Candidate Privacy Policy

Last revised 9/01/2023

This Candidate Privacy Policy (“Policy”) explains how Claroty Ltd. and its subsidiaries (collectively, “Claroty,” “we,” or “us”) collect, use, and protect information during our application and recruitment process. Your use of our services is governed by any applicable terms and our Privacy Policy.

What Information Do We Collect?

Subject to applicable law, we may collect personal information from you during the application and recruitment process, including:

- Your name, physical address, email address, telephone number and other contact information

- Your resume, CV, cover letter, previous and/or relevant work experience or other experience, education, transcripts, or other information you provide

- Information from interviews and phone-screenings

- Details related to any current or potential career opportunities, current and/or desired salary and other terms relating to compensation and benefits packages, and other job preferences

- Sensitive and/or demographic information processed during the application and recruitment process such as your gender, citizenship and/or nationality, medical or health information, and/or racial or ethnic origin;

- Reference information and/or information received from background checks (where applicable), including information provided by third parties;

- Information from publicly available sources, such as social media platforms (e.g. your social media handle) and professional networking sites (e.g. your LinkedIn profile) that we believe is relevant to your application or a potential future application; and/or

- Information related to any assessment you may take as part of the interview screening process.

How Do We Collect and Use Your Information?

We use your information for the purposes of carrying out our application and recruitment process to:

- Assess your skills, qualifications and interests related to our career opportunities

- Verify your information, carry out reference checks, and conduct background checks

- Communicate with you about the recruitment process and/or your application(s)

- Prepare or submit reports as required under any local laws and/or regulations, where applicable

- Assist you with obtaining an immigration visa or work permit where required and requested by you

- Improve our application and recruitment process

- Comply with applicable laws, regulations, legal processes or enforceable governmental requests; and/or

- Conduct research about your educational and professional background and skills and contact you if we think you would be suitable for a role with us

We will also use your information to protect our rights and property, our users, applicants, candidates, employees or the public as required or permitted by law.

If you are offered and accept employment with us, the information collected during the application and recruitment process may become part of your employment record.

Legal Basis for Processing Personal Information (EEA Visitors Only)

We typically collect or use personal information from you or others where it is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms, or where applicable, where we have obtained your consent to process for a specific purpose. We may have a legal obligation to collect or retain personal information or need the personal information to protect your vital interests or those of another person. When we process sensitive personal information about you, we will make sure that one or more of the lawful bases for processing sensitive personal information, as described in this Policy, applies.

How We Share Your Personal Information

We may share your information with our affiliates, subsidiaries or joint ventures in the United States and in other jurisdictions for the purposes described in this Policy. If you have been referred for a job at Claroty by a current Claroty employee, with your consent, we may inform that employee about the progress of your application and let the Claroty employee know the outcome of the process. In some cases, if it is identified that you have shared the same previous employer during the same period as a current Claroty employee we may consult with that employee for feedback on you.

We may also use service providers acting on our behalf to perform some of the services described above including for the purposes of the verification or background checks. These service providers may be located outside the country in which you live or the country where the position you have applied for is located.

We may sometimes be required to disclose your information to external third parties such as to local labor authorities, courts and tribunals, regulatory bodies and/or law enforcement agencies for the purpose of complying with applicable laws and regulations, or in response to a legal process.

We will also share your personal information with other third parties if we have your consent (for example if you have given us permission to contact your referees), or to detect, prevent or otherwise address fraud, security or technical issues, or to protect against harm to the rights, property or safety of us, our users, applicants, candidates, employees or the public or as otherwise required by law.

It is your responsibility to obtain consent from references before providing their personal information to us.

We operate globally, which means your information may be stored and processed outside of the country or region where it was originally collected including in the United States. In some of these countries, you may have fewer rights in respect of your information than you do in your country of residence. Regardless of where your information is processed, we apply the same protections described in this Policy. We also comply with certain legal frameworks relating to the transfer of data, such as the European frameworks.

The European Commission has determined that certain countries outside of the European Economic Area (EEA) adequately protect personal data. You can review current European Commission adequacy decisions on the Commission website. To transfer data from the EEA to other countries, such as the United States, we comply with legal frameworks that establish an equivalent level of protection with EU law. The European Commission has approved the use of model contract clauses as a means of ensuring adequate protection when transferring data outside of the EEA. By incorporating model contract clauses into a contract established between the parties transferring data, personal data is considered protected when transferred outside the EEA or the UK to countries which are not covered by an adequacy decision. We rely on these model contract clauses and your consent for data transfers.

We take appropriate steps to protect information about you that is collected, processed, and stored as part of the application and recruitment process.

Retaining Personal Information

If you apply for a job at Claroty and your application is unsuccessful (or you withdraw from the process or decline our offer), Claroty will retain your information for a period after your application. We will retain your personal information for as long as needed to fulfill the purpose for which we collected it and for a reasonable period thereafter in order to comply with audit, contractual, or legal requirements, or where we have a legitimate interest in doing so. We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. We may retain aggregated or de-identified data indefinitely, or to the extent allowed by applicable law, as such information would not be considered personal information.

If you do not want us to retain your information for consideration for other roles, or want us to update it, contact HR@claroty.com. Please note, however, that we may retain some information if required by law or as necessary to protect ourselves from legal claims.

Data Privacy Rights

In certain countries, you may have certain rights under data protection law. This may include the right to request access or to update or review your information, request that it be deleted or anonymized, or object to or restrict Claroty using it for certain purposes.

