We are pleased about your interest in XLever GmbH. The protection of your personal data is important to us. We process personal data in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and other applicable data protection regulations. It is generally possible to use our website without actively providing personal data. However, where you use certain services, contact us, submit an application or otherwise interact with us, the processing of personal data may be necessary. This Privacy Policy explains what personal data we process, for what purposes, on which legal basis and what rights you have as a data subject. XLever implements appropriate technical and organizational measures to protect personal data processed through this website. Nevertheless, Internet-based data transmission can have security vulnerabilities, meaning that absolute protection cannot be guaranteed.

1. Definitions This Privacy Policy is based on the terminology used in the General Data Protection Regulation (GDPR). a) Personal Data Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier or one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity. b) Data Subject A data subject is any identified or identifiable natural person whose personal data is processed. c) Processing Processing means any operation or set of operations performed on personal data, whether or not by automated means. This includes, among other things, collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, transmission, dissemination, restriction, deletion or destruction. d) Restriction of Processing Restriction of processing means marking stored personal data with the aim of limiting its future processing. e) Profiling Profiling means automated processing of personal data used to evaluate certain personal aspects relating to a natural person. f) Pseudonymization Pseudonymization means processing personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and protected through appropriate technical and organizational measures. g) Controller The controller is the natural or legal person, public authority, agency or other body which alone or jointly with others determines the purposes and means of processing personal data. h) Processor A processor is a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller. i) Recipient A recipient is a natural or legal person, public authority, agency or other body to whom personal data is disclosed. j) Third Party A third party is a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons authorized to process personal data under the direct authority of the controller or processor. k) Consent Consent means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they signify agreement to the processing of personal data relating to them.

2. Name and Address of the Controller The controller within the meaning of the General Data Protection Regulation and other applicable data protection legislation is:

XLever GmbH i. G. Schmiedehof 1 10965 Berlin Germany Phone: +49 152 22410474 Website: www.xlever.ai Register Court: Amtsgericht Charlottenburg Commercial Register Number: not yet available VAT ID: not yet available

Data Protection Contact For questions regarding data protection, please contact: Deniz Koc XLever GmbH i. G. Schmiedehof 1 10965 Berlin Germany Phone: +49 152 22410474

When contacting us regarding data protection matters, please indicate that your request relates to XLever. Please do not send sensitive information, such as copies of identification documents, unless specifically requested.

3. Cookies The XLever website may use cookies. Cookies are small text files stored on a user’s device by an Internet browser. Cookies may contain a cookie identifier that enables websites and servers to distinguish one browser from another. Cookies may be used to provide website functionality, improve usability, analyze website usage and, where applicable, support marketing activities. Where cookies are not strictly necessary for operation of the website, they will only be used where the legally required consent has been obtained. Users can prevent the storage of cookies at any time by configuring their browser settings accordingly. Cookies that have already been stored can also be deleted using the browser or other software. If cookies are disabled, certain functions of the website may not be available or may only be available to a limited extent.

4. Collection of General Data and Information When the XLever website is accessed, certain general data and information may automatically be collected by the website server. This may include: - browser type and browser version - operating system - referring website - pages accessed on our website - date and time of access - Internet Protocol address (IP address) - Internet service provider - other technical information required to operate and secure the website This information is processed in particular to: - correctly deliver website content - ensure website functionality - optimize our website - maintain the security of our IT systems - detect and prevent technical attacks or misuse Server log data is not used to identify individual users unless this is necessary for security, legal or technical reasons.

5. Contact via the Website Our website provides options for contacting XLever electronically. If you contact us by email or via a contact form, we process the information you voluntarily provide. This may include: - your name - email address - telephone number - company - job title - contents of your message - other information you choose to provide The data is processed for the purpose of responding to your request, communicating with you and, where applicable, initiating or managing a contractual or business relationship. Depending on the nature of the request, processing is based on Art. 6(1)(b) GDPR, Art. 6(1)(f) GDPR or, where applicable, your consent pursuant to Art. 6(1)(a) GDPR. Personal data will not be disclosed to third parties unless this is necessary to process your request, permitted by law or you have consented to such disclosure. 6. Routine Deletion and Restriction of Personal Data We only store personal data for as long as necessary for the purpose for which it was collected or as required by applicable statutory retention periods. Once the purpose of processing no longer applies and no statutory retention requirement exists, the relevant personal data will be deleted or restricted in accordance with applicable law.

7. Rights of the Data Subject You have the following rights under applicable data protection law. a) Right of Access You have the right to request information as to whether we process personal data concerning you. Where personal data is processed, you may request information about that data and receive a copy in accordance with applicable law. b) Right to Rectification You have the right to request the correction of inaccurate personal data concerning you. You may also request completion of incomplete personal data. c) Right to Erasure You have the right to request deletion of personal data concerning you where the legal requirements are met. This right is sometimes referred to as the “right to be forgotten”. d) Right to Restriction of Processing You have the right to request restriction of processing where the legal requirements are met. e) Right to Data Portability Where processing is based on consent or a contract and is carried out by automated means, you may have the right to receive personal data you have provided to us in a structured, commonly used and machine-readable format. You may also have the right to transmit this data to another controller. f) Right to Object You have the right to object, on grounds relating to your particular situation, to processing of personal data based on Art. 6(1)(e) or Art. 6(1)(f) GDPR. Where personal data is processed for direct marketing purposes, you have the right to object to such processing at any time. g) Right to Withdraw Consent Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal. h) Right to Lodge a Complaint You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that the processing of your personal data violates applicable data protection law.

