Terms and Conditions

Algora S.A. · SaaS subscription and related services Version 1.0 of 1 November 2026

These terms and conditions (the "Terms") are issued by ALGORA S.A., a public limited company (société anonyme) incorporated under the laws of the Grand Duchy of Luxembourg, having its registered office at 2, Rue du Fort Wallis, L-2714 Luxembourg, registered with the Luxembourg Trade and Companies Register (R.C.S. Luxembourg) under number B288571, VAT number LU35917055 ("Algora"). They replace the general terms and conditions of sale of 23 May 2025 and the SaaS User Service Agreement of 19 May 2025 for any Quote accepted and any Specific Agreement signed from 1 November 2026.

1. SCOPE, DEFINITIONS AND CONTRACT DOCUMENTS

1.1 These Terms apply to the subscription to the Service and to any related services provided by Algora to a customer (the "Customer"). They apply to every Quote accepted by the Customer and to any agreement signed by the Customer and Algora that refers to them (a "Specific Agreement"). Algora and the Customer are each a "Party" and together the "Parties".

1.2 The Service is offered only to undertakings acting for purposes relating to their trade, business or profession, and not to consumers. By accepting a Quote or signing a Specific Agreement, the Customer confirms that it acts in a professional capacity and that the person accepting has authority to bind it.

1.3 In these Terms:

(a) "Authorised User" means an employee or individual contractor of the Customer to whom the Customer gives access to the Service, within the number of users set out in the Quotes;

(b) "Contract" means these Terms and their Annexes, the DPA, the Quotes and any Specific Agreement;

(c) "Customer Data" means all data, documents, portfolios, prompts, instructions and other content uploaded or created by or for the Customer in the Service, including Outputs stored in its workspace, but excluding Usage Data and Third-Party Content;

(d) "DPA" means the Algora Data Processing Agreement, in the version stated in the Quote or Specific Agreement, which forms part of the Contract without separate signature;

(e) "Effective Date" means the date set out in the Quote or Specific Agreement or, failing that, the date of acceptance of the first Quote;

(f) "Fees" means the fees set out in the Quotes;

(g) "Outputs" means the content generated by the artificial intelligence features of the Service in response to the Customer's queries or instructions;

(h) "Quote" means a quote issued by Algora and accepted in writing by the Customer, which sets out the services ordered, the number of Authorised Users and the Fees;

(i) "Service" means Algora's artificial intelligence platform for investment professionals, made available as software-as-a-service through a web interface and an application programming interface, covering the aggregation and analysis of financial information and documents, portfolio monitoring, and the generation of research, reports and client communications, together with its user documentation (the "Documentation");

(j) "Subscription Term" means the Initial Term and any Renewal Term defined in Section 8.1;

(k) "Third-Party Content" means market data, news, regulatory filings and other content supplied by third parties or obtained from public sources and made available through the Service; and

(l) "Usage Data" means technical and statistical data on the operation and use of the Service, which does not include the content of Customer Data.

1.4 The Customer confirms that, before accepting a Quote or signing a Specific Agreement, it received or was given access to these Terms and the DPA in the version stated in that document, had the opportunity to read them and accepts them. Algora provides the current and previous versions on request.

1.5 In the event of conflict between the documents forming the Contract: (a) Section 9 and Annex 2 prevail to the extent that they implement Regulation (EU) 2022/2554 ("DORA"), Regulation (EU) 2023/2854 (the "Data Act") or other mandatory law; (b) the DPA prevails for the processing of personal data; (c) a Specific Agreement prevails over these Terms and the Quotes; (d) a Quote prevails over these Terms only as regards the services ordered, the number of Authorised Users, the Fees, the Effective Date and the Initial Term; and (e) otherwise, these Terms prevail. General terms of the Customer, including those on purchase orders, do not apply.

1.6 Algora may publish new versions of these Terms and of the DPA. A new version applies to an existing Customer only: (a) to Quotes accepted after its publication; or (b) from the next Renewal Term, if Algora notified it in writing at least four (4) months before the end of the current Subscription Term, so that the Customer may decide not to renew. A change required by law applies from its notification. A Specific Agreement may exclude this Section.

2. THE SERVICE

2.1 Algora grants the Customer, for the Subscription Term, a non-exclusive and non-transferable right to use the Service through its Authorised Users for the Customer's internal business purposes.

