Privacy and Information Security

What is the Privacy Policy?

The Altshuler Shaham Group respects the privacy of the Users of each of the Group's Websites (in this policy: the “Website"), and is committed to protecting and maintaining the privacy of the Website's Users ("You" or the "User"). This Website operates at the internet address www.as-invest.co.il. This Website as well as other Websites of the Group also operate at other addresses, at the discretion of the Group.

The Altshuler Shaham Group includes the following companies: Altshuler Shaham Ltd., Altshuler Shaham Finances Ltd., Altshuler Shaham Provident Funds and Pension Ltd., Altshuler Shaham Investment House Ltd., as well as all subsidiaries, affiliates and related companies (as defined in the Securities Law, 5728- 1968) and any other company or partnership held by the controlling shareholders of any of these companies, or a company held by them ("Altshuler Shaham", the "Group" or "We").

This Privacy Policy (the "Policy") is intended to inform and teach you about the way we manage, collect, store and use personal information that you provide to us through the Website, or that we collect when you use the Website or its services. You should always exercise caution and judgment when providing personal information that could identify you or others.

The Policy also describes the measures we take to protect the personal information that we are collecting and how to contact us regarding anything and any matter related to privacy in the Group. The policy is an integral part of the Terms of Use of the Website and it is designed to allow you to get a complete picture before you decide whether to give personal information to the Group.

This policy is a general privacy policy of the Website and of the various services provided on it. In any case where an individual privacy policy exists for one of the Altshuler Shaham Group companies, or for any of the services or the products of the Group - the individual privacy policy will prevail over this policy in any case of a conflict between the two policy documents. For the avoidance of doubt, the information in this policy is in addition to private instructions given to you separately, for example in the framework of the products you purchased from any of the Group companies.

The privacy policy is worded according to the male gender for reasons of convenience only and it refers to all genders equally. Everything stated in singular, also refers to plural, as applicable.

The term "Personal Information" in this policy means any information, array of information or data that relates to a person, identifies that person or can reasonably be used to identify that person, such as your full name, email address, phone numbers, national number, date of birth, gender, residential address, marital status, employment status, payment details, etc..

Providing Details and Personal Information to the Group

General use of the Website and viewing the content published on it - do not involve registering or providing details and personal information.

However, different areas and sections of the Website, such as the personal area, the online mechanisms for joining the Group's products, contacting the Group using online contact forms, registering to receive information on various topics (including newsletters, magazines and marketing content), and more - may involve registration and the provision of personal information and personal and identifying details, according to necessity, the circumstances of the matter and the relevant online service. Some sections may include a User interface that will allow you to update your personal information or identification information. Some of them will even allow you to pay for the relevant financial service.

You will usually have to fill in the details of the person who will be the member or client of the Group, so that we can contact him, transfer documents related to his account or the joining procedure, and more. The fields that must be completed will often be explicitly marked.

Without derogating from the generality of the aforesaid, the following is a non-exhaustive list of examples, for illustration only, of cases where we ask you to provide us with personal information -

• When logging in and accessing the personal area: Accessing your personal area on the Website will usually involve entering a one-time password, or additional identification information, which may include personal information. We will collect your identification information and contact details, in order to send you the access information to the personal area and allow you to use it. The personal area on the Website will often allow you to view personal information concerning you, located in the Group's databases, as well as to perform various actions.
• When joining online the various services of the Group: If you choose to join one of the services that the Group offers on the Website, we will collect your identification information, contact details, employment and family status, details of your family members (to the extent that the information is relevant), details of a beneficiary (to the extent that the information is relevant) and any additional personal information that we need in order to complete the contractual engagement with you in general, we may collect biometric information, such as a facial photograph, to verify your identity and comply with various regulatory obligations and anti-money laundering laws.
• Appointment of an attorney-in-fact: If you are interested in appointing an attorney-in-fact to receive information from your accounts in the Group, we will collect from you your identification information, contact details, the identification information of the attorney-in-fact and the contact information of the attorney-in-fact.
• Signing up to receive updates: If you are interested in receiving updates, marketing messages and publications about various products and services on behalf of the Altshuler Shaham Group, we will collect your identification and contact details from you, so that we can send you the aforementioned information.
• Contacting us: If you wish to contact us, on any subject, and through any of the contact methods set forth in this policy, we will usually collect your identification and contact details, as well as preliminary information about the nature of your inquiry.
• Recording calls for purposes of service control: Some of the calls with the Group's customer service centers may be recorded for identification, verification, supervision and control purposes. The content of the conversations may include personal information.
• Jobs: When you contact us in response to job ads that we publish on the Website, we will usually collect identification information, contact information and information about your professional training (resume, information from recommenders, etc.) from you, so that we can evaluate and examine your candidacy for the relevant position.

