Visitor Agreement

Effective: 21 July 2026

This Workplace Visitor Agreement (“Agreement”) is made between NALITS Ltd (“Company”) and the visitor identified below (“Visitor”; “I”, “Me”), effective as of the date signed by the Visitor and governs my visit to any location, office, or venue (whether owned, leased, or temporarily hired) where the Company is conducting business or hosting an event (“Company Premises”). To the extent a NALITS Ltd subsidiary or affiliate, including a landlord, is the owner, operator, or otherwise responsible for the Company Premises, that entity is a third-party beneficiary of this Agreement, and references to “Company” herein include both NALITS Ltd and its subsidiaries and affiliates. To the extent I or my employer is a party to any other agreements with Company that conflict with this Agreement, the terms of the other agreement(s) shall control. I enter this Agreement in consideration of being permitted by Company to access the Company Premises and I agree to all the terms and conditions set forth here.

1. General Compliance

1. I agree to comply with all procedures, rules, standards, and instructions given by Company (“Company Policies”) with respect to my access to the Company Premises and any Company assets.
2. I agree to remain with my Company host at all times during my visit to the Company Premises and will remain in any area of the Company Premises designated for my visit.
3. I will wear and display in a visible way the visitor badge provided to me by Company at all times while on the Company Premises and will not give the visitor badge provided to me to any other individual.
4. I will follow all safety and security signs, postings, and verbal instructions during my visit to the Company Premises.
5. I will not photograph, videotape, or otherwise record any information (including Confidential Information) to which I may have access during my visit to the Company Premises without the prior written consent of the Company.
6. I will not remove any document, equipment, or other materials (including Confidential Information) from the Company Premises without the prior written consent of the Company.
7. I will not attempt to evade, breach, bypass, or otherwise circumvent Company security measures during my visit to the Company Premises.
8. I understand that if I fail to comply with this Agreement or any Company Policies, I may be escorted out of the Company Premises.
9. I understand that no weapons of any kind, or anything that would reasonably be perceived as a weapon, are allowed on the Company Premises. I agree not to bring any weapons to the Company Premises, including the Company parking lots, no matter if I have a permit for them or not.

2. Data Privacy

1. By signing this Agreement, I confirm that I have read and agreed to the Company Visitor Privacy Notice (attached to this Agreement as Annex 1 and set out below).
2. I agree that Company may collect and process my personal information in connection with my visit to the Company Premises as set forth in the Company Visitor Privacy Notice.
3. I understand that I may withdraw my consent at any time by following the instructions provided in the Company Visitor Privacy Notice.

3. Confidentiality

1. I understand that during my visit to the Company Premises, I may have access to non-public information disclosed by Company (i) relating to Company’s business, including, without limitation, product designs, product plans, software and technology, financial information, marketing plans, business opportunities, pricing information, discounts, inventions, and/or know-how (ii) designated as confidential, or (iii) that, given the nature of the information or circumstances surrounding its disclosure, reasonably should be understood to be confidential (“Confidential Information”). Confidential Information does not include information that (i) is or becomes a matter of public knowledge without breach of this Agreement; (ii) was rightfully disclosed to me by a third party without a restriction on disclosure who rightfully obtained the Confidential Information; or (iii) can be shown by documentary evidence to have been developed by me prior to receipt and without use of Confidential Information.
2. I agree that I will:
   1. hold Confidential Information in strict confidence and not divulge Confidential Information to any third party (other than to Company employees or contractors who have a legitimate “need to know” such Confidential Information);
   2. take reasonable precautions to protect Confidential Information; and
   3. not copy, photograph, video record, or reverse engineer any materials disclosed under this Agreement or remove any proprietary markings from Confidential Information.
3. Upon advance notice to Company, I may make disclosures of Confidential Information to the extent required by law, provided that I use diligent efforts to limit disclosure and obtain confidential protection and allow Company to participate in the proceeding.
4. Upon written request by Company, I will:
   1. stop using Confidential Information;
   2. return to Company or destroy all Confidential Information and all copies, notes or extracts thereof within seven (7) business days of receipt of request; and
   3. confirm in writing that I have complied with these obligations.
5. I agree not to export or re-export any Confidential Information or any direct product thereof, except in compliance with all applicable U.S. and foreign laws and regulations.
6. I understand that all Confidential Information is provided “as is” and with all faults and I do not acquire any intellectual property rights or any other rights under this Agreement except the limited right to review Confidential Information.
7. I understand that any breach of this confidentiality section may cause irreparable harm for which monetary damages are an insufficient remedy. Therefore, upon any breach of this section, Company shall be entitled to seek appropriate equitable relief without the posting of a bond in addition to whatever remedies it might have at law.
8. Notwithstanding any expiration or termination of this Agreement, my obligations with respect to Confidential Information under this Agreement expire five (5) years from the date of my receipt of Confidential Information (except that with respect to any trade secrets the obligations shall be perpetual).

