CUSTOMER AGREEMENT

This Customer Agreement (this “Agreement”) is made effective as of the last signed date below
by and among Rocket21challenge, LLC, a Delaware limited liability company (“R21”), Rocket 21
Challenge, SP, a Segregated Portfolio of Flow Business Solutions, SPC, a Cayman Islands
Segregated Portfolio Company (“R21SP”) and ___________ (“Customer”). Each of R21, R21SP
John alexander molina castillo

or Customer may be referred to herein as a “Party” and collectively as “Parties.” In consideration

of the undertakings and obligations set forth herein, and for other good and valuable consideration,
the Parties agree as follows:

I. Rocket 21 Challenge Evaluation.

1. License to Simulation Trading. R21 shall give Customer a non-exclusive license to engage in
simulated trading on the FOREX financial market, or on other financial market(s) (“R21 FOREX
Trading”), through a special customer demo account (“R21 Customer Account”) on the platform
of a broker selected by R21. The R21 Customer Account shall be made accessible to Customer
subject to the conditions of this Agreement and to Rocket 21 Challenge programs and products.
Customer acknowledges and understands that the R21 Customer Account is the property of R21
and Customer shall keep confidential all information, trades and transactions in connection with
the R21 Customer Account. At the request of R21, all trading strategies used by Customer must
be fully disclosed to R21, and if Customer fails to completely provide such information promptly
to R21, R21 has the right to terminate this Agreement in accordance with Section 20.

2. Account Balance Requirement. R21 will not instruct or advise Customer regarding the method
of R21 FOREX Trading. Customer has discretion to decide the manner in which Customer engages
in R21 FOREX Trading. For purposes of R21 FOREX Trading, Customer has selected the
following challenge and shall observe the following policies of trading:

[Check appropriate boxes]

■ Rocket Challenge

 $5,000 USD
■  $10,000 USD  $25,000 USD  $50,000 USD
 $100,000 USD  $200,000 USD  $300,000 USD

a. The maximum daily aggregated loss in the R21 Customer Account, consisting of the
account’s current result of opened positions and the result of positions closed on the given
day, may not at any time in the course of such day exceed 5__% of the starting balance of
such R21 Customer Account. This aggregated loss resets at 5PM EST every day and is
calculated as follows:
a. Rocket Challenge: The aggregated loss from the prior day ending balance or equity,
whichever is higher.

Page 1 of 16
alex
alex
 b. The value of the capital balance in the R21 Customer Account may not fall below 10
__% of
the initial account balance in the R21 Customer Account, both for open and closed
positions, including commissions and swaps. In the event of a breach of any of the rules
referred to in this Section 2, all positions on the broker’s platform shall be closed
immediately and the R21 Customer Account will be blocked. In such case, R21 has the
right to terminate this Agreement in accordance with Section 20.

3. Acknowledgement. Customer acknowledges that the R21 Customer Account is a demo version
which does not allow Customer to engage in actual live trades using R21 FOREX Trading on
financial markets.

4. Compliance with Terms, Conditions and Applicable Laws. Customer shall not engage in
R21 FOREX Trading in violation of: (i) applicable laws, regulations and requirements; (ii) the
operation and customary usage and practice of actual financial market(s); (iii) the terms and
conditions of the broker as amended from time to time; (iv) the Terms of Use of R21 as amended
from time to time and which are incorporated by reference, made a part of this Agreement and are
available at https://rocket21challenge.com/terms-of-use/ (“R21 Terms”); (v) the R21 Knowledge
Center rules and conditions as amended from time to time and which are incorporated by reference,
made a part of this Agreement and are available at help.rocket21challenge.com (“R21 Rules”); (vi)
the conditions and requirements set forth in Section 2 of this Agreement; and (vii) the prohibition
against any other person except Customer from logging into, placing orders or executing trades,
or otherwise accessing the R21 Customer Account. Any transaction made or entered into in
violation of the above terms gives R21 the right to terminate this Agreement in accordance with
Section 20.

