Document details Version number: 1.0 Date of entry into force: 30 September 2026 Next planned evaluation date: 30 September 2027 Classification: Public

Explanatory note

Rule Step B.V. ("we", "us" or "the Controller" (Verwerkingsverantwoordelijke)) attaches great importance to the protection of the personal data of its customers, end users and other data subjects. This Privacy Policy ("Policy") has been drawn up in accordance with the Algemene Verordening Gegevensbescherming [General Data Protection Regulation] (hereinafter: "AVG" [GDPR]), the Uitvoeringswet Algemene Verordening Gegevensbescherming (hereinafter: "UAVG"), the Dutch Civil Code (Burgerlijk Wetboek, hereinafter: "BW").

This Policy applies to all processing activities with regard to personal data that take place in the context of the online services (hosting, domain registration and management, e-mail, certificates, licences, back-ups) and consulting services (ICT advice) offered by Rule Step B.V. The delivery arrangements with customers are laid down in the General Terms and Conditions, the applicable Supplementary Terms and Conditions (AVO for online services; AVC for consulting) and the Order Form. For the processing of personal data on behalf of customers, the Data Processing Agreement (Verwerkersovereenkomst, DPA) applies.

Where relevant, this Policy makes a strict separation between processing towards businesses (B2B) and consumers (B2C), in view of the specific protection that Book 6 Section 3 BW (Dutch Civil Code) (articles 6:231 et seq.) offers to consumers.

Article 1: Definitions

1.1. AVG: Verordening (EU) 2016/679 [Regulation (EU) 2016/679] of the European Parliament and of the Council of 27 April 2016.

1.2. UAVG: Uitvoeringswet Algemene Verordening Gegevensbescherming [Dutch GDPR Implementation Act].

1.3. Personal Data (Persoonsgegevens): any information relating to an identified or identifiable natural person.

1.4. Processing (Verwerking): any operation or set of operations relating to personal data.

1.5. Controller (Verwerkingsverantwoordelijke): Rule Step B.V., which determines the purpose of and the means for the processing (for its own administrative processing).

1.6. Processor (Verwerker): a natural or legal person that processes personal data on behalf of the Controller. For the online services, Rule Step is the Processor on behalf of the Customer (the Controller within the meaning of the AVG (GDPR)).

1.7. Sub-processor (Sub-verwerker): a processor engaged by Rule Step.

1.8. B2C Consumer (B2C-consument): a natural person who does not act in the exercise of a profession or business.

1.9. B2B Customer (B2B-klant): a legal person or natural person who acts in the exercise of a profession or business.

1.10. Customer (Klant): a party with which Rule Step concludes an agreement (as further defined in AW Art. 1.1).

Article 2: Identity of the Controller

2.1. The Controller for the processing mentioned in this Policy (own administrative processing) is:

• Company name: Rule Step B.V.
• KvK number: 42042967
• RSIN: 869445200
• Legal form: Besloten Vennootschap [private limited liability company]
• Business address: Amsterdam, the Netherlands
• Functionaris voor Gegevensbescherming [Data Protection Officer] (FG/DPO): J.J. van Grondelle (by board resolution)
• Privacy contact details: privacy@rulestep.com

2.2. For processing on behalf of customers in the context of the online services, Rule Step acts as Processor; the Customer is in those cases the Controller. The arrangements are laid down in the Data Processing Agreement (Verwerkersovereenkomst, DPA).

Article 3: Overview of processing per processing activity

In compliance with articles 13 and 14 AVG (GDPR), an overview is provided below per category of services of the processing purposes, the categories of data subjects, the categories of personal data, the legal basis for processing and the retention periods.

Table 1: Online services — Hosting (Dedicated servers, VPS, app hosting)

Table 2: Online services — Domain registration and management

Table 3: Consulting services (ICT advice)

Note: if Rule Step, in a concrete consulting assignment, processes personal data on behalf of the Customer (for example when advising on a data breach or analysing a customer database), Rule Step acts as Processor and the Customer as Controller. The arrangements are laid down in the Data Processing Agreement (DPA). This Policy concerns Rule Step's own administrative processing operations.

Article 4: Legal bases for processing and B2B/B2C separation

4.1. The processing of personal data takes place exclusively on the grounds referred to in article 6(1) under a, b, c and f AVG (GDPR), as specified in the tables under article 3.

