DRAFT — for demo and vendor-risk-review purposes only. This document has not yet been reviewed by counsel. Final wording will be substituted before pilot launch. Do not rely on this draft for any binding commercial decision.

Master Subscription Agreement

Effective from 1 May 2026 — Version 1

This Master Subscription Agreement (the "Agreement") is concluded between Fintum Market Intelligence GmbH ("we", "us", "our", "Fintum") and the customer entity that has accepted this Agreement through the Market Intelligence platform shell (the "Customer", "you", "your"). The acceptance is recorded in the platform's audit log together with the document hash, the Customer's snapshotted legal identity, and the express declaration of representative authority described in §17.

1. Parties

Fintum Market Intelligence GmbH Abt-Plazidus-Str. 24 97359 Schwarzach am Main Germany Managing Director: David Siegl Registered: Amtsgericht Würzburg, HRB [[FILL: HRB-Nummer]] USt-IdNr.: [[FILL: USt-IdNr]]

Customer is the legal entity identified in the acceptance audit record.

2. Definitions

The following terms have the meaning given here when used in this Agreement.

• Service means the Market Intelligence platform — dashboards, query interface, Download Hub, API access, and the related infrastructure operated by Fintum at `platform.fintum-mi.com`.
• Authorized User means a natural person whom the Customer has invited and granted access to the Service, including the Customer's Company Admins.
• Documentation means the user-facing documentation and the API reference published by Fintum on or alongside the Service.
• Customer Data means any data the Customer or its Authorized Users submit to or generate through the Service, including configuration data and the contents of support correspondence. It does not include the underlying Market Intelligence dataset, which is Fintum's property.
• Order Form means an order document, an electronic order acceptance, or a sales-quote acceptance that references this Agreement and identifies subscribed products, license counts, term, and fees.
• Subscription Term means the period during which the Customer has paid for access to the Service, as set in the applicable Order Form.
• Personal Data has the meaning given in the GDPR.
• DPA means the Data Processing Agreement which forms an integral part of this Agreement.
• Privacy Policy means the Privacy Policy describing Fintum's processing of personal data in its controller capacity.
• Subprocessor List means the list at /legal/subprocessors/v1 of the third parties Fintum engages to process Customer personal data.

3. The Service

Fintum delivers anonymised, aggregated behavioural signals derived from a panel of LATAM retail-investor consumers using the el-fondo consumer application. The Service surfaces those signals through three primary delivery methods:

1. Dashboards — pre-built and customer-built visualisations of attention-share, intent, sentiment, and geographic patterns.
2. API — programmatic access to the same signal data, with key-based authentication and per-key rate limits.
3. Download Hub — CSV / Parquet export of any signal data the Customer's data scope permits.

The Service is not investment advice, an offer to buy or sell securities, or a personalised recommendation to any individual. Customer is solely responsible for the investment, regulatory, and compliance decisions it makes with reference to the Service. Fintum makes no representation that the Service is suitable for any particular purpose other than as a market-intelligence input.

4. Access and use

Subject to the Customer's payment of the Fees and to compliance with this Agreement, Fintum grants the Customer a non-exclusive, non-transferable, non-sublicensable right during the Subscription Term to access and use the Service for the Customer's internal business purposes.

The Customer ensures that each Authorized User complies with this Agreement. The Customer is responsible for the acts and omissions of its Authorized Users as if they were the Customer's own.

The Customer may not, and may not permit any Authorized User to:

• Resell, sublicense, lease, or otherwise commercially exploit access to the Service to any third party
• Scrape or otherwise systematically extract data from the Service for the purpose of building, training, or augmenting a competing product
• Attempt to de-anonymise the underlying panel, link signal data to individual end-users, or reconstruct personally identifiable information from aggregated outputs
• Reverse-engineer, decompile, or otherwise attempt to derive the source code or structure of the Service except as expressly permitted by mandatory law
• Use the Service in violation of applicable export-control, sanctions, or anti-corruption laws
• Use the Service to make automated investment decisions on behalf of clients in any jurisdiction where doing so requires a regulatory permission the Customer does not hold

The Customer is responsible for the security of its own credentials and for promptly notifying Fintum of any compromise of an Authorized User account.

