Article 24 Without prejudice to this Law, the Regulations shall set out additional controls and procedures for the Processing of Credit Data in a manner that ensures the privacy of the Data Subject and protects their rights under this Law and the Credit Information Law. Such controls and procedures shall include the following: 1- Implementing appropriate measures to verify that the Data Subject has given their explicit consent to the Collection of the Personal Data, changing the purpose of the Collection, or Disclosure or Publishing of the Personal Data in accordance with the provisions of this Law and the Credit Information Law. 2- Requiring that the Data Subject be notified when a request for Disclosure of their Credit Data is received from any entity. Article 25 With the exception of the awareness-raising materials sent by Public Entities, Controller may not use personal means of communication, including the post and email, of the Data Subject to send advertising or awareness-raising materials, unless: 1- Obtaining the prior consent of the targeted recipient for such materials. 2- The sender of the material shall provide a clear mechanism, as set out in the Regulations, that enables the targeted recipient to request stopping receiving such materials if they desire so. 3- The Regulations shall set out the provisions concerning the aforementioned advertising and awareness-raising materials, as well as the conditions and situations concerning the consent of the recipient to receive aforementioned materials. Article 26 With the exception of Sensitive Data, Personal Data may be processed for marketing purposes, if it is collected directly from the Data Subject and their consent is given in accordance with the provisions of Law; the Regulations shall set out the controls in such regard. Article 27 Personal data may be collected or processed for scientific, research, or statistical purposes without the consent of the Data Subject in the following situations: 1-If it does not specifically identify the Data Subject. 2-If evidence of the Data Subject’s identity will be destroyed during the Processing and prior to Disclosure of such data to any other entity, if it is not Sensitive Data.