Depending on whether you are a candidate or an employee, Terra may collect some or all of the following categories of Personal Data:

• Identification data, such as your name, title, employee ID, contact information, citizenship, photos, passport or ID details (including Teudat Zehut), date and place of birth, signature, tax details, and other government issued identification information.
• Contact details, such as home address, phone numbers, email addresses, and emergency contacts.
• Recruitment information, including your CV, cover letter, references, right to work documentation, background checks (where permitted), academic records, and information gathered during the hiring process.
• Employment records, such as job titles, work history, working hours, attendance, leave and absence information, training records, professional memberships, and workplace location.
• Salary and benefits information, including salary, bonuses, commissions, equity grants, insurance and pension information (including data about dependents provided to insurers), tax status, bank account details, and payroll records.
• Equity compensation information, such as stock units, options, vesting status, and director or shareholder information where relevant.
• Performance, disciplinary, and grievance information, including performance reviews, evaluations, warnings, investigations, and related outcomes.
• Absence information, such as vacation, family leave, medical leave, educational leave, and similar absences.
• Organizational data, including IT system identifiers, department and cost center details, and internal organizational assignments.
• Use of company technology, including activity and usage data related to company systems, devices, software, communication tools, and audio or video recordings created in the course of work.
• IT system data, including personal data contained in emails, documents, and other materials processed or stored on Terra systems. Terra may monitor and review activity on company systems, in accordance with Terra’s policy and applicable law. Employees should not expect privacy in content stored or transmitted on company systems, except for folders clearly marked as “Personal”.
• Biometric data, such as fingerprints used for secure access and time and attendance systems. Such data is collected only for legitimate, defined purposes and with your informed consent, and is processed in accordance with Terra’s biometric data policy.
• Workplace security information, including data collected via security cameras placed only in appropriate areas and used solely for legitimate purposes such as safety and protection of company property.
• AI-based call and meeting recordings and transcriptions, including recordings retained for training purposes, quality assurance, documentation, compliance, and dispute prevention. Recordings are made with notice except where otherwise required by law.
• Health and medical data, to the extent permitted by law, such as sick leave information for salary and compliance purposes, work related accident reports, disability information for workplace accommodations, maternity leave data, and religious affiliation for salary or tax purposes.
• Other information relevant to your employment or candidacy, as required for legitimate business or compliance purposes.

Together, this information is referred to as “Personal Data.” In any event, such information shall be deemed personally identifiable information solely to the extent defined under the applicable privacy or data‑protection laws of your country of residency (for candidates) or country of employment (for employees).

‍

We collect and use your personal data for legitimate business, legal, and contractual purposes related to your candidacy or employment. Below is a simplified summary of the main processing purposes (“Processing Purposes”) and examples of the types of data used for each purpose:

• Recruitment, hiring, and onboarding. We use your data to evaluate your candidacy, verify qualifications and right‑to‑work documentation, conduct interviews and background checks (where permitted), set employment terms, and complete onboarding processes.
• Managing your employment and compensation. We process data needed to operate the employment relationship, including payroll, salary payments, bonuses, equity grants, benefits and insurance administration, pension plans, and updates required for tax and social‑security compliance in Israel, the U.S., or other relevant jurisdictions.
• Workforce administration and performance management. We use data to manage work schedules, assignments, organizational planning, attendance, leave administration, performance evaluations, promotions, training and development, and other day‑to‑day HR operations.
• Legal, regulatory, and compliance obligations. We process data to meet obligations under Israeli, U.S., and other applicable jurisdictions' employment, immigration, tax, safety, equal‑opportunity, and reporting laws, and to respond to lawful requests from regulators, courts, and government authorities.
• Workplace safety, security, and access control. This includes the use of security cameras (in appropriate areas only), access‑control systems, and biometric information (such as fingerprints), all processed strictly for defined and lawful purposes and only with clear notice and consent where required.
• IT, cybersecurity, and monitoring. We process personal data contained in or generated through Terra systems and devices to maintain information security, protect company assets, prevent unauthorized access, ensure compliance with IT policies, and support system operations. Monitoring is conducted in accordance with law and Terra’s policy.
• Business communications and operations. We use your data to communicate with you, internal teams, customers, partners, and authorities; support business travel; manage internal logistics; and operate core company functions. This may include limited use of photos or professional details when relevant for internal or external communications.
• Handling disputes, complaints, and legal claims. We use relevant data to investigate workplace concerns, manage disciplinary or grievance processes, and handle legal claims, insurance matters, or disputes involving employees or candidates.
• Health, safety, and accommodations. Where permitted by law, we process health‑related information needed for sick‑leave administration, workplace accommodations, safety reporting, and compliance with medical or equality‑related legal obligations.
• Internal analytics and planning. We may use aggregated or individual‑level data to conduct workforce analytics, plan staffing needs, and evaluate retention, attrition, or organizational structure, in accordance with applicable privacy laws.

