Northern Data Group acknowledges the importance of addressing climate change and seeks to maximize the use of low-carbon and renewable energy in its operations where possible. The Group does not currently have a formal transition plan in place, as it does not consider its business to be at risk of chronic extreme weather events in the short or medium term. As the Group continues to grow and evolve, it will evaluate the appropriate timing and scope for developing a climate transition plan. This plan will be embedded in the overall corporate strategy and approved by governance bodies.

Power Usage Effectiveness (PUE) measures how efficiently data centers use electricity to generate computing power. It is the ratio of total energy consumption to the energy used by computing equipment, with an ideal PUE of 1.0. Facility energy consumption includes non-computing elements such as cooling and lighting. In 2025, Northern Data Group reported a PUE of 1.15 (previous year: 1.12) for its Swedish data center, which is classified as very efficient (values below 1.2). Colocation partners guarantee PUE levels of 1.2 or lower.

Total energy consumption for the Group’s data center operations, including contracted third-party data centers, amounted to 1,036 GWh in 2025 (previous year: 906 GWh).

Gross Scopes 1, 2, and 3 Emissions
Northern Data Group acknowledges the need to calculate and disclose greenhouse gas (GHG) emissions across Scopes 1, 2, and, where possible, Scope 3. The Group is currently evaluating whether to report emissions in line with the simplified CSRD proposal published by the European Commission on 26 February 2025. To support this, Northern Data Group is considering engaging a third party to calculate GHG emissions using recognized methodologies and standards. This will provide a foundation for future action, including setting reduction targets, implementing mitigation measures, and exploring offsetting opportunities while adhering to regulatory and quality standards.

Business Travel
Northern Data Group offsets 100% of CO₂ emissions from business travel booked through Perk. Most travel is arranged via Green Trip, Perk’s carbon-neutral business travel program. Green Trip partners with carbon calculation and offsetting providers, enabling the Group to compensate emissions directly through the platform. Offsetting is conducted on a per-trip basis. All offset projects are VERRA-certified, including forestry initiatives that combat deforestation in regions such as Papua New Guinea and Peru.

Northern Data Group manages large volumes of hardware and evaluates whether discarded equipment can be remarketed, refurbished, recycled, or disposed of. The hardware lifecycle program aims to extend the life of assets beyond their first lifecycle wherever possible. In 2025, most discarded hardware (including servers, miners, cables, and other equipment) was sold to resellers, Bitcoin mining businesses, and educational institutions.

The recycling and disposal of electronic waste is carried out in accordance with local and European laws and regulations. In 2025, no significant amounts of hardware were disposed of.

Northern Data Group collects and manages employee data, using a human capital platform that serves as a centralized hub for storing and organizing employee information. In 2025, workforce changes were largely driven by the divestment of Peak Mining, which accounted for many employee exits. The recruitment function continued to support ongoing operations, maintaining a mostly permanent, full-time workforce. The workforce remains internationally diverse, predominantly based in Europe, with a higher proportion of male employees.

Northern Data Group invests in world-class office spaces and organizes regular social events, end-of-year celebrations, and regional programs tailored to each location. In 2025, Northern Data Group maintained a monthly Wellbeing Calendar.

Northern Data Group encourages every employee to fully develop their personal and professional ambitions. To support this, the Group offers competitive salaries, flexible working hours, and professional development opportunities as part of its reward and recognition strategy. Exceptional performance is rewarded through a performance framework, with quarterly reviews that feed into the appraisal process to track progress and determine future goals. A performance-based bonus is part of the employee remuneration and is calculated annually. In 2025, Northern Data Group implemented a fully automated performance management process, requiring goal setting, quarterly check-ins, and end-of-year reviews with self-reflections and manager feedback. A standardized calibration process ensured fairness, and results were used to guide development discussions and determine performance-based bonuses.