II. Rocket 21 Challenge, SP Proprietary Trading.

5. License to Simulation Trading. R21SP shall give Customer a non-exclusive license to engage
in simulation of trades on the financial market FOREX, or on other financial market(s) (“R21SP
FOREX Trading”), through a special customer demo account (“R21SP Customer Account”) on
the platform of a broker selected by R21SP and which shall be made accessible to Customer,
subject to the terms and conditions of this Agreement and to the R21SP programs and products.
Customer’s right to receive remuneration, which R21SP shall pay Customer subject to the terms
and conditions of this Agreement, is dependent on: (i) the R21SP FOREX Trading reflecting and
being in accordance with the operation of actual financial market(s) in a clear and reasonable
manner; and (ii) Customer complying with the conditions and requirements set forth in this Section
5 and Sections 6, 8 and 9 of this Agreement. Customer acknowledges and agrees that any breach
or violation of this Section 5 or Sections 6, 8 or 9 of this Agreement will result in Customer
forfeiting any right to receive and being ineligible to receive remuneration from R21SP under this
Agreement. Customer acknowledges and understands that the R21SP Customer Account is the
property of R21SP and Customer shall keep confidential all information, trades and transactions
in connection with the R21SP Customer Account. Customer further acknowledges that R21SP
reserves the right in its sole discretion to determine whether the R21SP FOREX Trading was

Page 2 of 16
alex
alex
 realistic in the context and operation of actual financial market(s) and that any deviations in the
R21SP FOREX Trading from the operation of the real market(s) will result in changes to the
remuneration payable to Customer. At the request of R21SP, all trading strategies used by
Customer must be fully disclosed to R21SP, and if Customer fails to completely provide such
information promptly to R21SP, R21SP has the right to terminate this Agreement in accordance
with Section 20.

6. Account Balance Requirement. R21SP will not instruct or advise Customer regarding the
method of R21SP FOREX Trading. Customer has discretion to decide the manner in which
Customer engages in R21SP FOREX Trading. For purposes of R21SP FOREX Trading, Customer
is required to and shall observe the following policies of trading:

a. The maximum daily aggregated loss in the R21SP Customer Account, consisting of the
account’s current result of opened positions and the result of positions closed on the given
day, may not at any time in the course of such day exceed5__% of the starting balance of
such R21SP Customer Account. This aggregated loss resets at 5PM EST every day and is
calculated as follows:
a. Rocket Challenge: The aggregated loss from the prior day ending balance or equity,
whichever is higher.

a. The value of the capital balance in the R21SP Customer Account may not fall below 10 __%
of the initial account balance, both for open and closed positions, including commissions
and swaps. In the event of a violation of any of the rules referred to in this Section 6, all
positions on the broker’s platform shall be closed immediately and the R21SP Customer
Account will be blocked. In such case, R21SP has the right to terminate this Agreement in
accordance with Section 20.

7. Acknowledgement. Customer acknowledges that the R21SP Customer Account is a demo

version which does not allow Customer to engage in actual live trades using R21SP FOREX
Trading on financial markets. It is up to the decision of R21SP in its sole discretion which if any
trades entered or executed during R21SP FOREX Trading will be executed on any financial
market(s) and which will not.

8. Right to Remuneration. Customer is entitled to remuneration based on the results of R21SP

FOREX Trading, calculated according to performance results in the R21SP Customer Account;
provided, however, that R21SP FOREX Trading is deemed to be in R21SP’s sole discretion in
accordance with actual live market conditions and is in full and complete compliance with this
Agreement, including but not limited to Sections 6, 8 and 9. Billing takes place in monthly cycles
from the first business day on which trading in the R21SP Customer Account occurred. If
Customer starts to trade for example on May 5, billing will take place on the fifth day of each
month. Billing consists of calculating from the R21SP Customer Account the difference between
the closed account balance and the value of the initial capital where such difference is positive.
The resulting Customer’s remuneration is calculated as ____% 85 of such difference. The

Page 3 of 16
alex
alex
 remuneration is payable within the 14th day of the invoice being issued by Customer to the account
shown in the header of this Agreement. Customer acknowledges that R21SP reserves the right in
its sole discretion to determine whether the R21SP FOREX trading was realistic in the operation
of actual financial market(s) and that the remuneration payable is dependent on R21SP FOREX
trading reflecting the operation of actual financial market(s) in a clear and reasonable manner. Any
deviation(s) in R21SP FOREX trading from the operation of actual financial market(s), or
violation of any rules set forth by R21SP or other applicable laws or regulations, shall result in full
and immediate forfeiture of any remuneration or right thereto otherwise payable to Customer,
notwithstanding the results in the R21SP Customer Account.

