KACTUS PRIVACY POLICY

udpated version: July 27, 2026

KactusBio Inc., doing business as KACTUS (“KACTUS,” “we,” “us,” or “our”), respects your privacy. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you:

• Visit or use kactusbio.com and other websites or online services that link to this Privacy Policy;

• Purchase or inquire about our products or services;

• Request a quotation, Certificate of Analysis, technical support, or other information;

• Communicate with us by telephone, email, text message, web form, or other means;

• Attend an event, meeting, webinar, or other interaction involving KACTUS; or

• Otherwise interact with us in a business or professional capacity.

“Personal information” means information that identifies, relates to, describes, or can reasonably be associated with an individual.

1. Personal Information We Collect

Depending on how you interact with us, we may collect the following categories of personal information.

Contact and professional information

This may include your name, company or institution, job title, department, business address, shipping address, billing address, email address, telephone number, and other business contact information.

Account and order information

This may include account credentials, products ordered or requested, quotations, purchase order information, order history, shipping instructions, billing details, tax-exemption information, and related transaction records.

Payment-card information is generally collected and processed by our payment-processing providers. KACTUS may receive limited payment-related information, such as payment status and a partial card identifier, rather than complete payment-card details.

Inquiry and customer-support information

This may include information you provide when requesting a quote, contacting customer service, requesting technical support, submitting a Certificate of Analysis request, communicating with our sales team, or otherwise corresponding with us.

Website and device information

When you use our websites, we and our service providers may automatically collect information such as your IP address, browser type, device type, operating system, approximate location derived from your IP address, referring webpage, pages viewed, search terms, interactions with the website, and dates and times of access.

Marketing and communications information

This may include your email or SMS subscription preferences, communication history, event participation, areas of scientific or commercial interest, and your responses to marketing communications.

SMS consent records

When you consent to receive text messages, we may maintain your mobile telephone number and records relating to your consent, such as the date, time, method, and scope of consent, together with opt-out and help requests.

Information from other sources

We may receive information from authorized distributors, service providers, business partners, public professional sources, event organizers, social-media platforms, and other third parties, subject to applicable law.

2. How We Collect Personal Information

We may collect personal information:

• Directly from you;

• Through our websites, online forms, account portals, and ecommerce services;

• Through telephone calls, email, SMS, meetings, trade shows, and other communications;

• From organizations with which you are affiliated;

• From authorized distributors and business partners;

• Automatically through cookies and similar technologies; and

• From service providers and publicly available business or professional sources.

3. How We Use Personal Information

We may use personal information to:

• Respond to inquiries and requests for information;

• Prepare quotations and process orders;

• Provide products, custom services, technical support, and customer service;

• Process payments and manage billing, shipping, delivery, returns, and order status;

• Create and administer customer accounts;

• Communicate about meetings, inquiries, quotations, orders, deliveries, technical questions, and support requests;

• Send marketing communications where permitted by law and consistent with your preferences;

• Operate, maintain, analyze, personalize, and improve our websites, products, services, and communications;

• Detect, investigate, and prevent fraud, security incidents, misuse, and other unlawful activity;

• Maintain business, financial, quality, regulatory, and compliance records;

• Enforce our agreements and protect our rights, property, personnel, customers, and business;

• Comply with legal, regulatory, tax, accounting, and reporting requirements; and

• Carry out other purposes disclosed to you when the information is collected.

4. SMS and MMS Communications

KACTUS may use SMS or MMS messaging to communicate with customers, prospective customers, vendors, and other business contacts who have provided appropriate consent.

Types of messages

Depending on the consent you provide and your relationship with KACTUS, messages may concern:

• Responses to product or service inquiries;

• Requested product information or documents;

• Quotations and purchase orders;

• Order confirmations and order-status updates;

• Shipping or delivery information;

• Meeting scheduling and follow-up;

• Customer service and technical support; or

• Product, service, event, or promotional information when you have consented to receive such communications.

How consent may be obtained

Consent to receive text messages may be obtained through an affirmative request or agreement, including verbal consent during a telephone call or in-person conversation, an inbound text-message request, an online form with an appropriate disclosure, or another documented opt-in method.

Consent to receive SMS or MMS messages is not a condition of purchasing any KACTUS product or service.

Message frequency and charges

Message frequency varies depending on your interactions with KACTUS and the communications you request. Message and data rates may apply according to your mobile carrier and service plan.

Opting out

You may opt out of KACTUS text messages at any time by replying STOP to a message. We may send one final message confirming your opt-out request. After opting out, you will no longer receive SMS or MMS messages from the applicable KACTUS messaging program unless you provide consent again.

You may reply HELP for assistance or contact KACTUS at support@kactusbio.us.

Mobile carriers are not liable for delayed or undelivered messages.

Mobile information and SMS consent

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

KACTUS will not sell, rent, transfer, disclose, or otherwise provide your mobile telephone number or SMS opt-in consent to third parties or affiliates for their own marketing or promotional purposes.

Consent provided to KACTUS applies only to communications from KACTUS and may not be transferred to or used by another business to send you text messages.

5. How We Disclose Personal Information

Except for mobile information and text-messaging consent as specifically described above, we may disclose personal information in the following circumstances.

Service providers

We may provide personal information to companies that perform services on our behalf, such as website hosting, ecommerce services, payment processing, customer relationship management, communications, analytics, information technology, security, order fulfillment, shipping, accounting, and professional services.

These providers are authorized to process personal information only for the purposes of providing services to KACTUS or as otherwise permitted by law.

