These Terms of Service ("Terms") govern all access to and use of the GoldenCalyx platform, including the website www.goldencalyx.com, its proprietary algorithms, database, interfaces, and related services (collectively, the "Platform"). By creating an account, checking the "I Agree" box, or accessing any part of the Platform, you ("User" — representing a licensed commercial Buyer, Vendor, or Auditor as defined herein, or a prospective Buyer, Vendor, or Auditor accessing the Platform) agree to be bound by these Terms and the GoldenCalyx Privacy Policy, which is fully incorporated by reference.

1. DEFINITIONS

1.1 "Platform"

means the digital cannabis business intelligence infrastructure operated by GoldenCalyx, comprising the website, databases, standardized sensory and physical verification protocols, and matching engines.

1.2 "Vendor"

means a fully licensed cultivation, processing, or production facility listed on the Platform.

1.3 "Buyer"

means a fully licensed distribution, manufacturing, or purchasing entity registered on the Platform.

1.4 "Auditor"

means an independent professional listed in the Platform's Auditor Directory who is qualified to perform GACP/GMP-aligned facility inspections and physical product batch evaluations.

1.5 "Batch"

means a specific, discrete, and unified quantity of medical cannabis listed on the Platform following standardized data capture.

1.6 "Blind LOI"

means a coded, non-binding Letter of Intent executed under randomized aliases (e.g., Buyer-A and Vendor-B) recording the commercial terms agreed in Messages. Each party's electronic signature of the Blind LOI constitutes that party's Access Data Request.

1.7 "Access Data Request"

means a party's electronic signature of the Blind LOI. The Buyer's signature followed by the Vendor's countersignature of the same terms constitutes the mutual Access Data Request, confirming that commercial terms (including price, quantity, delivery, payment, and packaging) have been agreed under randomized aliases. If the terms change after the Buyer signs, the Buyer's signature is void.

1.8 "Data Access Fee"

means the fee of $1,000.00 USD per side for each 50.00 kg, or part thereof, of the order total, invoiced to both Buyer and Vendor upon the Vendor's countersignature of the Blind LOI, which triggers the unmasking of legal identities and the release of verified product datasets following receipt of full payment.

1.9 "Data Access Credit"

means a discretionary platform credit that GoldenCalyx may, in its sole and absolute discretion, issue on a case-by-case basis in good faith if an unmasked transaction fails to execute post-reveal, which may be applied to a future Blind LOI match.

1.10 "Quality Score"

means the objective rating (0-100) assigned to a product batch, calculated by GoldenCalyx's proprietary algorithm based on standardized laboratory COAs and independent physical audit inputs.

2. NATURE OF THE SERVICE & LEGAL SEPARATION

GoldenCalyx is strictly a technology and data analytics service provider. GoldenCalyx does not plant-touch, distribute, cultivate, transport, or broker physical cannabis. Specifically, GoldenCalyx:

• Does not act as a broker, dealer, agent, or representative of any Buyer, Vendor, or Auditor.
• Does not take legal title to, physical possession of, or control over any cannabis or cannabis-derived products.
• Does not process, hold, escrow, or disburse funds relating to the commercial purchasing of physical cannabis.
• Does not employ, schedule, direct, or compensate Auditors. The relationships between Auditors and Vendors are entirely independent, bilateral B2B service relationships.

All commercial transactions, legal compliance, and physical logistics are executed entirely off-platform directly between the licensed Buyer and Vendor, without GoldenCalyx's participation or liability.

3. ELIGIBILITY AND LICENSING REPRESENTATIONS

The Platform is strictly a business-to-business (B2B) data analytics platform for licensed commercial entities. Access to the Platform's registered services is restricted to entities that represent and warrant, upon registration and continuously thereafter, that:

• They possess and continuously maintain all required municipal, regional, state/provincial, national, and international licenses and permits to cultivate, process, purchase, import, or distribute commercial medical cannabis.
• They are in full compliance with all local laws and regulations governing their commercial activities.
• They shall immediately notify GoldenCalyx in writing if any required license or permit is suspended, revoked, expired, or modified in a manner that affects their platform eligibility. GoldenCalyx reserves the right to immediately suspend or terminate any account upon a change in licensing status.

Acceptance of these Terms prior to registration constitutes acknowledgement of these eligibility requirements. The representations in this section are made upon submission of a registration profile.

4. FEE STRUCTURE AND DISCRETIONARY DATA ACCESS CREDIT PROTOCOL

To provide maximum transparency and eliminate upfront barriers to data exploration, GoldenCalyx operates on a transaction-initiated flat-fee model:

4.1 Free Coded Access

Access to the Platform's core analytical database, including randomized scatter plots and blind Quality Scores is provided free of charge. No upfront or recurring monthly reveal fees are assessed to Buyers or Vendors.

