Privacy Policy

Last updated August 2025

IBI Investment House Ltd. and all IBI Group companies (collectively and separately: “the Company“, “the Group“, “we” or “our“) respect the privacy of its users (“User(s)” , “Visitor(s), “Data Holder(s), “you“, or “your“), and the privacy of its customers (“Customer(s“), and are committed to protecting your privacy and the personal information you share with us through the use of our various platforms (collectively: “the Platforms“), which include, among other things, the telephone service in the Group, our website https://www.ibi.co.il/ as well as any web page under the IBI.co.il domain (“the Website“), our internet portals, including the following websites: https://mycapital.ibi.co.il | https://capitalmanagers.ibi.co.il | https://capitalr.ibi.co.il (“Portals“), in our mobile application Smart (“the Application“), on the Company’s landing pages and more.

About this privacy policy

This privacy policy (“Privacy Policy” or “Policy“) describes the information collection and processing practices of our Platforms and services. This policy provides transparency regarding the types of personal information collected and how it is used. By accessing our Platforms, including our Portals and Application and our services in general, you acknowledge and agree to the information practices described in this Policy.

This Privacy Policy reflects our commitment to our users’ rights to privacy. Your use of the Platforms may require the provision of personal data (as defined below), only if you choose of your own free will to provide us with this personal data for the purpose of receiving services from us. Where relevant, this Privacy Policy also forms an integral part of our terms of use, in accordance with the services provided by us, and forms part of the engagement between us and you.

You may refrain from providing us with certain personal data; However, you acknowledge that this may prevent us from providing you with certain services or using our Platforms, according to the types of uses of the information as detailed below. Our Platforms are available to relevant users, visitors or customers, and certain functions may require registration and submission of certain personal data, as described in this Privacy Policy. We will store the personal data you provide to us on the Platforms and services in accordance with this Privacy Policy.

We recommend that you read the Privacy Policy carefully and contact us with any questions at privacy@ibi.co.il. If you do not agree with the terms set forth in this Privacy Policy, please refrain from using our Platforms and using our services.

The types of information we collect

When using our platforms, we collect types of information, including personal information about you, including particularly sensitive personal information. in a variety of ways:

Data provided directly by you	Details you provided to us as part of using our services, as a visitor to our websites, when you contacted us through our Platforms, if you opened an account on one of our Platforms, or when you contacted our support services. In each of these cases, we may process the details you provided us, including: • Your contact information such as full name, email address, phone number, social security numbers, business email addresses, residential addresses (for personal delivery); • Financial data, including bank account details including IBAN numbers and SWIFT code when exercising an option, account confirmations; • Data for the purpose of KYC checks; • Positions and workplace details; • Preferences and information for the purpose of verifying your details; • Documents you will upload to our Platforms for the purpose of receiving the services; • Means of payment that you will provide for the purpose of receiving the services; • Trading preferences, transaction history, investment portfolio data; • Other information you chose to provide to us with your consent and at your request.
Data collected through your use of our Platforms	When you use our Platforms or our services, or in any interaction with them whether as a registered user or as a visitor, certain information about your actions is collected automatically just from your use, among others: • Your device type and visit to the Platform, the language you use, the relevant operating system version and its features; • Online identifiers such as the IP address your provider assigned to your device and Internet access, information about cookies, pixel tags and log files and includes online usage data, login data (where applicable); • The online activity you performed on the Platform such as browsing history on the Platforms, your clicks on actions and buttons, performance and frequency of use, including where relevant automatic recordings of activities you performed for the purpose of providing cancellation. As part of the registration process for our applications, we collect information based on your permissions according to the choices you make on your mobile phone device. Depending on the mobile phone you have, its type of operating system and its version as mentioned above. Some information can only be collected after you have given appropriate permissions.
Data we collect through third party services	We may receive from a third party data in connection with the services we provide to you, such as data from companies that offer their products or services in connection with our services or whose products or services may be linked to our service. As part of this, we may receive the following information: • Information related to marketing operations provided by third party services. We may share or receive information about you from third parties, including advertising and retargeting providers or similar partners through the use of cookies, pixel tags or other technologies; • Analytical information including IP addresses, Internet service provider, browser type, operating system and language, incoming and outgoing pages and URLs, date and time, length of time on certain pages, which parts of the Platform you visited, number of links clicked, search terms and other similar usage data and analysis performance measures; • We may also receive information about you from third party social platforms such as Facebook, Twitter or LinkedIn. When you interact with the Platform through a third-party social network, you allow the Platform to collect information about your interaction with the Platforms and allow us to access or collect information made available by the Platform in accordance with its privacy policy. For more information about these third parties, including how to opt out of certain data collection, please visit their privacy policies posted on their websites. It should be noted that if you choose to cancel any service, you may not be able to use the full functionality of the services
Aggregative data	As part of using or interacting with our Platforms and services, we may collect and store aggregate information, metadata data and statistical information about the use of the services to operate, maintain, manage and improve the Platforms and services, including creating analytical models. This information does not identify you personally and therefore this Privacy Policy does not apply to this type of information

