At true. SA (“true.”, “we”, “us”), we are committed to protecting your privacy and handling your personal data with integrity and transparency. This Privacy Policy explains how we collect and use personal data when you visit our website trueindustries.lu (the “Website”), when you contact us, and when we work with you or with the organisation you represent as a client, prospective client, business partner, counterparty or service provider. It is issued in accordance with Regulation (EU) 2016/679 (the “GDPR”) and the Luxembourg Law of 1 August 2018 on the organisation of the National Data Protection Commission and the general data protection framework.

1. Who we are

true. SA is a société anonyme incorporated under Luxembourg law, registered with the Luxembourg Trade and Companies Register (RCS Luxembourg) under number B298215, with its registered office at 2, rue de Rolling, L-5421 Erpeldange (Bous), Luxembourg. true. carries on commercial activities and services under its business permit, consisting of strategic advisory and coordination services, including advising athletes and coordinating services on their behalf, and corporate finance advisory to companies. Regulated services are provided exclusively by authorised third-party partners (see section 4 of our Legal Notice). true. is the controller of the personal data processed through the Website and in the course of its advisory mandates.

true. is not required to appoint a data protection officer under Article 37 GDPR and has not done so. Data protection matters are coordinated by our data protection contact, Matej Kraus, who can be reached at info@trueindustries.lu (subject line “Data protection”) or by post at our registered office, marked “Data protection”.

2. What personal data we collect

Depending on our relationship with you, we may collect the following categories of personal data:

(a) identification and contact details, such as your name, title, employer, postal address, email address and telephone number;

(b) professional information, such as your position, professional background and business relationships, and information on the transactions or projects in which you are involved;

(c) financial information relevant to an advisory mandate, such as information on assets, income, contracts and remuneration, investment objectives or transaction terms;

(d) know-your-customer (KYC) and anti-money-laundering (AML) information, such as identity documents, date and place of birth, nationality, beneficial ownership, source of funds and wealth, politically exposed person status, and the results of sanctions and adverse media checks carried out from public sources;

(e) for athletes we advise or for whom we coordinate services, information on their sporting career and contracts and, only where strictly necessary and lawful, health or fitness information (for example medical examinations in the context of a transfer);

(f) the content of our correspondence and meeting notes; and

(g) technical data from your use of the Website, such as your IP address, browser type, device information, pages visited and the date and time of your visit, including data collected through cookies (see section 7).

We collect this data directly from you or, where applicable, from the organisation you represent, from your advisers, from third parties involved in a mandate (such as clubs, federations, counterparties, co-advisers or introducers), from public sources (such as company and beneficial ownership registers, the press and professional networks). We do not use screening database providers: sanctions, politically exposed person and adverse media checks are carried out manually from public sources.

Where we advise athletes under the age of 18 or coordinate services for them, we process their personal data with the involvement and, where required, the consent of the holders of parental responsibility.

3. Why we process your data and on what legal basis

We process personal data for the following purposes:

(a) to perform an advisory mandate or other contract with you, or to take steps at your request before entering into one (Article 6(1)(b) GDPR). Where you are not yourself our client (for example, if you are an employee or representative of a client or a counterparty), we process your data on the basis of our legitimate interest in performing our mandates (Article 6(1)(f) GDPR);

(b) to comply with our legal obligations, including (i) customer due diligence and the related record-keeping obligations under the amended Luxembourg Law of 12 November 2004 on the fight against money laundering and terrorist financing, insofar as our activities fall within its scope, (ii) compliance with the restrictive measures (sanctions) applicable in Luxembourg under EU regulations and the Law of 19 December 2020 on the implementation of restrictive measures in financial matters, (iii) accounting and tax record-keeping obligations, and (iv) requests from competent authorities (Article 6(1)(c) GDPR). Where anti-money-laundering legislation does not apply to a given relationship, we carry out proportionate know-your-customer, politically exposed person and adverse media checks from public sources on the basis of our legitimate interest in knowing our clients and counterparties and in protecting true. against legal and reputational risks (Article 6(1)(f) GDPR);

(c) to manage our relationships with prospective clients, partners and business contacts and to inform them about our services, on the basis of our legitimate interest in developing our business (Article 6(1)(f) GDPR). We send electronic marketing communications to individuals only with their prior consent where the amended Law of 30 May 2005 on privacy in electronic communications requires it;

(d) to send you our newsletter, on the basis of your consent (Article 6(1)(a) GDPR), which you may withdraw at any time using the unsubscribe link in each newsletter;

(e) to operate and secure the Website and prevent misuse, and to establish, exercise or defend legal claims, on the basis of our legitimate interests in doing so (Article 6(1)(f) GDPR).

Where we process health data, we do so only with your explicit consent (Article 9(2)(a) GDPR) or where necessary for the establishment, exercise or defence of legal claims (Article 9(2)(f) GDPR). Personal data relating to criminal convictions and offences that may appear in the results of these checks is processed only where authorised by EU or Luxembourg law, in particular anti-money-laundering and restrictive measures legislation, and is limited to what is strictly necessary (Article 10 GDPR).

Providing KYC information is a legal requirement where anti-money-laundering or sanctions legislation applies, and in all cases a condition of our business relationship: if it is not provided, we cannot enter into or continue a business relationship. Other information is necessary for the performance of our mandates. Providing personal data through the Website is voluntary.

We do not make decisions producing legal or similarly significant effects for you based solely on automated processing, including profiling, within the meaning of Article 22 GDPR. We do not use Website visitor data for advertising profiling.

4. Who we share it with

We share personal data only where necessary, with:

(a) authorised third-party partners who provide regulated services that true. does not itself provide, with your agreement or where necessary for the mandate. These partners act as independent controllers and their own privacy notices apply;

(b) professional advisers (such as lawyers, auditors, notaries and tax advisers), banks, and counterparties to a transaction and their advisers, to the extent necessary for a specific mandate and subject to confidentiality obligations;

(c) service providers acting as processors on our behalf and under our instructions, bound by a contract complying with Article 28 GDPR, including our Website host (moskito s.a., Luxembourg), our email and cloud office provider (Google Workspace), our customer relationship management provider (HubSpot) and the AI tool providers referred to in section 11 (Anthropic, OpenAI and Fathom); and

(d) public authorities, courts and supervisory authorities, where required by law.

Information relating to one client or mandate is not shared with another client, except with the consent of the person concerned or where required by law. We do not sell or rent personal data to third parties.

5. International transfers

Given the international nature of our clients and partners, some recipients of personal data may be located outside the European Economic Area (EEA). We transfer personal data outside the EEA only where (i) the European Commission has recognised that the country, territory or sector concerned ensures an adequate level of protection (including, for the United States, organisations certified under the EU-U.S. Data Privacy Framework); (ii) appropriate safeguards under Article 46 GDPR are in place, in particular the European Commission’s Standard Contractual Clauses, together with supplementary measures where required; or (iii) a derogation under Article 49 GDPR applies, for example where the transfer is necessary for the performance of a contract concluded at your request or for the establishment, exercise or defence of legal claims. You may obtain a copy of the relevant safeguards by contacting us at info@trueindustries.lu.

6. How long we keep it

We retain personal data only as long as necessary for the purposes for which it was collected, in particular:

(a) KYC and AML records and transaction documents: five years after the end of the business relationship or the date of the occasional transaction, or longer where required by law;

(b) accounting records and supporting documents: ten years from the end of the financial year to which they relate;

(c) mandate files and correspondence: for the duration of the relationship and, thereafter, for the applicable limitation periods (generally ten years);

(d) data on prospective clients and business contacts: three years from our last contact;

(e) newsletter data: until you unsubscribe; and

(f) Website technical logs: no longer than [● 12 – to be confirmed by moskito s.a.] months; cookies: as set out in our Cookie Policy.

At the end of these periods, personal data is deleted or anonymised, unless it must be kept longer in connection with pending litigation or an investigation by a competent authority.

7. Cookies

The Website uses cookies and similar technologies as described in our Cookie Policy, available at trueindustries.lu/cookies [● to be confirmed by moskito s.a.: cookie page and consent banner in place]. Cookies that are not strictly necessary for the operation of the Website are placed only with your prior consent, which you may withdraw at any time through the cookie settings.

8. Your rights

Subject to the conditions and exceptions provided by law, you have the right to access your personal data, to have it rectified or erased, to restrict its processing and to receive it in a portable format. You also have the right to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests, and to object at any time, without having to give reasons, to the processing of your data for direct marketing purposes. Where processing is based on your consent, you may withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise these rights, contact us at info@trueindustries.lu. We may ask you to verify your identity. We will respond within one month of receiving your request; this period may be extended by two further months where necessary, in which case we will inform you. Certain rights may be limited where we are bound by legal obligations, in particular under anti-money-laundering legislation.

You also have the right to lodge a complaint with the Luxembourg National Data Protection Commission (Commission nationale pour la protection des données – CNPD), 15, boulevard du Jazz, L-4370 Belvaux (cnpd.lu), or with the supervisory authority of the EU Member State where you live or work.

9. Security measures

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or disclosure, including access restricted on a need-to-know basis, multi-factor authentication, encryption of data in transit, the use of business-grade tools subject to contractual data protection commitments, confidentiality obligations for our team, and the secure handling of mandate documentation. We have procedures to deal with any personal data breach, including notification to the CNPD and to the persons concerned where required by law.

10. Confidentiality between mandates

Discretion is core to how we work. Each advisory mandate is treated as confidential and supported, where appropriate, by non-disclosure agreements. Access to sensitive client or transaction information is limited to the team members directly involved, and information received in the course of one mandate is not used for another mandate without authorisation, subject to our legal obligations.