Northern Data Group actively seeks out different perspectives, increased diversity in decision making, and creates a healthy, supportive, and inclusive work environment where all employees have the opportunity to reach their full potential, feel valued, and be their authentic selves. The Group has zero tolerance for any type of discrimination on the basis of ethnicity, gender, religion or conviction, disability, age, or sexual identity, or any other characteristics. Northern Data Group expects all employees to be aware when behavior is unwanted and unwelcome – internally and externally. Employees are encouraged to report any incidents directly to the People Team or through any other established mechanisms, such as the Whistleblowing line. The People Team is committed to promptly and thoroughly investigate any complaints and take appropriate follow-up action. In addition, there are regular events and initiatives designed to foster a sense of fairness, equality, and inclusion for all. In 2025, Northern Data Group promoted diversity and inclusion through initiatives tied to key international observances such as International Women’s Day, Pride Month, and World Mental Health Day, alongside workshops on mental health, nutrition, and wellbeing.

The Group provides benefits, including pension plans, death-in-service cover, accident insurance, wellbeing programs, and private medical cover. Northern Data Group also has a complimentary and confidential Employee Assistance Program available 24/7 to all employees. In 2025, key updates included a new UK pension provider and a new salary sacrifice pension scheme, improving tax efficiency for employees.

The professional and personal development of employees is very important to Northern Data Group. The Group has in place a program of continuous reviews and target-setting cycles as well as a training budget available to each employee. In addition, Northern Data Group offers self-study training courses in a wide range of business and professional topics through an e-learning platform. Employee development remained a strategic priority in 2025, and is fully integrated in the Group's performance management framework. Dedicated training sessions for managers and new hires ensured consistent application of development plans. In 2025, the Group introduced a new learning platform, providing access to structured learning pathways. These initiatives reflect the Group’s continued investment in targeted and self-directed learning.

Health, Safety, and Environmental (HSE) management at Northern Data Group focuses on protecting our people, our assets, and the environment through well-defined processes, clear responsibilities, and continuous improvement. The rules of conduct for a safe workplace and healthy employee interaction are documented in Northern Data Group’s Code of Ethics and Conduct. In addition, Northern Data Group has in place a HSE Program that covers key elements of a comprehensive safety plan, including topics such as accident and damage reporting, orderliness and cleanliness, organization of first aid, risk audits, instructions, training and drills, and contractor qualifications. All incidents at data centers or offices need to be reported to the Health, Safety & Environment Service Desk, which is available to all employees on the intranet. In addition to the HSE Program, there are Occupational Health and Safety policies for each location that are aligned with applicable local regulations. In 2025, Northern Data Group further strengthened its HSE governance by appointing a dedicated HSE Manager.

Northern Data Group has an ongoing program of employee engagement and communication through town halls, newsletters, and other local events with the participation of the Executive Leadership. The Group aims to keep employees updated on its strategic progress, financial results, and other key areas of strategic focus for the business. The Chief People Officer, supported by a dedicated Human Resources team, is responsible for the development and application of all relevant policies and activities across the Group. Building on the insights from the 2024 employee engagement survey, during 2025 Northern Data Group focused on strengthening its engagement and level of communication with employees. The 2025 employee survey achieved a strong engagement score of 77 percent (2024: 78 percent), reflecting the Group’s continued commitment to employee wellbeing and a people-centered workplace culture. Survey results highlighted positive perceptions of fairness, inclusion, and open communication. Employees reported feeling supported in maintaining a healthy work-life balance, and working in an environment where equality and wellbeing are prioritized. At the same time, the survey identified areas for further development, including the need for greater transparency, further alignment with the reward and recognition framework and stronger cross-team collaboration. The results of the survey were shared with employees and leadership, and informed a program of targeted initiatives. A key milestone in 2025 was the introduction of the Group’s first Cross-Team Days, designed to enhance collaboration, communication, and mutual understanding. The program combined external communication training, interactive workshops, and personality awareness based on the DISC model, with almost 50 employees participating.

Northern Data Group’s approach to respecting and complying with human rights is set out in its Human Rights Policy. The policy is based on the international human rights principles contained in the Universal Declaration of Human Rights, the International Labor Organization (ILO) Declaration, the Fundamental Principles and Rights at Work, the United Nations Global Compact, and the United Nations Guiding Principles on Business and Human Rights. It applies throughout the Group and covers the topics of anti-discrimination, freedom of association and collective bargaining, a safe and healthy workplace, forced labor, human trafficking, child labor, and working hours.