The data and information provided to us will be kept for the reasonable time required for the purposes for which they were collected, at our sole discretion and in any case – as required by law. It is clarified that anonymous information may be stored as well as used, among other things, for the purposes of analysis and statistics in the present and in the future without time limit.

The purposes of the collection and use of information

The following are the purposes of using information on the Company’s Platforms:

To allow you to use and access our services and Platforms, to display information and data to you, to maintain management and proper operation of the Platforms as well as troubleshooting, including those requested by you.
To provide service to the licensee on your behalf, according to his permissions according to your preferences. We can communicate with such an authorized person and enable the provision of information and the performance of actions in accordance with our procedures.
For the purpose of changing and improving the contents, services and Platforms and adapting them to the nature of the users.
To monitor the uses of the users offered by the Company for the purpose of analysis, control and improvement of the Company’s services, either by the Company or by providing statistical information to third parties.
In order to allow the Group to protect the information and the receipt of the services in a secure manner, including, to monitor the access and use, and to enable identification of the user and prevention of unauthorized use.
To provide technical support services as well as for authentication for the purpose of providing the support services and entering the Platform when necessary through e-mail and/or text messages and/or answering the telephone according to the details provided during registration.
For the purpose of advertising, marketing and mailing by us or on our behalf, and exposure to marketing content / or to send newsletters and / or messages, including about our services or products or those of related companies or of third parties that are provided in collaboration with us and related products, which we think may be of interest to you provided that these are our products and services. In certain cases, we can also send you marketing messages in connection with additional products and services, including those of third parties, under the appropriate circumstances, for example in cases where you have agreed to this.
To follow the provisions of the law or a competent authority, such as courts, tribunals, the Capital Market and Insurance Authority or the Authority for the Prohibition of Money Laundering and Terrorist Financing, etc.
To enable the user to register for services for which registration is done through our digital platforms. Information provided to us as part of the KYC process in connection with opening an independent commercial account with Israel brokerage and Investment – IBI – Ltd., if not fully completed, will be retained in the Company’s systems for a period of up to three months and then deleted or anonymized. During the period in which the information is retained, the Company will work to contact the applicant to assist in completing the registration process or to optimally adapt the Group’s services to him.
For any other purpose in connection with the provision of the Company’s services, and to enable adaptation of the services and Platforms to your preferences, including any purpose detailed in this Policy and/or a purpose to which you expressly agree.
To contact you, including providing an update, confirmation or notification on issues related to your inquiries and the service you requested.

Without deviating from the above, we may disclose the information to third parties in any case of a merger of companies, transfer or sale of all ownership or principal shares of the Company and/or its assets to a third party and/or to companies controlled by the Company and/or related companies as part of a reorganization, insofar as transfer of the information is necessary for the execution of such a transaction, including in any case of the transfer of the activity and/or ownership of the Platforms.

Cookies and tracking files

As mentioned, on some of our Platforms, and especially on the Websites, we use cookies and other tracking technologies to improve the user experience and improve our services. Cookies are small data files transferred to your device through your web browser that allow our systems to recognize your browser and collect certain information.

