Data Processing Agreement

This Data Processing Agreement ("DPA") governs the processing of Customer Personal Data and accompanies the Flatpeak Terms of Service (the "Agreement") entered into between you, the Customer, and Flatpeak. Capitalised terms used in this DPA that are not defined herein have the meanings given to them in the Agreement.

In this DPA, the terms "you", "your", or "Customer" refer to you, and the terms "we", "us", "our" or "Flatpeak" refer to us.

1. Scope and Term

1.1 Scope. This DPA governs the processing of Customer Personal Data by Flatpeak as a processor in the course of providing the Services.

1.2 Customer Affiliates. Where your Customer Affiliates use the Services under your account, you enter into this DPA in your own name and on behalf of those Customer Affiliates, subject to Section 12.

1.3 Term. This DPA shall remain in effect so long as Flatpeak processes Customer Personal Data subject to this DPA, notwithstanding the expiration or termination of the Agreement.

1.4 Changes to this DPA. We will notify you of any changes to this DPA or other legal terms incorporated into it at least one (1) month before the changes take effect. Changes to Sub-processors are notified in accordance with Section 8.3.

2. Definitions

"Account Data" is any Personal Data provided by or for you to Flatpeak in connection with the entering into and administration of the Agreement and your Account, including but not limited to contact information, billing details and correspondence about the entering into and administration of the Agreement and the related Services, and Personal Data associated with the login accounts of your personnel who access the Dashboard or the Services ("Users").

"CCPA" means the California Consumer Privacy Act of 2018 and any regulations promulgated thereunder, in each case, as amended from time to time.

"Customer Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with the Customer.

"Customer Data" means any data and other information or content submitted by you or for you (or by an End-User of your Customer Application) under the Agreement and processed or stored by the Services.

"Customer Personal Data" means Personal Data contained in Customer Data processed by Flatpeak as a processor, excluding Account Data.

"Data Protection Laws" means all laws and regulations of any jurisdiction applicable to the confidentiality, privacy, security, or processing of Personal Data under the Agreement, including, where applicable, the GDPR and the CCPA.

"Data Protection Officer" means a designated individual employed by Flatpeak that is responsible for handling and protecting Customer Data and Customer Personal Data. The Data Protection Officer can be contacted directly via email: dpo@flatpeak.com.

"EEA" means, for the purposes of this DPA, the European Economic Area and Switzerland.

"End-User" means an individual whose Personal Data is submitted to the Services by you or for you, including a customer of yours whose energy provider account, location, meter or device is connected to the Services.

"GDPR" means, as applicable, (i) Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data (General Data Protection Regulation) ("EU GDPR"); and (ii) the EU GDPR as it forms part of the law of the United Kingdom by virtue of the European Union (Withdrawal) Act 2018, together with the Data Protection Act 2018 ("UK GDPR").

"Personal Data" means any information relating to a directly or indirectly identified or identifiable natural person, whether by itself or in combination with other information.

"Personal Data Breach" means any accidental, unauthorised or unlawful destruction, loss, alteration, disclosure of, or access to Customer Personal Data and any other similar term under applicable Data Protection Laws, such as "Security Breach".

"Standard Contractual Clauses" means Controller to Processor (Module Two) or Processor to Processor (Module Three), as applicable, of the Standard Contractual Clauses for the transfer of Personal Data to third countries pursuant to Regulation (EU) 2016/679 approved by European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, as currently set out at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj.

"Sub-processor" means a third-party entity that processes Customer Personal Data on behalf of Flatpeak acting as a data processor or a Sub-processor.

"UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, as amended or replaced from time to time.

Terms such as "processing", "data controller", "data processor", "data subject", etc. shall have the meaning assigned to them under the GDPR. The definition of "data controller" includes "business"; "data processor" includes "service provider"; "data subject" includes "consumer"; and "Personal Data" includes "personal information", in each case as defined under the CCPA and other applicable Data Protection Laws. The terms "business purpose", "commercial purpose", "sell" and "share" shall have the same meaning as in the applicable Data Protection Laws and, in each case, their cognate terms shall be construed accordingly.

