(Last updated July 29, 2025)

Anduril and its affiliates (collectively referred to as "Anduril", "we", "us") takes its data protection and privacy responsibilities seriously. This privacy notice explains how we collect, use and share your personal information as a result of your use of our websites, including:

• Intranet Disclosure
• What personal information we collect and when and why we use it
• Sharing your personal information
• Transferring personal information globally
• How we protect and store personal information
• How you can contact us
• Changes to this Privacy Notice
• Australia
• European Union and United Kingdom
• California

1. Intranet Disclosure

Some of Anduril websites that provide employees and retirees access to personnel and benefits information from the Internet, may provide more detailed privacy or disclaimer notices or policies, in which case they take priority over this notice.

To make this Privacy Notice easy to find, we make it available in the footer of every web page where it applies. Employees, Applicants and others with access to the Anduril internal Intranet should note that this privacy notice will apply if linked directly from there; otherwise, our internal privacy policies will apply.

You might find external links to third-party websites on our website. This privacy notice only applies to personal data collected on this website and does not apply to your use of a third-party site. We have no influence or control over linked third-party websites and your use of other sites is at your own risk and is subject to their privacy statements and policies.

2. What Personal Information We Collect and When and Why We Use It

We collect information about you if you register with or use one of our website(s).

We will collect your personal information via the following methods:

• By recording details you provide to us, with your explicit consent where required, - e.g. in responding to a job posting, your communications with us through emails or calls, and/or
• By observing your use of our products and services and our website.
• Our website uses a tracking technology known as "cookies." These cookies may collect demographic and interest information, which may result in seeing certain interest based information on other websites. For further details on our use of cookies and how you can change the way your browser manages cookies please see our cookie statement.

We may collect or use the following categories of Personal Information if you use our websites or visit our facilities:

Category of Personal Information	Further information about the category
Contact information	Names, postal addresses (including address history), email address, telephone numbers.
Employment information	Employment status, employment history, education history CV, information about security clearance (where necessary), work authorization, your current salary, and other personal information submitted by job applicants.
Demographic Information	Gender, Ethnicity, Veteran Status, Disability Status.
IP Address and Technical Details	IP address of the computer/personal device that you use to access our website(s), approximate location information from where you access our website(s) and information about your device and browser.
Health Information	Information relating to infectious diseases such as symptoms, recent diagnoses and relevant travel history.

We may use or disclose the personal information we collect to:

• fulfill or meet the reason you provided the information. For example, if you share your name and contact information to request a price quote or ask a question about our products or services, we will use that personal information to respond to your inquiry;
• communicate with you about, and administer your participation in, special events, programs, offers, surveys and market research;
• respond to your inquiries;
• process employment applications, including by assessing qualifications, verifying information, and conducting reference or other employment-related checks;
• evaluate potential suppliers and subcontractors and manage our relationships with them;
• perform data analyses (including anonymization and aggregation of personal information);
• protect against, identify and prevent cybersecurity and other security events, espionage, fraud and other unlawful activity, claims and other liabilities;
• help maintain the safety, security, and integrity of our website, products and services, databases and other technology assets, and business; and
• comply with and enforce applicable legal requirements, relevant industry standards and our policies.

We also may use the information in other ways for which we provide specific notice at the time of collection.

3. Sharing Your Personal Information

In this section you can find out more about how we share personal information:

• within Anduril
• with third parties, including those that help us provide our products and services; and
• with regulators

We share your information in the manner and for the purposes described below:

• within Anduril, where such disclosure is necessary to provide you with our services, to manage our business, or for security purposes;
• with third parties who help manage our business and deliver services. These third parties have agreed to confidentiality restrictions and use any personal information we share with them or which they collect on our behalf solely for the purpose of providing the contracted service to us. These include IT service providers who help manage our IT and back office systems;
• we may share in aggregate, statistical form, non-personal data regarding the visitors to our website, traffic patterns, and website usage with our partners, affiliates or advertisers;
• If, in the future, we sell or transfer some or all of our business or assets to a third party, we may disclose information to a potential or actual third-party purchaser of our business or assets; and/or
• with our regulators, to comply with all applicable laws, regulations and rules, and requests of law enforcement, regulatory and other governmental agencies.

