Terms & Conditions

Documill SaaS Terms & Conditions

Version 2.4 — May 2026

Includes Appendix 1: Data Processing Agreement

Supersedes version 2.3 (March 1, 2025)

These Documill Software as a Service (“SaaS”) Terms and Conditions (“Terms and Conditions”) are related to SaaS subscription between Documill Oy, a Finnish corporation having a principal place of business in Finland (“Documill”) and the subscribed client and its affiliates (the “Client”). Client’s SaaS subscription (subject to the payment of the Subscription fee and the provisions for termination set out in this Agreement) shall be deemed Client’s agreement to these Terms and Conditions, including Appendix 1 (Data Processing Agreement).

1. DEFINITIONS

For purposes of these Terms and Conditions, the terms below shall have the meanings defined below.

1.1 “Client Content” means any data, information, trademarks, logos, files, images, text or other content that may be provided by Client or its authorized users for use in conjunction with the SaaS. The Client Content used in conjunction with the SaaS is stored and maintained in certain third-party storage services.

1.2 “Subscription Fee” means the fee which covers the provision of the SaaS during the Term, payable annually in advance per end user with a unique license code allocated to each end user connected to the Service. Additional end user licenses can be purchased and added as required to expand the number of end users connected to a Service.

1.3 “SaaS Term” means the period during which the access to the SaaS will be provided by Documill to Client, comprising the Initial Term and any Renewal Terms as defined in Section 7.1.

1.4 “Initial Term” means the first twelve (12) months period of the SaaS Term, commencing on the service start date agreed between the parties.

1.5 “Renewal Term” means each successive twelve (12) months period following the expiry of the Initial Term or a preceding Renewal Term, as further described in Section 7.1.

1.6 “Term” refers collectively to the Initial Term and any Renewal Term(s).

1.7 “Third Party Sub-Processor” means a vendor or service provider engaged by Documill to help deliver the SaaS, which requires accessing or processing Client Content. Such subcontractors handle specific tasks such as cloud hosting on behalf of Documill and are required to adhere to applicable data protection regulations.

1.8 “SaaS” means Documill’s Software as a Service offering, based on Documill’s proprietary software and provisioned as a service by Documill. It supports various document-driven business process use cases. Depending on the use case, the Client may access the SaaS via a web browser or API.

1.9 “User Documentation” means Documill’s online user documentation relating to the SaaS.

2. WEB-BASED LICENSE

Documill grants to Client, and Client accepts, a non-transferable, non-exclusive license and right to access the SaaS via the Internet and use the SaaS and the User Documentation only as authorized in these Terms and Conditions, for the purpose of enabling its business operations during the SaaS Term. The SaaS will be managed by Documill (as described in Section 3) and accessed and used by Client through the use of the Internet and Client’s computers.

The license granted under this Section is strictly limited to the number and type of licenses purchased by the Client, as set out in the applicable subscription order:

• Named-user licenses: each license permits one uniquely identified individual end user to access and use the SaaS. Named-user licenses are personal to the assigned user and may not be shared, pooled or transferred to another individual without Documill’s prior written consent. The license does not extend to employees or contractors of Client who have not been assigned a named-user license.
• API licenses: each API license permits programmatic access to the SaaS by a single identified system or application integration within the agreed usage parameters. API licenses do not confer any right of interactive user access.

Additional named-user or API licenses may be purchased at any time in accordance with Section 6 (Service Fees). Client is responsible for ensuring that access to the SaaS does not exceed the number and type of licenses held at any given time.

3. ACCESSIBILITY

Documill will make the SaaS available for Client’s use during the SaaS Term on Client’s computer systems via web browser or API. Documill will provide Client with secure access to the latest supported version of the SaaS via the Internet from the hosting facility chosen by Documill (the “Hosting Site”) on a 24×7 basis, except during Maintenance Windows as described in Section 8. Documill will provide advance notice of all scheduled maintenance and planned outages in accordance with Section 8.

4. USER RIGHTS, LIMITATIONS AND ACCESS

Access to the SaaS is governed by the license granted in Section 2 and is strictly limited to individuals and systems holding a valid license purchased under the Client’s subscription. A “valid license” means either a named-user license assigned to a specific individual, or an API license assigned to a specific system or application integration, in each case as set out in the applicable subscription order. Access by employees, contractors or systems of Client that have not been assigned a valid license is not permitted under these Terms and Conditions.

By accessing and using the SaaS, Client will:

• comply with all applicable laws and regulations;
• keep its passwords and other authentication details confidential;
• promptly notify Documill if it learns of a security breach or unauthorized access related to the Service.

