RECRUITMENT PRIVACY STATEMENT

Introduction

We at Cellebrite DI Ltd. (the “Company”, “we”, “us”, “our”) respect your privacy.

This privacy notice (“Notice”) explains your rights concerning the Personal Information we hold about you. It also explains the policies and procedures we use regarding Personal Information you provide us, or that we collect and Process, during our recruitment process. We are committed to complying with applicable data protection laws, including the European General Data Protection Regulation (GDPR), the California Consumer Protection Act (CCPA) and the California Privacy Rights Act (CPRA), and the Israeli Privacy Protection Law, 1981, and to protecting our workforce’s privacy and their privacy rights.

This Notice applies to all Personal Information related to Candidates that is Processed by Company, whether in electronic format or in a structured filing system.

This Notice may be amended from time to time. We will post any change to this Notice on our website a reasonable period of time in advance of the effective date of the change.

The Company is the Controller of the Personal Information for the purpose of this Notice. We are located at 94 Shlomo Shmelzer Rd., Petah Tikva 4970602, P.O.B 3925, Israel and can be contacted through the Data Protection Officer, by following the link: https://cellebrite.com/en/privacy-data-inquiry/.

Definitions used in this Notice

  • “Candidate” or “You” – any applicant for a position at Company as a temporary, full-time or part-time employee, intern, contractor or contingent worker.
  • “Candidate Personal Information” or “your Personal Information” – any Personal Information related to Candidates.
  • “Controller” – the entity that determines the purpose and means of the processing of Personal Information of Individuals.
  • “GDPR” – The EU General Data Protection Regulation which came into effect on May 25, 2018.
  • “Identifiable Individual” – An individual who can be identified by reference to any identifier such as a name, identification number, location, or other identifiers (including online identifiers).
  • “Personal Information” – Any information relating to an identified Individual or identifiable Individual.
  • “Processor” – An entity that processes Personal Information on behalf of the Controller.
  • “Processing” – (and any variant of such term) – Any action taken on Processed Data such as collecting, recording, storing, organizing, altering, using, disclosing, transmitting or deleting, including if performed by automated means.

How we collect data and why

We will collect and Process Candidate Personal Information for the purpose of administering employment applications and for various necessary recruitment purposes prior to making a hiring decision and, where relevant, entering into an employment agreement.

Candidate Personal Information may include, but is not limited to, name, contact details, physical address, gender, date of birth, photograph, details of your qualifications, employment history, Information included in your CV or cover letter, job preferences, current and historic salary details together with salary expectations, details of your current benefit entitlements.

Personal Information may also include names and contact details for references. Please note that it is your responsibility to obtain consent from your references prior to providing us personal information about them and to inform them about the processing of their Personal Information, as described in this Privacy Notice.

Company may also collect Personal Information about Candidates from other third parties, subject to your consent or where required by law, including academic history, references supplied by former employers, information from employment background check providers and information from criminal records checks where necessary or required by law.

Company may collect this information in a variety of ways, including directly from Candidates, via hard copy and web-based application forms, from recruiters and recruitment agencies and through individual referrals.

When we are not legally required to collect your Personal Information, providing such information is voluntary and subject to your consent. However, please note that refusing to provide the required Personal Information may affect our ability to review your job application and make decisions regarding your employment with the Company.Should your application be successful, relevant data will be transferred to our HR information system in accordance with Company’s Workforce Privacy Notice.

Your Personal Information will be Processed for the purposes and on the legal bases detailed below. We may Process the Personal Information for additional purposes, provided that notice is provided to you, and provided that we receive your consent, if so required. Processing of your personal information may be carried out using advanced technological tools, including statistical inference and machine learning or artificial intelligence models.

Legal Basis for Processing

When a legal basis for processing is required under applicable law, our processing of candidate personal information is based on our legitimate interests in seeking new employees and considering job 3

applications, as well as our need to carry out the above processing of personal information in anticipation of potentially entering into contractual engagements with you.

