Agreement

SmartCap Consultation Service Agreement This SmartCap Consultation Service Agreement (hereinafter the Agreement) is entered into on the date of its signing by all parties hereto and is made by and between: (1) AS SmartCap, registered under the laws of Estonia with registry code 12071991, and having its registered office at Sepise 7, 11415 Tallinn, Estonia (hereinafter SmartCap), represented by the member of the management board Sille Pettai; and (2) Riigi Kaitseinvesteeringute Keskus, registered under the laws of Estonia with registry code 70009764, and having its registered office at Järve 34a, 11314 Tallinn, Estonia (hereinafter RKIK), represented by the deputy director general Katri Raudsepp. SmartCap and RKIK also referred to separately as a Party, and together as the Parties. WHEREAS: A. RKIK has announced a selective tender (hereinafter the Tender) to support the development of the Estonian defence and security sector by allowing the use of a site of ca 8900 m2 and up to seven storage facilities on the property located in Ämari Airport, Lääne-Harju Parish, Harju County for the performance of the activities specified in 8333 (1) section 6 of the Weapons Act, pursuant to the terms and conditions of the Tender (provided in Attachment 1 of this Agreement; hereinafter the Terms); B. RKIK shall establish a committee consisting of 6 experts (hereinafter the Committee) who shall evaluate the bids submitted to the Tender by the bidders pursuant to Section 4.2 of the Terms (hereinafter the Bidders); C. The Committee performs certain tasks during the selection process of the Tender as set out in the Terms. RKIK has requested from SmartCap, and SmartCap has agreed, to appoint its representative(s) (hereinafter the Representative) to provide their professional expertise and advice to the Committee when evaluating certain elements of the bids stipulated in the Terms during the selection process of the Tender; D. In the course of the performance of this Agreement, SmartCap and the Representative may have access to certain confidential information of RKIK and/or the Bidders that they wish to keep confidential, including trade secrets, actual and proposed business plans and projects, financial and pricing information, strategies and policies, and other material information; E. The Parties wish to agree on the details of providing the consultation service to the Committee and the performance of the subsequent obligations. NOW, THEREFORE, the Parties have entered into this Agreement on the following terms and conditions: 1. ASSIGNMENT 1.1. The subject matter of the Agreement is the rights, obligations and other terms and conditions of the Parties when performing the Assignment (as defined below), including the requirements for the full protection of confidential information. 1.2. SmartCap shall appoint its employee(s) as Representative(s) who shall provide their professional expertise, advice, or opinion to the Committee in evaluating the action plans of the bids submitted to the Tender by the Bidders (hereinafter the Assignment). 1.3. SmartCap hereby represents and warrants to RKIK that in performing the Assignment, the Representative: 1.3.1. acts exclusively and personally; 1.3.2. acts loyally, with due diligence, and to the best of their ability, using their best professional knowledge and experience, and performs the Assignment in a competent, professional and independent manner in accordance with the standards and practices that are generally accepted in the industry;  2 1.3.3. is bound by and complies with the objective of the Tender of supporting the development of the Estonian defence and security sector by giving the opportunity to use state infrastructure for the performance of the activities specified in 8333 (1) section 6 of the Weapons Act; 1.3.4. avoids all situations of conflict of interest with regard to RKIK and immediately informs RKIK as well as the Committee, if a potential or actual conflict of interest exists, and refrains from participating in any action relating the respective matter; 1.3.5. partiipates in the work of the Committee by participating in Committee meetings, as necessary. 1.4. The meetings of the Committee shall be held at RKIK’s premises or at such other place or in such other manner as RKIK may determine. 1.5. The tasks of the Assignment that require individual work from the Representative may be performed at any time at the discretion of the Representative. 1.6. SmartCap or the Representative shall not be liable for any direct or indirect damages arising out of or in connection with the expertise and advice provided in the course of the Assignment, or for the outcome of the Tender, including for any appeal, dispute or legal action that may arise from the Tender. RKIK expressly agrees and warrants that it shall not have, and hereby waives, any claims, demands, or right of recourse, including damages, losses, or liabilities, against SmartCap or the Representative in connection with the Assignment, irrespective of the legal basis of such claims. 1.7. RKIK must notify SmartCap immediately of circumstances related to this Agreement that affect or might affect the rendering of the Assignment. 1.8. The Parties acknowledge that the performance of the Assignment may involve the processing of personal data. By signing this Agreement, the Parties agree that if any personal data is required to be processed for performing the Assignment, such data shall be processed in accordance with the Data Processing Agreement outlined in Attachment 2. All relevant clauses of this Agreement shall also apply to the Data Processing Agreement, where applicable. 2. FEE 2.1. SmartCap shall not receive a fee for the Assignment performed under this Agreement. 2.2. RKIK may reimburse the necessary expenses incurred by SmartCap in connection with the performance of the Assignment, if the Parties so agree. 