In accordance with Article 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter - GDPR), we inform you that:

A company within the Nord Security Group - UAB 360 IT, a private limited liability company organized under the laws of Lithuania, registration number 304368853, with its registered office at Švitrigailos str. 36, Vilnius, Lithuania - acts as the controller of personal data processed in connection with the referral program (hereinafter referred to as the "Controller").

For all matters related to the processing of your personal data by the Controller, you may contact us by sending a message to the following e-mail address: privacy@nordaccount.com.

PURPOSE OF PROCESSING OF PERSONAL DATA

Your personal data will be processed in connection with your nomination of a candidate to participate in a recruitment process with the Controller, and for the purpose of determining your entitlement to receive a referral bonus for successfully referring a candidate for employment with the Controller, on the terms set out in the Referral Program, including verifying that you meet the conditions set out in the Program Rules and processing the payment of the reward.

GROUNDS FOR PROCESSING OF PERSONAL DATA

Personal data obtained under the Referral Program will be processed:

• on the basis of Article 6(1)(b) of the GDPR, i.e. where processing is necessary for the performance of a contract to which the data subject is a party (in connection with participation in the program);

• on the basis of Article 6(1)(f) of the GDPR, i.e. where processing is necessary for the purposes of the legitimate interests pursued by the Controller, namely for the purpose of defence against potential claims;

• on the basis of Article 6(1)(c) of the GDPR, where processing is necessary for the fulfilment of the Controller's obligations arising from tax law and accounting legislation.

PERSONAL DATA RETENTION

Your personal data will be processed for the period necessary to achieve the purpose for which they were collected, i.e. to determine your entitlement to a reward (referral bonus) in connection with your participation in the Referral Program, whereby:

• no longer than 10 years from the end of the calendar year in which the reward was granted, in the context of the Controller's tax and accounting obligations;

• in the event that the reward was not granted, no longer than 6 years, i.e. in the context of the limitation period for potential claims;

• in the event that the person referred by you to participate in the program does not confirm their wish to take part in the recruitment process, your data will be deleted immediately upon receipt of such information, no later than within 3 months.

PERSONAL DATA SHARING AND TRANSFERS

Your personal data may be disclosed to entities and authorities authorised to process such data under applicable law, including public offices and authorities. Your personal data may also be transferred to other entities, including entities affiliated with the Controller, i.e. entities belonging to the Nord Security group, whereby such entities process data on the basis of an agreement with the Controller and solely in accordance with its instructions, or are independent controllers of your data.

Your personal data may be transferred to third countries, due to, among other things, data flows within the Nord Security group or data hosting, subject to the legally required safeguards.

YOUR RIGHTS IN CONNECTION WITH PERSONAL DATA

In accordance with the GDPR, you have the right to access your data and receive a copy thereof, the right to rectify (correct) your data, the right to erasure of data, the right to restriction of processing, the right to object to the processing of data, the right to data portability, and the right to lodge a complaint by contacting us directly or, if all else fails, to lodge a complaint with a supervisory authority in your country.

Furthermore, to the extent that the processing of your personal data is based on consent, you have the right to withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to its withdrawal.

At any time, you have the right to object to the processing of your personal data (where provided for by applicable law). In such a case, the Controller will cease processing your data for the aforementioned purposes, unless it is able to demonstrate that there are compelling legitimate grounds for the processing which override your interests, rights and freedoms, or that the data are necessary for the establishment, exercise or defence of legal claims.

The provision of personal data is voluntary; however, it is necessary in order to participate in the Program and to receive any potential reward.