5. Customer Data

As between the parties, the Customer owns the Customer Data. The Customer grants Fintum a non-exclusive licence to host, copy, transmit, display, and otherwise use the Customer Data for the limited purpose of delivering and supporting the Service during the Subscription Term, and for the post-termination retention and deletion windows described in the DPA.

Fintum does not use Customer Data to train models, build derivative datasets, or enrich any third-party profile. Aggregated, irreversibly-anonymised usage statistics about the Service itself (number of API calls, error rates, average query latency) may be retained for operational purposes — these statistics never identify the Customer or any Authorized User.

6. Fees and billing

Fees, billing cadence, and license counts are set in the applicable Order Form. During the pilot phase, billing is handled through manual invoicing — Fintum issues invoices to the Customer's billing-email contact at the cadence agreed in the Order Form, and the Customer pays within the payment terms specified there (default: net 30 days from invoice date). Late payments accrue default interest at the statutory rate under § 288 BGB.

If the Customer adds Authorized Users beyond its license count during a Subscription Term, the additional licenses are pro-rated to the end of the current term and billed on the next invoice cycle.

Fees are exclusive of any applicable taxes, including VAT, which are added on the invoice in line with applicable law. The Customer is responsible for any withholding taxes and remits the gross amount of the invoice net of any such withholding.

7. Term and termination

This Agreement becomes effective on the date the Customer accepts it and continues for the Subscription Term agreed in the Order Form. The Subscription Term renews for successive periods of equal length unless either party gives written notice of non-renewal at least 30 days before the end of the current term.

Either party may terminate this Agreement for cause if the other party materially breaches the Agreement and fails to cure the breach within 30 days of written notice. Termination for cause for non-payment is allowed where the Customer's invoice is more than 30 days overdue and remains unpaid 14 days after a written reminder.

Either party may terminate this Agreement on 30 days written notice if the other party becomes insolvent, files for bankruptcy, or enters into a comparable proceeding.

On termination, the Customer's access to the Service ceases. Fintum returns or deletes Customer Data in line with the DPA. Sections of this Agreement that by their nature should survive termination — including §5 (Customer Data ownership), §6 (Fees, in respect of amounts due), §8 (Intellectual Property), §9 (Confidentiality), §11 (Limitation of Liability), §15 (Governing Law and Jurisdiction), and any provision of the DPA expressly tagged as surviving — survive termination.

8. Intellectual property

Fintum retains all right, title, and interest in and to the Service, the underlying Market Intelligence dataset, the platform code, the Documentation, and any improvements to any of the foregoing. No rights are granted to the Customer except as expressly stated in §4.

The Customer retains all right, title, and interest in and to the Customer Data.

If the Customer or any Authorized User provides feedback, suggestions, or improvement ideas to Fintum, the Customer grants Fintum a perpetual, irrevocable, royalty-free licence to use that feedback to improve the Service. Fintum is not obliged to act on any feedback and is not obliged to acknowledge or credit the source.

9. Confidentiality

"Confidential Information" of a party means any non-public information disclosed by that party to the other under this Agreement that is identified as confidential at disclosure or that a reasonable person would understand to be confidential given its nature and the circumstances of disclosure. The Customer's Confidential Information includes the Customer Data. Fintum's Confidential Information includes the Service, the Documentation, and any non-public technical or commercial information about the Service.

The receiving party uses the disclosing party's Confidential Information only for the purposes of this Agreement, takes at least the same care to protect it as it takes to protect its own confidential information of like nature (and in any event no less than reasonable care), and discloses it only to those of its personnel and subprocessors who need to know and who are bound by equivalent confidentiality obligations.

The confidentiality obligation does not apply to information that:

• Was already in the receiving party's possession on a non-confidential basis before disclosure
• Is or becomes publicly available without breach of this Agreement
• Was lawfully received from a third party without confidentiality obligation
• Is independently developed by the receiving party without reference to the Confidential Information
• Is required to be disclosed by law, court order, or supervisory authority — in which case the receiving party gives the disclosing party reasonable advance notice where lawful

The confidentiality obligation continues for five years after termination of this Agreement, except that trade secrets are protected for as long as they qualify as such under applicable law.

