PROCUREMENT & CO. PRIVACY POLICY // CONFIDENTIAL // ILLINOIS COMPLIANT // EFFECTIVE DATE: 2026 //

This Privacy Policy explains how Procurement & Co. ("Firm," "we," "us," or "our") collects, uses, stores, protects, and discloses information when you visit our website (procure-ment.com), purchase our services, or engage with our client portal. Please read this policy carefully before providing any personal or business information.

By using our website or purchasing any service, you consent to the data practices described in this Privacy Policy.

SECTION 1 — WHO WE ARE

Procurement & Co. is a professional advisory firm registered and operating under the laws of the State of Illinois. We provide federal procurement strategy, compliance architecture, entity formation, capability positioning, and subscription-based intelligence services exclusively to business entities. We are not affiliated with, endorsed by, or acting as an agent of any government agency.

Primary Contact for Privacy Inquiries: Procurement & Co. info@procure-ment.com procure-ment.com

SECTION 2 — INFORMATION WE COLLECT

We collect information in three ways: directly from you, automatically through your use of our website, and from third-party payment processors.

2.1 Information You Provide Directly

When you purchase a service, complete an intake form, or access our client portal, we may collect:

• Business Identity Information — full registered legal entity name, state of formation, entity structure classification, Federal Employer Identification Number (EIN), Unique Entity Identifier (UEI), and CAGE Code

• Contact Information — authorized signatory full name, corporate title, primary email address, and direct phone number

• Financial Information — profit and loss statements, balance sheets, commercial debt logs, target funding thresholds, and business credit profile summaries (collected only for Capital Acceleration Matrix engagements)

• Government Registry Information — SAM.gov vendor profile URLs, NAICS codes, PSC codes, socio-economic designations, and historical past performance records

• Formation Documents — corporate bylaws, articles of formation or incorporation, operating agreements, and certification portfolio documents

• Authorization Consents — written authorizations for banking relationship verification, IRS tax history pulls (Form 4506-C), personal credit pulls, and Social Security Number release for EIN extraction purposes

• Brand & Identity Assets — company logos, brand color codes, font preferences, executive headshot photography, and biography documents (collected only for applicable services)

• Procurement Intelligence Preferences — NAICS targeting parameters, geographic operating zones, contract value thresholds, and set-aside vehicle preferences (collected only for pipeline and subscription services)

• Agreement Execution Data — electronic signature (full legal name), date of execution, and agreement affirmation confirmation

⚠️ IMPORTANT: Sensitive Data Notice Certain services require authorization for the collection of sensitive personal and business information, including Social Security Numbers (for EIN extraction), banking relationship documentation, and IRS tax records. This information is collected exclusively through our encrypted post-purchase client portal and is NEVER transmitted through public-facing web forms, email, or unencrypted channels. We do not store Social Security Numbers, banking account numbers, or raw tax records in plain text at any time.

2.2 Information Collected Automatically

When you visit procure-ment.com, we and our service providers may automatically collect:

• Device & Browser Information — browser type, operating system, device type, and screen resolution

• Usage Data — pages visited, time spent on each page, links clicked, and referral source

• IP Address — used for geographic analytics and security monitoring only

• Cookies & Similar Technologies — see Section 6 for full cookie disclosure

2.3 Information from Third Parties

• Stripe, Inc. — our payment processor provides us with transaction confirmation, payment reference identifiers, and billing status. We do not receive or store your full credit card number. Stripe's privacy policy governs their data handling: stripe.com/privacy

SECTION 3 — HOW WE USE YOUR INFORMATION

We use the information we collect for the following purposes:

3.1 Service Delivery To fulfill the specific services you purchased, including entity formation filings, federal registry submissions, capability dossier production, proposal writing, pipeline intelligence configuration, and subscription content delivery.

3.2 Client Portal Administration To provision and maintain your dedicated client portal workspace, including access management, milestone tracking, and deliverable vault management.

3.3 Communication To send engagement-related communications including welcome emails, intake instructions, milestone notifications, deliverable alerts, renewal reminder notices, and subscription management updates.

3.4 Billing & Payment To process payments, manage recurring subscription billing, send billing notifications, and address failed payment remediation.

3.5 Legal Compliance To comply with applicable federal and Illinois state law, respond to lawful government requests, and enforce our Master Service Agreement.

3.6 Security & Fraud Prevention To monitor for unauthorized access, detect fraudulent activity, and maintain the security of our systems and client data.

⚠️ IMPORTANT: We do NOT use your personal or business information for: • Sale or rental to third parties • Third-party advertising or marketing targeting • Automated profiling or algorithmic decision-making that produces legal effects • Any purpose beyond those listed above without your explicit written consent

SECTION 4 — HOW WE SHARE YOUR INFORMATION

We do not sell, rent, or trade your personal or business information. We share information only in the following limited circumstances:

4.1 Service Delivery Partners We may share limited information with trusted third-party vendors who assist in delivering our services, including but not limited to document management platforms, secure file storage providers, and scheduling systems. These vendors are contractually prohibited from using your information for any purpose other than providing services to us.

4.2 Payment Processing Payment transaction data is shared with Stripe, Inc. solely for the purpose of processing your payment. Stripe operates under its own privacy policy and PCI DSS compliance framework.

4.3 Government Agencies (on your behalf) For services involving federal or state registrations, certifications, or filings, we transmit your business information to the applicable government agency (e.g., SAM.gov, state registrar offices, SBA) solely for the purpose of completing the engagement you purchased.

