APPENDIX 2 – LEGAL BASIS FOR PROCESSING