Northern Data Group is committed to upholding the highest standards of ethical conduct, environmental sustainability, and social responsibility across its global operations. As a leader in cloud services and data center solutions, the Group recognizes the critical role its suppliers play in achieving these objectives. The Supplier Code of Conduct outlines the expectations the Group has for its suppliers, vendors, contractors, and other partners. It reflects the Group’s dedication to ensuring that its supply chain operates in alignment with the following values: respect for human rights, protection of the environment, and commitment to fair and transparent business practices. The Group's Supplier Code of Conduct mandates that suppliers respect human and labor rights, maintain a safe and healthy work environment free from discrimination, and treat all workers with dignity and respect. In instances of human rights violations, Northern Data Group expects suppliers to provide access to remedy. The Global Procurement Team is responsible for ensuring that all suppliers are aware of the Group's Supplier Code of Conduct.

Northern Data Group’s Business Code of Conduct & Ethics applies to all employees and sets out the fundamental principles that guide daily decision-making and behavior across the organization.

Topics include:
• health, safety, and environmental responsibility
• equality and anti-discrimination
• anti-bribery and anti-corruption
• conflicts of interest
• confidentiality of information
• intellectual property
• competition and anti-trust
• risk management
• anti-money laundering
• insider trading

The Business Code of Conduct & Ethics is accessible to employees via the Group's intranet. To foster under-standing and compliance, all employees complete mandatory training and formally confirm their agreement and adherence. Ethical values are actively embedded into the corporate culture and their effectiveness is regularly reviewed through employee feedback and management assessments. Confidential mechanisms are in place for employees to identify, report, and raise concerns regarding potential violations or unlawful behavior. These include whistleblowing procedures and strong non-retaliation protections to support integrity and transparency throughout the organization.

Northern Data Group is committed to the highest standards of integrity, ethical conduct, and compliance.

The Group's Anti-Bribery and Anti-Corruption Policy reinforces zero-tolerance approach toward bribery, corruption, fraud, unethical influence, and improper business advantages. It establishes binding requirements for all employees, executives, and third parties acting on Northern Data Group's behalf.

Employees are expected to avoid situations that could create, or appear to create, a conflict between personal interests and the Group's interests. The Anti-Bribery and Anti-Corruption policy therefore covers all business interactions including gifts, entertainment and hospitality, participation in and organization of events, sponsorships, and donations.

In addition, the policy covers integrity in political contributions and government engagement. Northern Data Group does not contribute to political parties, organizations, candidates, or individuals involved in political activities without explicit approval from the Management Board and the Supervisory Board.

The policy sets strict requirements for the engagement and oversight of third parties, including risk-based due diligence, ongoing monitoring, and adherence to ethical, legal, and anti-corruption standards. It also governs the approval and reimbursement of third-party travel and related expenses to ensure transparency, proportionality, and a legitimate business purpose.

Employees complete mandatory anti-bribery and anti-corruption training, including role-specific and refresher sessions.

All employees are obligated to promptly report any risks or incidents – whether within or outside the Group – that could potentially harm individuals or entities. In addition, all suppliers, contractors, customers, and external stake-holders are encouraged to report any suspected violations either to their designated Northern Data contact or through the Whistleblowing channel. Violations are investigated, and internal disciplinary measures may include termination of the employment contract. Violations by third parties may also lead to the termination of contracts.

Northern Data provides a secure and confidential Whistleblowing System that enables both employees and third parties to report any concerns. The system allows for anonymous submissions, ensuring that individuals can raise concerns about compliance, policy breaches, or other risks without fear. Reports can be made anonymously via the Whistleblowing System or, if preferred, non-anonymously by emailing compliance@northerndata.de. The Whistleblowing System is operated by an independent third party and is accessible globally.

Northern Data ensures that all reports submitted through the Whistleblowing System are handled with the utmost confidentiality. Clear procedures are in place for the receipt, assessment, investigation, and resolution of reported concerns. All reports are reviewed promptly and investigated in a fair, objective, and proportionate manner, with appropriate remedial actions taken where necessary. Furthermore, it is guaranteed that no retaliation will be taken against anyone who reports concerns in good faith, reinforcing our commitment to maintaining a culture of integrity, transparency, and trust throughout the organization.