Cookies may be collected by us or by third-party providers for the purpose of analyzing your interaction with the use of our Platforms and services. The information collected by these cookies includes your IP address, the time of the visit, if you are a repeat visitor, in relation to your visit to any of the Platforms, Website or Application or any other service, URL address, device and browser characteristics, and date and time. The data collected by these cookies is transmitted and stored by third-party providers and is subject to their privacy policies. We also use other tracking technologies, such as Flash cookies, embedded scripts, eTags, and more, to collect and store information about your visit, such as your browser type, operating system, mobile device information, and click data.

We use cookies to enable you to use the Platforms without re-entering your login information, to improve or personalize your use of the Platforms, to monitor the use of the Platforms, to administer the Platforms and to improve our products and services. Cookies may be temporary (session) cookies, which expire when you close your browser, or permanent cookies, which remain on your device until you delete them. We may use information collected by these cookies to analyze trends, direct you to your preferences, collect information about visitor movements, diagnose potential problems with our server, investigate actual or potential security incidents, and ensure that the Platforms are working properly. We may also use third-party analytics tools to help us measure traffic and trends regarding the service and understand more about the demographics of our users.

Preferences changes: You can control and delete cookies as you wish. You can delete any cookies already on your computer and set most browsers to prevent them from entering. However, if you do so, you may need to manually adjust some preferences each time you visit the Platforms, and some services and functions may not work. Some of the features that improve your experience using the Platforms by disabling cookies may not function properly.

You can always change your cookie preferences based on the cookies we have collected, including accepting or rejecting them using the cookie preferences check box located on our Platforms. You can easily opt out of Google Analytics tracking by clicking here, and as a LinkedIn user you can control the use of their personal information for advertising purposes through their account settings. You may also choose to disable or delete cookies through your browser settings, but please note that doing so may affect your user experience on our Platforms. You can also learn about your options to opt out of mobile app tracking through your device settings. For more information, see https://support.apple.com/iphone and https://support.google.com/android.

Use of Artificial Intelligence (AI) Systems and Chatbots

The Group uses Artificial Intelligence (AI) systems and Machine Learning (ML)-based models to improve its services, automate and develop products, manage risks, detect fraud, improve the user experience and personalize services. In addition, chatbots are also used as part of its digital services.

The aforementioned systems operating on our behalf or by us may process your personal information that has been provided to us as part of your relationship with us, information that has been collected automatically from the use of digital platforms and as detailed in the section of this policy describing how information is collected. In addition to the above, our artificial intelligence systems may generate information about you, for example in relation to behavior, product recommendations or risk management in a way that supports decision-making.

Any processing of personal information in these systems will be carried out in accordance with the principles of privacy protection laws, including fairness, transparency and proportionality, and while implementing the Privacy by Design principle.

The Company will not make automated decisions that significantly affect your rights without human intervention and will allow you to contact us for more information about the decision-making process, the types of information processed and the main criteria. You may request at any time that a decision made automatically be reviewed by a human agent.

In any case of using a chatbot or automated system, you will be given a clear message that it is an automated system, and any manipulation or deception as if it were a human agent will be prohibited. We implement advanced security measures to protect the information processed in our artificial intelligence systems.

Sharing personal data with third parties

We do not sell or share your personal information. We may share it with third parties. However, we may share your personal information with suppliers and parties of the following types only:

