Effective Date: October 7, 2026

Introduction

This Applicant Privacy Notice (“Notice”) explains how the Company and its affiliates collect, handle and use personal data relating to job applicants. Where we refer to “we” or “our” or “us” we are referring to the Company and its affiliates, and where we refer to “you” or “your” or “Applicants” we are referring to job applicants. In the event that you become an employee of the Company, you will be provided with a separate Employee Privacy Notice.

Equal Employment Opportunity Statement

Company is an equal employment opportunity employer. Company’s policy is not to unlawfully discriminate against or harass any Applicant or employee on the basis of any protected category, characteristic or status under applicable laws. It is also Company’s policy to comply with all applicable laws in making hiring decisions.

For California Applicants: Company complies with the ADA, the ADAAA and applicable state law and considers reasonable accommodation measures that may be necessary for qualified applicants to perform the essential functions of the job. Hire may be contingent upon a post-offer medical examination, and to skill and agility tests, as appropriate for the position.

Information We Collect

“Personal information” or “Personal Data” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Applicant. We may collect the following categories of personal information. Not all categories may be collected about every Applicant.

• Identifiers and Contact information, for example: real name, alias, nickname, unique personal identifier, online identifier, Internet Protocol address, telephone number, postal address, e-mail address, Social Security number, driver’s license number, passport number and signature;
• Professional or Employment-Related Information, for example: educational institutions attended, degrees and certifications, skills, licenses, work experience and previous employers, and professional memberships and affiliations;
• Non-public educational information, for example: academic transcripts;
• Commercial Information, for example: travel expense records for an interview;
• Internet or other electronic network activity information, for example: interactions with Company’s Internet web site, job application, or job advertisement, and publicly available social media activity;
• Remuneration including benefit entitlements;
• References, transcripts, photographs, videos, articles, comments, and other content you submit;
• Information about your entitlement or eligibility to work;
• Demographic information, for example: age, date of birth, and gender;
• Interview records, assessments, and test results;
• Audio and visual information, for example: recording captured during interviews or virtual assessments, or at Company premises;
• Information from public profiles; and
• Other details, for example, hobbies and leisure activities or membership in voluntary/charitable/public organizations, as stated on the Applicant’s resume or CV.

If you are a resident of California:

§ 1798.80: We may also collect personal information described under Cal. Civ. Code § 1798.80 to the extent not already included in the categories listed above, such as a photograph or health information, for example, to conduct pre-employment physical examinations.

“Personal information” does not include:

• Information publicly available from government records or made publicly available by you or with your permission;
• Deidentified or aggregated information;
• Information excluded from the CPRA’s scope, such as:
  • protected health information covered by the Health Insurance Portability and Accountability Act (“HIPAA”) or the Health Information Technology for Economic and Clinical Health Act (“HITECH”) or medical information covered by California Confidentiality of Medical Information Act (“CMIA”); or
  • personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (“FCRA”), the Gramm-Leach-Bliley Act (“GLBA”), or the California Financial Information Privacy Act (“FIPA”).

Deidentified Information: At times, Company converts personal information into deidentified information using reasonable measures to ensure that the deidentified information cannot be associated with the individual (“Deidentified Information”).Company maintains Deidentified Information in a deidentified form and does not attempt to reidentify it, except that Company may attempt to reidentify the information solely for the purpose of determining whether its deidentification processes ensure that the information cannot be associated with the individual.

Characteristics of Protected Classifications: Company collects information about race, age, national origin, disability, sex, and veteran status as necessary to comply with legal obligations, including the reporting requirements of the federal Equal Employment Opportunity Act, The Office of Federal Contracting Compliance Programs (applicable to government contractors), and California’s Fair Employment and Housing Act, and for purposes of diversity analytics. Company also uses this personal information for purposes including: (a) with respect to disability and/or medical condition, as necessary, to comply with federal and California law related to accommodation; and (b) with respect to age, incidentally to the use of birth date for identity verification. Company collects protected categories of personal information on a purely voluntary basis, except where required by law, and uses the information only in compliance with applicable laws and regulations. Where applicable law classifies this information as sensitive or special category personal data, we process it only on the legal bases described in the "Sensitive and Special Category Personal Data" section of this Notice.