3. Processing of Customer Personal Data

3.1 Purposes. We will process Customer Personal Data only to the extent necessary (i) to provide the Services, including connecting to energy providers and other Upstream Parties on your or your End-Users' behalf, retrieving and processing tariff, price, meter and device data, calculating costs and plans, delivering data to you via the API and webhooks, ensuring the security of the Services, providing support, troubleshooting and maintenance, and improving and developing the Services in accordance with Section 3.5 of this DPA, in accordance with your documented instructions to us as a data processor as specified in Section 3.2 of this DPA; and (ii) as otherwise required under applicable law. We process Account Data as a data controller as specified in Section 3.4 of this DPA.

3.2 Customer Instructions. The Agreement and this DPA constitute your complete instructions to us as a data processor at the time of entering into this DPA. We will comply with other reasonable documented instructions provided that those instructions are consistent with the terms of the Agreement. We will inform you without undue delay if, in our opinion, an instruction infringes Data Protection Laws. Where we are required by applicable law to process Customer Personal Data other than on your instructions, we will inform you of that legal requirement before processing, unless that law prohibits such information on important grounds of public interest.

3.3 Details of Processing. Annex I, Part B (Description of Transfer) of Appendix I to this DPA specifies the nature and purpose of the processing by us as a data processor or Sub-processor, the processing activities, the duration of the processing, the types of Personal Data, and the categories of data subjects.

3.4 Account Data. We process Account Data as an independent data controller, in accordance with our Privacy Statement, to the extent necessary for the following legitimate business purposes: billing, account management, providing and securing access to the Dashboard and the Services for Users, financial and internal reporting, combatting and preventing security threats, cyber-attacks and cybercrime, fraud and abuse prevention and detection, and complying with our legal obligations. We retain Account Data for the duration of the Agreement and thereafter for as long as required to comply with applicable legal, accounting and tax requirements or to establish, exercise or defend legal claims.

3.5 Improvement of the Services. We may use Customer Personal Data to improve and develop the Services only in anonymised or pseudonymised form. We will not use Customer Personal Data to profile End-Users, or for the benefit of any third party.

4. Customer Obligations

4.1 Lawfulness. Where you act as a data controller of Customer Personal Data, you guarantee that all processing activities are lawful, have a specific purpose, and that any required notices and consents or other appropriate legal basis are in place to enable the lawful transfer of the Customer Personal Data to us. If you are a data processor (in which case we will act as a Sub-processor), you will ensure that the relevant data controller guarantees that the conditions listed in this Section 4.1 are met.

4.2 Compliance. You are solely responsible for (a) ensuring that you comply with the Data Protection Laws applicable to your use of the Services and to your own processing of Customer Personal Data, (b) making an independent assessment of whether the technical and organisational measures of the Services meet your requirements, and (c) implementing and maintaining privacy and security measures for components that you provide or control (including but not limited to API keys, passwords, devices used with the Services and Customer Applications).

5. Security

5.1 Security Measures. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, we shall implement and maintain appropriate technical and organisational security measures to protect Customer Personal Data from Personal Data Breaches and to preserve the security, integrity, availability, resilience and confidentiality of the systems we use to process Customer Personal Data. The security measures applied by us are described in Appendix II.

5.2 Updates to Security Measures. You are responsible for reviewing the information made available by us relating to Customer Personal Data security and making an independent assessment as to whether such information meets your requirements and legal obligations under Data Protection Laws. You acknowledge that the security measures are subject to technical progress and development and that we may update or modify our security measures from time to time, provided that such updates and modifications do not result in the degradation of the overall security of the Customer Personal Data.

5.3 Access Controls. We apply the principles of "need to know" and "least privilege", ensuring that access to Customer Personal Data is limited to those personnel required for the provision of the Services and in line with the Agreement, including this DPA.

5.4 Confidentiality of Processing. We will ensure that any person or party who is authorised by us to process Customer Personal Data (including our personnel, agents and Sub-processors) is informed of the confidential nature of such Customer Personal Data and is under an appropriate obligation of confidentiality (whether a contractual or statutory duty) that survives termination of their engagement.

