CANDIDATES AND EMPLOYEES PRIVACY NOTICE

 TL;DR: We’re here to protect you and your personal information, just like we protect our company.

 This is just a summary — to see the full policy, please scroll down.

1. Information We Collect

We collect and process various categories of personal data, collectively called “Employee Data” (for

employees) or “Candidate Data” (for job applicants). This information is necessary to manage our

employment relationship, comply with legal requirements, and support your well-being at work.

This may include:

• Identification & Contact Data: Name, photo, ID number, citizenship, date of birth, business, personal and emergency contact information.
• Professional & Job Record Information: CV , job details, training, start/end dates, background checks, etc.
• Financial & Benefits Information: Salary, bank info, taxes, insurance, equity, etc.
• Performance & Disciplinary Information: Performance reviews, ratings, etc.
• Absence & Health Information: Sick/vacation days, parental leave, accommodations, etc.
• System Use & Organizational Data: Company accounts, emails, IT system usage etc.
• Marketing Information:Photos, job title, stories.
• Other Information: Any other reasonable information you choose to provide that is necessary for managing the employment relationship, legal compliance, and/or ensuring your well-being.

2. Why We Use This Information (Processing Purposes)

We use your personal data for a variety of reasons linked to your employment:

• Administering Compensation & Benefits: Managing payroll, stock options, bonuses, insurance benefits, and other work-related allowances.
• Managing the Workforce: Performance, team management, travel, talent management, leave approvals, and providing references.
• Fulfilling Legal Obligations: Taxes, immigration, and compliance with laws.
• IT & Business Operations: Provide tools, keep systems safe, and enforce policies.
• Communication: Contact info for work and emergencies.
• Finance & Audits: Budgeting, reporting, compliance.

3. Who We Share Information With

We may transfer your personal data to third parties for the processing purposes described above:

• Inside Astrix: Other Astrix offices/entities.
• Trusted Providers: Payroll, IT, benefits partners.
• Customers & Partners: Work contact info as needed.
• Authorities: Regulators, courts, tax offices, insurers.
• M&A: In case of sale, merger, or restructure.

4. How We Protect Your Information

We keep your personal data only for as long as is necessary for the Processing Purposes or as required by applicable local law. We make transfers of data outside of your country of residency/work in compliance with applicable law (e.g., by implementing suitable safeguards).

5. Your Rights

You have a number of rights in relation to your personal data, which may include:

• Access: Requesting access to the personal data processed about you.
• Information: Know why data about you is used & who it’s shared with.
• Fix/Delete: Correct or remove data (where possible).
• Object: Say no to automated decisions.
• Compensation: For unlawful processing.

To exercise these rights or for any questions, you can contact us at [email protected].

6. Updates to This Notice

We reserve the right to update this Notice at any time. We will provide you with a new Notice when we make any substantial updates.

ASTRIX

CANDIDATES AND EMPLOYEES PRIVACY NOTICE

Last time updated: September 30, 2025

Please note that any reference in this notice to the “Company”, “Astrix”, “we”, “us”, “our” refers to the Astrix Group of companies, which includes Astrix Security Ltd. and Astrix Security Inc. (as the relevant company of AstrixAstrix identified in your employment contract) prepared this Employee Privacy Notice (“Notice“) to be provided to you as Astrix’s employee and job candidates.

In connection with your employment, we have to process your personal data. In that context, Company will be a database owner, which means that Company will be responsible for the processing of your personal data.We know that the fact that we will need to use your personal data may be quite obvious to you. However, the purpose of this Notice is to give you information about the sorts of personal data we may collect, process and use about you, and the circumstances in which we may use it.

Astrix needs to process certain personal data in order to enter into our contract of employment with you and to continue to perform crucial aspects of your contract of employment such as paying you and providing you with benefits. There are also statutory requirements and other contractual requirements we have to comply with in relation to your employment. If we are not able to carry out certain processing activities we describe in this Notice we may not be able to comply with your

contract of employment, and in certain very exceptional cases, may not be able to continue your employment. Of course, we hope it would never come to that, and we will attempt to discuss this with you first ever becomes a real possibility, but this is information that we are obliged to provide you with, as part of this Notice.

In addition, you will see several references to “Company Group,” which includes all other Company entities globally.

As with many other Company policies, this document is not part of your contract of employment, and we may update it from time to time, for example, if we implement new systems or processes that involve the use of personal data.

