processing unless a separate notice is provided for it. Processing described in this notice may be carried out by or on behalf of Group Companies and by service partners acting under contract.

"Personal information" means information that identifies you or reasonably relates to you as an identifiable individual.

This notice covers personal information we collect in connection with:

• nestview.com and its subdomains, including the forms, subscriptions, and account features available there (together, the "Sites");
• ir.nestview.com, our investor relations site, including its expression of interest form;
• the NVaccess application, through which reservations and stays are arranged and managed;
• the owner portal available to co-owners of our residences;
• the broker portal available to participating real estate professionals;
• the NVme membership program;
• the Nestview Card program, which is available by invitation;
• payments we accept, including payments made in digital assets where offered;
• gift purchases made through the Sites;
• our newsletters, contact forms, and email correspondence, and messaging channels where we offer them, including WhatsApp; and
• visits to our properties, including camera systems operated in common areas.

Together, we refer to all of the above as the "Services." Where a program is governed by its own terms or a program-specific privacy disclosure, that document supplements this notice for that program.

This notice is drafted in English. The English version controls over any translation provided for convenience, to the extent permitted by applicable law.

2. Personal information we collect

We collect what each relationship requires, and no more. The categories below are organized by context. Where a form marks a field as required and you choose not to provide it, we may be unable to complete the related request, reservation, or application.

When you visit our websites

• Device and browser information, IP address, approximate location derived from your IP address, the pages you view, and how you reached us.
• Cookie and similar-technology data, as described in our Cookie Policy.

When you contact us or subscribe

• Your name, email address, telephone number, and the content of your message.
• Newsletter subscription details and your communication preferences.
• Contact details and interest information we may receive from marketing partners and list providers (Section 3); we use them only for communications you can opt out of at any time, and every marketing message includes an unsubscribe option.

Reservations and stays (NVaccess)

• Identity and contact details for you and accompanying guests, stay dates, occupancy, and stated preferences.
• Your NVaccess account credentials.
• Payment details, billing address, and transaction records. Payment card details are collected and processed by our payment processors.
• Government-issued identification, collected at booking or at check-in where required for verification or by law.
• Correspondence about your reservation or stay.

Ownership and co-ownership (owner portal)

• Identity and contact details, and identity verification documentation collected during onboarding, such as government-issued identification and proof of address.
• Ownership records, transaction and closing documentation, and records of assessments and dues.
• Usage scheduling and residence-related requests submitted through the owner portal.
• Banking details used for ownership-related payments.

NVme membership

• Application details, identity verification information (know your customer, or KYC), contact details, and preferences.
• Membership activity and benefit usage.

Broker program

• Name, brokerage affiliation, license details, and contact information.
• Referral and transaction records connected to your participation, and payment details for amounts payable to you.

Investor relations and expressions of interest (ir.nestview.com)

• Name, contact details, jurisdiction of residence, and the content of any expression of interest you submit, including eligibility or accreditation information you choose to provide.
• Related correspondence.

The investor relations site is informational. Submitting an expression of interest is not an offer, a commitment, or a subscription of any kind, and it creates no obligation for you or for us.

Nestview Card

• Application information for this invitation-based program, including identity verification (KYC) information and the financial information needed to assess and administer the program.
• Transaction data generated by use of the card.
• Biometric identifiers, only if and where used for verification; biometric verification is not currently in use, and if it is introduced, a biometric-specific disclosure with a retention and destruction schedule will be added to this notice first.

Payments, including digital assets

• Payment instrument details, billing information, and transaction records, collected and processed through our payment processors.
• Where we accept digital assets: wallet addresses, transaction identifiers, and related screening information.
• Sanctions and anti-money laundering (AML) screening information, which we are required to collect and check for certain transactions and programs.

Gift purchases and gift instruments

• Purchaser and recipient names and contact details, delivery details, and any gift message you include.
• Where we offer gift instruments: purchaser and recipient identification and contact details, instrument numbers and our register of numbered instruments, records of activation, transfer honoring, and redemption, and related correspondence.
• Gift instruments may be issued by another Group Company under separate issuer terms presented at purchase; where that is the case, the issuer's terms and any program-specific privacy disclosure supplement this notice.

On our properties

• Images and recordings from camera systems operated in common areas, which are marked by on-site signage.