Sensitive and Special Category Personal Data

We may collect and process sensitive or special categories of personal data where necessary and permitted by applicable law, including:

• Health information, including whether or not you have a disability for which we need to make reasonable adjustments or accommodations during the recruitment process, for equal employment opportunity reporting purposes, or where a pre-employment physical examination or post-offer medical examination is required for a specific position;
• Racial or ethnic origin, as necessary to comply with legal obligations, including equal employment opportunity reporting requirements, and to support diversity and inclusion programs;
• Depending on the role that you apply for, and only if we offer you a contract of employment, criminal records and information regarding criminal offences or proceedings, if revealed in a background check;
• For roles involving the processing of financial information or involving responsibilities related to financial services, we may also be obliged by regulators to seek information about your criminal history and financial standing and history, which may include credit and solvency checks and related assessments.

In the case of sensitive or special categories of personal data, we may rely on the following legal bases:

• In limited circumstances, that you have given explicit consent to the processing;
• Processing is necessary for the purposes of carrying out the obligations and exercising rights in the field of employment law and social security law so far as permitted by local law;
• Processing relates to personal data which you have manifestly made public;
• Processing is necessary for the establishment, exercise or defence of legal claims;
• Processing is necessary to protect your (or another’s) vital interests;
• Processing is necessary for reasons of substantial public interest, on the basis of local law; and
• Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of your working capacity, medical diagnosis, on the basis of local law or pursuant to a contract with a health professional and subject to safeguards provided by law.

We do not collect or process sensitive personal information or characteristics of protected classifications for the purpose of inferring characteristics about you.

Information We Collect By Automated Means

When you visit our Careers website, we may collect certain information by automated means, such as by utilizing cookies, web beacons, web server logs, and other similar technologies, in accordance with your preferences and applicable law, or where necessary for the functioning of the site. This helps us remember your information, understand how you interact with the site, and ensure it functions properly. For full details on the types of cookies we use, their purposes, and how to manage your preferences, please refer to Company’s Cookie Policy at ripple.com/legal/cookie-policy/. You can manage or withdraw consent to non-essential cookies at any time via the Preference Center ("Your Privacy Choices" in our website footer) or through your browser settings. Please note, however, that without cookies you may not be able to use all of the features of our website.

Sources of Personal Data

We may collect personal data from:

• You, for example: in your job application, CVs, resumes, forms you fill out for us, identity documents, assessments and surveys you complete, and any information you provide us during the course of your application and interview process;
• Vendors and service providers, for example: recruiters;
• Third parties, for example: job references, affiliated companies, professional employer organizations or staffing agencies. We will seek information from third parties generally once a job offer to you has been made and will inform you that we are doing so;
• Background check providers and credit reference agencies (where required for specific roles and permitted by local law);
• Publicly available professional networking sites and career portals;
• Automated technologies on Company’s electronic resources, for example: to track logins and activity on Company’s careers page;
• Surveillance/recording technologies installed by Company, for example: video surveillance in common areas on Company premises, voicemail technologies, webcams, and audio/video recording technologies with consent to the extent required by law;
• Government or administrative agencies, for example: law enforcement or public health authorities; and
• Acquired company, if Company acquired your employer, Company might collect personal information from that employer.

How We Use Your Information

We process your personal data for the purposes described below. Where applicable law requires us to identify a lawful basis for processing, the applicable basis is indicated under each purpose. Where we rely on legitimate interests, we have assessed that those interests are not overridden by your interests or fundamental rights and freedoms.

