Service provider: WeldPeak Oy, Finland

The Finnish version of these Terms is the authoritative version. This English translation is provided for convenience; in the event of any discrepancy, the Finnish version prevails.

---

PART A — Terms of the cloud service

A.1 Scope

These WeldPeak cloud service terms (“Terms”) apply to the WeldPeak welding coordination system (“WeldPeak service”) provided by WeldPeak Oy (“WeldPeak”, “Service Provider”) to the customer (“Customer”) as a cloud service. The Customer and WeldPeak have entered into a separate agreement (“Agreement”) for the use of the service. These Terms form part of the Agreement together with the General Terms and Conditions (Part B) and the Data Processing Agreement (Part C).

A.2 The service

WeldPeak makes the WeldPeak service available to the Customer from the time of activation (see Section A.3.1). After the purchase of the cloud subscription (“Cloud Subscription”) defined in the Agreement, WeldPeak grants the Customer a limited right of use to the service under the terms of the Agreement. The scope of the right of use covers the agreed modules and number of users as well as any update packages and support services.

The right of use is valid for the duration of the Agreement, and the Agreement gives the Customer no rights other than those expressly defined in the Agreement, its annexes, these Terms, and the General Terms and Conditions (Part B). All other rights are reserved to the Service Provider.

The WeldPeak service is provided on an “as is” basis. The Service Provider does not assume responsibility for the service’s freedom from defects or its suitability for a particular purpose other than as expressly stated in these terms.

A.2.1 B2B model and creation of users

The WeldPeak service is a B2B cloud service intended for business customers. There is no self-service registration. All company subscriptions and user accounts are created by the WeldPeak Oy platform administrator on the basis of the Agreement.

The owner or main user of the Customer organisation may, in accordance with the Agreement, manage the module access of existing users in the Customer’s administration view, but adding or removing users only takes place through WeldPeak Oy.

A.2.2 Personal nature of user accounts and audit trail

The WeldPeak service is designed to support the requirements of ISO 3834-2, EN 15085, and ISO 14731, which require that the welding coordinator and other responsible persons be personally identifiable in the documentation. Accordingly:

(a) Each user account is personal and intended for use by one person only. Sharing accounts among several persons is prohibited.

(b) The Customer is responsible for all actions performed with the Customer’s user accounts, including situations in which an account has been shared in breach of these terms.

(c) Subject to the Customer’s subscription, WeldPeak Oy may enforce a single concurrent session policy technically, whereby a new login with the same account ends the previous session.

(d) The electronic signatures on users’ professional documents (WPS, WPQR, test supervision, NCR, etc.) are personal. The user shall safeguard their signature image and the associated credentials carefully. Changes to a signature require the approval of WeldPeak Oy.

The number of users shall not at any time exceed the number of Cloud Subscriptions purchased by the Customer. The Customer may purchase additional Cloud Subscriptions in accordance with the applicable price list.

A.3 Activation, availability, and security measures

A.3.1 Activation

WeldPeak activates the service and creates the agreed user accounts according to the schedule defined in the Agreement. By separate agreement, WeldPeak may provide training or other additional services related to the WeldPeak service.

A.3.2 Availability

The WeldPeak service is made available to the Customer via the internet and is maintained on cloud platforms selected by WeldPeak Oy (Cloudflare Pages hosting + Supabase database). The service may not be available in all countries and is provided only in selected languages (Finnish, English).

The Customer is responsible for its own internet connection. WeldPeak is not liable for defects or errors in the Customer’s internet connection or local network.

WeldPeak aims to maintain a high level of availability but does not guarantee uninterrupted operation. The service may be temporarily suspended for maintenance, updates, or other operational reasons. Advance notice will be given within reasonable time when possible.

A.3.3 Security measures

The WeldPeak service includes the following security measures:

1. Regular backups of the Customer’s data (full daily backup via the Supabase database, point-in-time recovery for 7 days back)
2. Encrypted server connection (HTTPS/TLS 1.3)
3. Password protection and session tokens (JWT)
4. Row-Level Security (RLS) at the database level: organisations’ data is isolated from each other
5. Single concurrent session enforcement when required (see A.2.2)
6. Sentry error monitoring for automated detection of error situations

The Customer is responsible for its own user accounts and devices, the related security measures (e.g. password strength, updates, antivirus), and ensuring that users do not introduce malware or security incidents into the service.

