Terms of Service

• "Service" — The VeroNavi web application that aggregates tax data from the Finnish Tax Administration APIs for use by accounting firms. • "User" — A natural person who has registered for the Service. • "Organization" — An accounting firm or other company that the User has created in the Service. • "Client" — A taxpayer (company or individual) added to the Service by the Organization, whose tax data is viewed through the Service. • "Tax Data" — Data retrieved from the Finnish Tax Administration APIs, such as tax letters, VAT returns, prepayments, and income register filings.

VeroNavi is a SaaS service for accounting firms that: • Aggregates tax data from the Finnish Tax Administration APIs into a single view • Enables monitoring and management of client tax data • Displays letters, deadlines, VAT returns, prepayments, and income register filings • Only reads data — the Service never submits data to the Tax Administration or files returns on behalf of the user The Service does not replace professional judgment of an accountant. The User is always responsible for verifying the accuracy of tax data from original sources.

Using the Service requires registration. By registering, you agree to: • Provide accurate information (name, email, organization business ID) • Keep your login credentials confidential and secure • Notify us immediately if you suspect unauthorized use of your account • Use the Service only for your organization's business purposes The User must be at least 18 years old and authorized to represent their organization. The Service Provider has the right to close accounts used in violation of these Terms. By registering, the User accepts the Terms for themselves. By creating the Organization in the Service, or by accepting the Terms on the Organization's behalf in the Service, the User accepts the Terms and their annexes, including the Data Processing Agreement in Annex 1, on behalf of the Organization, and confirms being authorized to bind the Organization to them.

The User agrees to: • Comply with all applicable laws and regulations, including tax procedure, data protection legislation, and anti-money laundering legislation • Ensure that Suomi.fi authorizations are valid and appropriate before viewing client tax data • Not share login credentials with other persons • Not use the Service for illegal purposes or in a way that violates third-party rights • Report any security vulnerabilities discovered to the Service Provider without delay • Ensure that other users in the organization comply with these Terms

The Service's source code, user interface, documentation, trademarks, and other content are the property of the Service Provider or its licensors. The User is granted a limited, non-exclusive, non-transferable right to use the Service for the duration of these Terms. The User may not: • Copy, modify, or create derivative works of the Service • Decompile, reverse engineer, or attempt to discover the source code • Sell, license, or rent the Service to third parties • Remove or obscure copyright or ownership notices

The Service Provider processes personal data in accordance with the Privacy Policy. For personal data processed on the Organization's behalf, the roles are as follows: • For tax data and client data, the Organization is the controller or, where it processes data on behalf of its client, that client's processor. The Service Provider is a processor or sub-processor. • For income register data, the controller is the employer (the Organization's client company), the Organization is the employer's processor, and the Service Provider is the Organization's sub-processor. • For Users' account and billing data, the Service Provider is an independent controller in accordance with the Privacy Policy. The data processing agreement under GDPR Article 28 is Annex 1 to these Terms and forms part of the Terms. The Organization accepts it together with the Terms. It contains terms on, among other things, instructions, confidentiality, security, sub-processors, assistance, deletion of data and audits. The Service Provider notifies the Organization of personal data breaches without undue delay and no later than 48 hours after becoming aware of the breach.

Annex 1: Data Processing Agreement

We aim to provide the Service with maximum uptime. However, we do not guarantee uninterrupted service. The Service may be temporarily unavailable due to: • Planned maintenance (advance notice provided) • Tax Administration API outages (the test environment is available only on weekdays 8:00–16:00) • Force majeure situations The Service Provider is not responsible for third-party (Tax Administration, Suomi.fi) service disruptions or resulting delays in data availability.

The Service is provided "as is". To the maximum extent permitted by applicable law: • The Service Provider does not guarantee the accuracy, timeliness, or completeness of data retrieved from the Tax Administration. The User should always verify data from original sources. • The Service Provider's total liability is limited to fees paid by the Organization in the preceding 12 months. • The Service Provider is not liable for indirect damages, including lost revenue, data loss, or business interruption. • The limitation of liability does not apply to damages caused by intent or gross negligence. The User is responsible for ensuring they have appropriate authorizations to view their clients' tax data.

Service pricing is determined by the current price list. Changes to pricing will be communicated at least 30 days in advance. • Billing period is monthly, unless otherwise agreed • Payments are charged in advance at the beginning of each billing period • Prices are exclusive of VAT, which is added at the applicable rate • Unpaid invoices: The Service Provider has the right to restrict access if invoices are unpaid more than 30 days past due • The free trial is available only to new customers, once per Business ID (Y-tunnus). If the same Business ID has already used the trial — including cases where that organization has since been deleted from the Service — a new trial will not be granted, and the subscription starts immediately with a payment method required [PLACEHOLDER: Detailed pricing will be published before commercial launch.]

The User can cancel their account at any time through the service settings or by emailing tuki@veronavi.fi. The Organization can terminate the agreement under the Terms in writing by emailing tuki@veronavi.fi. The Organization's termination takes effect at the end of the current billing period or, if no billing period is running (for example a trial without a card, or a subscription that has been cancelled and whose paid period has ended, while the account still exists), immediately when the Service Provider receives the written notice. A trial period or subscription expiring without termination does not end the agreement. The Service Provider always terminates the agreement under the Terms in writing. The Service Provider may terminate the agreement under the Terms or close an account: • If the Organization or its User materially breaches these Terms • If the Organization's payments are more than 60 days overdue • If the Service is discontinued entirely (at least 90 days' notice) In cases of material breach and payments more than 60 days overdue, the termination takes effect immediately. When the Service is discontinued, the termination takes effect at the end of the notice period. When a User deletes their account: • The User's own data is deleted in accordance with the privacy policy • If the User is the only member of the Organization, the Organization and the personal data processed on its behalf are also deleted immediately and cannot be restored. A data export must therefore be requested and received before deleting the account. When the agreement under the Terms ends by written termination: • The Organization can request an export of its data within 30 days after the end • Clients' tax data and other personal data processed on the Organization's behalf is deleted at the latest within 90 days after the end In both cases, audit logs are retained for 10 years per statutory requirements.

These Terms are governed by Finnish law. Disputes arising from these Terms shall primarily be resolved through negotiation. If negotiation is not possible, the dispute shall be resolved in the Pirkanmaa District Court. In consumer disputes, the User has the right to refer the matter to the Consumer Disputes Board (www.kuluttajariita.fi).

The Service Provider may modify these Terms. Changes will be notified in the Service and/or by email at least 30 days before they take effect. Changes required by law, and changes that do not weaken the position of the User or the Organization, may take effect sooner. If the changes are material and the Organization does not accept them, it may terminate the agreement under the Terms to end at the latest when the changes take effect. Prepaid fees are as a rule not refunded, but the Service Provider may consider a refund case by case. Continued use of the Service after the changes take effect constitutes acceptance of the modified Terms.

Iotera Oy Business ID: 3454475-1 Email: tuki@veronavi.fi Address: Tanhuankatu 63b, 33560 Tampere, Finland