4. Transferring Personal Information

Anduril operates on a global basis. Accordingly, your personal information may be transferred and stored in the United States, Australia, the United Kingdom are subject to different standards of data protection. Anduril will take appropriate steps ensure that transfers of personal information are in accordance with applicable law and carefully managed to protect your privacy rights and interests. To this end:

• we ensure transfers within Anduril will be covered by an agreement entered into by members of Anduril (an intra-group agreement) which contractually obliges each member to ensure that personal information receives an adequate and consistent level of protection wherever it is transferred within Anduril;
• where we transfer your personal information outside Anduril or to third parties who help provide our products and services, we obtain contractual commitments from them to protect your personal information; or
• where we receive requests for information from law enforcement or regulators, we carefully validate these requests before any personal information are disclosed.

You have a right to contact us at legal@anduril.com for more information about the safeguards we have put in place (including a copy of relevant contractual commitments) to ensure the adequate protection of your personal information when this is transferred as mentioned above.

5. How We Protect and Retain Your Information

We have implemented and maintain appropriate technical and organizational security measures, policies and procedures designed to reduce the risk of accidental destruction or loss, or the unauthorized disclosure or access to such information appropriate to the nature of the information concerned. As the security of information depends in part on the security of the computer you use to communicate with us and the security you use to protect User IDs and passwords please take appropriate measures to protect this information.

We will retain your personal information for as long as is reasonably necessary for the purposes for which it was collected, in alignment with our business needs (for example, to provide you with our services or to further contact you about employment opportunities). In some circumstances we may store your personal information for longer periods of time, for instance where we are required to do so in accordance with legal, regulatory, tax, and accounting requirements.

In specific circumstances, we may store your personal information for longer periods of time so that we have an accurate record of your dealings with us in the event of any complaints or challenges, or if we reasonably believe there is a prospect of litigation relating to your personal information or dealings.

6. Changes to Privacy Notice

Anduril reserves the right to modify this Privacy Notice at any time. If we make changes to this Privacy Notice, we will post the revised notice here and update the effective date. We may change or update portions of this privacy notice at any time and without prior notice to you.

7. Contact Us

If you have questions relating to our privacy policy or practices, or wish to submit a data privacy request, contact us at legal@anduril.com. We process requests and enable individuals to fulfill their data privacy rights consistent with applicable data privacy laws. These rights include, but are not limited to, the right to access, correct, delete, and opt-out of data processing. These rights are dependent upon other considerations, such as the scope of applicable data privacy laws and the legal obligations of Anduril. As such, our fulfillment of these data privacy rights is a guarantee of a process, not of an outcome. When responding to a data privacy request, we will:

We will verify the identity of the requestor prior to a response being provided. Upon verification, we will provide a response to the requestor without undue delay and we will investigate and attempt to resolve complaints and disputes and will make every reasonable effort to honor your wish to exercise your rights as quickly as possible and, in any event, within the timeframes provided by applicable data protection laws. If we cannot or will not fulfill a request, the requestor will receive a response identifying the reason(s) and any additional steps available, including the right to appeal, if applicable.

8. Anduril Australia Privacy Policy

Introduction

Anduril Australia Pty Limited ABN 15 657 508 088 and its related Australian entities are committed to upholding your rights to privacy protection. We will comply with the Privacy Act 1988 (Cth), as amended, and any other applicable laws applicable to us which regulate the collection, use, disclosure and handling of personal information.

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is:

• true or not; and
• is recorded in a material form or not.

This Australia Privacy Policy (Policy) details the practices we have adopted to protect your privacy, so that you can feel confident about how we manage the personal information you entrust to us. It also explains how to contact us if you have any queries or complaints.

