1

NON-DISCLOSURE AGREEMENT no 4.2-3/26/183-1

This Non-Disclosure Agreement (the “Agreement”) is entered into as of 10th of September 2026

(the “Effective Date”) by and between:

(1) Riigi Infosüsteemi Amet (Information System Authority), an Estonian government authority

(“RIA”); and

(2) SoftwareOne Estonia OÜ, registry number 16780431, with its registered office at Tartu mnt

82, Kesklinna linnaosa, 10112 Tallinn, Harju maakond (the “Consultant”).

RIA and the Consultant are each a “Party” and together the “Parties”.

BACKGROUND

The Parties wish to discuss and evaluate a potential engagement relating to the configuration,

management and automation of RIA’s Microsoft 365 environment, including management through

code and related technical approaches. In connection with those discussions, either Party may

disclose Confidential Information to the other Party.

The Parties therefore agree as follows:

1. Definitions

1.1 “Purpose” means evaluating, scoping and discussing a potential consultancy engagement

concerning the configuration, management and automation of RIA’s Microsoft 365 tenant and

related services, including the technical approach, required effort, implementation options,

security considerations and indicative pricing.

1.2 “Confidential Information” means any non-public information disclosed by or on behalf of a

Party (the “Disclosing Party”) to the other Party (the “Receiving Party”), whether before or

after the Effective Date and whether disclosed orally, visually, electronically, in writing or by

access to systems, which is identified as confidential or which, by its nature or the

circumstances of disclosure, should reasonably be understood to be confidential. Confidential

Information includes, in particular, technical architecture, configurations, identity and access

management arrangements, security controls, scripts, code, automation logic, system and

tenant settings, vulnerabilities, risks, internal procedures and documentation, business and

operational information, budgets, pricing, commercial terms and procurement-related

information.

1.3 “Representatives” means a Party’s Affiliates, and its and its Affiliates’employees, officers,

professional advisers, contractors and subcontractors who have a need to know the relevant

Confidential Information for the Purpose and who are bound by confidentiality obligations at

least as protective as those set out in this Agreement.

1.4 “Affiliate” means any entity that directly or indirectly controls, is controlled by, or is under

common control with a Party.

2. Use and protection of Confidential Information

2.1 The Receiving Party shall use Confidential Information solely for the Purpose and shall not

use it for any other commercial, competitive, technical or operational purpose without the

Disclosing Party’s prior written consent.

2

2.2 The Receiving Party shall keep Confidential Information confidential and protect it using at

least the same degree of care that it uses to protect its own information of a similar nature, and

in any event no less than reasonable care.

2.3 The Receiving Party may disclose Confidential Information only to its Representatives who

need it for the Purpose. The Receiving Party remains responsible for compliance with this

Agreement by its Representatives.

2.4 The Receiving Party shall not copy, reproduce or retain Confidential Information except to the

extent reasonably necessary for the Purpose or as required by applicable law, internal

compliance rules or bona fide backup and archiving processes.

2.5 The Receiving Party shall notify the Disclosing Party without undue delay if it becomes aware

of any unauthorized access to, use of or disclosure of Confidential Information and shall

reasonably cooperate in limiting the consequences of such event.

3. Exclusions

3.1 The obligations in this Agreement do not apply to information which the Receiving Party can

demonstrate: (a) is or becomes publicly available other than through a breach of this

Agreement; (b) was lawfully known to the Receiving Party without restriction before

disclosure; (c) is lawfully received from a third party without a duty of confidentiality; (d) is

independently developed without use of or reference to the Disclosing Party’s Confidential

Information; or (e) is approved for disclosure in writing by the Disclosing Party.

4. Mandatory disclosure and public-sector obligations

4.1 A Receiving Party may disclose Confidential Information to the extent that disclosure is

required by applicable law, a binding order of a court or competent authority, or a lawful

request from a supervisory, audit or oversight body. Where legally permitted and reasonably

practicable, the Receiving Party shall inform the Disclosing Party before making such

disclosure and shall disclose only the information that is legally required.

4.2 The Consultant acknowledges that RIA is an Estonian public authority and is subject to

statutory transparency, public information, records management, audit and public procurement

obligations. Nothing in this Agreement requires RIA to withhold information where disclosure

or retention is required under applicable law, including the Estonian Public Information Act

or public procurement legislation. RIA shall nevertheless apply any lawful grounds for

restricting access where such grounds exist and are applicable.

5. Information subject to special legal restrictions

5.1 This Agreement does not, by itself, create any legal basis or authorization for a Party to disclose

information whose disclosure is restricted by law, by third-party rights or by a separate

confidentiality regime. Each Disclosing Party remains responsible for determining whether it

is entitled to disclose information for the Purpose.

