CANDIDATES PRIVACY NOTICE

Last updated: October 11, 2026

Please note that any reference in this notice to “Lema”, “we”, “us”, or “our” refers to the Lema entity that is responsible for the recruitment process for the role you apply for. Where relevant, this may include Lema Inc. and Lema Ltd., together the “Lema Group”. This Candidate Privacy Notice (“Notice”) describes how Lema collects, uses, shares, and otherwise processes your personal data in connection with your candidacy and the recruitment process.

In connection with your application for a position with Lema, Lema needs to process certain personal data in order to assess your application, communicate with you during the recruitment process, and comply with legal and regulatory obligations. There are also statutory and other requirements we have to comply with in relation to your application. If we are not able to carry out certain processing activities described in this Notice, we may not be able to process your application.

This Notice is intended to inform you about the types of personal data Lema may collect, process, and use about you as a candidate, the circumstances in which your data may be used, and your rights regarding your personal data and how you can exercise them.

This Notice does not form part of any contract of employment or other contract for services, and we may update it from time to time, including where we implement new systems or processes involving personal data. Subject to applicable law, providing your personal data is generally voluntary, except where we are required by law to obtain certain information. However, if you do not provide certain personal data requested by us, we may be unable to assess your application, continue the recruitment process, or, where applicable, enter into an employment relationship with you. Where we rely on your consent, you may withdraw it at any time, subject to applicable law. Important note: Nothing in this privacy notice is intended to limit in any way your statutory rights, including your rights to a remedy or means of enforcement.

1. WHAT PERSONAL DATA WE COLLECT AND PROCESS

The types of personal data we collect include, among others: your full name, address, email address, phone number, date of birth, CV/resume, LinkedIn profile URL, personal website, cover letter, portfolio, employment and education history, academic records, professional qualifications, references, and other information you provide during interviews or assessments. We may also collect information generated during the recruitment process, such as interview notes, assessment results, communications with you, interview audio or video recordings, transcripts, AI-generated summaries or suggested notes, and background check results (where permitted by law). If you receive and accept an offer of employment with Lema, you may be asked to provide additional proof of your identity and, in some jurisdictions, proof of your right to work (failure to provide this will mean that the company is unable to hire the applicant).

2. FOR WHAT PURPOSE WE PROCESS THE PERSONAL DATA

• To assess, review, and verify your suitability for current or future employment opportunities with Lema and to take steps at your request prior to potentially entering into an employment relationship.
• To verify the information you provide during the recruitment process, to assess eligibility for the role, and, if applicable, to determine whether to make an offer of employment. Any offer and commencement of employment may be conditional on verification of the information provided by the candidate and the receipt of satisfactory references, to the extent permitted by applicable law.
• To conduct appropriate pre-employment checks and related inquiries, whether directly or through a service provider acting on our behalf, to the extent permitted by applicable law. These checks may include CV or resume review, employment history verification, education verification, reference checks, proof of relevant qualifications, professional membership checks, and public-source or media searches, which may include professional networking platforms and search engine searches. Artificial intelligence tools may assist us with organizing, matching, flagging, or summarizing information generated through these checks, and the HR team will review such recommendations and insights. No AI automatic decision-making is being done by these tools. If a candidate does not provide personal data required for these checks, we may be unable to continue the recruitment process or employ the candidate.
• To improve our recruitment processes, hiring practices, systems, and candidate experience, including by maintaining appropriate records, reporting, and internal administration.
• To manage and administer the recruitment process, including through the use of email providers, applicant tracking systems, candidate management systems, recruitment platforms, assessment providers, scheduling tools, HR-related platforms, and similar tools or services. This may include recording and transcribing interviews, to the extent permitted by applicable law, for purposes such as note-taking, evaluation, quality assurance, consistency in candidate assessment, and internal recordkeeping. Some of these tools may include artificial intelligence features that assist with recruitment administration, organization, screening support, note-taking, workflow management, candidate communications, and decision support. Any such use is subject to the disclosures, choices, safeguards, and jurisdiction-specific rights described in Section 4 below. We do not make final hiring decisions based solely on automated processing unless expressly permitted by applicable law and appropriately disclosed.
• We do not generally seek to collect sensitive personal data or special categories of personal data about candidates unless this is necessary for lawful recruitment, employment, diversity, accommodation, security, or legal compliance purposes, or where the candidate chooses to provide such information. Where required by applicable law, we will process such data only on an appropriate legal basis and subject to suitable safeguards.
• If the applicant has any questions, they can contact gilly.noyman@lema.ai.

3. The lawful bases we rely on for processing personal data are (if and when applicable):

1. The data subject has given consent to the processing of his or her personal data;
2. Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
3. processing is necessary for compliance with a legal obligation to which the controller is subject; and/or
4. Processing is necessary for the purposes of legitimate interest.

4. HOW DO WE COLLECT THIS INFORMATION?

In most cases, Lema collects personal data directly from the candidate during the recruitment process. We may also collect personal data from other members of the Lema Group (which include our subsidiaries and affiliates), recruitment agencies, referrers, references, background check providers, publicly available sources such as professional networking sites (e.g., LinkedIn), and, to the extent permitted by applicable law, sanctions or other lawful sources. Our recruitment process is not intended for individuals under the age of 18.