Client may not:

• use the SaaS in any way that intentionally harms Documill, its affiliates, resellers, distributors or vendors, or any customer of those parties or other users of the SaaS;
• engage in, facilitate, or further unlawful conduct;
• intentionally damage, disable, overburden or impair the SaaS or the networks connected to it, or interfere with any party’s use and enjoyment of the SaaS;
• resell or redistribute the SaaS, or any part of it, unless Client holds a separate written agreement with Documill permitting such activity;
• use any unauthorized automated process or service to access and/or use the SaaS, except that periodic automated access for report creation or scheduling is permitted;
• knowingly use unauthorized means to modify or reroute the SaaS, or attempt to work around any of its technical limitations;
• modify, create derivative works from, reverse engineer, decompile, disassemble or otherwise attempt to discover any trade secret contained in the SaaS or in any technology or system used by Documill in connection with the SaaS, except to the extent expressly permitted by applicable law notwithstanding this limitation;
• copy any ideas, features, functions or graphics of the SaaS.

6. SERVICE FEES

In order to access and use the SaaS, Client shall pay the Subscription Fee communicated to the Client on an annual basis during the SaaS Term. The Subscription Fee is fixed for the Initial Term. The Subscription Fee for any subsequent Renewal Term may be subject to adjustment at Documill’s discretion.

If Subscription Fees are not paid in accordance with the provisions of these Terms and Conditions and any additional payment terms communicated to Client by Documill, all further access to the SaaS will be blocked without further notice following the expiry of the twenty (20) day late payment period described in Section 7.2.

In consideration of any other services provided by Documill to Client, Client shall pay additional fees based on Documill’s then-current service fee schedule.

Documill shall issue invoices to Client in respect of the Subscription Fee and any additional service fees in advance. All invoices are payable within the terms specified by Documill on the invoice unless otherwise agreed in writing between the parties.

7. TERM AND TERMINATION

7.1 Initial Term; Renewal Terms

The SaaS Term will commence on the service start date agreed between the parties at the time of subscription. The SaaS Term shall continue for an Initial Term of twelve (12) months unless earlier terminated in accordance with these Terms and Conditions. Upon expiry of the Initial Term, the SaaS Term automatically renews for successive Renewal Terms of twelve (12) months each, unless either party gives written notice of non-renewal at least thirty (30) days before the end of the then-current Term, or the agreement is earlier terminated as provided herein. Renewal is not contingent on advance payment; the Subscription Fee for each Renewal Term shall be invoiced in accordance with Section 6.

7.2 Termination for Breach

Either party may terminate the SaaS Term upon a material breach of these Terms and Conditions by the other party, provided that: (a) the terminating party gives written notice specifying the breach; and (b) the breaching party fails to remedy the breach within thirty (30) days of such notice. In the case of Client’s failure to pay fees, the remedy period is twenty (20) days from notice of the late payment.

For purposes of this Section, a material breach by Documill includes a failure to provide at least 98.6% availability in three (3) consecutive calendar months. In such circumstances, Client may elect either to terminate the SaaS Term and receive a pro-rata refund of prepaid Subscription Fees for the unused remainder of the then-current Term, or to continue the SaaS Term and request a refund of Subscription Fees commensurate with the period of unavailability. Documill shall publish a post-incident report within five (5) business days of resolving any availability incident that contributes to the availability threshold being breached, setting out the root cause, impact duration and remediation steps taken.

7.3 Termination for Convenience

Client may terminate this agreement for convenience by providing written notice to Documill no later than thirty (30) days before the end of the then-current Initial or Renewal Term. Termination shall take effect at the end of that Term. No refunds are payable for terminations under this Section, except as provided in Section 7.4.

7.4 Effect of Termination

Upon termination of the SaaS Term for any reason, Client’s access to and use of the SaaS shall cease immediately. Sections 13, 16, 17 and 18 shall survive termination.

8. MAINTENANCE WINDOWS

Documill and/or its hosting or telecommunications vendor(s) may perform scheduled system maintenance during the pre-communicated “Maintenance Windows”, and Documill must provide notice of upgrades and planned outages in advance.

9. AVAILABILITY

Documill targets to offer 99.2% availability of the SaaS during the SaaS Term, calculated monthly.

For purposes of these Terms and Conditions, “availability” means the SaaS is accessible to Client, and is considered absent only where inaccessibility arises from: (i) a hardware failure of the server at the Hosting Site; or (ii) a connection failure between the servers hosting the SaaS and the closest Internet router. Scheduled Maintenance Windows notified in accordance with Section 8 are excluded from availability calculations.

The SaaS is provisioned as a shared service operating on shared infrastructure. Because any availability event affects all clients simultaneously, service credits are not offered under these Terms and Conditions. Client’s remedies in the event of availability failures are those set out in Section 7.2.

Possible software bugs, errors or other problems not causing the SaaS to be inaccessible are not considered availability issues and are addressed under Section 11.

