This Data Processing Agreement (“DPA”) forms part of the Terms of Service between RUSO Oy (the “Processor”) and the Customer (the “Controller”). It applies to all processing of personal data that RUSO carries out on behalf of the Customer in connection with the Platform, as defined in the Terms of Service.

1. Subject Matter and Duration

RUSO processes personal data on behalf of the Customer for the duration of the Terms of Service, and afterwards only as needed to complete deletion under Section 12. The purpose is to provide the Platform, including order management, fleet management, staff scheduling, warehouse scanning operations and related reporting.

2. Nature and Purpose of Processing

RUSO processes personal data to operate the management interface, the Employee application and the Scanner application. This covers:

• account creation and authentication

• task assignment and completion tracking

• geofenced location tracking during active work sign-in

• warehouse scanning events

• invoicing

• customer support

RUSO does not process Customer personal data for its own product development or testing.

3. Categories of Data Subjects

Personal data processed under this DPA may relate to:

• the Customer’s employees

• the Customer’s administrators and supervisory staff

• the Customer’s own customers, where their contact or order details are entered into the Platform

4. Categories of Personal Data

Personal data processed may include:

• names and contact details

• employee identifiers and login credentials

• work schedule and task data

• geofenced location data collected during active sign-in

• scanning event data

• vehicle assignment data

• order and delivery details relating to the Customer’s own customers

5. Processor Obligations

RUSO will process personal data only on the Customer’s documented instructions, including instructions about transfers to a third country. The exception is where EU or Finnish law requires otherwise. In that case, RUSO will inform the Customer of the legal requirement before processing, unless the law prohibits this on important grounds of public interest. RUSO will also inform the Customer promptly if, in its opinion, an instruction infringes data protection law.

RUSO will also:

• ensure that everyone authorized to process personal data is bound by confidentiality, either by commitment or by a statutory obligation;

• implement technical and organizational measures appropriate to the risk, as described in Section 10;

• not use identifiable Customer Data for any purpose beyond providing the Platform, except as permitted for Aggregated Data under Section 9;

• not disclose personal data to third parties except to approved sub-processors, or where required by law.

6. Controller Obligations

The Customer warrants that:

• it has a valid legal basis and all necessary rights to provide the personal data to RUSO and have it processed under this DPA;

• the personal data it provides is accurate and kept up to date; and

• its instructions to RUSO comply with applicable data protection law.

The Customer is solely responsible for meeting any obligations under the Act on the Protection of Privacy in Working Life. These include necessity assessments, advance notice to employees and consultation with employee representatives. RUSO’s obligations under this DPA do not include establishing the Customer’s legal basis or delivering those notices on the Customer’s behalf.

7. Sub-processors

7.1. Authorization. The Customer gives RUSO general authorization to engage sub-processors to support the provision of the Platform.

7.2. Current sub-processor. As of 8 September 2026, RUSO’s sole sub-processor is Google Cloud Platform via Firebase. Core data is stored in Finland (Google Cloud region europe-north1, Hamina). Firebase Authentication and Firebase Analytics process data in the United States, under Google’s Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.

7.3. Changes. RUSO will notify the Customer by email at least 30 days before engaging a new or replacement sub-processor. RUSO will also provide the information the Customer reasonably needs to assess it.

The Customer may object in writing within those 30 days on reasonable data protection grounds. If the parties cannot agree on a solution, the Customer may terminate the affected services without penalty and receive a refund of prepaid fees for the unused period. If the Customer does not object within 30 days, the sub-processor is considered approved.

7.4. Obligations and accountability. RUSO will:

• enter into a written contract with each sub-processor imposing data protection obligations equivalent to those in this DPA, and enforce those obligations;

• provide the material terms of those contracts to the Customer on request; and

• remain fully liable to the Customer for the acts and omissions of its sub-processors as if they were RUSO’s own.

8. Assistance to the Customer

RUSO will help the Customer respond to data subjects exercising their GDPR rights, taking into account the nature of the processing. This covers requests for access, correction, deletion, restriction, objection and portability. RUSO will provide this help whether the request comes directly from an individual or is forwarded by the Customer. If RUSO receives a request directly, it will forward it to the Customer without undue delay.

RUSO will also help the Customer meet its own GDPR obligations, including data protection impact assessments and prior consultation with a supervisory authority where required. This help takes into account the nature of the processing and the information available to RUSO.

This assistance is included in the Customer’s subscription at no extra cost. RUSO may charge reasonable costs at its standard hourly rates only for requests that are manifestly excessive or repetitive, or that go clearly beyond what a processor is required to provide. In that case, RUSO will give the Customer a written cost estimate in advance.

9. Aggregated Data

RUSO may create and use Aggregated Data for product improvement, benchmarking and analytics offerings, including across multiple customers. Aggregated Data is Customer Data processed so that it can no longer reasonably be used to identify an individual, a vehicle or a specific Customer.

Before Aggregated Data is used or published in any form, it must:

• meet a minimum group-size threshold; and

• exclude any combination of filters narrow enough to identify an individual, vehicle or specific Customer.

RUSO will not use identifiable Customer Data for these purposes without a separate, explicit agreement with the affected Customer.

10. Security Measures

RUSO will implement technical and organizational measures appropriate to the risk, including:

• encryption of personal data in transit and at rest;

• access controls that limit personal data access to personnel who need it for their role;

• regular backups; and

• regular review of these measures.

RUSO will not reduce the overall level of security during the term of the Terms of Service. Further detail on RUSO’s security measures and any certifications held is available on request.

11. Personal Data Breach Notification

RUSO will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Data. The notification will describe, as far as the information is available at the time:

• the nature of the breach;

• the categories and approximate number of data subjects and records affected;

• the likely consequences; and

• the measures taken or proposed to address it.

Further information will follow as it becomes available. RUSO will help the Customer meet its own breach notification obligations.

12. Data Return and Deletion

Before the Terms of Service end, the Customer may export its Customer Data in a format RUSO makes available. After the Terms of Service end, RUSO will:

• delete all Customer Data from live systems within 14 working days;

• delete or overwrite backup copies through RUSO’s normal backup cycle within 90 days; and

• on request, confirm in writing that deletion has been completed.

These deadlines do not apply where the law requires retention.

13. Audit Rights

On reasonable written request, RUSO will give the Customer the information needed to demonstrate compliance with this DPA. Requests are limited to once per contract year, except after a personal data breach or where a supervisory authority requires it.

RUSO will also allow for and contribute to audits by the Customer or an independent auditor the Customer appoints. Audits are subject to at least 30 days’ advance notice, confidentiality and scheduling that avoids undue disruption to RUSO’s operations and other customers.

14. International Transfers

Any transfer of personal data outside the European Economic Area under this DPA will use an approved transfer mechanism, such as Standard Contractual Clauses, as required under GDPR. The transfers described in Section 7.2 for Firebase Authentication and Firebase Analytics are made on this basis.

15. Liability

Liability under this DPA is subject to Section 15 of the Terms of Service, including the increased liability cap in Section 15.3 for breaches of this DPA.

16. Order of Precedence

If this DPA and the Terms of Service conflict on the processing of personal data, this DPA governs.

Contact for data protection matters: info@ruso.app