Purpose of sharing Provision of services	Description of sharing Sharing information with external suppliers who process information on our behalf or for us for the purpose of providing digital services and handling customer requests.
IT services, Storage and hosting	We use local storage servers. We may use external services that may be hosted on cloud services based in the European Union. We require any third party that stores or processes information for us to maintain strict privacy protection and information security rules and to ensure compliance with the applicable data protection laws, and any transfer of information abroad is carried out in accordance with and subject to the provisions of the law, including the Privacy Protection Regulations (transfer of information to external databases to the borders of the state), 5761-2001. However, the conditions of these services are controlled by privacy policies of these storage parties.
Analysis and Analytics	If you use and visit our Platform, we may use analytics services ,pixel or other tracking tools operated by third-party providers, and enable them to collect information about and characterize those who have visited our web pages, to help us understand how users interact with our Platform and services. It is clarified that none of the above should detract from our right to transfer statistical or aggregative, non-personal information to third parties, which does not identify the user personally, even with reasonable effort.
Support services	From time to time, we may use support and help services to provide better and faster support, either online or when you contact customer support.
Authentication and Security	When you open an account with us, we may over time integrate certain authentication services that will be supported by third parties, as well as protective tools to prevent fraud. We also share information with companies that help us realize our commitment to you and the information about you, such as information security and cyber companies.
Improving Functionality and Technology	Some of our Platforms and services may include third-party technologies, widgets or software to improve the functionality of the Platform or service and extend it to include additional software for you.
Advertising	Some of our third-party services may collect information about your interaction with our Platform. We use this technology to optimize the Company’s advertisements and media ads on various third-party websites and platforms to collect statistical data on the effectiveness of our advertising, the degree of exposure to it, etc. Third parties may use this information to display ads when you browse other sites around the Internet. You can opt out of this type of advertising at any time directly from the ad when you encounter it.
CRM and mailing lists	If you are a customer or user, we may use the Services to manage subscription lists and messages, including sending mailings and marketing materials, subject to consent to inclusion on said mailing list.
Compliance with Requirements Legal proceedings	We may share your personal information with a third party if we believe that disclosure of such information is beneficial or reasonably necessary to comply with any applicable law, regulation, legal process or governmental request; to enforce an agreement including the terms of use or this Privacy Policy, including investigations of potential violations thereof; detect, prevent or otherwise address fraud or security issues; and/or protect against damage to the rights, property or safety of the companies associated with us, our users, you or the public. To follow the provisions of the law or a competent authority, such as courts, tribunals, the Capital Market and Insurance Authority or the Authority for the Prohibition of Money Laundering and Terrorist Financing. If necessary, we will provide information to enforcement authorities, investigative authorities and others, such as the National Cyber System, courts and other bodies as part of legal and administrative proceedings To manage risks and legal and administrative proceedings as well as any other proceeding before a competent authority. Information arising from judicial orders or by virtue of legislative provisions relating to execution, the Tax Ordinance (collection) or the Civil Procedure Regulations, helps us in risk management and decision-making, including regarding the limitation or termination of the provision of services.
Merger, Sale or Bankruptcy	In the event that we or one of our related legal entities is acquired by, or merges with, a third-party entity or sells all or part of our assets, we may transfer or assign the information about you including the personal information. In such a case, we will require the acquiring entity to publish its data practices and provide you with all of your rights in accordance with applicable law.
Protecting rights and preventing damages	We also share information with companies that help us protect your rights, those of our other customers, the Company itself and its partners and suppliers, for example, accountants and legal advisors. In any case where we will believe that the provision of the information is necessary in order to prevent or minimize damage to any of us or on our behalf and and/or third parties, or in order to prevent other serious damage in accordance with our full and exclusive discretion.
Information sharing within the Group	We share and/or may share information between the Group companies in order to optimize the various services provided to you by the Group companies, to enable optimal characterization of the types of products, content and services that will be offered to you based on, among other things, your affiliation with the type of services you receive, the scope of your activity in the Group companies, population group, according to one or more characterization segmentations, as well as in any case of registration on the Company’s Platform, joining as a customer of one of the Group companies, opening an account in the Group or as part of joining additional services of any of the Group’s services. To the extent that your express consent has been given, each of the Group companies will be entitled to send you marketing messages or by direct mail, containing content that meets the definition of “advertisement matter”, according to the Communications Law (Bezeq and Broadcasting), 5742-1982 in the name of the Group or on its behalf and for this purpose, your contact information will be shared among Group members. See in detail below the “Direct Mail and Advertising” section to learn about your rights.

Please note that some Patforms may include links to third party websites. The Company is not responsible for these websites, and browsing them is external and separate and subject to the privacy procedures of these parties. Where applicable, and if you wish to opt out of certain data collection, please visit the privacy policies of these third parties and take the necessary actions to stop said collection. It should be noted that if you choose to cancel such collection, you may not be able to use the full functionality of our services or Platforms.

Information security

We take the protection of your data and information very seriously, and use a variety of systems, applications and industry practices to protect data from loss, theft, damage or unauthorized use or access. However, although we make efforts to protect your privacy, we cannot guarantee that our Platforms or services will be immune from any wrongful acts, malfunctions, illegal interception or access, or other types of abuse and misuse.

We also regularly monitor our systems to identify vulnerabilities, weaknesses and potential attacks, and regularly look for new ways to improve the security of our Platforms and services and protect the privacy of our visitors and users.