5.5 Personal Data Breach Response and Notification. Upon becoming aware of a Personal Data Breach, we will, without undue delay, (i) notify you, (ii) investigate the Personal Data Breach, (iii) provide timely information relating to the Personal Data Breach as it becomes known or as it is reasonably requested by you, including, to the extent available, a description of its nature, the categories and approximate number of data subjects and records concerned, its likely consequences, the measures taken or proposed to address it, and a contact point for further information, and (iv) take commercially reasonable steps to mitigate the effects and prevent recurrence of the Personal Data Breach.

6. Assistance

6.1 Data Protection Assistance. We shall provide you with reasonably requested assistance in order to allow you to comply with your obligations under the Data Protection Laws, including the notification of a Personal Data Breach, assessing the appropriate level of security of processing, and assisting you with the performance of a relevant data protection impact assessment. On request, we will also provide reasonable assistance with any prior consultation of a supervisory authority and cooperate with any supervisory authority enquiry or audit relating to your processing of Customer Personal Data; such assistance is provided at your cost, except where it is attributable to our own breach of this DPA.

6.2 Assistance with Rights of Data Subjects. We will provide you with reasonable assistance in order to allow you to comply with your obligations to data subjects who exercise their rights under Chapter III of the GDPR and other Data Protection Laws, including requests for access, rectification, erasure, restriction, portability and objection, including by making available technical measures through the API and Dashboard to access, correct and delete Customer Personal Data. If we receive a request from a data subject relating to Customer Personal Data, we will promptly forward it to you and will not respond to it ourselves, other than to direct the data subject to you, unless required by law. For the avoidance of doubt, you, as the data controller, are responsible for responding to any request or complaint from data subjects with respect to Customer Personal Data.

7. Disclosure and Disclosure Requests

7.1 Limitations on Disclosure and Access. We will not provide access to or disclose Customer Personal Data except (i) as directed by you, (ii) as set out in the Agreement and this DPA, or (iii) as required by law.

7.2 Disclosure Requests. We will notify you as soon as reasonably possible if we receive a request from a governmental or regulatory body to disclose Customer Personal Data unless such notice is prohibited by law. We will handle disclosure requests in accordance with the Data Disclosure Policy.

8. Sub-processors

8.1 Use of Sub-processors. By means of this DPA, you provide a general written authorisation to us to engage Sub-processors for the processing of Customer Personal Data subject to the following requirements:

8.1.1 We will restrict access to Customer Personal Data by Sub-processors to what is strictly necessary to provide the services specified in the Sub-processor agreement;

8.1.2 We will agree upon data protection obligations with the Sub-processor that are substantially the same as the obligations under this DPA; and

8.1.3 We remain liable to you under this DPA for the performance of the data protection obligations of the Sub-processor.

8.2 Sub-processor List. The list of Sub-processors forms an integral part of this DPA and is available at https://flatpeak.com/legal/subprocessors or a successor URL.

8.3 Changes to Sub-processors. We will notify you of any intended addition or replacement of a Sub-processor at least fourteen (14) calendar days before the change takes effect. You may object to the change on reasonable grounds relating to data protection by notifying us at privacy@flatpeak.com within that period, in which case the parties will discuss the objection in good faith.

8.4 Onward Sub-processors. Where a Sub-processor engages its own sub-processors to process Customer Personal Data, the Sub-processor shall ensure that those onward sub-processors are bound by data protection obligations no less protective than those in this DPA.

9. Cross-Border Transfers of Customer Personal Data

9.1 Transfers of Customer Personal Data. We may transfer Customer Personal Data on the condition that all appropriate safeguards required by Data Protection Laws are in place. This may include a prior data transfer impact assessment, the adoption, monitoring and evaluation of supplementary technical, organisational and legal measures, enforceable data subject rights, and that effective legal remedies for data subjects are available.

9.2 Sub-processor Transfers. Unless an adequacy decision or alternative transfer mechanism applies, we have entered into and shall maintain Standard Contractual Clauses (and, for transfers from the United Kingdom, the UK Addendum) with Sub-processors located outside the EEA or the United Kingdom, subject to Section 9.1 of this DPA.

9.3 Transfers to Flatpeak. To the extent your use of the Services requires a transfer mechanism to lawfully export Customer Personal Data from a jurisdiction (e.g. the EEA, Switzerland or the United Kingdom) to Flatpeak, the following transfer mechanisms shall apply and can be directly enforced by the parties to the extent such transfers are subject to Data Protection Laws:

9.3.1 The parties agree that the Standard Contractual Clauses will apply to Customer Personal Data that is transferred via the Services from the EEA, either directly or via onward transfer, to Flatpeak.

9.3.1.1 When you are acting as a data controller, and Flatpeak is a data processor, Module Two (Controller to Processor) of the Standard Contractual Clauses will apply. When you are acting as a data processor and Flatpeak is a Sub-processor, Module Three (Processor to Processor) of the Standard Contractual Clauses will apply.

9.3.1.2 Flatpeak will be deemed the data importer, and you will be deemed the data exporter under the Standard Contractual Clauses. Each party's acceptance of this DPA will be treated as its signature of the applicable Standard Contractual Clauses, which are incorporated into this DPA by reference. The information required for Annex I and Annex II of the Standard Contractual Clauses is set out in Appendix I and Appendix II to this DPA. In the event of any conflict or inconsistency between this DPA and the Standard Contractual Clauses, the Standard Contractual Clauses shall prevail.

9.3.1.3 Where the Standard Contractual Clauses require the parties to choose between optional clauses and to input information, the parties have done so as follows:

• The optional Clause 7 "Docking clause" shall not apply.
• For Clause 9 "Use of sub-processors", Option 2 (General written authorisation) shall apply, and the time period for prior notice of Sub-processor changes shall be fourteen (14) calendar days, as set out in Section 8.3 of this DPA.
• The optional wording in Clause 11(a) "Redress" shall not apply.
• For Clause 13 "Supervision", the competent supervisory authority is as set out in Annex I, Part C.
• For Clause 17 "Governing law", Option 1 shall apply, and the governing law shall be the law of the Netherlands.
• For Clause 18 "Choice of forum and jurisdiction", the courts shall be the courts of the Netherlands.

9.3.2 The parties agree that the UK Addendum will apply to Customer Personal Data that is transferred via the Services from the United Kingdom, either directly or via onward transfer, to Flatpeak in a country that is not recognised under the UK GDPR as providing an adequate level of protection for personal data. For the purposes of the UK Addendum: (i) Table 1 is completed with the information in Annex I, Part A; (ii) Table 2 refers to the Standard Contractual Clauses as incorporated under Section 9.3.1; (iii) Table 3 is completed with the information in Appendix I and Appendix II; and (iv) for Table 4, neither party may end the UK Addendum under its Section 19. In the event of any conflict or inconsistency between this DPA and the UK Addendum, the UK Addendum shall prevail.

10. Audit

10.1 Audit Report. Our Services are regularly audited against security controls aligned with ISO/IEC 27001:2022. The audit may, at our sole discretion, be an internal audit or an audit performed by a third party. We are working towards ISO/IEC 27001:2022 certification, which we expect to achieve in Q2 2027. Upon written request, we will provide you with a summary of the audit report(s) ("Audit Report") so that you can verify our compliance with this DPA. Audit Reports, and any conclusions or findings specified in them, are our Confidential Information.

10.2 Customer Information Requests. We will make available to you all information reasonably necessary to demonstrate compliance with the obligations laid down in this DPA. We will provide written responses to reasonable requests for information made by you, including responses to information security and audit questionnaires that are reasonable in scope and necessary to confirm compliance with this DPA, provided that you (i) have first made a reasonable effort to obtain the requested information from the Documentation, Audit Reports and other information provided or made public by us, and (ii) will not exercise this right more than once per year, unless a Personal Data Breach or a significant change in our processing activities in relation to the Services requires an additional questionnaire. All responses provided are our Confidential Information.

10.3 Customer Audit. If an Audit Report provided by us gives you substantiated reasons to believe that we are in breach of our obligations under this DPA in relation to the Customer Personal Data provided by you, we will allow an independent and qualified third-party auditor appointed by you and approved by us (such approval not to be unreasonably withheld) to audit the relevant Personal Data processing activities, provided that:

• You give us at least sixty (60) days' advance written notice before exercising the right to audit;
• The auditor agrees to market standard confidentiality obligations with us;
• You and the auditor take measures to minimise disruption to our business operations;
• The audit is carried out during regular business hours;
• We are not obliged to provide access to the data of other customers or to systems not involved in the provision of the Services; and
• You pay all the audit costs.

11. Deletion and Return of Customer Personal Data

11.1 During the term of the Agreement, you can delete Customer Personal Data at any time via the API or the Dashboard. Deleting an object also deletes related objects as described in the Documentation (for example, deleting a customer deletes its locations, tariffs and any associated energy provider connection credentials). Deleted Customer Personal Data is marked as deleted and becomes inaccessible immediately, and is permanently removed from our live systems within thirty (30) days. It is retained in backups for no longer than ninety (90) days, after which it is permanently deleted as the backup cycle expires.

11.2 Upon termination or expiration of the Agreement, we will (at your election) delete or return to you all Customer Personal Data (including copies) in our possession or control, save that this requirement will not apply to the extent we are required by law to retain some or all of the Customer Personal Data. Customer Personal Data held in our backup systems will be protected from further processing and permanently deleted within ninety (90) days as the backup cycle expires. This Section 11 does not apply to Account Data, which is retained in accordance with Section 3.4 of this DPA.

11.3 Upon your written request following termination or expiration of the Agreement, we will issue a certificate confirming the deletion of Customer Personal Data from our live systems within thirty (30) days of the request.

12. Customer Affiliate Communication and Rights

Where this DPA is entered into on behalf of a Customer Affiliate as set out in Section 1.2, it constitutes a separate DPA between us and that Customer Affiliate, subject to the following:

12.1 Communication. The Customer that is the contracting party to the Agreement shall remain responsible for coordinating all communication with us under this DPA and be entitled to make and receive any communication in relation to this DPA on behalf of its Customer Affiliates.

12.2 Rights of Customer Affiliates. Where a Customer Affiliate becomes a party to this DPA with us, it shall, to the extent required under Data Protection Laws, be entitled to exercise the rights and seek remedies under this DPA, subject to the following:

(i) Unless Data Protection Laws require the Customer Affiliate to exercise a right or seek a remedy under this DPA against Flatpeak directly by itself, the parties agree that (a) solely the Customer that is the contracting party to the Agreement shall exercise any such right or seek any such remedy on behalf of the Customer Affiliate, and (b) the Customer that is the contracting party to the Agreement shall exercise any such rights under this DPA not separately for each Customer Affiliate individually but in a combined manner for itself and all of its Customer Affiliates together.

(ii) The Customer that is the contracting party to the Agreement shall, when an audit of the procedures relevant to the protection of Customer Personal Data is being carried out on its behalf under Section 10.3 of this DPA, take all reasonable measures to limit any impact on us by combining, to the extent reasonably possible, several audit requests carried out on behalf of itself and all of its Customer Affiliates in one single audit.

For clarity, a Customer Affiliate does not become a contracting party to the Agreement.

13. California Consumer Privacy Act

We make the following additional commitments to you with respect to the processing of Customer Personal Data within the scope of the CCPA.

13.1 Our Obligations. We shall comply with the CCPA and treat all Customer Personal Data subject to the CCPA ("CCPA Personal Data") in accordance with the provisions of the CCPA. With respect to CCPA Personal Data, we are a service provider under the CCPA. We will not (a) sell or share CCPA Personal Data; (b) retain, use or disclose any CCPA Personal Data for any purpose other than for the specific purpose of providing the Services, including retaining, using or disclosing CCPA Personal Data for a commercial purpose other than providing the Services; or (c) retain, use or disclose CCPA Personal Data outside of our direct business relationship with you. The processing of CCPA Personal Data is authorised by your instructions in the Agreement and this DPA and is integral to our provision of the Services. You acknowledge and agree that our access to Customer Data does not constitute part of the consideration exchanged under the Agreement. To the extent that any Account Data is considered CCPA Personal Data, we are the business with respect to such data and will process that data in accordance with our Privacy Statement. Both parties certify that they understand and will comply with the obligations and restrictions set forth in this DPA and the Agreement as required under the CCPA.

13.2 Customer Obligations. You represent and warrant that you have provided any notice to End-Users required under the CCPA in respect of the disclosure of their Personal Data to us. You are responsible for compliance with the requirements of the CCPA applicable to you as a business.

APPENDIX I - DETAILS OF PROCESSING

Where applicable, this Appendix I will serve as Annex I to the Standard Contractual Clauses.

Annex I, Part A. List of Parties

Data exporter: Customer

Data exporter contact details: The address listed in Customer's account, Customer's account owner email address, or the email address(es) at which Customer elects to receive notices under the Agreement.

Data exporter activities: Use of the Services as described in the Agreement.

Data exporter role: Controller or processor, as set out in Section 4 of this DPA.

Signature and date: If and when applicable, the data exporter is deemed to have signed the Standard Contractual Clauses incorporated herein as of the effective date of this DPA.

Data importer: Flatpeak Technology Ltd

Data importer contact details: 25 Luke Street, London, EC2A 4DS, United Kingdom – privacy@flatpeak.com.

Data importer activities: Provision of the Services as described in the Agreement.

Data importer role: Processor (or Sub-processor where the data exporter is a processor).

Signature and date: If and when applicable, the data importer is deemed to have signed the Standard Contractual Clauses incorporated herein as of the effective date of this DPA.

Annex I, Part B. Description of Transfer

1. Categories of data subjects whose Personal Data is transferred: End-Users. Any individual (i) whose information is stored on or collected via the Services, or (ii) whose energy provider accounts, locations, meters or devices are connected to the Services by or for the Customer (collectively, "End-Users"). You, as the Customer, solely determine the categories of data subjects whose Personal Data is submitted to the Services. Personal Data of Users and other Account Data is processed by Flatpeak as a data controller in accordance with Section 3.4 of this DPA and is not covered by this Annex.
2. Categories of Personal Data transferred: Customer Personal Data contained in End-User data, energy data, connection data and customer usage data. End-User data, such as reference identifier, first name, last name, email address, phone number, address, postcode, country and geographic coordinates. Energy data, such as energy provider, account and contract details, tariff and rates, bills or other documents provided to identify tariff information, meter identifiers and meter records, and device identifiers, state, settings and telemetry (including VPP enrolment, event and reward data). Connection data, such as credentials, tokens and consent records used to connect to an End-User's energy provider account or other Upstream Party. Customer usage data, such as statistical data relating to the use of the Services in respect of End-Users, and API request logs and IP addresses.
3. Sensitive data transferred (if applicable) and applied restrictions or safeguards that fully take into consideration the nature of the data and the risks involved, such as for instance, strict purpose limitation, access restrictions (including access only for staff having followed specialised training), keeping a record of access to the data, restrictions for onward transfers or additional security measures.

• End-User data and energy data. No special categories of Personal Data are required to provide the Services. Energy consumption and device data can indicate when a property is occupied; this data is protected by the measures described in Appendix II.

• Connection data and customer usage data. No sensitive data is contained in connection data or customer usage data.

4. The frequency of the transfer (e.g. whether the data is transferred on a one-off or continuous basis): Customer Personal Data is transferred on a continuous basis for the duration of the Agreement.
5. Nature of the processing: We will process Customer Personal Data to the extent necessary to provide the Services under the Agreement. We do not sell any Personal Data, including Customer Personal Data, and do not share Personal Data with third parties for compensation or for those third parties' own business interests.
6. Purpose(s) of the data transfer and further processing: We will process Customer Personal Data as a data processor in accordance with instructions of Customer as set forth in this DPA unless the processing is necessary for compliance with a legal obligation to which we are subject, in which case we will classify as a data controller.

End-User data, energy data, connection data and customer usage data. Personal Data contained in End-User data, energy data, connection data and customer usage data will be subject to the following basic processing activities:

(a) Energy data. The provision of energy data products and services, offered in the form of application programming interfaces (APIs) or via the Dashboard, to Customer, including retrieval of data from energy providers and other Upstream Parties, calculation of prices, costs and plans, and transmittal to or from Customer's software application from or to our platform.

(b) Connection data. Connection data is processed for the purpose of connecting to an End-User's energy provider account or other Upstream Party on the Customer's or End-User's behalf, and retrieving data from it.

(c) End-User data. Personal Data of End-Users is required in order to perform the Services and will only be processed for the purposes of providing the Services, customer support, and ensuring compliance with legal obligations of Flatpeak.

(d) Customer usage data. Personal Data contained in customer usage data will be subject to the processing activities of providing the Services under the Agreement, with the aim of providing the Customer with Services-related insights and analytic reports regarding use of the Services and customer support, and, in anonymised or pseudonymised form only, continuous improvement of the Services in accordance with Section 3.5 of this DPA.

7. The period for which the Personal Data will be retained, or, if that is not possible, the criteria used to determine that period:

(a) Energy data and connection data. Energy data and connection data are retained for the duration of the Services, except if you delete them via the API or the Dashboard. Deleted data is permanently removed from our live systems within thirty (30) days and from backups within ninety (90) days, in accordance with Section 11 of this DPA.

(b) End-User data. End-User data will be processed for the duration determined by the Customer; by default it is retained for the duration of the Services, subject to paragraph 6(c) of this Annex I, Part B, and deleted in accordance with Section 11 of this DPA.

(c) Customer usage data. Customer usage data is deleted or returned in accordance with Section 11 of this DPA, save that anonymised data, which is no longer Personal Data, may be retained. API request logs and IP addresses are retained for up to six (6) months.

Annex I, Part C. Competent Supervisory Authority

For transfers subject to the EU GDPR: where the data exporter is established in an EU Member State, the supervisory authority of that Member State; where the data exporter is not established in the EU but falls within the territorial scope of the EU GDPR and has appointed a representative, the supervisory authority of the Member State in which the representative is established; otherwise, the supervisory authority of the Member State in which the relevant data subjects are located.

For transfers subject to the UK GDPR: the UK Information Commissioner's Office (ICO).

APPENDIX II TO THE STANDARD CONTRACTUAL CLAUSES

Where applicable, this Appendix II will serve as Annex II to the Standard Contractual Clauses. The following provides more information regarding our technical and organisational security measures set forth below.

Technical and Organisational Security Measures:

Measures of pseudonymisation and protection of Personal Data in storage and transit: All Personal Data is encrypted in transit and at rest and, to the extent relevant from a security standpoint, treated as if it were classified as sensitive data. Information is always transmitted over TLS with up-to-date encryption methodologies by default. Energy provider connection credentials and tokens are stored encrypted.

Measures for ensuring ongoing confidentiality, integrity, and availability and resilience of processing systems and services: we enter into agreements that contain confidentiality provisions with our employees, contractors, vendors, and Subprocessors. Our business continuity policy is to prepare our business and services in the event of extended outages caused by factors beyond our control and to restore services to the widest extent possible in a minimum time frame. We understand the services we provide are mission-critical to our customers and, therefore, have very little tolerance for service disruptions. Our timeframes for recovery are designed to ensure we can meet our obligations to all of our customers.

Processes for regular testing, assessing and evaluating the effectiveness of technical and organisational measures in order to ensure the security of processing: The goal of information security and our Information Security Management System (ISMS) is to protect the confidentiality, integrity and availability of information to the organisation, employees, partners, customers and the (authorised) information systems, and to minimise the risk of damage occurring by preventing security incidents and managing security threats and vulnerabilities. Our Legal Team, Data Protection Officer, and Security and Compliance Team make sure that applicable regulations and standards are factored into our security frameworks.

Measures for user identification and authorisation: We follow principles of "need to know" and "least privilege". We promote the use of role-based access control. Provisioning and de-provisioning are overseen by the security team, with Single-Sign-On and 2FA by default. Owners have been defined for each information asset who is responsible for ensuring access to their systems is appropriate and reviewed on a regular basis. Whenever dealing with sensitive information or taking critical action, we use the four-eyes principle.

Measures for ensuring event logging: Audit logs are centrally stored and monitored on a regular basis for security events and are kept secure to avoid the risk of tampering. The Incident Management Policy enforces the incident response plan and its procedures. These guidelines are being followed if any type of security or technical incident occurs. In the event that there are Security incidents, they will be reviewed regularly by the Security Steering Committee, which consists of senior stakeholders from across the business.

Measures for ensuring system configuration, including default configuration: We follow a consistent change management process for all changes to the production environment of the Services. To elaborate further, all requests for changes (RFC) need to be approved by a designated party and executed according to the formal change control process. The control process ensures that changes proposed are reviewed, authorised, tested, implemented, and released in a controlled manner; and that the status of each proposed change is monitored. Configuration baselines are followed to securely configure the systems by following best practices. Also, within the Engineering department, a tech radar is used to define which technologies (languages, platform tools, databases and data management tools) can be adopted or need to be avoided during development.

Measure for physical security: We actively promote a "Work from Anywhere" policy so our employees are free to work from any place they want. However, we still have our office premises. We have no secure areas/data centre on our premises as we are a completely cloud-based company. Our office floors are protected by physical access controls, CCTV, and manned security.

Measures for internal IT and IT security governance and management: We maintain a risk-based assessment security programme, which includes administrative, organisational, technical, and physical safeguards designed to protect the Services and confidentiality, integrity, and availability of Customer Data. Our information security programme is set up in a systematic and well-organised way. In addition, legal and regulatory requirements apply to ensure the confidentiality, integrity, and availability of information to the organisation, employees, partners and customers. All these are translated into our information security policies, procedures and guidelines. We have a Security Steering Committee, which is responsible for the tactical level of information security. This entails the coordination of information security activities and the translation of strategic activities to operational activities for our security, and our continuous maintenance of regulatory compliance. All employees are responsible for safeguarding company assets. All our employees are screened for expertise, experience, and integrity. Employees are informed about security and data protection at the onboarding stage, as well as by way of regular team-specific training and other company-wide all-hands presentations about the importance of data protection and security compliance.

All our hosting providers are ISO/IEC 27001 certified.

Measures for certifications/assurance of processes and products: Our security controls are regularly audited as described in Section 10.1 of this DPA, and we regularly execute application vulnerability and penetration testing. We are working towards ISO/IEC 27001:2022 certification, which we expect to achieve in Q2 2027. Flatpeak takes a unified approach to patch and vulnerability management to ensure that our standard SLA timelines are maintained, whether vulnerabilities exist in our underlying infrastructure, operating platforms, or source code.

Measures for the protection of test data: Production Customer Personal Data is not used in development or testing environments. Where testing requires realistic data, the data is anonymised or pseudonymised.

Measures for application security: We ensure the security of our applications during the design and development phase based on the Flatpeak Secure Code Guidelines:

• Appropriate corrections are implemented prior to release;
• Code changes are reviewed by skilled individuals (who are familiar with code review and secure development) other than the originating developers;
• Code reviews are performed to ensure code is developed according to secure coding guidelines such as OWASP;
• Applications will undergo rigorous application security testing to identify any new threats and vulnerabilities at least annually and following major releases (in accordance with industry standards and best practices);
• All code changes for applications that are pushed to production environments are reviewed using manual and/or automated processes.

Penetration tests are conducted annually and following major releases. Automated source code analysis tools are being used to detect security defects in code prior to deployment, based on the language.

Measures for vulnerability disclosure: We appreciate security researchers who have found vulnerabilities on our platform contacting us and sending their findings to security@flatpeak.com. We have a dedicated security team that follows up and sends invitations to our bug bounty programme to investigate and remediate where necessary.

Measures for ensuring accountability: We implement information security and data protection policies in accordance with applicable laws. We have appointed a dedicated Compliance and Information Security and a Data Protection Officer and maintain documentation of our processing activities, including recording and reporting security incidents involving Personal Data where applicable.