Taboola Workplace Data Use Policy
Last Updated: 7 March 2024
Dear Taboolars (and potential Taboolars):
At Taboola, our employees are our top priority, and we are glad to have you as a member or
potential member of our team! Every permanent and non-permanent employee, former employee,
contractor, consultant, temporary worker, intern, job applicant, and volunteer (“Taboolar”, “you”,
or “your”) has an important role in our operations and we value the abilities, experience, andbackground that each brings. We know that our Taboolars provide the services that our customers
and partners rely upon and enable us to grow and create new opportunities for the years to come.
Taboola is made up of a family of global companies, including our parent company, Taboola.com
Ltd. and its subsidiary and affiliate entities (collectively referred to herein as “Taboola”, the “Taboola
Corporate Group”, “we”, “us” or “our”). We consider all Taboolars to be members of the Taboola
family and we are committed to maintaining the accuracy, confidentiality, and security of your
Personal Data (defined below). Similarly, we are dedicated to providing you with the highest level oftransparency and control over our use of your Personal Data.

Purpose of this Workplace Data Use Policy●

To ensure that you understand your data rights as a Taboolar and how you can exercisethem●

To provide you with internal points of contact, should you have any questions about ouruse of your Personal Data●

To address the agreements Taboola has with third-party processors of your Personal Data●

To explain the process of how you can access and update your Personal Data●

To provide you with guidance on how you should use and protect our customers’ andpartners’ Personal Data

Quick References
This Workplace Data Use Policy includes the following:
Global Workplace Privacy Notice ................................................................................................. 5
Internal Data Handling Policy ....................................................................................................... 14
EEA Data Subject Rights Handling Policy ............................................................................... 22
PRC Data Subject Rights Handling Policy ............................................................................... 31
COVID-19 Return to Office Data Use Notice ............................................................................ 37
1

Why do we need this?
Taboola is growing faster than ever — with a new Taboolar starting almost every week! To accountfor this incredible growth, we have prepared these policies to ensure that all Taboolars understandtheir data rights and the ways that Taboola may use their Personal Data. This policy also outlines
your responsibility with respect to third party Personal Data you may have access to as part of youremployment with Taboola. In addition, for Taboolars based in the European Economic Area (the“EEA”), this policy outlines the basis under which we process your Personal Data under the General
Data Protection Regulation (the “GDPR”), for Taboolars based in the People’s Republic of China(“PRC”), this policy outlines the basis under which we process your Personal Data under the
Personal Information Protection Law ('PIPL'), and for Taboolars who are California residents, thispolicy outlines the basis under which we process your Personal Data under the California Consumer
Privacy Act (“CCPA”).

What is “Personal Data”?
For purposes of this Workplace Data Use Policy, Personal Data includes any information about an
identifiable individual. However, when Personal Data is used or disclosed for Taboola’s business
communications, Personal Data does not include (1) the individual’s business title, or (2) the
individual’s business contact information. Personal Data also does not include anonymous or nonPersonal Data (for example, information that cannot be associated with or tracked back to a specificindividual). We will refer to your Personal Data herein as “Taboolar Data”.

What Taboolar Data Do We Collect?
We collect and maintain different types of Personal Data about our Taboolars. This includes the
Personal Data contained in:
●
●
●
●
●
●

●
●
●

Resumes and applications;
References and interview notes;
Letters of offer and acceptance of employment;
Mandatory policy acknowledgements (such as pay wage notice acknowledgement forms);
Wage and payroll information, including but not limited to social security and national
insurance numbers and direct deposit information;
Benefit information and any forms related to applications for, or changes to, Taboolar
health and welfare benefits (including, short-term and long-term disability, medical anddental care);Beneficiary and emergency contact information;
Access card entry and surveillance footage;
Taboolar photographs and video footage (for example, in our human resources
databases, from company events and security camera footage).

Personal data also includes information such as your name, home address, telephone number,personal email address, date of birth, Taboolar identification number, marital status, and any otherinformation necessary for Taboola's business purposes, that the Taboolar or candidate voluntarily
discloses during an application for and employment with Taboola.
2What does Taboola do with your Taboolar Data?
Taboola uses and discloses your Taboolar Data for our internal business purposes, including toestablish or manage your employment relationship with Taboola, or to offboard Taboolars. Suchuses (outlined in further detail in our Global Workplace Privacy Notice, below) include:● To determine eligibility for initial employment, including verifying references andqualifications;● To administer pay and benefits;● To process Taboolar work-related claims (for example, worker compensation andinsurance claims)● To establish training and development requirements;● To conduct performance reviews and determine performance requirements;● To assess qualifications for a particular job or task;● To gather evidence for disciplinary action or termination;● To identify a contact point in the event of an emergency;● To comply with applicable labor or employment statutes;● To ensure Taboolar safety and the security of company-held information; and● For any other purposes that are reasonably required by Taboola in connection withapplication for and during the course of employment with Taboola.
We may also share your Taboolar Data with third parties that provide important services related tothese purposes (such as benefits administrators, or pension plan, insurance or benefit andproviders).

What are your responsibilities as a Taboolar for handling the Personal Data of third
parties’?
During your employment with Taboola, you will regularly come into contact with Personal Data fromour third party clients and partners. This will include our professional contacts’ names, contact
details, job titles, and other information that is necessary for our business operations. As arepresentative of Taboola, you are expected to help us ensure our responsible processing andhandling of third party data. This includes using the Personal Data only as needed to provide
Taboola’s services to the particular client or partner and not sharing the Personal Data with any
third party.
Taboola is required to immediately respond to any “Data Subject Access Requests” that we receive.
So if you receive an inquiry from a customer, partner, or third party (i) asking what information or
Personal Data Taboola holds about that individual, or (ii) requesting that we update or delete that
individual’s contact information or Personal Data, please acknowledge receipt letting the individual
know that you are passing their request to our privacy team and direct this immediately to Taboola’s
Privacy Team, at privacy@taboola.com. Please remember that a data access request does not haveto be official or mention data protection law to qualify as a valid request. If you are ever unsure, it isbest to check with our Privacy Team.
3

Who can you speak to if you have any questions or concerns?
If you have any questions about how this policy applies to you, or how to exercise any of your rights,
please reach out to your designated human resources representative.

4

Global Workplace Privacy Notice1.

Introduction

1.1

Taboola respects the privacy rights of our permanent and non-permanent employees,
former employees, contractors, consultants, temporary workers, interns, job applicants,
and volunteers ("Taboolars", “you”, “your”), and we are dedicated to providing transparency
around the ways that we interact with your data. Taboola collects, uses, and discloses
Personal Data as specified by the laws of the countries in which our Taboolars reside. This
Global Workplace Privacy Notice (the “Privacy Notice”) applies to everyone who performs
work for Taboola, anywhere around the globe.

1.2This Privacy Notice outlines Taboola’s standards for processing our Taboolars’ Personal
Data (“Taboolar Data”). This Privacy Notice sets forth Taboola’s obligations to protect
Taboolar Data, but it does not replace any specific data requirements that may apply to
Taboola’s corporate functions or business units, which are simultaneously in effect. If there
is a discrepancy between these requirements, the most protective provision will apply.

1.3

If you have any questions or would like to discuss anything in this Privacy Notice, please
do not hesitate to reach out according to the contact details in Section 10 below.

2.

Taboolar Data We Collect

2.1

In connection with your employment with Taboola or your application for employment with
Taboola, we may collect the following types of Personal Data about you, your dependents,and other individuals that you inform us are connected to you:(a)

Identification data – such as your name, gender, photograph, date of birth,
Taboolar identification number, and languages.

(b)Contact details – such as your home address, telephone number, email
addresses, beneficiaries, and emergency contact details.

(c)Employment details – such as your job title, office location, hire date, employment
contracts, performance and disciplinary records, grievance procedures, andsickness and holiday records.

(d)Educational and professional background – such as your academic andprofessional qualifications, education, CV or résumé, reference letters andinterview notes, and criminal records data (only for vetting purposes, wherepermissible and in accordance with applicable law).

(e)National identifiers – such as your social security number, national ID or passport,
immigration status and documentation, visas, and insurance numbers.
5

(f)Spouse & dependent information – such as your marital status.

(g)

Financial information – such as banking details, tax information, payroll
information, withholdings, salary, benefits, expenses, company allowances, andstock and equity grants.

(h)

IT information – information required to provide access to Taboola's IT systems
and networks such as IP addresses, log files, login information, andsoftware/hardware inventories. For further information about how we process IT
information, see Section 8 below.

(i)Security information -- such as access card usage (to enter Taboola’s offices) andclosed-circuit televisions (“CCTV”) footage.

(j)

Other information you choose to share with us – such as your hobbies and social
preferences etc.

2.2

We may also collect certain demographic data that qualifies as sensitive Taboolar Data,such as race, ethnicity, sexual orientation, and disability to help us understand the diversityof our workforce, provide work-related accommodations, manage absences from work, or
conduct background checks necessary for the Taboolar’s role in advance of
employment. This information, when collected, is generally done so on a voluntary,consensual basis, and Taboolars are not required to provide this information, unless it isnecessary for us to collect such information to comply with our legal obligations.

2.3

Generally, we collect Taboolar Data directly from our Taboolars. However, in some cases,
we may collect Personal Data about Taboolars from trusted third parties (for example, when
we perform background checks that are necessary for the Taboolar’s role or to obtain
information from recruiters in connection with potential applicants). In most circumstances,
we will obtain your permission before we collect any Personal Data about you from a third
party.

2.4

If we ask you to provide any other Personal Data not described above, then we will makeclear to you what specific Personal Data we need and the reasons why we ask you toprovide it.