A.4 Update package

WeldPeak updates the service regularly in response to reported defects, user needs, and the development roadmap. Updates are included in the Cloud Subscription price unless otherwise agreed. Updates may include new features, fixes, or changes to existing functionality.

WeldPeak may also make updates related to standard changes (ISO 9606-1/-2, ISO 14732, EN 1090-1/-2, EN 15085, etc.) when the standards are updated. The Customer is responsible for always using documentation according to the latest WeldPeak version.

A.5 Support

The Customer receives support for the use of the service on the following conditions: the Customer has familiarised itself with the documentation and user instructions provided by WeldPeak Oy. Support requests may be sent by email to support@weldpeak.fi or through the weldpeak.fi website.

Support covers questions about the basic operation of the service but not the training of users in matters related to welding standards. Separate training is available at additional cost.

Support response times:

• Critical malfunctions (service does not work at all): response within 8 working hours
• Functional errors: response within 2 working days
• General usage questions: response within 5 working days

Response times are calculated according to Finnish working days (Mon–Fri 9:00–17:00, excluding public holidays).

A.6 Pricing

Pricing is defined in the Agreement and its annexes (Price List). All prices are in euros (€) and exclude value-added tax unless expressly agreed otherwise.

Direct charges payable at activation are invoiced at the time of activation. Recurring annual or monthly fees are invoiced according to the Agreement. The payment term is 14 days from the invoice date unless otherwise agreed.

WeldPeak may review pricing annually. The Customer will be notified of price changes at least thirty (30) days before they take effect. If the Customer does not accept the new prices, the Customer may terminate the Agreement to end before the change takes effect.

A.7 Limitation of liability

The limitation of liability is governed by Section B.5 of Part B (Limitation of liability).

A.8 Confidentiality and data protection

All data that the Customer enters into WeldPeak is the property of the Customer.

WeldPeak Oy has the right to use data entered by the Customer into WeldPeak in anonymised form for statistical, business development, and product development purposes, and for fulfilling the obligations under the Agreement. In doing so, the identity or detailed information of the Customer or its personnel is not disclosed to third parties.

If the Customer stores personal data in WeldPeak (e.g. welders’ names, qualification certificates, training data, photographs), the Customer is responsible for ensuring that the collection and processing of personal data takes place in accordance with applicable data protection legislation (GDPR, EU 2016/679 and its national implementations) and the Data Processing Agreement (Part C).

More detailed terms regarding personal data are defined in Part C (Data Processing Agreement).

A.8.1 Shared material library

WeldPeak Oy maintains a shared material library (base materials, filler materials and shielding gases) that is available to all Customers within the service.

WeldPeak Oy has the right to review material rows that Customers add to the service and to add a corresponding entry to the shared library if such an entry does not already exist there. This applies only to the technical details of a material: the grade name, standard reference, material or classification group (e.g. ISO/TR 15608, ISO 9606, ISO 14175), composition limits and similar designations. These are technical designations based on public standards and manufacturer data, not the Customer’s trade secrets.

Customer information is not disclosed to other Customers. In particular:

(a) The shared library does not record which Customer’s library an entry appeared in (b) No Customer documents (WPS, pWPS, WPQR, records), projects, personal data, prices, supplier or distributor details, or other business information is transferred to the shared library (c) The Customer’s own library row remains unchanged for them, and it is shown to them instead of the shared version

A Customer’s own material rows are visible only to that Customer. They do not become visible to other Customers unless WeldPeak Oy adds a corresponding entry to the shared library in the manner described in this clause.

A.9 Retrieval of Customer Data upon termination

The Customer may request in writing, no later than one (1) month before the end of the Agreement, that WeldPeak makes the Customer’s data available for download through the service. The download is available for 45 days from receipt of the request.

After this 45-day period, WeldPeak Oy is not obliged to retain the Customer’s data and may delete it entirely from its systems. Backups will however be retained according to their own life cycle (up to 30 days after the last active copy).

The export is performed in commonly used formats (CSV, JSON, PDF) in standard form. WeldPeak is not obliged to provide custom exports but may offer them at an additional cost.