Release of Liability and Assumption of Risk

I AM AWARE AND UNDERSTAND THAT ACCESSING THE COMPANY PREMISES AND ENGAGING IN THE ACTIVITY MAY INVOLVE THE RISK OF SERIOUS INJURY, ILLNESS, DISABILITY, DEATH, AND/OR PROPERTY DAMAGE. I ACKNOWLEDGE THAT ANY INJURIES THAT I SUSTAIN MAY RESULT FROM OR BE COMPOUNDED BY THE ACTIONS, OMISSIONS, OR NEGLIGENCE OF COMPANY, INCLUDING NEGLIGENT EMERGENCY RESPONSE OR RESCUE OPERATIONS OF THE OWNER. NOTWITHSTANDING THE RISK, I ACKNOWLEDGE THAT I AM VOLUNTARILY ACCESSING THE COMPANY PREMISES AND ENGAGING IN THE ACTIVITY WITH KNOWLEDGE OF THE DANGER INVOLVED AND HEREBY AGREE TO ACCEPT AND ASSUME ANY AND ALL RISKS OF INJURY, ILLNESS, DISABILITY, DEATH, AND/OR PROPERTY DAMAGE ARISING THEREFROM, WHETHER CAUSED BY THE ORDINARY NEGLIGENCE OF THE OWNER OR ANY RELEASEE OR OTHERWISE.

Miscellaneous

In the event that any of the provisions of this Agreement shall be held illegal or unenforceable by a court of competent jurisdiction, such provisions shall be limited or eliminated to the minimum extent necessary so that this Agreement shall otherwise remain in full force and effect. This Agreement shall be governed by the laws of England and Wales. The exclusive jurisdiction and venue for any action arising out of or relating to the subject matter of this Agreement shall be in the courts of London, England, and both parties hereby submit to the personal jurisdiction of such courts.

Last Updated: 21 July 2026

This Company Visitor Privacy Notice (“Notice”) describes how NALITS Ltd and its affiliates and subsidiary operating under the Company brand (“Company”, “we”, “our” or “us”) collect, use, transfer, share, disclose, or otherwise process personal information about you in connection with your visit to the Company Premises.

1. Categories of Personal Information and Third Parties to Whom It Is Disclosed

Below we list the categories of personal information we collect. For each category of personal information we collect, the categories of third parties to whom we disclose personal information for business purposes is listed in parentheses. The extent to which our collection and processing of your personal information will involve the categories below, will depend on the nature of your visit to a Company office location.

• Identifiers: such as your full name, email address, picture, signature (Service Providers)
• Location information: such as the address of the Company office location you visit (Service Providers)
• Audio, electronic, visual or similar information: such as CCTV images (where permitted by law) and physical access records related to our physical premises (Service Providers)
• Professional-related data: such as the name of your employer, your job title (Service Providers)
• Other information: information you voluntarily provide to us during your visit to a Company location (Service Providers)

2. Purposes and Legal Bases for Our Processing of Your Personal Information

In this section, we describe the purposes for which we collect and process your personal information and the legal basis for such processing pursuant to the EU General Data Protection Regulation (“GDPR”), the UK Data Protection Act, and other similar data protection laws.

Legal bases for collecting and processing personal information under certain privacy laws
We process your personal information generally pursuant to the following legal bases:

• Contract: the processing is necessary for the performance of a contract to which you are a party, or to take steps to enter into a contract with you;
• Legal Obligation: the processing is necessary to comply with a legal obligation to which we are subject;
• Legitimate Interest: the processing is in furtherance of our legitimate business interests balanced against your rights (where our interests are not overridden by your interests, fundamental rights or freedoms);
• Consent: we have obtained your consent in accordance with applicable legal requirements, for example if you are in the EEA or the UK, your consent must be informed, specific, and freely given. Where we rely on consent to process your personal information, you may withdraw that consent at any time by contacting us as described in Section 5;
• Other Legal Bases: Where permitted by applicable law, we may process your personal information to protect vital interests, or to exercise, establish or defend legal rights and claims.

Purposes for which we may process your personal information
We process your personal information in connection with your visit to a Company location to:

• Communicate with you about your visit;
• Secure, monitor, and protect our corporate assets, such as our networks, systems, devices, and physical premises;
• Comply with legal and regulatory obligations to which we are subject; and
• Cooperate with law enforcement or regulators, where required.

3. Sources of Your Personal Information

Generally, we collect personal information directly from you, such as personal or business contact information. As applicable, we may also collect personal information from your employer or other third parties.

