PRIVACY POLICY Effective Date: October 4, 2026 Michelle Linzy Private Advisory, operated by Michelle Linzy, LLC (“Michelle Linzy Private Advisory,” “the Firm,” “we,” “us,” or “our”), respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you visit www.michellelinzy.com, communicate with us, submit a request for a private conversation, or otherwise interact with the Firm. We seek to handle personal information responsibly and transparently and, where applicable, in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), applicable European data-protection requirements, and other applicable privacy laws. This Privacy Policy should be read together with our Cookie Policy and Terms of Service. 1. WHO WE ARE The data controller responsible for the personal information covered by this Privacy Policy is: Michelle Linzy Private Advisory Operated by Michelle Linzy, LLC Email: hello@michellelinzy.com Website: www.michellelinzy.com For privacy-related questions or requests concerning your personal information, please contact us at: hello@michellelinzy.com We have not appointed a Data Protection Officer at this time. If that changes, this Privacy Policy will be updated accordingly. 2. WHAT PERSONAL INFORMATION WE COLLECT The information we collect depends on how you interact with the Firm. Information you provide directly When you contact us, submit a request for a private conversation, communicate with us by email, or otherwise voluntarily provide information, we may collect: • Your name • Email address • Telephone number, if provided • Country or general location, if provided • Information about your professional role or circumstances, if you choose to provide it • Information about the decision, transition, challenge, or circumstance you are navigating • Information contained in communications between you and the Firm • Other information you voluntarily provide Because the Firm provides private advisory services, individuals may choose to describe personal, professional, family, financial, leadership, or other circumstances in communications with us. Please do not provide sensitive personal information through the website or an initial inquiry unless it is reasonably necessary for your request. Information collected automatically When you visit our website, certain technical information may be collected automatically through Squarespace and other website technologies that may be active on the site. Depending on the configuration of the website and your consent choices, this information may include: • IP address • Browser type and version • Device type • Operating system • Pages visited • Referring website • Date and time of visits • General website interaction information • Information collected through cookies or similar technologies The specific cookies and technologies used on the website are described in our Cookie Policy. 3. HOW WE USE PERSONAL INFORMATION We use personal information only for legitimate and appropriate business purposes, including: • Responding to inquiries and requests for a private conversation • Reviewing requests to determine whether the Firm may be an appropriate fit • Communicating with prospective or existing advisory clients • Providing private advisory services • Establishing and administering advisory relationships • Managing appointments and communications • Processing payments and maintaining business records • Responding to questions and requests • Maintaining and improving the website • Understanding website usage where appropriate and permitted • Protecting the security and integrity of the website and Firm • Complying with legal, regulatory, accounting, and administrative obligations • Establishing, exercising, or defending legal claims • Preventing fraud, misuse, or unauthorized activity We do not sell personal information to third parties. We do not use personal information for automated decision-making that produces legal or similarly significant effects on individuals. 4. LEGAL BASES FOR PROCESSING Where the GDPR applies, we process personal information on one or more of the following legal bases: Performance of a contract or steps taken before entering into a contract We may process information when it is necessary to respond to a request, evaluate an advisory relationship, enter into an agreement, or provide services under an agreement. Legitimate interests We may process information when necessary for our legitimate business interests, provided those interests are not overridden by your fundamental rights and freedoms. Examples may include: • Operating and securing the website • Managing business communications • Maintaining appropriate business records • Protecting the Firm against fraud or misuse • Establishing or defending legal claims • Improving our services and website Legal obligations We may process personal information when necessary to comply with applicable laws, regulations, court orders, tax requirements, accounting requirements, or other legal obligations. Consent Where consent is required, we will request it clearly and specifically. You may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing that occurred before consent was withdrawn. 5. ADVISORY AND INQUIRY INFORMATION The Firm's private advisory work can involve circumstances that are personal or sensitive in nature. We do not require prospective clients to disclose more information than is reasonably necessary to determine whether a private conversation or advisory relationship may be appropriate. If you voluntarily provide information that may constitute a special category of personal data under the GDPR, such as information concerning health, political opinions, religious beliefs, or other protected categories, we will handle that information in accordance with applicable law. Where special-category information is not necessary, we encourage you not to submit it through the website. The Firm does not use information submitted through a private conversation request as a basis for automated profiling or automated decision-making. 6. HOW WE SHARE PERSONAL INFORMATION We may disclose personal information to service providers and professional advisers where reasonably necessary to operate the Firm, provide services, maintain the website, communicate with individuals, process payments, comply with legal obligations, or protect our rights. Depending on the services actually used by the Firm, these may include: • Website hosting and technology providers, including Squarespace • Business email and productivity providers, including Google Workspace • Scheduling or appointment providers, if used • Payment processors, including providers used for future online payment processing • Professional advisers, such as legal, accounting, or compliance professionals • Government authorities, courts, regulators, or law-enforcement bodies where legally required or permitted • Other service providers acting on our behalf under appropriate contractual arrangements We do not permit service providers to use personal information for their own independent purposes except where permitted by their own legal obligations or applicable agreements. 