2.2 LAWFUL PROCESSING Without prejudice to the principles set out in Section 5 and conditions set out in Sections 7 and 8 of this Regulation, Processing shall be lawful if at least one of the following applies: a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; b) processing is necessary for the performance of a contract to which the Data Subject is party or in order to take steps at the request of the Data Subject prior to entering into a contract; c) processing is necessary for compliance with a legal obligation to which the Controller is subject; d) processing is necessary in order to protect the vital interests of the data subject or of another natural person and e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official public mandate vested in the controller; 2.3 PROCURING CONSENT i. No data shall be obtained except the specific purpose of collection is made know to the Data Subject; ii. Data Controller is under obligation to ensure that consent of a Data Subject has been obtained without fraud, coercion or undue influence; accordingly: a) where processing is based on consent, the Controller shall be able to demonstrate that the Data Subject has consented to processing of his or her personal data and the legal capacity to give consent; b) if the Data Subject's consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding on the data subject; c) prior to giving consent, the Data Subject shall be informed of his right and the ease to withdraw his consent at any time. However, the 8