4.2 Data Access Fee Schedule

Unmasking legal identities and releasing full verified product datasets (including unredacted COAs, applicable certificates, and photographic evidence) is $1,000.00 USD per side for each 50.00 kg, or part thereof, of the order total (e.g., $1,000.00 per side on 20 kg; $3,000.00 per side on 137 kg).

The trigger event is the Vendor's countersignature of the Blind LOI the Buyer has signed, recording the terms (price, quantity, delivery, payment, and packaging) agreed in Messages.

Upon countersignature, an invoice is generated and issued to both parties. Each party must remit full payment. Platform deliverables are released only after both invoices are settled in full.

4.3 Discretionary Data Access Credit and Good Faith Policy

The Data Access Fee is strictly non-refundable. However, to demonstrate our commitment to operating in good faith and fostering successful commercial matches, GoldenCalyx may, in its sole and absolute discretion, evaluate failed post-reveal transactions on a case-by-case basis. If GoldenCalyx determines, upon review of the circumstances, that a credit is warranted, it may issue a "Data Access Credit" to the respective party's account as a discretionary gesture of goodwill. The issuance of any such credit is evaluated strictly on an individual basis, does not constitute a contractual entitlement, right, or guarantee of the User, and is not a waiver of the non-refundable nature of the fee. If granted, the credit may be applied as a rollover to cover the Data Access Fee of a future transaction.

5. THE VETTED AUDITOR DIRECTORY & SCORING DECOUPLING

To maintain absolute data integrity and eliminate potential employee-status liabilities, the Platform utilizes an independent directory model:

5.1 Independent Status:

Auditors listed on the platform are fully independent third-party professionals. They are not employees, agents, or contractors of GoldenCalyx. GoldenCalyx acts solely as a standard-setting directory.

5.2 Direct Bilateral Contract:

Vendors contract directly with the Auditor of their choice from the directory. The Vendor and Auditor are solely responsible for negotiating, invoicing, and executing payment for all audit services, hourly rates, and travel expenses directly. GoldenCalyx is not a party to this transaction and holds zero liability for payment defaults or performance disputes.

5.3 Standardized Data:

To eliminate any bias arising from direct Vendor-Auditor payment, the Auditor's evaluation is tightly bound to a standardized electronic Auditor Form on the platform. The form requires raw, unmanipulated inputs: high-resolution lightbox flower photography, digital microscope images verifying trichome head integrity (assessing specific intact percentages), and official laboratory COA documents. The Auditor has no authority to assign or influence the final Quality Score.

5.4 Algorithmic Decoupling:

The raw data inputs uploaded by the Auditor are processed independently by GoldenCalyx's proprietary algorithm, which automatically calculates the final Quality Score (0-100) based on weighted parameters. This decoupling ensures full objectivity and protects platform credibility.

6. PROHIBITED CONDUCT AND NON-CIRCUMVENTION

Users shall not bypass, avoid, or circumvent the Platform to transact on batches or establish commercial relationships with partners first introduced through the Platform without paying the applicable Data Access Fee. This obligation remains in effect for one (1) year following each introduction event. Any user found in violation of non-circumvention terms shall be subject to immediate platform suspension, account termination, and liability for all avoided fees and consequential damages.

7. DISCLAIMERS AND LIMITATION OF LIABILITY

THE PLATFORM AND ALL QUALITY RATINGS ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS WITHOUT WARRANTIES OF ANY KIND. GOLDENCALYX EXPLICITLY DISCLAIMS ANY REPRESENTATIONS REGARDING THE LEGALITY, ENFORCEABILITY, OR QUALITY OF THE PHYSICAL PRODUCT, CUSTOMS CLEARANCE, OR PAYMENT DEFAULTS. IN NO EVENT SHALL GOLDENCALYX'S AGGREGATE LIABILITY EXCEED THE TOTAL FEES PAID BY THE USER TO GOLDENCALYX IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM.

8. GOVERNING LAW AND INTERNATIONAL ARBITRATION

By operating completely outside the jurisdiction of the United States of America, the Parties agree that these Terms and any disputes arising hereunder shall be governed by, and construed in accordance with, the federal laws of Canada and the provincial laws of Ontario, without regard to conflict of laws principles. The United Nations Convention on Contracts for the International Sale of Goods is explicitly excluded.

Any dispute, controversy, or claim arising out of or relating to this agreement, including its formation, validity, enforceability, or breach, shall be referred to and finally resolved by binding arbitration in Toronto, Ontario, Canada, under the Simplified Arbitration Rules of the ADR Institute of Canada (ADRIC). The language of the arbitration shall be English. The decision of the arbitrator shall be final, binding, and enforceable in any court of competent jurisdiction globally.

