NOVARIC^® Social Media Policy

This Policy sets out the standards that apply to:

• the personal social media activity of employees and authorised representatives where that activity intersects with their employment or relationship with NOVARIC^®; and
• access to and operation of official NOVARIC^® social media accounts.

The Policy is designed to protect individuals, clients, candidates, business partners and the public, to preserve the integrity and reputation of NOVARIC^®, and to ensure that social media activity is conducted in a lawful, ethical and professionally responsible manner.

This Policy applies to:

• all employees of NOVARIC^® Sh.A. and associated entities;
• officers and directors;
• contractors, consultants and agency workers engaged by NOVARIC^®;
• temporary personnel and interns; and
• other authorised representatives acting on behalf of NOVARIC^® in any capacity.

It applies to personal and official social media activity that intersects with the individual’s employment relationship or representation of NOVARIC^®, regardless of the platform, device, account type or time of day.

It does not regulate purely private social media activity that has no connection whatsoever to employment or to NOVARIC^®.

Social media use in connection with NOVARIC^® is guided by the following principles:

• Accountability. Individuals are responsible for the content they publish, share or endorse. The informal nature of social media does not reduce this responsibility.
• Transparency. Where relevant, clearly distinguish between personal views and official positions. Do not post anonymously on behalf of NOVARIC^® or use misleading identities.
• Respect. Treat all persons with dignity and fairness, consistent with the NOVARIC^® Code of Ethics.
• Confidentiality. Do not disclose information that is not authorised for public communication.
• Legality. Comply with all applicable laws, including those relating to data protection, defamation, copyright and employment rights.
• Brand integrity. Uphold the professional image and values of NOVARIC^® in all public-facing activity.

Employees are permitted to maintain and use personal social media accounts in their own time. The following requirements apply when personal social media activity intersects with the employee’s relationship with NOVARIC^®:

• Do not disclose confidential information relating to the Company, its clients, candidates or employees.
• Do not make statements that are — or could reasonably be perceived as — harmful to the Company’s reputation.
• Do not post discriminatory, harassing, offensive or unlawful content, whether or not it references the Company.
• Do not identify yourself as speaking on behalf of NOVARIC^® in a personal capacity without explicit written authorisation.

Where personal social media use occurs during working hours or on Company systems, it must not interfere with work responsibilities or the Company’s IT security controls.

The following categories of information must not be published, shared or referenced on any social media platform without written authorisation:

• client, candidate or employee information, including names, contact details or any identifying particulars;
• recruitment records, assessments, application materials or selection decisions;
• personal data of any individual, including data held in connection with employment or service delivery;
• internal communications, memoranda, decisions or correspondence;
• contracts, commercial terms, pricing or proprietary business arrangements;
• credentials, access tokens, passwords or security-related information;
• unpublished financial data, forecasts, strategies or business plans;
• photographs, recordings or screenshots taken in non-public workplaces, client environments or internal systems, unless explicitly authorised;
• any document, file or communication bearing an Internal, Confidential or Restricted classification marking.

All social media activity involving personal data must comply with the NOVARIC^® Data Protection & Privacy policy and applicable data-protection legislation, including the GDPR where applicable.

Confidentiality obligations survive termination of employment or engagement.

All social media activity connected with NOVARIC^® must be conducted in a respectful and lawful manner. The following conduct is prohibited:

• posting content that is discriminatory, harassing, threatening, offensive or demeaning, whether or not it explicitly references NOVARIC^®;
• defaming, misrepresenting or making false statements about any individual, organisation or the Company;
• bullying, targeted harassment or coordinated abuse;
• inciting violence, hate speech or unlawful activity;
• reproducing, sharing or endorsing misinformation in a manner that could reflect on NOVARIC^®.

Conduct that would constitute a disciplinary matter if it occurred in the workplace may equally be treated as such when it occurs on social media where it is connected to employment.

Employees may accurately state their employment or role at NOVARIC^® on personal social media profiles. Where such a reference could create confusion about whether a post represents the Company’s position, a clear disclaimer is recommended, for example:

The inclusion of a disclaimer does not excuse any breach of this Policy, including confidentiality obligations, harassment, discrimination, unlawful conduct or unauthorised disclosure. A disclaimer cannot retrospectively authorise content that contravenes the Policy or applicable law.

Official NOVARIC^® social media accounts are managed exclusively by authorised members of the Communications Division. No employee may create, operate or post to official Company social media channels without express written authorisation from the Communications Director.

The following requirements apply to all official NOVARIC^® social media accounts:

• Only expressly authorised Communications Division personnel may create or operate official accounts. Authorisation must be written and attributable.
• Account credentials must use approved Company-controlled systems. Credentials must not be communicated through informal, unencrypted or personal channels.
• All published content must comply with applicable brand standards, the Brand Guidelines, and NOVARIC^® communications policies before publication.
• Posts that are high-risk in nature, including those touching on crisis situations, litigation, regulatory matters, political or public-authority subjects, or material brand-sensitive topics, require the applicable human approval process before publication.
• AI-assisted or AI-generated content remains subject to human review, brand standards and the accountability requirements in this Policy before it is published on official channels.
• Account ownership, recovery details, content archives and intellectual property produced for official accounts belong to NOVARIC^®.

