Terms of Service of NoCFO Oy

These terms and conditions ("Agreement" or "Terms") govern the use of the financial management SaaS service ("Service") provided by NoCFO Oy ("NoCFO", Business ID 3149769-7). By using the Service, the Customer agrees to comply with these Terms and to act in accordance with applicable law and good practice. The Terms are accepted by logging into the Service.

1. Scope

This Agreement applies to the provision of the Service to the Customer. The Agreement enters into force when the Customer starts using the Service. The Agreement applies to all features and use of the Service unless otherwise agreed in writing between the parties.

2. Definitions

Customer: A person or organization using the Service.

Service: The accounting and financial management SaaS service developed and maintained by NoCFO.

Company Account: The Customer account created when onboarding the Service.

User: A person authorized by the Customer to use the Service.

Parties: NoCFO and the Customer.

DPA: The Data Processing Agreement appendix to the Agreement.

3. NoCFO's Rights and Obligations

NoCFO is responsible for providing the Service in accordance with these Terms and may use subcontractors where necessary.

NoCFO has the right to modify the content and features of the Service without separate notice, to continuously develop the Service, and to make technical or operational changes to it. Interruptions or changes in the Service may occur due to development or maintenance work. NoCFO is not liable for damages caused to the Customer but will endeavor to provide advance notice of significant service interruptions where possible.

NoCFO may restrict or prevent the Customer's access to the Service if the Customer jeopardizes the operation, security, technical reliability, lawful use, or development of the Service, or materially breaches its contractual obligations, including payment obligations.

NoCFO's experts may provide guidance regarding the use of the Service and financial administration matters. The Customer is responsible for any actions taken based on such guidance within or outside the Service. NoCFO Oy is not liable for the correctness of such guidance or advice.

NoCFO has the right to process data stored in the Service, such as receipts, vouchers, invoices, bank statement data, bank transactions, customer register information, and other financial data, for purposes of analyzing, developing, automating, and improving the quality of the Service.

Such processing is based on the Agreement, NoCFO's legitimate interest in developing and maintaining the Service, and the DPA appendix governing all processing of personal data carried out on behalf of the Customer.

NoCFO may discontinue the Service by notifying the Customer at least three (3) months before termination of the Service.

4. Customer's Rights and Obligations

The Customer has the right to use the Service in accordance with these Terms. The Customer must review the Terms before using the Service and ensure that use of the Service complies with applicable law and good practice.

The Customer is responsible for:

• The accuracy and up-to-dateness of the information entered into the Service.
• Managing and securing access rights granted to Users.
• All actions performed using the Company Account credentials.
• The functionality and security of its own devices and internet connections.

With regard to personal data stored in the Service, the Customer acts as the data controller and NoCFO acts as the data processor. Such processing is governed by the DPA appendix to the Agreement.

The Customer is responsible for ensuring that materials stored in the Service do not infringe third-party rights or violate applicable legislation.

The Customer is responsible for notifying NoCFO of any errors detected in the Service.

The Customer may use third-party services integrated into or offered through the Service, such as payment services, e-invoicing services, or other external interfaces. By using such services, the Customer accepts the applicable terms and conditions of the relevant third parties and is responsible for complying with them. NoCFO is not responsible for the content, operation, or availability of third-party services.

5. Pricing and Payment Terms

Current prices and payment methods are available on NoCFO's website.

NoCFO may change the pricing of service packages by notifying Customers in advance. Prices for transaction-based products and services, such as e-invoices and payroll services, may change regardless of the Customer's selected service package or billing period. Current pricing is always available on NoCFO's website.

Fees are charged either in advance or in arrears according to the selected service level.

The minimum monthly invoice amount is EUR 10. Smaller invoices may be charged quarterly.

Applicable VAT will be added to service prices. Late payment interest is determined in accordance with the Finnish Interest Act. When paying by invoice, the payment term is fourteen (14) days from the invoice date.

NoCFO does not provide refunds for partial billing periods, unused service time, or retroactive cancellations unless required by mandatory law.

Third-party payment service providers may be used for payment processing.

6. Intellectual Property Rights

All intellectual property rights relating to the Service and all related materials, software, user interfaces, databases, models, documentation, and other content belong exclusively to NoCFO or its licensors. The Customer is granted only a limited right to use the Service in accordance with these Terms.