We may retain and process your Personal Information for future job openings in accordance with applicable data protection laws. Our processing of your Personal Information for this purpose is based on our legitimate interests in identifying suitable candidates for potential future positions. You have the right to object to this processing at any time by contacting us at: https://cellebrite.com/en/privacy-data-inquiry/. We will retain your Personal Information only for as long as necessary for this purpose, in accordance with our data retention policy and applicable laws.

Sharing Processed Data

As a global corporate group, we may share your Personal Information with our offices or affiliates worldwide. All such entities are either governed by this Privacy Notice and are bound by appropriate confidentiality and data transfer agreements.

We may share Candidate Personal Information with others under any of the following circumstances:

  • With Processors and service providers engaged by us to provide services that require the use of Candidate Personal Information, including for purposes related to the recruitment process or for operational needs. Such Processors operate under our instruction. We ensure that any Processor we use takes adequate measures to protect your Processed Data, by signing a data processing agreement with it.
  • In the event of sale or transfer of all or part of our or any of our affiliate shares or assets, in case of mergers or in case of negotiations with respect to the foregoing.
  • If required to do so by applicable law, or in urgent circumstances, to protect personal safety, the public or our Website.

We do not sell or share your Processed Data to third parties for cross-context behavioral advertising.

Other than as described above, any other transfer of Candidate Personal Information to third parties will be subject to your consent.

International data transfer

Company is based in Israel. Information we collect from you will be processed in Israel, which is recognized by the European Commission as having adequate protection for personal data.

For the above purposes, personal information may be transferred to recipients in countries around the world (which may be located outside the EU/EEA) which in some cases may have a lower level of protection than that within the EU/EEA. When transferring personal data from the EU/EEA to countries outside the EU/EEA, to jurisdictions that did not receive an adequacy decision or other mechanism approved by the European Commission, we use standard contractual clauses approved by the European Commission to ensure a sufficient level of protection for your personal information. The standard 4

contractual clauses can be found via the following link: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en.

Retention and security

Retention. Candidate Personal Information will not be kept for longer than is necessary for the recruitment process, unless the data is relevant to a successful Candidate’s employment. In such cases, relevant data will be transferred to our HR information system in accordance with Company’s Workforce Privacy Notice. Unsuccessful Candidate’s Personal Information will be deleted within 7 years of the decision.

For more information on how long we retain Candidate Personal Information, please contact us using the contact details provided in “Contact us” section below.

Safeguards. We implement measures to reduce the risks of damage, loss of information and unauthorized access or use of Candidate Personal Information. We also request our affiliates to implement such measures in order to secure the information we provide them. However, although efforts are made to secure Candidate Personal Information, we cannot guarantee its absolute protection.

Data Subjects’ Rights

Depending on the applicable law, You have the following rights regarding your personal data:

  • Right to Access: you have the right to access and receive a copy of your Processed Data that we Process.
  • Right to Rectify: you have the right to request correction of inaccurate Processed Data we have concerning you and to have incomplete Personal Information completed.
  • Right to Data Portability: where applicable, you have the rightto receive the Processed Data that you provided to us, in a structured, commonly used and machine-readable format. You have the right to transmit this data to another person or entity. If you are in the EU, where technically feasible, you have the right to have your Processed Data transmitted directly from us to the person or entity you designate.
  • Right to Withdraw Consent: when the GDPR applies, you may withdraw your consent for processing at any time where processing is based on your consent. We may continue to Process Processed Data with respect to which your consent is not necessary. Withdrawing your consent will not affect the lawfulness of Processing we carried out based on your consent before such withdrawal.
  • Right to Object: when the GDPR applies, you may object to processing based on our legitimate interests. However, we may override the objection if we demonstrate compelling legitimate grounds, or if we need to Process such Processed Data for the establishment, exercise or defence of legal claims. In certain circumstances, you may also object to be subject to a decision based solely on automated processing.
  • Right to Restriction of Processing: when the GDPR applies, You may request that we restrict the processing of your Processed Data: (a) if you contest the accuracy of the Processed Data (in which case the restriction applies only for a period enabling us to determine the accuracy of the Processed Data); (b) if the Processing is unlawful and you prefer to restrict the Processing of the Processed Data rather than requiring the deletion of such data by us; (c) if we no longer need the Processed Data for the purposes outlined in this Notice, but you require the Processed Data to establish, exercise or defend legal claims; or (d) if you object to our Processing based on our legitimate interest (in which case the restriction applies only for the period enabling us to determine whether our legitimate grounds for processing override yours). when the California law applies, you have the right to limit the use and disclosure of your sensitive personal information, as defined under California law.
  • Right to Erasure (Right to be Forgotten). when the GDPR applies, in certain circumstances, such as when our Processing of your Processed Data is based on your consent, you have the right to ask us to erase your Processed Data. However, notwithstanding such request, we may still process your Processed Data if it is necessary to comply with our legal obligations under the applicable law, or for the establishment, exercise or defense of legal claims.