Except where the provision of the personal information is due to a legal obligation - you are not required by law to provide us with the details of the personal information described in this policy. Their provision depends on your consent and your free will, however in order to use the Website and the Altshuler Shaham Group services in an optimal manner, you are asked to provide the Altshuler Shaham Group with the details of your personal information as requested in the body of the Website. Providing incorrect information or failing to provide the requested personal information may prevent you from completing the registration for the relevant service or the requested action, harm the quality of the service provided to you, as well as harm the ability to contact you if necessary.

If you convey personal information of third parties to us, such as family members, employees, customers, etc., you must inform them that their details will be conveyed to the Altshuler Shaham Group and you confirm and declare that you have received their express consent to give their personal information for the purpose of using it in accordance with this policy.

Information We Collect When You Use the Website

When you use the Website, we may collect information about your practices in relation to its use, including information or content you read, the pages you viewed, search queries you made, the online services and sections that interested you, the frequency of their use, the location of your computer and the data of the internet address (IP address) through which you accessed the Website, the type of operating system you use, the type of end device you have and more. Altshuler Shaham may use the services of third parties to collect and analyze this information in connection with the use of the Website, such as Google Analytics.

How do we use Personal Information?

Altshuler Shaham will use the details and personal information you provide, and the details collected by the Group when you use the Website and its services, in accordance with the provisions of this policy, the purposes of the relevant database of any of the Group's companies, or according to the provisions of any law, inter alia, for the following purposes -

• To allow you to use the Website, its contents, and the various services and sections it offers, including allowing you to join the various services and products provided by the Altshuler Shaham Group and to allow the Group to provide you with these services and products.
• In order to identify you or to verify your identity in accordance with the law and regulations that apply to the Group, or during your repeated entry into areas that require registration and to save you from entering your details each time;
• In order to improve and enrich the services and content on the Website, including creating new services and new content that match the Users' requirements and expectations, and to change or cancel existing services and content. The information that will be used by the Group for this purpose will mainly be statistical information, which does not identify you personally;
• For improving the information in the Group's databases;
• In order to allow you to adjust the services on the Website to your preferences;
• To periodically send you information about the Website's services and content, the Group's services and activities, advertisements, direct mail messages, surveys, newsletters, etc. Such information may be promotional in nature and it may be sent to you in writing, via text messages (SMS), email messages, or by other electronic means, as set forth on the Website's terms of use;
• To contact you when we believe it is necessary;
• For the proper operation and development of the Website and its services, including technical support and customer service;
• To enforce the provisions of the binding documents, in order to comply with the requirements of any law, regulation or other legislation, and in order to assist authorized authorities and any third party, when the Group believes in good faith that it should do so;
• For any other purpose, specified in this privacy policy or in any of the binding documents.
• For adapting the Group's services and investment policy to the Group's customers - Altshuler Shaham may use the details and personal information you provided in order to examine the suitability of the Group's products and services to you, as well as to offer you to adapt the investment policy to your personal characteristics, voluntarily and subject to your consent. For this purpose, the Group may also use decision-making systems based on algorithms and artificial intelligence tools (AI - Artificial Intelligence).