• Recruitment and Application Management. We process your personal data to manage and administer the recruitment process as necessary to take steps at your request prior to entering into a contract of employment and on the basis of our legitimate interests in identifying and evaluating qualified candidates, including to:
  • Administer and manage your application and communicate with you throughout the recruitment process, as necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract;
  • Evaluate your education and working skills, qualifications and your suitability in connection with your selected job opening and/or for available positions;
  • Keep your record for future hiring needs, including for the purpose of contacting you regarding possible employment;
  • Take measures to verify that the information you have provided is true and accurate, such as reference checks; and
  • Evaluate and improve the recruiting processes, including through training and quality assurance with respect to Company employees conducting the interviews or otherwise to assist with the recruiting and hiring process and to promote Company as a place to work.
• Background Checks and Screening. We process your personal data to conduct background checks and screening where required or authorized by applicable law, including to:
  • Conduct background checks to the extent authorized by law and as required for your role, which may include but are not limited to criminal record checks, credit and financial standing checks, and other assessments relevant to the responsibilities of the position or applicable regulatory requirements.
• Health, Safety, and Wellbeing. We process your personal data to address health and safety matters during the recruitment process as necessary to take pre-contractual steps at your request, to comply with applicable health, safety, and employment law obligations, and — in the case of medical or safety emergencies — where processing is necessary to protect your vital interests or those of another person, including to:
  • Conduct pre-employment physical examinations and post-offer medical examinations, maintain occupational health and safety compliance and record-keeping, provide reasonable accommodations, and respond to health or safety needs arising during the recruitment process; and
  • Protect the vital interests of you or another person (for example, to respond to an Applicant’s medical emergency), or where necessary for a task carried out in the public interest, in the exceptional circumstances permitted by law.
• Security and Monitoring. We process your personal data to monitor and protect our facilities and systems on the basis of our legitimate interests in protecting our information systems and where required to comply with applicable laws and Company policies, including to:
  • Monitor and protect Company facilities and information systems, and report suspected criminal conduct to law enforcement or cooperate with investigations.
• Business Operations and Recruitment Administration. We process your personal data to manage the business operations connected to the recruitment process on the basis of our legitimate interests in running an effective and well-organized recruitment function, including to:
  • Manage business operations connected to the recruitment process, including interview travel, reimbursements, and supporting personnel involved in hiring.
• Business Transfers and Corporate Transactions. We process your personal data in connection with corporate transactions on the basis of our legitimate interests in evaluating and implementing such transactions and, where required, to comply with applicable law, including to:
  • Process it in connection with a corporate transaction, sale, or assignment of assets, merger, divestiture, or other changes of control or financial status of Company or any of its subsidiaries or affiliates.
• Defending and Protecting Rights. We process your personal data to protect and defend our legal rights and those of others on the basis of our legitimate interests in establishing, exercising, and defending legal claims and, where applicable, to comply with applicable legal obligations, including to:
  • Establish, exercise, or defend (potential) legal claims, and to comply with legal obligations or regulatory requirements.
• Compliance with Applicable Legal Obligations. We process your personal data where necessary to comply with applicable legal obligations, including under employment law, immigration law, and other applicable laws and regulations, including to:
  • Verify your identity and eligibility to work in the relevant jurisdiction.

How We Store Your Information

Your personal data will be stored in a range of different places, including on your application record, in our Human Resources management systems and on other IT systems (including email). We are subject to legal duties to take good care of personal data and apply security measures which are consistent with its sensitivity.

How We Share Your Information

We may share personal data with members of the Company’s Human Resources department and the Recruiting team, interviewers involved in the recruitment process, managers in the business area with a vacancy, and IT staff if access to the data is necessary for the performance of their roles. We may also share personal data with affiliated companies within the Ripple group of companies for purposes including evaluating your application for cross-enterprise team, compliance auditing, and maintaining the security and integrity of our systems.

We may share personal data to third parties in the following circumstances:

• Auditors, lawyers, consultants, and accountants engaged by Company for the business purpose of auditing compliance with policies and applicable laws, in addition to performing services on the Company’s behalf;
• Government authorities, regulators, or law enforcement agencies where required or permitted by law, including: (i) if required to do so by law or legal process; (ii) in connection with any legal proceedings, or for the purposes of establishing, exercising, or defending legal rights; (iii) to law enforcement authorities or other government entities based on a lawful disclosure request; or (iv) when we believe disclosure is necessary or appropriate to prevent harm or financial loss, or in connection with an investigation of suspected or actual fraudulent or illegal activity; and
• Successors or acquirers in connection with a merger, acquisition, joint venture, reorganization, divestiture, dissolution or liquidation, sale or assignment of assets, or other changes of control or financial status of Company or any of its subsidiaries or affiliates. In such cases, we will use reasonable efforts to direct the transferee to use personal data you have provided to us in a manner that is consistent with this Applicant Notice. Following such a sale or transfer, you may contact the entity to which we transferred your personal data with any inquiries concerning the processing of that information.

We do not sell or share (disclose it for cross-context behavioral advertising) your personal information in connection with the application process. We also have no actual knowledge that we sell or share the personal information of individuals of any age in connection with the application process, including the personal information of children under 16.

Transfer of Personal Data To Other Countries

Company operates globally. Your personal data may be transferred to and processed in countries other than your country of residence, including but not limited to the United States, where our Human Resources Department and Recruiting team and Human Resources management systems and other IT systems (including email) are located. Where required by applicable law, we implement appropriate safeguards for international transfers, such as standard contractual clauses or other approved transfer mechanisms.

DIFC or ADGM

Where we transfer your personal data outside of the DIFC or ADGM respectively, including to jurisdictions that have not been recognized as providing an adequate level of protection by the DIFC Commissioner of Data Protection or the ADGM Commissioner of Data Protection, we do so on the basis of appropriate safeguards permitted under applicable law, including standard contractual clauses. You may obtain a copy of the relevant safeguards by contacting us using the information located in the 'Contact Us' section of this Notice.