When required by applicable privacy law, the main legal reason for processing your employee data is that data processing is mandatory for the legitimate interests of Astrix, provided that it does not harm your fundamental rights and freedoms. In addition, processing of your data being directly related to the establishment or performance of the employment contract, or the processing of personal data belonging to you being necessary and mandatory for Astrix to fulfill its legal obligation, as will be explained below, may also be legal grounds for the processing of certain personal data. In cases where we cannot process data without your explicit consent, the legal reason for the processing of your data will always be your explicit consent.

Important note: Nothing in this privacy notice is intended to limit in any way your statutory right, including your rights to a remedy or means of enforcement.

Candidates:

• Astrix collects and uses the candidates data for the purpose of considering and verifying your suitability for employment. Additionally, you are not obligated to provide us with the above-mentioned information, and you may refuse to do so.
• Any offer and commencement of employment is conditional on the verification, to the satisfaction of Astrix, of the information the applicant provides as part of their application and Astrix being able to obtain references with which it is satisfied. If the applicant receives and accepts an offer of employment with Astrix, they will undergo pre-employment screening and that this will involve verification of the details as specified below.
• Astrix or an independent agent acting on behalf of Astrix, may verify the information provided by you and carry out further enquiries which may include, a CV check (e.g., to call your previous employers) and gap analysis, a verification of your highest education, a reference check, a proof of relevant qualifications check, a professional membership check, a media search (which may include social media and search engine searches), as well as criminal background checks and credit ratings to the extent permitted by applicable law. If the applicant fails to supply personal data which Astrix requires in order to satisfy these checks Astrix might be unable to employ the applicant.
• Astrix requires this information as it is legally required to obtain it, it is necessary for Astrix to perform or exercise its rights and obligations under employment law and/or because it is in Astrix’s legitimate interests in its role as prospective employer to verify who they are, that they can work for Astrix and that they are suitable for the role they have applied for.
• Where the applicant’s personal history requires verifications to be carried out in countries where they have worked and resided, their data may be sent and processed in those relevant countries.
• The applicants information will be handled in accordance with Astrix’s Data Retention and Deletion Policy and may be shared with any member of Astrix’s group worldwide in the countries in which Astrix operates (in particular Israel and the US, where Astrix will use commercially reasonable efforts to implement suitable safeguards in place in respect of the privacy of their data such as via Astrix’s intra-group transfer agreement). Astrix may share their information with third parties (including, recruitment tools, vendors and service providers) or when it is required to disclose the data or in order to comply with any legal obligation or to protect its rights, property, or safety of its employees, customers, or others.
• If the applicant is successful in obtaining employment at Astrix: the other information which Astrix needs to keep in order to make further arrangements for their employment will be retained whilst their employment continues and as set out in Astrix’s Data Retention and Deletion Policy.
• In connection with Astrix’s processing of their personal data, the applicant has certain rights (amongst others that may be applicable under the applicant’s privacy law) to:
  1. ask to review the information held on him by Astrix.
  2. ask for rectification of inaccurate personal data and to have any incomplete data completed; the decision in such request will be according to Astrix ‘s judgment; and
  3. ask for erasure of personal data; the decision in such request will be according to Astrix’s judgment
• More information on these rights and how to exercise them is available below.
• If the applicant is not successful then any personal documents that they have submitted to Astrix or background check vendor (if applicable) will be confidentially destroyed in accordance with Astrix’s Data Retention and Deletion Policy.
• If the applicant has any questions, they can contact [email protected].

Employees:

1. What categories of personal data does Company collect about me?

Company will collect, process and use the following categories of personal data about you:

