EU Data Act addendum

September 2025

This EU Data Act Addendum (“Addendum”) governs all switching and/or deletion requests made by Client pursuant to Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 concerning harmonized rules on fair access to and use of data (the “Data Act”).

This Addendum supplements and forms an integral part of the Subscription Agreement between WithSecure and Client or any other agreement governing Client’s use of the Services (“Agreement”). This Addendum applies only to Clients headquartered and billed within the European Union.

1 Definitions

Unless otherwise stated herein, capitalized terms shall have the meaning given in the Agreement.

“Customer Data” means exportable data and digital assets necessary for the implementation of the Client’s data in a new environment, excluding any Exempted Data.

“Exempted Data” means any data that is excluded from the scope of Customer Data, including but not limited to (a) data relating to the internal operations or functionality of the Services, (b) data protected by intellectual property rights pursuant to the Agreement, and (c) data that constitutes a trade secret of WithSecure or any third party.

“Notice Period” means the minimum two (2) month period following WithSecure’s receipt of a valid Switching Notice.

“Services” means the Data Processing Services provided by WithSecure under the Agreement.

“Switching” means the process initiated by the Client to either (a) change to a different provider of Data Processing Services, (b) migrate to an on-premises ICT infrastructure, or (c) erase Customer Data.

“Switching Notice” means the written notification submitted by the Client to WithSecure indicating its intention to initiate a Switching process.

“Transitional Period” means the thirty (30) calendar day period following the expiry of the Notice Period during which WithSecure enables the Switching process. The Client has the right to extend the Transitional Period once by notifying WithSecure in writing before its expiry.

2 Switching Request

Client may submit a Switching Notice to WithSecure indicating its intention to:

a) Switch to a different provider of Data Processing Services;

b) Switch to an on-premises ICT infrastructure; or

c) Erase its Customer Data.

A third party authorized by the Client may submit the Switching Notice and carry out the Switching process, provided it includes verifiable proof of authorization.

The Switching Notice must specify:

a) The relevant Services and Customer Data;

b) The intended destination (alternative provider or on-premises infrastructure); and

c) Whether the Client seeks erasure only.

Once WithSecure has received the Switching Notice, WithSecure shall evaluate whether the Switching Notice qualifies to initiate the Switching process as set out in the Data Act.

3 Switching Process

Upon expiry of the Notice Period, WithSecure shall enable the requested Switching without undue delay during the Transitional Period, unless technically unfeasible. In such cases, WithSecure shall notify the Client within fourteen (14) business days, explaining the reasons and proposing a revised Transitional Period not exceeding seven (7) months.

WithSecure shall:

a) Provide reasonable assistance to the Client and authorized third parties;

b) Act with due care to maintain business continuity;

c) Inform the Client of known risks to continuity;

d) Ensure high-level data security during transfer and retrieval;

e) Support the Client’s exit strategy with relevant documentation;

f) Allow data retrieval for at least thirty (30) calendar days after the Transitional Period;

g) Fully erase Customer Data after the Transitional Period or a later agreed date.

In order to complete the Switching process, the Client shall: (i) extract the Customer Data; (ii) cease use of the Services; and (iii) remove the WithSecure Solution from the Client’s environment during the Transitional Period. The Client shall notify WithSecure in writing upon completion of the Switching process. If the Client fails to complete the steps of the Switching process and/or provide the completion notice by the end of the Transitional Period, the Switching process shall be deemed lapsed.

4 Switching Charges

For Switching Notices submitted prior to 12 January 2027, if the Switching process involves a disproportionate amount of work due to circumstances not attributable to WithSecure, WithSecure shall be entitled to invoice the Client for reasonable switching charges in accordance with its standard support fees.

5 Termination

The Agreement shall automatically terminate:

a) Upon completion of the Switching process; or

b) At the end of the Notice Period, if the Client opts only for erasure.

Termination does not relieve the Client of payment obligations for Services rendered prior to the termination date. Any remaining subscription fees shall be payable as an early termination fee. WithSecure shall continue providing Services until the termination date or end of the subscription term, whichever is earlier.

6 Miscellaneous

In the event of any conflict or inconsistency between the Agreement and this Addendum, the terms of this Addendum will control over the Agreement.