Privacy Notice

1.1 Alexandria operates in the national security and defense technology sector. We apply heightened care to data handling in recognition of the sensitive nature of our clients’ activities and the regulatory environment in which we operate.

1.2 Identity and contact details:
Alexandria Holdings LLC is the data controller responsible for personal data processed through the Platform. Our registered address is 411 Brazos Street, Suite 209, Austin, TX 78701. Questions about this Privacy Notice may be directed to privacy@alexandria.com.

2.1 Data you provide directly:
When you access the Platform, register for an account, submit an inquiry, or engage with our Services, we may collect:

• (a) identity data, including your full name, job title, and employer organization;
• (b) contact data, including your email address, telephone number, and mailing address;
• (c) professional and credentials data, including security clearance status (at your election), regulatory compliance certifications, government contracting experience, and organizational affiliations;
• (d) account credentials, including usernames and passwords; and
• (e) communications data, including the content of messages, inquiries, and any other information you submit through the Platform’s contact or inquiry forms.

2.2 Data we collect automatically:
When you visit the Platform, we automatically collect:

• (a) technical data, including your IP address, browser type and version, operating system, device identifiers, and referring URL;
• (b) usage data, including pages visited, time spent on pages, links clicked, and session duration; and
• (c) cookie and tracking data as described in clause 8.

2.3 Data we receive from third parties:
We may receive personal data about you from:

• (a) professional references or partner organizations who refer you to Alexandria;
• (b) publicly available databases, including U.S. government contractor registrations and denied-parties screening databases; and
• (c) analytics and technology service providers.

2.4 Special categories of data:
We do not intentionally collect special-category personal data (such as health data, biometric data, or racial or ethnic origin) through the Platform. You must not submit such data unless expressly authorized in writing by Alexandria.

3.1 Legal bases and purposes:
We process personal data only where we have a lawful basis to do so. The table below sets out our primary processing purposes and the legal bases we rely on:

3.2 Legitimate interests:
Where we rely on legitimate interests as a lawful basis, we have assessed that our interests are not overridden by your rights and interests, taking into account the context in which you engage with us as a business professional in the defense technology sector.

3.3 Consent:
Where we rely on your consent, you have the right to withdraw it at any time by contacting us at privacy@alexandria.com. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

3.4 No automated decision-making:
Except for automated sanctions and denied-parties screening, which may result in denial of access where a potential match is identified and which is subject to human review before any final adverse determination, we do not subject you to decisions based solely on automated processing (including profiling) that produce legal or similarly significant effects.

4.1 Alexandria is required to screen users of the Platform against applicable U.S. government denied-parties, restricted-entity, and sanctions lists (including lists administered by the U.S. Department of the Treasury’s Office of Foreign Assets Control ("OFAC"), the U.S. Department of Commerce Bureau of Industry and Security, and the U.S. Department of State) before providing access to certain content or Services. This screening constitutes a legal obligation and cannot be waived.

4.2 Screening involves processing your name, employer, nationality, and country of residence, and, where applicable, government-issued identifiers, against those lists. Results of screening may be retained for a minimum of five (5) years as required by applicable recordkeeping requirements, or such longer period as required by law. For individuals located in the EEA or the United Kingdom, we rely on our legitimate interest in complying with applicable sanctions and export-control laws as the lawful basis for this screening, because the underlying obligation arises under U.S. law.

5.1 We do not sell your personal data. We may share your personal data with the following categories of recipients:

• (a) service providers and subprocessors who process data on our behalf to support Platform operations, including cloud infrastructure providers, email delivery providers, analytics providers, and cybersecurity vendors, each under data processing agreements that impose obligations no less protective than those in this Privacy Notice;
• (b) professional advisors, including attorneys, accountants, and insurers, to the extent necessary for the provision of their services;
• (c) capital partners, compliance advisors, and other third-party service providers whom you request Alexandria to introduce to you in connection with the Services, where you have been informed of such sharing in advance;
• (d) U.S. government agencies and law enforcement authorities where required by law, court order, or government authority, or where disclosure is necessary to protect national security or prevent unlawful activity; and
• (e) a successor entity in the event of a merger, acquisition, reorganization, or sale of all or substantially all of Alexandria’s assets, provided that the successor entity is bound by obligations materially consistent with this Privacy Notice.

5.2 International transfers:
Personal data may be transferred to and processed in the United States and other countries. Where we transfer personal data originating in the European Economic Area ("EEA") or the United Kingdom ("UK") to countries that have not been determined to provide an adequate level of data protection, we implement appropriate safeguards, including the use of Standard Contractual Clauses approved by the European Commission or the UK Information Commissioner’s Office, as applicable. You may request a copy of the applicable safeguards by contacting privacy@alexandria.com.

