All information, including personal data, is managed in accordance with the Pavilion Energy group group's standards for Information and Records Management, and will be securely deleted once it is no longer necessary for legitimate business purpose or for legal/regulatory purposes.

• Some exceptions necessary to comply with local legal requirements are:

• information contained within employee files will be retained for a maximum of 10 years after the termination of employment;

• information regarding retirement benefits will be retained for a maximum of 99 years from the beginning of the employment relationship;

• any personal data collected as part of the evaluation process from publicly available or government-issued sanctions lists and media sources will be retained for a maximum of 15 years after it was first obtained;

• names, dates, times and access points of all individuals entering Pavilion Energy group facilities will be retained for 3 years from each access;

• in the event that an individual has been terminated or has their contract terminated due to serious misconduct, including violation of Shell’s Life-Saving Rules or Shell's Code of Conduct, such information will be retained for a maximum of 30 years after termination.

In all cases, the information may be retained for (a) a longer period of time when there is a legal or regulatory reason to do so (in which case it will be deleted after it has served its legal or regulatory purpose) or (b) a shorter period when you disapprove of the processing of your personal data and there is no longer a legitimate business purpose to retain it.