Attachment No. 7 to the Data Privacy Governance Framework

Version: 2.0 dated September 2026

I. INTRODUCTION & SCOPE

1.1. Pomelo Technology US Inc. and its worldwide affiliated entities operating under the brand LemFi ("we", "us", "our", or "LemFi") recognise and respect your right to personal data protection.

1.2. This Candidate Privacy Notice ("Notice") applies to all individuals applying for, being sourced for, or considering employment or engagement opportunities with LemFi, including full-time and part-time employees, board members, external consultants, independent contractors, agency staff, and talent community members ("Candidate" or "Candidates").

1.3. This Notice explains:

What personal data we collect about you across all application and sourcing channels.
The legal bases under global privacy laws authorising our processing.
How candidate data flows through our primary recruitment management platform (Ashby).
How we conduct background screening and share data across global entities and Employers of Record (EORs).
Your statutory data protection rights and how to exercise them.

Please read this Notice in conjunction with our General Notices and relevant internal data protection procedures.

II. DATA CONTROLLER STRUCTURE & GLOBAL ENTITIES

2.1. Joint Control & Intra-Group Architecture

Due to our global corporate structure and matrix recruitment setup, your personal data is processed under a Joint Controller framework. Pomelo Technology US Inc. operates as the central administrative controller for our recruitment platform (Ashby) alongside the specific local operating entity that will employ or contract you.

All Pomelo group entities participate in Intra-Group Data Sharing Agreements incorporating Standard Contractual Clauses (SCCs) and cross-border transfer safeguards/mechanisms across the following joint controllers:

Pomelo Technology US Inc. (Delaware, USA - Holding / Group Central Platform)
Lemonade Technology Limited (United Kingdom)
RightCard Payment Services Limited (United Kingdom)
Pillar Labs Ltd (United Kingdom)
Pomelo Technology Canada Ltd. (Canada)
Pomelo Two US LLC (USA)
Pillar US LLC (USA)
Pomelo Added Services Limited (Nigeria)
Lemmy MFB (Nigeria)
Pomelo Australia Pty Ltd (Australia)
Lemfi-Europe Limited (Ireland / EU)
Tullia AS (Norway)
Wealth8 Limited (United Kingdom)
Any future local operating entity incorporated under the Pomelo/LemFi brand.

2.2. Employer of Record (EOR) Engagements

In jurisdictions where LemFi does not currently maintain a registered legal operating entity, we engage third-party Employers of Record (EORs) to hire and contract talent on our behalf.

When applying for or being offered a role managed via an EOR, your personal data will be shared with the relevant EOR partner to establish pre-contractual measures, perform statutory local right-to-work checks, and execute local employment agreements.

III. DATA COLLECTION METHODS & SOURCING CHANNELS

3.1 We collect candidate personal data for our talent community through five primary channels, all of which feed into our single source of truth: Ashby.

ASHBY ATS & TALENT CRM (Central Recruitment & Sourcing Database)

1. Direct Apply	2. Direct Sourcing	3. Outbound Email	4. Events / QR	5. Employee Referral
Careers Site/Jobs Board/Ashby Portal.	LinkedIn Manual/Booking Links.	JuiceBox AI Enrichment.	Event Registration Forms & QR Codes.	LemFi employees into Ashby.

Channel 1: Direct Job Applications

Candidates applying directly via the LemFi Careers site (hosted via Ashby), including via our careers website at www.lemfi.com/careers, which routes applications into Ashby, or through aggregated job boards (LinkedIn, Indeed, Glassdoor) where applications redirect into Ashby.

Channel 2: Direct Sourcing via LinkedIn

Recruiters identify talent on public platforms like LinkedIn. Data enters Ashby via:

Manual profile creation by LemFi recruiters using publicly disclosed profile details.
Self-registration by candidates using direct self-booking links shared by recruiters in direct messages.
Direct Ashby integration

Channel 3: Outbound Sourcing via JuiceBox (PeopleGPT)

We utilise JuiceBox App, Inc. ("JuiceBox") to identify potential talent. JuiceBox compiles publicly available profile data and contact details (personal/professional email addresses and phone numbers) from compliant web sources.

Ingestion Mechanics: Candidate profile data is ingested into Ashby immediately upon initial outreach to enable LemFi to track outreach efficiency, conversion rates, and sourcing metrics.

Channel 4: Events, Conferences & QR Code Sourcing

Candidates register interest at offline hiring events, campus fairs, or industry conferences by scanning QR codes that open Ashby web intake forms. (Note: Unless a specific event privacy notice is displayed at the booth, event data is processed under the terms of this notice).

Channel 5: Employee Referrals

Personal and professional details provided by current LemFi employees who have obtained your preliminary agreement to submit your profile for active vacancies.