6.1 We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with legal and regulatory obligations, and to defend legal claims. Our primary retention periods are:

• (a) account and engagement data: for the duration of the engagement relationship and for five (5) years thereafter;
• (b) sanctions screening records: for a minimum of five (5) years as required by applicable recordkeeping requirements, or such longer period as required by applicable law;
• (c) communications data: for three (3) years from the date of last communication; and
• (d) website usage and technical data: for up to twenty-four (24) months.

6.2 We may retain personal data for longer periods where required by law, regulatory order, or to resolve a dispute or enforce an agreement.

7.1 Rights under applicable law:
Depending on your location and the applicable law, you may have the following rights regarding your personal data:

• (a) the right to access a copy of the personal data we hold about you;
• (b) the right to rectification of inaccurate or incomplete personal data;
• (c) the right to erasure of your personal data in certain circumstances;
• (d) the right to restrict processing of your personal data in certain circumstances;
• (e) the right to data portability (where technically feasible) in respect of personal data you have provided to us;
• (f) the right to object to processing based on legitimate interests or for direct marketing; and
• (g) the right to lodge a complaint with a supervisory authority.

7.2 Delaware residents:
If you are a Delaware resident, you may have additional rights under the Delaware Personal Data Privacy Act ("DPDPA"), effective January 1, 2025, including the right to confirm whether we process your personal data, to obtain a copy of your personal data, to correct inaccuracies, to delete your personal data, to opt out of any sale of personal data or use for targeted advertising, and to appeal a refusal of your request. To exercise these rights, please contact privacy@alexandria.com.

7.3 California residents:
If you are a California resident, you may have additional rights under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA/CPRA"), including the right to know what personal information is collected, used, disclosed, or sold; the right to delete personal information; the right to correct inaccurate personal information; the right to opt out of the sale or sharing of personal information; the right to limit the use and disclosure of sensitive personal information; and the right to non-discrimination for exercising your rights. To exercise these rights, please contact privacy@alexandria.com.

7.4 Texas residents:
If you are a Texas resident, you may have additional rights under the Texas Data Privacy and Security Act ("TDPSA"), effective July 1, 2024, including the right to access, correct, delete, and obtain a copy of your personal data, to opt out of the processing of personal data for targeted advertising or the sale of personal data, and to appeal a refusal of your request. To exercise these rights, please contact privacy@alexandria.com.

7.5 Colorado residents:
If you are a Colorado resident, you may have additional rights under the Colorado Privacy Act ("CPA"), effective July 1, 2023, including the right to access, correct, delete, and obtain a copy of your personal data, to opt out of the processing of personal data for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects, and to appeal a refusal of your request. To exercise these rights, please contact privacy@alexandria.com.

7.6 Virginia residents:
If you are a Virginia resident, you may have additional rights under the Virginia Consumer Data Protection Act ("VCDPA"), effective January 1, 2023, including the right to confirm whether we process your personal data, to access a copy of your personal data, to correct inaccuracies, to delete your personal data, to obtain a portable copy of your personal data, to opt out of the processing of your personal data for targeted advertising or the sale of personal data, and to appeal a refusal of your request. To exercise these rights, please contact privacy@alexandria.com.

7.7 Maryland residents:
If you are a Maryland resident, you may have additional rights under the Maryland Online Data Privacy Act ("MODPA"), effective October 1, 2025, including the right to confirm whether we process your personal data, to access a copy of your personal data, to correct inaccuracies, to delete your personal data, to obtain a portable copy of your personal data, to opt out of the processing of your personal data for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects, and to appeal a refusal of your request. To exercise these rights, please contact privacy@alexandria.com.

7.8 Connecticut residents:
If you are a Connecticut resident, you may have additional rights under the Connecticut Data Privacy Act ("CTDPA"), effective July 1, 2023, including the right to confirm whether we process your personal data, to access a copy of your personal data, to correct inaccuracies, to delete your personal data, to obtain a portable copy of your personal data, to opt out of the processing of your personal data for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects, and to appeal a refusal of your request. To exercise these rights, please contact privacy@alexandria.com.

7.9 Oregon residents:
If you are an Oregon resident, you may have additional rights under the Oregon Consumer Privacy Act ("OCPA"), effective July 1, 2024, including the right to confirm whether we process your personal data, to access a copy of your personal data, to correct inaccuracies, to delete your personal data, to obtain a portable copy of your personal data, to opt out of the processing of your personal data for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects, and to appeal a refusal of your request. To exercise these rights, please contact privacy@alexandria.com.