Information about other people

If you provide personal information about another person, for example an accompanying guest, a co-owner, or a gift recipient, you confirm that you are authorized to provide it and that we may use it as described in this notice.

Sensitive information

Please do not send us sensitive personal information, for example information about health, religion, or political opinions, unless we specifically request it as part of a program described above. Identity, financial, and screening information collected for KYC and AML purposes is used only as described in Sections 4 and 9.

3. Where personal information comes from

• Directly from you, when you complete a form, make a reservation, apply to a program, submit an expression of interest, or communicate with us.
• Automatically from your device, when you use the Sites and applications, as described in our Cookie Policy.
• From service providers acting on our instructions, such as payment processors and identity verification and screening providers.
• From brokers, agents, and transaction professionals involved in a reservation or transaction you pursue with us.
• From screening databases and public records, where we are required to conduct sanctions, AML, or similar checks.
• From a person acting for you, such as someone who books a stay that includes you or purchases a gift for you.
• From marketing partners and list providers, who may supply contact details and interest information for the communications described in Section 4. Every message sent to such contacts includes an unsubscribe option, and the rights in Sections 9 through 11 apply to this information like any other.

4. How we use personal information, and our legal bases

Where the law of your jurisdiction requires a legal basis for processing, as in the European Union, the United Kingdom, and Quebec, the table below identifies the bases we rely on. More than one basis can apply to a purpose.

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Screening tools may flag a potential match; flagged matches are reviewed by a person before any action is taken.

5. Cookies and similar technologies

The Sites use a small number of cookies and similar technologies, managed through our consent management tool, which lets you make choices by category. The current list of cookies, their purposes and lifetimes, and the way to change or withdraw your choices are set out in our Cookie Policy. The choices you make there operate alongside the rights described in Sections 9 through 11.

6. How we share personal information

We do not sell personal information. We do not share personal information with third parties for cross-context behavioral advertising. If that ever changes, we will update this notice first and provide the opt-out mechanisms required by law before any such sale or sharing begins. Receiving contact details from marketing partners, as described in Section 3, is not a sale by us of your information; where we send marketing to such contacts, every message carries an unsubscribe option and opt-outs are honored across our lists.

We disclose personal information only as follows:

• Service providers. Companies that host our infrastructure, deliver email, operate our consent management tool, process payments, verify identity, run required screening, and provide similar services, under contracts that limit their use of personal information to the services they perform for us.
• Group Companies. Members of the Nestview Group, as defined in Section 1, where needed to operate the Services described in this notice, for the purposes described here and under safeguards consistent with this notice.
• Transaction participants. Brokers, closing and escrow agents, notaries, and similar professionals involved in a reservation, membership, or ownership transaction you pursue, to the extent needed for that transaction.
• Financial partners. Banks, card networks, payment institutions, and digital-asset payment processors that support the relevant program or payment.
• Professional advisers. Auditors, accountants, insurers, and legal advisers, under duties of confidentiality.
• Authorities. Courts, regulators, tax authorities, and law enforcement, where we are legally required to respond, or where disclosure is necessary to protect our rights, our guests, or the public.
• Business transactions. A counterparty and its advisers in connection with a reorganization, financing, merger, sale of assets, or similar transaction, under confidentiality obligations appropriate to the stage of the transaction.
• At your direction. Anyone you ask us to share information with.

We require every service provider to protect personal information and to use it only on our instructions. Browsers can send an opt-out preference signal known as Global Privacy Control (GPC); we honor it as described in Section 9.

7. International transfers

We are based in the United States, and personal information is processed in the United States. Depending on the program, personal information may also be processed in Canada and in other countries where we or our service providers operate.

Where information about individuals in the European Union, the European Economic Area, the United Kingdom, or Switzerland is transferred to a country that has not been found to provide an adequate level of protection, we rely on appropriate safeguards, in particular the standard contractual clauses approved by the European Commission, supplemented for United Kingdom transfers by the UK addendum or the UK international data transfer agreement. These safeguards apply equally to transfers between Group Companies and to transfers to our service providers. You may request a copy of the relevant safeguards by writing to legal@nestview.com.

For residents of Quebec: personal information may be communicated outside Quebec, including to the United States. We assess such communications as required by Quebec law before making them.

8. How long we keep personal information

We keep personal information only as long as needed for the purposes described in this notice, and we then delete it, anonymize it, or archive it where the law requires. Retention periods are set using three criteria: the duration of your relationship with us, the legal obligations that apply to the record, and the limitation periods relevant to potential disputes.