A.10 General Terms and Conditions

The WeldPeak Oy General Terms and Conditions (Part B) form an integral part of the Agreement and supplement these Terms.

A.11 Validity and termination

These Terms enter into force upon activation of the WeldPeak service and remain in force until the Agreement ends according to this Section A.11.

The Agreement is valid for the initial term defined in the Agreement and continues thereafter as an open-ended agreement, unless either party terminates it in writing at least six (6) months before the end of the initial term or any subsequent renewal term.

The Customer shall pay all fees, costs, and other charges incurred up to the termination date by the termination date at the latest.

The Agreement may be terminated immediately on the basis of material breach of contract pursuant to Section B.6 of Part B.

A.12 Applicable law and dispute resolution

These Terms are governed by Section B.18 of Part B (Applicable law and dispute resolution).

A.13 Assignment of the Agreement

The assignment of the Agreement is governed by Section B.13 of Part B (Assignment).

---

PART B — WeldPeak Oy General Terms and Conditions

B.1 Scope

These WeldPeak Oy General Terms and Conditions (“General Terms”) apply to the delivery of all products and services provided by WeldPeak Oy (“WeldPeak”, “Service Provider”).

WeldPeak Oy’s offers are not binding on the Service Provider unless otherwise stated in writing. The Customer is responsible for the accuracy and completeness of the information provided in its request for quotation.

The application of the Customer’s purchasing conditions or other terms is expressly rejected.

The Customer is responsible for the selection, use, and adaptation of the service to its own needs, including compatibility with its own systems. The Customer is also responsible for adequately organising its information security, which includes the necessary organisational measures to protect data.

WeldPeak may use subcontractors, sub-suppliers, and licensors for the delivery of the service.

The Customer may request a free two (2) week trial period before entering into the Agreement. During the trial period, the Customer may use the basic functions of the WeldPeak service without charge. After the trial period, access to the service is blocked unless an Agreement is concluded.

B.2 Definitions

Unless otherwise defined in the Agreement, the following terms have the following meanings:

“Activation” means the actions of the Service Provider to make the service available in the agreed scope.

“Agreement” means the written agreement between the Customer and WeldPeak Oy to which these General Terms and other annexes are attached.

“Cloud Service” means the welding coordination system provided by WeldPeak that is accessible via the internet.

“User” means a welding coordinator belonging to the Customer’s personnel or an external contractual coordinator for whom a personal user account has been created in the WeldPeak service.

“Cloud Subscription” means the right of use purchased by the Customer to a specific number of users and specific modules.

“Customer Data” means all data entered into or created via WeldPeak by the Customer or its Users, including welding procedures (WPS, pWPS, WPQR, HPTK), qualification certificates, welding coordinator data, project and production data, NDT results, and other documents.

“Personal Data” means data within the meaning of Article 4(1) of the GDPR (EU 2016/679).

“Intellectual Property” means all copyrights, patents, trademarks, trade name and domain name rights, design rights, software rights, database rights, trade secrets, and other intellectual property rights, whether registered or unregistered, worldwide.

“WeldPeak” or “WeldPeak service” means the welding coordination system of WeldPeak Oy as defined in the Agreement.

“Third Party Products” means third-party software products integrated into or used in connection with the service (e.g. Supabase database platform, Cloudflare hosting service, Sentry error monitoring), including open-source software.

B.3 Delivery of licensed material and service

WeldPeak delivers the Cloud Service to the Customer in connection with Activation. The service may not be put into commercial use before Activation, except during the trial period (see B.1).

Defects in the service may be remedied by providing the Customer with a temporary workaround, written instructions for bypassing the defect, or by releasing an update in which the defect is fixed.

WeldPeak is not liable for defects in Third Party Products. Services provided by third parties (Supabase, Cloudflare, Sentry, etc.) operate under their own terms and service-level agreements.

B.4 Fees and invoicing

The currency of the Price List is the euro (€), unless otherwise agreed in writing.

All fees exclude value-added tax. Applicable VAT is added to the invoice separately.

If no price has been agreed in the Agreement for a delivery or service, the Price List in force on the order date applies.

WeldPeak may invoice separately for work performed outside the agreed deliveries on the basis of the Customer’s written order. Additional work may be invoiced according to the hourly rates in the Price List or at a separately agreed price.