Distributors and business partners

When appropriate to fulfill your request, we may provide information to an authorized KACTUS distributor or business partner. For example, we may direct an inquiry to a distributor responsible for your geographic region.

Mobile information and SMS opt-in consent are excluded from disclosures to distributors and business partners for marketing or promotional purposes.

Legal and compliance disclosures

We may disclose personal information when we reasonably believe disclosure is required to:

• Comply with applicable law, regulation, court order, subpoena, or other legal process;

• Respond to lawful requests from governmental or regulatory authorities;

• Investigate or prevent fraud, security incidents, or unlawful activity;

• Enforce agreements or protect legal rights; or

• Protect the safety, rights, or property of KACTUS, our customers, or others.

Business transactions

Personal information may be disclosed in connection with a merger, acquisition, financing, restructuring, sale of assets, bankruptcy, or similar business transaction, subject to appropriate confidentiality and legal protections.

At your direction

We may disclose information when you request, direct, authorize, or consent to the disclosure.

6. Sale and Sharing of Personal Information

KACTUS does not sell personal information for monetary payment.

We may use analytics, advertising, or similar technologies that involve disclosures of device identifiers or website activity to service providers or advertising partners. Under certain U.S. state privacy laws, some of these activities may be defined as a “sale,” “sharing,” or use for targeted advertising even though no money is exchanged.

Where required by applicable law, you may opt out through our cookie-preference tools or by contacting us using the information below.

Regardless of these other practices, mobile telephone information and SMS opt-in data and consent will not be sold or shared with third parties or affiliates for their marketing or promotional purposes.

7. Cookies and Similar Technologies

We and our service providers may use cookies, pixels, tags, local storage, and similar technologies to:

• Operate and secure our websites;

• Remember your choices and preferences;

• Maintain shopping-cart and account functions;

• Understand website usage and performance;

• Diagnose errors and improve our websites;

• Measure marketing effectiveness; and

• Provide relevant communications or advertising where permitted.

You may control cookies through your browser settings and, where available, through our website cookie-preference tools. Blocking certain cookies may affect website functionality.

8. Marketing Communications

You may unsubscribe from marketing emails by using the unsubscribe link included in the message or by contacting us.

You may opt out of SMS or MMS messages by replying STOP. Email and SMS preferences are maintained separately; opting out of one channel may not automatically opt you out of the other.

We may continue to send non-promotional communications that are necessary to respond to your request, administer your account, process a transaction, provide customer service, or comply with legal obligations.

9. Legal Bases for Processing

Where the European Economic Area, United Kingdom, or another jurisdiction requires a legal basis for processing, we may process personal information based on:

• Your consent;

• Performance of a contract or steps taken at your request before entering into a contract;

• Compliance with a legal obligation;

• Protection of vital interests;

• Performance of a task in the public interest; or

• Our legitimate interests, provided those interests are not overridden by your rights and interests.

Our legitimate interests may include operating and improving our business, providing customer service, securing our systems, preventing fraud, maintaining business records, and conducting appropriate business-to-business marketing.

You may withdraw consent at any time, but withdrawal will not affect processing that occurred before withdrawal.

10. Data Retention

We retain personal information for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, including providing products and services, maintaining business and transaction records, documenting communications and consent, resolving disputes, enforcing agreements, and meeting legal, tax, accounting, quality, and regulatory requirements.

Retention periods vary depending on the type of information, the nature of our relationship with you, applicable legal requirements, and operational needs.

11. Data Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, loss, alteration, or disclosure.

No method of transmission or electronic storage is completely secure. We therefore cannot guarantee absolute security.

12. International Data Transfers

KACTUS operates internationally and may process or store personal information in the United States and other countries. These countries may have privacy laws that differ from those in your country.

Where required, we use appropriate safeguards for international transfers, such as contractual protections or other legally recognized transfer mechanisms.

13. Your Privacy Rights

Depending on where you reside, you may have the right to:

• Request access to personal information we maintain about you;

• Request correction of inaccurate information;

• Request deletion of personal information;

• Request a portable copy of certain information;

• Restrict or object to certain processing;

• Withdraw consent;

• Opt out of targeted advertising, sale, or sharing as defined by applicable law; and

• Appeal a decision concerning a privacy request.

These rights may be subject to exceptions and verification requirements.

To submit a privacy request, contact support@kactusbio.us. We may request information reasonably necessary to verify your identity and authority to make the request.

You may use an authorized agent where permitted by law. We may require proof that the agent is authorized to act on your behalf.

KACTUS will not unlawfully discriminate against you for exercising an applicable privacy right.

Residents of the European Economic Area or United Kingdom may also have the right to file a complaint with the data-protection authority responsible for their place of residence or work.

14. Children’s Privacy

Our websites, products, and services are directed to businesses, research organizations, and professionals and are not intended for children under 16.

We do not knowingly collect personal information from children under 16. If you believe that a child has provided personal information to us, contact us so that we may investigate and take appropriate action.

15. Third-Party Websites

Our websites may link to websites or services operated by third parties. This Privacy Policy does not govern third-party websites or services. We encourage you to review their privacy policies before providing personal information.

16. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, technologies, services, or legal obligations.

The effective date at the beginning of the policy indicates when it was most recently updated. Material changes may be communicated through our website or by another appropriate method.

17. Contact Us

Questions, complaints, and privacy-rights requests may be directed to:

KactusBio Inc.
Attn: Privacy
60 Hickory Drive
Waltham, MA 02451
United States

Email: support@kactusbio.us
Telephone: +1 (617) 665-7333