9. Compliance with Terms, Conditions and Applicable Laws. Customer shall not engage in
R21SP FOREX Trading in violation of: (i) applicable laws, regulations and requirements; (ii) the
operation of actual financial market(s); (iii) the terms and conditions of the broker as amended
from time to time; (iv) the Terms of Use of R21SP as amended from time to time and which are
incorporated by reference, made a part of this Agreement and are attached as Exhibit A (“R21SP
Terms”); (v) the conditions and requirements set forth in Sections 5, 6 and 8 of this Agreement;
(vi) the R21SP Knowledge Center rules and conditions as amended from time to time and which
are incorporated by reference, made a part of this Agreement and are attached as Exhibit B
(“R21SP Rules”); and (vii) the prohibition against any other person except Customer from logging
into, placing orders or executing trades, or otherwise accessing the R21SP Customer Account. Any
transaction(s) made or entered into in violation of the terms and conditions of this Agreement, as
determined in R21SP’s sole discretion, will constitute full and immediate forfeiture of Customer’s
right to remuneration or right thereto under Section 8 of this Agreement or otherwise, and any such
transaction(s) shall give R21SP the right to terminate this Agreement in its sole discretion in
accordance with Section 20.

III. General Provisions.

10. Compliance with Cayman Islands. By signing this Agreement, Customer undertakes to
conduct R21 FOREX Trading and R21SP FOREX Trading in accordance with regulations in the
Cayman Islands and to obtain and provide R21 or R21SP, as applicable, with all necessary permits
for such activity.

11. Conflict of Interest. Customer shall notify R21 and R21SP promptly of any interest in
business or other activities of Customer which could conflict with the interests of R21SP or R21,
respectively.

12. Confidentiality. Customer shall: (i) keep all information received in connection with this
Agreement or when engaging in R21 FOREX Trading or R21SP FOREX Trading strictly
confidential; (ii) treat such information at least as privately and confidentially as Customer treats
Customer’s own private information; and (iii) not permit, authorize or allow any person except
Customer to access the R21 Customer Account, the R21SP Customer Account, or any information

Page 4 of 16
alex
alex
 contained in any of the foregoing. Customer may not copyright, trademark, or patent any byproduct
created through Customer’s relationship with R21 or R21SP unless otherwise agreed.

13. Data Processing. Customer agrees and acknowledges that R21 and R21SP process (in an
automated manner or by other means through web-based partners and accounts) the personal data
of Customer in compliance with applicable data protection laws. Customer has provided or will
provide certain data and information to R21, R21SP or the broker for the purposes of and to the
extent necessary for (i) performance of this Agreement, (ii) personal and business evaluation of
Customer, (iii) resolution of any disputes arising in connection with this Agreement and (iv)
receiving information on other services or products of or offered by R21 and R21SP. Customer
grants this consent for the duration of the performance of Customer’s relationship with R21 or
R21SP, and for a period of three years after termination of this Agreement, unless there is an
obligation to R21SPhive any personal or business data for a longer period of time by applicable
law (in which case Customer grants this consent for such applicable longer period of time).
Customer further acknowledges that R21 and R21SP may retain Customer’s personal or business
data indefinitely and without consent at the request of law enforcement agencies for the purpose
of aiding in investigative activities.

14. Third Party Data Processing. R21 and R21SP have the right to provide personal and business
data of Customer to third parties and to foreign governments to the extent necessary to carry out
the terms of this Agreement and to comply with relevant data privacy laws. R21 and R21SP only
have the right to such transfer of personal and business data of Customer for the purpose of and to
the extent specified above, or if such an obligation is provided for by law. R21 and R21SP shall
inform Customer of the transfer of Customer’s personal or business data pursuant to this paragraph
unless the law states otherwise.