3. INTELLECTUAL PROPERTY 3.1. If in the course of performing the Assignment any intellectual property is created, including by way of drafting emails, memos, or other documents containing analysis and advice regarding the Assignment, then: 3.1.1. SmartCap shall retain the exclusive ownership of all works protected by copyright or similar rights, including all moral and economic rights to all the materials and works created by the Representative in connection with the Assignment; and 3.1.2. SmartCap shall grant to RKIK a non-exclusive license for an unspecified term with sublicensing right to all economic rights to all the materials and works created by the Representative in connection with the Assignment. 4. CONFIDENTIALITY OBLIGATION 4.1. For the purposes of this Agreement “Confidential Information” means (a) the existence and the terms of this Agreement and (b) any information relating to a Party or a Bidder that the other Party receives as a result of entering into or performing this Agreement and that, at the time of disclosure, is designated as being confidential or that would be regarded as confidential or commercially sensitive by a reasonable person. Confidential Information shall not, however, include information that (a) is, or that becomes (other than through a breach of this Agreement), available to the public generally without requiring a significant expenditure of labour, skill or money; (b) is, at the time of disclosure, already known to the receiving Party without restriction on disclosure; (c) is, or subsequently comes, into the AS SMARTCAP Sepise 7, 11415 Tallinn, Estonia [email protected] Registry code 12071991 www.smartcap.ee  3 possession of the receiving Party without the violation of any obligation of confidentiality; (d) is explicitly approved for release by the disclosing Party or the Bidder at least in a form reproducible in writing; (e) a Party is required to disclose under any laws or regulations or by any public authority to which such Party is subject or submits, or by any court order. 4.2. Both Parties shall treat Confidential Information as confidential and shall not use or disclose it to any third party or enable any third party to become aware of it. Notwithstanding the foregoing, a Party may disclose Confidential Information to its attorneys, accountants, consultants and other professional advisors to the extent necessary to obtain their services, provided that they are subject to the same confidentiality obligations as the relevant Party. The obligations set forth in this Section 4 shall apply for the period of two years from the signing date of this Agreement. 5. TERM AND TERMINATION OF THE AGREEMENT 5.1. The Parties have agreed that the Agreement shall enter into force from its signing and shall be valid for an indefinite period. 5.2. Either Party may terminate the Agreement at any time without prior notice in a form enabling written reproduction. 5.3. Upon termination of the Agreement, the rights and obligations arising from it, which due to their nature are applicable after the termination of the Agreement, shall remain in force. 6. FINAL PROVISIONS 6.1. Any communication for all matters related to this Agreement, including materials or other exchange of information subject to this Agreement or part of the Assignment, unless otherwise required under the applicable law, is deemed duly delivered to and received by the Parties if made in writing to the contact person of the respective Party. The contact persons are: 6.1.1. for SmartCap Sille Pettai, e-mail address [email protected]; 6.1.2. for RKIK Tambet Tõnisson, e-mail address [email protected]. A Party may change its contacts provided above by notifying the other Party about the change beforehand and providing them with the new contact details. 6.2. The invalidity or enforceability of any provision of this Agreement shall not affect the validity or enforceability of any other provision hereof. If any provision proves to be invalid or unenforceable, the Parties shall use all reasonable endeavours to replace the relevant provision with a new, lawful and/or enforceable provision closest to the material substance of the original provision. 6.3. No amendment to the Agreement shall be effective unless formalised in writing and signed by both Parties. 6.4. The Parties shall endeavour to settle any disputes arising from the Agreement by way of negotiations. If any dispute arising out of or in connection with the Agreement cannot be resolved by negotiations within a reasonable period of time, the dispute shall be settled by the Harju County Court. 6.5. The Agreement is governed by Estonian law. 6.6. This Agreement may be executed in any number of counterparts, each of which shall constitute an original, and all the counterparts shall together constitute one and the same agreement. By and behalf of RKIK: By and behalf of SmartCap: /digitally signed/ /digitally signed/ Riigi Kaitseinvesteeringute Keskus AS SmartCap Katri Raudsepp Sille Pettai Deputy Director General Member of the management board AS SMARTCAP Sepise 7, 11415 Tallinn, Estonia [email protected] Registry code 12071991 www.smartcap.ee  4 Attachment 1 – Terms and conditions of the selective tender Provided in a separate file. Attachment 2 – Data Processing Agreement 1. The Parties acknowledge that performing the Assignment may require the processing of personal data. In such case SmartCap shall be considered the Processor, and RKIK shall be considered the Controller. 