Privacy Policy

Graymarc Advisors, LLC, a Texas limited liability company ("Graymarc," "we," "us," "our," or the "Company"), is committed to protecting your privacy and preserving your trust. Please carefully review this Privacy Policy (the "Privacy Policy"), which provides transparency about our privacy practices, including how Graymarc collects, processes, stores, and discloses Personal Information in connection with its sell-side business brokerage and M&A advisory services, and how you can control and manage your privacy choices.

In this Privacy Policy, "Visitor" or "you" refers to any individual or entity who visits Graymarc's website located at graymarc.com (the "Platform"), as well as clients, prospective sellers, prospective buyers, counterparties, and other persons who interact with Graymarc in connection with our brokerage and advisory services (collectively, "Users").

By accessing or using the Platform or engaging with our services, you agree to this Privacy Policy. You acknowledge and consent to our privacy practices as described below. Failure to comply with this Privacy Policy may result in termination of access to the Platform or our services.

Important Notice to Business Sellers and Prospective Buyers: In the course of our sell-side brokerage and M&A advisory services, Graymarc collects, processes, and shares sensitive business and personal financial information on behalf of our clients. Confidentiality is central to everything we do. This Privacy Policy governs how such information is handled. Please review it carefully before engaging our services.

1. SCOPE AND APPLICABILITY

This Privacy Policy applies to all Personal Information collected, processed, or stored by Graymarc in connection with: (i) use of the Platform; (ii) engagement of Graymarc's sell-side business brokerage, M&A advisory, or related services; (iii) marketing and business development activities; and (iv) any other interactions between you and Graymarc.

Our relationship with you will determine how this Privacy Policy applies to your information. If you engage with us directly and independently of a third party, this Privacy Policy governs. To the extent that your information is processed by an independent third party (e.g., an identity verification provider, escrow agent, or financial institution), that third party's privacy policy may also apply. If you have questions about who is responsible for your information, please contact us using the information in Section 16.

Texas Law Notice: Graymarc is organized, headquartered, and conducts business in Texas. This Privacy Policy is designed to comply with applicable Texas law, including the Texas Business and Commerce Code Chapter 521 (Identity Theft Enforcement and Protection Act) and Chapter 541 (Texas Data Privacy and Security Act, "TDPSA"), effective July 1, 2024, as well as all other applicable federal and state privacy and data security laws. Because Graymarc serves seller-clients, buyers, and other parties located across the United States, this Privacy Policy also addresses applicable rights and requirements for residents of other states, including California. See Sections 10 and 11 below.

2. INFORMATION WE COLLECT AND RECEIVE

"Personal Information" means any information that is linked or reasonably linkable to an identified or identifiable individual, including sensitive data as defined under applicable law. Graymarc collects various categories of Personal Information depending on the nature of your interaction with us.

2.1 Visitors and General Website Users

When you visit the Platform at graymarc.com, we may collect:

• Full name and contact information (name, email address, phone number);

• General geographic location or address;

• IP address, device identifiers, and browser/session data;

• Information submitted through contact forms, inquiry submissions, or schedule-a-call requests; and

• Communications and correspondence sent to us.

2.2 Clients and Program Participants (Business Sellers)

When you engage Graymarc as a sell-side client, we may collect the following categories of information:

Identity and Contact Information:

• Legal name, trade name, and all aliases;

• Mailing address, physical address, and registered address;

• Telephone number(s) and email address(es);

• Date of birth (for individual owners and principals);

• Government-issued identification information (driver's license number, passport number, EIN, and/or SSN for verification purposes); and

• Profile images and biographical information.

Business and Financial Information:

• Business name, entity type, state of formation, and years in operation;

• Business financial statements, tax returns, and related records;

• Revenue, earnings, Seller Discretionary Earnings (SDE), and EBITDA data;

• Asset and liability schedules;

• Customer and supplier information (subject to applicable confidentiality arrangements);

• Employee headcount and organizational information;

• Lease agreements and real property information;

• Existing debt obligations and lien information; and

• Asking price expectations and transaction objectives.

Transactional Information:

• Deal structure preferences, terms, and negotiation history;

• Letters of intent, term sheets, and purchase agreements (as applicable);

• Due diligence materials and disclosures;

• Escrow and closing documentation; and

• Communications with Graymarc, prospective buyers, and legal counsel.

