Andmekaitsespetsialisti määramine

Power of Attorney

Subject: For the Appointment Notification of a Data Protection Officer (DPO) to the Estonian Data Protection Inspectorate

I, the undersigned, Mr. Tonu Naks, acting in my capacity as Director of AdaCore Estonia OÜ, a company incorporated under the laws of Estonia, with its registered office at Mäealuse 2/1, 12618 Tallinn, Estonia and registered under number 14485372, hereby grant full power and authority to:

Gilles Rouvier, Attorney, Lawways Avocats,

5 rue La Boétie, 75008 Paris, FRANCE Email: gilles.rouvier@lawways.com

to act on behalf of the Company solely for the purpose of notifying the appointment of the Company’s Data Protection Officer (DPO) to the Estonian Data Protection Inspectorate (EDPI), and to carry out all necessary steps in relation thereto, including, without limitation, the provision of any required information and documentation, and to communicate with the EDPI as may be required in the context of such notification.

This Power of Attorney shall remain in force until the notification has been duly submitted and acknowledged, or until expressly revoked in writing.

Executed in Tallinn, on April 24th, 2025

Mr. Tonu Naks Director

Mäealuse 2/1 12618 Tallinn

ESTONIA +372 600 3400

info@adacore.com www.adacore.com

Docusign Envelope ID: E26F9534-A3DA-45D3-810E-3C205B33C865

ERAELU KAITSE JA RIIGI LÄBIPAISTVUSE EEST

Tatari tn 39 / 10134 Tallinn / 627 4135 / info@aki.ee / www.aki.ee / registrikood 70004235

Pauline Pasquer

Lawways

pauline.pasquer@lawways.com

Yours: 20.02.2025 Ours: 05.03.2025 nr 2.2-9/25/601-2

Answer to request The Data Protection Inspectorate (EDPI) received your questions about registering data

protection officer (DPO) in Estonia. Firstly, does the notice of appointment of a DPO in EDPI

have to be in Estonian or can it be done in English as well. You also ask that if the notification

cannot be made through the e-Business Register, then do you have to contact EDPI, and if so,

what is the notification procedure.

The General Regulation on the Protection of Personal Data (GDPR) stipulates a number of rules

to which a data protection officer (DPO) must comply. Whether the company's data protection

officer meets these conditions, including being able to provide Estonian-speaking data subjects

with the necessary information and service, must be known by each company responsible

(controller).

In some cases, the notification to EDPI can also be done in English. However, we emphasize

that DPO must be able to communicate with both, data subjects and EDPI, in Estonian.

Companies must prepare appropriate data protection documentation (including privacy policy)

in Estonian for Estonian data subjects before data processing if the service is aimed at Estonian

residents. However, if the company is able to fulfill all relevant requirements (including

communication in Estonian) with a group-wide data protection officer, for example, then the

inspectorate sees no reason why companies should not be assign a group-wide (non-Estonian-

speaking) data protection officer.

Company must be able to comply with the GDPR. In any case, the controller i.e. the company, is

responsible for violations related to data processing, not the DPO. Which is why it is always

worth considering the decisions more thoroughly (including whether the appointed DPO provides

the service required at the local level) and choose a DPO who will really help the company.

We also note that the Data Protection Inspectorate accepts DPO appointment notices if:

1) the notice has been signed digitally or by hand by an authorized person, a company´s

manager etc., or a person entered in the business register as a representative of the

company/institution, or

2) if the signer acts on the basis of authorization, the notification is accompanied by a power

of attorney signed by the person entitled to represent. At the same time, a person entitled

to represent one company/institution cannot submit a report about another

company/institution without authorization - even if he is the linked company or a higher-

ranking institution.

2 (2)

As a result of the above, if necessary, a (signed) notification about the appointment of a data

protection officer can be forwarded to the inspectorate. The data protection officer becomes the

contact person of his employer in communication with inspectorate. To identify DPO, we need his

personal identification number or date of birth and citizenship (in addition to the date of

appointment, the name of the data protection officer and contact details). If there is no deadline,

we assume that the data protection officer position is without the term.

Although you have already referred to it, we note that the easiest way to report a DPO in Estonia

is to do it through the entrepreneur portal. In this case, it is no longer necessary to send a separate

notification to the EDPI. The notice can be entered by a person registered as a representative in

the e-business register.

If it is not possible to make a notification in the e-business register, it can be forwarded to EDPI

by e-mail to a address info@aki.ee. The inspectorate will send a separate reply, either to clarify

the data or to notify that the notice of DPO has been noted by EDPI.

You have the opportunity to read relevant information on the website of the EDPI (however, it is

mostly in Estonian):

- Andmekaitsespetsialisti määramisest;

- Andmekaitsespetsialisti ülesanded, teadmised ja oskused.

- Isikuandmete töötleja üldjuhendi 3. peatükk.

Explanations in English are published here: https://www.aki.ee/en/inspectorate-news-

information-dpo-s/information-dpo-s.

Hope my explanations are helpful. Best regards

Liina Kroonberg

lawyer

authorized by Director General

www.lawways.com 5, rue La Boétie, 75008 Paris – +33 (0) 1 43 18 16 50 – contact@lawways.com

SELARL au capital de 12.000 euros – RCS Paris 489 534 479 – Toque G0076

Data Protection Inspectorate

Tatari Tn, 39

10134 Tallinn

Estonia

Paris, May 19th, 2025,

Subject: Notification of Appointment of Data Protection Officer

Dear Sir/Madam,

We have been duly appointed as the official point of contact for all data protection matters related to

the designating company and are authorized to communicate directly with the Estonian Data

Protection Inspectorate and with data subjects, in compliance with applicable EU data protection law.

We hereby notify the Estonian Data Protection Inspectorate of our appointment as external Data

Protection Officer (DPO) on behalf of our Client, AdaCore OÜ, in accordance with Article 37 of the

General Data Protection Regulation (EU) 2016/679 (GDPR).

The following information is provided in support of this notification:

1. Entity Designating the Data Protection Officer (DPO)

- Registration Number: 14485372; - Corporate Name: AdaCore Estonia OÜ ; - Address: Abara tn 19, Haabersti linnaosa, 13516 Tallinn, Harju Maakond, Estonia ; - Country: ESTONIA ; - Number of Employees : 50-99 ; - Legal Representative of the Designating Entity: Mr. Tõnu Näks ; - Position: Managing Director of AdaCore Estonia; - Email Address: naks@adacore.com - EDPI Contact Person: Mr. Tõnu Näks;

2. Information Concerning the Data Protection Officer (DPO)

- Registration Number: 489534479 ; - Corporate Name (legal entity): LAWWAYS ; - Address: 5, Rue La Boétie, 75008 PARIS ; - Country : FRANCE ; - Field of Activity: Law firm; - Contact : +330143181650 ;

www.lawways.com 5, rue La Boétie, 75008 Paris – +33 (0) 1 43 18 16 50 – contact@lawways.com

SELARL au capital de 12.000 euros – RCS Paris 489 534 479 – Toque G0076

Contact Details of the Legal Representative of the Appointed DPO Entity

- Last Name: ROUVIER ; - First Name: Gilles ; - Email Address: gilles.rouvier@lawways.com ; - Telephone Number: +33(0)660947953

3. Contact Information

- Address: 5, Rue La Boétie, 75008 PARIS (France) - Email Address: dpo@adacore.com.

Yours sincerely,

Gilles Rouvier

Attorney at law – Paris Bar

Encl. Copy of the Power of Attorney signed by the undersigned M. Tonu Naks

Power of Attorney

Subject: For the Appointment Notification of a Data Protection Officer (DPO) to the Estonian Data Protection Inspectorate

I, the undersigned, Mr. Tonu Naks, acting in my capacity as Director of AdaCore Estonia OÜ, a company incorporated under the laws of Estonia, with its registered office at Mäealuse 2/1, 12618 Tallinn, Estonia and registered under number 14485372, hereby grant full power and authority to:

Gilles Rouvier, Attorney, Lawways Avocats,

5 rue La Boétie, 75008 Paris, FRANCE Email: gilles.rouvier@lawways.com

to act on behalf of the Company solely for the purpose of notifying the appointment of the Company’s Data Protection Officer (DPO) to the Estonian Data Protection Inspectorate (EDPI), and to carry out all necessary steps in relation thereto, including, without limitation, the provision of any required information and documentation, and to communicate with the EDPI as may be required in the context of such notification.

This Power of Attorney shall remain in force until the notification has been duly submitted and acknowledged, or until expressly revoked in writing.

Executed in Tallinn, on April 24th, 2025

Mr. Tonu Naks Director

Mäealuse 2/1 12618 Tallinn

ESTONIA +372 600 3400

info@adacore.com www.adacore.com

Docusign Envelope ID: E26F9534-A3DA-45D3-810E-3C205B33C865

ERAELU KAITSE JA RIIGI LÄBIPAISTVUSE EEST

Tatari tn 39 / 10134 Tallinn / 627 4135 / info@aki.ee / www.aki.ee / registrikood 70004235

Pauline Pasquer

Lawways

pauline.pasquer@lawways.com

Yours: 20.02.2025 Ours: 05.03.2025 nr 2.2-9/25/601-2

Answer to request The Data Protection Inspectorate (EDPI) received your questions about registering data

protection officer (DPO) in Estonia. Firstly, does the notice of appointment of a DPO in EDPI

have to be in Estonian or can it be done in English as well. You also ask that if the notification

cannot be made through the e-Business Register, then do you have to contact EDPI, and if so,

what is the notification procedure.

The General Regulation on the Protection of Personal Data (GDPR) stipulates a number of rules

to which a data protection officer (DPO) must comply. Whether the company's data protection

officer meets these conditions, including being able to provide Estonian-speaking data subjects

with the necessary information and service, must be known by each company responsible

(controller).

In some cases, the notification to EDPI can also be done in English. However, we emphasize

that DPO must be able to communicate with both, data subjects and EDPI, in Estonian.

Companies must prepare appropriate data protection documentation (including privacy policy)

in Estonian for Estonian data subjects before data processing if the service is aimed at Estonian

residents. However, if the company is able to fulfill all relevant requirements (including

communication in Estonian) with a group-wide data protection officer, for example, then the

inspectorate sees no reason why companies should not be assign a group-wide (non-Estonian-

speaking) data protection officer.

Company must be able to comply with the GDPR. In any case, the controller i.e. the company, is

responsible for violations related to data processing, not the DPO. Which is why it is always

worth considering the decisions more thoroughly (including whether the appointed DPO provides

the service required at the local level) and choose a DPO who will really help the company.

We also note that the Data Protection Inspectorate accepts DPO appointment notices if:

1) the notice has been signed digitally or by hand by an authorized person, a company´s

manager etc., or a person entered in the business register as a representative of the

company/institution, or

2) if the signer acts on the basis of authorization, the notification is accompanied by a power

of attorney signed by the person entitled to represent. At the same time, a person entitled

to represent one company/institution cannot submit a report about another

company/institution without authorization - even if he is the linked company or a higher-

ranking institution.

2 (2)

As a result of the above, if necessary, a (signed) notification about the appointment of a data

protection officer can be forwarded to the inspectorate. The data protection officer becomes the

contact person of his employer in communication with inspectorate. To identify DPO, we need his

personal identification number or date of birth and citizenship (in addition to the date of

appointment, the name of the data protection officer and contact details). If there is no deadline,

we assume that the data protection officer position is without the term.

Although you have already referred to it, we note that the easiest way to report a DPO in Estonia

is to do it through the entrepreneur portal. In this case, it is no longer necessary to send a separate

notification to the EDPI. The notice can be entered by a person registered as a representative in

the e-business register.

If it is not possible to make a notification in the e-business register, it can be forwarded to EDPI

by e-mail to a address info@aki.ee. The inspectorate will send a separate reply, either to clarify

the data or to notify that the notice of DPO has been noted by EDPI.

You have the opportunity to read relevant information on the website of the EDPI (however, it is

mostly in Estonian):

- Andmekaitsespetsialisti määramisest;

- Andmekaitsespetsialisti ülesanded, teadmised ja oskused.

- Isikuandmete töötleja üldjuhendi 3. peatükk.

Explanations in English are published here: https://www.aki.ee/en/inspectorate-news-

information-dpo-s/information-dpo-s.

Hope my explanations are helpful. Best regards

Liina Kroonberg

lawyer

authorized by Director General