SIGNATURES AND EXECUTION VIA ELECTRONIC CONSENT

BY CREATING AN ACCOUNT, CHECKING THE "I ACCEPT" OR "I AGREE" BOX, OR CLICKING THE "SUBMIT," "REGISTER," OR "ACCEPT" BUTTONS ASSOCIATED WITH THESE TERMS, THE USER (REPRESENTING A LICENSED COMMERCIAL BUYER, VENDOR, OR AUDITOR, OR A PROSPECTIVE BUYER, VENDOR, OR AUDITOR SEEKING ACCESS TO THE PLATFORM) EXPLICITLY COVENANTS AND AGREES TO BE BOUND BY THIS AGREEMENT, THE TERMS OF SERVICE, AND THE GOLDENCALYX PRIVACY POLICY, WHICH IS FULLY INCORPORATED HEREIN BY REFERENCE.

THE INDIVIDUAL PERFORMING THIS ELECTRONIC ACTION EXPRESSLY REPRESENTS, WARRANTS, AND COVENANTS THAT:

Corporate and Licensing Authority:

They possess the proper corporate power, licensing authority, and legal capacity to execute this Agreement and, where they act on behalf of a registered business entity, corporation, or licensed cannabis facility, to contractually bind that entity. A User acting in an individual professional capacity executes this Agreement in their own name.

Statutory Consent to Electronic Contracting:

They explicitly consent to enter into contracts and execute legal agreements electronically pursuant to the Electronic Commerce Act, 2000, S.O. 2000, c. 17 (Ontario) and the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (Canada).

Legal Equivalence of Click-Wrap Actions:

They acknowledge and agree that checking the "I Accept" box and/or clicking the acceptance button constitutes their digital signature, which holds the identical legal weight, validity, and enforceability of a physical, handwritten signature on a paper contract under all applicable domestic and international laws.

Admissibility of Platform Transaction Logs:

They agree that GoldenCalyx's secure platform transaction logs — which permanently record the system IP address, specific browser metadata, the version of each document displayed, and the precise timestamp of the electronic acceptance action, together with the user's account ID and verified corporate email address where the acceptance is made by, or subsequently linked to, a registered account — shall constitute the definitive, uncontestable, and legally admissible record of execution.

GoldenCalyx ("we," "our," or "us") operates a global medical cannabis B2B intelligence platform facilitating blind introductions, compliance verification, and analytics. We are committed to maintaining the highest standards of data protection. This Privacy Policy outlines how we collect, use, store, transfer, and process personal and commercial data when you access our website www.goldencalyx.com and its integrated services (the "Platform").

1. INFORMATION WE COLLECT AND DUAL CATEGORIZATION

To provide compliance verification and analytical matching, we collect data across two distinct legal categories:

1.1 Personal Data (Personally Identifiable Information - PII)

Personal Data refers to any information relating to an identified or identifiable natural person. We collect:

Contact Details:

Names, business email addresses, personal telephone numbers, and professional roles.

Identity Verification:

Government-issued identification or signatures of corporate officers.

Account Credentials:

Login details, IP addresses, session logs, and access security monitoring data.

Pre-Registration Acceptance Records:

Where you accept these documents before creating an account, we record the version of each document displayed, the date and time of acceptance, your IP address, and your browser user-agent string, together with a randomly generated receipt identifier. This record evidences acceptance and is not linked to a named individual unless and until you register an account.

Messages:

The content of messages exchanged between Buyer and Vendor through the platform, and our review decisions on them. Messages between Buyer and Vendor are reviewed by GoldenCalyx before delivery and may be edited to remove identifying details; they are encrypted in transit and at rest, not end-to-end.

1.2 Proprietary Business Data (Non-PII)

Proprietary Business Data refers to commercial, structural, and regulatory information of registered legal entities. This includes:

Licensing Records:

Medical cannabis cultivation, processing, and import/export licenses, and compliance certificates.

Batch Metadata:

Product weights, chemical potencies, total active cannabinoids (TAC), terpene profiles, and lab COAs.

Physical Verification Metrics:

Microscope photos, lightbox imagery, sensory data, and GACP/GMP facility audits.

Coded Transaction Metadata:

Anonymized matching records, platform interest signals, and historical regional price plots.

2. LEGAL BASIS FOR PROCESSING (GDPR ARTICLE 6)

Under the European Union General Data Protection Regulation (GDPR) and similar global laws, we process data based on several legal grounds:

2.1 Contractual Necessity (Article 6(1)(b)):

To perform compliance matching, unmasking, and verification services under your platform agreements.