2.2 Algora provides the Service with reasonable care and skill, substantially as described in the Documentation. Algora may develop and modify the Service, provided that it does not materially reduce the functionality subscribed by the Customer during the current Subscription Term, and shall inform the Customer in advance of any material change.

2.3 Algora hosts the Service and stores Customer Data in the European Union, in the locations set out in Annex III of the DPA, and shall not store Customer Data outside the European Economic Area without the Customer's prior written consent.

2.4 The service levels and support are set out in Annex 1.

2.5 The Customer shall ensure that access credentials are personal and kept secure, and is responsible for the acts of its Authorised Users. Algora may require multi-factor authentication or single sign-on for access to the Service. The Customer shall not: (a) make the Service available to third parties or resell it; (b) reverse engineer the Service or attempt to extract its source code, models or prompts, except where mandatory law allows it; (c) use the Service or Outputs to develop a competing product or to train a machine learning model; (d) impair the security or performance of the Service; or (e) use the Service in breach of applicable law or for a practice prohibited by Article 5 of Regulation (EU) 2024/1689 (the "AI Act"). Algora may suspend access to the extent strictly necessary where a use breaches this Section or creates a security risk, after notice where practicable, and shall restore access once the cause is remedied.

2.6 Setup, configuration, training and other services outside the subscription are provided only where ordered in a Quote. Algora performs them with reasonable care and skill, as an obligation of means, mostly remotely, and the Customer shall provide the information and cooperation reasonably requested. Deliverables are deemed accepted unless the Customer notifies a material non-conformity in writing within ten (10) business days of delivery, in which case Algora shall correct it within a reasonable period. Algora retains its rights in its tools and know-how, and the Customer may use the deliverables for its internal purposes during the Subscription Term.

2.7 Where Algora makes the Service or certain features available free of charge, for evaluation or as beta features, these Terms apply to that use, including Sections 13 and 14, but without the service levels of Annex 1. Free features may be modified or withdrawn at any time, and Algora's total liability for any free use is limited to EUR 10,000.

3. AI OUTPUTS

3.1 The Customer acknowledges that the Service relies on probabilistic models and that Outputs may be inaccurate, incomplete or outdated, even where they include citations or confidence indicators.

3.2 The Service is a research tool. Neither the Service nor any Output is investment advice, a personal recommendation or an investment recommendation by Algora, and Algora provides no investment service. The Customer remains solely responsible for its investment decisions, for the advice it gives to its clients and for its own regulatory obligations.

3.3 The Customer shall ensure that Outputs are reviewed by competent persons before they are relied upon or shared with third parties.

3.4 Algora complies with the transparency obligations applicable to it under Article 50 of the AI Act. Where the Customer publishes Outputs, it complies with the obligations applicable to it as deployer.

3.5 Algora claims no ownership of the Outputs. The Customer may use them for its business, including in materials for its own clients, subject to Section 4. Outputs are not exclusive to the Customer.

3.6 Algora shall not use Customer Data, including prompts and Outputs, to train or improve any artificial intelligence model, and shall contractually require the providers of the models it uses not to do so.

4. THIRD-PARTY CONTENT

4.1 Third-Party Content is made available subject to the rights of its licensors. The Customer may use it for internal research and may include limited, cited extracts in materials for its clients, but shall not redistribute raw market data, price feeds or full articles. Algora does not guarantee the accuracy or availability of Third-Party Content and may change its sources where required by its licensors or for operational reasons.

5. CUSTOMER DATA AND DATA PROTECTION

5.1 The Customer retains all rights in Customer Data and authorises Algora to host and process it solely to provide, secure and support the Service. The Customer warrants that it has the rights and legal bases needed for this processing.

5.2 Algora backs up Customer Data. If Customer Data is lost or corrupted for reasons attributable to Algora, Algora shall restore it from the latest backup without delay and at its own cost.

5.3 Algora may use Usage Data to operate, secure and improve the Service, and may disclose it only in aggregated form that identifies neither the Customer nor any natural person.

5.4 Algora processes personal data contained in Customer Data as processor in accordance with the DPA. It processes the data of the Customer's contact persons and Authorised Users as controller, in accordance with its privacy notice, published at www.algora.lu/privacy-policy and provided on request.

6. SECURITY

6.1 Algora shall maintain the technical and organisational measures described in Annex II of the DPA (the "Security Measures") and shall notify the Customer without undue delay of any security incident materially affecting Customer Data or the Service. Personal data breaches are notified within the time set in the DPA, and ICT incidents, where Annex 2 applies, within the time set in that Annex.

6.2 Algora is implementing an information security management system aligned with ISO/IEC 27001, for which a certification procedure is in progress. Algora does not represent that it holds any certification and shall inform the Customer when one is obtained.

7. FEES AND PAYMENT

7.1 The Customer pays the Fees set out in the Quotes, as invoiced by Algora. Unless a Quote provides otherwise, subscription Fees are invoiced annually in advance. Fees are in euros and exclude VAT. Except where these Terms expressly provide for a refund, Fees paid are not refundable.

7.2 Invoices are payable by bank transfer within thirty (30) days of their date. Any dispute must be notified in writing, with reasons, within fifteen (15) days of the invoice date; the undisputed part remains payable when due. Invoices not disputed within that period are deemed accepted.

7.3 The Fees are adjusted on each anniversary of the Effective Date in line with the national consumer price index (IPCN) published by STATEC, comparing the index of the third month before the anniversary with the index of the third month before the Effective Date or the previous anniversary.

7.4 Late payments bear interest at the rate set by the Luxembourg law of 18 April 2004 on payment periods and late payment interest, together with the fixed compensation for recovery costs provided by that law.

7.5 If an undisputed amount remains unpaid ten (10) business days after a written reminder, Algora may suspend the Service after a further written notice of twenty (20) business days. Suspension does not release the Customer from its payment obligations. Failure to pay an undisputed amount within thirty (30) days of a written reminder is a material breach for the purposes of Section 8.2(a).

7.6 If the Customer's use exceeds the agreed number of users or a fair use of the Service, Algora shall inform the Customer and propose a Quote. No additional Fees are due without an accepted Quote.

8. TERM AND TERMINATION

8.1 The subscription takes effect on the Effective Date for the initial term set out in the Quote or Specific Agreement or, failing that, for twelve (12) months (the "Initial Term"). It then renews automatically for successive periods of twelve (12) months (each a "Renewal Term"), unless either Party gives written notice of non-renewal at least three (3) months before the end of the current term.

8.2 Either Party may terminate the Contract by written notice with immediate effect: (a) if the other Party commits a material breach which, where remediable, is not remedied within thirty (30) days of a written notice describing it; (b) if the other Party is declared bankrupt, enters into a composition with creditors or is placed in liquidation; or (c) if the other Party becomes subject to sanctions of the European Union, the United Nations or the Grand Duchy of Luxembourg.

8.3 If the Customer ends a Subscription Term early for any reason other than those in Sections 8.2, 12, 15, Annex 1 or Annex 2, it pays an early termination fee of fifty per cent (50%) of the subscription Fees that would have been payable for the rest of that Subscription Term. No fee is due for a Subscription Term in which no subscription Fees are payable. This fee is not a switching charge within the meaning of the Data Act.

8.4 On expiry or termination: (a) access to the Service ends, subject to Section 9; (b) undisputed amounts for the period until termination become payable; (c) where the Customer terminates under Section 8.2 or Algora terminates without fault of the Customer, Algora refunds the prepaid Fees for the period after termination; and (d) Sections 3.5, 5, 9, 10, 11, 13, 14 and 18 continue to apply.

9. EXIT, SWITCHING AND RETURN OF DATA

9.1 The Customer may at any time ask, by written notice, to switch to another provider, to transfer its data to its own infrastructure, or to have its data erased. The switching process starts at the end of a notice period of two (2) months, or of any shorter period chosen by the Customer.

9.2 A transitional period of up to thirty (30) days then applies, during which the Contract remains in force and Algora continues to provide the Service, assists the Customer and the third parties it designates, informs the Customer of known risks to continuity and maintains a high level of security. If this period is technically unfeasible, Algora shall inform the Customer within fourteen (14) working days of the request, with reasons, and propose an alternative period not exceeding seven (7) months. The Customer may extend the transitional period once.

9.3 The data that can be exported are the Customer Data and their metadata, including uploaded documents, portfolios, watchlists, notes, stored Outputs with their citations, the configuration of custom analysts and account metadata, in common machine-readable formats (original files, CSV, JSON and PDF), as described in the up-to-date online description of data structures, data formats, standards and interfaces that Algora maintains at www.algora.lu/legal/data-export. They do not include Algora's software, models, prompts or internal logs, or Third-Party Content beyond Section 4.

9.4 After the transitional period, and after the end of the Contract for any other reason, the Customer has at least thirty (30) days to retrieve its data. Algora then erases the Customer Data, subject to the backup cycle set out in the DPA and to legal retention obligations, and confirms the erasure in writing on request.

9.5 Algora charges no switching or data egress fees. The Fees remain payable until the end of the transitional period.

9.6 The Contract terminates, and Algora notifies the Customer of its termination, on the successful completion of the switching process or, where the Customer has only requested the erasure of its data, at the end of the notice period of Section 9.1.

10. CONFIDENTIALITY

10.1 Each Party shall keep confidential all information received from the other Party in connection with the Contract that is marked as confidential or that a reasonable person would consider confidential, including the terms of any Quote or Specific Agreement, Algora's software and know-how and, for the Customer, Customer Data. It shall use such information only for the Contract and disclose it only to its officers, employees, contractors, advisers and auditors, and in the case of Algora its sub-processors and hosting providers, who need to know it and are bound by equivalent obligations.

10.2 These obligations do not apply to information that is or becomes public without breach, was lawfully known or received without restriction, or was independently developed. Disclosures required by law or by a competent authority, including the Customer's supervisory authorities, are permitted, with prior notice to the other Party where legally possible.

10.3 These obligations apply during the Contract and for five (5) years after it ends, and for as long as the information remains a trade secret or, for Customer Data, for as long as Algora holds it.

11. INTELLECTUAL PROPERTY

11.1 The Service, the Documentation, Algora's software, models, prompts and know-how, and all improvements to them, including those resulting from the Customer's feedback, remain the property of Algora or its licensors. No other right is granted to the Customer.

11.2 Algora may cite the Customer's name and logo as a client only if the Quote or Specific Agreement so provides or with the Customer's prior written consent, which may be withdrawn at any time.

12. WARRANTY

12.1 Algora warrants that the Service will perform materially in accordance with the Documentation. If it does not, the Customer shall notify Algora in writing and Algora shall correct the non-conformity within a reasonable period. If it fails to do so within thirty (30) days, the Customer may terminate the Contract and obtain a refund of the prepaid Fees for the period after termination.

12.2 Except as provided in these Terms, the Service, the Outputs and Third-Party Content are provided "as is", and all other warranties, including against hidden defects and of fitness for a particular purpose, are excluded to the extent permitted by law.

12.3 The Customer acknowledges that it is a professional, that it has assessed the suitability of the Service for its needs and that the Service assists its research and does not replace the professional judgment of the Customer and its personnel.

13. LIABILITY

13.1 Nothing in the Contract limits liability for fraud, wilful misconduct (dol) or gross negligence (faute lourde), for death or personal injury, for the payment of the Fees, for the Customer's use of the Service in breach of Section 2.5 or in infringement of Algora's intellectual property rights, or for any liability that cannot be limited by law.

13.2 Neither Party is liable for indirect or consequential loss, loss of profit, revenue, clientele or opportunity, or for any trading or investment loss.

13.3 The total liability of each Party under the Contract is limited to the Fees paid or payable for the Service in the twelve (12) months before the event giving rise to the claim, or EUR 10,000 if that amount is higher.

13.4 Service credits count towards this limit. Any claim must be brought within two (2) years of the date on which the claimant became aware, or should have become aware, of the facts giving rise to it.

14. INTELLECTUAL PROPERTY CLAIMS

14.1 Algora shall defend the Customer against any third-party claim that the Service, used in accordance with the Contract, infringes that third party's intellectual property rights, and shall pay the damages and costs finally awarded or agreed in a settlement approved by Algora. This does not apply to claims arising from Customer Data, Third-Party Content, the Customer's use of Outputs, modifications not made by Algora or use in breach of the Contract. Algora may procure the right to continue using the Service, modify it, or, if neither is reasonably possible, terminate the Contract and refund the prepaid Fees.

14.2 The Customer shall defend Algora against any third-party claim arising from Customer Data, from the use of the Service in breach of the Contract or of the law, or from the Customer's investment decisions and advice to its clients, and shall pay the damages and costs finally awarded or agreed in a settlement approved by the Customer.

14.3 The indemnified Party shall notify the claim promptly, allow the other Party to control the defence and settlement, and cooperate at that Party's cost. No settlement may impose an admission or obligation on the indemnified Party without its consent.

15. FORCE MAJEURE AND HARDSHIP

15.1 Neither Party is liable for a failure to perform, other than a payment obligation, caused by an event beyond its reasonable control that it could not foresee and whose effects it could not avoid. Failures of Algora's suppliers are force majeure only if they themselves result from such an event, and cyberattacks only if the Security Measures could not have prevented or mitigated them. The affected Party shall notify the other Party, mitigate the effects and apply its business continuity plans. If the event lasts more than thirty (30) days, either Party may terminate the Contract by written notice, and Algora refunds the prepaid Fees for the period after termination.

15.2 The Parties acknowledge that the Fees were agreed on the basis of the costs prevailing at the Effective Date, in particular the costs of artificial intelligence models, cloud hosting and data licences, which are largely outside Algora's control. If, after the Effective Date, an unforeseeable change in circumstances which is not attributable to Algora, and the risk of which Algora has not assumed under the Contract, makes performance excessively onerous for Algora, Algora may request a renegotiation of the Fees or of the affected provisions by written notice describing the change and its impact, with supporting evidence. A Party's awareness, at the Effective Date, of a general risk that such costs may vary does not in itself preclude the application of this Section. The Parties continue to perform the Contract in the meantime. If no agreement is reached within two (2) months of the request, either Party may terminate the Contract with three (3) months' written notice, without early termination fee. Algora then refunds the prepaid Fees for the period after termination, and Section 9 and, where applicable, Section 4.5 of Annex 2 apply.

16. NON-SOLICITATION

16.1 During the Contract and for twelve (12) months after it ends, the Customer shall not actively solicit, with a view to hiring or engaging them, the employees or individual contractors of Algora directly involved in the Contract. Hiring a person who responds to a general advertisement or approaches the Customer on their own initiative is not a breach. In case of breach, the Customer pays a lump-sum indemnity equal to six (6) months of the gross remuneration or fees of the person concerned.

17. GENERAL PROVISIONS

17.1 Subcontracting. Algora may use subcontractors and remains responsible for them. The use of sub-processors is governed by the DPA, and the use of subcontractors for critical or important functions by Annex 2.

17.2 Assignment. The Customer may assign the Contract only with Algora's prior written consent, which shall not be unreasonably withheld for an assignment to an affiliate. Algora may assign it, by written notice, to an affiliate or to a successor in a merger, sale of business or change of control that assumes all its obligations, without prejudice to the Customer's rights under Annex 2.

17.3 Compliance. Each Party complies with applicable anti-bribery laws and represents that neither it nor its directors or controlling shareholders are subject to sanctions of the European Union, the United Nations or the Grand Duchy of Luxembourg. The Customer informs Algora in writing of any regulatory requirement specific to its activities that it expects Algora to meet, other than those set out in Annex 2.

17.4 Notices. Formal notices are sent by registered letter or by email with acknowledgement of receipt to the addresses in the Quote or Specific Agreement and, for Algora, to 2, Rue du Fort Wallis, L-2714 Luxembourg and info@algora.lu.

17.5 Entire agreement and amendments. The Contract forms the entire agreement of the Parties on its subject matter and replaces any prior agreement or proposal on it. Subject to Section 1.6, any amendment must be in writing and signed by both Parties.

17.6 Miscellaneous. A waiver is valid only in writing. If a provision is invalid, the others remain in force and the Parties shall replace it with a valid provision with the closest effect. The Parties are independent contractors. The Contract creates no rights for third parties. Algora's monitoring logs and records constitute evidence of availability, access and use of the Service, subject to proof to the contrary. These Terms are drafted in English, which prevails over any translation. Quotes and Specific Agreements may be accepted or signed electronically in accordance with Regulation (EU) No 910/2014 (eIDAS).

18. GOVERNING LAW AND JURISDICTION

18.1 The Contract is governed by Luxembourg law. Before starting proceedings, except for urgent measures, the Parties shall try to settle any dispute through their senior management for thirty (30) days. The courts of the City of Luxembourg have exclusive jurisdiction.

ANNEX 1: SERVICE LEVELS AND SUPPORT

1. Availability

1.1 Algora shall use all reasonable efforts to make the Service available at least 99.5% of the time in each calendar month, measured by its monitoring tools, which test login and query processing at least every minute. The Service is unavailable when Authorised Users cannot log in or submit queries and receive responses, or when its core research functions are unusable for all users.

1.2 The following periods are not counted as unavailability: (a) scheduled maintenance announced at least five (5) business days in advance, carried out outside business hours where possible and not exceeding eight (8) hours per month; (b) emergency security patches, up to four (4) hours per month, with notice as soon as possible; (c) unavailability caused by the Customer, its systems or third-party services not supplied by Algora; (d) force majeure; and (e) unavailability of a single Third-Party Content source while the Service remains available.

1.3 If availability falls below 99.5% in a month, the Customer receives the following service credits, calculated on one twelfth of the annual subscription Fees:

1.4 The Customer requests credits at info@algora.lu within thirty (30) days of the end of the month concerned. Algora replies within ten (10) business days with its availability data. Credits are deducted from the next invoice or, if none follows, paid within thirty (30) days of the end of the Contract. Without prejudice to Section 1.5 and Annex 2, service credits are the Customer's sole financial remedy for unavailability.

1.5 If availability is below 95.0% in two (2) consecutive months, or in three (3) months within any twelve (12) months, the Customer may terminate the Contract within thirty (30) days, without early termination fee, and Algora refunds the prepaid Fees for the period after termination.

2. Support

2.1 Support requests are sent to info@algora.lu or, for critical incidents, by telephone at +352 691 246 799. Business hours are Monday to Friday, 9:00 to 18:00, Luxembourg time, excluding public holidays. Support covers incidents and questions on the use of the Service.

2.2 Algora responds to and aims to resolve requests within the following times, counted in business hours:

2.3 For critical incidents, Algora informs the Customer without undue delay, provides updates at least every two (2) hours until restoration and an incident report within five (5) business days. Escalation: Julien Poncé, Chief Operating Officer (jponce@algora.lu), then Nicolas Thill, Chief Technology Officer (nthill@algora.lu).

ANNEX 2: REGULATED ENTITY TERMS (DORA, CSSF AND PROFESSIONAL SECRECY)

1. Scope

1.1 This Annex applies where the Customer is a financial entity within the meaning of Article 2 of DORA, is supervised by the Commission de Surveillance du Secteur Financier (the "CSSF") or another financial supervisory authority, or is bound by professional secrecy, as stated in the Quote or Specific Agreement or notified in writing by the Customer. Algora is not a financial entity within the meaning of DORA; this Annex implements for the Customer the contractual requirements of Article 30 of DORA, of CSSF Circular 25/882 and, for customers not subject to DORA, of CSSF Circular 22/806, as amended. "Competent Authority" means any authority competent to supervise the Customer, including the CSSF.

1.2 The Customer determines whether the Service supports a critical or important function and informs Algora in writing. Part C applies only if it does.

2. Part A: provisions for all regulated customers

2.1 Services and subcontracting. The services are described in these Terms, the Quotes, any Specific Agreement and the Documentation. Subcontracting is governed by Section 17.1, the DPA and, for critical or important functions, Section 4.2 of this Annex. The subcontractors that underpin the services, the data each receives and the place where each processes it are listed in Annex III of the DPA.

2.2 Locations. The services are provided and Customer Data is stored in the locations set out in Section 2.3 and in Annex III of the DPA. Algora gives at least three (3) months' notice of any change of country or region, or notice without delay in an emergency.

2.3 Data. Algora ensures the availability, authenticity, integrity and confidentiality of Customer Data in accordance with the Security Measures and the DPA, and its access, recovery and return in accordance with Section 9, including if Algora becomes insolvent or stops its activity.

2.4 Service levels. The service levels in Annex 1 may not be reduced during a Subscription Term without the Customer's consent.

2.5 ICT incidents. Algora notifies the Customer of any ICT incident affecting the services or Customer Data that is or may be major, or that may be relevant for the Customer's classification of incidents under Article 18 of DORA, within four (4) hours of its classification as such by Algora, acting reasonably on the basis of the information available to it and of any classification criteria communicated by the Customer, and in any event within twenty-four (24) hours of detection by Algora, and provides updates and a final report allowing the Customer to meet its reporting obligations. Assistance is free of charge where the incident is attributable to Algora and otherwise charged at EUR 120 per hour.