EU-U.S. Data Privacy Framework

Company’s participating entities comply with the EU-U.S. Data Privacy Framework Principles, the UK Extension to the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework Principles (collectively, the “DPF Principles”). The participating entities can be found here. Company has certified to the U.S. Department of Commerce that it adheres to the DPF Principles with regard to the processing of personal data received from the European Union, United Kingdom and Switzerland in reliance on the DPF Principles. Company is committed to protecting your personal information and continues to comply with these frameworks as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union, the United Kingdom, and Switzerland to the United States. If there is any conflict between the terms in this Notice and the DPF Principles, the DPF Principles shall govern. To learn more about the DPF Principles program, and to view our certification, please visit https://www.dataprivacyframework.gov/. In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Company commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU and UK individuals and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF should first contact Company at privacy@ripple.com. In compliance with the DPF Principles, Company commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of human resources data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF in the context of the employment relationship.

Company is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC). Under certain circumstances you may request arbitration by the Data Privacy Framework Arbitration Panel for resolution of any claimed violations of the Principles not resolved by any of the other EU-U.S. DPF mechanisms. For more information, please visit https://www.dataprivacyframework.gov/s/article/A-Scope-dpf?tabset-35584=2. In cases of onward transfer to third parties of personal information received pursuant to the DPF Principles, Company shall remain potentially liable.

Company has also committed to refer unresolved complaints to JAMS, an alternative dispute resolution provider located in the United States. If you do not receive timely acknowledgment of your complaint from us, or if we have not addressed your complaint to your satisfaction, please visit https://www.jamsadr.com/DPF-Dispute-Resolution for more information or to file a complaint. The services of JAMS are provided at no cost to you.

Our UK Representative

We have appointed Ripple Markets UK Ltd. to act as our UK Representative. Data subjects may contact Ripple Markets UK Ltd. by sending an email to privacy@ripple.com.

Personal Data Service Providers

We use the following third-party service providers or vendors to store, manage, or process applicant data:

How We Protect Your Information

We are committed to protecting the security of your information. We maintain appropriate administrative, technical and physical safeguards designed to protect the personal data you provide against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use.

How Long We Retain Your Data

If Company hires you, the information collected about you during the job application process may become part of your personnel file and may be used to administer the employment relationship and for related reporting and recordkeeping purposes. Company will retain this application information for the entire duration of your employment relationship with Company and for as long thereafter as permitted or required by applicable law. Company makes its document retention schedule available to employees for review. If your application is unsuccessful, we will retain your personal data for 12 months in the UK, Switzerland and Iceland, 15 months in Ireland, 12 months in the DIFC and ADGM, from the date that you are notified of your unsuccessful application in case there are future employment opportunities for which you may be suited. We will use your personal data for this purpose in light of our legitimate interests in staffing vacancies. In California, we will retain information of applicants who are not hired for four (4) years after the record is collected, for our internal recordkeeping and reporting purposes in compliance with California Government Code § 12946. During that time, we may also use your information to consider you for positions in addition to the position(s) for which you initially applied.

If you do not wish for us to keep your data, please contact us using the information located in the ‘Contact Us’ section of this Notice. We may retain personal information longer than described above if required by law, for example, for a litigation hold.

Your Privacy Rights

Subject to applicable local law, you have the following rights regarding your personal data.

Right to Access: You have the right to request certain information and to access personal data that we hold and to request a copy of your data.

Right to Correction: We will take steps to maintain correct personal data. We encourage you to keep us up to date in order to ensure that changes in personal circumstances (for example, change of address, etc.) are reflected in our database. You have the right to request correction of any inaccurate personal data relating to you.

Right to Deletion: You have the right to request deletion of any irrelevant personal data we hold about you.

Right to Withdraw Consent: In the event your personal data is processed on the basis of your consent, you have the right to withdraw consent at any time by contacting us using the information located in the ‘Contact Us’ section of this Notice specifying your request, without affecting the lawfulness of processing based on consent before its withdrawal.

Non-Discrimination / Non-Retaliation: We will not discriminate against or retaliate against any applicant for exercising any privacy right set out in this Notice or under applicable law.

Right to Data Portability (if you are a resident of EU, EEA, UK, Switzerland, DIFC or ADGM): In certain circumstances, you may be entitled to receive your data in a structured, commonly used and machine-readable format, and also to require us to transmit it to another data controller where this is technically feasible.