7. SQUARESPACE Our website is hosted and operated using Squarespace. Squarespace may process information concerning visitors to websites hosted on its platform in accordance with its own privacy and data-processing documentation. Squarespace provides tools intended to help website owners address privacy requirements, including cookie consent controls and privacy-policy resources. 8. GOOGLE WORKSPACE AND EMAIL The Firm uses Google Workspace for business email and related productivity services. If you communicate with us by email, information contained in those communications may be processed through Google Workspace. Google provides data-processing terms addressing its obligations as a processor under applicable data-protection laws. Google may process or store information in locations outside the European Economic Area. Where applicable, international transfers are subject to appropriate safeguards under applicable data-protection law. 9. COOKIES AND SIMILAR TECHNOLOGIES Our website uses cookies and similar technologies necessary for the website to function and may use additional technologies for analytics, performance, preferences, or other purposes. Where applicable law requires consent for non-essential cookies or similar technologies, we will request consent before placing or using those technologies. Our Cookie Policy explains: • The types of cookies used • Their purposes • Whether they are necessary or optional • How long they remain active • Relevant third-party providers • How visitors can manage or withdraw consent 10. DATA RETENTION We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. Retention periods may depend on: • The nature of the information • The purpose for which it was collected • Whether an advisory relationship exists • Legal, accounting, tax, or regulatory requirements • The need to establish, exercise, or defend legal claims • Whether the information remains necessary for legitimate business purposes When personal information is no longer required, we will take reasonable steps to securely delete, destroy, or anonymize it where appropriate. 11. INTERNATIONAL DATA TRANSFERS Because the Firm operates internationally and uses service providers that may process information in countries outside the European Economic Area (“EEA”), personal information may be transferred to or processed in countries outside the EEA. Where the GDPR applies and a transfer is subject to the GDPR's international-transfer requirements, we will rely on an appropriate legal mechanism, which may include: • An adequacy decision • Standard Contractual Clauses • Another lawful transfer mechanism recognized under applicable data-protection law • A lawful derogation where applicable 12. YOUR PRIVACY RIGHTS Where the GDPR applies, you may have the right to: • Request access to personal information we hold about you • Request correction of inaccurate or incomplete information • Request deletion of your personal information in certain circumstances • Request restriction of processing in certain circumstances • Object to certain processing • Request portability of personal information where applicable • Withdraw consent where processing is based on consent • Object to certain forms of direct marketing • Lodge a complaint with a competent data-protection supervisory authority These rights are subject to applicable legal limitations and exceptions. 13. HOW TO EXERCISE YOUR RIGHTS To exercise a privacy right or ask a question about how your information is processed, contact: hello@michellelinzy.com Please provide enough information for us to understand your request and verify your identity where reasonably necessary. We will respond within the period required by applicable law. If we are unable to fulfill your request, we will explain the reason where required by law. 14. RIGHT TO LODGE A COMPLAINT If you believe that your personal information has been processed unlawfully, you have the right to lodge a complaint with a competent data-protection supervisory authority. For individuals in the European Economic Area, the appropriate supervisory authority may generally be the authority in the country where you live, work, or where you believe an infringement occurred. For matters concerning the Firm's processing in Albania, the relevant Albanian data-protection authority may be contacted in accordance with applicable Albanian law. 15. DATA SECURITY We take reasonable technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, loss, or destruction. No method of transmitting information over the internet or storing information electronically is completely secure. Accordingly, we cannot guarantee absolute security. Access to personal information is limited to individuals and service providers who have a legitimate need to access it for authorized purposes. 16. CHILDREN'S PRIVACY The Firm's services and website are intended for adults. We do not knowingly solicit or intentionally collect personal information from children through the website. If we become aware that we have collected personal information from a child in circumstances where collection was not appropriate or lawful, we will take reasonable steps to address the situation in accordance with applicable law. 17. THIRD-PARTY WEBSITES AND SERVICES Our website may contain links to websites or services operated by third parties. We are not responsible for the privacy practices, security, content, or policies of third-party websites. We encourage visitors to review the privacy policies of third-party services before providing them with personal information. 18. CHANGES TO THIS PRIVACY POLICY We may update this Privacy Policy from time to time to reflect changes in our business, services, technology, legal requirements, or privacy practices. When we make material changes, we will update the Effective Date at the top of this policy and, where appropriate, provide additional notice. We encourage visitors to review this Privacy Policy periodically. 19. CONTACT US If you have questions about this Privacy Policy, our privacy practices, or the handling of your personal information, please contact: Michelle Linzy Private Advisory Operated by Michelle Linzy, LLC Email: hello@michellelinzy.com Website: www.michellelinzy.com Last Updated: October 4, 2026