We do not guarantee that the Platforms will operate properly and without any interruption and/or that the Platforms and/or the data collected and/or provided as stated above will be absolutely immune from unauthorized access and/or penetration of the Group’s databases. The Group will not be held liable for any indirect damage of any kind, caused as a result of this, including due to violation of privacy.

Disconnecting from the mailing services or mailing operations will not delete the information collected about you from the Group’s databases, and they will be entitled to continue using such information in accordance with the purposes listed in this Policy.

It is prohibited to share identification elements with others, including usernames, passwords, one-time codes, and other unique identification information (except in the case of duly authorized proxies).

Saving the information

As a general rule, personal information will be kept in the Company’s databases for the period of time necessary for compliance with the legitimate purposes of using the information. In cases where the purposes of use expire, the Company will make reasonable efforts to anonymize it, delete the information, archive it, or reduce access to it and the possibilities of using it as much as possible.

Anonymous information will be kept in the Company’s information systems indefinitely (as long as this is not prohibited by any law).

Exercising your privacy rights

The Company will act to fulfill a user’s or other data holder’s request to review the information, correct or delete it in accordance with the obligation according to the applicable privacy laws, primarily the Privacy Protection Law, 5741-1981 and the regulations issued pursuant thereto and in accordance with and subject to any contract agreement with the Company’s customers.

To submit a request to exercise the right to review personal information, click here.

Inquiries to the Company must be made in writing through the means of communication listed on the Platforms or at the email address: .privacy@ibi.co.il.

A person who reviewed the information about him, and found that the information is not correct, complete, clear or updated, may, according to the Privacy Protection Law, request to correct or delete the information by contacting the Company using the online form mentioned above.. The aforementioned application does not oblige the Company to correct or delete the information in accordance with the request.

Before allowing a user or data subject to review and/or update and/or delete the personal information collected about them, we will be required to go through a process of verifying the identity of the requester. To this end, we may require unique identification data.

After completing the identification process as stated, we will act to respond to the request in accordance with the provisions of the law. Enquiries to the Company on behalf of another person acting for the requester will be made in coordination with the party who initially provided the details and will be considered the owner of the information provided.

If the information in the Group’s databases is used for the purpose of contacting you personally based on your belonging to a group determined according to one or more characteristics of people whose names are included in the database, then you have the right to demand in writing that the information relating to you will no longer be used for the purpose of making such marketing inquiries, and also request that the information be deleted from a database used for direct mailing.

It is clarified that the right of review will not apply to information that is required to be collected to comply with legal requirements or information that the Company has created for the purpose of managing internal processes, including information that is subject to trade secrets or information the disclosure of which may cause significant harm to our other customers or the public.

Please note that a request to review, correct or delete personal information as mentioned above may be subject to approval by a third party who shared the information with the Company and is the controlling party in the database. In the event that the Company receives such a request, it will be directed to the controlling party in the relevant database to continue exercising your rights.

Please note that, the deletion of the aforementioned personal information may prevent the Company from acting in accordance with the purpose for which the information was provided, such as a place where details were left as part of an interest in the Company’s services. In the event that the Company receives a request for deletion, the Company reserves the right to turn the personal information into anonymous statistical information, which will not allow identification.

Notwithstanding the above, personal information necessary for the Company to continue managing its business and/or necessary for a legitimate purpose such as defending against lawsuits, to the extent required, will continue to be kept by the Company for the time required by law, but access to it will be limited to legal or technical needs only.

It should be noted that users and data holders located in different territories, such as residents of the European Economic Area (EEA) or the European Union (EU) may have additional and/or different rights in relation to their personal information and in order to exercise these rights, contact us as detailed below.

For any other inquires regarding this Privacy Policy, the ways in which we collect and use your personal data, or your choices and rights regarding such use, you may contact us and our Privacy Protection Officer via the email address: privacy@ibi.co.il

To the extent that you are a customer and/or user of IBI Capital Ltd. services, an inquiry regarding this Privacy Policy, the ways in which we collect and use your personal data, or your choices and rights regarding such use, you may contact IBI Capital Ltd. directly and the Privacy Protection Officer of IBI Capital Ltd. via the email address: privacycapital@ibi.co.il.