The following security controls apply to all official NOVARIC^® social media accounts:

• Multifactor authentication must be enabled on all official accounts where the platform supports it.
• Passwords and access credentials must not be shared through personal messaging applications, personal email or other informal channels. Company-approved credential management procedures apply.
• Access rights must be reviewed when an individual’s responsibilities change, when a project or campaign concludes, or at intervals specified by the Communications Director.
• Personnel who leave the organisation or transfer roles must immediately surrender all access to official accounts. The Communications Director is responsible for ensuring this occurs without delay.
• Account recovery details, backup codes and associated email addresses must be Company-controlled at all times.

Personnel must report any of the following without delay to the Communications Director and the IT/Security function:

• any suspected or confirmed compromise of an official account;
• accidental disclosure of confidential information on social media;
• impersonation of NOVARIC^® or any of its personnel on social media;
• fraudulent or unauthorised NOVARIC^® profiles;
• unauthorised posts published on official channels;
• coordinated harassment or threats targeting official accounts;
• loss of Company-controlled credentials or recovery access.

The following must not be used on personal social media accounts or in any unauthorised context without explicit written authorisation from the Communications Director:

• NOVARIC^® logos, wordmarks, design marks or registered trademarks;
• official templates, campaign materials or branded assets;
• copyrighted images, graphics or media produced for or by NOVARIC^®;
• client or partner branding, logos or proprietary materials; or
• third-party materials that NOVARIC^® does not hold a licence to sub-licence.

For guidance on approved logo usage, colour standards and brand identity, refer to the NOVARIC^® Brand Guidelines.

Employees must not respond publicly on social media, on behalf of NOVARIC^®, to enquiries from journalists, broadcasters, public authorities, regulatory bodies or crisis situations unless they have been specifically and expressly authorised to do so by the Communications Director.

Enquiries of this nature received through personal social media channels must be referred promptly to the Communications Director. Do not acknowledge or engage with an enquiry in a manner that could be construed as a Company response before authorisation is received.

In a crisis situation, employees must not speculate, comment or post any content related to the incident until official guidance has been issued by the Communications Director or other authorised function.

Any employee who becomes aware of a suspected breach of this Policy, including by a colleague, third party or contractor, should report it promptly using one of the following channels:

• the Communications Director;
• the Human Resources Division;
• the Complaints Procedure; or
• the Misconduct Reporting Procedure (opens on novaric.co), including any confidential reporting channels provided under that Procedure.

Reports will be assessed promptly, treated with appropriate confidentiality, and managed in accordance with applicable procedures.

This Policy must not be applied in a manner that characterises fair criticism, good-faith complaints or legally protected disclosures as reputational harm to NOVARIC^® merely because the content is unfavourable or uncomfortable to the Company.

Employees are encouraged to raise concerns through internal channels in the first instance. However, the right to approach external bodies, regulators or legal advisers is fully preserved under applicable law.

NOVARIC^® prohibits retaliation against any person who:

• raises a genuine concern relating to social media conduct or any other matter in good faith;
• makes a protected disclosure in accordance with applicable law;
• reports suspected misconduct through an authorised channel; or
• participates in an authorised investigation.

Any person who engages in retaliation will be subject to appropriate action under the applicable disciplinary procedures.

Suspected breaches of this Policy will be assessed fairly, with appropriate confidentiality where practicable, and in a manner proportionate to the circumstances. The response will follow applicable law, contractual obligations and internal procedures.

Depending on the nature and severity of a breach, the response may include one or more of the following, applied proportionately:

• preservation of relevant evidence;
• restriction or removal of access to official accounts;
• request for correction or removal of unauthorised or non-compliant content;
• investigation in accordance with the applicable employment or governance procedure;
• proportionate corrective or disciplinary action; and
• referral to competent authorities where legally required.

Any monitoring of social media activity will be conducted only where it is lawful, necessary, proportionate and transparently documented in accordance with applicable law and Company policy. NOVARIC^® does not conduct continuous surveillance of employees’ private accounts.

This Policy should be read alongside the following documents. Governance documents relevant to this subject.

This Policy will be reviewed at intervals not exceeding 12 months from the effective date, or sooner if required by changes in applicable law, technology, organisational structure or risk profile. Revisions are subject to the approval workflow set out in the NOVARIC® document-control procedures.

Document code: DOC-COM-003. Effective: 7 September 2026. Next review: 7 September 2027.

Questions about the application or interpretation of this Policy should be directed to:

• the Communications Director — for questions relating to official accounts, authorisations and external communications;
• the Human Resources Division — for employment-related questions; and
• the Governance team — for document-control, policy-compliance or legal questions.

General governance enquiries may also be submitted via the NOVARIC® contact page.