The Customer may not copy, modify, reproduce, sell, rent, sublicense, transfer, publish, translate, reverse engineer, decompile, or otherwise attempt to derive the source code of the Service unless permitted by mandatory law.

7. Confidentiality

"Confidential Information" means all information designated as confidential or that should reasonably be understood to be confidential by its nature.

Both Parties shall keep confidential all Confidential Information received in connection with the Agreement and shall not disclose such information to third parties or use it for purposes other than those permitted under the Agreement without the other Party's prior written consent.

The Parties shall ensure that their employees and representatives comply with these confidentiality obligations.

Unless otherwise agreed, all Confidential Information and related documents remain the property of the original owner.

Information is not considered Confidential Information if it was already known to the receiving Party before the Agreement, is publicly available, or has been lawfully obtained from a third party without confidentiality obligations.

This confidentiality obligation does not restrict NoCFO's right to process data stored in the Service by the Customer to the extent permitted under the Agreement and the DPA appendix for purposes of providing, maintaining, analyzing, developing, and automating the Service.

8. Liability and Limitation of Liability

NoCFO is not liable for damages caused by third-party services or the Customer's own actions.

The Service is provided "as is." NoCFO is not liable for indirect damages, including loss of profits, incorrect information, or data loss, unless otherwise required by mandatory law.

NoCFO's maximum aggregate liability is limited to three (3) months of service fees paid by the Customer, excluding VAT.

9. Term and Termination

The Agreement remains in force until terminated.

The notice period is one (1) month, and service fees will be charged until the end of the notice period.

For the purposes of these Terms, termination of the Agreement means that the Customer deletes its Company Account and Users from the Service. The end of a paid subscription alone does not terminate the Agreement if the Customer continues using the Service under a free version.

Upon deletion of the Company Account, all data stored by the Customer in the Service will be deleted immediately. The Customer is responsible for backing up and retaining any necessary data before deleting the Company Account. NoCFO is not responsible for data loss after deletion of the Company Account.

The Customer remains responsible for complying with statutory accounting retention obligations. Accounting materials must be retained for the period required by law even after termination of the Service.

10. Governing Law and Disputes

This Agreement shall be governed by the laws of Finland.

Any disputes arising from this Agreement shall be resolved in the competent courts of Finland.

11. Force Majeure

Force majeure means any circumstance or event beyond a Party's reasonable control that prevents or materially hinders the fulfillment of obligations under the Agreement and could not reasonably have been foreseen or avoided.

Examples include war, natural disasters, fire, pandemics, large-scale network, telecommunications or power outages, governmental actions, or similar exceptional events.

If NoCFO is prevented from fulfilling its obligations due to force majeure, NoCFO shall be released from liability for the duration and extent of the force majeure event.

NoCFO shall notify the Customer of the force majeure event and its estimated duration as soon as reasonably possible.

If the force majeure event continues for more than three (3) months, the Customer may terminate the Agreement with immediate effect by written notice.

12. Personal Data Processing and Privacy

Both Parties shall comply with applicable data protection legislation.

NoCFO acts as the data controller with respect to its own customer and user data in accordance with its Privacy Policy available on NoCFO's website.

The Customer acts as the data controller with respect to personal data stored in the Service, and NoCFO acts as the data processor. Such processing is governed by the DPA appendix to the Agreement.

NoCFO has the right to process personal data stored in the Service by the Customer in accordance with the Agreement and DPA appendix for purposes of providing, maintaining, analyzing, developing, and automating the Service.

NoCFO does not process personal data for marketing purposes without the explicit consent of the data subject.

13. Amendments to the Agreement

NoCFO may amend these Terms by notifying Customers through the Service or on its website.

Continued use of the Service after the amendments take effect constitutes acceptance of the amended Terms.

If the Customer does not accept the amendments, either Party may terminate the Agreement.

14. Limitation Period for Claims

Claims arising under the Agreement must be submitted within six (6) months from the date on which the grounds for the claim arose.

15. Assignment

The Customer may not assign the Agreement without NoCFO's prior written consent.

NoCFO may assign the Agreement to a third party.

16. AI Assistant (Luca)

The Service includes an AI-powered assistant ("Luca"), through which Users may retrieve information about their company, discuss matters related to data stored in the Service, request actions to be performed within the Service, and ask general accounting and taxation questions.