By using our website(s) or otherwise interacting with us, you may be asked to provide personal information in order to accomplish the purpose of your visit or assist us to operate our business, including providing or acquiring goods and services. By providing us with your personal information, you consent to us collecting, using, disclosing and/or transferring (including cross-border transfer) that information in accordance with this Policy.

Please ensure that you read this Policy before submitting your information to us. You are responsible for the information that you provide or make available and you must ensure that it is legal, honest, truthful, accurate and not misleading in any way. You must ensure that the information provided does not contain any material that is obscene, defamatory, or infringing on any rights of any third party, or otherwise legally actionable by such third party. Before providing personal information to us relating to other persons, you must obtain their consent and notify them of the location of this Policy.

Information we collect

We will collect and hold personal information that is necessary for our business operations, or to comply with our legal obligations. The types of information we collect and hold will depend on the reasons for, or circumstances of, its collection. It may include, amongst other things:

• contact information, including your name, postal and email addresses and telephone number;
• employment or engagement application information, including your resume, work authorisation information, education history, career history, security clearances and other information legally required before access to certain US derived technical information and services related to military products can be granted to you;
• other personal information you give us when you provide or acquire a good or service to or from us, including your corporate profile, requirements with respect to specific goods or services, opinion or preferences with respect to any of our or your goods or services, payment and transactional information and billing and credit information, including payment, credit and service history;
• information contained in any communications between you and us, including information contained in an application form or other document given to us; activity with or on our website(s), including through use of cookies and general information about your visit which may include your server address, the date and time of your visit, the pages you accessed, the information you downloaded and the type of Internet browser you used. We and/or our services providers and contractors may use this information in anonymous, aggregated form, for statistical purposes, to assist us in improving the quality and usability of our business and website(s). Our website(s) also may make use of third party analytics services, including Remarketing with Google Analytics, Google Display Network Impression Reporting, and Google Analytics' campaign tracking feature. We and third party vendors, including Google, may use first-party cookies (such as the Google Analytics cookie) and third party cookies together to (i) inform, optimize, and serve ads based on your past visits to our website(s) and (ii) report how ad impressions, uses of ad services, and interactions with the foregoing are related to your visits to our website(s); and
• any information we are required to collect by law.

We will not collect, use or disclose sensitive information about you unless it is necessary to operate our business and we have your consent or unless we are legally required to collect, use or disclose that information. Sensitive information includes any information about a person's race, ethnic origin, political opinions, religious or philosophical beliefs or affiliations, membership of a professional, trade or political association or union, sexual preferences or practices, criminal record, health information or genetic information about an individual that is not otherwise health information.

How we collect information

We collect personal information in a number of ways, including information that you provide to us:

• through your use of our website(s), goods or services;
• when you apply for employment or engagement with us;
• when you or your representatives interact with us or one of our trusted partners, including our service providers, contractors or agents;
• when you make a payment to us or one of our trusted partners.

In addition, there will be circumstances where we obtain your personal information from other sources, such as from credit reporting and verification bodies and from publicly available information.

We may also monitor and record your communications with us (including email and telephone) for security, dispute resolution, and training purposes and we also operate video and audio surveillance devices in our premises.

Where we collect your personal information, we will do so only by lawful and fair means and not in an unreasonably intrusive way. The specific information that you may choose to provide will depend on the nature of the transaction to be completed and is always voluntary. Where it is lawful or practical to do so, you may choose to deal with us anonymously. However, we may not be able to conduct particular functions or activities, including providing you with or acquiring your goods and services if you do not provide us with the information we reasonably request.

Holding and securing your information

We hold your personal information electronically and in hard copy form, both at our own premises and with the assistance of our trusted partners, including our related entities and service providers, some of which are based overseas, including in the United States of America.

