USER NOTICE

Last updated: April 6, 2025

This user notice (the "Notice") describes how Malantai Ltd. ("Malantai", "we", "us", "our") collects, uses and otherwise processes the personal data concerning individual ("User", "you" or "your") acting on behalf of and under the instruction of a business entity who has agreed to the Terms and Conditions SaaS Services ("Customer") to sign up, access and use the platform and its related Services as described in the Terms and Conditions SaaS Services (the "Platform").

Please note that this Notice supplements our Terms of Use and our Cookie Policy. In addition, a separate privacy policy applies to our website. If you have questions or concerns regarding this Notice, please contact us at: [email protected]

Please see our full NOTICE below in order to better understand our practices in detail.

What Personal Data Do We Process

We hereby inform you, and you hereby acknowledge that you have no legal obligation to provide us with any personal data when you use the Platform, and the provision of it is solely based on your free will. However, without receipt of personal data it may not be possible to operate the Platform and provide you with its related services.

We collect, use or otherwise process your contact details (i.e., your work email address); business data(i.e., company name); and login credentials (i.e., username and encrypted password). Such personal data is provided by the User and/or Customer.

Purposes and EU Legal Basis for Processing

With Whom Do We Share Your Personal Data

In the preceding twelve months, we have neither not sold or otherwise disclose personal data for monetary or other consideration to any third parties nor shared your personal data for cross-contextual behavioral advertising.

We will share your personal data with: service providers and subcontractors (including hosting, data security, fraud detection and prevention, analytics, insurers); legal and regulatory authorities (exclusively in case of a subpoena, search warrant or court order (or similar requirement), or in compliance with applicable laws and regulations); lawyers and interested parties (exclusively in case of the management of possible disputes and other legal matters where appropriate); and corporate transactions (in the event of any proposed or actual reorganization, restructuration, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock.)

Cross-Border Data Transfers

Due to our global business operation, we may store or process your personal data in several jurisdictions other than the country of your jurisdiction.

Israeli Transfers. When we transfer personal data from the State of Israel to a third country outside Israel, the transfer takes place on the basis of: (i) a country declared as offering equivalent level of protection by the Israeli Privacy Protection Authority; (ii) another approved transfer mechanism under the Israeli regulations; or (iii) your consent to transfer your personal data to other jurisdictions, understanding that in some countries the level of protection may be lower than in Israel.

EEA Transfers. When we transfer personal data from within the European Economic Area ("EEA") to countries or international organizations that are based outside the EEA, the transfer takes place on the basis of an adequacy decision by the European Commission, or in the absence of an adequacy decision, other legally permitted safeguards, such as standard contractual clauses.

Data Retention

We process most of the personal data described in section 1 as data processor on behalf of our Customers who as data controllers are responsible for determining the retention period. Therefore, we will process the personal data under their instruction and will delete it from the Platform in accordance with our agreement with such Customer. If you wish to delete your account on the Platform, please contact the relevant Customer directly. Other circumstances in which we will retain your personal data for longer periods of time include: to comply with legal requirements, or if there is a prospect of litigation.

Data Security

We maintain appropriate technical and organizational measures to protect personal data, in particular against accidental or unlawful destruction, loss, modification, unauthorized access, harm to the integrity or divulgation. However, we do not promise or guarantee that any personal data will be absolutely protected from unauthorized disclosure or use. If you have found a vulnerability or would like to report a security incident, you may send an email at [email protected]

Your Rights Regarding your Personal Data

Individuals have certain rights regarding their personal data, depending on their jurisdiction. If you wish to exercise your rights, you may contact us at: [email protected]. We will consider all such requests and provide our response within a reasonable period and as required by applicable laws. When you ask us to exercise any of your rights under this Notice, we may need to ask you to provide us with certain credentials to make sure that you are who you claim you are, to avoid disclosure to you of personal data which is related to others that you are not authorized to receive, and to ask you questions to better understand the nature and scope of your request. We may redact from the personal data we will make available to you any personal data related to others.