In the event of a material availability incident, Documill will notify affected clients by email within same business day of the incident being identified. Documill will publish a post-incident report within five (5) business days of incident resolution, covering root cause, impact duration and remediation steps taken.

10. SUPPORT

Documill will provide technical support via email, online channel and phone during the SaaS Term. Technical support services are provided on Finnish business days and hours, excluding Finnish national holidays. The first reply to a support request is provided within one (1) business day.

Technical support is included as part of the Subscription Fee. Documill’s support operations are dimensioned around an average of five (5) support requests per client per month under normal operating conditions. Should a certain Client’s support needs consistently exceed this level, Documill will notify the Client, and the parties will agree on an appropriate extended support arrangement, which may be subject to additional fees.

Bug resolution follows the severity categorization below. Support requests directly related to identified and reproducible software bugs are not counted against the average support volume described above.

P0 — Fatal Software Issue

Catastrophic failure; the SaaS aborts or the Client cannot access any functionality of the SaaS. Example: none of the Client’s documents can be populated or  fetched from SaaS. Maximum 24 hours for an initial fix or circumvention; corrective action begins immediately and continues until an initial fix or circumvention is in place. A permanent resolution will follow as soon as practicable.

P1 — Limited Functionality

Significant issue; the SaaS is not delivering its intended functionality. Example: only some of the Client’s documents are populated, or only part of search results is returned. Maximum one (1) week to fix.

P2 — Annoying Functionality

Minor Software issue or annoying behavior. Example: a small number of fields in Client’s documents are not populated, and manual population is only a minor inconvenience. To be fixed in the next regularly scheduled release.

P3 — Enhancement Request

Prioritized according to the Documill feature request process. May be implemented in a future Software release.

Support outside standard hours is available for P0 (down or mission-critical) cases only.

The Client may contact Documill Support via:

• Web: www.documill.com
• Email: support@documill.com
• Tel: +358 50 408 1839

Documill Support will assist with:

• Problems with or questions about the operation of the SaaS;
• Problems with interfaces between the SaaS and third-party data sources;
• Error messages occurring in the context of the SaaS.

11. UPGRADES

Documill will install software upgrades, releases, patches and fixes of the SaaS which are generally made available to other clients of the SaaS through the related Service, at no additional charge during the SaaS Term. All upgrades are protected by Finnish copyright law, EU copyright directives, and applicable international intellectual property treaties. Documill will determine and announce upgrades as described in Section 8 of these Terms and Conditions.

12. CLIENT RESPONSIBILITIES

Client is responsible for administering and granting of rights to its users using a specific form in the SaaS. Client is also responsible for ensuring that its users comply with these Terms and Conditions with respect to use of the SaaS. Client shall provide connectivity and security to the Internet for its location(s) for purposes of providing adequate access to the SaaS hosted at the Documill Hosting Site.

Documill shall not be responsible for the reliability or continued availability of the communications lines, or the corresponding security configurations, used by Client in accessing the Internet to access the SaaS.

13. INTELLECTUAL PROPERTY RIGHTS

Client agrees that the SaaS, related User Documentation and related Services are proprietary products and services and that all right, title and interest in and to the SaaS, related User Documentation, including all associated intellectual property rights, are and shall at all times remain with Documill and its third-party licensors.

The Documill software empowering SaaS and related Client installable software modules contain trade secrets and proprietary information owned by Documill or its third-party licensors and is protected by Finnish copyright law, EU copyright directives and applicable international intellectual property treaties. Client must treat the SaaS and related Client installable software modules like any other copyrighted material and Client may not copy or distribute related Client installable software modules or the User Documentation, electronically or otherwise, for any purpose.

Client hereby grants to Documill a non-exclusive right to use all Client Content as necessary solely for the purposes of provisioning the SaaS to Client and Client’s authorized users pursuant to these Terms and Conditions. In all usage situations all right, title and interest in and to the Client Content remains with the Client.

14. OTHER RESTRICTIONS

Use of the SaaS is restricted to use by the specific licensing entity only, and only in the context of the Client Content. Client may not use the SaaS for the benefit of any third parties or provide service bureau (which would make the Client a service provider of Documill’s SaaS Service without explicit permission from Documill). Client may not reverse engineer, disassemble, decompile or make any attempt to ascertain, derive or obtain the source code the SaaS related Client installable software.

The SaaS and Client Content shall not be used for any commercial purpose beyond the functionality offered by the SaaS. Except as may be permitted in Section 4 consistent with Documill’s permissions for the SaaS, the Client hereby agrees, represents and warrants to Documill that it will not access or use the SaaS for any purpose that is unlawful or prohibited by these terms, conditions, and notices.