• Identification data, such as your name, ID’s photo and number, business email address, home address, business landline, citizenship, passport data, date and place of birth, social security number, signature, health insurance and governmental retirement plan information and tax references, as well as other government-issued identification information;
• Contact details, such as your home address, telephone number, email address and emergency contact details;
• Information about your spouses, such as your spouse’s name, phone number and other contact details.
• Professional experience information such as, information about your previous experience, e.g., CV information, cover letter, education, training history, portfolio, and any other relevant information that you decide to share with us;
• Information about your job record, such as position, business title, employee type, management level, time type (full or part time and percentage), work location, division, department, position level, manager (name & ID), support roles, start and end date, job history (including position history, title history, effective dates and past pay groups), CV or resume, qualification testing results, certifications, background check results, worker history (including log-files of changes in HR databases) and reason for leaving;
• Information about your salary, benefits, such as your basic salary, car allowance, bonus and commission entitlements, raise amounts and percentages, insurance benefits (including information about you and your dependents that we provide to the insurer), emergency contact, pension plans, tax code, your bank account details and payment dates, accrued salary information, information relating to your pension, or information that you provided while filling out tax refunds documents;
• Information about your equity compensation, such as units of stock or directorships held, details of all restricted stock units or any other entitlement to shares of stock awarded, cancelled, exercised, vested, unvested or outstanding in your favour;
• Performance and disciplinary information, such as performance reviews, evaluations, recordings and transcriptions of calls and interactions with Company’s customers, ratings, information about disciplinary allegations, the disciplinary process and any disciplinary warnings, details of grievances and any outcome;
• Absence Information, such as dates ofleave of absence/vacation, family leave, training/educational leave, family care leave, medical leave;
• Organisational data including IDs for IT systems, company details, cost centre allocations, and organisations;
• Information about use of and participation in company technology and communications systems; including, without limitation, software, hardware, cellular phone usage, and video and audio recordings, for the purpose of provide you with the relevant services to allow you to properly perform your work, to manage the Comapny data security and compliance with license terms, and for learning purposes;
• Personal data processed on our IT systems; including personal data contained in emails sent to/from employees and business partners, suppliers and customers and other third parties and in other documents processed on our systems;
• Personal data processed for marketing purposes; including photos from Company’s events, or other photos that you have provided, and other relevant details such as job title and description;
• Health and medical data, to the extent these can be shared with Astrix in accordance with the applicable laws, such as the number of sick days for purposes of salary payment, workforce planning, and compliance with legal obligations; information on work-related accidents for purposes of insurance compensation, work safety and compliance with legal obligations (such as reporting obligations); information on disability for purposes of accommodating the work place and compliance with legal obligations, and information on maternity leave for purposes of workforce planning and compliance with legal obligations; records of allergies and sensitivities as well dietary preferences to ensure suitable meal provision; and
• Any other reasonable information you choose to provide us, which is necessary for managing the employment relationship, complying with legal obligations, and/or ensuring your well-beingrelevant to the employment relationship; together “Employee Data“.

2. Why does Company need to collect and process my Employee Data?

We collect and use this Employee Data for a variety of reasons linked to your employment. To help clarify these we have set out below a list of reasons why we collect and use this data (the “Processing Purposes“) along with examples of some of the Employee Data used for each of the Processing Purposes:

• Administering and providing compensation, including payroll bonus, stock options and other applicable incentives which involves the processing of identification data, contact details, information about your job, salary and benefits and equity compensation, performance and disciplinary information, absence information and organizational data;
• Administering and providing applicable benefits and other work-related allowances, including reporting of benefit entitlements and use which involves the processing of identification data, contact details, information about your job, salary and benefits and equity compensation, performance and disciplinary information, absence information and organizational data;
• Administering our workforce including managing work activities, providing performance evaluations and promotions, reviewing performance and customer interaction, producing and maintaining corporate organization charts, matrix management, entity and intra-entity staffing and team management, managing and monitoring business travel, carrying out workforce analysis, conducting talent management and career development, leave management/approvals, providing references as requested, and administering ethics and compliance trainings which involves the processing of identification data, contact details, information about your job, salary and benefits and equity compensation, performance and disciplinary information, absence information and organizational data;
• Facilitating the employee’s role, such as, for personnel in sales or support, disclosing their business contact information to a customer or potential customer;
• Providing IT systems and support to enable you and others to perform their work, to enable our business to operate, and to enable us to identify and resolve issues in our IT systems, and to keep our systems secure which involves processing almost all categories of Employee Data;
• Complying with applicable laws and employment-related requirements along with the administration of those requirements, such as income tax, social security deductions, and employment and immigration laws which involves the processing of identification data, contact details, information about your job, performance and disciplinary information, absence information and organizational data;
• Monitoring and ensuring compliance with applicable policies and procedures and laws, including conducting internal investigations, which involves the processing of identification data, contact details, information about your job, salary and benefits and equity compensation, performance and disciplinary information, absence information and organizational data, use of and participation in company technology and communications systems;
• Communicating with you, other Company employees and third parties (such as existing or potential business partners, suppliers, customers, end-customers or government officials) which involves the processing of identification data, contact details, information about your job and organizational data;
• Communicating with your designated contacts in the case of an emergency which involves the processing of contact details, information about your job and organizational data;
• Responding to and complying with requests and legal demands from regulators or other authorities in or outside of your home country which involves the processing of identification data, contact details, information about your job, salary and benefits and equity compensation, performance and disciplinary information, absence information and organizational data; and
• Complying with corporate financial responsibilities, including audit requirements (both internal and external) and cost/budgeting analysis and control which involves the processing of identification data, contact details, information about your job, salary and benefits and equity compensation, performance and disciplinary information, absence information and organizational data.