We protect any personal information that we collect and hold about you from misuse or loss. We also protect it from unauthorised access, modification or disclosure. Where we need to disclose your personal information to a third party, we will restrict their use to the specific purpose that we have provided and use best endeavours to ensure that they observe and adhere to the terms of this Policy.

We also take measures in respect of destroying or de-identifying personal information that is no longer needed for any lawful purpose. Unfortunately, the internet is not a secure place and we cannot guarantee security of your personal information.

Use of your information

We collect your personal information so that we can use it for or in connection with our business operations, which may include, amongst other things:

• helping us to operate, maintain and improve our website(s), our business and the products and services we may acquire from or provide to you;
• communicating with you, including in order to acquire or provide you with products and services;
• evaluating potential suppliers and subcontractors and manage our relationships with them;
• conducting assessments and verifying personal information provided to us to enable us to employ or engage you and lawfully conduct our business;
• working with our related entities, service providers, contractors and agents in the conduct of our business;
• sending information including confirmations, invoices, technical notices, updates, security alerts, and support and administrative messages;
• addressing any queries, feedback or complaints we receive from you;
• developing, improving, analysing and, marketing (unless restrictions apply) goods and services that may be offered by us and/or our selected partners. In some cases marketing activity may continue after you've stopped providing or using our products or services, and until you opt-out. You can stop us using your information for direct marketing by contacting us using the contact details below;
• complying with relevant laws, regulations and standards; and
• using your personal information for any other purpose that it was collected for, or any related purpose for which we are entitled to use your personal information.

Disclosure of your information

We may share your information with third parties who assist us with the operation of our business. We may also disclose your information to:

• your authorised representatives or advisers, or when you ask us to do so;
• identity and fraud-checking bodies for verification;
• our related entities, services providers and agents and other businesses we work with, including or through whom you may acquire goods or services;
• law enforcement and national security agencies, and other government and regulatory authorities as required or authorised by law;
• third parties who assist us with recruitment, for the purposes of assisting us to evaluate your application and to make contact with you and your referees;
• our professional advisors; and
• third parties who assist us with managing or developing our business and corporate strategies and functions, including our corporate risk or funding functions and for the purposes of facilitating or implementing a transfer/sale of all or part of our assets or business.

In some cases, the organisations that we may disclose your information to may be based outside Australia. For example, we may share your information with our related entities and service providers in the United States of America. We take reasonable steps to ensure that third party recipients are obliged to protect the privacy and security of your personal information consistent with this Policy and use it only for the purpose for which it is disclosed.

Access to or correction of your information

We take reasonable steps to ensure that any personal information collected by us is accurate and up-to-date at the time of collecting, using and disclosing.

If you learn that personal information we hold about you is inaccurate, incomplete or out-of-date, you should contact us. You also have a right to request that a statement be attached to your personal information if we disagree with your request to correct the information.

You can ask to obtain access to personal information that we hold about you, although in some circumstances, the law may not permit us to provide such information to you. If we are not able to provide you with access to any of your personal information held by us, we will tell you the reasons why this is the case. We may ask you to put your request in writing and pay a reasonable fee to us before providing requested access.

Contacting us or making a complaint

If you have any questions relating to this Policy, or for questions you might have about our privacy practices, including complaints, please contact us at legal@anduril.com.

If you have a complaint you will need to provide us with sufficient details regarding the complaint as well as any supporting evidence and/or information. Anduril Legal will investigate the issue and make all reasonable attempts to respond to your complaints or requests. We will contact you if we require any additional information and will notify you of the outcome of the investigation. If you are not satisfied with the outcome, you may refer the matter to the Office of the Australian Information Commissioner at www.oaic.gov.au.

Updates

This Policy may be updated periodically. We will notify you of any changes by posting the new Anduril Australia Privacy Policy to this page and will change the "Last Updated" date above. You should consult this page regularly for any changes.