IV. CATEGORIES OF PERSONAL DATA PROCESSED

We process the following categories of candidate personal data:

Identification & Contact Data: Full name, home address, personal email address, telephone number, location (city/country), and public professional profile URLs (e.g., LinkedIn, GitHub).
Professional History & Credentials: Resume/CV, cover letter, employment history, previous employers, job titles, educational qualifications, professional certifications, registrations, language capabilities, and portfolio submissions.
Assessment & Interview Records: Technical screening submissions, coding test results, interviewer scorecards, written evaluation feedback, and interview audio/video recordings, transcripts and AI-generated interview notes (AI Notetaker).
Candidate-Submitted Communications: Email exchanges, SMS/text and WhatsApp messages sent via Ashby, and interview scheduling logs.
Pre-Employment Screening & Vetting Data (Conditional Offer Stage Only):

Verification of national identity/registry numbers, taxpayer identification, passport, visa, and right-to-work documentation.
Results of professional reference checks, qualification checks, credit history checks, and criminal background records (strictly where required by financial regulatory standards and permitted by local law).

V. PURPOSES & LAWFUL BASES FOR PROCESSING

5.1 Purpose of processing your personal data:

We process your personal data for the following purposes:

identifying and evaluating candidates for potential employment, as well as for future roles that may become available;
maintaining records in relation to recruiting and hiring;
ensuring compliance with legal requirements, including those relating to public health and workplace safety;
if you receive an offer from us, conducting background checks, including, to the extent permitted by applicable law, criminal history checks;
protecting our legal rights to the extent authorised or permitted by law;
managing claims or the defence of claims made against us; and
protecting the workplace and communicating with medical professionals, law enforcement, or other public authorities in the event of an emergency or public health event, such as when the health or safety of you or one or more individuals may be endangered.

We may also use your personal data for our analytics purposes, including in aggregated/pseudonymized form, to improve our recruitment and hiring process and augment our ability to attract successful candidates.

5.2 Legal bases for processing your personal data

We process your personal data as necessary to fulfil our legal and contractual obligations as a recruiter under applicable laws, to manage the recruitment process based on our legitimate interest and for compliance with legal obligations to which we are subject.

We may rely on our compliance with applicable law about personal data necessary to satisfy our legal and regulatory obligations, including about public health and workplace safety.

We may also rely on our performing contractual and precontractual measures relating to our potential employment relationship with you.

In certain specific situations, we may also process your personal data based on your consent (e.g., for using your photograph attached to your submission or your voluntary submission of an application outside the ongoing recruitment processes). Where we process your personal data based on consent, this may be withdrawn at any time. Failure to give your consent will not result in not hiring you, and your withdrawal will not result in negative consequences for you.

We may also process your personal data if processing is necessary to secure your vital interests (e.g., in case of emergency).

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason, being compatible with the purpose for which they were initially collected or where we have a legitimate interest, provided it does not unduly affect your interests or fundamental rights and freedoms. Please note that we always seek to balance our legitimate interests with your privacy when processing your personal data on this basis.

Such ‘legitimate interests’ are:

evaluating your application to manage our relationship with you, to ensure that we recruit appropriate employees, to ensure objective, accurate candidate evaluations, and to evaluate and maintain the efficacy of our recruiting process more generally;
meeting our corporate and social responsibility objectives,
the establishment or assertion of civil law claims by Pomelo in the course of its business, as well as the defence of such claims,
internal administrative purposes, e.g., measures taken to maintain operational activities (e.g., workforce planning, budget planning, space planning, etc.).

If we need to use your personal data for an unrelated purpose, we will notify you, and we will explain the legal basis which allows us to do so.

VI. BACKGROUND SCREENING & THIRD-PARTY VENDORS

6.1. Global Background Vetting via Zinc

If you receive a conditional offer of employment or engagement from LemFi, we conduct pre-employment background screening through our screening vendor(s).

Primary Screening Vendor: Zinc (Zinc Work Ltd., https://zincwork.com/).
Scope of Vetting: Depending on your jurisdiction and role (particularly for regulated financial services roles subject to 'Fit and Proper' rules), we may verify employment history, professional qualifications, identity documents, global sanctions, credit history, and criminal record history.
Proportionality & Timing: Background checks are initiated only after a conditional offer is extended. Checks are tailored strictly to the requirements of the specific role. You will receive a separate notification and authorisation request from the vendor or us before screening commences.

6.2. Recruitment Platform & Software Processors

We share candidate personal data with trusted third-party technology providers under strict Data Processing Agreements (DPAs):

Ashby HQ, Inc.: Primary recruitment platform, Applicant Tracking System (ATS), candidate database, provider of AI-assisted interview recording, transcription, and note-taking functionality. and interview communication tool.
JuiceBox App, Inc. (PeopleGPT): Outbound candidate sourcing and contact data enrichment platform.
Google Workspace / Slack: Internal communications, evaluation notes, and interview panel scheduling.
Technical Assessment Platforms: Technical code tests and candidate skill evaluations.

We strictly prohibit our service providers from utilising candidate personal data for their own independent commercial purposes or selling candidate information.

