Privacy Notice

BookRunner is operated by Infinitude Technologies Ltd. ("BookRunner", "we"). This notice explains what personal data we handle when you use:

• our website, bookrunner.app;
• the BookRunner platform used by Arrangers and their teams;
• BookRunner Direct (direct.bookrunner.app);
• the channels we run conversations on;
• Sabra for Zoom;
• our API and AI access.

BookRunner is a technology platform. It is not an arranger, underwriter, distributor, broker or investment adviser; it does not offer securities or give investment advice. Offerings on BookRunner are made by the Arrangers. BookRunner may also show documents that issuers have filed with a securities regulator for other offerings, as described in the Terms of Use.

Questions and requests: legal@bookrunner.app.

In this notice, "Arranger" means a bank, underwriter, placement agent or fund sponsor — or another firm that arranges, distributes or raises an offering — that uses BookRunner.

Investors an Arranger adds. When an Arranger adds its own investors to BookRunner to run an offering and reach them, the Arranger determines how and why that personal data is used, and BookRunner processes it on the Arranger's behalf. If an Arranger added you or contacted you through BookRunner, it is responsible for your data, and requests about that data should go to it first. We will help it respond.

An Arranger's staff. An Arranger that gives its staff access to BookRunner is responsible for informing them. We may share their use of the service with that Arranger, for example in activity logs and compliance reports.

People with their own BookRunner account. For the activities listed below, BookRunner determines how and why your personal data is processed:

• signing in to BookRunner Direct yourself;
• applying for investor verification;
• using an analysis capability such as Tender Analysis;
• writing to us through the website.

Website visitors. If you use the contact form, we collect your name, work email and company. Page views are counted as set out in section 8.

People who sign in to BookRunner Direct:

• your email address and its domain;
• details your organisation's sign-in provider shares with us, such as your name;
• any profile details you add (name, company, job title);
• records of sign-in attempts, including their time, outcome and IP address;
• your language choice;
• which version of our terms you accepted, and when;
• if you turn on notifications, a notification registration for your device.

Investors taking part in an offering:

• contact details provided by the Arranger or by you, such as name, email, phone, firm and role;
• the content of your conversations, in any channel, including voice communications;
• which documents you open;
• indications of interest and orders you place;
• where you provide them for settlement, account details.

People using analysis capabilities (such as Tender Analysis, Holdings or Brokerage): the questions asked, the answers given, and a record of use.

Arranger staff: account details and a record of actions taken in the platform.

Company participants (issuer representatives invited to follow an issuance): name, role, email, sign-in records, and any answers they propose.

Zoom calls attended by Sabra: the attendance and participant details set out on the Sabra for Zoom support page.

Investor verification applicants: see section 7.

You are not legally required to give us personal data, but without it we may not be able to provide the service.

We use personal data to:

• provide the service. That means signing you in, running conversations and answering questions from the materials an Arranger provides, routing questions to a banker, delivering messages and notifications, and running the capabilities you use;
• make offerings that Arrangers, including fund sponsors, place on the platform available to people with their own BookRunner account. If you have your own BookRunner account, an Arranger whose offering you view receives your identity when you consent to it, or when you place an indication of interest or an order with that Arranger;
• keep the service secure and prevent misuse, including automated-access checks and usage limits;
• keep the records an Arranger needs for its own compliance, such as conversation and compliance reports;
• communicate with you about the service, including sign-in codes;
• support, maintain and improve the service;
• analyse the service using aggregated or de-identified information;
• establish, exercise or defend legal claims;
• meet our legal obligations.

• The Arranger running the offering you take part in. If you have your own BookRunner account, this happens as described in section 4.
• The issuer of an offering whose filed documents BookRunner shows, or its underwriter where there is one, if you express interest in that offering.
• Our service providers, who process data for us under contract: hosting and databases, email delivery, messaging and voice, AI model providers that generate answers, speech processing, push notifications, security checks, usage-limit services, and website analytics. A list is available to Arrangers on request.
• Authorities, where the law requires it.
• Others, where needed to protect our rights, in legal proceedings, or to prevent fraud or serious harm.
• A buyer or successor, if our business is reorganised or sold.

Our service providers may process personal data outside your country, with the safeguards the law requires. Details are available on request.

When you apply for investor verification on BookRunner Direct, we collect:

• your name, email address and, if you choose, a mobile number and the kinds of offerings that interest you;
• if you upload a qualified-investor certificate: the document, the kind of professional who issued it, their name where you give it, and its issue date.

Your application goes to the Arranger named on the page you applied from, and that Arranger decides whether to verify you. If you are verified, other Arrangers on the platform can see that your investor status is verified and current when you open an offering they have listed.

Certificates are stored securely, and access is limited to people authorised to review them. BookRunner keeps the verification record on the Arranger's behalf, as evidence of the basis on which you were verified.

We use cookies and similar device storage to run the service:

• Sign-in session (BookRunner Direct and the platform) keeps you signed in and your session secure. It is set on our own domain by our authentication provider.
• Sign-in hand-offs are short-lived cookies (15–30 minutes) that carry an invitation or access link through sign-in.
• Language remembers the language you chose, for up to one year.
• Security check. Cloudflare Turnstile checks that a real person is signing in or sending a form. The check may run without anything for you to click. Cloudflare receives your IP address and browser signals for that purpose, under the Turnstile Privacy Addendum.
• On your device, BookRunner Direct stores layout choices (such as pane width) and that you saw the cookie notice. If you turn on notifications, it also stores a notification registration with Google Firebase Cloud Messaging.
• Website analytics. With your consent, our website and public campaign pages on BookRunner Direct (for example a tender's campaign page at direct.bookrunner.app/tender-il/…) use Google Analytics, which sets cookies, to count visits and see how pages are used. BookRunner Direct uses no analytics outside its public campaign pages. One choice covers both, is kept in a cookie for 12 months, and can be changed at any time from "Cookie settings" in the website's footer.
• Website accessibility menu. If you change a setting in the website's accessibility menu, your choices are stored on your device so they apply on every page.

You can clear cookies and device storage in your browser settings; you will then need to sign in again.

We keep personal data for as long as it is needed to provide the service and to meet legal and regulatory record-keeping requirements. That includes records an Arranger must retain. Afterwards, we delete it or anonymise it so that it no longer identifies an individual. Data that no longer identifies an individual, including aggregate and statistical data, may be retained and used without a fixed retention period, provided it remains non-identifiable.

Depending on the law that applies to you, you may ask to access, correct or delete your personal data, object to certain uses of it, or exercise other rights available to you under applicable law. Write to legal@bookrunner.app.

• If an Arranger contacted you through BookRunner, contact that Arranger first.
• We may need to confirm your identity.
• We respond within the period the law requires.
• Some records may have to be kept where the law requires it, and we will tell you if so.

We use technical and organisational measures appropriate to the service to protect personal data. No security measure can guarantee absolute security.

BookRunner may link to other websites and services. We are not responsible for them; their own terms and privacy notices apply.

We may update this notice. The date at the top shows when it last changed.

Infinitude Technologies Ltd. · legal@bookrunner.app
Arrangers may request our data processing agreement at the same address.