9. EU/UK Privacy Rights

Last Updated: March 2025

If you are a resident of the European Economic Area ("EEA") or the United Kingdom ("UK"), our processing of your Personal Information may be subject to the EU General Data Protection Regulation ("EU GDPR") or the UK General Data Protection Regulation ("UK GDPR"). Where these laws apply to our processing of your Personal Information, you may have the following rights:

• right to correct your Personal Information;
• right to delete your Personal Information;
• right to restrict the processing of your Personal Information;
• right to transfer your Personal Information;
• right to access your Personal Information;
• right to object to the processing of your Personal Information; and
• right to not be subject to automated decision-making.

These rights (and potential limitations on them) are described below, along with information on how you can exercise these rights.

Right to Correct Your Personal Information

You may have a right to ask us to correct inaccurate or incomplete Personal Information that we process about you. If you submit this type of request, we will:

• determine whether it is a legally valid request and whether it should be directed to us or another entity;
• verify your identity;
• check whether the Personal Information you would like to change is inaccurate or incomplete; and
• if it is a legally valid request, correct or update any Personal Information found to be incorrect or incomplete.

Right to Access your Personal Information

You may have the right to request that we confirm whether we process your Personal Information and, if we process your Personal Information, that we provide you with access to the Personal Information we process about you. This right may be subject to certain limitations under applicable law.

If you have a right to access to your Personal Information, we will provide you with access to it, along with such other information as required by applicable law.

Right to Delete Your Personal Information

You may have a right to request that we delete your Personal Information if, for example,

• you feel that it is no longer needed for the purposes for which it was collected;
• you have withdrawn your consent (where the data processing was initially based on consent), and where there is no other legal basis for the processing;
• we are relying on our legitimate interests as the basis for processing your Personal Information, you object to such processing, and there is no overriding legitimate interest to continue processing it;
• we are processing it for direct marketing purposes and you object to that processing;
• it has been processed unlawfully; or
• we otherwise have a legal obligation to delete your Personal Information.

Please note that this right to deletion is not absolute. It applies only in certain circumstances and is subject to several exceptions. For example, we are not required to comply with your request if it is necessary for us to maintain your Personal Information:

• for compliance with a legal obligation, including compliance with applicable laws and regulations;
• for the establishment, exercise or defense of legal claims;
• to detect, prevent, or otherwise mitigate illegal activities, including but not limited to fraud, computer crimes and identity theft;
• to avoid or mitigate harm to Anduril personnel or property or to others, and
• for a legitimate purpose that overrides your interests in having your Personal Information deleted.

Right to Restrict the Processing of Your Personal Information

You may have a right to request that we limit our processing of your Personal Information. This right may be available to you when:

• we are reviewing your claim disputing the accuracy of the Personal Information we process about you;
• you feel that our processing of your Personal Information does not have a lawful basis, but you do not want it erased;
• we no longer need your Personal Information for the purpose for which we collected it, but you have requested that we keep your Personal Information for the purpose of establishing, exercising, or defending your legal claims; or
• you have exercised your right to object to our processing of your Personal Information, and we are considering whether we have an overriding legitimate grounds to process your Personal Information.

If you have a legal right to request that we restrict our processing of your Personal Information, and you make such a request, we will not process it except:

• to store it;
• when we have your consent;
• to establish, exercise or defend legal claims;
• to protect the rights of another natural or legal person; or
• for reasons of important public interest.

Right to Object to the Processing of your Personal Information

You may have the right to object to our processing of your Personal Information if our processing is for:

• direct marketing purposes;
• a task carried out in the public interest;
• the exercise of official authority vested in us; or
• our legitimate interests (or those of a third party).

You can always object to our processing of your Personal Information for direct marketing purposes; however, your right to object to our processing of your Personal Information for the other purposes identified above may be limited. If you object to our processing of your Personal Information, we may still continue processing your Personal Information if:

• we have compelling legitimate grounds for the processing which outweigh your interests, rights and freedoms; or
• the processing is for the establishment, exercise or defense of legal claims.