15. WARRANTIES

15.1 Mutual Warranties

Each party warrants that (i) it has the right and power to enter into these Terms and Conditions, and (ii) it will comply with any applicable laws and regulations pertaining to these Terms and Conditions.

15.2 Documill Limited Warranty

Documill warrants that the provisioning of the SaaS will be performed in a professional and workmanlike manner in accordance with recognized industry standards.

15.3 Remedies

If during the Warranty Period the SaaS fails to comply with the Warranties set forth above, Documill’s entire liability and Client’s exclusive remedy will be either a) repair or replacement of the SaaS, or if in Documill’s opinion such repair or replacement is not possible, then b) termination of the SaaS Term and a refund of the Subscription Fees paid for the remainder of the SaaS Term. This limited warranty is void if failure of the SaaS has resulted from accident, or Client’s abuse, misuse or negligence of any kind in the use, handling or operation of the SaaS, including any use not consistent with the User Documentation or Documill training.

15.4 Disclaimers

Any written or oral information or representations provided by Documill agents, employees, resellers, consultants or service providers with respect to the use or operation of the SaaS will in no way increase the scope of Documill’s warranty. Documill and its suppliers exercise no control whatsoever over the content of the information passing through their systems. Client and users must exercise their own due diligence before distributing and/or relying on information available on the Internet, and must determine that they have all necessary rights to copy, publish, or otherwise distribute such information under copyright and other applicable laws.

EXCEPT AS SET FORTH HEREIN, DOCUMILL DOES NOT AND CANNOT WARRANT THE PERFORMANCE OR RESULTS OBTAINED BY CLIENT IN USING THE SAAS OR RELATED CLIENT INSTALLABLE SOFTWARE, OR THAT THE SAAS OR RELATED CLIENT INSTALLABLE SOFTWARE WILL MEET CLIENT’S REQUIREMENTS OR THAT THE PROVISIONING OF THE SAAS WILL BE UNINTERRUPTED OR ERROR FREE. EXCEPT FOR THE WARRANTIES SET FORTH HEREIN, DOCUMILL EXPRESSLY DISCLAIMS ALL OTHER REPRESENTATIONS OR WARRANTIES, WHETHER EXPRESS, IMPLIED, OR STATUTORY (BY ANY TERRITORY OR JURISDICTION) TO THE EXTENT PERMITTED BY LAW, AND FURTHER DOCUMILL EXPRESSLY EXCLUDES ANY WARRANTY OF NONINFRINGEMENT, TITLE, FITNESS FOR A PARTICULAR PURPOSE, OR MERCHANTABILITY TO THE EXTENT PERMITTED BY LAW.

16. CONFIDENTIAL INFORMATION

16.1 Definition

The term “Confidential Information” shall mean: (i) any and all information which is disclosed by either party (“Owner”) to the other (“Recipient”) verbally, electronically, visually, or in a written or other tangible form which is either identified or should be reasonably understood to be confidential or proprietary; and (ii) the terms, including without limitation, the pricing, of the SaaS and any proposals or other documents that preceded these Terms and Conditions.

Confidential Information may include, but not be limited to, personal information (individual name, address, contact information), organization, credit card information, trade secrets, computer programs, software, documentation, formulas, data, inventions, techniques, marketing plans, strategies, forecasts, client lists, employee information, financial information, confidential information concerning any of Owner’s past, current or future plans and initiatives, and confidential information concerning Owner’s business or organization, as Owner has conducted it or as Owner may conduct it in the future. In addition, Confidential Information may include information concerning any of Owner’s past, current, or possible future products or methods, including information about Owner’s research, development, engineering, purchasing, manufacturing, accounting, marketing, selling, leasing, and/or software (including third party software).

16.2 Treatment of Confidential Information

Owner’s Confidential Information shall be treated as strictly confidential by Recipient and shall not be disclosed by Recipient to any third party except to those third parties operating under non-disclosure provisions no less restrictive than in this Section and who have a justified business “need to know”. Client shall protect the deliverables resulting from use of the SaaS with the same degree of care. These Terms and Conditions impose no obligation upon the parties with respect to Confidential Information which either party can establish by legally sufficient evidence: (a) was in the possession of, or was rightfully known by the Recipient without an obligation to maintain its confidentiality prior to receipt from Owner; (b) is or becomes generally known to the public without violation of these Terms and Conditions; (c) is obtained by Recipient in good faith from a third party having the right to disclose it without an obligation of confidentiality; (d) is independently developed by Recipient without the participation of individuals who have had access to the Confidential Information; or (e) is required to be disclosed by court order or applicable law, provided notice is promptly given to the Owner and provided further that diligent efforts are undertaken to limit disclosure.