Data Rights for Israeli Users. If you are based in Israel, you are entitled to request us to: (i) review and access your personal data that we process; (ii) update, amendment, and deletion of personal data which is incomplete, incorrect, outdated or unclear.

Data Right for EEA Users. If you are based in the EEA, you are entitled to request us to: (i) access your personal data and obtain information on how we process your personal data and your rights, as well as a copy of your personal data; (ii) rectify your personal data in case your personal data is obsolete, inaccurate or incomplete; (iii) object the processing of your personal data when the processing is based on Malantai’s legitimate interest; Malantai will no longer process your personal data unless Malantai demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, such as the respect of a legal obligation, or for the establishment, exercise or defense of legal claims; (iv) in certain circumstances under applicable laws, restrict the processing of some of your personal data during a limited period of time; (v) withdraw your consent when processing is based on consent; (v) in certain circumstances under applicable laws, request data portability, meaning that you can receive the personal data originally provided by you in a structured and commonly used format or that you can request the transfer of the personal data provided by you to another data controller; (vi) in certain circumstances under applicable laws, delete your personal data; (vii) lodge a complaint to your national data protection authority. If you have a complaint about how we use your personal data, we would always prefer you to contact us first. However, you may also make a complaint to your local data protection authority in the EEA. If you are unsure which data protection authority to contact, please contact us at [email protected]

Data Rights for California Users. If you are a California resident, you may be entitled to request the following rights: (i) what personal data we have collected, including the categories of personal data and sources from which the personal data is collected, business or commercial purpose for collecting, selling, or sharing personal data, categories of third parties to whom we disclose personal data, specific pieces of personal data we have collected about you, and length of time we intend to retain each category of personal data; (ii) deletion of your personal data, subject to certain exceptions; (iii) correction of your inaccurate personal data that we maintain about you; (iv) to the extent applicable, to opt-out of the “sharing” of your personal data for “cross-contextual behavioral advertising,”; (v) to the extent applicable, to opt-out of the sale of your personal data to third parties; (vi) under certain circumstances, to limit the use or disclosure of Sensitive Personal Information (SPI) (as defined under the CCPA); (vii) to receive a copy of your personal data, including specific pieces of personal data; (viii) not receive discriminatory treatment if and when you exercise your rights regarding your personal data under the CCPA.

Only you may make a request related to your personal data. If you are a California resident a request can be made by a person registered with the California Secretary of State that you authorize to act on your behalf, in such event you must provide us with signed documentation that you have authorized an agent to act on your behalf.

Personal data that we process on behalf of our Customers as data processor is processed only on behalf of Customers. Therefore, Customers, as data controllers are responsible for responding to your requests to exercise your rights. If you send your request to us, we will transfer it to the relevant Customer (i.e., your employer), in accordance with our agreement with such Customer. You may also send your request to exercise your rights directly to the relevant Customer, i.e., your employer.

MINORS

The Platform is not intended for use by minors (an individual that is under the age defined by applicable law, which concerning the EEA is under the age of 18, and with respect to the US, under the age of 13), and we do not knowingly collect and process personal data relating to minors. If these age requirements are not met, you are required to avoid using the Platform. we will discard any personal data we receive from a minor immediately upon discovering that such a user shared personal data with us.

CHANGES TO THIS NOTICE

We will change this Notice from time to time. Any changes we make to our Notice in the future will be posted on this page and, if we have your email address, we may also notify you by email of any material changes. The effective date of any change of Notice will be clearly marked on the top of each new Notice posted. We strongly encourage you to review this Notice periodically to ensure that you understand our most updated privacy practices.

CONTACT US AND DATA CONTROLLER’S DETAILS

If you have questions, concerns or comments regarding this Notice or the data protection practices in connection with the Platform, please contact us at: