NON-DISCLOSURE AGREEMENT (NDA)

Soda Data NV, a company incorporated under the laws of Belgium, registered under registration number 0694.987.974, with its registered office at Rue Picard 7/100, 1000 Brussels, Belgium, duly represented by Joeri Meurisse, Director of Operations,

and

Tervise ja Heaolu Infosüsteemide Keskus (edaspidi TEHIK), registered under registration number 70009770, with its registered office at Pärnu mnt 132, 11317 Tallinn, Estonia, duly represented by its Director, Margus Arm, acting based on the Articles of Association,

hereinafter jointly or individually referred to as the "Parties" or a "Party", have entered into the following agreement (hereinafter the "Agreement"):

1. Purpose of the Agreement

1.1. The Parties may grant each other access to Confidential Information in connection with the potential implementation, integration or evaluation of the Soda data quality monitoring and data lineage solution within the TEHIK environment, including the preparation, execution and evaluation of a proof of concept ("PoC").

1.2. Access to Confidential Information shall be granted until the purpose of this Agreement has been fulfilled or until the Parties decide to terminate the PoC or the related cooperation.

2. Confidential Information

2.1. For the purposes of this Agreement, Confidential Information means any information, in any form or format, disclosed by one Party to the other Party, or to which the other Party gains access in connection with the fulfilment of the purpose of this Agreement, regardless of whether such information is marked as confidential, provided that the nature of the information or the circumstances of its disclosure indicate that it is confidential or constitutes a trade secret.

2.2. Confidential Information includes, without limitation, technical, commercial, organizational, security-related and other non-public information, including information relating to systems, architecture, data models, interfaces, processes, security measures, pricing, products, development plans, business relationships and the results of the PoC, except to the extent that TEHIK is required by law to disclose such information in the course of a public procurement procedure.

2.3. Confidential Information shall also include any non-public information obtained or created in the course of the PoC.

Docusign Envelope ID: D4FDBF01-ED25-8CB5-83C8-6356940949A9

3. Confidentiality Obligations

3.1. The Party receiving Confidential Information from the other Party shall keep such Confidential Information confidential and shall not disclose or otherwise make it available, in any manner, to any third party, except as expressly permitted under this Agreement.

3.2. Confidential Information may be used solely for the purposes set out in this Agreement.

3.3. Each Party shall apply to the protection of Confidential Information at least the same degree of care and security measures that it applies to the protection of its own confidential information of a similar nature, but in no event less than a reasonable standard of care.

3.4. Any exchange of information containing Confidential Information shall be carried out in a secure manner, including, where appropriate, by using encryption.

3.5. Each Party shall prevent unauthorized access to Confidential Information by third parties and shall not disclose or transfer such information to any third party, except where such disclosure or transfer is necessary for the fulfilment of the purpose of this Agreement and is in compliance with the terms of this Agreement.

3.6. Each Party shall promptly notify the other Party if it becomes aware that any person not authorized to do so has gained access to Confidential Information.

4. Permitted Access

4.1. A Party may grant access to Confidential Information only to its employees, officials, members of its management board, contractors, advisors or other representatives who require such access for the purpose of fulfilling the purpose of this Agreement.

4.2. Each Party shall ensure that the persons referred to in Clause 4.1 are aware of the confidential nature of the Confidential Information and are bound by confidentiality obligations that are no less stringent in substance than those set out in this Agreement.

5. Personal Data and Production Data

5.1. This Agreement does not constitute an independent legal basis for the processing of Personal Data.

5.2. No Personal Data or production environment data shall be transferred or processed in connection with the PoC unless the Parties have agreed otherwise in writing in advance and have entered into the necessary data protection, information security and other relevant agreements.

5.3. Where possible, the Parties shall use anonymous, synthetic or test data for the purposes of the PoC and shall give preference to the use of such data.

6. Restrictions on the Use of Confidential Information

6.1. A Party shall not copy, store or otherwise reproduce Confidential Information to an extent that is not necessary for the fulfilment of the purpose of this Agreement.

Docusign Envelope ID: D4FDBF01-ED25-8CB5-83C8-6356940949A9

6.2. Copies of Confidential Information may be made only to the extent necessary for the preparation, execution or evaluation of the PoC or for the fulfilment of the purpose of this Agreement.