4.2. B2C processing and unreasonable terms: where the data subject is a Consumer (B2C), the processing is subject to the strict rules of Book 6 Section 3 BW (Dutch Civil Code) (articles 6:231 et seq.). General terms and conditions that conflict with reasonableness and fairness, or that constitute an unreasonable burden for the Consumer in the exercise of his AVG (GDPR) rights, are not binding on the Consumer. Consumer rights can never be excluded or limited by Rule Step B.V., neither by an appeal to performance of a contract, nor via general terms and conditions.

4.3. Consent (Art. 6(1)(a) AVG (GDPR)): where consent is used as a legal basis, it is given freely, specifically, informed and unambiguously prior to the processing. The data subject may withdraw this consent at any time and free of charge (article 7(3) AVG (GDPR)). The withdrawal of consent does not affect the lawfulness of the processing prior to the withdrawal.

Article 5: Retention periods and data minimisation

5.1. Personal data are not retained longer than necessary for the realisation of the purposes for which they were collected (article 5(1)(e) AVG (GDPR)).

5.2. The specific retention periods are set out in the tables under article 3.

5.3. The retention period of seven years for accounting and financial data is based on article 193 of the Dutch Criminal Code (Wetboek van Strafrecht) and the limitation periods of article 3:307 BW.

5.4. For consulting services, a retention period of five years (B2B) or two years (B2C) applies after termination of the agreement, in view of the legitimate interest of Rule Step B.V. to be able to defend itself against possible liability claims within the applicable limitation period (article 3:306 BW for unlawful acts, article 3:307 BW for contractual claims). An interest balancing test pursuant to article 6(1)(f) AVG (GDPR) is documented.

5.5. After expiry of the retention periods, the personal data are deleted or anonymised without delay and securely, unless a statutory obligation to retain longer opposes deletion.

Article 6: Data transfer outside the European Economic Area (EEA)

6.1. The primary infrastructure for the online services is hosted at hosting partners within the EEA; accordingly this processing takes place within the EEA.

6.2. Where personal data are transferred to third countries (for example to ICANN in the United States for gTLD coordination), Rule Step B.V. provides appropriate safeguards in accordance with articles 44-49 AVG (GDPR).

6.3. These safeguards consist of:

(a) the conclusion of Standard Contractual Clauses (SCCs) in accordance with Implementing Decision (EU) 2021/914;

(b) the execution and documentation of a Transfer Impact Assessment (TIA) per transfer;

(c) the application of the EU-US Data Privacy Framework (2023) where applicable; in the event of invalidation of the DPF, SCCs and supplementary measures are applied automatically;

(d) the implementation of supplementary measures in accordance with EDPB Recommendations 01/2020, such as strong encryption of which the keys remain within the EEA.

6.4. For domain services, ICANN regulations require the transfer of WHOIS data. For B2C Consumers, WHOIS data are shielded by default (AVO Art. 4.5). Publication of WHOIS data requires separate, active and specific consent (opt-in), which is not bundled with other conditions.

6.5. For consulting services, in principle no transfer outside the EEA takes place. If this is necessary in a specific assignment, the same safeguards as in paragraph 6.3 apply.

Article 7: Sub-processors

7.1. Rule Step B.V. makes use of reliable processors and sub-processors that provide sufficient guarantees for the implementation of appropriate technical and organisational measures, in accordance with article 28 AVG (GDPR).

7.2. A detailed and current register of the sub-processors is included in Annex 1 of this Policy.

7.3. Authorisation mechanism: in the event of a proposed change or addition of a sub-processor, Rule Step B.V. notifies the Customers (contracting parties) thereof in advance. This right belongs to the Controller (Customer) on the basis of article 28(2) AVG (GDPR). Data subjects have no independent right to object to sub-processor changes under the AVG (GDPR); their rights are safeguarded via their own controller. If a Customer refuses the authorisation, Rule Step seeks alternative solutions or ceases the processing to the extent that the sub-processor is needed for it.

Article 8: Security measures

8.1. Taking into account the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing, as well as the risk of varying likelihood and severity for the rights and freedoms of data subjects, Rule Step B.V. takes appropriate technical and organisational measures (article 32 AVG (GDPR)).