3.

How We Use Your Taboolar Data

3.1

Taboola uses and discloses the Taboolar Data that we collect primarily for the purposes ofmanaging our employment relationship with you, along with other business purposes,
which may include:(a)Recruitment;(b)

To understand whether we are meeting our diversity goals and how we can
improve our practices going forwards;
6

3.2

(c)

To determine eligibility for hiring (including the verification of references andqualifications);(b)

To administer payroll and benefits;(c)

To administer background checks when necessary for the role, where permitted
by law;(d)

To process Taboolars’ work-related claims (such as workers’ compensation andinsurance claims);(e)

To establish training and development requirements;(f)

To determine performance requirements and review work performance;(g)

To manage, plan, and organize workflow;(h)To ensure health and safety in the workplace;(i)

To assess qualifications for a particular job or task;(j)

For disciplinary actions or terminations;(k)

To establish emergency contacts;(l)

To comply with laws and regulations (such as employment laws, health and safety
laws, tax laws, and anti-discrimination laws), under judicial authorization, or to
exercise or defend Taboola’s legal rights;(m)

To compile internal directories (such as Taboolar directories);(n)

To detect fraud or other types of wrongdoing;(o)

For IT security and administration;(p)

For accounting, financial reporting, and business planning;(q)

To monitor Taboola’s premises and communication facilities, including closedcircuit televisions (“CCTV”) cameras,(r)

To organize team-building activities and other Taboola-hosted events;(s)

For other legitimate purposes reasonably required for day-to-day operations.

We may also use your Taboolar Data for other lawful purposes that may arise. We will
inform you of any such purpose, and will obtain your consent to that use, if required by law
to do so.
7

4.

Legal Basis for Processing Your Taboolar Data

4.1

If you are a Taboolar in the European Economic Area (the “EEA”),the People’s Republic ofChina (“PRC”), or California, our legal basis for collecting and using the Taboolar Datadescribed above will depend on which data is concerned and the context in which wecollect it. However, we will normally collect Taboolar Data from you only (i) where we haveyour consent to do so, (ii) where we need the Taboolar Data to carry out our employment
contract with you, (iii) where we need the Taboolar Data to comply with our legal obligations
or exercise rights in the field of employment, or (iv) where the processing of Taboolar Data
is in our legitimate interests and does not override your data protection interests or yourfundamental rights and freedoms. In some cases, we may need the Taboolar Data toprotect your vital interests or those of another person (for example, we may need to shareyour Taboolar Data with third parties in the event of a work-related emergency).

4.2

If we ask you to provide Taboolar Data to comply with a legal requirement or to perform acontract with you, we will make this clear at the relevant time and let you know whether theprovision of your Taboolar Data is mandatory (as well as the possible consequences if you
do not provide it).

4.3

Similarly, if we collect and use your Personal Data in reliance on our legitimate interests (orthose of a third party) that are not listed above, we will make clear to you at the relevanttime what those legitimate interests are.

4.4

If you have questions about or need further information concerning the legal basis on which
we collect and use your Personal Data, please contact us using the contact details provided
in Section 10 below.

5.

How We Share Your Taboolar Data

5.1

We take care to allow your Taboolar Data to be accessed only by those who truly must
access it in order to perform a service for the Taboolar or for Taboola, and to third parties
who have legitimate purpose for accessing it. Whenever we authorize third parties toaccess your Taboolar Data, we take steps to ensure they have appropriate security
measures in place and that they only use the Taboolar Data in confidence and in a way thatis consistent with this Privacy Notice.

5.2

We may share your Taboolar Data in the following ways:(a)With other companies in the Taboola Corporate Group: We may need to shareyour Taboolar Data with other Taboola offices around the world in order to manage
and administer our human resources services, to manage Taboolar transfers andtravel, and for other business purposes like IT, taxes, accounting, and generalbusiness management. These international companies in the Taboola Corporate
Group may be registered by a different legal name than the company with which
you are employed — for example, you may be employed by Taboola Korea Ltd.
8

and we may need to share your Taboolar Data with Taboola (Thailand) Limited —but these companies all operate together as one global Taboola entity.
(b)With third party service providers and agents: We may also make certain Taboolar
Data available to third parties who provide services to us (such as our humanresource management software, Taboolar benefit plan providers, payroll support
services, share incentive plan and Taboolar stock purchase plan coordinators, andTaboolar travel management services). When we share with these third parties, we
do so on a need-to-know basis and under clear contractual terms and instructions
for the processing of Taboolar Data.

(c)With third party companies that provide software and tools to Taboola: We may
also make certain Taboolar Data available to third party companies that provide
tools relevant for our business operations (such as to assist with internal ticketing,product engineering, and design services). Should these companies require user
log in details, those details will be limited to the taboolar’s name and professional
email, and in limited circumstances, may be used and sold by the third party foradvertising purposes.

(d)With other third parties: We may also share your information with other types ofthird parties, such as our legal representatives, industry groups or self-regulatory
bodies, or event planners, on lawful grounds. For example:●

With your consent;●

To comply with our legal obligations (including to comply with laws, regulations,and contracts, to respond to court orders, administrative or judicial process,subpoenas and search warrants, or to meet national security and law
enforcement requests);●

To establish, exercise, or defend against potential, threatened, or actual
litigation;●

To protect the safety, property, or vital interests of a person;●

To protect Taboola’s rights or property;●

To organize team-building activities and other Taboola-hosted events;●

To protect Taboola, our other Taboolars, customers, or the public from harm
or illegal activities;●

To respond to an emergency that we, in good faith, believe requires us todisclose data to prevent harm; and●In connection with the sale, assignment, merger, or other reorganisation ortransfer of all or part of our business.
96.

International Transfers of Your Taboolar Data

6.1

Taboola and our service providers may collect, use, process, store, or disclose your
Taboolar Data outside your home country or jurisdiction. These outside countries may
have different data protection laws than the laws of your home country. But rest assured
that Taboola only transfers Taboolar Data to another country (including to a company within
the Taboola Corporate Group) in accordance with applicable privacy laws, and where there
are adequate data protections in place. We will ensure that your Taboolar Data is treatedin accordance with this Privacy Notice wherever we process it.

6.2

If you are a Taboolar in the EEA, the PRC, or California, Taboola may transfer your Taboolar
Data outside of the country in which you work. To ensure that your Taboolar Data isadequately protected in such transfers, applicable data protection laws mandate that suchtransfers must take place using certain legal mechanisms. When transferring your Taboolar
Data from the EEA to Israel, Taboola relies on the European Commission’s determinationthat Israel offers adequate data protection for transfers from the EEA. When transferring
Taboolar Data from the EEA or PRC to elsewhere, Taboola relies on the European
Commission’s approved Standard Contractual Clauses, which are contractual privacy andsecurity commitments between companies that transfer Personal Data (for example, from
Taboola Europe Limited to Taboola, Inc.). Taboola.com Ltd. and its Affiliates haveaccordingly adopted Standard Contractual Clauses to ensure the legality, privacy, andsecurity of the data flows necessary to provide, maintain, and develop our services.

7.

How Long We Keep Your Taboolar Data

7.1

We will keep your Taboolar Data for as long as is needed to carry out the purposes
described above (or as otherwise required by law). Generally, this means we keep your
Taboolar Data until the end of your Taboola employment, plus a reasonable period of timeafter to respond to any employment inquiries, deal with any legal or administrative matters,
or to provide you with ongoing pensions and other benefits.

8.

Monitoring Notice

8.1

We periodically need to monitor our IT and communications systems for specific purposes.
We may do this through automated tools like anti-malware software, website filtering, spam
filtering, intrusion detection and prevention systems, security software and mobile device
management solutions to maintain and protect our IT systems and network security,
including investigating and responding to suspected security incidents.

8.2

We also monitor Taboola’s office premises by security footage and badge scans.

8.3

Where permitted by law, we may also monitor for other purposes, such as:
10

(a)

To document and archive proof of business transactions;(b)

To train and evaluate our Taboolars;(c)

To protect our confidential information, intellectual property, and other businessinterests;(d)

To investigate breaches of our company policies or other unlawful or improper
acts;

(e)

To comply with a legal obligation; and(f)

For other legitimate purposes, as permitted by applicable law.

8.4

Please note that any Taboolar telephone conversations or transmissions, message, files,
data, document, electronic communications, social media posts, internet access or usage,or any other types of information transmitted to or from, received or printed from, or
created, stored, or recorded on our IT and communications systems and assets (excluding
Taboola-provided mobile phones, but including use of a computer, office telephone, wire,radio or electromagnetic, photoelectronic or photo-optical systems) are presumed to be
Taboola business-related and we may monitor it at any and all times and by any lawfulmeans in accordance with this Privacy Notice.

8.5

We recognise that any monitoring that we perform may impact our Taboolars' privacy, so
we will always seek to ensure that any monitoring we perform is proportionate for the limited
and specific purposes needed and conducted as required or permitted by applicable law.
Before undertaking any monitoring activities, we will always consider your privacy carefully
and assess whether there are any less invasive options available.

9.

Your Rights to Your Taboolar Data

9.1

Several of our self-service HR Information Systems (“HRIS”) (for example, Bamboo,
SuccessFactors, and ADP) allow you to view and update some of the Taboolar Data that
Taboola holds about you. If we have Taboolar Data that you cannot access via these HRIS
tools, or if we have Taboolar Data that you believe is inaccurate or no longer relevant, andyou would like us to correct or delete such data, then you may make a request via email toyour designated human resources representative.