8. Data Protection in the Application Process XLever processes personal data of applicants for the purpose of managing the recruitment process. This may include: - contact information - CV - qualifications - employment history - application documents - interview information - communication related to the application Processing may also take place electronically, for example where an applicant submits application documents via email or a website form. Where an employment relationship is established, relevant personal data may be processed and stored for purposes connected with the employment relationship and in accordance with applicable law. Where no employment relationship is established, application data will be deleted after the legally appropriate retention period unless there is another legitimate basis for retaining it.

9. Website Analytics XLever may use analytics technologies to understand how visitors use the website and to improve website performance, content and user experience. Depending on the analytics tool used, information such as the following may be processed: - page views - referral source - browser information - device information - approximate location - interaction with website content - time spent on pages Where legally required, analytics technologies are only activated after the user has provided consent. Users may withdraw consent at any time through the website’s cookie or privacy settings.

10. Google Analytics Where Google Analytics is used on the XLever website, the service is used to analyze website usage and improve our website and content. Google Analytics may process information about website usage, including information about the pages viewed, device and browser information, approximate location and user interactions. Where required by law, Google Analytics will only be activated after the user has provided consent. Further information regarding Google’s processing of personal data is available in Google’s privacy information.

11. Google Advertising Services Where XLever uses Google advertising services, these services may be used to measure advertising effectiveness, understand website conversions or display relevant advertising. Cookies or similar technologies may be used for this purpose. Where legally required, such services will only be activated after consent has been provided. Consent may be withdrawn at any time through the available cookie settings.

12. Instagram XLever may maintain a presence on Instagram and may integrate links or components relating to Instagram on its website. If users access Instagram or interact with integrated Instagram functionality, personal data may be processed by the respective platform provider. The processing of personal data by Instagram is governed by the privacy terms of the respective provider. 13. LinkedIn XLever maintains a presence on LinkedIn and may integrate links or components relating to LinkedIn into its website. When users visit our LinkedIn profile, access LinkedIn through our website or interact with LinkedIn functionality, personal data may be processed by LinkedIn. LinkedIn may process information regarding account activity, interactions, device information and other usage data in accordance with its own privacy policies. Where LinkedIn technologies are used on the XLever website for analytics, advertising or conversion tracking, these technologies will only be activated with consent where legally required.

14. Duration of Storage The duration for which personal data is stored depends on the purpose of processing and applicable legal retention requirements. Where statutory retention periods apply, personal data will be stored for the required duration. After expiry of the relevant retention period, the data will be deleted unless it remains necessary for the performance or initiation of a contract, establishment or defense of legal claims or another lawful purpose.

15. Legal or Contractual Requirement to Provide Personal Data In certain circumstances, the provision of personal data may be required by law or may be necessary for entering into or performing a contract. For example, certain contact, company or billing information may be necessary to establish a contractual relationship with XLever. If required personal data is not provided, it may not be possible to enter into or perform the relevant contractual relationship.

16. Automated Decision-Making and Profiling XLever does not use solely automated decision-making, including profiling, that produces legal effects concerning individuals or similarly significantly affects them, unless explicitly stated otherwise and permitted by law.

17. Legal Basis for Processing Depending on the relevant processing activity, XLever may process personal data on the following legal bases: - Art. 6(1)(a) GDPR — consent - Art. 6(1)(b) GDPR — performance of a contract or pre-contractual measures - Art. 6(1)(c) GDPR — compliance with legal obligations - Art. 6(1)(f) GDPR — legitimate interests pursued by XLever or a third party Where processing is based on legitimate interests, these may include in particular: - operation and security of our website - communication with customers and business partners - development of business relationships - improvement of our services - protection against misuse or security threats - establishment, exercise or defense of legal claims

18. Recipients and Service Providers XLever may use external service providers to support the operation of its website and business activities. These may include providers of: - website hosting - IT infrastructure - analytics - communication tools - recruitment systems - customer relationship management - marketing services - professional advisory services Where service providers process personal data on behalf of XLever, appropriate data processing agreements are entered into where required by law.

19. International Data Transfers Where personal data is transferred to recipients outside the European Economic Area, XLever ensures that an appropriate legal basis for the transfer exists. This may include: - an adequacy decision of the European Commission - Standard Contractual Clauses - another transfer mechanism permitted under the GDPR Where required, additional safeguards are implemented.

20. Changes to this Privacy Policy XLever may update this Privacy Policy from time to time to reflect legal, technical or organizational changes. The current version is always available on our website.