Page 3 - POLICY FOR THE PROTECTION AND PROCESSING OF PERSONAL DATA OF NUROL GROUP EMPLOYEES

2.1.4. Processing Data in a Manner that is Relevant, Limited and Measured to the Stated
Purpose of Processing
Our Company collects only the type of personal data that is required for its business activities, and
only to the extent that is warranted by these activities. The processing of the data also remains
limited to the stated purposes.

2.1.5. Periods Envisaged in Relevant Legislation that are Required for the Purpose of
Processing
Safekeeping of Data

Our Company stores personal data for as long as required, and for the purpose for which it has
been processed, and in accordance with the minimum time periods defined in legislation.
Accordingly, our Company first determines whether a specific time period is specified in legislation
for the storage of personal data, and acts accordingly if such a time period is defined. If no legally
defined time period is available, the personal data is kept for as long as it is necessary, in
accordance with the purpose for which it has been processed. Personal data will be destroyed in
accordance with pre-defined methods (deletion and/or disposal and/or anonymization) at the end
of its storage period, or at periodic times for designated data destruction, or upon the
application/request of the data owner.

2.2 CONDITIONS FOR THE PROCESSING OF PERSONAL DATA

Explicit consent by the owner of personal data constitutes only one of the legal grounds for the
processing of personal data, in compliance with the law. Should any of the conditions listed below
apply, personal data may be processed by our Company without having to obtain the explicit consent
of the owner of the personal data.

Any one of the conditions listed below other than explicit consent can serve as a basis for the
processing of personal data, although more than one of these conditions may serve as the basis for
the processing of the same personal data. In the event of the data to be processed being private
personal data, the conditions listed within Section 2.3 (“Processing of Special Category Personal
Data”) of this Policy shall apply.

2.2.1 Explicitly Envisaged in the Laws
If explicitly required by the law, in other words, should the law contain an explicit provision relating
to the processing of personal data, the personal data of the data owner may be processed by our
Company to the extend permitted by legislation.

2.2.2 Impossibility of Obtaining Explicit Consent
The processing of the personal data of the data owner is permitted in cases where it becomes
obligatory to process the personal data of a person who is incapable of expressing consent, or
whose consent lacks validity, in order to protect the life or physical integrity of this person or
someone else.

2.2.3 Direct Relationship with the Conclusion and Execution of a Contract
If personal data is required to be processed, this condition may be deemed to have been fulfilled
provided that a contract to which the data owner is a party is concluded, or is directly related to
its execution.

2