2.3 Prospective Buyers and Third Parties

We maintain a buyer list and may receive inquiries from prospective buyers. We may collect the following from such parties:

• Identity and contact information;

• Financial qualification information and proof of funds;

• Business background and professional experience;

• Non-disclosure agreement execution records; and

• Communications and correspondence.

2.4 Automatically Collected Information

When you use the Platform, we may automatically collect:

• Log data (IP address, browser type, pages visited, time and date of access);

• Device identifiers and operating system information;

• Cookie and tracking data (see Section 8); and

• Referral URLs and click-stream data.

2.5 Information from Third Parties

We may receive Personal Information from third-party sources, including:

• Business listing platforms and databases;

• Credit reporting agencies and background check providers (subject to applicable law);

• Professional advisors (accountants, attorneys, business consultants) acting on your behalf;

• Public records sources; and

• Identity verification and fraud prevention service providers.

3. OUR USES OF PERSONAL INFORMATION

Graymarc will use Personal Information to:

• Provide, manage, and deliver sell-side business brokerage, M&A advisory, and related services;

• Value businesses and prepare Confidential Information Memoranda (CIMs), teasers, and other marketing materials for qualified buyers;

• Qualify, screen, and communicate with prospective buyers on behalf of seller clients;

• Conduct due diligence, coordinate transactions, and facilitate closings;

• Operate, maintain, and improve the Platform;

• Communicate with you about your engagement, transaction status, and related matters;

• Send service-related and marketing communications (subject to your preferences);

• Maintain records as required by applicable law, including tax, accounting, and regulatory records;

• Comply with our legal and contractual obligations, including engagement letter terms;

• Enforce our rights and agreements;

• Respond to government and legal requests;

• Detect, prevent, and investigate fraud, unauthorized activity, and security incidents;

• Verify identity and perform background checks as permitted by applicable law; and

• Analyze usage patterns and improve our services and Platform.

Legal Basis for Processing: Depending on your circumstances, we may process your Personal Information on the following bases: (i) Consent - where you have given consent for one or more specific purposes; (ii) Contract - where processing is necessary for the performance of a contract or engagement agreement with you; (iii) Legal Obligation - where processing is required by applicable law; and (iv) Legitimate Interests - where processing is necessary for our legitimate business interests, such as improving our services, maintaining security, and conducting our brokerage business, provided such interests are not overridden by your interests or rights.

4. HOW WE SHARE INFORMATION

Graymarc shares and discloses Personal Information only as necessary to provide our services, fulfill legal obligations, and operate our business. We do not sell Personal Information to third parties for monetary consideration. The categories of parties with whom we may share information include:

4.1 Prospective Buyers and Transaction Parties. In the ordinary course of our sell-side brokerage services, we share seller client information including financial, operational, and identifying information with prospective buyers and their advisors who have executed a valid Non-Disclosure Agreement (NDA) and have been qualified by Graymarc. Seller clients consent to this sharing as part of engaging Graymarc's services.

4.2 Professional Advisors and Transaction Professionals. We may share Personal Information with attorneys, accountants, financial advisors, lenders, escrow agents, and other transaction professionals involved in facilitating or closing a transaction.

4.3 Service Providers. We may share Personal Information with third-party service providers who assist us in operating our business and the Platform, including hosting and infrastructure providers, CRM and communication platforms, security and storage providers, analytics providers, background check and identity verification services, and other vendors. These service providers are contractually obligated to use your Personal Information only as necessary to provide services to us.

4.4 Business Services and Professional Advisors. We may share Personal Information with our auditors, financial institutions, legal counsel, and other professional advisors in the ordinary course of our business operations.

4.5 Corporate Transactions. We may share Personal Information in connection with any reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or ownership interests. In such a case, your Personal Information may be transferred to the potential or actual acquirer, successor, or assignee.

4.6 Legal and Regulatory Disclosures. We may disclose Personal Information to governmental authorities, regulators, or other third parties as required by applicable law, regulation, or legal process (including subpoenas and court orders), or when we believe in good faith that such disclosure is necessary to: protect our legal rights; comply with applicable law; respond to a lawful government request; protect the safety of any person; or detect, prevent, or investigate fraud or criminal activity.