4. Information for California Residents

The California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (“CCPA”), effective as of January 1, 2023, requires businesses that collect personal information of California residents to make certain disclosures regarding how they collect, use, retain and disclose such information. This section facilitates those requirements.

The personal information we collect is described in Section 1. The purposes for which we collect the personal information are described in Section 2.2. The sources from which we collect that information are described in Section 3. We retain personal information as described in Section 6.

Company does not sell or share personal information collected pursuant to this Notice, as we understand the terms sale and share to be defined by the CCPA and its implementing regulations. The company does not have actual knowledge that it sells or shares the personal information of consumers under 16 years of age. Company does not collect, use, or disclose sensitive personal information in connection with your visit to a Company location for purposes other than those permitted under the CCPA.

California law gives California residents the right to make certain requests with regard to their personal information. Please see Section 5 for a description of those rights and how you may make a request.

5. Your Privacy Rights

Subject to applicable law, you may have privacy rights regarding your personal information, including the right to:

• Request a copy of your personal information or for us to correct, update, or delete your personal information.
• Request that we disclose what personal information we collect, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, and the categories of third parties to whom we disclose personal information.
• Object to the processing of your personal information, ask us to restrict processing of your personal information, or request portability of your personal information.
• Withdraw your consent at any time for personal information processed with your consent. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.
• Submit a complaint to the applicable data protection authority about our collection and use of your personal information.

Californians also have the right to opt out of the sale of personal information or the sharing of personal information for cross-context behavioral advertising. They also have the right to limit the use or disclosure of sensitive personal information for purposes other than those permitted by the CCPA. As described above, we do not sell your personal information, or use or disclose sensitive personal information for purposes other than those permitted by the CCPA.

You can submit a request by contacting us by e-mail to [email protected].

The company will verify that the information you submit (which may include verification that your first name, last name, email address, company, and country/state) matches our records before we fulfill the request. You may use an authorized agent to submit a consumer rights request on your behalf using the methods above, however, the Company will require the authorized agent to provide signed permission to submit the request on your behalf and may still contact you to confirm your identity and that this request was submitted with your permission.

The company does not discriminate against you for exercising your rights or offer you financial incentives related to the use of your personal information.

6. How Long Do We Keep Your Personal Information?

Our general approach is to not keep personal information for longer than is necessary for the purposes it was collected. In general, we will keep your personal information for the duration of your visit and for a reasonable period afterwards, unless required or permitted otherwise by law. In certain cases, legal or regulatory obligations require us to retain specific records for a set period of time. In other cases, we deliberately retain records in order to resolve queries or disputes which we think may arise from time to time.

7. How Do We Secure Your Personal Information?

We take all reasonable and appropriate steps to protect your personal information in an effort to prevent loss, misuse, and unauthorized access, disclosure, alteration and destruction. We use appropriate technical and organizational measures to protect your personal information which may include: physical access controls, encryption, internet firewalls, intrusion detection and network monitoring depending on the nature of the information and the scope of processing. Our staff who may have access to your personal information are required to keep that information confidential.

8. Transfers of Personal Information

Our primary operations are within the United Kingdom, but we have operations around the globe. Therefore, your personal information may be processed outside of the country where the Company Premises that you are visiting is located, including the United Kingdom and other countries where members of our group are located. Where the recipients of your personal information are located in a jurisdiction that does not provide data protection equivalent to what is required in the jurisdiction where the office you are visiting is located, we will take steps to ensure that the transfer is lawful and that there are appropriate security arrangements, as may be required under applicable laws, to provide adequate safeguards for your personal information. For example, the Company has executed inter-company standard contractual clauses among its affiliates to govern international transfers of personal information from the EEA, the United Kingdom and/or Switzerland to countries not deemed to provide an adequate level of data protection. If you want more details about these safeguards, please email us at [email protected] or Company’s Data Protection Officer (DPO) at [email protected].

9. Changes to This Notice

We may change this Notice from time to time. If we make changes to this Notice, we will provide you with notice of the changes to the email address provided or by presenting you the then current version of this Agreement at the time of your visit. Any changes to this Notice will be effective from the date you are notified of them, except as otherwise required by law (such as when we are required by law to obtain your consent to such changes).

10. How to Contact Us

If you have any questions about this Notice or other privacy-related topics, please contact us at [email protected] or NALITS Ltd, 1 Finch Lane, Bushey, WD23 3AH (Registered Office).

If you are in the EEA, United Kingdom, or Switzerland, you may contact Company’s Data Protection Officer (DPO) at [email protected] and where related to activities within the EU, Company’s representative to the EU at [email protected].

If you have any questions or complaint relating to this Notice or our data privacy practices, please contact Company’s Grievance Officer at [email protected] or NALITS Ltd, 1 Finch Lane, Bushey, WD23 3AH (Registered Office).