16.3 Rights and Duties

The Recipient shall not obtain, by virtue of these Terms and Conditions, any rights, title, or interest in any Confidential Information of the Owner. Upon written request after termination of the SaaS Term all copies of Confidential Information in any form, including partial copies, have been destroyed, returned, or used solely as the Owner so directs, provided, however, that each party may retain one copy for archival purposes only.

16.4 Data Transfer

Documill has implemented appropriate security measures to protect Client Content during transfer from the system where Client Content resides at SaaS. These measures include encryption in transit using industry-standard protocols (e.g., TLS/SSL/HTTPS). For the transfer of Client Content to Third-Party Sub-Processors, Documill ensures that such transfers are conducted in accordance with applicable data protection laws. The Client agrees to notify Documill immediately if they become aware of any unauthorized access to, or transfer of, their data.

16.5 Publicity

Notwithstanding this Section 16 (“Confidentiality”), no prior written approval is required by Documill to reference Client as a customer as part of its own sales and marketing activities.

16.6 Data Processing

The processing of personal data by Documill in connection with the SaaS is governed by Appendix 1 (Data Processing Agreement) to these Terms and Conditions, which forms an integral part of this agreement and is binding on both parties from the service start date.

16.7 Survival

The terms of this Section 16 shall survive termination of the SaaS Term.

17. INDEMNITY

17.1 By Documill

Documill shall indemnify and defend Client against any third party claims that the SaaS or related Client installable software made available to Client by Documill infringe any intellectual property right during the SaaS Term, provided that Documill is given prompt notice of such claim and is given information, reasonable assistance, and the sole authority to defend or settle said claim. In the defence or settlement of any claim relating to infringing SaaS or related Client installable software, Documill shall, in its reasonable judgment and at its option and expense: (i) obtain for Client the right to continue using the SaaS or related Client installable software; (ii) replace or modify the SaaS or Client installable software so that it becomes non-infringing while giving substantially equivalent functionality; or (iii) if Documill determines the remedies in (i) or (ii) are not commercially reasonable, as its sole obligation, terminate the SaaS Term.

Documill shall have no liability to indemnify and defend Client to the extent (i) the alleged infringement is based on infringing information, data, software, applications, services, or programs created or furnished by or on behalf of Client; (ii) the alleged infringement is the result of a modification made by anyone other than Documill; or (iii) Client uses the SaaS or related Client installable software other than in accordance with these Terms and Conditions or any documentation delivered by Documill. This Section states Documill’s entire liability and Client’s sole and exclusive remedy for claims relating to infringement.

17.2 By Client

Client shall indemnify and defend Documill against any claims resulting from the use of the SaaS; (i) that any Client Content (including without limitation content provided by Client or its users) infringes or violates any rights of third parties, including without limitation, rights of publicity, rights of privacy, intellectual property, trade secrets or licenses; or (ii) arising from or relating to Client’s or its users’ failure to comply with these Terms and Conditions.

17.3 Survival

The terms of this Section 17 shall survive termination of the SaaS Term.

18. LIMITATION OF LIABILITY

EXCEPT FOR THE INDEMNIFICATION FOR THIRD PARTY CLAIMS PROVIDED IN SECTION 17, OR ANY MATERIAL SECURITY BREACH RESULTING FROM DOCUMILL’S MISCONDUCT, NEGLIGENCE OR BREACH OF ITS INFORMATION CONFIDENTIALITY OBLIGATIONS, EITHER PARTY’S MAXIMUM LIABILITY FOR ANY CLAIM ARISING UNDER THESE TERMS AND CONDITIONS, REGARDLESS OF THE FORM OF ACTION AND WHETHER IN TORT, CONTRACT OR OTHERWISE, SHALL NOT EXCEED THE TOTAL SUBSCRIPTION FEES PAID BY CLIENT TO DOCUMILL IN THE TWENTY-FOUR (24) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO THE CLAIM.

IN NO EVENT SHALL EITHER PARTY BE LIABLE FOR INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY KIND, INCLUDING WITHOUT LIMITATION LOST DATA, LOST PROFITS, LOSS OF OPPORTUNITIES OR CONTRIBUTIONS, LOSS OF USE, LOSS OF GOODWILL, BUSINESS INTERRUPTION, COST OF COVER, OR OTHER PECUNIARY OR NON-PECUNIARY LOSS, HOWEVER ARISING, EVEN IF A PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

DOCUMILL SHALL HAVE NO LIABILITY OR RESPONSIBILITY FOR ANY LOSS OR INTERRUPTION IN ACCESS TO THE SAAS ARISING FROM CAUSES BEYOND ITS REASONABLE CONTROL OR FORESEEABILITY, INCLUDING WITHOUT LIMITATION FAILURE OR INTERRUPTION OF TELECOMMUNICATIONS OR DIGITAL TRANSMISSIONS AND LINKS, INTERNET SLOWDOWNS OR FAILURES.