If you wish to exercise any of these rights, contact us through the channels listed below.

When you contact us, we reserve the right to ask for reasonable evidence to verify your identity before we provide you with information. Where we are not able to provide you with information that you have asked for, we will explain the reason.

Subject to applicable law, you have the right to lodge a complaint with your local data protection authority. According to Article 77 of the GDPR, you can lodge a complaint to the supervisory authority, in the Member State of your residence, place of work or of an alleged infringement of the GDPR. For a list of supervisory authorities in the EU, click here.

Candidates will not be discriminated against for exercising their rights under California law.

If you are in the State of California, then according to the Civil Code, relating to personal information, and declaring the urgency thereof, to take effect immediately, approved by Governor September 23, 2018, filed with Secretary of State September 23, 2018, you can lodge a complaint to the supervisory authority.

In certain cases, we may not be able to grant all of your rights (for example, the right to deletion of your processed data), as we may be subject to laws and regulations that do not recognize some of these rights or require us to retain your processed data.

Minors

We do not recruit or employ individuals under the age of 18. We do not knowingly collect Personal Information about children under that age, other than Personal Information about your underaged 6

children that we may process for purposes like HR administration, tax reporting provision of insurance, etc.

Contact us

To exercise any of your rights, please contact the Data Protection Officer, by following the link: https://cellebrite.com/en/privacy-data-inquiry/. Please be aware that every request will be examined by us and its resolution will be documented and notified to you.

We may amend this policy from time to time. If we make any substantial changes in the way we use your Personal Information, we will make that information available in our website.

Notice for California Residents

Pursuant to the California Consumer Privacy Act (as amended by the California Privacy Rights Act of 2020), we inform you about the categories of personal information we collect and the purposes for which we use such information in the past 12 months.

Categories of Personal Information We Collect:

  • Identifiers (such as name, contact details, address, email address, phone number).
  • Demographic information (such as gender, date of birth).
  • Professional or employment-related information (such as education, CV/resume, employment history, references, work permits).
  • Government-issued identification (such as social security number, identification documents).
  • Compensation and benefits information (such as salary history, benefit entitlements).
  • Information from background checks and evaluations.
  • Any other information you provide as part of your application.

Sources of Personal Information

We collect personal information directly from you, or through third parties such as recruiters, recruitment agencies and individual referrals.

Purposes for Collection and Use:

  • To process and evaluate your job application.
  • To verify your qualifications and references.
  • To communicate with you regarding your application.
  • To comply with legal and regulatory requirements.
  • To consider you for future job opportunities.
  • For internal record-keeping and reporting.
  • To protect the rights and safety of our company, workforce, and applicants.

Retention: We retain your personal information only as long as necessary for the purposes described above, in accordance with our data retention policies and applicable laws. Personal information of candidates who are not selected for a position will be retained for 7 years following the conclusion of the recruitment process.

Disclosure of Personal Information

We may disclose your personal information to :

  • Our subsidiaries and affiliates.
  • Our service providers.
  • If required to do so by applicable law, or in urgent circumstances.
  • In connection with a merger, acquisition, or sale of all or a portion of our assets.

Your Rights

Subject to limitations and conditions, you have the right to know, access, correct, or delete your personal information, to opt out of sale or sharing, to limit the use and disclosure of your sensitive personal information, and to not be discriminated against for exercising your rights. For more information, please see our Notice above. To exercise your rights, follow the link: https://cellebrite.com/en/privacy-data-inquiry/.

We do not sell or share your personal information as those terms are defined under California law.