Applicant Privacy Statement

Automox Inc. ("Automox") knows that you care about your personal data, and your privacy is important to us. This Applicant Privacy Statement explains what personal data we collect in connection with employee recruiting, how we use that data, and your privacy rights. For information about how we collect and use personal data collected through our website (which occurs while you are applying for a position), see our Privacy Policy. This Applicant Privacy Statement provides the following information:

• Personal data that we collect

• How we use personal data

• When we share personal data

• How long we retain personal data

• When we transfer personal data internationally

• How we secure personal data

• Our Data Privacy Framework certification

• Your privacy rights

• Changes to this Applicant Privacy Statement

• How to contact us

To process your application, we ask you to provide personal data. You provide this information voluntarily, and you determine what information to provide. However, some information is required to complete our evaluation of your application, and without sufficient information we will have only a limited ability to evaluate you as a candidate. We also receive information from other sources. The following are types of personal data that we use for employee recruiting:

• Personal data that you provide: We request personal data, including information about your educational and employment background, contact information and preferences, job qualifications and job interests. You may provide additional information like your CV, resume, transcripts, references and compensation request.

• Sensitive personal data that you provide: If permitted or required by applicable law, we also request information treated as sensitive personal data. This may include your government-issued identification number (such as a social security number or driver's license number), information relating to your race or ethnic origin, physical or mental health or condition, sexual orientation, trade union membership, and any related legal actions. If you provide this information, it will not be viewable during the selection or hiring process.

• Data we receive from other sources: We obtain information about you from other sources, to the extent permitted by applicable law. We receive information from third parties such as employment research firms, recruiters, identity verification services, and other websites on the Internet (for example, LinkedIn). In addition, where permitted by law, we use a third party to carry out a background check to determine your suitability for a position.

Automox uses your personal data collected in connection with recruiting. For EU data subjects, we process your personal data as a data controller pursuant to your request that we consider you for employment and our legitimate interest in doing so. We use your personal data:

• to process and evaluate your application and make hiring decisions;

• to communicate with you and inform you of current and future career or scholarship opportunities (unless you tell us that you do not want us to keep your data for that purpose);

• to manage and evaluate the effectiveness of our recruiting and hiring processes;

• to conduct reference and background checks where required or permitted by applicable local law; and

• for compliance with corporate governance and legal and regulatory requirements.

If you are hired, your personal data will be used as part of your employee record under our Employee Privacy Policy.

We share your personal data only as necessary to evaluate your application. We do not sell your information to others or share it except as described below.

• Automox affiliates: If you will be employed by a Automox affiliate, Automox will share your personal data with that affiliate to process your application and notify you of other opportunities. Our affiliates will process your data as data controllers and will treat your personal data in accordance with this Applicant Privacy Policy.

• Service providers: Automox uses other companies and individuals to provide services on its behalf. We use vendors to assist with recruiting, employment consulting, legal review and background checking. Those service providers have access to the personal data required to provide their services and are prohibited from using the personal data for any other purpose.

• Business transfers: In the event that Automox or substantially all of its assets are acquired, the personal data held by Automox will be one of the transferred assets.

• Protection of Automox and others: Automox shares personal data when required by law or to respond to legal process, to protect others, and to protect the rights or property of Automox.

• With your consent: Except as described above, we will provide you with notice when your personal data will be shared with third parties, and you may choose not to share that information.

If you are hired, your personal data will be used as part of your employee record under our Employee Privacy Policy. If you are not hired, Automox will retain your personal data for three years. You can request deletion of your personal data at any time (see "Your Privacy Rights" for further information) and we will consider your request in accordance with applicable laws.

When we have no justifiable business need to process your personal data, we will either delete or de-identify it. If this is not possible (for example, because your personal data has been stored in backup archives), then we will securely store your personal data and isolate it from any further processing until deletion is possible.

Automox is headquartered in the United States, and we have entities, operations and service providers in the United States and throughout the world. We and our service providers may transfer your personal data to, or access it from, counties other than the one in which you are located. Some of these countries might have data protection laws less stringent than, or different from, the laws in effect in the country in which you are located. We will take steps to ensure that your personal data receives an adequate level of protection where it is processed. For additional information, see "Our Data Privacy Framework certification".