11. Responsible use of artificial intelligence

true. uses artificial intelligence (AI) tools, including general-purpose AI assistants, to support internal tasks such as research, summarising, translation, analysis and drafting. We use these tools in accordance with Regulation (EU) 2024/1689 on artificial intelligence (the “AI Act”), as amended, and with the GDPR, on the following principles:

Human oversight. AI outputs are always reviewed by a member of our team before they inform any advice, document or decision. We do not take decisions about individuals, such as accepting a client or assessing a person’s financial situation, based solely on AI outputs.

No high-risk uses. We do not use AI systems for purposes classified as high-risk under the AI Act, such as evaluating the creditworthiness of natural persons or recruiting and evaluating staff. We review our uses of AI regularly against the requirements of the AI Act.

Confidentiality and data protection. We use AI tools only under professional subscriptions and data processing agreements under which the provider acts as our processor and undertakes not to use our data to train its models. Confidential client or transaction information is not entered into consumer AI services, and we limit the personal data used with AI tools to what is necessary. Our current AI tool providers are Anthropic (Claude), OpenAI (ChatGPT) and Fathom (AI meeting notes); where they process data outside the EEA, section 5 applies. Where we use an AI note-taking tool during a meeting, we inform the participants beforehand and do not use it if a participant objects.

Transparency. If we make available an AI system that interacts directly with you, such as a chatbot, or publish content subject to AI disclosure obligations, we will inform you clearly, in accordance with Article 50 of the AI Act.

AI literacy. We take measures to support a sufficient level of AI literacy among the members of our team who use AI tools, in accordance with Article 4 of the AI Act.

12. Updates to this policy

We may update this Privacy Policy from time to time to reflect changes in our activities or in the law. The date of the last update is shown above. Where changes are significant, we will bring them to your attention by appropriate means.

This Legal Notice sets out the legal information relating to the Website and its publisher, in accordance with the amended Luxembourg Law of 14 August 2000 on electronic commerce.

1. Website publisher

This Website is published by:

• true. SA
• Legal form: société anonyme (S.A.)
• Registered office: 2, rue de Rolling, L-5421 Erpeldange (Bous), Luxembourg
• Trade and Companies Register (RCS Luxembourg): B298215
• VAT number: LU36786932
• Business permit (autorisation d’établissement) number: 10182812/0 (commercial activities and services), issued on 8 August 2025
• Email: info@trueindustries.lu
• Phone: +352 691 337 231

2. Person responsible for content

The person responsible for the content of the Website is Tom Rasqué, Managing Director, true. SA, info@trueindustries.lu.

3. Hosting

This Website is hosted by:

• moskito s.a.
• 20, rue des Sangliers, L-7344 Steinsel, Luxembourg
• moskito.lu

4. Regulatory information

true. SA carries on commercial activities and services under business permit No. 10182812/0, issued on 8 August 2025 by the Luxembourg Minister for the Economy under the amended Law of 2 September 2011 regulating access to the professions of craftsman, trader, industrialist and certain liberal professions.

true. SA is not a regulated financial entity. It is not authorised or supervised by the Commission de Surveillance du Secteur Financier (CSSF) as a credit institution, investment firm or other professional of the financial sector, nor by the Commissariat aux Assurances (CAA) as an insurance intermediary. It does not provide investment services within the meaning of the amended Law of 5 April 1993 on the financial sector, including investment advice, portfolio management, the reception, transmission or execution of orders and the placing of financial instruments, nor insurance distribution or legal advice reserved to members of the Bar. It does not hold or handle client funds or financial instruments.

Where a client requires any such service, true. SA refers the client to duly authorised providers, which provide those services under their own authorisation and responsibility, under a separate agreement concluded directly with the client.

Nothing on this Website constitutes an offer to the public, a solicitation or a recommendation to buy or sell any financial instrument, or investment, legal or tax advice.

5. Intellectual property

All content on this Website, including text, graphics, logos, the “true.” name and marks, images and layout, is the property of true. SA or its licensors and is protected by applicable intellectual property laws. Except for viewing and printing for personal, non-commercial use, any reproduction, representation, modification or distribution, in whole or in part, without the prior written authorisation of true. SA is prohibited.

6. Liability

The information on this Website is provided for general information purposes only and does not constitute investment, legal, tax or financial advice. Consulting the Website does not create an advisory relationship with true. SA. While we take care to keep the information accurate and up to date, we make no warranty as to its completeness or accuracy and, to the extent permitted by applicable law, we accept no liability for any direct or indirect damage arising from the use of the Website, from its unavailability or from the use of information published on it.

7. External links

This Website may contain links to third-party websites. true. SA has no control over these websites and accepts no responsibility for their content or their privacy practices.

8. Personal data

The processing of personal data through this Website is described in our Privacy Policy.

9. Applicable law and jurisdiction

This Legal Notice is governed by Luxembourg law. Any dispute relating to the use of this Website shall be subject to the exclusive jurisdiction of the competent courts of Luxembourg, without prejudice to mandatory rules protecting consumers in their country of residence.

10. Contact

For any question regarding this Legal Notice, please contact us at info@trueindustries.lu.