2.2 Legal Obligation (Article 6(1)(c)):

To verify commercial licensing validity and prevent illegal cannabis diversion.

2.3 Legitimate Interests (Article 6(1)(f)):

To maintain platform security, prevent circumvention of platform terms (including review of Messages before delivery), combat fraudulent activities, and analyze, compile, and monetize aggregated, non-personally identifiable marketplace trends and product Quality Scores.

3. FULL EU-GDPR & CANADIAN PIPEDA COMPLIANCE

GoldenCalyx fully respects and grants statutory privacy rights. If you reside in the European Economic Area (EEA), the United Kingdom, Switzerland, or Canada, you possess the following rights over your Personal Data (PII):

Right of Access:

You may request a copy of your Personal Data held by the platform.

Right to Rectification:

You may request immediate correction of inaccurate or incomplete Personal Data.

Right to Erasure ("Right to be Forgotten"):

You may request deletion of your Personal Data when it is no longer necessary for the purposes collected.

Right to Restriction and Objection:

You may restrict or object to the processing of your Personal Data.

Right to Data Portability:

You may request your Personal Data in a structured, machine-readable format.

To exercise any of these statutory rights, please contact our Privacy Office at office@goldencalyx.com. We shall respond to all verified requests within thirty (30) days.

4. COMMERCIAL DATA RIGHTS AND EXCLUSIONS

The statutory deletion and portability rights detailed in Section 3 apply strictly to Personal Data (PII). They do NOT apply to, and GoldenCalyx explicitly retains all ownership, intellectual property, and monetization rights over, Proprietary Business Data, including:

• Calculated Quality Scores, sensory profiles, and anonymized facility assessments.
• Anonymized, compiled, and aggregated transaction metadata.
• Redacted COAs, raw physical metrics, and product photographs uploaded by Auditors or Vendors.

These records are processed under our legitimate business interests to preserve platform integrity, standard-setting, and marketplace analytics, and are excluded from personal erasure requests.

Records evidencing your acceptance of these documents are retained for the limitation period applicable to the resulting agreement, under our legitimate interest in establishing, exercising and defending legal claims. Such records are not subject to erasure on request, and may be produced against the receipt identifier issued at the time of acceptance.

5. GOVERNING LAW

This Privacy Policy and all data processing disputes hereunder shall be governed by and construed in accordance with the federal laws of Canada and the provincial laws of Ontario. Data transfers across borders shall be executed under standard contractual clauses or equivalent legal mechanisms.

SIGNATURES AND EXECUTION VIA ELECTRONIC CONSENT

BY CREATING AN ACCOUNT, CHECKING THE "I ACCEPT" OR "I AGREE" BOX, OR CLICKING THE "SUBMIT," "REGISTER," OR "ACCEPT" BUTTONS ASSOCIATED WITH THESE TERMS, THE USER (REPRESENTING A LICENSED COMMERCIAL BUYER, VENDOR, OR AUDITOR, OR A PROSPECTIVE BUYER, VENDOR, OR AUDITOR SEEKING ACCESS TO THE PLATFORM) EXPLICITLY COVENANTS AND AGREES TO BE BOUND BY THIS AGREEMENT, THE TERMS OF SERVICE, AND THE GOLDENCALYX PRIVACY POLICY, WHICH IS FULLY INCORPORATED HEREIN BY REFERENCE.

THE INDIVIDUAL PERFORMING THIS ELECTRONIC ACTION EXPRESSLY REPRESENTS, WARRANTS, AND COVENANTS THAT:

Corporate and Licensing Authority:

They possess the proper corporate power, licensing authority, and legal capacity to execute this Agreement and, where they act on behalf of a registered business entity, corporation, or licensed cannabis facility, to contractually bind that entity. A User acting in an individual professional capacity executes this Agreement in their own name.

Statutory Consent to Electronic Contracting:

They explicitly consent to enter into contracts and execute legal agreements electronically pursuant to the Electronic Commerce Act, 2000, S.O. 2000, c. 17 (Ontario) and the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (Canada).

Legal Equivalence of Click-Wrap Actions:

They acknowledge and agree that checking the "I Accept" box and/or clicking the acceptance button constitutes their digital signature, which holds the identical legal weight, validity, and enforceability of a physical, handwritten signature on a paper contract under all applicable domestic and international laws.

Admissibility of Platform Transaction Logs:

They agree that GoldenCalyx's secure platform transaction logs — which permanently record the system IP address, specific browser metadata, the version of each document displayed, and the precise timestamp of the electronic acceptance action, together with the user's account ID and verified corporate email address where the acceptance is made by, or subsequently linked to, a registered account — shall constitute the definitive, uncontestable, and legally admissible record of execution.