Luca is available as both a text-based chat feature and a voice-based feature.

The AI assistant may make errors. The User is solely responsible for how they use information or advice generated by Luca. The User must verify the correctness of actions performed by Luca before relying on them.

NoCFO is not liable for damages caused by incorrect information generated by Luca or incorrect actions performed by Luca.

Appendix 1: Data Processing Agreement (DPA)

This appendix forms part of the NoCFO Service General Terms of Service and supplements the Agreement regarding the processing of personal data between the Customer (data controller) and NoCFO Oy (data processor). The processing is based on the Agreement between the Customer and NoCFO.

1. Subject Matter and Nature of Personal Data Processing

NoCFO processes personal data on behalf of the Customer for the purpose of providing, maintaining, developing, analyzing, and automating the Service. Processing includes the technical processing of financial administration documents and data stored in the Service.

2. Personal Data Processed

Personal data processed on behalf of the Customer may include, for example:

• Names, contact details, and address details of the Customer or the Customer's customers, employees, partners, or other data subjects.
• Billing information, bank account details, and payment information.
• Vouchers, receipts, bank statements, transaction data, and other financial administration materials.
• Other information entered into the Service by the Customer or its end user.

The Customer is responsible for ensuring that the data has been collected lawfully and that the Customer has the right to transfer it to NoCFO for processing.

3. Processor's Obligations

NoCFO undertakes to process personal data:

• Only in accordance with applicable data protection legislation.
• Solely in accordance with the Agreement and this appendix.
• Only in accordance with the Customer's documented instructions.

NoCFO ensures that personal data is processed only by persons who are bound by a statutory or contractual confidentiality obligation.

NoCFO does not permit authorities to access the data without a lawful order, such as a court order.

NoCFO shall notify the Customer of personal data breaches without undue delay so that the Customer can fulfill its statutory notification obligations.

Upon request, NoCFO shall provide the Customer with reasonable information or evidence regarding the security of the Service so that the Customer can assess NoCFO's compliance with its obligations under this appendix. However, the Customer does not have the right to conduct its own physical audit or inspection of NoCFO's premises or systems without NoCFO's prior written consent.

4. Processing for Service Development

NoCFO has the right to process Customer materials, including vouchers, receipts, bank statements, bank transactions, and other financial data, for the purpose of analyzing and developing the Service, implementing automation, and improving quality.

Development-related processing may include, for example:

• Technical analysis of data.
• Classification and modeling.
• Training of algorithms or machine learning models.
• Error detection and performance optimization.

Processing does not include using personal data for marketing purposes or disclosing data to third parties for any purpose other than what is necessary for providing the Service.

5. Subcontractors and Data Transfers

NoCFO may use subcontractors for the processing of personal data in accordance with this appendix. NoCFO maintains an up-to-date list of its subcontractors, which is available to the Customer upon request.

Subcontractors operate under NoCFO's supervision and only in accordance with this appendix. Personal data may be transferred outside the EU/EEA only where necessary for providing the Service and where the transfers comply with applicable data protection legislation.

6. Controller's Obligations

The Customer is responsible for ensuring that:

• The processing of personal data in the Service is lawful.
• The data stored in the Service is accurate.
• The obligation to inform data subjects is fulfilled.
• Any required notifications to authorities are made appropriately.

The Customer acknowledges that NoCFO acts as a processor of personal data in accordance with the Agreement and this appendix.

7. Information Security

NoCFO implements appropriate technical and organizational measures to protect personal data. Information security is assessed and updated regularly.

8. Deletion or Return of Personal Data

Customer materials are deleted immediately when the Customer deletes its Company Account and Users from the Service. The Customer is responsible for backing up and retaining any necessary data before deleting the Company Account.

The Customer remains responsible for complying with statutory accounting retention obligations also after termination of the Service. NoCFO recommends that the Customer ensure that all necessary materials have been stored before deleting the Company Account.

This appendix supplements the Agreement and remains valid for as long as the Agreement remains in force.

9. Data Processing by the AI Assistant

The AI assistant included in the Service ("Luca") processes data stored by the Customer in the Service in order to enable the assistant's functionality. The data processed may include financial administration documents, transactions, customer register data, and other information stored by the Customer in the Service. In addition, Luca processes messages and voice commands sent by the User to the assistant in order to provide the assistant's functionality.