Right to Restrict Processing (if you are a resident of EU, EEA, UK, Switzerland, DIFC or ADGM): In certain circumstances, you may be entitled to request that we restrict our use of your personal data.

Right to Object (if you are a resident of EU, EEA, UK, Switzerland, DIFC or ADGM): In certain circumstances, you may be entitled to object to our processing of your data.

Right to Know (if you are a resident of California): You have the right to submit a verifiable request up to twice in a 12-month period for specific pieces of your personal information and for information about Company's collection, use, and disclosure of your personal information. Please note that the CPRA’s right to obtain “specific pieces” does not grant a right to the whole of any document that contains personal information, but only to discrete items of personal information. Moreover, Applicants have a right to know categories of sources of personal information and categories of external recipients to which personal information is disclosed, but not the individual sources or recipients.

Right to Lodge a Complaint:

• In compliance with the DPF Principles, Company commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of human resources data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF in the context of the employment relationship.
• Where applicable law provides for it, if you believe that we have not complied with this Notice or your applicable data protection rights, you have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction. We encourage you to contact us first so that we may address your concerns directly. For the EU and EEA, you can contact your local data protection authority, which can be found at edpb.europa.eu. For the UK you can contact the Information Commissioner's Office at ico.org.uk/global/contact-us/. For Switzerland, you can contact the Federal Data Protection and Information Commissioner at edoeb.admin.ch. For Australia, you can contact the Office of the Australian Information Commissioner at oaic.gov.au. For the DIFC, you can contact the DIFC Commissioner of Data Protection at difc.ae/business/operating/data-protection. For ADGM, you can contact the ADGM Office of Data Protection at adgm.com/operating-in-adgm/office-of-data-protection. For Singapore, you can contact the Personal Data Protection Commission at https://www.pdpc.gov.sg/individuals/e-services/report-a-data-protection-concern.

Please note that we may need to retain certain personal data for record keeping purposes and/or to complete any transactions that you began prior to requesting a change or deletion. For further information regarding your rights, or to exercise any of your rights, please contact us using the information located in the ‘Contact Us’ section of this Notice.

If you are a resident of California, the following provisions apply:

Verifying your Request. If you submit a request through an adequately secure password-protected account that you created before the date of your request, we will use the authentication mechanisms in the account to verify your identity. Otherwise, we match personal information that you provide us against personal information we maintain in our files. The more risk entailed by the request (e.g., a request for specific pieces of personal information), the more items of personal information we may request to verify your identity. If we cannot verify your identity to a sufficient level of certainty to respond securely to your request, we will let you know promptly and explain why we cannot verify your identity.

Authorized Agents. You may designate an authorized agent to exercise your right to know, to correct, or to delete. If an authorized agent submits a request on your behalf, the authorized agent must submit with the request a document signed by you that authorizes the authorized agent to submit the request on your behalf. In addition, we may ask you or your authorized agent to follow the applicable process described above for verifying your identity. This provision does not apply if you have provided a power of attorney compliant with the California Probate Code.

CCTV (Closed Circuit Television) / Monitoring

We have installed CCTV systems in some of our premises used by members of the public, visitors to our office, and our employees. The principal purpose of the CCTV system is for the prevention and detection of crime, and to ensure the safety of employees, visitors and members of the public. Images captured by CCTV will not be kept for longer than necessary. However, on occasions there may be a need to keep images for longer, for example where a crime is being investigated. We will only disclose images and audio to other authorized bodies who intend to use it for the purposes stated above. You have the right to see CCTV images of yourself and be provided with a copy of the images.

Automated Decision-Making and Profiling

We may use applicant tracking software to organize and manage applications; however, this is an administrative tool and does not substitute for human judgment.

Company does not make hiring decisions based solely on automated processing. We do not use automated tools to build profiles of applicants or to make final assessments without meaningful human review. Our recruitment process involves human evaluation at all material decision points, including shortlisting, interview, and offer stages.

Contact Us

The data controller responsible for your personal data is the Company entity to which you are applying, as identified in the relevant job posting or application process.

To submit a request to exercise your privacy rights, please contact us at hr@ripple.com. If you are a resident of California, you may also reach us by calling 1 (800) 887-4084.

To submit questions regarding this Notice or our privacy practices, please contact us by emailing privacy@ripple.com. Where applicable law requires us to appoint a Data Protection Officer or equivalent role, they may also be reached at this address.

Changes to This Notice

We may update this Notice from time to time. If we update this Notice, we will post those changes on this page and update the effective date above.