Providing your Personal Information

Except as set forth in this policy, the personal information you provide to the Group or that the Group collects will not be given, sold or shared with third parties without your consent, except in the cases hereafter-

• To the extent that this is necessary for the proper provision of the services of the Website or of the Group - we are entitled and may share personal information with third parties on our behalf, that assist us in the operation of our Website, in the management of the Group's business or in the provision of the services provided to you on behalf of any of the Group's companies, such as subcontractors. These third parties may use your personal information and process it only as necessary to perform the services they provide to us and in accordance with the Group's instructions, and they must take information security measures in order to protect and keep your personal information confidential;
• For example, and for the sake of illustration only, we use the identification and verification services of a third party, which uses biometric identification tools and means in order to comply with various regulatory obligations and anti-money laundering laws, regarding some of the Group's services and digital joining mechanisms.
• We are allowed to share personal information with third parties which you have authorized, in the framework of the services provided to you on behalf of any of the companies of the Altshuler Shaham Group or in the framework of another contractual engagement of yours with the Group.
• If you violate the Terms of Use on the Website or any of the binding documents, or if you perform through the Website, or in connection with it, actions that are considered by the Group to be against the law or attempt to perform such actions;
• If the Group receives a judicial order, or a demand from an authorized authority, instructing it to hand over your details or the personal information about you to a third party or to the relevant authority;
• In any dispute, claim, lawsuit, demand or legal proceedings, if any, between you and the Group, any of its companies, or anyone on their behalf;
• In any case that the Group believes that providing the personal information is necessary to prevent serious damage to your body or property, or to the body or property of a third party;
• For the avoidance of doubt, the Group companies may transfer and share your personal information between themselves, provided that they use this information only according to the provisions of this policy;
• For the purpose of providing and sharing information with other companies or organizations related to the Group and with suppliers, business partners, advertisers and any third party. The Group will not knowingly reveal your identity to these parties without your consent;
• If the Group, or any of its members, organizes their activities or the Website's activities in a different framework, as well as in the event that the Group changes the Group's legal structure, including in the event that the Group's activity, or part of it, is transferred to a third party - we will be entitled to transfer a copy of the personal information to the new entity about you, provided that this entity accepts on itself the provisions of this policy towards you;
• According to your express request.

Where is the Information Stored?

The information that a Group collects, or any of its companies, is stored in Altshuler Shaham's databases, which are stored at server hosting and data backup providers, which may also be located outside the borders of Israel, except to the extent that the law requires that the information be stored locally. Additional information, as set forth in this policy, is collected and stored by other companies (such as statistics companies, companies that provide identification and authentication services, etc.). They may also keep the information outside the country's borders. Your consent to this policy also constitutes consent to the storage of the information abroad and its transfer outside the borders of Israel.

Information Security

The Group attributes utmost importance to the security of the information in its systems. In order to preserve and protect the information, the Group operates systems, applications and procedures for the security of information, designed to minimize the risks of theft, damage, loss or unauthorized access to information, including personal information. However, there is no certainty that these applications absolutely guarantee that personal information will not be disclosed or stolen from the databases. Therefore, the Group does not guarantee, and you cannot reasonably expect, that the services and information systems used by Altshuler Shaham will be immune from unauthorized access to the information stored in them. By using the site and its services, you are aware of and agree to these limitations.

‘Cookies’ on the Website

We use 'cookies' on the Website. Cookies are text files that your browser creates according to a command from the Website's computers. Some of the cookies will expire when you close the browser (Session Cookies) and others will be stored on the hard drive of the end device you use, and will be used when you return and visit the Website (Persistent Cookies). The cookies can contain a variety of information such as information about the pages you visited, the length of time you stayed on the Website, where you came to the Website from, the information you sought to see when entering the Website, and more.

If your preference is that no cookies be stored on your computer, you can change your browser settings to reject certain types of cookies, or remove them manually. However, after rejecting the cookies or removing them from the end device, you may not be able to derive the maximum benefit from the services provided to you by Altshuler Shaham Group, including the Website services, or some of these services may not be available to you. We use cookies for several purposes. Some of the cookies we use on the Website are our cookies (first party cookies) and some are of third parties (third party cookies).

Database

You agree that information provided by you and/or collected about you, including in a children’s savings funds in your child's name, if any, will be stored in the databases of the Altshuler Shaham Group companies and it will be used, inter alia, for the purposes of management, operating and marketing Altshuler Shaham Group products and services; Managing and streamlining the service and the relationship with customers; data cleansing, processing and production of information for operational, marketing and statistical needs; Direct mail; Offering content and services provided by the Altshuler Shaham Group and providing the information to third parties for the purpose of realizing the above purposes or according to any law.