Automox uses administrative, organizational, technical and physical safeguards to protect your personal data. We use physical access controls, encryption, Internet firewalls, intrusion detection and network monitoring depending on the type of data. We require our service providers to use appropriate security measures.

Automox complies with, the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework. Automox has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Automox has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Applicant Privacy Statement and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov.

Automox is responsible for the processing of personal data it receives under each Data Privacy Framework Principle (DPF Principles) and subsequent transfers of the data to a third party acting as an agent on its behalf. Automox complies with the DPF Principles for all onward transfers of personal data from the EU, Switzerland and United Kingdom including the onward transfer liability provisions.

Pursuant to the Data Privacy Framework Principles, EU, UK, and Swiss individuals have the right to obtain our confirmation of whether we maintain personal information relating to you in the United States. Upon request, we will provide you with access to the personal information that we hold about you. You may also correct, amend, or delete the personal information we hold about you. An individual who seeks access, or who seeks to correct, amend, or delete inaccurate data transferred to the United States under the DPF Principles, should direct their query to privacy@automox.com. If requested to remove data, we will respond within a reasonable timeframe.

We will provide an individual opt-out choice, or opt-in for sensitive data, before we share your data with third parties other than our agents, or before we use it for a purpose other than which it was originally collected or subsequently authorized. To request to limit the use and disclosure of your personal information, please submit a written request to privacy@automox.com.

With respect to personal data received or transferred pursuant to the Data Privacy Framework Principles, Automox is subject to the regulatory enforcement powers of the U.S. Federal Trade Commission. In certain situations, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Swiss-U.S. DPF, Automox commits to resolve complaints about our collection or use of your personal information transferred to the U.S. pursuant to the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF. EU, UK, and Swiss individuals with inquiries or complaints should first contact Automox at privacy@automox.com.

Automox has further committed to refer unresolved DPF Principles-related complaints to a U.S.-based independent dispute resolution mechanism, BBB NATIONAL PROGRAMS. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://www.bbbprograms.org/dpf-complaints for more information and to file a complaint. This service is provided free of charge to you.

If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction.

Updating Your Information: If you would like to update personal data that you have provided to us, please logon to our online applicant portal, such as Lever, and update your profile. You must ensure that the information you provide to us is honest, accurate and not misleading in any way.

Additional Rights for the European Economic Area and Certain Other Territories: If you are located in certain territories (such as the European Economic Area), you have the right to exercise other privacy rights available to you under applicable laws. These additional rights are described below:

• Right of access: You may have the right to access the personal data that we hold about you.

• Right of erasure: In certain circumstances, you have the right to the erasure of personal data (for example if it is no longer necessary for the purposes for which it was originally collected).

• Right to object to processing: You have the right to request that Automox stop processing your personal data, and we will do so if we rely on our legitimate interest to process your personal data - unless we demonstrate compelling legitimate grounds to continue the processing.

• Right to rectification: You have the right to require us to correct any inaccurate or incomplete personal data.

• Right to restrict processing: You have the right to request that we restrict processing of your personal data in certain circumstances (for example, where you believe that the personal data we hold about you is not accurate or lawfully held).

• Right to lodge a complaint with the data protection authority: If you have a concern about our privacy practices, including the way we handled your personal data, you can report your concerns to the data protection authority that is authorized to hear those concerns.

If you would like to exercise any of the above rights, please contact privacy@automox.com so that we can consider your request under applicable law, and we will respond to your request within a reasonable timeframe. To protect your privacy and security, we will take steps to verify your identity before complying with the request.

Our business changes constantly, and our Applicant Privacy Policy will change also. We may e-mail periodic reminders of our Applicant Privacy Policy, but you should check our website frequently to see recent changes. If you are located in certain territories (such as the European Economic Area), we will notify you of any material changes to this Applicant Privacy Policy as required by applicable law.

Unless stated otherwise, our current Applicant Privacy Policy applies to all information that we have about you. But we will never materially change our policies and practices to make them less protective of personal data collected in the past without the consent of affected individuals.

If you have any questions about this Applicant Privacy Policy, you can write to us or any of our affiliates at privacy@automox.com or by mail at:

Automox Inc.
1606 Headway Cir, #9043
Austin, TX 78754
United States
Attn: General Counsel