3. How do we collect this information?

In most cases, Company collects personal data directly from you. At times, Company may also receive personal data from other members of the Company Group, publicly available sources, a benefits provider, or other service providers involved in the Processing Purposes. For example, we typically collect Employee Data:

• during the recruitment process;
• at the start of employment;
• during the course of employment; and
• occasionally following termination of your employment.

In addition, we may receive personal information about you from non-publicly available sources, such as:

• recruitment consultants;
• former employers;
• our benefits providers; and
• medical experts.

As you can understand from the above Processing Purposes, certain Employee Data is required in order to enable us to meet certain legal obligations under applicable law. The remaining Employee Data that you provide to us or that we collect, is provide or collected based on your consent.

4. With who might Company share my personal data?

Company may transfer personal data to third parties, including to entities within and outside the Company Group located in any jurisdictions where Company Group entities are located, for the Processing Purposes as follows:

• Within the Company Group. As your Company employing entity is part of a wider group of affiliates, which all partially share management, human resources, legal, compliance, finance and audit responsibility, Company may transfer the Employee Data to, or otherwise allow access to, such data by other entities within the Company Group, which may use, transfer, and process the data for the following purposes, consistent with applicable law: to maintain and improve effective administration of the workforce; to maintain a corporate directory; to maintain IT systems; to monitor and assure compliance with applicable policies and procedures, and applicable laws; and to respond to requests and legal demands from regulators and other authorities, and as otherwise required or appropriate for the Processing Purposes.
• Communication with third parties. As necessary in connection with business operations, work contact details, communication contact details and other personal data may be transferred to existing or potential business partners, suppliers, customers, end-customers or government officials and other third parties as appropriate for the particular business operation.
• Regulators, authorities, and other third parties. As necessary for the Processing Purposes described above, personal data may be transferred to regulators, courts, and other authorities (e.g., tax and law enforcement authorities), independent external advisors (e.g., auditors and legal advisors), Directors within the Company Group, insurance carriers, benefits providers, internal compliance and investigation teams (including external advisers appointed to conduct internal investigations).We will share your personal information with third parties where required by law, where it is necessary to administer the working relationship with you or where we have another legitimate interest in doing so.
• Acquiring entities. We may share your personal information with other third parties, for example in the context of the possible sale, restructuring or transfer, of some or all of the business, shares or assets to a third party.
• Bankruptcy. In the event of bankruptcy or a comparable event, we reserve the right to transfer, disclose or assign your personal data in connection with the foregoing events.
• Service providers. As necessary for the Processing Purposes described above, personal data may be shared with one or more third parties, whether affiliated or unaffiliated, to process personal data under appropriate instructions (“Service Providers“). For example, the Service Providers may carry out instructions related to workforce administration, IT system support, payroll and compensation, training, compliance, and other activities relevant to the Processing Purposes, and will be subject to appropriate contractual obligations.

Some of the recipients with whom we may share Employee Data, as described above, may be located in countries outside of your country of residency and/or palcement of work. In such cases, we make the transfers in compliance with the applicable law (e.g.,the recipient’s undertaking to take sufficient measures to ensure the privacy of the data subject).

5. How long will Company keep my personal data for?

It is our policy not to keep personal data for longer than is necessary for the Processing Purposes. We may, for example, keep your personal data for a reasonable time after you have left to ensure that any ongoing obligations can be complied with. Where personal data is kept beyond the time that we normally would need to keep it, that period will be determined based on the applicable local law.

6. What rights do I have in respect of my personal data?

You have a number of rights in relation to your Employee Data. Such rights can be summarized in broad terms as follows (you may have additional rights under applicable law):

(i) Right of access

You may have the right to request access to personal data processed about you. We do have to take into account the interests of others though, so this is not an absolute right, and in some cases permitted by law we may charge a fee.

(ii) Right to Information

You have a right to learn the purpose of processing of the personal data and whether data are used in accordance with their purpose and to know the third parties in the country or abroad to whom personal data have been transferred.

(iii) Right to rectification and erasure

In limited circumstances, you may have the right to rectify or request to erase inaccurate, not-updtaed or incomplete personal data concerning you. You may also request notification of the relevant rectification or erasure to third parties to whom your personal data have been transferred.

(iv) Right to Object and Compensation

You have a right to object to occurrence of any result that is to your detriment by means of analysis of personal data exclusively through automated systems and request compensation for the damages in case you incur damages due to unlawful processing of personal data.

7. Can Company update this Notice?

We reserve the right to update this Notice at any time, and we will provide you with a new Notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.

8. Who can I contact about this?

If you have concerns or questions regarding this Notice or if you would like to exercise your rights as a data subject, you can send an email at [email protected].