Recordings from camera systems at our properties are kept for a limited period consistent with the security purposes described above and are then overwritten.

9. Your United States privacy rights

This section applies to California residents under the California Consumer Privacy Act (CCPA) and, to the extent similar laws apply, to residents of other United States states with comprehensive privacy laws.

What you can ask of us

• Know and access. Confirm whether we process your personal information, and receive the categories and specific pieces we have collected, the sources, the purposes, and the categories of recipients.
• Delete. Ask us to delete personal information we collected from you, subject to the exceptions the law allows, for example completing a transaction, security, and legal compliance.
• Correct. Ask us to correct inaccurate personal information.
• Opt out of sale or sharing. Direct a business that sells or shares personal information to stop. As stated in Section 6, we do not sell personal information and do not share it for cross-context behavioral advertising.
• Limit use of sensitive personal information. We collect sensitive personal information, meaning government identifiers, financial account details, and, if used in the Card program, biometric identifiers, only to provide the Services you request, verify identity, prevent fraud, maintain security, and comply with law. We do not use it to infer characteristics about you, so California law does not require a limit-use link for our current practices.
• Non-discrimination. We will not deny you Services, charge you different prices, or provide a different level of Services because you exercised a privacy right.

Notice at collection: categories under California law

Section 2 (what we collect, by context), Section 3 (sources), Section 4 (purposes), Section 6 (recipients), and Section 8 (retention) together serve as our notice at collection. The table below maps that information to the categories defined by California law. We do not sell any category of personal information, and we do not share any category for cross-context behavioral advertising.

We do not collect protected classification characteristics, health or medical information, precise geolocation, or education information, and we do not knowingly collect any category from individuals under 18 (Section 12).

De-identified information, data brokers, and "Shine the Light"

• De-identified information. Where we hold information that has been de-identified, we maintain and use it only in de-identified form and do not attempt to reidentify it, except as the law permits to test that the de-identification holds.
• Data brokers. We are not a data broker. Our relationship with you is direct, and, as stated in Section 6, we do not sell personal information.
• "Shine the Light." California residents may ask, once per calendar year, about disclosures of personal information to third parties for those parties' own direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes. Requests on this point go to legal@nestview.com.

Opt-out preference signals

We honor recognized opt-out preference signals, including Global Privacy Control (GPC), as a valid request to opt out of any sale or sharing of personal information for that browser or device. We process these signals without charging a fee, without degrading your experience, and without displaying interruptions. To use one, enable GPC in a participating browser or browser extension. We do not respond to other "do not track" signals, for which no settled standard exists. Because we do not sell or share personal information, no "Do Not Sell or Share My Personal Information" link is required on the Sites.

How to submit a request

Email legal@nestview.com, using the email address associated with your relationship with us where possible. We verify requests by matching the information you provide against the information we hold, and for requests involving sensitive records we may ask for additional verification. If you use an authorized agent, we require proof of the agent's authority and may confirm the request with you directly.

Timing and outcomes

We respond within 45 days of receiving a verifiable request. Where reasonably necessary, we may extend once by a further 45 days, and we will tell you within the first 45 days if we do. Disclosures cover the 12-month period before your request; you may ask us to go further back, and we will unless doing so proves impossible or would involve disproportionate effort. If we decline a request, we will explain why, and where your state provides an appeal right, you may appeal by replying to our response; we will answer as your state's law requires. California residents may also contact the California Privacy Protection Agency or the California Attorney General.

Where we offer referral, loyalty, or incentive programs, participation is voluntary and program terms, including any material terms relating to personal information, are provided at enrollment. Where the law requires, including under California's financial-incentive rules, we provide a notice of financial incentive and honor withdrawal from the program at any time, without penalty.

10. Your Canadian privacy rights

We handle personal information of individuals in Canada in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, including the Quebec Act respecting the protection of personal information in the private sector.