THE PARTIES ACKNOWLEDGE AND AGREE TO THE ALLOCATION OF RISK SET FORTH IN THIS SECTION.

19. FORCE MAJEURE

Except for Client’s obligation to pay Documill, neither party shall be liable for any failure to perform its obligations under these Terms and Conditions if prevented from doing so by a cause or causes beyond its control, including without limitation, acts of God, failure of suppliers to perform, fire, floods, storms, epidemic or quarantine restrictions, earthquakes, riots or civil commotion, strikes, war, and restraints of government freight or other embargoes, weather conditions or any failures by Documill’s subcontractors or suppliers.

20. NOTICES

All notices or other communications referenced under these Terms and Conditions shall be made in writing and sent to “Attention: General Counsel” at Documill’s address available in www.documill.com to Client’s address set forth when subscribing to the SaaS. All notices shall be deemed given to the other party if delivered receipt confirmed using one of the following methods: registered or certified first-class mail, postage prepaid; recognized courier delivery; or electronic mail.

21. GOVERNING LAW; ARBITRATION

These Terms and Conditions shall be governed by the laws of Finland. Any dispute, controversy or claim arising out of or relating to this contract, or the breach, termination or validity thereof, shall be finally settled by arbitration in accordance with the Rules for Expedited Arbitration of the Arbitration Institute of the Finland Chamber of Commerce. Any decision in arbitration shall be final and binding upon the parties. Notwithstanding the above, Documill may sue in any court for infringement of its proprietary or intellectual property rights.

22. TRANSFERABILITY

Either party may assign this Agreement upon written notice to the other party; provided, however, that neither party may assign this Agreement to a direct competitor of the other party without the other party’s prior written consent. For the purposes of this Section, a “direct competitor” means any entity whose primary business includes the development, licensing or provision of document automation or document-driven business process software or services that are substantially similar to those offered by Documill or, as applicable, to the core business of the Client. Any purported assignment in violation of this Section shall be null and void.

23. MISCELLANEOUS

Except as otherwise specifically stated herein, remedies shall be cumulative and there shall be no obligation to exercise a particular remedy. If any provision of these Terms and Conditions is held to be unenforceable, the other provisions shall nevertheless remain in full force and effect. The failure by either party to enforce any rights granted hereunder or to take action against the other party in the event of any breach of these Terms and Conditions will not be deemed a waiver by that party as to the subsequent enforcement of rights or subsequent actions in the event of future breaches. These Terms and Conditions set forth the entire agreement between the parties with respect to the subject matter hereof and all other agreements, representations, communications and understandings, both oral and written, are superseded hereby.

This agreement is non-exclusive.

— End of Terms & Conditions — Appendix 1 follows —

Documill SaaS Terms & Conditions

Appendix 1 — Data Processing Agreement

Version 1.0 — April 2026

This Data Processing Agreement (“DPA”) forms Appendix 1 to the Documill SaaS Terms and Conditions (version 2.4) (the “Principal Agreement”) and is incorporated into and made part of the Principal Agreement. It is binding on Documill Oy (“Processor”) and the Client (“Controller”) as identified in the Principal Agreement from the service start date. No separate execution is required. Client’s subscription to the SaaS constitutes acceptance of this DPA on the same basis as the Principal Agreement. In the event of any conflict between this DPA and the Principal Agreement with respect to the processing of Personal Data, this DPA shall prevail.

1. DEFINITIONS

“Authorized Sub-processor” means Amazon Web Services EMEA SARL, and any additional Sub-processor subsequently approved in writing by the Controller pursuant to Section 6.

“Controller Personal Data” means the Personal Data described in Section 3 of this DPA processed by Documill as Processor on behalf of the Controller under the Principal Agreement.

“Data Protection Laws” means the EU General Data Protection Regulation 2016/679 (“GDPR”), the Finnish Data Protection Act (1050/2018), and any other applicable national data protection legislation.

“Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Controller Personal Data.

“Standard Contractual Clauses” means the standard contractual clauses approved by European Commission Implementing Decision (EU) 2021/914, or any subsequent replacement approved by the European Commission.

“Third Country” means any country outside the EU/EEA not subject to a valid adequacy decision by the European Commission.

The terms “Process/Processing”, “Data Controller”, “Data Processor”, “Data Subject”, “Personal Data”, and “Special Categories of Personal Data” have the same meanings as in the GDPR.

2. SCOPE AND ROLES

In providing the SaaS under the Principal Agreement, Documill processes Controller Personal Data as Processor acting on behalf of the Controller as Data Controller. Each party warrants it has the authority to enter into this DPA.

Documill shall process Controller Personal Data only in accordance with the Controller’s documented instructions as set out in this DPA and the Principal Agreement, unless required by applicable EU or Finnish law, in which case Documill shall (to the extent permitted) notify the Controller before processing.