WeldPeak may review the Price List. Price changes will be notified at least 30 days in advance. If the Customer does not accept the new prices, the Customer may terminate the Agreement to end on the effective date of the change.

The payment term is 14 days from the invoice date unless otherwise agreed. Late payment interest under the Finnish Interest Act applies to late payments.

If overdue fees are delayed by more than 30 days, WeldPeak may, after 15 days’ prior written notice, suspend delivery of the service until the fees have been paid.

B.5 Limitation of liability

WeldPeak Oy is liable only for direct damages that are proven to result from WeldPeak Oy’s own intentional or gross negligence. A claim for damages must be submitted to WeldPeak Oy in writing within one (1) month from the date on which the act giving rise to the damage was detected or should have been detected.

WeldPeak Oy’s aggregate liability to the Customer, whether based on breach of Agreement or otherwise, is limited to the lower of the following amounts:

(a) EUR 3,000, or (b) twenty per cent (20 %) of the total fees paid by the Customer to WeldPeak Oy under the Agreement in the twelve (12) months preceding the Customer’s claim.

If the matter concerns recurring monthly or annual fees only, liability is capped at fees corresponding to a maximum of six (6) months.

For defects in one-time services (e.g. Activation, training), WeldPeak Oy’s liability is limited to correcting the defect or repeating the service at WeldPeak Oy’s own expense, provided that the Customer has notified the defect in writing.

The Customer’s aggregate liability to WeldPeak Oy is limited to the total fees paid by the Customer under the Agreement.

The limitations of liability do not apply to:

• Intentional acts or gross negligence
• Breach of confidentiality (Section B.7) or intellectual property rights (Section B.6.2)
• Situations in which the Customer has shared user accounts with several persons (the Customer is fully liable for any resulting licence fees)

Neither party is liable to the other party for indirect damages, including loss of production, loss of profit, loss of contracts, or other similar damages, except for intentional acts, gross negligence, or breaches of Section B.7 (Confidentiality).

WeldPeak Oy is not liable for the destruction, loss, or alteration of the Customer’s data unless caused by WeldPeak Oy’s own gross negligence. WeldPeak Oy is not liable for defects, disturbances, or unavailability of Third Party Products.

B.6 Intellectual property

B.6.1 WeldPeak’s rights

All Intellectual Property rights to the WeldPeak service, its software, database structure, user interface, documentation, and other material created or provided by WeldPeak Oy belong to WeldPeak Oy or its licensors.

The Customer is granted only a limited right of use as defined in these General Terms and the Agreement.

The Customer may not:

1. Copy or reproduce the service or any part of it
2. Modify, adapt, or create derivative works
3. License, sublicense, lease, sell, or transfer the service to a third party (except to its own authorised users)
4. Reverse engineer or decompile the source code of the service, unless expressly permitted by mandatory law
5. Use the service to build a competing product or service
6. Copy the functionality, integrations, user interface, or graphics of the service

B.6.2 The Customer’s rights

The Customer’s Intellectual Property rights existing prior to the Agreement remain with the Customer.

The Customer grants WeldPeak Oy a free, worldwide, limited right of use to the data entered by the Customer into WeldPeak only to the extent required for the performance of the Agreement.

B.6.3 The Customer’s responsibility for content

The Customer is responsible for the accuracy, currency, and legality of the content of all information entered into WeldPeak. In particular, the Customer is responsible for ensuring that:

(a) Welding procedures (WPS, pWPS, WPQR), qualification data, and other technical documents are up to date and conform to applicable standards (b) Welders’ and welding coordinators’ data are up to date (c) Any personal data is processed in accordance with the law (d) The Customer has the right to store all information it imports into WeldPeak

WeldPeak Oy is not liable for errors in the operation of the service that result from inaccurate, outdated, or incomplete information provided by the Customer.

B.6.4 Infringement protection

If a third party claims that the WeldPeak service infringes its Intellectual Property rights, WeldPeak Oy will defend the Customer against such a claim and compensate the Customer for direct damages incurred, provided that:

(a) The Customer notifies WeldPeak Oy of the claim without delay in writing (b) The Customer cooperates in the defence (c) WeldPeak Oy has the right to lead the defence and to agree on a settlement

WeldPeak Oy is not liable for infringements resulting from:

• The Customer’s unauthorised or non-contractual use
• Modifications made by the Customer to the service
• Combination of the service with Third Party Products without WeldPeak’s approval
• Codes or specifications provided by the Customer

B.7 Confidentiality

Each party undertakes to keep the other party’s confidential information confidential and not to disclose it to third parties without permission.

