MUTUAL NON-DISCLOSURE AGREEMENT

Mutual confidentiality agreement (NDA)

Document: TC-COM-NDA Version: 1.0 Effective date: September 28, 2026 Site: https://tinycio.com

TinyCIO Inc., a Wyoming corporation (EIN 37-2015210), with principal office at 1309 Coffeen Avenue STE 1200, Sheridan, WY 82801, USA (“TinyCIO”), and the person who accepts this Agreement (a customer, a partner or a person providing a 1C database for assessment) (the “Counterparty”), together the “Parties,” agree as follows.

1. Subject matter

1.1. The Parties undertake to keep confidential the Confidential Information received from each other in preparing and performing agreements, in providing “1C:Enterprise” databases, files and access, and in assessing tasks.

1.2. This Agreement applies whether or not a principal agreement has been concluded between the Parties: it may be accepted before a database is provided or before negotiations begin.

2. Confidential Information

2.1. Confidential Information means information in any form disclosed by one Party to the other, including:

• 1C databases, their copies and exports, and the information they contain;
• the Counterparty's files, documents, reports and correspondence;
• logins, passwords, keys and other credentials for access to databases and systems;
• commercial, financial and technical information, and information about customers and business partners;
• personal data contained in the information disclosed.

2.2. Confidential Information does not include information that: is publicly available through no fault of the receiving Party; was known to it before receipt; was developed by it independently without use of the information received; or was received from a third party without an obligation of confidentiality.

3. Obligations of the Parties

3.1. To use Confidential Information only for the purposes for which it was disclosed.

3.2. To give access to it only to those employees and engaged persons who need it for those purposes and who are bound by confidentiality obligations no less protective than those of this Agreement.

3.3. To protect the information with measures no less strict than those the Party uses to protect its own confidential information: access control, encryption of credentials in storage and in transit, and access logging.

3.4. Not to copy the information beyond what is necessary. Copies of 1C databases created by TinyCIO to perform tasks are kept in an isolated environment and deleted after the task is completed, within the periods set by TinyCIO's internal rules.

3.5. To notify the other Party without delay of any unauthorized access to Confidential Information that comes to its knowledge.

4. Credentials for access to databases

4.1. Logins and passwords provided by the Counterparty for access to 1C databases are stored by TinyCIO in encrypted form, are not displayed in interfaces and are used only to perform the Counterparty's tasks.

4.2. At the Counterparty's request, and after completion of the work for which they were provided, the credentials are deleted.

5. Processing using AI

5.1. When TinyCIO's AI staff perform tasks, the fragments of Confidential Information necessary for the task may be processed by artificial intelligence models of third-party providers engaged by TinyCIO, on terms that ensure confidentiality. TinyCIO transfers only the data necessary for the task and does not transfer credentials.

5.2. Where such information contains personal data of data subjects in the EEA or the United Kingdom, these providers act as sub-processors, and any transfer outside the EEA/UK is made with appropriate safeguards (in particular, standard contractual clauses), in accordance with the Data Processing Addendum (TC-COM-DPA).

6. Disclosure required by law

6.1. A Party may disclose Confidential Information upon a lawful request of a public authority to the extent of such request, notifying the other Party unless prohibited by law.

7. Term and return of information

7.1. This Agreement enters into force upon acceptance (by ticking the box in the Customer Portal, at sign-up or by signature) and remains in force for the entire duration of the Parties' relationship and for 3 (three) years after it ends. Obligations regarding personal data remain in force until such data are destroyed.

7.2. When the relationship ends, or at the request of the disclosing Party, the other Party deletes or returns the Confidential Information within 30 (thirty) days, except for information that must be retained by law and for backups deleted in the course of their scheduled rotation.

8. Liability and disputes

8.1. A Party that breaches this Agreement compensates the other Party for the actual damage caused by the breach.

8.2. This Agreement is governed by the laws of the State of Wyoming, USA. Disputes are resolved in accordance with Section 12 (Governing law; dispute resolution; arbitration) of the TinyCIO Terms of Service (TC-COM-TOS-MAIN), which applies to this Agreement accordingly, including where no other agreement has been concluded between the Parties.

9. Miscellaneous

9.1. At the Counterparty's request, this Agreement may be executed as a separate paper document or signed electronically; its content does not change.

9.2. TinyCIO's details: TinyCIO Inc. (Wyoming, USA), EIN 37-2015210, 1309 Coffeen Avenue STE 1200, Sheridan, WY 82801, USA, we@tinycio.com.