2.6 Authorities. Algora cooperates fully with the Competent Authorities and resolution authorities of the Customer and with the persons they appoint.

2.7 Termination rights. The Customer may terminate the Contract with three (3) months' notice, or immediately if a Competent Authority so requires, in the event of: (a) a significant breach by Algora of applicable law or of the Contract; (b) circumstances that may alter the performance of the services, including material changes affecting Algora; (c) evidenced weaknesses in Algora's ICT risk management; or (d) circumstances that prevent a Competent Authority from effectively supervising the Customer. No early termination fee is then due, and Algora refunds the prepaid Fees for the period after termination.

2.8 Training. Algora takes part, once a year at no cost and beyond that at EUR 950 per session, in the Customer's ICT security awareness and digital operational resilience training.

2.9 Register of information. Algora provides the information the Customer needs for its register of information under DORA, including its legal entity identifier (LEI) or, failing that, its European unique identifier (EUID), its relevant subcontractors and the locations of the services, as well as the information reasonably required for any notification by the Customer to a Competent Authority.

2.10 Written contract. Where this Annex applies, the documents forming the Contract are attached to the Quote or Specific Agreement, or otherwise compiled with it in one single document, which each Party keeps in a durable and downloadable format.

3. Part B: professional secrecy

3.1 Algora acknowledges that information covered by the Customer's professional secrecy, in particular under Article 41 of the law of 5 April 1993 on the financial sector ("Secret Information"), is protected by criminal law. Algora shall keep Secret Information strictly secret, use it only to perform the Contract, limit access to the persons and sub-processors who need it and are bound by equivalent obligations, keep a list of them available to the Customer, and inform the Customer without delay of any breach. It discloses Secret Information only to those persons, to the Competent Authorities or as required by law.

3.2 The Customer is responsible for obtaining any client consent or meeting any other condition required to transmit Secret Information to Algora, and Algora provides the information the Customer needs for that purpose, in particular on the services, the categories of information concerned and the countries in which they are processed. This Part B survives the end of the Contract without limitation in time.

4. Part C: critical or important functions

4.1 Audit and access. Algora grants the Customer, any third party appointed by it and the Competent Authorities unrestricted rights of access, inspection and audit regarding the services, including the right to take copies of relevant documentation on site. These rights are not limited by any other contractual arrangement. Algora first provides its policies, test results, certifications and audit reports. On-site audits are announced at least thirty (30) days in advance, except in an emergency or at the request of a Competent Authority, and may be pooled with other customers. Audit costs are borne by the Customer unless a material breach by Algora is found; Algora's time beyond two (2) days per audit and per year is charged at EUR 950 per day, except for audits requested by a Competent Authority.

4.2 Subcontracting. Algora maintains and communicates the list of subcontractors that underpin the services, monitors them, ensures equivalent audit rights to the extent possible given the standard terms of its subcontractors, complies with the conditions for subcontracting resulting from Commission Delegated Regulation (EU) 2025/532, and remains fully responsible. Algora gives three (3) months' notice of any material change. The Customer may object within thirty (30) days and, if no solution is found, terminate the affected services without early termination fee.

4.3 Continuity and testing. Algora tests its business continuity and ICT response and recovery plans at least once a year and shares a summary of the results. It participates, at the Customer's cost, in the Customer's threat-led penetration testing where the services are in scope.

4.4 Reporting. Algora provides a monthly report on availability, critical and high incidents and notified incidents, and informs the Customer without delay of any development that may affect the agreed service levels.

4.5 Exit. On termination for any reason, Algora continues to provide the services at the Customer's request for up to six (6) months, at the Fees in force pro rata, assists with an orderly transfer and cooperates in the Customer's exit plan. Assistance beyond the data export of Section 9 is charged at EUR 950 per day.

5. Part D: changes

5.1 If a change in law or in the requirements of a Competent Authority requires an amendment, the Parties negotiate it in good faith. If it causes significant additional costs for Algora and no agreement on the Fees is reached within sixty (60) days, either Party may terminate the affected services with three (3) months' notice, without early termination fee.

5.2 Algora informs the Customer without undue delay of any change of control or assignment of the Contract.