And if we are processing your Personal Information for scientific or historical research, or for statistical purposes, your right to object may be more limited.

To exercise this right, you must provide specific reasons why you are objecting to the processing of your Personal Information. These reasons should be based upon your particular situation.

NOTE: Both the "right to restrict" our processing of your Personal Information and the "right to object" provide you with some control over our processing of your Personal Information. The "right to restrict" allows you to request that we temporarily stop processing your Personal Information, except for certain permitted purposes, while the "right to object" requires that we stop processing your Personal Information for the purposes identified above unless an exception applies.

Right to Obtain, Port or Transfer your Personal Information

If you have provided your Personal Information to us, you may have the right to ask us to provide that Personal Information to you in a structured, commonly used machine-readable format, or you can ask to have it transferred directly to another entity or company, where technically feasible, but only when:

• the processing of your Personal Information is based on your consent or the performance of a contract with you; and
• the processing is automated.

Right to Not be Subject to Automated Decision-Making

You may have a right not to be subject to decisions made by automated means – meaning without any human involvement - where such decisions have a significant impact on you.

This right may also be subject to certain limitations. For example, it may not apply where such processing is necessary to enter into or perform under an agreement with you, or where you consent to such processing.

How to Exercise Your EU/UK Privacy Rights

If you are an EU or UK Resident, you can exercise your rights by contacting legal@anduril.com.

10. California Privacy Notice

Last Updated: March 2025

If you are a resident of California, the processing of your Personal Information may be subject to the California Privacy Rights Act ("CPRA"). The CPRA provides California residents with certain rights.

This California Privacy Notice ("CA Notice") supplements our general Privacy Statement and applies to the Personal Information that Anduril, Inc. ("we," "us," or "our") may collect about California residents, unless a more specific privacy notice applies. For example, if you are a Anduril employee, Anduril' Global Employee Privacy Notice will apply to our processing of Personal Information collected in connection with your employment. Additionally, our Recruitment Privacy Notice applies with respect to any Personal Information we collect in connection with recruitment and hiring activities.

Personal Information We Collect about California Residents

California law requires we provide disclosures to you about what Personal Information we collect by reference to the enumerated categories of Personal Information set forth within California law. To address this obligation, we have identified the relevant enumerated categories for the Personal Information described in the "What Categories of Personal Information Are Collected via Anduril Sites and Apps" section of our Privacy Statement.

For each category of Personal Information (in bold), we have provided a few examples of the types of Personal Information we may collect. These examples are not an exhaustive list of the types of Personal Information we collect in each category.

Category of Personal Information	Examples
Identifiers	Names, postal addresses, email addresses, and/or telephone numbers, preferred method of contact, and other Personal Information voluntarily provided to us.
Professional/Employment Information	Employer name, job titles, employment history, professional licensing and certification information, and professional organization affiliations.
Education information	Education history.
Internet / network information	IP addresses, device IDs, and/or other similar identifiers, and information about interactions with Anduril Sites or Apps or Anduril advertisements.
Geolocation data	Information about your non-precise physical location collected from geolocation features on your device, including your IP address.
Inferences	Inferences derived from Analytics Data as described in the "Data Collected for Analytics, Marketing and Advertising Purposes" section of our Privacy Statement.
Sensitive Personal Information	Information about health-related symptoms and conditions that you share with Anduril, information collected in connection with our efforts to maintain the health and safety of our employees and visitors to our facilities, and information about your race or ethnicity which we collect from job applicants for regulatory compliance purposes. We do not sell Sensitive Personal Information, and we do not process or otherwise share sensitive Personal Information for the purpose of targeted advertising. However, you may be able to limit our processing of Sensitive Personal Information as described below.

We may at times receive, or process Personal Information to create, deidentified information that can no longer reasonably be used to infer information about, or otherwise be linked to, a particular individual or household. Where we maintain deidentified information, we will maintain and use the information in deidentified form and not attempt to reidentify the information except as required or permitted by law.