9.2

If you are located in certain regions (including the EEA, PRC, Brazil, Thailand, andCalifornia), you may have certain additional rights in relation to your Personal Data, suchas:(a)You have the right to update, correct, and access your Personal Data.

(b)

If we have collected and processed your Personal Data with your consent, thenyou have the right to withdraw your consent at any time. (Please note that11

withdrawing your consent will not affect the lawfulness of any processing wecarried out prior to your withdrawal, nor will it affect processing of your Personal
Data carried out in reliance on other lawful grounds other than consent).
(c)

The right to object to processing of your Personal Data, ask us to restrict
processing of your Personal Data, or request portability of your Personal Data.

(d)

To have your Personal Data erased in a number of other circumstances, such aswhere it has been unlawfully processed, or where there are no overriding legitimate
grounds for the processing.

(e)

To opt out of the “sale” or “sharing” (as defined under the CCPA) of Personal Data,
if you are a California resident.

(f)

To limit use and disclosure of Sensitive Personal Data, if you are a California
resident.

(g)

To not be discriminated against for exercising any of the rights set out in the CCPA.

9.3

You can make any of these requests by using the contact details provided in Section 10
below. We will respond to all requests in accordance with applicable data protection laws.

10.

Questions and Concerns

10.1

If you have any questions or concerns about this Privacy Notice please contact Taboola’s
Privacy Team at privacy@taboola.com, or your designated human resources representative
as listed below:

10.2

(a)

In Asia: Anjali Oldfield, anjali.o@taboola.com(b)

In Israel: Efrat Israeli-Korn, efrat.i@taboola.com(c)

In Europe: Anjali Oldfield, anjali.o@taboola.com(d)

In the United States: Lana Saad, lana.s@taboola.com(e)

In Brazil and Latin America: Natalie Coggins, natalie.c@taboola.com

If you are a Taboolar in the EEA, California, or PRC, you may also request to access andreview
ourrecords
ofyourTaboolarDatabyemailing
employeesubjectaccessrequest@taboola.com. This shall provide notice to Taboola’s
Privacy Team, human resources department, and Taboola’s appointed data protection
officer (our “DPO”). You also have the right to reach out directly to our DPO by emailing
DPO@taboola.com. Taboolars in the EEA also have the right to lodge any complaints orconcerns with your local data protection authority (a “DPA”). You can find a list of all theEuropean
DPAs
at
http://ec.europa.eu/justice/data12

protection/bodies/authorities/index_en.htm. Taboolars in the PRC also have the right tocomplain to the relevant department performing duties of Personal Information protection(not yet identified).

11.

Updates to this Privacy Notice

11.1

We may update this Privacy Notice from time to time to reflect any changes in our privacy
practices. Where the changes are material, we will inform all Taboolars by email and we will
also indicate at the top of this Privacy Notice the date that it was last updated. We
encourage you to check back periodically to make sure you're aware of the most recent
provisions.

12.

Additional Disclosures for California Residents

12.1

During the previous calendar year, we received and responded to these types of Taboolar
requests as follows:
Number received

Number compliedwith in whole or inpart

NumberdeniedMedian numberof days torespond

Requests to
know

0

0

0

0

Request to
Correct

0

0

0

0

Requests todelete00

00Requests to limit
use of sensitive
personal
information

0

0

0

0

Requests to optout

0

0

0

0

13

Internal Data Handling Policy
1.

Introduction

1.1

Taboola has issued this Internal Data Handling Policy ("Data Handling Policy") for
permanent and non-permanent employees, former employees, contractors, consultants,
temporary workers, interns, and volunteers (each an “Taboolar”, "you", or "your").

1.2

Taboola respects the Personal Data and data protection rights of all individuals (including
our Taboolars, partners, clients, and potential clients), and we are fully committed andlegally obligated to comply with applicable data protection laws. Because the Taboola
Corporate Group is comprised of Taboola’s many global offices and registered entities,
and because Taboola engages in business across all corners of the globe, Taboola has
determined that EU data protection laws, and specifically the General Data Protection
Regulation 2016 (the “GDPR”), offers individuals the greatest data protections as it relates
to handling of Personal Data. Thus, we determined that our global operations shall comply
with these standards.

1.3

This Data Handling Policy explains what Taboolars must do when handling Personal Data
found in Taboola’s contracts, Personal Data about clients and professional contacts, andPersonal Data provided by suppliers and colleagues. Please address any questions orcomments about this Data Handling Policy to Taboola’s Privacy Team, atprivacy@taboola.com.

2.

Breaches of Data Protection Law and Breaches of This Internal Data Handling
Policy2.1

Companies that suffer from a data protection breach can face (i) significant reputational
harm; (ii) enormous fines; and (iii) claims from individuals for the breach of their dataprotection.

2.2

All Taboolars are expected to comply with this policy. Taboolar breaches of this Data
Handling Policy will be taken seriously and may result in disciplinary action.

3.

Terminology Used in this Data Handling Policy

3.1"Personal Data" means any information about an identified or identifiable natural person.
An identifiable person is one who can be identified, directly or indirectly, in particular byreference to an identification number, location data, online identifier, or to one or morefactors specific to that person's physical, physiological, genetic, mental, economic, culturalor social identity.
(a)

Examples of data that may permit this kind of identification in the employment
context:

14

(b)

(i)

Identification data (such as name, address, date and place of birth,photograph);(ii)

Contact details (such as telephone number, email, address);(iii)

National identifiers (such as ID numbers, tax IDs/social security numbers,
driver's licence number, passport number);(iv)

Information about education and training (educational history, professional
qualification and experience, professional organisations, publications);
and

(v)

Information about professional status (such as title, position, location).

Examples of data that may permit this kind of identification of a client or partner:(i)Name and contact details on our Customer Relationship Management(“CRM”) databases (including Salesforce, Taboola Ads, and our emailing
platforms);(ii)

Email addresses;(iii)

IP addresses;(iv)

Newsletter subscriptions; and(v)

Marketing preferences.

3.2“Data Subject” means individuals within the European Economic Area (“EEA”) whose data
is processed by Taboola. Data Subjects include: (i) individuals who interact with Taboola’sContent Distribution Platform (“Users”); (ii) publishers, advertisers, and other content
providers with whom Taboola has a contractual relationship, ("Customers"); and (iii)
Taboola’s permanent and non-permanent employees, former employees, contractors,
consultants, temporary workers, interns, job applicants, and volunteers ("Taboolars").

3.3"Processing", "Process" or "Processed" means any operation or set of operations
performed upon Personal Data, whether or not by automatic means.
(a) Examples of data processing include:(i)Collecting data;(ii)

Recording data;(iii)

Organising data;(iv)

Storing data,(v)

Altering data;(vi)

Retrieving data;(vii)

Consulting data,(viii)

Use of data;(ix)

Disclosure by transmission of data;(x)

Transfer of data;
15

(xi)

Remote access to data;(xii)

Alignment or combination;(xiii)

Blocking data;(xiv)

Erasing data; and(xv)

Deleting data.

3.4“Sensitive Data” is a subset of Personal Data that contains information relating to aperson's race or ethnic origin, political opinions, religious or philosophical beliefs, tradeunion membership, genetic data, biometric data (for identifying a person), health data, anddata about sex life or sexual orientation.

3.5"Criminal Records Data" means information relating to criminal convictions and offenses
or related security measures.

4.

Overarching Data Protection Principles

4.1

As an organisation, Taboola we must ensure that we:(a)

Are legally entitled to process the Personal Data under data protection law ("Lawful
Grounds");(b)

Are transparent with individuals about what Personal Data we process and why("Transparency");(c)

Do not use Personal Data for any purpose other than for which it is collected("Purpose Limitation");(d)Collect the minimum Personal Data needed for the purpose it is collected("Minimisation");(e)

Keep Personal Data accurate and up to date ("Accuracy");(f)Respect and honor the data subject rights of individuals based in specific regions(see the EEA Data Subject Rights Handling Policy and the PRC Data Subject
Rights Handling Policy for more information) ("Data Subject Rights");(g)

Keep Personal Data secure when used both internally and when shared with third
parties ("Security");(h)Transfer (or allow the transfer of) Data Subject’s Personal Data only if we have put
in place appropriate data transfer arrangements ("Data Transfers"); and(i)

Build data protection compliance (for example, compliance with the above
principles) into any new project that involves Personal Data processing or new useof Personal Data ("Data Protection by Design").

16

5.

How Should You as a Taboolar Comply with Data Protection Principles inEveryday Practice?

5.1

Use your Taboola email account for all business correspondence — do not use yourpersonal email account.

5.2

Scale down the Personal Data you access to only what is necessary to perform yourrequired tasks.

5.3

Just because you can access certain Personal Data does not mean everyone elseshould. Before you share Personal Data with another Taboolar, be sure they need it andhave the right to access and use it.

5.4

Change your passwords regularly. Do not write them down.

5.5

Be respectful of our Customer’s contact choices -- if a contact is marked as “DO NOTCONTACT” in Salesforce, please do not contact them.

5.6

Encrypt Sensitive Data when necessary — for example, when saving to a flash drive or
emailing it.

5.7

Use secure Internet connections when accessing our organisation’s network.

5.8

Lock your computer when you step away from it.

5.9

Report suspicious-looking emails. Do not reply to them or open any links or attachments.

5.10

You should not collect or use any Sensitive Data or Criminal Records Data unless this has
been reviewed and approved by Taboola’s Privacy Team, at privacy@taboola.com.

5.11

Be aware of our policies and reach out to privacy@taboola.com with any questions.

5.12

Understand the different measures we have in place to protect Personal Data and know
when to use them.