6.3. All such copies shall remain Confidential Information and shall be subject to the terms and conditions of this Agreement.

7. Exceptions to the Confidentiality Obligations

7.1. The confidentiality obligations set out in this Agreement shall not apply to information that the receiving Party can demonstrate:

7.1.1. was lawfully in its possession prior to its disclosure and was not subject to any confidentiality obligation;

7.1.2. is or becomes publicly available through no breach of this Agreement by the receiving Party;

7.1.3. was lawfully obtained from a third party who was entitled to disclose such information without being subject to any confidentiality obligation; or

7.1.4. was independently developed without the use of the other Party's Confidential Information.

7.2. A Party shall not be deemed to be in breach of this Agreement to the extent that it is required to disclose Confidential Information pursuant to applicable law or by order or request of a court, supervisory authority or other competent public authority, provided that, where legally permitted, it notifies the other Party thereof as soon as reasonably practicable.

7.3. Nothing in this Agreement shall limit TEHIK's statutory obligations, including obligations arising under legislation governing public information, public procurement, archiving, auditing, supervision, information security or reporting.

8. Return and Destruction of Confidential Information

8.1. Upon fulfilment of the purpose of this Agreement, termination of the PoC, or upon the written request of the other Party, the Party receiving Confidential Information shall, within a reasonable period of time, return, delete or destroy the Confidential Information disclosed to it, except where retention of such Confidential Information is required by law or is necessary for the establishment, exercise or defense of legal claims.

8.2. Confidential Information retained in automated backup systems or disaster recovery systems may remain until deleted in the ordinary course of the applicable retention cycle, provided that such Confidential Information remains subject to the confidentiality obligations and restrictions on use set out in this Agreement.

Docusign Envelope ID: D4FDBF01-ED25-8CB5-83C8-6356940949A9

9. Duration of the Confidentiality Obligations

9.1. The confidentiality obligations set out in this Agreement shall remain in force for a period of five (5) years following the termination of this Agreement, except with respect to trade secrets, security-related information, Personal Data and information subject to statutory access restrictions, for which the confidentiality obligations shall remain in force for as long as such information remains protected by its nature.

10. Liability

10.1. In the event of a breach of the confidentiality obligations under this Agreement, the injured Party shall be entitled to exercise any remedies available under applicable law, including the right to require cessation of the breach and compensation for any damage caused by such breach.

10.2. The Parties agree that no contractual penalty shall apply under this Agreement.

11. Contact Persons

11.1. TEHIK's contact person for matters relating to this Agreement and the implementation of the PoC shall be: [name, email address, telephone number].

11.2. Soda's contact person for matters relating to this Agreement and the implementation of the PoC shall be: Joeri Meurisse, Director of Operations, email: [email protected].

12. Dispute Resolution

12.1. Any disputes arising out of or in connection with the performance of this Agreement shall be resolved primarily through negotiations between the Parties.

12.2. If no agreement is reached, the dispute shall be resolved in Harju Country Court in accordance with the law of the Republic of Estonia, unless the parties agree otherwise in writing.

13. Assignment of Rights and Obligations

13.1. Neither Party may assign or transfer any of its rights or obligations under this Agreement to any third party without the prior written consent of the other Party.

14. Final Provisions

14.1. This Agreement shall enter into force upon signature by both Parties.

14.2. This Agreement constitutes the entire agreement between the Parties with respect to the protection of Confidential Information in connection with the purpose of this Agreement.

14.3. Any amendments to this Agreement shall be valid only if made in writing and signed by both Parties.

Docusign Envelope ID: D4FDBF01-ED25-8CB5-83C8-6356940949A9

Signatures of the Parties:

/Digitally signed/ /signed/

Tervise ja Heaolu Infosüsteemide Keskus Soda Data NV

Name: ___________________________ Name: Joeri Meurisse

Role: ___________________________ Role: Director of Operations

Date: _______________________

Signature: _____________________

Date: ________________________

Signature: _____________________

Docusign Envelope ID: D4FDBF01-ED25-8CB5-83C8-6356940949A9

22-Sep-2026