Social Networks

Altshuler Shaham provides the Website Users with tools for sharing and linking content from the Website through social networks and various online services, and we also refer Website Users to various social media channels of Altshuler Shaham, such as the pages operated by the Group on Facebook, YouTube, LinkedIn, Instagram, Twitter and more. Please note that the use of such social networks and online services is external and separate to the Website and subject to the privacy practices of those services and the privacy policy of each such service. This policy does not apply to the activity of these social networks or any online service operated by a third party.

Third Party Communication Services

Some of Altshuler Shaham's services involve the use of third-party communication services (such as: WhatsApp and a link to cellular company) (hereinafter: "Third Party Services"). Third party services are provided by entities that are not part of the Group, and the Group is not responsible for the correctness, accuracy, level of performance or quality of the services provided by these third-party services. The Group will not be responsible for the availability of third-party services or for their content or activities. The decision whether to use the service, which involves the use of third-party services, is the User's only and at his sole risk. In addition, the use of third-party services will be subject to all policies and terms of use, including the privacy policy, of the relevant third-party services.

Right to Review the Information and Correcting the Information

According to the Privacy Protection Law, every person has the right to review by himself, or by his attorney that he authorized in writing, or by a guardian, the information about him held in a database. A person who reviewed the information in the database and found it to be incorrect, incomplete, unclear or not updated, may contact the owner of the database with a request to correct the information or delete it. If the owner of the database refused, he must notify the applicant of this in the manner and way stipulated in the regulations by virtue of the Privacy Protection Law. The applicant requesting the information may appeal a refusal of a database to allow a review and a notice of refusal to correct or delete information appeal in the manner and way stipulated in these regulations.

In addition, if the information in the Group's databases is used for the purpose of contacting you personally, based on your belonging to a population Group, determined according to one or more characteristics of people whose names are included in the database ("Contacting by Direct Mail"), then you are entitled under the Privacy Protection Law to demand in writing that the information relating to you be deleted from the database. In this case, the Group will delete information it needs only to contact you with direct mail inquiries.

Please note that deleting information may prevent you from continuing to receive services from the Website or it may lead to the cancellation of your registration for some of the Website's sections. Information needed by the Group for the purpose of managing its business - including documentation of actions you performed on the Website, or in the personal area - will continue to be kept by Altshuler Shaham according to law, but will no longer be used for contacting you. If within 30 days you do not receive notification that the information that the Group was asked to delete was indeed deleted according to this section, you will be entitled to apply to a court in the manner stipulated in the regulations by virtue of the Privacy Protection Law, to order the Group to act as stated.

Minors' Privacy

Altshuler Shaham is committed to protecting the privacy of Website Users in general, however in particular the privacy of minors. We encourage parents and legal guardians to take an active role in their children's online activities and interests. The Group does not knowingly collect personal information from minors under the age of 18 without the consent of a parent or legal guardian to collect and use this information in the services provided by the Group or for any activity or service provided through the Website.

Changes to this Policy

The Group may change the terms of this policy from time to time (just as it may change any of the binding documents, as set forth in the terms of use). If we make material changes to the policy, we will post a notice about it on the Website's home page, or we will notify you via the contact information you provided to us. If we make such changes in accordance with the provisions of any law, or a requirement of a competent authority - the changes will enter into force in accordance with the provisions of the law or such requirement.

Continued use of the Website after the change constitutes your consent to the current policy, however we may ask you to confirm the current policy, or all the binding documents. If you do not agree with the updated version of the policy, you must stop using the Website. You can review the current policy at any time by clicking on the appropriate link on the Website.

Contacting Us / Reporting a Violation of Privacy

If you believe that your privacy has been violated while using the Website, or any of the Group's services, and if you have any questions, suggestions, complaints, etc. regarding this policy or the Group's privacy practices, please contact us using any of the contact methods set forth on the Website, or in any of the following ways, and we will try to handle your request as soon as possible:

• Telephone: *5054 (08:00 – 16:00);
• electronic-mail: sherut@altshul.co.il;
• By using the online contact form on the Website;
• Post: Altchuler Shaham - 19A Habarzel St., Ramat Hachayal, Tel Aviv-Jaffa 6971026.

Last updated: 1.3.2023