5.13

If you spot a privacy issue, report it to privacy@taboola.com or IT@taboola.com.

6.

How Does Taboola Comply with Data Protection Principles in Everyday
Practice?

We Ensure that We Have Lawful Grounds to Process Personal Data
6.1

We only process Personal Data for purposes permitted under applicable data protection
law. Permissible purposes include:(a)

To comply with a legal obligation (for example, as an employer, we may be required
to process certain information about our Taboolars);(b)

To protect the Data Subject’s vital interests (for example, if there is a medical
emergency);(c)

For performance of a contract with the Data Subject or to perform steps prior toentering into a contract at the request of the data subject;
17

6.2

(d)

For the legitimate interests of Taboola or a third party but only if the Data Subject’s
rights are not outweighed, for example, where the business benefit to Taboola islimited but there would be significant intrusion on the privacy of the Data Subject;
and/or(e)

The Data Subject has given his or her consent (although this should only be sought
if one or more of the other grounds above do not apply).

There are additional special grounds for processing Sensitive Data and data regarding
criminal records. As noted above, you should not collect or use any Sensitive Data or
Criminal Records Data unless it has been reviewed and approved by Taboola’s Privacy
Team, at privacy@taboola.com.

Relying on Consent
6.3

Whenever relying on consent to process Personal Data, Taboola ensures that consent is:(a)Documented – so we can demonstrate that we have obtained consent lawfully;(b)Given affirmatively (such as ticking a box or signing a document) – we cannot
rely on 'inaction' as a way of obtaining consent (e.g., no pre-ticked boxes);(c)

Freely given and retractable at any time – it must be as easy for Data Subjects
to withdraw their consent as it is to give their consent; and(d)Not conditioned – for example, not given on the condition that other actions aretaken, accepted, or exchanged.

Transparency, Purpose Limitation and Minimisation
6.4

You, as a Taboolar, should decide what Personal Data is necessary for the intended
purpose (i.e. to provide the required business services) and collect only the minimal
Personal Data necessary for that purpose.

6.5

Because Personal Data may only be collected for a specific purpose, the Personal Datashould only be retained for the time necessary to complete the purpose. Our Privacy
Notices (internal and external) set forth the time period for which we generally retain
Personal Data. Our computer and IT systems are already structured to comply with thesetimeframes, so you should not tamper with these settings to keep the Personal Data forany longer.

6.6

If you need to use Personal Data that Taboola has provided you access to for any purpose
other than legitimate business purposes, this must be reviewed and approved by Taboola’s
Privacy Team, at privacy@taboola.com.

Accuracy
6.7

We must keep Personal Data accurate. This will mean, in each relevant context, that wemust consider how we will regularly update information. If you get any such request from a18

client or partner, please direct this request to Taboola’s Privacy Team, atprivacy@taboola.com.
Data Subject Rights (EEA, PRC, and California Only)
6.8

Data Subjects in the EEA and PRC are entitled to exercise certain rights with respect totheir own Personal Data. These rights are explained in Taboola’s EEA Data Subject Rights
Handling Policy and Taboola’s PRC Data Subject Rights Handling Policy.

6.9

If a Data Subject’s Personal Data is shared with a third party or if a third party shares
Personal Data directly with Taboola, we are required to ensure that a mechanism is in place
to communicate with each other about any requests to restrict, delete, or correct Personal
Data, unless this would be impossible or involve disproportionate effort. If you receive an
inquiry from a Data Subject, such as a User or Customer or any other third party (i) asking
what information or Personal Data Taboola holds about that individual, or (ii) requesting that
we update or delete that individual’s information or Personal Data, please direct it
immediately to Taboola’s Privacy Team, at privacy@taboola.com.

Security
6.10

Taboola must keep Personal Data secure and protect it from any unauthorised access,accidental loss, damage, or destruction. You should ensure that you are familiar with, andthat you follow, our security policies and procedures that are designed to protect our IT
systems, our premises, and the data stored within them (including both confidential
information and Personal Data). You must also follow the practical steps set forth above in
Section 5.

6.11

When Taboola collects Personal Data for a particular purpose, we must always consider
whether we could achieve the same purpose with anonymised data. If that is not possible,
we should strive to encrypt or pseudonymize the Personal Data (for example, by masking,hashing, or otherwise concealing the data). The more confidential the information, thehigher our security standards will need to be to protect it. Please consult with Taboola’s
Privacy Team, at privacy@taboola.com, if you have questions about whether certain
Personal Data needs to be encrypted or pseudonymised.

6.12

Personal Data should not be shared with anyone or any organisation outside of the Taboola
Corporate Group (including to our service providers) unless (i) appropriate contractual
arrangements have been signed (including our standard non-disclosure and dataprocessing agreement), or (ii) the disclosure is otherwise permitted under data protection
law. Please consult with Taboola’s Legal team (legal@taboola.com) prior to sharing any
Personal Data with any third party.

6.13

Before authorizing any third party providers to hold or have access to Personal Data on ourbehalf, Taboola must first carry out due diligence to verify that the third party meets ourdata protection standards for Personal Data and is compliant with the GDPR’s
requirements. Please refer requests for due diligence assistance to Taboola’s IT Team, at
IT@taboola.com.
19

Data Transfers
6.14

6.15

Personal Data cannot be transferred outside of the EEA, unless the transfer is:(a)

To a country approved by the European Commission as having adequate dataprotection laws to protect the Personal Data (there are only a handful of these);(b)

To an organisation that has entered into a data transfer agreement with us (basedon European Commission approved standard contracts); or(c)

To an organisation that has its "binding corporate rules" approved by the European
data protection regulators.

Personal Data cannot be transferred outside of the PRC, unless the transfer:
(a)
(b)
(c)
(d)

(e)
6.16

Is with the Taboolar’s consent to do so;
Passed the security assessment organized by the PRC cyberspace administration;
Has been certified in accordance with the provisions of the PRC cyberspaceadministration;
Is to an oversees recipient that has entered into a data transfer agreement (basedon a standard contract formulated by the PRC cyberspace administration, or until
available, is in good faith based on best industry practices);
Satisfied other conditions prescribed by laws, administrative regulations, or the
PRC cyberspace administration.

If you are aware of any (planned) Personal Data transfers without at least one of the above
mechanisms in place or to confirm that one of the above mechanisms is in place, pleasecontact Taboola’s Legal Team, at legal@tabola.com.

Data Protection by Design and Data Protection Impact Assessments
6.17

Taboola must build data protection compliance into our processes and systems from theground up. To do this, it is important that all Taboolars have a good understanding of ourdata protection obligations (as set out in this Data Handling Policy). It is also necessary toensure that the concept of “Data Protection by Design” — or ensuring that new systems
that that Taboola introduces are designed to minimize the Personal Data that they collect— is embedded into our product development processes and considered from the outset
and throughout the life cycle of the product. This is especially important for our R&D,
Product, and IT Taboolars to keep in mind as they perform their business tasks.

6.18

We also have standard procedures and templates for carrying out a “Data Protection
Impact Assessment” or “DPIA” — which is the process of evaluating and documenting
the potential individual privacy risks that could result from Taboola’s new projects,
processes, or product developments that involve the collection of Personal Data. For higher
risk (more intrusive) uses of Personal Data, completing a DPIA may be required by dataprotection law. Please consult with Taboola’s Privacy Team, at privacy@taboola.com todetermine whether your new project or product development task requires a DPIA.

20

7.

Data protection complaints

7.1

For instructions on how EEA Data Subjects may exercise their data subject rights, please
see the EEA Data Subject Rights Handling Policy. For instructions on how PRC Data
Subjects may exercise their data subject rights, please see the PRC Data Subject Rights
Handling Policy.

7.2

For complaints from individuals about Taboola’s processing of their Personal Data, please
immediately direct the complaint to Taboola’s Privacy Team, at privacy@taboola.com.

21

EEA Data Subject Rights Handling Policy
1.

Introduction

Taboola has issued this EEA Data Subject Rights Handling Policy to describe the practices andprocedures that Taboola follows when it receives requests about our use of Personal Data from: (i)individuals who interact with Taboola’s Content Distribution Platform (“Users”); (ii) publishers,
advertisers, and other content providers with whom Taboola has a contractual relationship,("Customers"); and (iii) Taboola’s permanent and non-permanent employees, former employees,
contractors, consultants, temporary workers, interns, job applicants, and volunteers ("Taboolars").
Any individual User, Customer, or Taboolar in the European Economic Area, (“EEA”) whose data isprocessed by Taboola shall each be referred to hereinafter as a “Data Subject”.

2.

Rights That All Data Subjects Have Regarding Their Personal Data

Data Subjects have data protection rights that they may exercise by making a request to Taboola(a “Data Subject Rights Request”). These data subject rights include the right to request:●

Access to their Personal Data;●

Rectification or Correction of their Personal Data;●

Erasure of their Personal Data (also referred to as the 'Right to be Forgotten');●Restriction on Taboola’s processing of their Personal Data;●

Portability of their Personal Data;●

Termination of any further processing of their Personal Data (also referred to as the‘Right to Object’);●

Not to be subject to automated decision making; and●Not to be sent direct marketing.

2.1

Each of these rights is described in more detail in Sections 11-18 below.

2.2

The procedures described in this EEA Data Subject Rights Handling Policy outline how
Taboola, as a data controller (the entity determining the purpose for which, and manner inwhich, the Personal Data is processed), will respond to any Data Subject Rights Requests.

3.