3. DETAILS OF PROCESSING

3.1 Nature, Purpose and Subject Matter

The subject matter of processing is the provision of Documill’s SaaS platform for document-driven business process automation as described in the Principal Agreement. Documill processes Controller Personal Data solely as necessary to deliver the SaaS, including: hosting and storage of data on cloud infrastructure; user authentication and access management; document template execution and automated document generation; backup and disaster recovery; technical support and maintenance; and security monitoring and audit logging.

All processing of Controller Personal Data within document generation workflows is fully automated. Data supplied to the SaaS for document population is processed transiently in CPU memory and is automatically purged from memory upon completion of each processing operation. Documill does not retain, inspect or have visibility into the specific data processed within document templates. The Controller exclusively determines, through template configuration, what data fields are populated and what Personal Data, if any, is included in generated documents.

3.2 Categories of Personal Data

The categories of Personal Data processed depend entirely on what the Controller configures in document templates. Based on the typical use case of the Documill SaaS — document automation for customer-facing and CRM-driven workflows — Personal Data processed is likely to include some or all of the following categories of standard CRM and business contact data:

• Contact and identity data: first name, last name, job title, company name
• Business contact data: email address, phone number, business address
• Account and relationship data: customer or account identifiers, contract references
• User account data: SaaS user name, email address, authentication credentials
• Usage and log data: IP addresses, session identifiers, access timestamps

Documill does not knowingly process Special Categories of Personal Data as defined in Article 9 GDPR. If the Controller’s document templates contain Special Categories of Personal Data, the Controller must notify Documill in advance so that appropriate additional safeguards can be agreed in writing.

3.3 Categories of Data Subjects

Data Subjects are those individuals whose Personal Data the Controller includes in document templates, typically: the Controller’s customers, prospects and business contacts; the Controller’s employees and authorized SaaS users; and any other individuals whose data the Controller configures within document workflows.

3.4 Duration

Processing continues for the duration of the SaaS Term as defined in the Principal Agreement, plus the period required for return or erasure under Section 9 of this DPA.

4. INFORMATION SECURITY AND ISO 27001 CERTIFICATION

Documill Oy is certified to ISO/IEC 27001, the international standard for Information Security Management Systems. This certification, audited and renewed annually by an accredited third-party certification body, provides independent verification that Documill has implemented a comprehensive and continuously improving information security management framework covering people, processes and technology.

The ISO 27001 certification scope encompasses all processing of Client data in connection with the Documill SaaS service, including the infrastructure operated by the authorised Sub-processor (Amazon Web Services EMEA SARL, AWS eu-west-1, Dublin, Ireland). Upon request, Documill will provide the Controller with a copy of its current ISO 27001 certificate.

Documill implements and maintains a comprehensive set of technical and organizational measures to ensure the security of Controller Personal Data, consistent with its ISO 27001 certified Information Security Management System (ISMS). These measures address, as a minimum:

• Pseudonymisation and encryption of Personal Data at rest and in transit using industry-standard protocols (TLS/SSL for data in transit; encryption at rest on AWS infrastructure);
• Automated and immediate purging of Personal Data from processing memory upon completion of each document generation operation, ensuring no residual Personal Data remains in CPU memory after processing is complete;
• Ongoing confidentiality, integrity, availability and resilience of all processing systems and services;
• The ability to restore availability and access to Controller Personal Data in a timely manner following any physical or technical incident;
• Access controls based on the principle of least privilege; multi-factor authentication for administrative access; and full audit logging of all access to systems processing Controller Personal Data;
• Regular testing, assessment and evaluation of the effectiveness of security measures as part of Documill’s ISO 27001 annual audit and continuous improvement cycle;
• Documented incident response procedures, including a Personal Data Breach notification process aligned with Section 7 of this DPA;
• Regular security awareness training for all personnel with access to Controller Personal Data.

Documill will maintain its ISO 27001 certification throughout the SaaS Term and will promptly notify the Controller if the certification lapses or is materially changed in scope. Documill will provide the Controller with a copy of its current ISO 27001 certificate upon request, and will make available relevant audit summaries or evidence of compliance as reasonably required by the Controller under Section 10 of this DPA.

5. RELIABILITY AND CONFIDENTIALITY

Documill shall ensure that all personnel with access to Controller Personal Data are subject to binding confidentiality obligations, have received appropriate data protection training, and are granted access strictly on a need-to-know basis consistent with Documill’s ISO 27001 access control policies.

6. SUB-PROCESSING

The Controller hereby authorizes Documill to engage Amazon Web Services EMEA SARL (AWS eu-west-1, Dublin, Ireland) as Sub-processor for cloud infrastructure hosting and storage of the Documill SaaS platform and all Controller Personal Data. AWS processes all data within the EU; no Third Country transfer occurs in connection with this Sub-processor.