If you wish to exercise a right of access please contact privacy@claroty.com. We will respond to any requests in accordance with applicable law, and so there may be circumstances where we are not able to comply with your request.

If you are in the EEA, the UK or Brazil and if you can’t find the answer to your question in this Policy, you can contact Claroty at privacy@claroty.com. Depending on your country of residence, you may also raise any questions or concerns you have regarding your personal information with your local data protection authority.

Residents of the United States

California and Virginia Residents

Under the California Privacy Rights Act (‘CPRA’) and Virginia Commonwealth Data Protection Act (‘CDPA’), residents of California and Virginia have certain rights regarding the personal information that businesses collect and process about them. This includes the rights to request access or deletion of your personal information, as well as the right to direct a business to stop selling or sharing your personal information.

We are required to detail the categories of personal information we collect and/or share. The details of categories of personal information we collect and/or share are included in this Policy.

We collect, and in the past 12 months have collected, the following categories of personal information for our business purposes:

- Identifiers and similar information, such as your name, phone number, and address; username and password; and unique identifiers tied to the browser, application, or device you’re using.

- Demographic information, such as your age, gender, and language(s) spoken. If you choose, you may also provide additional information, like your racial or ethnic origin, religious or philosophical beliefs, trade union membership, sexual orientation, or gender identity.

- Financial information, such as your current and/or desired salary and other terms relating to compensation and benefits packages.

- Information collected by cookies and other technologies, including IP address. - Internet or other electronic network activity information, including app log information, content you view or engage with, and app, browser and device information.

- Audio, electronic, visual, and similar information, such as information transmitted in connection with interviews or phone-screenings you may have, if any.

- Communications data, such as emails that you may send or receive in connection with the application or recruitment process.

- Health information, if you choose to provide it, in connection with the application or recruitment process, such as data you may provide in connection with an accommodations request.

- Professional, employment, and education information, such as information you provide in connection with the application and recruitment process, as well as information Claroty may otherwise collect through reference checks, criminal and financial background checks (where applicable) and information from publicly available sources, including online, that may be relevant.

- Other information you create or provide, such as the content you create, upload, or otherwise provide in connection with the application and recruitment process. - Inferences drawn from any of the above categories of personal information.

While we do not sell personal information in exchange for any monetary consideration, we do share personal information for other benefits as defined by Cal. Civ. Code 1798.140(ad)(2). We have shared in the preceding 12 months personal information as necessary for specific “business purposes,” as defined by Cal. Civ. Code 1798.140(e) and as specified in this Policy, including:

- Administrative purposes: We use and may disclose information for purposes related to carrying out our application and recruitment process, including for assessing candidates; verifying information and conducting reference checks and criminal and financial background checks; communicating with you; responding to your requests for assistance with obtaining an immigration visa or work permit (where required); diversity, equity, inclusion and belonging; and other related activities.

- Protecting against security threats, abuse, illegal activity, and violations: we use and may disclose information to detect, prevent and respond to security incidents, and for protecting against other malicious, deceptive, fraudulent, or illegal activity.

- Research and development: we use information to improve our application and recruitment process, including improving diversity in recruitment practices.

- Use of service providers: we share information with service providers to perform services on our behalf, in compliance with this Policy and other appropriate confidentiality and security measures. For example, we may rely on service providers to help perform criminal and financial background checks.

- Legal reasons: we also use information to satisfy applicable laws or regulations, and disclose information in response to legal process or enforceable government requests, including to law enforcement.

We may share your information with the following parties:

- Other people with whom you choose to share your information, such as the content you create, upload, or otherwise provide in connection with the application and recruitment process.

- Third parties with your consent, for example if you have given us permission to contact your references.

- Service providers, trusted businesses or persons that process information on our behalf, based on our instructions and in compliance with this policy and any other appropriate confidentiality and security measures.

- Law enforcement or other third parties, in response to legal process or enforceable government requests, and as necessary to identify, report on and investigate violations of applicable laws and regulations.

For more information on how to exercise your rights, including the list of privacy rights that may be available to you, or to access, review, update, correct, delete any personal information we hold about you, or exercise any other privacy rights available to you, including the right to opt out from selling or sharing your personal information, please contact us at privacy@claroty.com.

We aim to respond to your request within the required timeframes. If we need more time, we will inform you of the reason and extension period in writing. We will reply to you by mail or email, at your option. We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Right to Appeal – California and Colorado

If we do not take action on your request within the 45-day response period, or in the event of an extension, within the maximum 90-day response period, we will inform you in writing of the reasons for not taking action, as well as provide an explanation of any rights you have to appeal the decision.

Right to Appeal – Virginia and Connecticut

You have the right to appeal a refusal to take action on a request within a reasonable period of time after your receipt of our decision. Within 60 days of receipt of an appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, you will be provided with a method through which you may contact the Attorney General of Virginia (if you are a Virginia resident) or Attorney General of Connecticut (if you are a Connecticut resident) to submit a complaint.

California and Delaware “Do Not Track” disclosures

Privacy regulations in the United States, such as the laws of California and Delaware, require us to indicate whether we honor your browser’s “Do Not Track” settings concerning targeted advertising. Claroy adheres to the standards set out in this Policy and does not monitor or respond to Do Not Track browser requests.

Candidate Policy Changes

We may update this Policy from time to time to reflect changes to our information practices. For the latest information on our privacy practices, we encourage you to periodically review this Policy

Contact Us

If you have any questions about this Policy, please contact us at:

Claroty Ltd.

82 Yigal Alon Street

Building Suzuki, Floor 10-11,

Tel Aviv-Yafo, Israel 6789124

HR@claroty.com