15. Right to Correct. Customer has the right to access and correct Customer’s personal or
business data or information. In the event that Customer finds or believes that R21 and R21SP
perform the processing of Customer’s personal or business data or information in a manner
inconsistent with protection of the private and personal life of Customer or Customer’s business
or in conflict with applicable laws or regulations on the protection of personal and business data
(in particular, if the personal or business data is inaccurate), Customer may request that R21 or
R21SP make reasonable and appropriate efforts to remediate.

16. California Customers Only. Customers who are residents of California should refer to
Appendix I for information regarding R21’s and R21SP’s data privacy policy and treatment of
personal information.

17. European Customers Only. Customers who are citizens or residents of the United Kingdom
or European Union should refer to Appendix II for information regarding R21’s and R21SP’s data
privacy policy and treatment of personal information.

Page 5 of 16
alex
alex
 18. Return of Company Property. Upon R21’s or R21SP’s request, as applicable, and at any
time after termination of this Agreement, Customer agrees to return all borrowed materials, other
resources, notes, documents, including electronic or other storage media, containing information
regarding R21 or R21SP, as applicable, including all copies thereof. Retaining copies in any
manner or form is strictly prohibited.

19. Integral Part of Agreement. The Parties expressly acknowledge that the R21 Terms and
R21SP Terms and privacy statements form integral parts of this Agreement, and Customer
expressly acknowledges that Customer has read and understands the R21 Terms and R21SP Terms
and the privacy statements.

20. Termination. This Agreement continues in effect for an indefinite period of time and may be
terminated by any Party at any time with immediate effect without prior notice.

21. Counterparts. This Agreement may be executed by manual or electronic signature in one or
more counterparts, each of which shall be deemed an original and all of which collectively shall
constitute a single agreement.

22. Applicable Law and Waiver. This Agreement and all exhibits or attachments are integral
parts of this Agreement and shall be subject to the laws of Cayman Islands, without regard to
conflict of laws provisions. Any dispute between the Parties that is not resolved through arbitration
as provided in the R21 Terms or R21SP Terms by law or by circumstances shall be resolved by
the state courts located in the location of R21’s choosing. THE PARTIES AGREE THAT A
PARTY MAY BRING CLAIMS IN ARBITRATION OR OTHERWISE ONLY IN EACH
PARTY’S INDIVIDUAL CAPACITY AND NOT AS A PLAINTIFF OR CLASS MEMBER IN
ANY PUTATIVE CLASS, COLLECTIVE AND/OR REPRESENTATIVE PROCEEDING,
SUCH AS FOR EXAMPLE IN THE FORM OF A PRIVATE ATTORNEY GENERAL ACTION.

23. Appendixes. Any appendixes or attachments attached to this Agreement are integral parts of
this Agreement.

24. Amendments. Any modification, amendment, or extension to this Agreement is not valid
unless written and signed by all Parties.

25. Taxes. Neither R21 nor R21SP are liable or responsible for the withholding of taxes for or
payment of taxes on behalf of Customer.

26. Relationship. This Agreement shall not be interpreted to create any form of partnership,
membership, employment or joint venture between the Parties.

SIGNATURE PAGE FOLLOWS

Page 6 of 16
alex
alex
 CUSTOMER:

John alexander molina castillo

_________________________________
John alexander molina castillo (Feb 13, 2023 08:24 EST)

John alexander molina castillo

BY: ______________________________

Feb 13, 2023

DATE: ____________________________

Page 7 of 16
alex
alex
 APPENDIX I – CALIFORNIA PRIVACY NOTICE

This California Privacy Notice describes how Rocket21challenge, LLC (“R21”) and Rocket 21
Challenge, SP (“R21SP”) complies with the California Consumer Privacy Act of 2018 (“CCPA”)
with respect to personal information collected about California residents (“California consumers”).