8.2. Data Processing Agreement: insofar as Rule Step B.V. acts as processor within the meaning of article 28 AVG (GDPR), the processing of personal data on behalf of the controller is regulated in a separate Data Processing Agreement (DPA). A Service Level Agreement is insufficient to meet the requirements of article 28(3) AVG (GDPR).

8.3. Online services: - Encryption of personal data 'at-rest' (AES-256) and 'in-transit' (TLS 1.2 or higher); - Role-based access control (RBAC); - Multi-factor authentication (MFA) for all administrative access; - Documented and periodically tested incident response procedures; - Regular vulnerability scans and penetration tests; - Continuous security monitoring and logging; - Physical security via the data centre provider; - Minimum 4-eyes principle for critical operations.

8.4. Domain services: - Application of DNSSEC where supported by the respective top-level domain; - Encrypted WHOIS data transfer (TLS); - Strict access controls and authentication for domain management; - Incident response procedures and secure credential storage.

8.5. Consulting services: - Encrypted storage and communication (TLS); - Access controls on project material; - Secure communication channels; - Confidentiality obligation for all persons engaged (see AVC Art. 7); - Logging of access to project data.

8.6. NIS2 / Cybersecurity Act (Cyberbeveiligingswet, Cbw): security measures in accordance with the Cbw, exclusively insofar as Rule Step B.V. qualifies as an essential or important entity within the meaning of that legislation and insofar as the Cbw has entered into force. In the event of significant incidents, an early warning is also issued within 24 hours to the competent CSIRT.

Article 9: Personal data breach notification

9.1. In the event of a personal data breach, Rule Step B.V. acts without delay in accordance with the internal procedures.

9.2. Notification to the supervisory authority: Rule Step B.V. notifies the Autoriteit Persoonsgegevens [Dutch Data Protection Authority] of a personal data breach no later than 72 hours after it has become aware thereof, unless the breach is unlikely to result in a risk to the rights and freedoms of data subjects (article 33(1) AVG (GDPR)).

9.3. Notification to data subjects: when a personal data breach entails a high risk for the rights and freedoms of data subjects, Rule Step B.V. notifies the data subjects of the breach without undue delay (article 34(1) AVG (GDPR)).

9.4. Notification to Customer (Processor role): if Rule Step has a personal data breach relating to personal data that it processes on behalf of a Customer, Rule Step notifies the Customer without delay, but no later than within forty-eight (48) hours, in accordance with the Data Processing Agreement (DPA Art. 7).

9.5. Personal data breach register: Rule Step B.V. documents all personal data breaches, their causes, the consequences and the measures taken in an internal personal data breach register (article 33(5) AVG (GDPR)).

9.6. NIS2 / Cbw: in the event of significant incidents, an early warning notification is also issued within 24 hours to the competent CSIRT (Computer Security Incident Response Team), insofar as Rule Step qualifies under the Cbw.

Article 10: Rights of data subjects

10.1. Data subjects have the following rights under the AVG (GDPR), which can be exercised at any time free of charge:

(a) Right of access (article 15 AVG (GDPR));

(b) Right to rectification (article 16 AVG (GDPR));

(c) Right to erasure (article 17 AVG (GDPR), "right to be forgotten"), unless the processing is necessary for a legal obligation or for the establishment, exercise or defence of legal claims;

(d) Right to restriction of processing (article 18 AVG (GDPR));

(e) Right to data portability (article 20 AVG (GDPR));

(f) Right to object (article 21 AVG (GDPR)), including profiling; in the event of objection by the Consumer (B2C), the processing stops, unless there are compelling legitimate grounds that outweigh;

(g) Rights regarding automated decision-making (article 22 AVG (GDPR)): the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects the data subject.

10.2. Procedure description: - Requests are submitted in writing or electronically via privacy@rulestep.com. - Rule Step B.V. verifies the identity of the requester by means of appropriate identity verification before providing or making changes. - Rule Step B.V. responds without delay, but no later than within one month after receipt of the request. In the case of complex requests, this term may be extended by two months, subject to notification within the first month (article 12(3) AVG (GDPR)). - Information is provided free of charge, unless the request is manifestly unfounded or excessive (article 12(4) AVG (GDPR)).

