Spines Candidates Privacy Notice

Please note that any reference in this notice to “Spines”, “we”, “us”, or “our” refers to the Spines Group, which includes Booxai Technologies US, Inc. and Booxai Technologies Ltd.

Spines prepared this Candidates Privacy Notice (“Notice”) to be provided to you as a job candidate. In connection with your engagement, we have to process your personal data. In that context, Spines will be a data controller (or database owner under Israeli law), which means that Spines will be responsible for the processing of your personal data. We know that the fact that we will need to use your personal data may be quite obvious to you. However, the purpose of this Notice is to give you information about the sorts of personal data we may collect, process and use about you, and the circumstances in which we may use it.

Spines needs to process certain personal data in order to evaluate your candidacy and, if applicable, to take steps towards entering into a contract with you. There are also statutory requirements we must comply with in relation to the recruitment process. If we are not able to carry out certain processing activities we describe in this Notice, we may not be able to consider your application.

In addition, you will see a number of references to the “Spines Group”, which includes all other Spines entities globally. This document is not part of any contract of employment or engagement, and we may update it from time to time, for example if we implement new systems or processes that involve the use of personal data.

Important note: Nothing in this Notice is intended to limit in any way your statutory rights, including your rights to a remedy or means of enforcement.

You are not obligated to provide us with this information, and you may refuse to do so; however, failure to provide certain information may prevent us from considering your application.

1. What categories of personal data does Spines collect about me?

Spines will collect, process and use the following categories of personal data about you:

• Identification data, such as your name,  ID photo and number, email address, home address, business landline, citizenship, passport data, date and place of birth, social security number or equivalent, signature, as well as other government-issued identification information;
• Contact details, such as your home address, telephone number, and email address;
• Professional experience information such as information about your previous experience, e.g., CV information, cover letter, education, training history, portfolio, and any other relevant information that you decide to share with us;

• Recruitment process data, such as interview notes, assessment results, qualification testing results, references, background check results (to the extent permitted under applicable law), and recordings or transcriptions of interviews (where applicable and subject to your consent where required by law);

• Other data relevant to the candidacy process, such as salary expectations, availability, documentation, and any other information you choose to provide;together “Candidate Data”.

• Any offer and commencement of employment is conditional on the verification, to the satisfaction of Spines, of the information you provide as part of your application and Spines being able to obtain references with which it is satisfied. If you receive and accept an offer of employment with Spines, you will undergo pre-employment screening that will involve verification of the details as specified below.
• Spines, or an independent agent acting on behalf of Spines, may verify the information provided by you and carry out further inquiries which may include, a CV check (e.g., contacting your previous employers) and gap analysis, a verification of your highest education, a reference check, a proof of relevant qualifications check, a professional membership check, and media search (which may include social media and search engine searches). If you fail to supply personal data which Spines requires in order to satisfy these checks, Spines might be unable to employ you.
• Where the applicant’s personal history requires verifications to be carried out in countries where they have worked and resided, their data may be sent to and processed in those relevant countries.

2. Why does Spines need to collect and process my Candidate Data?

We collect and use Candidate Data for the following purposes in connection with the recruitment process (the “Processing Purposes”):

• Receiving, reviewing, and analyzing your CV and application materials;
• Evaluating and assessing your suitability for the role you applied for;
• Communicating with you and responding to your inquiries throughout the recruitment process;
• Scheduling and conducting interviews;
• Conducting pre-employment screening and background checks (where permitted under applicable law);
• Making hiring decisions; and
• Complying with applicable legal obligations related to your recruitment process.

3. What is the legal basis for processing?

When required by applicable privacy law, the legal bases for processing your Candidate Data are as follows:

Under the EU General Data Protection Regulation (GDPR) and the UK GDPR: We rely on the following lawful bases for our processing activities under this Notice:

Where required by applicable law, and where no other lawful basis for processing applies, we will request your consent before processing your personal data. In such cases, the legal basis for the processing of your data will be your consent.

Under U.S. privacy laws: We collect and process personal information for business purposes as disclosed in this Notice. We do not “sell” or “share” your personal information as those terms are defined under applicable U.S. state privacy laws.

4. Use of AI Features

Spines uses artificial intelligence features (“AI Features“) within its recruiting tools to assist in the recruitment process. This includes, but is not limited to, generating hiring content  (including generation of transcripts and summaries of the video interviews), and reviewing candidates’ resumes. These AI Features are used to support, and not replace, human judgment. No hiring decision is made solely on the basis of automated processing. All AI-assisted evaluations and outputs are subject to meaningful human review by a member of our recruitment team before any decision is made.