CCPA Rights
The CCPA is a California law that gives California consumers additional rights relating to the
personal information collected about them. The main rights under that law are:

• Right to Opt-Out. You have the right to inform R21 and R21SP not to sell your personal
information.
• Right to Know. You have the right to know what kind of personal information is collected
about you. You also have the right to request a copy of the personal information collected.
• Right to Delete. You have the right to request deletion of your personal information, with
the exception of reasonableness, including, but not limited to, compliance with law
enforcement agencies and government edicts.
• Right to Non-discrimination. You are protected from discriminatory practices under
California law.
• Protection of Minors. Californian minors are protected from certain marketing activities.
• Right to File Complaint. You have the right to file complaint against those you feel are
in violation of applicable Californian laws.

These rights can be exercised by the Californian consumer or their designated agent such as an
attorney or those in possession of a power of attorney.

Scope
The CCPA applies to personal information of California consumers, such as those who interact
with R21’s and R21SP’s products and websites. “Personal information” is defined broadly in the
CCPA, and essentially encompasses any information that can be used directly or indirectly to
identify a California resident. This Notice does not apply to residents of other states and nations.

Collection, Use and Sharing of Your Data

The personal information that R21 and R21SP collect about California consumers depends upon
the interaction with you, and is also limited to that which is relevant and appropriate for the
interaction and purpose of the collection.

Please see R21’s general Privacy Statement (www.rocket21challenge.com) and R21SP’s Privacy
Statement as amended from time to time and incorporated by reference, made a part of this
Agreement and attached as Exhibit C for more details.

Right to Opt-Out
Upon request by a Californian consumer, R21 and R21SP will not sell personal information of
Californian residents as defined by the CCPA. To the extent that your personal information is

Page 8 of 16
alex
alex
 accessible to their affiliated companies, third-party partners, and their subsidiaries who assist R21
or R21SP with their services to Customers, such persons are also prohibited from selling your
personal information as defined by CCPA.

In order to opt out, you can contact R21’s and R21SP’s Data Protection Officers through the
contact information provided below or click the “Do Not Sell My Data” link on R21’s and R21SP’s
websites.

R21 and R21SP will confirm to the California resident or, if applicable, their authorized agent such
as their attorney, no later than fifteen (15) days from the date that they receive the request, that the
California resident has been opted-out of the sale of his or her information under the CCPA, and
that they have added him/her to the Do Not Sell My Information Log.

Right to Know
In accordance with the CCPA requirements, California residents may contact R21 and R21SP to
exercise their right to know about the personal information that they hold about them as well as
how the data was used, the categories and the identity of third parties with whom the data was
shared, and the purpose(s) for the sharing of the information. They can do so by exercising that
right via one of the other options identified in the Contact Methods section of this Notice.

R21 and R21SP will acknowledge a Right to Know within ten (10) days of receipt, and provide
the information requested by the verified California resident within forty-five (45) days. R21 and
R21SP may require more time to deliver the information, up to a total of ninety (90) days if further
investigations and verifications are required. If a reasonable delay is necessary, R21 or R21SP will
contact the California resident of the delay. California residents or their authorized agents who
seek to exercise this right are subject to comprehensive verification to minimize any risk to
individuals of sharing their person information with an unauthorized individual. R21 and R21SP
will deny the request if it is unable to verify the requestor or the authorized agent. If R21 or R21SP
are unable to verify the individual requesting the information under the Right to Know, they will
inform the individual or authorized agent within forty-five (45) days of receipt of their request.

R21 and R21SP can also deny the request if they do not hold any personal information about the
individual which falls within the scope of CCPA. This California Privacy Notice applies only to
California residents and the scope of data covered by applicable Californian laws.

California residents are limited to two such requests to know or access their data in any twelve (12)
month period, whether through his or her individual capacity or through his or her agent.

Right to Delete
California residents have the right to request deletion of their personal information, and can make
the request directly to R21 or R21SP in his or her individual capacity or through an authorized
agent. They can do so by exercising that right through one of the other options identified in the
Contact Methods section of this Notice.

R21 and R21SP are not obligated to delete the personal information of the California resident if
they are required or permitted to retain it in accordance with one of the exemptions in the CCPA.

Page 9 of 16
alex
alex
 Individuals who exercise their right to request deletion directly or through an authorized agent will
be subject to verification in accordance with the CCPA requirements. R21 and R21SP will
acknowledge a request for deletion within ten (10) days of receipt, and will endeavor to fulfill the
request within forty-five (45) days.

If it becomes evident that R21 or R21SP are unable to delete all of the California resident’s data
within the forty-five (45) day period, R21 or R21SP will inform the individual or the authorized
agent within that period, and may take additional days to comply with the request, up to ninety
(90) days.

When R21 or R21SP processes a request for deletion from a California resident who has been
properly verified, R21 or R21SP will delete the data from its systems in a secure and irreversible
manner, to prevent the data from being restored. To the extent that R21 or R21SP have entrusted
any of the Personal Information of the California resident to a “Service Provider” as defined by
the CCPA, R21 or R21SP will also contact that Service Provider to process the deletion request
and will confirm to the California resident or the agent that it has done so.

Rights of Minors
R21 and R21SP uphold the rights of California residents who are minors in relation to the
collection and processing of their personal information. In accordance with the CCPA
requirements, R21 and R21SP have also applied those rights to California residents between the
ages of thirteen (13) and sixteen (16). R21 and R21SP have also adopted practices to uphold the
surrounding rights of parents and legal guardians of those minors. Parents and legal guardians who
seek to exercise the CCPA rights of their children will also be subject to authentication in order to
prevent the release of any information pertaining to a minor to an unauthorized individual.

Right to No Discrimination
In accordance with the CCPA, R21 and R21SP do not discriminate against individuals, including
those who choose to exercise their CCPA rights.

Rights of Consumers with Disabilities

R21 and R21SP provide assistance to individuals with disabilities to communicate effectively with
them. Please contact R21 and R21SP through their respective e-mail addresses:
support@rocket21challenge.com and R21SPmanagement@gmail.com.

Contact Methods
R21 and R21SP are e-commerce entities with no physical storefront. They exclusively operate
through their websites or other online methods, and they have direct relationships with their
customers. You can email or mail R21 or R21SP to exercise your rights. When you email such
requests, please write “My California Privacy Rights” in the subject field and identify who you
are. R21 and R21SP are not responsible for notices that are not properly labeled or sent. When you
mail your request, please write “My California Privacy Rights” on the header.

In order to contact R21 and R21SP to exercise your rights as a California resident, you can mail
or message them through the following:

Page 10 of 16
alex
alex
 Rocket21challenge, LLC
Attn: Data Protection Officer
2140 South DuPont Hwy
Camden, Delaware 19934
Email Address:
support@rocket21challenge.com

Rocket 21 Challenge, SP
Attn: Data Protection Officer, FG Services Limited
Suite 2206, Cassia Court
72 Market Street
Camana Bay
P.O. Box 30869
Grand Cayman KY1-1204
Cayman Islands
Email Address: R21SPmanagement@gmail.com

Page 11 of 16
alex
alex
 APPENDIX II – EUROPEAN PRIVACY NOTICE

This European Privacy Notice describes how Rocket21challenge, LLC, organized in the State of
Delaware (“R21”) and Rocket 21 Challenge, SP, organized in the Cayman Islands (“R21SP”),
comply with the General Data Protection Regulation effective as of 2018 and the United
Kingdom’s Data Protection Act of 2018 (collectively, “GDPR”) with respect to personal data
collected about citizens or residents of the European Union or United Kingdom, respectively
(“European data subjects”).

How R21 and R21SP Process Data

R21 and R21SP collect with your express consent, or may collect in the future, your first and last
name, email address, phone number, and your financial information. R21 and R21SP may collect
other information about you with your express consent. They collect your data through the online
or physical registration process, completion of surveys or feedbacks, payment methods used to
purchase their products or reimburse you, and use of cookies on their websites. R21 and R21SP
may also partner with cloud computing companies to store personal data through their software.

R21 and R21SP may receive your data indirectly through your credit card processing companies
and governmental agencies.

How R21 and R21SP Use Your Data

R21 and R21SP use your data to process your purchase or to issue payments to you, manage your
account, email you with special offers on other products they think you might like, send billing
reminders, and perform other activities necessary and proper to serve you as best they can. Please
see R21’s general Privacy Statement (www.rocket21challenge.com) and R21SP’s Privacy
statement as amended from time to time and incorporated by reference, made a part of this
Agreement and attached as Exhibit C for more details.

GDPR Rights
The GDPR is a law of the European Union (and set of rules some countries outside of the EU
mirror) that gives individuals in Europe additional rights relating to the personal information
collected about them. The main rights under that law are:

• Right to Access. You have the right to request R21 or R21SP to make copies of your
personal data. You may be charged a small fee for this service.
• Right to Rectification. You have the right to request R21 or R21SP to correct any
information you believe is inaccurate. You also have the right to request R21 or R21SP to
complete any information you believe is incomplete.
• Right to Erasure. You have the right to request R21 or R21SP to erase your personal data,
with certain exceptions.
• Right to Restrict Processing. You have the right to request R21 or R21SP to restrict the
processing of your personal data, with certain exceptions.

Page 12 of 16
alex
alex
 • Right to Object to Processing. You have the right to object to R21’s or R21SP’s
processing of your personal data, with certain exceptions.
• Right to Data Portability. You have the right to request R21 or R21SP to transfer the data
that they have collected to another organization, or directly to you, with certain exceptions.

These rights can be exercised by an individual in Europe or their designated agent such as an
attorney or those in possession of a power of attorney.

Scope
The GDPR applies to personal data of citizens or residents of the European Union or the United
Kingdom, such as those who interact with R21’s or R21SP’s products and websites. “Personal
data” is defined broadly in the GDPR, and essentially encompasses any information that can be
used directly or indirectly to identify an individual in Europe (or other non-EU state that adopted
the provisions within GDPR). GDPR Article 4 defies “personal data” as any information relating
to an identified or identifiable natural person (“data subject”); an identifiable natural person is one
who can be identified, directly or indirectly, in particular by reference to an identifier such as a
name, an identification number, location data, an online identifier or to one or more factors specific
to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural
person.

GDPR applies to personal data processed through purely automatic means or through non-
automatic means.

Right to Access
In accordance with the GDPR requirements, European data subjects may contact R21 or R21SP to
exercise their right to access the personal data that they hold about them as well as how the data
was used, the categories and the identity of third parties with whom the data was shared, and the
purpose(s) for the sharing of the information. They can do so by exercising that right via one of
the other options identified in the Contact Methods section of this Notice.

European data subjects or their authorized agents who seek to exercise this right are subject to
comprehensive verification to minimize any risk to individuals of sharing their person information
with an unauthorized individual. R21 or R21SP will deny the request if it is unable to verify the
requestor or the authorized agent.

R21 or R21SP can also deny the request if either company does not hold any personal data about
the individual which falls within the scope of GDPR. This European Privacy Notice applies only
to European data subjects and the scope of data covered by applicable European laws.

Right to Rectification.
In accordance with the GDPR requirements, European data subjects may contact R21 or R21SP to
change, correct, or add to the information they have about them if they think that the data they
collected is incorrect or incomplete. Upon proper verification of the European data subject and
proper request, R21 or R21SP will rectify the errors, if any. If the personal data was made public

Page 13 of 16
alex
alex
 or shared with third parties, R21 or R21SP will make efforts to communicate to the third party the
need to rectify the personal data.

Upon completion of rectification, R21 or R21SP will contact the European data subject promptly.

Right to Erasure
European data subjects have the right to request erasure of their personal data, and can make the
request directly to us in his or her individual capacity or through an authorized agent. They can do
so by exercising that right through one of the other options identified in the Contact Methods
section of this Notice.

R21 and R21SP are not obligated to erase personal information if they are required or permitted
to retain such information in accordance with one of the exemptions in the GDPR. Individuals who
exercise their right to request deletion directly or through an authorized agent will be subject to
verification in accordance with the GDPR requirements. Valid reasons for the erasure are:

a. The personal data are no longer necessary in relation to the purposes for which they were
collected;
b. The European data subject withdraws consent;
c. The European data subject objects to the processing;
d. The personal data was unlawfully processed;
e. There are existing legal obligations; or
f. The personal data have been collected in relation to the offer of information society services.

When R21 or R21SP process a request for erasure from a verified European data subject, they will
delete the data from their systems in a secure and irreversible manner, to prevent the data from
being restored. To the extent that R21 and R21SP have entrusted any of the personal data of the
European data subject to a third party, they will also contact that third party to process the erasure
request and will confirm to the European data subject or the agent that they have done so. If the
data was made public, R21 or R21SP will take reasonably steps to inform other controllers of the
data that the data subject has requested the erasure.

Upon completion of erasure, R21 or R21SP will contact the European data subject promptly.

Right to Restrict of Processing

European data subjects have the right to restrict the processing of their personal data in order to
effectuate other rights or to effectuate the right to restrict processing in and of itself. When the
restriction is effectuated, R21 and R21SP will not process the personal data objected to with the
exception of storage, only to be processed with the data subject’s consent or for the establishment,
exercise, or defense of legal claims, or for the protection on the rights of another natural or legal
person. This right may be restricted further as the law demands.

A European data subject who has obtained restriction of processing will be informed by the Data
Protection Officer before the restriction if processing is lifted.

Page 14 of 16
alex
alex
 Right to Object to Processing
European data subjects may object, on grounds relating to his or her particular situation, at any
time. At which point, R21 or R21SP will cease processing of personal data concerning him or her
unless they can demonstrate compelling, legitimate grounds for the processing.

Please do note that R21 and R21SP may not adhere to objections to processing of data if the
processing is necessary for the performance of a task carried out for reasons of public or national
interest.

Right to Data Portability

European data subjects can request R21 and R21SP to transfer the personal data they have on them
to the desired institution or person where technically feasible.

Upon completion of transfer, R21 or R21SP will contact the European data subject promptly.

Response and Completion Times

R21 and R21SP will acknowledge, respond, and complete the requests to exercise the above Rights
within one calendar month of receipt, and provide the information requested by the verified
European data subject. If a reasonable delay is necessary, R21 or R21SP will contact the European
data subject of the delay. The period may be extended up to two additional months if necessary to
respond to the requests.

Exceptions to the Rights

GDPR provides certain instances when R21 and R21SP do not have to comply with a request to
exercise GDPR rights. Such instances include: national security, defense, public security, the
prevention and investigation of crime, protection of judicial independence and judicial proceedings,
prevention, investigation, detection, and prosecution of breaches of ethics for regulated professions,
enforcement of civil law claims, or other important objectives of general public interest.

Contact Methods
R21 and R21SP are e-commerce entities with no physical storefront. They exclusively operate
through their websites or other online methods, and they have direct relationships with their
customers. You can email or mail them to exercise your rights. When you email your request,
please write “My European Privacy Rights” in the subject field and identify as to who you are.
R21 and R21SP are not responsible for notices that are not properly labeled or sent. When you
mail your request, please write “My European Privacy Rights” on the header. If you believe R21
or R21SP is in breach of GDPR, you may contact your proper Commission.

In order to contact R21 or R21SP to exercise your rights as an individual in Europe, you can mail
or message them through the following:

Rocket21challenge, LLC
Attn: Data Protection Officer, Carlos Rico-Ospina, Jr
2140 South DuPont Hwy
Camden, Delaware 19934
Email Address: support@rocket21challenge.com

Page 15 of 16
alex
alex
 Rocket 21 Challenge, SP
Attn: Data Protection Officer, FG Services Limited
Suite 2206, Cassia Court
72 Market Street
Camana Bay
P.O. Box 30869
Grand Cayman KY1-1204
Cayman Islands
Email Address: R21SPmanagement@gmail.com

Page 16 of 16
alex
alex