4.7 With Your Consent. We may share your Personal Information with other parties with your express consent.

5. CONFIDENTIALITY OF SELLER AND BUYER INFORMATION

Graymarc recognizes that information provided by seller clients and prospective buyers is highly sensitive and confidential. Confidentiality is a core principle of our brokerage process. Accordingly, Graymarc maintains the following practices:

• Seller identity and business details will not be disclosed to prospective buyers until a valid NDA has been executed and the prospective buyer has been qualified by Graymarc.

• Confidential Information Memoranda and other deal materials will be distributed only to parties who have executed an NDA.

• Graymarc personnel are subject to confidentiality obligations with respect to all client information.

• Buyer and seller communications, financial records, and deal documentation are maintained in a secure environment with access restricted to authorized personnel and advisors.

• Graymarc operates on a sellers-only representation model. We do not represent buyers in transactions where we represent the seller, eliminating conflicts that can arise from dual representation.

Nothing in this Privacy Policy limits any confidentiality obligations set forth in a separate engagement letter, NDA, or other written agreement between the parties.

6. COMMUNICATIONS AND MARKETING

When you provide your contact information to Graymarc by, without limitation, submitting a contact form, scheduling a call, downloading a resource guide, or joining our buyer list at graymarc.com, we may send you periodic communications regarding our services, market updates, industry insights, available listings (for qualified buyers), or other information we believe may be relevant to you.

You may opt out of promotional or marketing communications at any time by:

• Clicking the "unsubscribe" link in any email you receive from us;

• Contacting us directly at admin@graymarc.com; or

• Calling us at (737) 243-8448.

Please note: Opting out of marketing communications will not affect your receipt of important transactional communications related to an active engagement, legal or regulatory notices, or security-related communications.

7. DATA RETENTION AND DISPOSAL

Graymarc retains Personal Information in accordance with applicable law and our business needs. In general, we retain Personal Information for as long as reasonably necessary to:

• Fulfill the purposes described in this Privacy Policy;

• Perform our engagement obligations and maintain transaction records;

• Comply with legal, tax, accounting, regulatory, or recordkeeping requirements;

• Resolve disputes and enforce our agreements; and

• Support any ongoing or potential legal proceedings.

Seller and buyer records related to completed transactions are generally retained for a minimum of seven (7) years following the closing date, consistent with applicable tax and business recordkeeping requirements. We will take reasonable steps to securely delete, de-identify, or anonymize Personal Information when it is no longer needed for the above purposes, subject to any applicable legal or regulatory obligations that require longer retention.

8. COOKIES AND OTHER TRACKING TECHNOLOGIES

We use cookies and similar technologies on the Platform to:

• Track Visitor interactions and usage patterns;

• Personalize your experience on the Platform;

• Measure and analyze Platform performance; and

• Improve and develop our Platform and services.

Cookies are small files stored on your device that hold limited amounts of data specific to a Visitor and website to help tailor the browsing experience. You may control or disable cookies through your browser settings; however, disabling cookies may impact certain features or functionality of the Platform.

Targeted Advertising. Graymarc may now or in the future use third-party advertising platforms, such as Meta (Facebook) and similar services, to market our brokerage services to prospective seller clients and buyers. When we do, we pay those platforms to display our advertisements, and the platforms use their own data and systems to determine who sees them. We do not control or have access to the personal data those platforms use for that purpose. If you wish to limit interest-based advertising, we encourage you to use the privacy settings available directly through those platforms (for example, your Facebook ad preferences or Google ad settings). If you have uploaded your contact information to Graymarc and wish to be excluded from any custom audience lists we maintain with advertising platforms, you may contact us at admin@graymarc.com and we will remove you from those lists.

Global Opt-Out. To the extent Graymarc is subject to the universal opt-out provisions of the TDPSA (Tex. Bus. & Com. Code Section 541.055(e), effective January 1, 2025), Graymarc will make reasonable efforts to recognize and honor universal opt-out signals (such as the Global Privacy Control) with respect to personal data processing for purposes of targeted advertising or sale of personal data. Graymarc does not currently sell personal data in the ordinary course of its brokerage operations. For opt-out requests related to third-party advertising platforms, please refer to the Targeted Advertising paragraph above or contact us at admin@graymarc.com.