How we collect your personal data

We collect most personal data directly from you – for example, through your job application, onboarding forms, or communications with us during your employment. We also receive personal data from other Terra Group entities, and from third parties such as recruitment agencies, former employers or references, benefits and equity-administration providers, background-check providers (where permitted by law), and other service providers that assist us in managing our workforce.

We typically collect personal data at the following stages:

• during the recruitment and hiring process
• at the start of your employment
• throughout your employment
• in limited cases, after your employment ends – for example, to meet legal, tax, or benefits-related obligations

Why we are permitted to process your personal data

We process your personal data only where we have a lawful basis for doing so. The legal bases we rely on are described below. Because this Notice applies across multiple jurisdictions, the specific legal framework will depend on your country of employment; however, the categories of basis are substantially consistent across the laws that apply to Terra Group.

1. Pre-contractual steps and performance of your employment agreement. For candidates, we process personal data that is necessary to take steps at your request prior to entering into an employment agreement – for example, to evaluate your application, conduct interviews, and make a hiring decision. For employees, this basis extends to the performance of the employment agreement itself, covering personal data such as contact details, compensation information, payroll data, job title and role information, and related HR administration. If you do not provide personal data that is necessary for these purposes, we may not be able to progress your application or, for employees, fulfil our obligations under your employment agreement.
2. Compliance with a legal obligation. We are required by law to process certain personal data, including for the purposes of labor law compliance, tax and social security reporting, occupational health and safety obligations, and anti-money laundering or other regulatory requirements. Even at the candidate stage, certain legal obligations may apply, for example, right-to-work verification or record-keeping requirements imposed by applicable employment or data protection law. Retention of employment and recruitment records for prescribed periods is also a legal obligation in the jurisdictions in which we operate. You cannot opt out of processing that is required by law.
3. Legitimate interests. We process some personal data on the basis that it is necessary for our legitimate interests as an employer, provided those interests are not overridden by your privacy rights. This includes, for example:
   
   1. evaluating candidates and maintaining a talent pipeline for future roles (for candidates)
   2. managing and improving internal operations, systems, and security
   3. protecting the Group's assets, confidential information, and IT infrastructure
   4. workforce planning and organizational management
   5. handling grievances, disciplinary matters, and legal disputes
   6. conducting internal investigations where necessary

Where we rely on legitimate interests, you may have the right to object to the processing. We will assess any such objection and inform you of the outcome.

4. Consent. In limited cases, we rely on your consent to process your personal data, for example when we offer optional wellness, health, or supplementary benefit programs, where participation (and the related processing of personal data) is entirely voluntary. Whenever we rely on consent, we will make this clear at the point of collection, and choosing not to provide consent will not affect your employment or any benefit to which you are entitled by law or under your employment agreement. You may withdraw your consent at any time by contacting Terra’s HR team, and doing so will not affect the lawfulness of any processing carried out before the withdrawal.

Terra keeps personal data only for as long as it is needed to fulfill the Processing Purposes described in this Notice. In some cases, we may keep certain information for a reasonable period after your employment or candidacy ends, for example to comply with legal, tax, audit, or contractual obligations. If we need to retain personal data for longer than our standard retention periods, the extended period will be determined based on applicable local law and legitimate business needs.

Your rights depend on the laws applicable in your country of employment (or, for candidates, your country of residency). A summary of rights that may apply to you is set out below. Where a right applies to you, you may exercise it by contacting us as described in Section 9.

• Right of access. You may have the right to request confirmation of whether we process your personal data and, if so, to receive a copy of that data, along with information about the categories of data processed, the purposes of processing, and the recipients or categories of recipients.
• Right to rectification / correction. You may have the right to request that we correct personal data about you that is inaccurate, incomplete, or out of date.
• Right to erasure / deletion. In certain circumstances, you may have the right to request that we delete personal data about you.
• Right to restriction of processing. You may have the right to request that we restrict how we use your personal data in certain circumstances (e.g., while the accuracy of data is being contested).
• Right to data portability. You may have the right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit it to another controller.
• Right to object. You may have the right to object to processing of your personal data, including processing carried out for legitimate interests.

These rights are not absolute. We may limit or decline a request where permitted or required by applicable law. For example, where retaining data is necessary to comply with a legal obligation (such as labor, tax, or social security law), to defend or conduct legal proceedings, or to protect the rights of other individuals. We will inform you of any such limitation and the reasons for it.

We may update this Notice from time to time. If we make any substantial changes, we will provide you with an updated version. We may also notify you through other appropriate means about changes relating to how we process your personal data.

You will not be subject to decisions that have a significant impact on you based solely on automated decision‑making, unless this is permitted by law and we have informed you in advance. At this time, Terra does not make employment‑related decisions using fully automated means. If this ever changes, we will notify you in writing before such processing begins.

If you have any questions about this Notice, or if you wish to exercise any of your rights as a data subject, you can contact us using the details below:

Terra Security Ltd.

Yehuda Halevi 34, Floor 5, Tel-Aviv

legal@terra.security