How the fair information principles apply here

• Accountability. We are responsible for personal information under our control and have designated a person accountable for compliance, with the title Privacy Officer, reachable at legal@nestview.com.
• Identified purposes and limited collection. We identify purposes at or before collection (Sections 2 and 4) and collect only what those purposes require. We do not make consent to unrelated uses a condition of service.
• Consent. We rely on express consent for sensitive information and on implied consent only where your action makes the purpose obvious, for example providing an email address to receive a requested reply. You may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice; before acting on a withdrawal, we will explain what it means for the Services you use.
• Limiting use, disclosure, and retention; accuracy; safeguards. Sections 4, 6, 8, and 13 describe these practices.
• Openness, access, and challenging compliance. This notice is our public statement of practices. You may request access to your personal information, challenge its accuracy and completeness, and have it amended as appropriate, by writing to legal@nestview.com. We respond within the time limits required by applicable law.

Quebec

• Person in charge. The person in charge of the protection of personal information holds the title Privacy Officer and can be reached at legal@nestview.com.
• Consent. Where we ask for your consent, we ask in clear and simple language, separately for each purpose.
• Communication outside Quebec. Section 7 describes communications of personal information outside Quebec.
• Confidentiality incidents. We maintain an incident register, act to reduce the risk of injury from any confidentiality incident, and notify the Commission d'accès à l'information (CAI) and affected individuals where an incident presents a risk of serious injury.
• Cessation of dissemination and de-indexing. Quebec residents may request that we cease disseminating personal information or de-index a hyperlink attached to their name, in the circumstances provided by law, by writing to legal@nestview.com.

Complaints

You may raise a concern with us at legal@nestview.com. You may also contact the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

11. Your rights in the European Union and the United Kingdom

This section applies where European Union, European Economic Area, or United Kingdom data protection law applies to our processing of your personal information.

• Legal bases. Section 4 identifies the legal basis for each purpose. Where we rely on legitimate interests, the interest pursued is named in the same row.
• Your rights. You may request access to your personal information and a copy of it; rectification of inaccurate information; erasure; restriction of processing; and portability of information you provided to us. You may object at any time to processing based on legitimate interests, and to direct marketing, which we will stop without exception. Where processing is based on consent, you may withdraw consent at any time without affecting prior processing. You also have rights in relation to decisions based solely on automated processing; as stated in Section 4, we do not make such decisions.
• How and when we respond. Write to legal@nestview.com. We respond within one month, extendable by two further months for complex or numerous requests, in which case we will tell you within the first month. Requests are free of charge; we may ask for information reasonably needed to confirm your identity.
• Complaints. You may lodge a complaint with the supervisory authority in the place where you live or work or where the matter arose. In the United Kingdom, that is the Information Commissioner's Office.
• Representative. We are established outside the European Union and the United Kingdom and have not designated a representative there; every right in this section can be exercised directly through legal@nestview.com.
• Transfers. Section 7 describes the safeguards we use for transfers out of the European Union, the European Economic Area, and the United Kingdom.

12. Minors

The Services are intended for adults. We do not knowingly collect personal information from individuals under 18, and no part of the Services is directed to them. Where an adult provides limited information about accompanying minors to administer a reservation or stay, we use it only for that purpose. If you believe a minor has provided personal information to us, write to legal@nestview.com and we will delete it.

13. Security

We use organizational, technical, and administrative measures proportionate to the sensitivity of the information we hold, including access limited to those who need it, encryption of data in transit, and contractual safeguards with our service providers. No transmission or storage system can be guaranteed fully secure. If you believe your interaction with us is no longer secure, contact legal@nestview.com immediately. We maintain incident response procedures and will provide any notifications required by applicable law.

14. Changes to this notice

The effective date at the top of this notice shows when it was last revised. If we make material changes, we will post a prominent notice on the Sites before the changes take effect and, where required by law, notify you directly or ask for your consent. Notice of amendments is published in the same place you found this notice.

15. How to contact us and submit requests

All privacy questions and requests, in every jurisdiction, go to a single mailbox:

• Email: legal@nestview.com
• Post: Nestview International, Inc., Attn: Legal Department, 140 Yonge Street, Suite 200, Toronto, Ontario M5C 1X6, Canada

When you write, tell us where you are located and which right you want to exercise, and use the email address connected to your relationship with us where possible. Section 9 describes response timing for United States requests, Section 10 for Canada, and Section 11 for the European Union, the European Economic Area, and the United Kingdom. We do not charge a fee for requests unless the law permits one for requests that are manifestly unfounded or excessive, and if we ever rely on that, we will explain why.

This notice is available in alternative formats on request, including large print and accessible electronic documents; write to legal@nestview.com. Our Digital Accessibility statement describes the same commitment for the rest of our web content.