5.2 Unless separately and expressly agreed in writing and legally permitted, the Parties do not

intend to disclose classified information, state secrets or foreign classified information,

authentication secrets, production credentials, cryptographic private keys, or other information

that cannot lawfully or appropriately be shared for the Purpose.

6. Security-sensitive information

6.1 To the extent Confidential Information describes RIA’s systems, security architecture,

configurations, vulnerabilities or protective measures; the Consultant shall use such

information only to assess and discuss the potential consultancy engagement. It shall not use

that information to access, probe, scan, test, circumvent or interfere with RIA’s systems or

services unless RIA has expressly authorised the relevant activity in writing.

3

7. Personal data

7.1 The Parties expect that any personal data exchanged under this Agreement will be limited to

ordinary business contact details. If the contemplated engagement requires the Consultant to

process personal data on behalf of RIA or requires broader disclosure of personal data, the

Parties shall establish the necessary legal basis and, where applicable, enter into appropriate

data-processing arrangements before such processing or disclosure takes place.

8. Ownership, no licence and return or destruction

8.1 All Confidential Information remains on the property of the Disclosing Party or its relevant

licensor. No intellectual property right, licence or other right is granted by disclosure except

for the limited right to use the Confidential Information for the Purpose in accordance with

this Agreement.

8.2 Upon the Disclosing Party’s written request, the Receiving Party shall, to the extent reasonably

practicable, return or securely destroy Confidential Information in its possession or control,

except for copies that must be retained under applicable law, mandatory internal compliance

requirements or routine backup processes. Any retained Confidential Information remains

subject to this Agreement.

8.3 Unless expressly agreed otherwise in writing, Confidential Information is provided for

evaluation purposes without any representation or warranty as to completeness or accuracy,

and neither Party is obliged to proceed with any proposed transaction or engagement.

9. No commitment and public procurement neutrality

9.1 Nothing in this Agreement obliges RIA to purchase any services, issue any order, commence

or continue a procurement procedure, or award any contract to the Consultant. Each Party

bears its own costs associated with the discussions unless otherwise agreed in writing.

9.2 The execution of this Agreement and the exchange of information under it do not grant the

Consultant exclusivity, preferred-supplier status or any advantage in a future procurement

procedure. RIA remains free to plan and conduct any procurement in accordance with

applicable law and the principles of equal treatment, transparency, and competition.

9.3 Nothing in this Agreement prevents RIA from using general knowledge, experience or

requirements developed during the discussions, provided that doing so does not disclose or

reproduce the Consultant’s Confidential Information in breach of this Agreement.

10. Term and duration of confidentiality obligations

10.1 This Agreement enters into force on the Effective Date and remains in force for three (3) years

unless terminated earlier by either Party by written notice.

10.2 The confidentiality and use of restrictions in this Agreement survive termination or expiry for

five (5) years from the date on which the relevant Confidential Information was disclosed.

Information that constitutes a trade secret, or security-sensitive information whose

unauthorised disclosure could reasonably compromise the security of systems or services, shall

remain protected for so long as it retains that character, subject always to Clause 4.

11. Liability and remedies

11.1 Each Party is responsible for breaches of this Agreement in accordance with applicable law.

Nothing in this Agreement excludes or limits any remedy that a Party may have under

applicable law in respect of an unauthorised use or disclosure of its Confidential Information.

12. Miscellaneous

12.1 This Agreement contains the entire agreement between the Parties concerning confidentiality

for the Purpose and supersedes any prior discussions or understandings on that subject. Any

4

amendment must be made in writing and agreed by both Parties.

12.2 A failure or delay in exercising a right under this Agreement does not constitute a waiver of

that right. If any provision is held invalid or unenforceable, the remaining provisions remain

in effect, and the invalid provision shall be interpreted or replaced, to the extent possible, so

as to reflect its intended purpose.

12.3 This Agreement may be executed electronically and in counterparts, each of which is deemed

original and all of which together constitute one instrument.

12.4 This Agreement is governed by the laws of the Republic of Estonia. Any dispute arising out

of or in connection with this Agreement that cannot be resolved by negotiation shall be

submitted to the competent court in Estonia, unless mandatory law provides otherwise.

SIGNED by the authorised representatives of the Parties:

Riigi Infosüsteemi Amet SoftwareOne Estonia OÜ

Name: Joonas Heiter Name: Tarmo Uba

Title: Director General Title: Chief Executive Officer

(signed digitally) (signed digitally)