Confidential information means all information that is not generally known in the industry, including:

• The software, database structure, and development material of the WeldPeak service
• Trade secrets
• Business information, customer lists, price lists
• Material marked “Confidential” or “Luottamuksellinen”

The confidentiality obligation does not apply to information that:

• Was known to the recipient before disclosure
• Has become public without breach by the recipient
• Was obtained lawfully from a third party without similar restrictions
• Was disclosed at the request of an authority (in which case the recipient notifies the discloser and limits the disclosure to the minimum)

Upon termination of the Agreement, each party shall demonstrably return or destroy the other party’s confidential information, save for statutory retention obligations.

The confidentiality obligation remains in force for five (5) years after the end of the Agreement.

B.8 The Customer’s obligations and liability

The Customer undertakes not to:

(a) Use the service in a manner not permitted by the Agreement or these General Terms (b) Combine the service with Third Party Products not expressly approved by WeldPeak (c) Intentionally introduce malware (viruses, worms, trojans) into the service (d) Share user accounts with several persons (see A.2.2) (e) Take or permit actions that breach Section B.6 of these General Terms (Intellectual property)

The Customer is responsible for:

• The actions of its users in the service
• Actions performed with user accounts
• The information security of the devices and networks it uses
• The accuracy of information provided

The Customer indemnifies WeldPeak Oy against claims for damages arising from the gross negligence or intentional conduct of the Customer’s personnel, and against third-party infringement claims related to information, content, or specifications provided by the Customer.

B.9 Termination of the Agreement

Either party may terminate the Agreement by written notice with immediate effect if:

(a) The other party materially breaches its obligations under the Agreement and does not remedy the breach within 30 days of written notice (where the breach is remediable) (b) The other party is declared bankrupt, enters into corporate restructuring, ceases business, or is in a comparable situation

WeldPeak Oy may also terminate the Agreement if the Customer comes under the direct or indirect ownership or control of a WeldPeak competitor.

In the event of termination, the Customer pays all overdue fees, but not necessarily the price for the entire remaining contract period if the termination is based on a breach by WeldPeak.

B.10 Export and sanctions restrictions

The Customer undertakes to comply with Finnish and EU export and sanctions legislation. The Customer represents that it is not on a sanctions list or subject to export restrictions.

B.11 Non-solicitation

The Customer may not, during the term of the Agreement and for a period of one (1) year after its termination, recruit WeldPeak Oy’s employees or subcontractors without the written consent of WeldPeak Oy.

The restriction does not apply if the person seeks employment with the Customer on their own initiative on the basis of a public job advertisement.

In case of breach, the Customer shall pay WeldPeak Oy as liquidated damages an amount equal to six (6) months’ gross salary of the person concerned.

B.12 Notices

Notices relating to the Agreement shall be made in writing and delivered in person, by post, or by email to the addresses named in the Agreement.

A notice by email is effective at the time of sending. A notice by regular post is effective 3 working days after sending.

B.13 Assignment

The Agreement binds the parties and their successors. Neither party may assign the Agreement to a third party without the written consent of the other party, which consent shall not be unreasonably withheld.

WeldPeak Oy may however assign the Agreement or any part of it in connection with a corporate transaction (merger, demerger, change of ownership, business sale) without separate consent.

B.14 Force majeure

Neither party is liable for delay or prevention of the performance of an obligation (other than payment obligations) caused by reasons outside that party’s control, including:

• Natural disasters, fire, flood
• Authority orders, wars, terrorism
• Strikes and labour disputes
• Cyber attacks, denial-of-service attacks
• Significant disturbances in the electricity or telecommunications network
• Significant disturbances in third-party services (e.g. Cloudflare, Supabase)

If a force majeure situation continues for more than 60 days, either party may terminate the Agreement in writing.

B.15 Relationship of the parties

The parties to the Agreement are independent operators. Neither party is the agent, employee, representative, or otherwise authorised to bind the other party to contracts or obligations.

B.16 Publicity and reference

Public communication about the existence of the Agreement requires the consent of the other party, unless required by law.

WeldPeak Oy has however the right to mention the Customer on its public customer list and to use the Customer’s industry as an example in marketing material, unless the Customer prohibits this in writing.

B.17 Partial validity

If any provision of the Agreement or these General Terms is found to be invalid, the other provisions remain in force. The invalid provision shall be amended only to the extent necessary to make it valid, while preserving the original intent.

B.18 Applicable law and dispute resolution

The Agreement and these General Terms are governed by Finnish law, excluding its conflict-of-laws rules and the UN Convention on Contracts for the International Sale of Goods (CISG).

Disputes arising from the Agreement or these General Terms shall first be sought to be resolved by negotiation between the parties.

If a settlement is not reached, disputes shall be resolved by the District Court of Helsinki. Alternatively, the parties may agree in writing that disputes are resolved by the Finland Chamber of Commerce mediation procedure in Helsinki.

WeldPeak Oy always has the right to apply for an interim injunction in any competent court.

B.19 Validity after termination

The following terms remain in force after termination of the Agreement according to their nature:

• B.5 Limitation of liability
• B.6 Intellectual property
• B.7 Confidentiality (5 years)
• B.10 Export and sanctions restrictions
• B.11 Non-solicitation (1 year)
• B.18 Applicable law and dispute resolution
• All accrued and unpaid fees

---

PART C — Data Processing Agreement (DPA)

C.1 Background and purpose

This Data Processing Agreement (“DPA”) is an inseparable part of the Agreement between the Customer and WeldPeak Oy.

The purpose of the DPA is to agree on the conditions under which WeldPeak Oy, as a personal data processor, processes the Customer’s personal data when the Customer acts as the data controller.

The DPA follows the EU General Data Protection Regulation (GDPR, EU 2016/679) and Finnish national data protection legislation.

C.2 Definitions

“Personal Data”, “Processing”, “Controller”, “Processor”, “Data Subject”, and other GDPR terms are understood in accordance with the GDPR.

“Customer’s Personal Data” means the personal data entered by the Customer into WeldPeak, which typically includes:

• Names, email addresses, job titles, and IWE/IWS/IWT qualifications of users (welding coordinators)
• Identification, training, and qualification data of welders and operators
• Information related to qualification certificates (parameters tested, photographs of welds, signatures)
• Audit log content of actions performed

“Sub-processor” means another processor used by WeldPeak Oy (e.g. Supabase, Cloudflare, Sentry, Anthropic).

C.3 Subject matter, nature, and purpose of processing

WeldPeak Oy processes the Customer’s personal data only to the extent required for the delivery of the WeldPeak service and the fulfilment of the obligations under the Agreement.

The nature and purpose of the processing are:

• Delivery and operational maintenance of the service
• Creation and management of user accounts
• Storage and backup of the Customer’s data
• Monitoring and correcting technical errors of the service
• Automatic reading of documents and interpretation of search questions using an AI service (see C.8)
• Statistical and anonymised product development

WeldPeak Oy does not use the Customer’s personal data for marketing, profiling, or other purposes without the Customer’s separate consent.

C.4 Roles of the parties

The Customer is the Controller of all personal data entered into WeldPeak.

WeldPeak Oy is the Processor that processes personal data on the Customer’s instructions under this DPA.

C.5 Duration of processing

The processing of personal data is tied to the term of the Agreement.

Upon termination of the Agreement, WeldPeak Oy will, at the Customer’s choice, either delete or return the Customer’s personal data; see Section A.9 of Part A. Statutory retention obligations (e.g. accounting, backups for 30 days) take precedence.

C.6 The Customer’s instructions

WeldPeak Oy processes personal data only on the Customer’s documented instructions. This DPA constitutes the complete documented version of the Customer’s instructions. Additional instructions may be given in writing.

If WeldPeak Oy considers that the Customer’s instruction infringes data protection law, WeldPeak Oy will notify the Customer without delay and may refrain from processing without consequences.