10.3. Right to complain: data subjects have the right to lodge a complaint with the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) or with another supervisory authority in an EU Member State.

Article 11: Automated decision-making and profiling

11.1. Online services — hosting: automated domain suspension due to violation of the AUP is applied, with always an option for human review at the request of the registrant. Other automated decision-making with legal effects is currently not applied. If future systems (fraud detection, automated account suspension, profiling) are implemented, this will be clearly and transparently disclosed in this Policy, with human review (article 22(3) AVG (GDPR)).

11.2. Domain services: automated domain suspension due to violation of the AUP is applied, with an option for human review upon request. Other profiling or automated decision-making with legal effects is not applied.

11.3. Consulting services: no automated decision-making with legal effects or similarly significant consequences is applied.

Article 12: Data Protection Officer (FG/DPO)

12.1. J.J. van Grondelle, director of Rule Step B.V., has been appointed by board resolution as Functionaris voor Gegevensbescherming [Data Protection Officer] (FG/DPO), Privacy Officer and Information Security Officer. This appointment is permitted pursuant to article 38(6) AVG (GDPR) (a solely/independently authorised director may be DPO for small organisations).

12.2. For hosting services and domain services, the necessity of a DPO is assessed annually on the basis of article 37 AVG (GDPR). If Rule Step remains below the 'large-scale' threshold, this is documented internally with a reasoned assessment of why a DPO is not legally required.

12.3. Regardless of whether a DPO is legally required, all questions regarding data protection may be addressed to privacy@rulestep.com.

Article 13: Data Protection Impact Assessment (DPIA)

13.1. When a processing is likely to result in a high risk to the rights and freedoms of data subjects, Rule Step B.V. carries out a Data Protection Impact Assessment (DPIA) prior to the processing (article 35(1) AVG (GDPR)).

13.2. A DPIA is in any event required when the processing falls under the criteria of article 35(3) AVG (GDPR) or the list of the Autoriteit Persoonsgegevens.

13.3. If the DPIA shows that the processing entails a high risk that cannot be mitigated, Rule Step consults the Autoriteit Persoonsgegevens prior to the processing (article 36 AVG (GDPR)).

Article 14: Applicable law and competent court

14.1. This Privacy Policy and all agreements and legal relationships arising therefrom are governed exclusively by Dutch law.

14.2. B2B: for B2B parties, the court in the arrondissement [judicial district] in which Rule Step B.V. has its statutory seat (Amsterdam) has jurisdiction to hear disputes.

14.3. B2C: for Consumers (B2C), the competent court in the Consumer's place of residence is also competent, in accordance with Regulation (EU) 1215/2012 (Brussels I bis) — in particular article 18(1) — and article 6:231 et seq. BW. This choice does not affect the jurisdiction of the supervisory authorities in other Member States of the European Union.

Article 15: Amendments and entry into force

15.1. Rule Step B.V. reserves the right to amend this Privacy Policy. Amendments enter into force on the date of entry into force stated in the document.

15.2. Material amendments that affect the rights and freedoms of data subjects are communicated in good time and in an appropriate manner (e-mail, notification on the website). For Consumers (B2C), a materially detrimental amendment enters into force only after express notification and with a reasonable period of at least thirty days.

Signing

Thus adopted by the Controller:

Rule Step B.V. Place: Amsterdam Date: 30 September 2026

Name: J.J. van Grondelle Position: Director (alleen/zelfstandig bevoegd [solely/independently authorised]) / Functionaris voor Gegevensbescherming (FG/DPO) [Data Protection Officer] / Privacy Officer / Information Security Officer Signature: ___________________________

Annex 1: Sub-processor Register

This register is kept up to date and can be requested at any time from Rule Step B.V. via privacy@rulestep.com. The overview below shows the current sub-processors per service category.

Table 4: Sub-processors Online services — Hosting

Table 5: Sub-processors Online services — Domain registration

Table 6: Sub-processors Consulting services

Note: for consulting services, no additional sub-processors are engaged beyond the parties listed for online services, unless agreed otherwise in a concrete assignment. If this is nevertheless necessary, the Customer is informed in advance in accordance with the authorisation mechanism of article 7.3.

End of document