The following rights (which may be subject to certain exemptions or derogations) shall apply to certain individuals (some of which only apply to individuals protected by specific laws) with regard to our use of AI Features:

• You have the rigtht to be informed about the use of AI Features in your application process.

• You have the right to request information about how AI Features evaluated your application.

• You have the right to object to the use of AI Features in your evaluation and request a manual review.

• You have the right to raise concerns or file a complaint with the appropriate data protection authority.

5. With whom might Spines share my personal data?

In certain cases, your personal data may be shared as follows:

• Group Companies: We may share your personal data with other entities of the Spines Group, including entities located in other countries (for example, Israel or the United States).
• Legal and Regulatory Disclosure: We may share your personal data with regulators, courts, banks, or other competent authorities where required by law, to comply with a legal obligation, or to protect our legitimate rights, property, or the safety of our employees, candidates, customers, or others, provided there is no legal reason preventing such sharing.
• Vendors and Service Providers: We may share your personal data with, or allow access to it by, vendors and service providers that assist us with the recruitment and employment process, including email providers, applicant tracking systems, candidate management systems, recruitment platforms (such as Spark Hire (Comeet)), assessment providers, scheduling tools, HR-related platforms and background check providers. Depending on the context, these recipients may process personal data on our behalf or as independent recipients as permitted by applicable law.
• Corporate Transactions: If, in the future, we sell or transfer, or consider selling or transferring, some or all of our business, shares, or assets to a third party, we may disclose your personal data to that third party, whether actual or potential, in connection with such transaction, including to current or potential investors.
• Merger, Acquisition, or Insolvency: If we are acquired by, merged with, a third party entity, or become subject to bankruptcy or a comparable event involving a third party entity, we may transfer, disclose, or assign your personal data in connection with such event.

6. International Data Transfer

If we transfer your personal data outside your country of residence, we will take appropriate measures to ensure that it is protected in accordance with applicable privacy laws. Such measures may include transferring personal data to countries recognized as providing an adequate level of protection, entering into appropriate contractual safeguards, or relying on another valid transfer mechanism permitted by applicable law.

7. How long will Spines keep my personal data for?

The applicant’s information will be retained in accordance with Spines retention practices and applicable law.

If you are not hired, we may retain your personal data for a reasonable period after the relevant recruitment process ends in order to comply with legal obligations, resolve disputes, defend against claims, maintain records, and, where permitted, consider you for future opportunities, unless you object or request deletion where such rights are available under applicable law.

If you join Spines, relevant personal data collected during the recruitment process may become part of your employment record and be retained in accordance with the applicable employee privacy notice and retention requirements

We may retain personal data for longer where required or permitted by law, including for legal, regulatory, tax, accounting, or litigation-related purposes.

8. Data Security

Spines implements appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, misuse, alteration, or disclosure. These measures are designed to ensure a level of security appropriate to the risks presented by the processing of your personal data. Access to your personal data is limited to those who have a business need to know and are subject to confidentiality obligations.

9. What rights do I have in respect of my personal data?

The following rights (which may be subject to certain exemptions or derogations) shall apply to certain individuals (some of which only apply to individuals protected by specific laws):

• You have the right to request access to your personal data held by us, along with details on how it is processed, subject to certain conditions. You have the right to demand rectification of inaccurate personal data about you. We will promptly correct any information found to be incorrect.
• You have the right to object to unlawful data processing under certain conditions.
• You have the right to the erasure of past personal data about you (your “right to be forgotten”) under certain conditions.
• You have the right to demand that we restrict the processing of your personal data, under certain conditions, if you believe we have exceeded the legitimate basis for processing, the processing is no longer necessary, or if you believe your personal data is inaccurate.
• You have the right to receive certain personal data you provided to us in a structured, commonly used, and machine-readable format and, where applicable, to request its transfer to another party.
• Where we rely on your consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
• You have the right to lodge a complaint with the relevant supervisory or regulatory authority.

If you wish to exercise any privacy rights available to you under applicable law, or if you have concerns or questions regarding this Notice, you can contact us at HR@Spines.com We will review and respond to your request in accordance with applicable law. In order to verify your identity or authority to make the request, we may ask for additional information before processing your request. We will not discriminate against you for exercising privacy rights available to you under applicable law.

10. Updates to this Notice

We reserve the right to update this Notice at any time, and we will provide you with a notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal data.

11. Contact Us

If you have concerns or questions regarding this Notice or if you would like to exercise your rights as a data subject, you can send an email at HR@Spines.com

Last updated: May 2026