10. Warranties and disclaimers

Fintum warrants that during the Subscription Term the Service substantially conforms to the Documentation. The Customer's exclusive remedy for breach of this warranty is, at Fintum's choice, repair of the Service, replacement of the affected functionality with a substantially equivalent capability, or termination of the affected portion of the Service with a pro-rata refund of pre-paid fees.

Except for the express warranty above, the Service is provided as-is and Fintum disclaims, to the maximum extent permitted by mandatory law, any other warranty, whether express or implied, including any implied warranty of merchantability, fitness for a particular purpose, non-infringement, or accuracy of the underlying Market Intelligence dataset for any specific decision-making purpose.

The Customer acknowledges that the Service is not investment advice, that signals derived from a behavioural panel reflect what the panel did rather than what any market may do, and that the Customer makes its own investment, regulatory, and compliance decisions independently.

11. Limitation of liability

To the maximum extent permitted by mandatory law, neither party is liable to the other for any indirect, incidental, special, consequential, or punitive damages, or for any loss of profits, revenue, goodwill, or data, regardless of the form of action.

To the maximum extent permitted by mandatory law, each party's total liability under or in connection with this Agreement is capped at the fees the Customer paid or owes Fintum in the 12 months preceding the event giving rise to the claim.

The cap and the exclusions above do not apply to liability that cannot lawfully be limited, including liability for:

• Breach of confidentiality
• Infringement of the other party's intellectual property
• Damages caused by intent or gross negligence
• Liability under the German Product Liability Act (ProdHaftG)
• Personal injury or death
• Anything else that under § 309 or § 444 of the German Civil Code (BGB) cannot be limited

12. Indemnification

Fintum defends the Customer against any third-party claim that the Customer's use of the Service in accordance with this Agreement infringes that third party's intellectual property rights, and Fintum bears any damages and costs (including reasonable attorneys' fees) finally awarded against the Customer in such a claim, provided the Customer notifies Fintum promptly of the claim, gives Fintum sole control of the defence and any settlement, and provides reasonable cooperation. If the Service is enjoined or threatened with injunction, Fintum may at its choice procure the right for the Customer to continue using the Service, modify the Service to be non-infringing, or terminate the affected portion of the Service with a pro-rata refund.

The Customer indemnifies Fintum against any third-party claim arising from (i) the Customer's use of the Service in violation of this Agreement, (ii) Customer Data that infringes a third-party right, or (iii) the Customer's downstream products or services that incorporate output from the Service.

13. Data protection

Each party complies with applicable data-protection law in connection with this Agreement. The DPA at /legal/dpa/v1 governs the processing of personal data Fintum performs on the Customer's behalf. By accepting this Agreement, the Customer also accepts the DPA.

The Privacy Policy at /legal/privacy/v1 describes Fintum's processing of personal data in its controller capacity and is incorporated by reference. The Customer acknowledges the Privacy Policy on its own behalf and confirms that the Customer's Authorized Users have been made aware of it.

The Subprocessor List at /legal/subprocessors/v1 is the authoritative list of third parties Fintum engages to process Customer personal data, and is updated through the change-notification procedure in §12 of the DPA.

14. Compliance

Each party complies with all laws applicable to it in connection with this Agreement, including export control, sanctions, anti-corruption, and tax law. Neither party uses the Service in violation of OFAC, EU, or UN sanctions programmes.

The Customer is responsible for the regulatory permissions, licences, and authorisations needed for its own activities — including, as applicable, financial-services licensing in the jurisdictions where the Customer operates — and Fintum makes no representation that the Service alone is sufficient to perform any regulated activity.

15. Governing law and jurisdiction

This Agreement is governed by the laws of the Federal Republic of Germany, excluding the United Nations Convention on Contracts for the International Sale of Goods. The exclusive place of jurisdiction for any dispute arising out of or in connection with this Agreement is Frankfurt am Main.

If the Customer is not a Kaufmann within the meaning of the HGB and the dispute concerns a non-commercial matter, mandatory consumer-protection rules of the Customer's habitual residence apply where they are more favourable to the Customer than this clause.

16. Notices

Operational notices (security alerts, agreement-acceptance confirmations, subprocessor change notices, fee invoices, scheduled-maintenance announcements) are delivered through the platform's notification surface and through email to the Customer's primary administrative contact. The email address is recorded in the platform shell and is the Customer's responsibility to keep current.

Legal notices to Fintum are delivered to legal (at) fintum-mi.com and, where the matter requires postal service, to the registered office address in §1.

A notice is treated as received on the next business day in the recipient's timezone, unless the recipient acknowledges earlier receipt.

17. Acceptance and representative authority

By clicking Accept in the platform shell, the natural person performing the click confirms that:

• They have read this Agreement, the DPA, and the Privacy Policy
• They are authorised to accept these documents on behalf of the Customer entity named in the acceptance audit record (Vertretungsberechtigung under § 164 BGB)
• The Customer entity's legal name, legal form, country of registration, and registry identifier are recorded accurately in the audit log

The platform records the acceptance with a timestamp, the IP address of the acceptance, the accepting Authorized User's identity, the Customer entity's snapshot, the document hash, and the verbatim text of the representative-authority declaration the user ticked. A confirmation email containing the accepted document and the recorded metadata is sent to the accepting user under the German Civil Code's Textform requirement (§ 126b BGB).

18. Miscellaneous

18.1 Assignment

Neither party may assign this Agreement without the other party's written consent, except that either party may assign the Agreement to an affiliate or in connection with a merger, acquisition, corporate reorganisation, or sale of substantially all of its assets. Any purported assignment in violation of this section is void.

18.2 Force majeure

Neither party is liable for any failure or delay in performance to the extent caused by an event beyond its reasonable control, including natural disaster, war, civil unrest, governmental action, network or utility failure not within the affected party's control, or pandemic-related restrictions. The affected party gives the other prompt notice and uses reasonable efforts to mitigate.

18.3 Severability

If any provision of this Agreement is held unenforceable, the remaining provisions continue in full force and the unenforceable provision is reformed to the minimum extent necessary to make it enforceable while preserving its original economic effect.

18.4 Entire agreement

This Agreement, together with the DPA, the Privacy Policy, the Subprocessor List, and the applicable Order Form, constitutes the entire agreement between the parties on its subject matter and supersedes any prior or contemporaneous communication.

18.5 Amendments

Fintum may update this Agreement to reflect changes in law, the Service, or its business, by publishing a new version at an incremented URL and notifying the Customer's primary administrative contact through the platform's notification surface and email. Material changes — those that materially diminish the Customer's rights or materially increase the Customer's obligations — require fresh acceptance through the click-through flow before they take effect for the Customer. Non-material changes take effect on the effective date noted in the new version unless the Customer objects in writing within 30 days, in which case the parties engage in good-faith discussion and the Customer may terminate the affected portion of the Service without penalty if no resolution is reached.

18.6 Order of precedence

In the event of any conflict between this Agreement, the DPA, the Privacy Policy, and any Order Form, precedence is determined as follows:

1. A separately-signed master contract between the parties (a "Wet-Ink Master Agreement"), if any
2. The applicable Order Form
3. The DPA
4. This Agreement
5. The Privacy Policy

18.7 Independent contractors

The parties are independent contractors. This Agreement does not create any partnership, joint venture, agency, or employment relationship.

18.8 No waiver

A party's failure to enforce a provision of this Agreement is not a waiver of that provision or of any other right under this Agreement.

18.9 Language

This Agreement is concluded in English. We may publish convenience translations into other languages from time to time at the relevant document URL. In the event of any discrepancy between this English version and a convenience translation, this English version controls.

19. Contact

Sales, product, and contractual questions: sales (at) fintum-mi.com Legal correspondence: legal (at) fintum-mi.com Privacy and data-protection requests: privacy (at) fintum-mi.com Security and vulnerability disclosure: security (at) fintum-mi.com

Information required by § 5 TMG and § 18 (2) MStV is published at https://www.fintum-mi.com/imprint.