Responsibility to Respond to a Data Subject Rights Request

3.1

The controller of a Data Subject’s Personal Data is primarily responsible for responding toa Data Subject Rights Request and for facilitating the Data Subject’s exercise of his or her
rights under applicable data protection laws. For example, because Taboola determines
what data it will collect from its Taboolars, and how it will process this Taboolar data,
22

Taboola is the controller of the Taboolar’s Personal Data that it holds and processes. As
the controller of the Taboolar’s Data, Taboola must respond to any Data Subject Rights
Request we receive from a Taboolar. As a second example, Taboola is a controller of thedata that we collect from individuals (“Users”) who interact with the Taboola Content
Discovery Platform because we determine the purposes for which the data is collected andthe means by which it is processed. Therefore, Taboola must respond to any Data Subject
Rights Request we receive from a User about the Personal Data that we collect throughour Content Discovery Platform.
3.2

In certain circumstances, Taboola may process a Data Subject’s Personal Data as aprocessor on behalf of a third party who is the controller (rather than for its own purposes).
In such instances, Taboola must inform the relevant third party promptly and provide it withreasonable assistance to help the third party honor the Data Subject’s rights in accordancewith applicable data protection laws.

4.

Personal Data That Taboola Has Made Available to Third Parties

4.1

If Taboola shares Personal Data with third parties, it is our responsibility to inform thosethird parties of any request we receive from Data Subjects to rectify, erase, or restrict their
Personal Data, unless doing so would involve disproportionate effort or is impossible. For
example, when Taboola receives a Data Subject Rights Request, we must notify any
relevant Taboola entity, processors, or other third parties (such as occupational healthproviders) that we have disclosed the Personal Data to, so that they may also update theirrecords accordingly. As a general rule, in order to comply with this requirement, Taboola
requires that all of its processors erase any Personal Data they receive from Taboola within
thirty (30) days of their receipt of such Personal Data. If you have concerns about any
service providers that you are engaged with, please consult with Taboola’s Legal Team, atlegal@taboola.com.

4.2

If requested, Taboola must also provide the Data Subject with details about third parties towhom we have disclosed the Data Subject's Personal Data.

5.

Where Can You Send Your Own Data Subject Rights Requests and Questions?

5.1

If you are a Taboolar in the EEA, and you wish to make a Data Subject Rights Request
regarding the Personal Data that Taboola holds about you, please send your request to
employeesubjectaccessrequest@taboola.com.

5.2

Any questions regarding Taboolar Data Subject Rights Requests should also be sent toemployeesubjectaccessrequest@taboola.com.

5.3

Users who engage with the Taboola Content Discovery Platform can make a Data Subject
Rights Request here. All Data Subject Rights Requests and questions that you receivefrom non-Taboolars should be sent to Taboola’s Privacy Team at privacy@taboola.com.
23

6.

What to Do if You Receive a Data Subject Rights Request from a Taboolar or a
Non-Taboolar Data Subject

6.1

If you receive a Data Subject Rights Request from another Taboolar, you should
immediately direct the request to employeesubjectaccessrequest@taboola.com. Pleasealso include the date on which you received it, along with any other information that may
help us efficiently respond to the request.

6.2

If you receive a Data Subject Rights Request from a User who interacts with the Taboola
Content Discovery Platform, you should (1) immediately refer the Data Subject to Taboola’s
Data Subject Access Request Portal, available here and (2) immediately forward the request
to Taboola’s Privacy Team, at privacy@taboola.com, and please also include the date on
which you received it, along with any other information that may help us efficiently respondto the request.

6.3

If you receive a Data Subject Rights Request from a Customer, you should immediately
direct the request to Taboola’s Privacy Team, at privacy@taboola.com. Please also include
the date on which you received it, along with any other information that may help us
efficiently respond to the request.

6.4

European data protection legislation demands that Taboola respond to requests within avery short time frame, so it is crucial that you immediately direct any Data Rights Requests
you receive to the appropriate person indicated above without delay.

7.

Verification Process

7.1

Taboola’s Privacy Team will assess every Data Rights Request that we receive to determine
whether Taboola is the controller or a processor of the data requested. We may also needto verify that the request has been made by a genuine Data Subject (which may requirethat we request further identification of the requestor).

7.2

If we determine that Taboola is a processor of the Data Subject’s requested data, and that
one of Taboola’s Customers or another third party is the controller of this data, thenTaboola shall notify the Customer or third party as soon as possible, per data protection
regulations. Taboola shall also help the controller comply with the Data Subject Rights
Request (in accordance with any contract terms which may be in place with the controller).

7.3

If we determine that Taboola is the controller of the Data Subject’s requested data, Taboola
shall contact the individual in writing to confirm receipt of the Data Subject Rights Request
and seek confirmation of identity (if not already validated).

7.4

If Taboola is not exempt under applicable data protection laws from fulfilling the Data
Subject Rights Request (see Section 9.1, below), then Taboola, to the extent it deems
necessary, will request any further information needed to action the individual's request.
24

Once Taboola has all the information it needs to honor the Data Subject Rights Request,
Taboola will respond to the request in accordance with Section 11, below.

8.

Exemptions from Requirement to Respond to a Data Subject Rights Request

8.1

Taboola is permitted to decline to honor a Data Subject Rights Request that is excessiveor manifestly unfounded (for example, because repetitive requests have been made). In thiscase, Taboola must be able to demonstrate that the request is in fact, excessive or
manifestly unfounded.

8.2

In some cases, specific additional exemptions may apply. Where specific exemptions
relating to particular Data Subject Rights Request exist, these are explained below.

8.3

If Taboola is exempt from the requirement to fulfill a received Data Subject Rights Request,
then Taboola will notify the individual that we intend to decline the Data Subject Rights
Request and explain why an exemption applies. Taboolars should always forward inquiries
to Taboola’s Privacy Team, at privacy@taboola.com, who can make an assessment about
whether such an exemption applies. Please never make this determination yourself.

9.

Timeframe for Responding to a Data Subject Rights Request

9.1

Data Subject Rights Requests must be responded to without undue delay and in no caselater than one month from the receipt of the request, unless this is not possible because
the request is particularly complex. In such complex cases, Taboola will be entitled toextend its response period by up to two additional months. Within the initial monthfollowing receipt of the Data Subject Rights Request, Taboola must provide the Data
Subject with notice of its intention to respond within this extended time period. The noticeprovided must explain the reasons for the delay. Given this short time frame for responding
to Data Subject Rights Requests, it is imperative that you direct any requests that you
receive immediately to Taboola Privacy Team, at privacy@taboola.com.

10.

Charging for Data Subject Rights Requests

10.1

Taboola is not legally permitted to charge for acting on a Data Subject Rights Request
unless Taboola is exempt from the obligation to act on the request (see Section 8, above)
but is nonetheless prepared to act on the request anyway. In such a case, Taboola may
charge the Data Subject a reasonable fee that accounts for the administrative costs ofproviding the information or communication or taking the action requested. Please consult
with Taboola’s Privacy Team before seeking to impose any fees for responding to a Data
Subject Rights Request.

25

11.

Requests for Access to Personal Data

The Right of Access: This is a Data Subject’s right to obtain confirmation about whether his or her
data is processed by a controller, and, if so, to be provided with details about and accessto that Personal Data.
Information to be Provided in Response to a Right of Access Request
11.1

A Data Subject is entitled to request a copy of his or her Personal Data from Taboola.
Where a Data Subject makes such a request, Taboola must confirm whether it holds andis processing Personal Data about that Data Subject and, if so, Taboola must provide that
Personal Data to the Data Subject in an intelligible form.

11.2

The Data Subject making the request should also be provided with the following
information:
11.2.1A description of the Personal Data and categories of Personal Data concerned;

11.2.2The expected period for which the Personal Data will be stored;

11.2.3The purposes for which the Personal Data is being held and processed;

11.2.4

The recipients or classes of recipients to whom the Personal Data is, or may be,disclosed by Taboola;11.2.5

Confirmation of the Data Subject’s right to request rectification or erasure of hisor her Personal Data or to restrict or object to its processing;

11.2.6

Confirmation of the Data Subject’s right to lodge a complaint with a competent
data protection authority;

11.2.7

Details about the source of the Personal Data, if it was not collected from theData Subject;

11.2.8

Details about whether the Data Subject’s Personal Data is subject to automateddecision-making (including profiling); and11.2.9Where Personal Data is transferred from the European Economic Area to a
country outside of the European Economic Area, the appropriate safeguards that
Taboola has put in place relating to transfers in accordance with European dataprotection laws.

Format of Requests
11.3

An access request does not have to be official or mention data protection law to qualify as
a valid request. Please keep this in mind to the extent you receive any type of request froma User or Client — if you are not sure, it is best to check with Taboola’s Privacy Team, atprivacy@taboola.com.

11.4

An access request does not need to be made in writing and can be made orally but it is
helpful if it is made in writing (for record keeping purposes). If made in writing it is also26

helpful if the Data Subject provides their email address and confirms whether the
information can be sent to them by email (or other means by which they prefer to receive
the information). Requests made electronically (e.g., by email) must be responded toelectronically (in a commonly used format) unless the Data Subject stipulates otherwise.
Data Subjects may ask for information to be provided orally instead. This is especially
important for our human resources Taboolars to keep in mind, since they are most likely toreceive oral requests from other Taboolars.
Exemptions
11.5

Taboola is not permitted to refuse to comply with an access request unless it candemonstrate that it is not in the position where we can identify the Data Subject who ismaking the request or Taboola is exempt from its obligations to comply (see Section 8,
above, regarding exemptions).

12.

Requests to Rectify Personal Data

The Right to Rectification: This is a Data Subject’s right to obtain rectification of inaccurate
Personal Data that a controller may process about him or her.
Rectification by Taboola
12.1

If Taboola holds inaccurate or incomplete records of Personal Data about a Data Subject,
the Data Subject is entitled to request that the Personal Data is rectified.

Rectification by Third Parties
12.2

If Taboola rectifies a Data Subject’s Personal Data, Taboola must also convey thisrectification to any third parties that also use this Personal Data for processing purposes.
See Section 4, above.

Supplementary Statements to Complete Personal Data
12.3

Because a request to rectify Personal Data involves ensuring that the records are complete,
the Data Subject may elect to provide a supplementary statement so that Taboola may
complete the records of Personal Data held about them. This process is unlikely to happen
in connection with Taboola’s Users, because we only hold their pseudonymized data.
However, this may occur in connection with the Personal Data that we hold about ourCustomers or Taboolars.

13.

Requests to Erase Personal Data ("Right to be Forgotten")

The Right to Erasure: This is a Data Subject’s right to require a controller to erase his or her
Personal Data on certain grounds – for example, where the Personal Data is no longer
necessary to fulfil the purposes for which it was collected.
27

Circumstances in Which Right to Erasure Applies
13.1

A Data Subject may request that Taboola erases his or her Personal Data in the following
circumstances:
13.1.1The Personal Data is no longer necessary for the purpose for which it wascollected or otherwise processed;

13.1.2The Personal Data was unlawfully processed by Taboola;13.1.3

If the processing was on the basis of the Data Subject’s given consent, and theData Subject elects to withdraw his or her consent (and Taboola does not rely on
any other legitimate interest grounds for our processing);

13.1.4

The Data Subject objects to Taboola’s processing of his or her Personal Data(see Section 14, below) and Taboola does not have any overriding legitimate
interest grounds for continuing to process the information; and13.1.5

The Personal Data needs to be erased to comply with Taboola's legal obligations.

13.1.6

Taboola’s Users may access and delete their Personal Data though Taboola’s
Data Subject Access Request Portal, available here.

13.1.7

Taboola’s Customers may send an access or deletion request directly to our
Taboolars. If you receive such a request from a Customer, please immediately
direct it to Taboola’s Privacy Team, at privacy@taboola.com.

13.1.8

Taboola’s
EEA
Taboolarsshouldreach
out
employeedatasubjectrights@taboola.com to make any such requests.

toErasure of Personal Data by Processors
13.2

If Taboola erases a Data Subject’s information further to such a request, Taboola must also
notify its processors. See Section 4, above.

13.3

If Taboola has made the Data Subject’s Personal Data public (for example, by publicly
posting a photograph of a Taboolar or Customer from an event), and if Taboola is obliged
to erase the Personal Data pursuant to a Data Subject Rights Request, Taboola must takereasonable steps, including technical measures (balancing its available technology and thecost of implementation), to inform processors that are processing the Personal Data thatthe Data Subject has requested that this Personal Data, and any links to, copies, or
replicas, of the Personal Data be erased. This is most relevant for Taboolars in ourMarketing Departments, so please consult with Taboola’s Privacy Team, atprivacy@taboola.com, if you receive any erasure requests from Customers or potential
customers following any marketing events.

28

Exemptions
13.4

14.

In addition to the exemptions referred to above, Taboola is exempt from the obligation toerase Personal Data where its processing is necessary for:13.4.1

Compliance with Taboola's legal obligations;13.4.2

Establishing, exercising, or defending legal claims;

13.4.3

Scientific, historical, or statistical purposes where erasure of the Personal Data
would make this processing impossible or seriously impair it (please note that thisexemption is unlikely to apply to Taboola).

Right to Object to Processing

The Right to Object: This is a Data Subject’s right to object to a controller’s processing of his or
her Personal Data, if the controller is processing based on legitimate interest grounds.
Circumstances in Which Data Subjects May Object to Processing
14.1

A Data Subject may object to Taboola’s processing of his or her Personal Data, where
Taboola relies on its legitimate business interests as the grounds for processing the
Personal Data.

Exemptions
14.2

In addition to the exemption referred to above, Taboola is exempt from the obligation tocease further processing of a Data Subject’s Personal Data if:
14.2.1 Taboola can demonstrate that we have compelling legitimate interest grounds forprocessing the Personal Data that override the interests, rights, and freedoms of
the Data Subject;
14.2.2 The processing is to establish, exercise, or defend a legal claim; and14.2.3 The processing is for scientific, historical, or statistical purposes carried out in the
public interest (please note that this exemption is unlikely to apply to Taboola).

29

15.

Right to Restriction

The Right to Restriction: This is a Data Subject’s right to require that Taboola restrict its processingof his or her Personal Data.
15.1

Where certain grounds are met (for example, where a Data Subject has contested theaccuracy of data and a period of time is required for Taboola to verify the accuracy of the
Personal Data or if Taboola is determining whether a Data Subject’s objection to processing
overrides Taboola’s legitimate interests), the processing of the Data Subject’s Personal
Data will need to cease, absent the Data Subject’s specific consent. If you believe you havereceived a request for restriction, please share it immediately with the Taboola Privacy
Team, at privacy@taboola.com.

16.

Right to Data Portability

The Right to Data Portability: This is Data Subject’s right to request that a controller provide any
Personal Data that it processed with the Data Subject’s consent via automated means toanother controller in a structured, commonly used, and machine-readable format.
16.1

For Taboola, this is likely to only apply when a Taboolar leaves Taboola to another
employer. In such cases, Taboola shall take confidentiality into consideration before
making any such transfer.

17.

Right to Not Be Subject to Automated Decision Making (Including Profiling)

The Right to Not Be Subject to Automated Decision Making: This is the Data Subject’s right toobject to an automated decision made about an individual (for example, without a human
involved) which has a legal or other similar effect on the individual. Individuals can ask forhuman intervention in the process.
17.1

Taboola does not engage in this type of automated decision making.

18.

Right to Object to Direct Marketing

The Right to Object to Direct Marketing: This is a Data Subject’s right to object to direct marketing,including profiling relating to direct marketing.
18.1

If Taboola receives a request to stop using Personal Data for direct marketing purposes,
we must stop doing so. Please refer our Customers to our subscription center if you receive
any such request and refer the request to Taboola’s Marketing Team at
marketing@taboola.com.

30

PRC Data Subject Rights Handling Policy
1.

Introduction

Taboola has issued this PRC Data Subject Rights Handling Policy to describe the practices andprocedures that Taboola follows when it receives requests about our use of Personal Data (in thisPRC Policy, referred to as “Personal Information”) from: (i) individuals who interact with Taboola’sContent Distribution Platform (“Users”); (ii) publishers, advertisers, and other content providers withwhom Taboola has a contractual relationship, ("Customers"); and (iii) Taboola’s permanent andnon-permanent employees, former employees, contractors, consultants, temporary workers,
interns, job applicants, and volunteers ("Taboolars"). Any individual User, Customer, or Taboolar in
the People’s Republic of China, (“PRC”) whose data is processed by Taboola shall each be referredto hereinafter as a “Data Subject”.

2.

Rights That All Data Subjects Have Regarding Their Personal Information

Data Subjects have data protection rights that they may exercise by making a request to Taboola(a “Data Subject Rights Request”). These data subject rights include the:●Right to be informed●

Right to determine, restrict, and refuse data handling●

Right to access and request a copy●

Right to rectify and supplement●

Right to delete●

Right of portability●

Right relating to automated decisions●

Right of the deceased

2.1

Each of these rights is described in more detail in Sections 11-18 below.

2.2

The procedures described in this PRC Data Subject Rights Handling Policy outline how
Taboola, as a processing entity (the entity determining the purpose for which, and mannerin which, the Personal Information is processed), will respond to any Data Subject Rights
Requests.

3.

Responsibility to Respond to a Data Subject Rights Request

3.1

The personal information processing entity of a Data Subject’s Personal Information is
primarily responsible for responding to a Data Subject Rights Request and for facilitating
the Data Subject’s exercise of his or her rights under applicable data protection laws. For
31

example, because Taboola determines what data it will collect from its Taboolars, and how
it will process this Taboolar data, Taboola is the processing entity of the Taboolar’s
Personal Information that it holds and processes. As the processing entity of the Taboolar’sData, Taboola must respond to any Data Subject Rights Request we receive from a
Taboolar.
3.2

In certain circumstances, Taboola may process a Data Subject’s Personal Information as
an entrusted party on behalf of a third party who is the processing entity (rather than for its
own purposes). In such instances, Taboola must inform the relevant third party promptly
and provide it with reasonable assistance to help the third party honor the Data Subject’s
rights in accordance with applicable data protection laws.

4.

Personal Information That Taboola Has Made Available to Third Parties

4.1

If Taboola shares Personal Information with third parties, it is our responsibility to inform
those third parties of any request we receive from Data Subjects to rectify, erase, or restrict
their Personal Information, unless doing so would involve disproportionate effort or is
impossible. For example, when Taboola receives a Data Subject Rights Request, we must
notify any relevant Taboola entity, processors, or other third parties (such as occupational
health providers) that we have disclosed the Personal Information to, so that they may also
update their records accordingly. As a general rule, in order to comply with thisrequirement, Taboola requires that all of its entrusted parties erase any Personal
Information they receive from Taboola within thirty (30) days of their receipt of such Personal
Information. If you have concerns about any service providers that you are engaged with,please consult with Taboola’s Legal Team, at legal@taboola.com.

4.2

If requested, Taboola must also provide the Data Subject with details about third parties towhom we have disclosed the Data Subject's Personal Information.

5.

Where Can You Send Your Own Data Subject Rights Requests and Questions?