4.4 Legal Requirements We may disclose your information if required by law, court order, or valid governmental request, or if we reasonably believe disclosure is necessary to protect our legal rights, prevent fraud, or address security threats.

4.5 Business Transfers In the event of a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred to the acquiring entity, subject to the same privacy protections described in this policy.

SECTION 5 — DATA RETENTION

We retain your information for the following periods:

• Active Engagement Records — retained for the duration of your active engagement plus twenty-four (24) months following the conclusion or cancellation of services

• One-Time Service Portal Archives — your dedicated portal workspace is archived five (5) calendar days following delivery of final deliverables, then retained for twenty-four (24) months before permanent deletion

• Subscription Cancellation Records — upon cancellation, a secure download link is provided for five (5) calendar days, after which portal data is archived and retained for twenty-four (24) months before permanent deletion

• Agreement Execution Records — retained indefinitely as required for legal enforceability of the Master Service Agreement

• Payment Records — retained for seven (7) years in accordance with standard accounting and tax compliance requirements

⚠️ Upon expiration of the applicable retention period, all personal and business data is permanently and irreversibly deleted from our systems.

SECTION 6 — COOKIES & TRACKING TECHNOLOGIES

Our website (procure-ment.com) is built on the Squarespace platform, which uses cookies and similar tracking technologies to operate the site. The following types of cookies may be used:

• Essential Cookies — required for the website to function, including session management and security. These cannot be disabled.

• Analytics Cookies — used to understand how visitors use the site (pages visited, time on site, referral sources). We use this data in aggregate to improve our website. No individual visitor profiles are created or sold.

• Preference Cookies — used to remember your settings and preferences across visits.

You may control cookie preferences through your browser settings. Disabling non-essential cookies will not affect your ability to purchase services or access your client portal.

We do not use third-party advertising cookies or cross-site behavioral tracking cookies.

SECTION 7 — DATA SECURITY

We implement industry-standard technical and organizational measures to protect your information:

• Encrypted Portal — all sensitive client data is collected and stored through our encrypted post-purchase client portal. Sensitive documents are never transmitted via unencrypted email or public web forms.

• Access Controls — client portal access is restricted to the individual client account. Internal team access to client records is limited to personnel with a legitimate need to fulfill the engagement.

• Payment Security — all payment processing is handled by Stripe, Inc., which maintains PCI DSS Level 1 compliance. We do not store payment card data on our systems.

• Secure Transmission — all data transmitted between your browser and our website is encrypted via SSL/TLS.

⚠️ IMPORTANT: While we implement robust security measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your information. In the event of a data breach affecting your personal information, we will notify you in accordance with applicable Illinois law (815 ILCS 530 — Personal Information Protection Act).

SECTION 8 — YOUR RIGHTS UNDER ILLINOIS LAW

As an Illinois resident or a business entity operating in Illinois, you have the following rights regarding your personal information under the Illinois Personal Information Protection Act (PIPA, 815 ILCS 530):

8.1 Right to Know You have the right to request information about the categories of personal data we have collected about you and the purposes for which it is used.

8.2 Right to Access You have the right to request a copy of the personal information we hold about you.

8.3 Right to Correction You have the right to request correction of inaccurate personal information we hold about you.

8.4 Right to Deletion You have the right to request deletion of your personal information, subject to our legal obligations to retain certain records (see Section 5).

8.5 Right to Non-Discrimination We will not discriminate against you for exercising any of your privacy rights.

To exercise any of these rights, submit a written request to: info@procure-ment.com We will respond to verified requests within thirty (30) calendar days.

SECTION 9 — CHILDREN'S PRIVACY

Our services are designed exclusively for business entities and are not directed to individuals under the age of 18.We do not knowingly collect personal information from minors. If we become aware that we have inadvertently collected personal information from a minor, we will take immediate steps to delete it.

SECTION 10 — THIRD-PARTY LINKS

Our website may contain links to third-party websites, including government portals (SAM.gov, SBA.gov), payment processors (Stripe), and scheduling platforms (Acuity Scheduling). We are not responsible for the privacy practices of third-party websites. We encourage you to review the privacy policies of any third-party site you visit through our platform.

SECTION 11 — CHANGES TO THIS PRIVACY POLICY

We reserve the right to update this Privacy Policy at any time. Material changes will be communicated to active clients via email at least fourteen (14) days before taking effect. The updated policy will be posted on this page with a revised effective date. Continued use of our services after the effective date of any update constitutes acceptance of the revised policy.

SECTION 12 — CONTACT US

For privacy inquiries, data access requests, or concerns about how we handle your information, contact us at:

Procurement & Co. info@procure-ment.com procure-ment.com

We are committed to resolving privacy concerns promptly and transparently. All privacy inquiries will receive a response within thirty (30) calendar days.

STATUTORY DISCLOSURE

Procurement & Co. is an independent advisory firm and is not affiliated with, endorsed by, or acting as an agent of any federal, state, or municipal government agency. This Privacy Policy is provided for informational and compliance purposes and does not constitute legal advice. Clients are encouraged to consult a licensed attorney for legal guidance specific to their circumstances. This policy is governed by the laws of the State of Illinois, including the Illinois Personal Information Protection Act (815 ILCS 530) and the Illinois Electronic Commerce Security Act (5 ILCS 175).