7.10 EEA residents:
If you are located in the European Economic Area ("EEA"), you have rights under the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), including: the right to access a copy of your personal data; the right to rectification of inaccurate or incomplete personal data; the right to erasure of your personal data in certain circumstances; the right to restriction of processing in certain circumstances; the right to data portability in respect of personal data you have provided to us where processing is based on consent or contract and carried out by automated means; the right to object to processing based on legitimate interests or for direct marketing purposes; and the right to withdraw consent at any time where we rely on consent as a legal basis. You also have the right to lodge a complaint with your national data protection supervisory authority. To exercise any of these rights, please contact privacy@alexandria.com.

7.11 United Kingdom residents:
If you are located in the United Kingdom, you have equivalent rights under the UK General Data Protection Regulation and the Data Protection Act 2018 (together, “UK GDPR”), including the right to access a copy of your personal data, to rectification of inaccurate or incomplete personal data, to erasure of your personal data in certain circumstances, to restriction of processing in certain circumstances, to data portability where processing is based on consent or contract and carried out by automated means, and to object to processing based on legitimate interests or for direct marketing purposes. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (“ICO”) at ico.org.uk. To exercise any of these rights, please contact privacy@alexandria.com.

7.12 Other jurisdictions:
If you are located in a jurisdiction not otherwise addressed in this Section 7 and applicable law grants you rights in respect of personal data we hold about you, you may submit a request to privacy@alexandria.com and we will respond in accordance with applicable law.

7.13 How to exercise your rights:
Requests to exercise your rights should be submitted to privacy@alexandria.com. We will respond within the timeframe required by applicable law. We may need to verify your identity before processing your request; verification may involve confirming information already associated with your account or requesting additional identifying information. We will maintain a record of rights requests and our responses for a minimum of twenty-four (24) months. We will not discriminate against you for exercising any rights under applicable law.

7.14 Limitations:
Your rights may be limited where processing is necessary to comply with a legal obligation, to protect national security, or to establish, exercise, or defend legal claims.

8.1 We use cookies and similar tracking technologies on the Platform to support Platform operation, analyze usage, and, where you have consented, serve relevant content.

8.2 The types of cookies we use include:

• (a) strictly necessary cookies, which are essential to the functioning of the Platform and cannot be disabled;
• (b) analytics cookies, which help us understand how visitors interact with the Platform using third-party analytics providers; and
• (c) preference cookies, which remember your settings and choices.

8.3 You can manage or disable non-essential cookies through your browser settings. Please note that disabling certain cookies may affect Platform functionality.

8.4 We do not use cookies or tracking technologies for cross-context behavioral advertising without your prior consent.

8.5 Note for EU/UK users:
Users located in the European Economic Area or the United Kingdom may be subject to additional consent requirements under the EU ePrivacy Directive and applicable national implementing legislation (including the UK Privacy and Electronic Communications Regulations).

9.1 We implement and maintain technical and organizational security measures designed to protect your personal data against unauthorized access, disclosure, alteration, loss, or destruction. These measures include encryption in transit and at rest, access controls, regular security assessments, and vendor due diligence for our cloud infrastructure providers.

9.2 In the event of a personal data breach affecting Delaware residents, we will comply with our notification obligations under Delaware and any other applicable law. We will notify you where required by law.

9.3 No security measures are completely infallible. You are responsible for maintaining the confidentiality of your account credentials.

10.1 The Platform is a business-to-business resource intended for professionals and is not directed to children. We do not knowingly collect personal data from any individual under 18 years of age. If we learn that we have collected personal data from a child, we will delete it. If you believe a child has provided us with personal data, please contact privacy@alexandria.com.

11.1 We may update this Privacy Notice from time to time. Material changes will be communicated by posting a revised notice on the Platform with an updated "Last Updated" date. We will use reasonable efforts to notify registered users of material changes by email. Continued use of the Platform after the effective date of any revision constitutes acceptance of the revised Privacy Notice.

12.1 For questions, concerns, or requests regarding this Privacy Notice, please contact:

Alexandria Holdings LLC
Attn: Privacy

411 Brazos Street, Suite 209
Austin, TX 78701

Email: privacy@alexandria.com
Website: alexandria.com/demo

12.2 If you are located in the EEA or UK and are not satisfied with our response, you have the right to lodge a complaint with the data protection supervisory authority in your country of residence.