5.1

If you are a Taboolarin the PRC, and you wish to make a Data Subject Rights Request
regarding the Personal Information that Taboola holds about you, please send your request
to employeesubjectaccessrequest@taboola.com.

5.2

Any questions regarding Taboolar Data Subject Rights Requests should also be sent toemployeesubjectaccessrequest@taboola.com.

5.3

Users who engage with the Taboola Content Discovery Platform can make a Data Subject
Rights Request via Taboola's Global Data Subject Access Request Portal. All Data Subject
Rights Requests and questions that you receive from non-Taboolars should be sent to
Taboola’s Privacy Team at privacy@taboola.com.

32

6.

What to Do if You Receive a Data Subject Rights Request from a Taboolar or a
Non-Taboolar Data Subject

6.1

If you receive a Data Subject Rights Request from another Taboolar, you should
immediately direct the request to employeesubjectaccessrequest@taboola.com. Pleasealso include the date on which you received it, along with any other information that may
help us efficiently respond to the request.

6.2

If you receive a Data Subject Rights Request from a User who interacts with the Taboola
Content Discovery Platform, you should (1) immediately refer the Data Subject to Taboola’s
Data Subject Access Request Portal, available here and (2) immediately forward the request
to Taboola’s Privacy Team, at privacy@taboola.com, and please also include the date on
which you received it, along with any other information that may help us efficiently respondto the request.

6.3

If you receive a Data Subject Rights Request from a Customer, you should immediately
direct the request to Taboola’s Privacy Team, at privacy@taboola.com. Please also include
the date on which you received it, along with any other information that may help us
efficiently respond to the request.

6.4

PRC data protection legislation demands that Taboola respond to requests within a very
short time frame, so it is crucial that you immediately direct any Data Rights Requests you
receive to the appropriate person indicated above without delay.

7.

Verification Process

7.1

Taboola’s Privacy Team will assess every Data Rights Request that we receive to determine
whether Taboola is the processing entity or an entrusted party of the data requested. We
may also need to verify that the request has been made by a genuine Data Subject (which
may require that we request further identification of the requestor).

7.2

If we determine that Taboola is an entrusted party of the Data Subject’s requested data,
and that one of Taboola’s Customers or another third party is the processing entity of thisdata, then Taboola shall notify the Customer or third party as soon as possible, per dataprotection regulations. Taboola shall also help the processing entity comply with the Data
Subject Rights Request (in accordance with any contract terms which may be in place withthe processing entity).

7.3

If we determine that Taboola is the processing entity of the Data Subject’s requested data,
Taboola shall contact the individual in writing to confirm receipt of the Data Subject Rights
Request and seek confirmation of identity (if not already validated).

7.4

If Taboola is not exempt under applicable data protection laws from fulfilling the Data
Subject Rights Request (see Section 8.1, below), then Taboola, to the extent it deems
necessary, will request any further information needed to action the individual's request.
33

Once Taboola has all the information it needs to honor the Data Subject Rights Request,
Taboola will respond to the request in accordance with Section 9, below.

8.

Exemptions from Requirement to Respond to a Data Subject Rights Request

8.1

If Taboola is exempt from the requirement to fulfill a received Data Subject Rights Request,
then Taboola will notify the individual that we intend to decline the Data Subject Rights
Request and explain why an exemption applies. Taboolars should always forward inquiries
to Taboola’s Privacy Team, at privacy@taboola.com, who can make an assessment about
whether such an exemption applies. Please never make this determination yourself.

9.

Timeframe for Responding to a Data Subject Rights Request

9.1

Data Subject Rights Requests must be responded to without undue delay It is imperativethat you direct any requests that you receive immediately to Taboola Privacy Team, atprivacy@taboola.com.

10.

Right To Be Informed

10.1

Data subjects have the right to be informed of the processing activities. In particular,
the PIPL requires that processing entities should provide the following information
to Data Subjects prior to the processing of their personal information:
(a)
(b)
(c)
(d)
(e)
(f)

The identity and contact details of the processing entity;
The purposes and methods of the processing;
The type of Personal Information to be handled and the storage period;
The methods and procedures for data subjects to exercise their rights;
Other information that is required to be informed by laws and regulations;andChanges to the above, if any.

10.2

If the above information is provided through privacy policies, such policies should
be made public and easy to be accessed and saved. Data subjects have the rightto request explanations on such policies.

10.3

Applicable privacy law and regulations outline two instances in which a controlling
entity will be exempted from the above obligations: where law or regulation requiresthat processing Personal Information be (1) confidential or (2) exempted fromnotification.

34

11.

Right To Determine, Restrict, and Refuse Data Processing

11.1

Data Subjects have the right to determine whether to permit the processing
activities proposed by data handlers, and have the right to restrict or refuse wholeor part of such activities.

11.2

However, it is pending further clarification by PRC legislators as to how could a data
subject exercise such rights (particularly for the circumstances where the dataprocessing activities are relying on legal bases other than consent).

12.

Right Of Access And Right To Request A Copy Of Personal Information

12.1

Data subjects have the right to access and request a copy of their personal
information, whilst the PIPL provides exceptions to such rights where law or
regulation requires the processing of Personal Information (either carried out by
government authorities or other data handlers) to be confidential or be exemptedfrom notification.

13.

Right To Rectify And Supplement

13.1

Where the personal information is not accurate or complete, data subjects have theright to request data handlers to rectify or supplement the information in a timely
manner (after necessary verification by data handlers).

14.

Right To Delete

14.1

Data subjects have the right to request the deletion of their personal information,
under the circumstances that data handlers fail to delete the information after one
or more of following circumstances is triggered:
(a)
(b)
(c)
(d)
(e)

14.2

The purposes of data handling have been achieved, or have failed to beachieved, or it is no longer necessary for achieving the purposes;
The processing entity has ceased to provide the products or services, orthe agreed storage period has expired;
Data Subjects have withdrawn their consent;
The processing entity has violated applicable laws or regulations or any
agreement relating to the handling of personal information; orOther situations provided for by law or regulation.

Notably, if the statutory storage period is not expired (which may under otherapplicable laws and regulations) or it is technically unfeasible to delete the personal
information, data handlers should cease the handling activities (except for taking
necessary security measures and storage of information).

35

15.

Right Of Portability

15.1

As an important change brought by the PIPL, data subjects are granted the right torequest their personal information to be transferred to other designated data
handlers, provided that such request satisfies certain conditions to be raised by
Cyberspace Administration of China ('CAC').

15.2

However, the details on exercising such right are pending further clarification.
Particularly, the CAC conditions are yet to be released to the public and it is also
unclear as to the scope of personal information that could be portable.

16.

Right Relating to Automated Decisions

16.1

Where the personal information is used for automated decision and such decision
may cause material impact to personal rights and interests, data subjects have theright to request an explanation on such handling activity and refuse to accept any
determination that is made merely relying on the automated decision.

16.2

Similarly, if the automated decision is applied for message pushes or marketingpromotion, data subjects have the right to refuse such handling.

17.

Right Of The Deceased

17.1

For the Personal Information of the deceased, the above rights to access, copy,
rectify, and deletion could be exercised by his/her close relatives (for lawful andlegitimate interests of their own), unless there exists other arrangement that is priorly
made by the deceased.

36

COVID-19 Return to Office Data Use Notice
Overview
Due to the outbreak of the Coronavirus pandemic (COVID-19), Taboola’s global offices
were closed indefinitely to ensure the safety of our Taboolars. Taboola’s management,
legal, and HR departments have closely monitored health and safety guidance from therelevant national and regional authorities and the World Health Organization, particularly
about measures required to safely reopen our offices. We will begin to do so on a regional,
incremental, and voluntary basis. These office-specific guidelines set forth the Personal
Data that will be collected from Taboolars that elect to return to the office before they are
required to do so, and Taboola’s limited uses and retention of their Personal Data for thispurpose.
Israel Office Reopening
By choosing to return to the office, you agree to:•

Only enter the office premises if you:
1. Are vaccinated for COVID-19 and hold a valid Green Pass; or
2. Are a recovered COVID-19 patient and hold a valid Green Pass; or
3. Hold a negative COVID-19 Test (PCR) from the preceding 72 hours or hold anegative rapid COVID-19 Test result from the same day; and4. Are not experiencing any specified COVID-19 symptoms or a temperature equal
to or exceeding 38°C.

•

Notify office administrators or HR if:
1. You have received a positive COVID-19 Test result; or
2. Your Green Pass is not valid.

•

Leave the office premises if:
1. At any time, you experience any COVID-19 symptoms; or
2. Asked to do so by office administrators or HR because, as per the company’s
discretion, your presence creates a health risk to other Taboolars at the office;
or
37

•

3. Your Green Pass is not valid.
Taboola will only collect the following Personal Data:
1. Names of Taboolars who provide a vaccination certificate or Green Pass.
2. Vaccination status.
3. Positive COVID-19 Test result.

Taboola will retain the Personal Data related to your vaccination status for as long as theGreen Pass is valid and shall use it to activate your entrance card to the office. Taboola willretain this Personal Data for the minimum time necessary to comply with the local
government’s reporting obligations. It may be used only to (1) comply with any relevant
reporting obligation to the relevant governmental authority, or (2) inform other individuals
who may have been exposed, without disclosing any Personal Data of the Taboolar who
received a positive COVID-19 Test result. To be clear, the Taboolar’s Personal Data shallbe made available only on a need-to-know basis to one or more of the following: (i) Office
Administrators, (ii) IT, and (iii) HR.
London Office Reopening
By choosing to return to the office, you agree to:•

Only enter the office premises if you:
1. Provide proof of a negative COVID-19 Lateral Flow Test result, administered
within the preceding 72 hours, from NHS England (i.e., email or text
notification); and2. Are not experiencing any specified COVID-19 symptoms or temperature equalor exceeding 38°C; and3. Have not received a positive COVID-19 Test result in the previous ten (10)
days.