Direct mailing and advertising

Providing personal details of the user, or anyone on his behalf on the Company’s Platforms or by any other means, constitutes explicit consent to receive e-mail and/or text messages (SMS) from the Company, in connection with the service (such as messages related to the completion of the registration for the services, the Platform or regarding updates.

Subject to your consent, any of the Group’s companies may send you marketing messages or by direct mail, containing content that meets the definition of “advertisement matter”, according to the Communications (Bezeq and Broadcasting) Law, 5742-1982 on behalf of the Group or on its name. These messages may be value propositions regarding the Company’s services and its products, which refer to products or services similar to the services that the user needs, including information about the Company’s activities and/or about products and services offered by it, events and conferences, professional reviews, etc., and this in various ways, including by e-mail, electronic message, SMS messages, WhatsApp messages, push messages and facsimile notifications and an automatic dialing system.

You may, at any time, notify the company from which you receive mailings of your wish to remove your address from the distribution list of recipients of “advertisement” of that company, or request to delete your personal information from the database used for direct mailing, as stated in the previous chapter, using one of the alternatives specified in the message itself and/or by contacting through the website privacy@ibi.co.il. It will be clarified that this does not rule out sending service messages required for the provision of the services.

It is possible that some of the Company’s inquiries to the user will be made as part of a personal inquiry, based on your belonging to a population group, determined according to one or more characterization segmentation of people whose names are included in the database (“direct mail inquiry”) in order to allow an optimal characterization of the types of products, content and services that will be sent to you. According to the provisions of the law, you have the right to demand in writing that the information relating to them be deleted from the database for direct mail.

Minors

The access to the Platforms and the use of the Company’s services are directed mainly to users over the age of 18. To the extent that a certain service is possible for users under the age of 18, these users must obtain the consent of one of their parents or their legal guardian, before using the services and providing personal details within them. The Company may and might use security measures and automatic software to characterize user data in order to verify and/or authenticate the identity of users of its services in the various communication channels and to prevent fraud, deception and impersonation.

Processing of personal information according to geographical areas

Residents of the European Union (EEA)

Depending on your country of residence, and according to your type of use of our Website (visitor or user) or services, certain rights regarding your personal information may be available to you. If you are located in the European Economic Area (EEA) including the United Kingdom, you have certain rights regarding your personal information, including:

The right to receive information regarding the processing of personal information
The right to access personal information
The right to correct personal information
The right to delete personal information
The right to limit data processing
The right to object to the processing of certain information
Rights regarding automatic decisions of statistical discrimination (profiling)

Please contact us at privacycapital@ibi.co.il with your detailed request and sufficient information that will allow us to verify you and your request, and we will process your verified request within the time frame set by the legislation. Please note that when processing these requests, we may request additional information from you. We will make good faith efforts to locate the data you request to access. When you ask us to exercise one of your rights under this policy and applicable law, we may need to ask you to provide us with certain credentials to verify that you are who you claim to be, to avoid phishing and/or disclosure of personal information related to others.

Data transfer outside your region

If you are a resident of the European Union (including the United Kingdom), your personal information may be transferred outside the European Union to third parties who can assist us with our services. We may process your personal information in any country in which we operate, currently mainly in the member states of the European Union, Israel (a country declared by the European Commission as a country with adequate recognition of due diligence) or the USA (with which the European Union has a data sharing agreement -DPF). If we transfer your EU resident personal information outside of Israel or the European Union, we will comply with applicable laws in relation to such transfer and in accordance with our obligation under the Data Protection and Data Processing Agreement (DPA) with our customers.

We are subject to the provisions of the GDPR protecting your personal information. We will ensure that the necessary safeguards are in place to provide a similar level of security for your personal information. Any transfer of personal data outside the EEA to an area that is not protected under official recognition of authenticity, will be subject to Commission Implementing Decision (EU) 2021/915 issued on June 4, 2021 (: “SCC” and/or “Standard Contractual Conditions”).

In any case, the transfer, storage and handling of your personal data will continue to be governed by this Privacy Policy and in accordance with our obligation under the DPA with the Data Controller.