Employees receive training and guidance on the use of the Whistleblowing System and on their right and obligation to raise concerns. The Chief Legal Officer is responsible for all compliance matters supported by the Head of Risk and Compliance and a dedicated Legal team.

The Group maintains an annual Compliance Training program to ensure employees are aware of and adhere to the Group’s ethical, legal, and regulatory obligations. Core training covers key topics such as information security, data protection, occupational health and safety, and insider trading. The program is reviewed and updated annually to reflect evolving regulatory requirements and emerging risks. In addition to mandatory annual training for all employees, targeted training is provided for specific roles and responsibilities. New joiners are also required to complete a specific induction training to ensure understanding of the Group’s compliance expectations.

In 2025, 88 percent of employees completed the training (2024: 89 percent). The Group is targeting a 95 percent completion rate in 2026.

Information security governance is integrated into the Group's overall corporate governance and enterprise risk management framework. Northern Data Group is ISO/IEC 27001 certified and committed to maintaining the highest standards of information security. The Supervisory Board maintains ultimate oversight of cyber and information security risks and receives regular updates on risk exposure and mitigation measures.

Operational oversight is the responsibility of the Information Security Steering Committee, led by the Chief Legal Officer. This cross-functional committee coordinates security strategy, policy implementation, risk management, incident readiness, and awareness programs. Governance activities are supported by internal experts and, where appropriate, external advisors ensure informed and effective decision-making.

Northern Data Group is committed to maintaining the confidentiality, integrity, and availability of all information assets.

Aligned with ISO/IEC 27001, the Group's Information Security Management System (ISMS) covers critical functions including High-Performance Computing, data centers, IT systems, and third-party relationships. Security governance is ensured through the Information Security Steering Committee, regular internal and external audits, and ongoing employee training. The Group emphasizes continuous improvement, proactive risk management, and transparency to address emerging threats and deliver secure, resilient, and trustworthy services.

Northern Data's full Cybersecurity statement is available in the ESG section on the Group's corporate website.

Northern Data Group continued to strengthen its cyber-security posture through targeted improvement initiatives and control enhancements. These actions include increased automation of key security processes and the further development of core controls such as threat modeling, system hardening, and incident detection and response. The Group carried on embedding cybersecurity processes across the business through a security transformation plan. The plan seeks to support the Group's cybersecurity practices as its operations expands and grow.

The Group carried on embedding cybersecurity processes across the business through a security transformation plan. The plan seeks to support the Group's cybersecurity practices as its operations expands and grow.

In 2025, Northern Data Group conducted an internal audit of its ISMS and IT infrastructure to assess alignment with internal policies, control standards, and ISO/IEC 27001 requirements. The audit covered key controls, risk management practices, and operational security procedures. The results of the audit were reported to the Executive Leadership. The outcome of the audit informed the Group's security transformation plan.

In line with ISO/IEC 27001 requirements, the Group conducts an annual external audit of its ISMS and relevant IT infrastructure. This audit is performed by accredited third-party assessors and is designed to evaluate the effectiveness of implemented security controls, governance practices, and risk management processes. The results of the 2025 audit were reviewed by the Management Board and used to guide remediation and continuous improvement activities. The annual external audit demonstrates the Group’s commitment to maintaining a robust and resilient information security framework.

The Group has established a mandatory annual compliance training program on ISMS and information security. This program ensures that employees understand their roles and responsibilities in protecting information assets, as well as comply with internal policies and regulatory requirements. In addition, the Group reinforced information security awareness through a Cybersecurity Awareness Month.

The Group is committed to robust risk management. For this purpose, Northern Data Group has established clear targets to strengthen its information security framework. These include conducting one internal audit and one external audit annually. The primary goal of these audits is to identify, mitigate, and address information security risks and non-conformities while also incorporating improvement measures identified during the audit process. In addition, the Group conducts regular security maturity assessments. The objective of these assessments is to guide continuous improvement planning and the definition of annual security objectives.