9. THIRD-PARTY SITES, LINKS, AND SOCIAL MEDIA

The Platform may include links to third-party websites, including business listing platforms, professional networks, scheduling tools, or industry resources. When you navigate to a third-party website through a link on our Platform, the privacy policy of that website governs your interaction with it. Graymarc is not responsible for the privacy practices of any third-party websites.

Our Platform may also feature social media widgets, links, or embedded tools. These features may collect your IP address, the page you are visiting, and may set cookies. Such features are governed by the privacy policies of their respective providers.

10. TEXAS RESIDENTS -- PRIVACY RIGHTS UNDER THE TEXAS DATA PRIVACY AND SECURITY ACT

Texas Data Privacy and Security Act (TDPSA). Pursuant to the Texas Data Privacy and Security Act, Tex. Bus. & Com. Code Chapter 541 (effective July 1, 2024), Texas residents who are consumers (i.e., individuals acting in a personal or household capacity, not a commercial or employment capacity) have the following rights with respect to their Personal Data processed by Graymarc:

• Right to Know / Confirm. You have the right to confirm whether Graymarc is processing your Personal Data and to access that data.
  
  

• Right to Correction. You have the right to request that Graymarc correct inaccuracies in your Personal Data, taking into account the nature and purposes of the processing.
  
  

• Right to Deletion. You have the right to request deletion of Personal Data provided by or obtained about you, subject to exceptions (e.g., where retention is required by law, necessary to complete a transaction you requested, or needed to detect fraud or protect security).
  
  

• Right to Portability. You have the right to obtain a portable copy of your Personal Data in a readily usable format, to the extent technically feasible.
  
  

• Right to Opt Out. You have the right to opt out of the processing of your Personal Data for purposes of: (i) targeted advertising; (ii) sale of your Personal Data; and (iii) profiling in connection with decisions that produce legal or similarly significant effects. Graymarc does not sell Personal Data for monetary consideration as defined under the TDPSA in the ordinary course of its brokerage operations.
  
  

• Right Against Discrimination. You have the right not to receive discriminatory treatment for exercising your privacy rights under the TDPSA.
  
  

• Right to Appeal. If Graymarc declines to take action on a request you submit to exercise your rights, you have the right to appeal that decision. We will respond to a written appeal within sixty (60) days of receipt. If your appeal is denied, we will provide information on how to contact the Texas Attorney General to submit a complaint via the Attorney General's website.

How to Submit a Request: To exercise any of the above rights, you may submit an authenticated request to Graymarc using the contact information in Section 16. We will respond without undue delay and no later than forty-five (45) days after receipt of a verified request. We may extend this period by an additional forty-five (45) days where reasonably necessary, with prior written notice. Responses will be provided free of charge at least twice annually per consumer.

Sensitive Data: Graymarc will not process "sensitive data" as defined under the TDPSA including precise geolocation data and Personal Data of children under the age of thirteen (13) without obtaining your prior consent, except as otherwise permitted or required by applicable law.

Note on Scope: The TDPSA's consumer rights apply to individuals acting in a personal or household context. Graymarc's primary services are business-to-business in nature, and much of the information Graymarc processes relates to commercial transactions. Accordingly, some TDPSA consumer rights may not apply to all information processed by Graymarc in its capacity as a business broker.

11. CALIFORNIA RESIDENTS: PRIVACY RIGHTS UNDER THE CCPA AND CPRA

This section applies to residents of the State of California and supplements the other provisions of this Privacy Policy. It is provided pursuant to the California Consumer Privacy Act of 2018 and its amendment by the California Privacy Rights Act of 2020 (together, the "CCPA"), Cal. Civ. Code Section 1798.100 et seq.

Applicability Note: The CCPA applies to for-profit businesses that conduct business in California and meet at least one of the following thresholds: (i) annual gross revenues exceeding $25 million; (ii) buying, receiving, or selling the Personal Information of 100,000 or more California consumers or households annually; or (iii) deriving 50% or more of annual revenues from selling or sharing consumers' Personal Information. Graymarc provides this section as a courtesy to California residents regardless of whether Graymarc currently meets these thresholds, and intends to maintain compliance as the business grows.