Sources of Personal Information We Collect about California Residents

We may collect Personal Information from the following sources:

• information provided to us directly from California residents;
• information we collect prior to or during visits to our facilities;
• our affiliates and subsidiaries;
• our customers, prime contractors, subcontractors, and other partners;
• our advertising and marketing partners;
• conference organizers;
• our joint venture and strategic partners; and
• publicly available sources.

Purposes for Which We Process Personal Information

We may process Personal Information for the following business purposes, as further described in our Privacy Statement:

• to deliver marketing and advertising messages, or to otherwise communicate with you at your request;
• to provide information or otherwise respond to requests for information, such as information about Anduril' services, Anduril' expertise in various areas or Anduril publications;
• for legitimate business purposes, such as in connection with performance under a contract, bidding on a contract, or as otherwise necessary to meet contractual or legal obligations;
• to conduct research, analytics, and development;
• to identify and address bugs or system errors;
• to provide for the security of our systems and facilities;
• to protect our systems against malicious or unauthorized activity and to investigate any suspected malicious or unauthorized activity;
• to protect the safety of our guests, employees, and visitors to our facilities, including possibly through contact tracing, temperature scanning or other methods of identifying and/or preventing the spread of infectious disease;
• to conduct internal auditing;
• to protect our property and enforce our rights;
• to investigate reported adverse events involving a medical product or device sold or distributed by Anduril and submit such information to appropriate government agencies;
• as authorized or required by law; and
• for any other purpose stated when you provide your Personal Information to us or as described in this CA Notice.

Personal Information We Share about California Residents

The CPRA requires that we disclose the categories of Personal Information we have sold in the last year. Although we do not sell Personal Information for direct monetary compensation, we permit third parties to collect Internet / Network Information and related Inferences from our Sites and Apps (as defined in our general Privacy Statement). These data processing activities qualify as the "sale" of Personal Information or the sharing or processing of Personal Information for the purpose of displaying advertisements that are selected based on Personal Information obtained or inferred over time from an individual's activities across businesses or distinctly-branded websites, applications, or other services (otherwise known as "targeted advertising" or "cross-context behavioral advertising") under the CPRA.

In addition, we may disclose each of the categories of Personal Information described in the "Personal Information We Collect about California Residents" section above to third parties in connection with our business operations, such as to market Anduril' services or the expertise and skills of its workforce.

For example, we share these categories of Personal Information with third party partners and service providers for various reasons, such as: 1) to help us target advertising messages to potential or existing customers, both online and through direct marketing campaigns, 2) to identify new business opportunities, 3) to prepare and submit business proposals and bids, 4) to contact potential new business partners and employees; and 5) to negotiate with potential business partners and potential customers. Our third party partners may include subcontractors, customers, prime contractors, consultants, universities, and other entities or individuals with whom we partner to provide solutions to our customers.

For more information about how we disclose Personal Information, please refer to the "Disclosure of Personal Information" section of our Privacy Statement.

Right to Know What Personal Information We Process about You

If you live in California, you may have the right to request that we disclose to you certain information about our processing of your Personal Information during the last 12 months. You may request that we provide to you 1) the categories of personal information we collect about you, 2) the categories of sources from which we collected this information, 3) the business or commercial purpose for collecting, selling, or sharing your Personal Information, 4) the categories of third parties to whom we disclose your Personal Information, and 5) the specific pieces of Personal Information we collected about you. To exercise this right, contact legal@anduril.com.

Right to Delete Your Personal Information

If you live in California, you may have the right to request that we delete the Personal Information we have collected from you. To exercise this right, contact legal@anduril.com.

Please note, though, that the right to delete your Personal Information is not absolute. For example, we will not delete your Personal Information if we need to process it:

We may also retain any Personal Information contained in archive or back-up systems until we recover or delete your Personal Information.