VII. INTERNATIONAL DATA TRANSFERS

7.1 Because LemFi operates globally, your personal data may be accessed by recruiters, hiring managers, technology infrastructure, and group affiliates located outside your home country, including, but not limited to, the United States, Canada, United Kingdom, European Union Member States, Nigeria, Kenya, Ghana, the Philippines, and Australia.

Where personal data is transferred across international borders, we ensure adequate legal protection is in place:

Standard Contractual Clauses (SCCs): Transfers from the European Economic Area (EEA) to non-adequate third countries are governed by EU Commission-approved SCCs.
UK International Data Transfer Agreement (IDTA): Transfers originating in the United Kingdom rely on the UK IDTA or the UK Addendum to the EU SCCs.
Intra-Group Transfer Agreement: All LemFi group entities operate under executed intra-group data transfer contracts enforcing equivalent security and confidentiality standards globally.
African & APAC Transfer Safeguards: Transfers originating in Nigeria (NDPA), Kenya, Ghana, Australia, or other applicable countries/regions adhere to local statutory transfer mechanisms and individual disclosures.

VIII. RETENTION SCHEDULE & AUTOMATED PURGING POLICY

8.1 LemFi enforces strict channel-specific retention schedules within Ashby to align with the principle of storage limitation. Candidate data is not retained indefinitely. Interview recordings, transcripts and notes generated by the Ashby AI Notetaker form part of the relevant candidate record and are subject to the same retention periods and actions at expiry as that record, as set out in the matrix below.

LEMFI CANDIDATE RETENTION MATRIX

CATEGORY / CHANNEL	MAXIMUM RETENTION PERIOD	ACTION AT EXPIRY
Outbound Sourced Profiles (JuiceBox / LinkedIn - Unresponsive)	60 Days from Ingestion	Automated Purge from Ashby unless candidate engages.
Talent Pool / Community Members (Event / QR Code Registrants, Direct applicants, referred candidates)	24 Months	Automated Consent Renewal Email sent at Month 23; Purged if unconfirmed.
Background Check Reports	6 Months Post-Decision	Secure Confidential Erasure
Successful Candidate Records (Hired Staff)	Transferred to Personnel File (Duration + 7 Years)	Secure Confidential Erasure Governed by LemFi Employee Privacy Policy

Sourced Candidates (JuiceBox / LinkedIn Outbound): If we reach out to you via email or LinkedIn and you do not respond, book an interview, or engage with our team, your profile is automatically purged from Ashby after 60 days.
Talent Community / CRM Retention: Candidates who explicitly join our Talent Pool permit LemFi to store their details for up to 24 months. The 23-month mark triggers an automated email asking if you wish to remain in our database. If you do not renew consent, your profile is permanently deleted.
Referred candidates are automatically added to our Talent Community unless you opt out.

IX. ARTIFICIAL INTELLIGENCE (AI) & AUTOMATED DECISION-MAKING

We use AI to support our hiring process, such as sorting applications, assisting with sourcing, and transcribing interviews, to reduce administrative work so our team can focus on you. We do not use solely automated decision-making. AI supports our evaluations, but every decision to progress, reject, or hire a candidate is made by a person who can review and overrule the tool’s output. We do not use AI to analyse your biometric data, voice, or emotions. For full details on our standards, where we encourage you to use AI, and your rights to human review, please see our LemFi Candidate AI Use Policy.

X. CANDIDATE DATA PROTECTION RIGHTS

10.1 Depending on your jurisdiction, you possess specific statutory rights regarding your personal data:

Right to Access (DSAR): Request confirmation of whether we process your candidate data and receive a copy of your records (including interviewer scorecard feedback).
Right to Rectification: Request correction of inaccurate, out-of-date, or incomplete application data.
Right to Erasure ("Right to be Forgotten"): Request deletion of your candidate profile from Ashby and our candidate databases.
Right to Restrict Processing: Request that we temporarily limit processing of your candidate profile.
Right to Object: Object to our processing of your candidate data where we rely on "Legitimate Interests" as our legal basis.
Right to Withdraw Consent: Revoke your consent at any time for Talent Community membership, DEI data collection, or event marketing without affecting the lawfulness of prior processing.
Automated Decision-Making Disclosure: LemFi does not make hiring or rejection decisions based solely on automated processing or algorithmic profiling. Every candidate screening step involves direct human review by our recruitment team.

10.2 How to Exercise Your Rights

To exercise any of your rights, submit a formal request to us at: dataprivacycounsel@lemfi.com. We will process and respond to your request within statutory timeframes.

10.3 Regulatory Complaints

If you believe LemFi has processed your personal data in breach of applicable privacy legislation, you have the right to lodge a complaint with your local data protection supervisory authority.

XI. UPDATES TO THIS PRIVACY NOTICE

We reserve the right to amend this Candidate Privacy Notice at any time to reflect updates to our recruitment tools, operational changes, or evolving global data protection laws. When material updates occur, we will publish the updated notice on our application portal and update the Document Control table above.