5. WITH WHOM DO WE SHARE YOUR PERSONAL DATA?

In certain cases, we may share your personal data with the following recipients for the recruitment, employment-related, legal, administrative, and other purposes described in this Notice:

• Group Companies: We may share your personal data with other entities of the Lema Group, including entities located in other countries (for example, Israel or the United States).
• Legal and Regulatory Disclosure: We may share your personal data with regulators, courts, banks, or other competent authorities where required by law, to comply with a legal obligation, or to protect our legitimate rights, property, or the safety of our employees, candidates, customers, or others, provided there is no legal reason preventing such sharing.
• Vendors and Service Providers: We may share your personal data with, or allow access to it by, vendors and service providers that assist us with the recruitment and employment process, including email providers, applicant tracking systems, candidate management systems, recruitment platforms, assessment providers, scheduling tools, HR-related platforms, background check providers, and similar tools or services, including those that incorporate AI-enabled features to support our recruitment activities. Depending on the context, these recipients may process personal data on our behalf or as independent recipients as permitted by applicable law.
• Corporate Transactions: If, in the future, we sell or transfer, or consider selling or transferring, some or all of our business, shares, or assets to a third party, we may disclose your personal data to that third party, whether actual or potential, in connection with such transaction, including to current or potential investors.
• Merger, Acquisition, or Insolvency: If we are acquired by, merged with, a third party entity, or become subject to bankruptcy or a comparable event involving a third party entity, we may transfer, disclose, or assign your personal data in connection with such event.

Lema will use commercially reasonable efforts and appropriate contractual, technical, and organizational measures to make sure that an appropriate level of protection applies to your personal data, including where personal data is transferred internationally, as required by applicable law.

6. HOW LONG WILL LEMA KEEP PERSONAL DATA FOR?

The applicant’s information will be retained in accordance with Lema’s retention practices and applicable law.

If you are not hired, we may retain your personal data for up to one (1) year after the relevant recruitment process ends in order to comply with legal obligations, resolve disputes, defend against claims, maintain records, and, where permitted, consider you for future opportunities, unless you object or request deletion where such rights are available under applicable law.

If you join Lema, relevant personal data collected during the recruitment process may become part of your employment record and be retained in accordance with the applicable employee privacy notice and retention requirements.

We may retain personal data for longer where required or permitted by law, including for legal, regulatory, tax, accounting, or litigation-related purposes.

7. DATA SECURITY.

Lema implements appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, misuse, alteration, or disclosure. These measures are designed to ensure a level of security appropriate to the risks presented by the processing of your personal data. Access to your personal data is limited to those who have a business need to know and are subject to confidentiality obligations.

8. DATA TRANSFERS.

Your personal data may be processed in countries and jurisdictions other than your country of residence, including in connection with international transfers of your personal data. Where we transfer your personal data outside your country of residence, we will take appropriate measures to ensure that it is protected in accordance with applicable privacy laws. Such measures may include transferring personal data to countries recognized as providing an adequate level of protection, entering into appropriate contractual safeguards, or relying on another valid transfer mechanism permitted by applicable law.

9. WHAT RIGHTS DO I HAVE IN RESPECT OF MY PERSONAL DATA?

The following rights (which may be subject to certain exemptions or derogations) shall apply to certain individuals (some of which only apply to individuals protected by specific laws):

1. You have the right to request access to your personal data held by us, along with details on how it is processed, subject to certain conditions. You have the right to demand rectification of inaccurate personal data about you. We will promptly correct any information found to be incorrect.
2. You have the right to object to unlawful data processing under certain conditions.
3. You have the right to the erasure of past personal data about you (your “right to be forgotten”) under certain conditions.
4. You have the right to demand that we restrict the processing of your personal data, under certain conditions, if you believe we have exceeded the legitimate basis for processing, the processing is no longer necessary, or if you believe your personal data is inaccurate.
5. You have the right to receive certain personal data you provided to us in a structured, commonly used, and machine-readable format and, where applicable, to request its transfer to another party.
6. Where we rely on your consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
7. You have the right not to be subject to a decision based solely on automated processing, including profiling (to the extent that we perform any such processing activities).
8. You have the right to lodge a complaint with the relevant supervisory or regulatory authority.
9. Depending on your jurisdiction, applicable law and the manner in which we use AI in connection with your application, you may have certain additional rights, including the right to: (a) withdraw any consent you have provided to the use of AI-assisted processing at any time, including consent to the recording or analysis of video interviews; and (b) request the deletion of any interview recording and associated AI-generated outputs.

If you wish to exercise any privacy rights available to you under applicable law, or if you have concerns or questions regarding this Notice, you can contact us at gilly.noyman@lema.ai. We will review and respond to your request in accordance with applicable law. In order to verify your identity or authority to make the request, we may ask for additional information before processing your request. We will not discriminate against you for exercising privacy rights available to you under applicable law.

10. CAN LEMA UPDATE THIS NOTICE?

We reserve the right to update this Notice at any time, and we will provide you with a new Notice when we make any substantial updates and take any additional steps as required by applicable law.

11. WHO CAN I CONTACT ABOUT THIS?

If you have concerns or questions regarding this Notice or if you would like to exercise your rights in relation to your personal data, you can contact us at gilly.noyman@lema.ai.