•

Notify office administrators or HR if you received a positive COVID-19 Test result•

Leave the office premises if:
1. At any time, your temperature is or exceeds 38°C; or
2. Asked to do so by office administrators or HR because, as per the company’s
discretion, your presence creates a health risk to other Taboolars at the office.

•Taboola will only collect the following Personal Data:
1. Names of employees working from the office.
2. Names of employees who provide a positive COVID-19 Test result.
38

Taboola will retain this Personal Data for the minimum time necessary to comply with thelocal government’s reporting obligations. It may be used only to (1) comply with any relevant
reporting obligation to the relevant governmental authority, or (2) inform other individuals
who may have been exposed, without disclosing any Personal Data of the Taboolar who
received a positive COVID-19 Test result. To be clear, the Taboolar’s Personal Data shallbe made available only on a need-to-know basis to one or more of the following: (i) Office
Administrators, (ii) IT, and (iii) HR.
New York Office Reopening
By choosing to return to the office, you agree to:•

Only enter the office premises if you:
1. Are vaccinated for COVID-19 and hold either a valid COVID-19 Vaccination
Record Card or a valid Excelsior Pass; and2. Are not experiencing any specified COVID-19 symptoms or temperature whichis equal to or exceeds 100°F (38°C); and3. Have not received a positive COVID-19 Test result in the previous ten (10)
days.

•

Notify office administrators or HR if you have received a positive COVID-19 Test
result.

•Leave the office premises if:
1. You are not vaccinated for COVID-19; or
2. At any time, you are experiencing any specified COVID-19 symptoms or
temperature which is equal to or exceeds 100°F (38°C).

•

Taboola will only collect the following Personal Data:
1. Names of employees who provide evidence of vaccination status.
2. Names of employees notify office administrators or HR of a positive COVID-19
Test result.

Taboola will retain this Personal Data for the minimum time necessary to comply with thelocal government’s reporting obligations. It may be used only to (1) comply with any
relevant reporting obligation to the relevant governmental authority, or (2) inform otherindividuals who may have been exposed, without disclosing any Personal Data of the
Taboolar who received a positive COVID-19 Test result. To be clear, the Taboolar’s
39Personal Data shall be made available only on a need-to-know basis to one or more of
the following: (i) Office Administrators, (ii) IT, and (iii) HR.
France Office Reopening
We encourage Taboolars who return to the office to first be vaccinated or receive anegative COVID-19 Test (PCR) result. Should a Taboolar receive a positive COVID-19
Test result, that Taboolar has a legal obligation to notify the French Social Security
Authorities, and such authorities shall notify any individuals who may have been exposed.
Should a Taboolar voluntarily choose to notify Taboola about a positive COVID-19 Test
result or exposure, Taboola will inform other individuals who may have been exposed,
without disclosing any Personal Data of the Taboolar who received a positive COVID-19
Test result.
By choosing to return to the office, you agree to:•

Only enter the office premises if you:
1. Are not experiencing any specified COVID-19 symptoms or temperature equal
to or exceeding 38°C; and2. Have not received a positive COVID-19 Test result in the previous ten (10)days•

Leave the office premises if you are experiencing any specified COVID-19 symptoms,
or if your temperature is or exceeds 38°C•

Notify your country manager in case you are unwell and intend to leave the office•

Taboola will only collect names of Taboolars working from the office to inform of any
exposures that are voluntarily brought to Taboola’s attention

Spain Office Reopening
We encourage Taboolars who return to the office to first be vaccinated or receive anegative COVID-19 Test (PCR) result. Should a Taboolar receive a positive COVID-19
Test result, the Taboolar must immediately contact their country manager. Taboola will
inform other individuals who may have been exposed, without disclosing any Personal
Data of the Taboolar who received a positive COVID-19 Test result. Additionally, should a
Taboolar experience COVID-19 symptoms or receive a positive COVID-19 Test result, theTaboolar must immediately contact the telephone number provided by the corresponding
Autonomous Community or health center.
40

By choosing to return to the office, you agree to:•

Only enter the office premises if you:
1. Are not experiencing any specified COVID-19 symptoms or temperature equal
to or exceeding 38°C; and2. Have not received a positive COVID-19 Test result in the previous ten (10)
days.

•

Leave the office premises if you are experiencing any specified COVID-19 symptoms,
or if your temperature is or exceeds 38°C.

•

Notify your country manager in case: (i) you are unwell and intend to leave the office;or (ii) receive a positive COVID-19 Test result.

•

Taboola will only collect the following Personal Data:
1. Names of Taboolars working in the office.
2. Names of Taboolars who provide a positive COVID-19 Test result.

Taboola will retain this Personal Data for the minimum time necessary to comply with thelocal government’s reporting obligations. It may be used only to (1) comply with any relevant
reporting obligation to the relevant governmental authority, or (2) inform other individuals
who may have been exposed, without disclosing any Personal Data of the Taboolar who
received a positive COVID-19 Test result. To be clear, the Taboolar’s Personal Data shallbe made available only on a need-to-know basis to the country manager and HR.
Turkey Office Reopening
By choosing to return to the office, you agree to:•

Only enter the office premises if you:
3. Are not experiencing any specified COVID-19 symptoms or temperature equal
to or exceeding 38°C; and4. Have not received a positive COVID-19 Test result in the previous ten (10)
days.

•

Leave the office premises if you are experiencing any specified COVID-19 symptoms,
or if your temperature is or exceeds 38°C. Should you experience COVID-19

41

symptoms or receive a positive COVID-19 Test result, you must also visit the nearest
medial institution.
•

Notify your country manager in case: (i) you are unwell and intend to leave the office;or (ii) you receive a positive COVID-19 Test result.

•

Taboola will only collect the following Personal Data:
1. Names of Taboolars attending the office.
2. Names of Taboolars who reported testing positive for COVID-19.

Taboola will retain this Personal Data for the minimum time necessary to comply with thelocal government’s reporting obligations, if any. It may be used only to (1) comply with any
relevant reporting obligation to the relevant governmental authority, or (2) inform otherindividuals who may have been exposed, without disclosing any Personal Data of the
Taboolar who reported testing positive for COVID-19. To be clear, the Taboolar’s
Personal Data shall be made available only on a need-to-know basis to the country
manager and HR.
Germany Office Reopening
We encourage Taboolars who return to the office to first make sure they obtained a negative
result of COVID-19 Lateral Flow Test. The test kit will be available for you at the office.
Should a Taboolar voluntarily choose to notify Taboola about a positive COVID-19 Test
result or exposure, Taboola will inform other individuals who may have been exposed,
without disclosing any Personal Data of the Taboolar who received a positive COVID-19
Test result.
By choosing to return to the office, you agree to:•

Only enter the office premises if you:
1. Are not experiencing any specified COVID-19 symptoms or temperature equal
to or exceeding 38°C; and2. Have not received a positive COVID-19 Test result in the previous ten (10)days•

Leave the office premises if you are experiencing any specified COVID-19 symptoms,
or if your temperature is or exceeds 38°C•

Notify your country manager in case you are unwell and intend to leave the office42

Taboola will only collect names of Taboolars working from the office to inform of any
exposures that are voluntarily brought to Taboola’s attention
LA Office Reopening
By choosing to return to the office, you agree to:•

Only enter the office premises if you:
1. Are vaccinated for COVID-19 and hold a valid COVID-19 Vaccination Record
Card; and2. Are not experiencing any specified COVID-19 symptoms or temperature whichis equal to or exceeds 100°F (38°C) for at least 24 hours prior to entering thepremises without the aid of any medicine; and3. Have not received a positive COVID-19 Test result in the previous ten (10)
days.

•

Notify HR if you have received a positive COVID-19 Test result.

•

Leave the office premises if:
1. You are not vaccinated for COVID-19; or
2. At any time, you are experiencing any specified COVID-19 symptoms or
temperature which is equal to or exceeds 100°F (38°C).

•

Taboola will only collect the following Personal Data:
1. Names of employees who provide evidence of vaccination status.
2. Photo ID.
3. Vaccination type and date of last dose.
4. Names of employees who notify office administrators or HR of a positive COVID19 Test result.

Taboola will retain this Personal Data for the minimum time necessary to comply with thelocal government’s reporting obligations. It may be used only to (1) comply with any
relevant reporting obligation to the relevant governmental authority, or (2) inform otherindividuals who may have been exposed, without disclosing any Personal Data of the
Taboolar who received a positive COVID-19 Test result. To be clear, the Taboolar’s
Personal Data shall be made available only on a need-to-know basis to one or more of
the following: (i) Office Administrators, (ii) IT, and (iii) HR.
43

Other Regional Offices
This COVID-19 Return to Office Data Use Notice shall be updated from time to time andwhen additional Taboola offices reopen in the coming months.
Contact
If you have any questions about this COVID-19 Return to Office Data Use Notice, pleasecontact Taboola’s Privacy Team at privacy@taboola.com, or your designated humanresources representative as listed below:(a)

In APAC: Anjali Oldfield, anjali.o@taboola.com(b)

In Israel: Efrat Israeli-Koren, efrat.i@taboola.com(c)

In EMEA: Anjali Oldfield, anjali.o@taboola.com(d)

In the United States: Lana Saad, lana.s@taboola.com(e)

In Brazil and Latin America: Natalie Coggins, natalie.c@taboola.com

44