Notice to California residents

We hereby inform visitors and users who are residents of California (herein “you“, “your“) of the following rights regarding the processing of your personal information: To learn more about the personal information we collect, including the specific categories of personal information collected, sources of collection, purposes of the collection and categories of service providers with whom we share personal information, see the headings above.

We do not sell personal information for business or commercial purposes, but we may share personal information or aggregate information with third parties for business purposes. When we do this, we enter into a contract that describes the purpose and obligates the recipient to keep this information confidential and not use it for any purpose other than the agreement.

If you wish to exercise your rights regarding aspects of disclosure to a third party, please refer to the “Exercising Your Rights” section below.

Your rights as a consumer in California:

The CCPA gives California consumers certain rights regarding the personal data collected by businesses, as described below:

The right to know: You have the right to know the specific categories and personal data we have collected about you during the previous 12 months.
The right to deletion: You have the right to request that we delete any personal data we have collected about you.
The right to request information: You have the right to request information about the collection, sale and disclosure of your personal data during the previous 12 months.
The right to cancel (opt-out) the sale or sharing of personal data: You have the right to cancel the sale or sharing of personal data that we have collected about you. As of the date of this policy, we do not sell the personal data we have collected about you.
The right not to be discriminated against: You have the right not to be discriminated against for exercising your legal rights, we will not treat you differently if you choose to exercise any of the above rights.

Exercising your rights

To exercise any of your rights under the CCPA, do not hesitate to contact us by email at privacycapital@ibi.co.il

We will grant your request within 45 days of receiving the request. Some of these rights may be subject to limitations and restrictions, such as when fulfilling the request would conflict with federal, state, or local law, regulatory investigations, subpoenas, or our ability to defend against lawsuits. We will verify your request using your email address. If you have created an account with us, we will also verify your request using the information associated with your account.

Please note that we cannot respond to your request if we cannot verify your identity and confirm the personal data associated with you. Creating a verified request does not require you to create an account with us. If you wish to use an authorized agent to submit a cancellation request on your behalf, you must provide the authorized agent with written authorization signed by you. We may reject an application from an authorized agent if the agent cannot provide us with your signed authorization showing that they are authorized to act on your behalf.

Notice to residents of other US states, such as Colorado, Virginia, etc.

This Privacy Notice for other US Residents supplements the information contained in IBI’s Privacy Policy and applies only to visitors, users and others residing in countries with applicable privacy protection laws that require it (“Consumer(s)” or “You“). We adopt this notice to comply with the requirements of these privacy laws, and all terms defined there have the same meaning when used in this document.

Your rights

If you are a resident of these states, you have certain rights regarding your personal data under the law, these include:

The right to access: request disclosure of the personal data we collect, use and disclose.
The right of correction: request the correction of inaccurate personal data.
The right to delete: request the delete your personal data.
The right to cancel: cancel the sale or processing of your personal data for targeted advertising or profiling.

Changes and updates

We reserve the right to change or update this Privacy Policy to reflect changes in our Platform services, data processing practices or to meet regulatory requirements. Such changes will be effective immediately. The date of the last update will be displayed under the heading “Last updated”. If we make material changes to this Privacy Policy, we will notify you by email or on our Platform or any other electronic means.

Your continued use of the services after we have posted the update to the Privacy Policy indicates your acceptance of the updated policy. If you do not agree to the updated policy, you may terminate your use of the services.

Contact us

For more information about this Policy, please contact us at privacy@ibi.co.il or by mail at: IBI Investment House Ltd., 9 Ehad Ha’am Street, Tel Aviv-Yafo.

***

Privacy Policy

Last updated August 2025

About this privacy policy

The types of information we collect

Data provided directly by you

Data collected through your use of our Platforms

Data we collect through third party services

Aggregative data

The purposes of the collection and use of information

Cookies and tracking files

Use of Artificial Intelligence (AI) Systems and Chatbots

Sharing personal data with third parties

Purpose of sharing

Provision of services

Description of sharing

IT services,

Storage and hosting

Analysis and Analytics

Support services

Authentication and Security

Improving Functionality and Technology

Advertising

CRM and mailing lists

Compliance with Requirements

Legal proceedings

Merger, Sale or Bankruptcy

Protecting rights and preventing damages

Information sharing within the Group