C.7 WeldPeak Oy’s obligations

WeldPeak Oy:

(a) Complies with all applicable data protection laws in the processing of personal data

(b) Applies appropriate technical and organisational security measures, covering at least:

• Encrypted connection (HTTPS/TLS 1.3)
• Access control and role-based permissions (RLS)
• Password hashing (bcrypt or equivalent)
• Database backups
• Regular security testing
• Single-session enforcement when required

(c) Assists the Customer by reasonable means in fulfilling its obligations under data protection law, including the realisation of the data subject’s rights (e.g. right of access, right to be forgotten, portability)

(d) Ensures that persons authorised to process personal data are committed to confidentiality

(e) Provides the Customer with sufficient information to demonstrate compliance with data protection law obligations

C.8 Sub-processors

WeldPeak Oy may use sub-processors in the processing of personal data. WeldPeak Oy’s current sub-processors are:

Sub-processor	Purpose	Location
Supabase Inc.	Database platform, authentication	EU
Cloudflare, Inc.	Web hosting, CDN, DDoS protection	Global
Zoho Corporation	Email (info@ mailbox)	EU
Sentry (Functional Software Inc.)	Error monitoring	US
Anthropic PBC	Automatic reading of documents (PDF import) and interpretation of search questions	US
Resend, Inc.	Emails sent by the service (invitations, reminders)	US

WeldPeak Oy will notify the Customer in writing in advance of new or replaced sub-processors before they are put into use. The Customer has the right to object to the change for justified reasons, in which case WeldPeak Oy will look for an alternative or the Customer may terminate the Agreement.

WeldPeak Oy requires sub-processors to comply at least with the personal data obligations of this DPA.

C.9 Location of data and transfers outside the EU

The Customer understands that personal data may also be processed outside the EU, including in the United States (Cloudflare, Sentry, Anthropic and Resend in part) and possibly in other countries depending on the data centre chosen by Supabase.

The Customer authorises WeldPeak Oy to make the necessary contractual arrangements for transfers of personal data outside the EU, including the Standard Contractual Clauses (SCC) approved by the European Commission or other transfer mechanisms permitted by law.

WeldPeak Oy ensures that transfers outside the EU are made lawfully.

C.10 Personal data breaches

In the event of a personal data breach, WeldPeak Oy will notify the Customer without undue delay, but in any case no later than within 72 hours of detection of the breach.

The notification shall include at least:

(a) The nature of the breach and the personal data affected, including an estimate of the numbers of data subjects and records concerned (b) The name and contact details of the contact person from whom more information can be obtained (c) An assessment of the likely consequences of the breach (d) Actions taken or planned by WeldPeak Oy to mitigate the effects of the breach

C.11 Audit

The Customer or its authorised auditor may audit WeldPeak Oy’s compliance with personal data processing at most once a year, by giving 15 working days’ prior written notice.

The audit shall be carried out during normal working hours and shall not unreasonably disrupt the operations of WeldPeak Oy. Each party bears its own costs related to the audit.

WeldPeak Oy has the right to offer the Customer an audit report by an independent third party (e.g. SOC 2, ISO 27001 if available) in lieu of an audit, if the report demonstrates compliance at a sufficient level.

---

Annex — Glossary

Term	Explanation
WPS	Welding Procedure Specification
pWPS	Preliminary Welding Procedure Specification
WPQR	Welding Procedure Qualification Record
HPTK	Welding process operation results log (Finnish acronym)
IWE	International Welding Engineer
IWS	International Welding Specialist
IWT	International Welding Technologist
RWC	Responsible Welding Coordinator (EN 15085)
NDT	Non-Destructive Testing
NCR	Non-Conformance Report
RLS	Row-Level Security — Supabase row-level access control
GDPR	General Data Protection Regulation (EU 2016/679)
SCC	Standard Contractual Clauses
DPA	Data Processing Agreement

---

Closing note

These WeldPeak cloud service terms, general terms and conditions, and data processing agreement are in force from 24 October 2026 (version 1.1). The previous version 1.0 was in force from 9 May 2026.

WeldPeak Oy has the right to update these terms by notifying the Customer of changes at least 30 days before they take effect. If the Customer does not accept the changes, the Customer may terminate the Agreement to end on the effective date of the change.

Contact:

WeldPeak Oy Email: info@weldpeak.fi Data Protection Officer: aleksi.souru@weldpeak.fi