Categories of Personal Information Collected. Graymarc has not yet collected Personal Information from California residents but may do so in the future as our business grows. To the extent Graymarc collects Personal Information from California residents, the following categories may be collected, as defined under the CCPA:

• Identifiers (name, email address, phone number, IP address, government ID numbers);

• Personal information described in Cal. Civ. Code Section 1798.80(e) (financial information, tax records, signatures);

• Commercial information (business records, transaction history, financial performance data);

• Internet or other electronic network activity information (browsing and interaction data on the Platform);

• Geolocation data (general location from IP address or address information); and

• Professional or employment-related information (business ownership history, professional background).

Categories of Sources. To the extent we collect Personal Information from California residents, we will collect it directly from you, automatically through your use of the Platform, and from third-party sources as described in Section 2.5 above.

Business or Commercial Purposes for Collection. To the extent we collect Personal Information from California residents, we will do so for the business and commercial purposes described in Section 3 above.

Categories of Third Parties with Whom Personal Information Is Shared. To the extent we collect and share Personal Information from California residents, we will share it with the categories of third parties described in Section 4 above.

Sale or Sharing of Personal Information. Graymarc does not sell Personal Information to third parties for monetary consideration. To the extent Graymarc's use of third-party analytics or advertising tools on the Platform could be characterized as "sharing" Personal Information for cross-context behavioral advertising purposes under the CCPA, California residents have the right to opt out of such sharing.

Sensitive Personal Information. Graymarc may collect certain sensitive personal information in the course of its brokerage services, including government identification numbers and financial account information. Graymarc collects such information only as necessary to perform its services and does not use or disclose it for purposes beyond those permitted under the CCPA.

Rights of California Residents. Subject to certain exceptions and verification requirements, California residents have the following rights under the CCPA:

• Right to Know. You have the right to request that Graymarc disclose the categories and specific pieces of Personal Information collected about you over the preceding twelve (12) months, the categories of sources, the purposes for collection, and the categories of third parties with whom it has been shared.
  
  

• Right to Deletion. You have the right to request deletion of Personal Information Graymarc has collected about you, subject to certain exceptions (e.g., where the information is necessary to complete a transaction, detect security incidents, comply with a legal obligation, or is otherwise exempt under the CCPA).
  
  

• Right to Correction. You have the right to request that Graymarc correct inaccurate Personal Information it maintains about you.
  
  

• Right to Portability. You have the right to receive a copy of your Personal Information in a portable, readily usable format, to the extent technically feasible, no more than twice per twelve-month period.
  
  

• Right to Opt Out of Sale or Sharing. You have the right to opt out of the sale of your Personal Information and the sharing of your Personal Information for cross-context behavioral advertising purposes. Graymarc does not sell Personal Information. To opt out of any sharing for behavioral advertising purposes, contact us using the information in Section 16.
  
  

• Right to Limit Use of Sensitive Personal Information. You have the right to direct Graymarc to limit its use and disclosure of sensitive personal information to only those purposes necessary to provide the services you have requested, or as otherwise permitted by the CCPA.
  
  

• Right Against Discrimination. Graymarc will not discriminate against you for exercising any of your CCPA rights. Graymarc will not deny goods or services, charge different prices, or provide a different level of service based solely on your exercise of these rights.
  
  

How to Submit a Request. To submit a verifiable consumer request under the CCPA, contact us using the information in Section 16. You may submit a request on behalf of a minor child of whom you are the parent or legal guardian. We will respond to a verifiable consumer request within forty-five (45) days of receipt. If we require more time (up to an additional forty-five days), we will notify you in writing of the reason and extension period. We do not charge a fee for processing a verifiable consumer request unless it is excessive or repetitive.

Authorized Agents. You may designate an authorized agent to submit a CCPA rights request on your behalf. We may require written proof of the agent's authorization and may verify your identity directly.

Do Not Sell or Share My Personal Information. As noted above, Graymarc does not sell Personal Information. If you wish to opt out of any sharing of your Personal Information for cross-context behavioral advertising, please contact us at admin@graymarc.com or (737) 243-8448.