Documill shall not engage any additional Sub-processors without giving the Controller at least thirty (30) days’ prior written notice, during which time the Controller may object on reasonable grounds. Documill shall: (i) conduct due diligence on each Sub-processor to ensure GDPR-equivalent protections; (ii) impose data protection obligations on each Sub-processor equivalent to those in this DPA; and (iii) remain fully liable to the Controller for any failure by a Sub-processor to fulfil its obligations.

7. PERSONAL DATA BREACH

Documill shall notify the Controller without undue delay, and in any case within twenty-four (24) hours, upon becoming aware of a Personal Data Breach. The notification shall describe: the nature of the breach and approximate number of Data Subjects and records affected; the contact details of Documill’s designated data protection contact; the estimated consequences; and the measures taken or proposed to address and mitigate the breach.

Documill shall cooperate with the Controller in investigating, mitigating and remediating any Personal Data Breach, and shall not notify any third party without the Controller’s prior written consent unless required by applicable law.

8. DATA SUBJECT RIGHTS AND DPA ASSISTANCE

Documill shall promptly notify the Controller — within five (5) business days — of any request received from a Data Subject or supervisory authority relating to Controller Personal Data, and shall not respond without the Controller’s prior written authorization. Documill shall provide reasonable technical and organizational assistance to enable the Controller to respond to Data Subject rights requests and to carry out data protection impact assessments under Article 35 GDPR and prior consultations under Article 36 GDPR.

9. ERASURE OR RETURN OF CONTROLLER PERSONAL DATA

As described in Section 3.1, document generation processing within the SaaS is fully automated and transient: Personal Data supplied for document population is processed in CPU memory and purged immediately upon completion of each operation. Such transiently processed data is not retained by Documill and is therefore not in scope for return or erasure under this Section.

Certain Personal Data associated with service delivery — including user account data, authentication credentials and audit and access logs — is processed by Documill acting as an independent Data Controller for its own purposes of access management, security monitoring and service operation. The Controller is not the Data Controller in respect of such data, and accordingly this Section does not apply to it.

Generated document outputs are delivered directly to the Controller’s own controlled environment — such as Salesforce, SharePoint or other systems designated by the Controller — and are not retained on Documill’s infrastructure or that of its Sub-processor. Documill therefore holds no stored document outputs on behalf of the Controller at any point.

As a consequence of the above, Documill does not hold any Controller Personal Data in a persistent form on behalf of the Controller at any time during or after the SaaS Term. No return or erasure action by Documill is therefore required upon termination or expiry of the Principal Agreement. The Controller is solely responsible for the management, retention and deletion of Personal Data within its own controlled environments to which document outputs have been delivered.

For the avoidance of doubt, nothing in this Section affects Documill’s rights and obligations as an independent Data Controller in respect of Personal Data it processes for its own service operation purposes, including user account data and audit logs, which are governed by Documill’s own privacy policy and applicable Data Protection Laws.

10. AUDIT RIGHTS

Upon reasonable written request with at least thirty (30) days’ notice, Documill shall make available all information necessary to demonstrate compliance with this DPA and shall permit audits by the Controller or a mandated third-party auditor, conducted during business hours and in a manner that minimizes operational disruption. Documill’s ISO 27001 certification documentation and audit summaries shall be accepted as primary evidence of compliance with technical and organizational security requirements. The Controller shall bear audit costs unless the audit reveals material non-compliance, in which case Documill shall bear those costs.

11. INTERNATIONAL TRANSFERS

As at the date of the Principal Agreement, no Controller Personal Data is transferred to a Third Country. All processing takes place within the EU on AWS infrastructure in Dublin, Ireland. Should Documill wish to engage a Sub-processor located in a Third Country in the future, it will provide thirty (30) days’ notice to the Controller and shall implement appropriate safeguards, including Standard Contractual Clauses where required, before any such transfer takes place.

12. GENERAL TERMS

• This DPA shall automatically terminate upon termination or expiry of the Principal Agreement. All obligations of Documill relating to the processing of Personal Data shall survive termination.
• This DPA is governed by the laws of Finland, consistent with Section 21 of the Principal Agreement.
• Any breach of this DPA by Documill constitutes a material breach of the Principal Agreement.
• In the event of inconsistency between this DPA and the Principal Agreement, this DPA prevails in respect of data protection obligations for Personal Data of EU/EEA Data Subjects.
• If any provision of this DPA is invalid or unenforceable, the remaining provisions remain in full force. This DPA may only be amended by a written document signed by authorized representatives of both parties.

— End of Appendix 1 – Data Processing Agreement —