2. In this Data Processing Agreement, the following words and expressions shall, unless the context otherwise requires, have the following meanings: 2.1. “Processing” – any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; 2.2. “Personal Data” – any information relating to an identified or identifiable natural person (e.g., name, personal identification code, job title, previous job experiences, education, etc.); 2.3. “Data Protection Laws” – the GDPR and other domestic legislation of the Member State regulating data protection; 2.4. “GDPR” – EU General Data Protection Regulation 2016/679; 2.5. “Sub-processor” – another data processor engaged by the Processor when processing personal data on behalf of the Controller; 2.6. “Personal Data Breach” – a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored, or otherwise processed. All other capitalized terms used and not defined herein shall have the same meanings assigned to them in the Agreement. 3. The description of the Processing of Personal Data is as follows: 3.1. Types of Personal Data that may be Processed: name and surname, phone number, home and work address, email address, information contained in personal identification documents (date of birth, personal identification code, nationality, gender, document number, etc.), information about education and professional qualifications, employment records (including current and previous job titles, employment history, performance reviews, professional licenses and professional recommendations or reference calls), professional or volunteer engagements, personal financial information (including personal investments, shareholdings and ownerships, bank statements, proof of income or salary information, loan records, and payment history), legal records (including criminal and arrest records, civil court records, and records or information about misdemeanours or other offenses), memberships and affiliations, and owned IP rights. 3.2. Data subjects whose Personal Data may be Processed: the employees of SmartCap, and the representatives and beneficial owners of SmartCap. 3.3. Processing activities: accessing, reading, analysing, combining, and transferring of Personal Data. 3.4. Objective of the Processing: the objective of the Controller in Processing the Personal Data is to carry out the Agreement. 4. The Processor shall: 4.1. comply with all applicable Data Protection Laws when Processing the Personal Data; 4.2. not Process Personal Data other than on the relevant Controller’s documented instructions; AS SMARTCAP Sepise 7, 11415 Tallinn, Estonia [email protected] Registry code 12071991 www.smartcap.ee  5 4.3. not engage a Sub-processor without prior written authorisation of the Controller. Where any Sub- processors are engaged for carrying out specific Processing activities, the same data protection obligations as set out in this Data Processing Agreement shall be imposed on that Sub-processor by way of a contract or other legal act under EU or relevant EU member state law, in particular providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that the Processing will meet the requirements of the GDPR. Where the Sub-processor fails to fulfil its data protection obligations, the Processor shall remain fully liable to the Controller for the performance of that Sub-processor; 4.4. not transfer Personal Data outside European Economic Area or to any international organisations, unless required to do so by EU or relevant EU member state law to which the Processor is subject. In such a case, the Processor shall inform the Controller of that legal requirement before Processing, unless that law prohibits such information on important grounds of public interest; 4.5. ensure that persons authorised to Process the Personal Data, including the staff members or the Processor (if relevant), have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality; 4.6. take all relevant technical measures pursuant to Section 5 below; 4.7. assist the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests for exercising the data subject's rights; 4.8. notify about any Personal Data Breach to the Controller at least within 48 hours after the detection of the Personal Data Breach; 4.9. assist the Controller in ensuring compliance with the security of Processing, detection and notification of the Personal Data Breach, data protection impact assessment obligations pursuant to Articles 32 to 36 of the GDPR taking into account the nature of Processing and the information available to the Processor; 4.10. at the choice of the Controller, delete or return all the Personal Data to the Controller after the end of the provision of services relating to Processing, and delete existing copies unless EU or relevant EU member state law requires storage of the Personal Data; 4.11. make available to the Controller all information necessary to demonstrate compliance with this Data Protection Agreement and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller; 4.12. immediately inform the Controller if, in its opinion, an instruction infringes GDPR or other Data Protection Laws. 5. Processor shall apply at least the following security measures when Processing Personal Data: • ensure that devices used for Processing Personal Data are equipped with anti-malware software; • ensure that devices used for Processing Personal Data are not accessible to third parties who do not have the right to Process Personal Data, e.g., apply two-factor authentication, strong passwords; • do not make copies or extractions of Personal Data outside Controller’s relevant database or premises without prior consent of the Controller; • ensure the devices or programs used for Processing Personal Data are equipped with the ability to restore the Personal Data, track the Processing activities and delete Personal Data; • in case it is necessary to store or transfer Personal Data, apply encryption and if necessary and appropriate, use pseudonymisation of the Personal Data. AS SMARTCAP Sepise 7, 11415 Tallinn, Estonia [email protected] Registry code 12071991 www.smartcap.ee