Right to Opt-Out of Sales

If you are a California resident, you may have the right to ask us to not "sell" your Personal Information and the right to opt out of interest-based advertising. To exercise this right, please review the sections in our general Privacy Statement about managing Cookies and interest-based advertising to learn how to opt-out of permitting third parties to collect information about your activities on our Sites or Apps. You can also contact legal@anduril.com.

If you are visiting one of our Sites and Apps with the Global Privacy Control enabled, any cookies that constitute sales or are used for targeted advertising should already be turned off automatically in our cookie preference manager. Please note this opt-out tool is website, device, and browser specific, so you will need to change your preferences on each device and browser you use to interact with the specific website you are visiting. In addition, you can also opt-out of cookie-based sales by businesses that participate in the Digital Advertising Alliance's CCPA Opt-Out Tool by visiting https://www.privacyrights.info. Lastly, you may follow the other steps set forth in "Your Choices" section of our Privacy Statement to further exercise control over automatic data collection technologies.

Right to Correct Your Personal Information

California residents also have the right to ask that we correct any inaccurate Personal Information we maintain about you. If you submit a request to correct your Personal Information, we will review your request to determine if the Personal Information we maintain about you is accurate. If we determine that the Personal Information we maintain about you is inaccurate, we may correct it or delete it. To exercise this right, contact legal@anduril.com.

Right to Limit our Processing of Sensitive Personal Information

California residents also have a right to request that Anduril limit processing of Sensitive Personal Information. Sensitive Personal Information includes 1) certain government identification numbers, 2) financial account information, 3) precise geolocation information, 4) information about an individual's racial or ethnic origin, 5) information about an individual's religious or philosophic beliefs, 6) information about an individual's union membership, 7) genetic or health information, and 8) information about an individual's sex life or sexuality.

If you submit a request to limit our processing of your Sensitive Personal Information, we will limit our use or disclosure of your Sensitive Personal Information to only those processing activities that are permitted by the CPRA. These processing activities may include 1) performing services at your request, 2) preventing, detecting, and investigating security incidents, 3) preventing and prosecuting malicious, deceptive, fraudulent, or illegal actions, 4) ensuring the physical safety of others, 5) providing products and services and upgrading or enhancing those products and services or for other permitted business purposes, or 6) as otherwise permitted by the CPRA. To exercise this right, contact legal@anduril.com.

Right to Equal Treatment

If you exercise any of the rights provided to you under the CPRA, we will not treat you any less favorably as a result of your request. We support your desire to exercise these rights and we will not provide you with a different level of service if you do.

Exercising Your Rights

To exercise your rights under the CPRA, contact legal@anduril.com. You will be asked to identify your relationship to Anduril and the right(s) you would like to exercise. which we will use to verify your identity and California as your state of residence by matching it to information we have previously collected. Upon receiving your request, we may communicate with you to obtain additional information that will help us process your request.

Using an Authorized Agent

You have the right to use an authorized agent to exercise your rights under the CPRA on your behalf. To use an authorized agent, your agent will be required to provide evidence that you have granted him or her power of attorney. If you have not granted your authorized agent power of attorney, your authorized agent must provide us with a written and signed statement in which you authorize your agent to act on your behalf, and your authorized agent must verify his or her identity. You will also be required to directly confirm with us that you have authorized your agent to submit the request on your behalf.

Personal Information of Children

We do not knowingly collect or process Personal Information of children under 16 years old. We also do not knowingly sell Personal Information relating to children under 16 years old. If you believe that we have collected or sold Personal Information about a child under 16 years old, please contact legal@anduril.com to notify us of such processing.

Other California Rights

Anduril may also share Personal Information with its affiliates so that they can send direct marketing communications. If you do not wish to receive these communications, please let us know by email at contact legal@anduril.com.

Questions and Complaints

If you have any questions, complaints, or wish to send us comments about this Privacy Notice, please send an e-mail to contact legal@anduril.com. We will investigate your complaint and will respond as soon as possible.