12. YOUR PRIVACY PREFERENCES

Graymarc provides you with the ability to exercise certain preferences with respect to your Personal Information, including accessing, updating, and requesting deletion of information, by contacting us using the information in Section 16. We will process such requests in accordance with applicable law and subject to appropriate verification of your identity.

13. CHILDREN'S DATA

Graymarc's Platform and brokerage services are not directed to, and we do not knowingly collect Personal Information from, individuals under the age of eighteen (18). Our services are intended for business owners, professionals, and adults. If you believe a minor has provided Personal Information to us, please contact us immediately at admin@graymarc.com and we will take prompt steps to delete such information.

14. INTERNATIONAL USERS

Graymarc is based in Texas and your Personal Information is collected and processed in the United States. If you access the Platform from outside the United States, you do so at your own risk and initiative. Graymarc makes no representations that the Platform is appropriate or available for use in any jurisdiction outside the United States.

WE MAKE NO REPRESENTATION THAT THE CONTENT OR SERVICES ON THE PLATFORM CONFORM TO THE LAWS OF ANY JURISDICTION OUTSIDE THE UNITED STATES. IF YOU ARE ACCESSING THE PLATFORM FROM OUTSIDE THE UNITED STATES, YOU ARE SOLELY RESPONSIBLE FOR COMPLIANCE WITH YOUR LOCAL LAWS.

15. INFORMATION SECURITY

Graymarc implements and maintains reasonable administrative, technical, and physical data security measures designed to protect your Personal Information from unauthorized access, use, disclosure, alteration, or destruction, consistent with Tex. Bus. & Com. Code Section 541.101. Our security practices are commensurate with the nature and volume of the Personal Information we handle and include, without limitation:

• Encryption of sensitive data in transit and at rest where technically feasible;

• Access controls limiting access to Personal Information to authorized personnel on a need-to-know basis;

• Regular review of our security practices and vendor relationships;

• Employee training on data security and privacy obligations; and

• Secure destruction of Personal Information when it is no longer needed.

Notwithstanding our security measures, no data transmission over the internet or storage system is guaranteed to be 100% secure. You transmit Personal Information to us at your own risk.

16. BREACH NOTIFICATION

Texas Business and Commerce Code Section 521.053. In the event of a breach of system security involving your sensitive Personal Information, Graymarc will:

• Notify affected individuals without unreasonable delay and no later than the sixtieth (60th) day after the date on which we determine that a breach occurred, as required by Tex. Bus. & Com. Code Section 521.053;

• If the breach affects two hundred fifty (250) or more Texas residents, notify the Texas Attorney General as soon as practicable and no later than thirty (30) days after determining that a breach occurred, by submitting the required electronic notification form through the Attorney General's website, as required by the 2023 amendment to Section 521.053 (S.B. 768); and

• If the breach affects ten thousand (10,000) or more persons at one time, also notify each major consumer reporting agency of the timing, distribution, and content of the notices without unreasonable delay.

Notice to affected individuals may be provided by: (i) written notice to the individual's last known mailing address; (ii) electronic notice, if consistent with applicable law; or (iii) substitute notice (e.g., conspicuous posting on the Platform and notification to major statewide media) if direct notice is not reasonably feasible due to cost or lack of contact information.

California Residents: Data Breach. California residents have the right to bring a private civil action for damages in the event of certain data breaches involving their unencrypted Personal Information as a result of Graymarc's failure to maintain reasonable security practices. Before filing suit, a California resident must provide Graymarc with written notice of the alleged CCPA violation and allow thirty (30) days to cure the violation.

17. GENERAL INQUIRIES, REQUESTS, AND UPDATES

For inquiries about this Privacy Policy, to submit a privacy rights request, or to file a privacy complaint, please contact us at:

Graymarc Advisors, LLC Attn: Privacy 5900 Balcones Drive, #29489 Austin, TX 78731

Email: admin@graymarc.com Phone: (737) 243-8448 Website: graymarc.com

This Privacy Policy may be updated from time to time to reflect changes in our practices, applicable law, or the services we offer. When we make material changes, we will update the "Last Revised" date at the top of this Policy. We encourage you to review this Policy periodically. Your continued use of the Platform or our services following any update constitutes your acceptance of the revised Privacy Policy.

Copyright 2026 Graymarc Advisors, LLC. All rights reserved.