Data is stored within the EU/EEA. Data processing may occur outside the EU/EEA in compliance with applicable data protection legislation.

Luca uses a third-party AI service, which acts as NoCFO's subcontractor in accordance with Section 5. The AI service provider does not use the data it processes for its own purposes, such as training its models.

Appendix 2: Payment Functionality and Third-Party Payment Services

This appendix applies only to the payment functionality offered in the NoCFO Service, through which the Customer may initiate payment orders using licensed payment services provided by third parties. This appendix supplements NoCFO's General Terms of Service and takes precedence to the extent it concerns payment functionality.

1. Nature of the Payment Functionality

NoCFO provides the Customer with a technical software solution that allows the Customer to initiate payments through licensed payment services provided by third parties.

NoCFO is not a payment service provider, payment institution, or obliged entity under the Finnish Act on Preventing Money Laundering and Terrorist Financing (444/2017), and NoCFO does not process, store, or receive funds belonging to the Customer or third parties.

NoCFO acts solely as a technical interface and enabler of payment order initiation and is not a party to the payment transaction between the Customer and the payment recipient.

2. Third Parties and Execution of Payments

Payments are executed based on the contractual relationship between the Customer and the Customer's bank or other licensed payment service provider.

NoCFO is not responsible for the execution, delay, interruption, or failure of payments, nor for the actions of banks, payment service providers, or other third parties.

The Customer is responsible for verifying the final status of each payment from its own bank.

2.1 Salt Edge Payment Initiation Service

The payment initiation service may be provided in cooperation with Salt Edge Limited and its licensed payment institution partner.

Salt Edge and its partner are responsible for the technical execution of the payment order and for providing the payment service.

NoCFO is not responsible for the actions of Salt Edge, its payment institution partner, or banks, nor for the availability of their services.

2.2 Holvi Integration

NoCFO may also offer the Customer the possibility to initiate payments from a Holvi account provided by Holvi Payment Services Oy through a separate integration.

Payments related to the Holvi account are executed based on the contractual relationship between Holvi and the owner of the Holvi account, and NoCFO is not a party to that contractual relationship or payment transaction.

In connection with the Holvi integration, NoCFO acts solely as a technical service provider that transmits payment orders given by the Holvi account owner or a user authorized by the account owner to Holvi. All payments initiated from a Holvi account through NoCFO are deemed to have been initiated by the Holvi account owner.

The Holvi account owner may grant other users the right to initiate payments from the Holvi account.

The Holvi account owner is solely and fully responsible for granting access rights, their scope and validity, and all payments and other actions carried out on the basis of such access rights.

NoCFO is not responsible for granting, monitoring, or revoking access rights, nor for payments made on the basis of such rights.

3. Payment Information, Consent, and Irrevocability

The Customer is responsible for all payment information entered by it, for the accuracy of such information, and for ensuring that the payment order is lawful and that the Customer has the right to make the relevant payment.

A payment order is initiated only after the Customer has explicitly consented to the execution of the payment and accepted the third-party terms of service and privacy policy applicable to the payment initiation service (Salt Edge).

A payment order cannot be cancelled or modified through NoCFO after the Customer has approved the payment.

NoCFO does not process payment refunds. Any refunds must be handled between the Customer and the bank or payment recipient.

4. AML and Compliance

The Customer is responsible for the lawfulness of its own operations, including compliance with obligations relating to the prevention of money laundering and terrorist financing to the extent such obligations apply to the Customer.

NoCFO does not perform customer identification, transaction monitoring, or suspicious activity reporting on behalf of the Customer.

NoCFO reserves the right to suspend the payment functionality if it has reasonable grounds to suspect misuse or unlawful activity, or if required by a third-party payment service provider.

5. Limitation of Liability

NoCFO is not liable for indirect or consequential damages, such as loss of revenue, profit, or business opportunities.

NoCFO's total liability to the Customer for claims relating to payment functionality is limited to the service fees paid by the Customer to NoCFO during the three (3) months preceding the claim, unless otherwise required by mandatory law.

6. Service Interruption

NoCFO has the right to suspend the payment functionality in whole or in part without liability for compensation if a third party related to the payment functionality is prevented from providing the service, if regulations change, if an information security or misuse risk arises, or if continuing the service is not reasonably possible.