Information Security Management System

Certificate of Approval

This is to certify that the ISMS of:

SEMOS DOO Skopje

T.C. Skopjanka, blok 2, lamela 6, 1000 Skopje

R. North Macedonia

has been assessed and found to meet the requirements of:

ISO 27001:2013

The certificate is valid for the following scope of operations & Statement of Applicability:

Network and system integration, software development, training

and maintenance of IT systems

In accordance with SOA dated 1st March 2021

Date of Certificate Issue: 17th May 2021

Certificate Valid until: 16th May 2024

Initial Certification Date: 17th May 2018

Certificate Number: DAS87954825/1/I

Authorized:

This presentation certificate is the property of SN Registrars (Holdings) Ltd and remains valid subject to satisfactory Surveillance audits

Re-certification audit due before 27th April 2024

SN Registrars (Holdings) Limited, Company Number: 07659067

Registration House, 22b Church Street, Rushden, Northamptonshire, NN10 9YT, UK

Quality Management System

Certificate of Approval

This is to certify that the Quality Management System of:

SEMOS DOO Skopje

T.C. Skopjanka, blok 2, lamela 6, 1000 Skopje

Republic of North Macedonia

has been assessed and found to meet the requirements of:

ISO 9001:2015

The certificate is valid for the following scope of operation:

Network and system integration, software development, training

and maintenance of IT systems

Date of Certificate Issue: 17th May 2020

Certificate Valid until: 16th May 2023

Certified with DAS since: 17th May 2017

Certificate Number: DAS55005556/1/Q

Authorized:

This presentation certificate is the property of SN Registrars (Holdings) Ltd and remains valid subject to satisfactory Surveillance audits

Re-certification audit due before 27th April 2023

SN Registrars (Holdings) Limited, Company Number: 07659067

Registration House, 22b Church Street, Rushden, Northamptonshire, NN10 9YT, UK

This cer�ficate is valid as long as the surveillance audits are completedand the requirements of Dene�k Cer�fica�on are followed.The validity of this cer�ficate can be checked from www.dene�k.com.

This is to certify that organization:

SEMOS d.o.o. Skopje

Blvd. Kuzman Josifovski Pitu No.19, T.C. Skopjanka, local 6, 1000 Skopje, R. North Macedonia

has implemented and maintains an IT Service Management Systemwithin the scope of:

Network and System Integration, Software Development, Training and Maintenance of Information Technology Systems

in accordance to:

ISO/IEC 20000-1:2018 Cer cate No.: SRN2317Date of issue: 24.05.2021.

23.05.2024.Expiry date:

General Manager:

Dene�k Interna�onal Cer�fica�on Audit and Inspec�on Services Company Limited

Ini�al Cer�fica�on date: 24.05.2021.

KPMG Cert GmbH Umweltgutachterorganisation Barbarossaplatz 1a, 50674 Cologne, Germany

certifies that

SAP SE Dietmar-Hopp-Allee 16 69190 Walldorf, Germany

with the locations, organizational units and services as listed in the annex of the ISO/IEC 27001 certificate with the certification number 11860521

has established and applies an information security management system for the scope

„Operations of SAP Business Technology Platform and the services as provided on the Annex of the ISO/IEC 27001 certificate”.

A certification audit conducted by KPMG, documented in a report, has verified that the management system complies with the requirements of the following standard:

CSA STAR, CCM version 3.0.1

Certification number 11860521(1)1 Certification date 31st May 2021 Certificate valid from 1st June 2021 Certification valid until 31st May 2024

________________________________________________________ _______________________________________________________

Wilhelm Dolle Georg Hartmann Managing Director Certification body

1 Valid only with certificate No. 11860521 provided for SAP SE.

KPMG Cert GmbH Umweltgutachterorganisation Barbarossaplatz 1a, 50674 Cologne, Germany

certifies that

SAP SE Dietmar-Hopp-Allee 16 69190 Walldorf, Germany

with the locations and organizational units as listed in the annex

has established and applies an information security management system for the scope

„Operations of SAP Business Technology Platform and the services as provided on the Annex of the certificate”. This is in accordance with the Statement of Applicability (SoA) dated 04-03-2021.

A certification audit conducted by KPMG, documented in a report, has verified that the management system complies with the requirements of the following standard:

DIN EN ISO/IEC 27001:2017

In addition to this certification, the organization uses the norms ISO/IEC 27017:2015 and ISO/IEC 27018:2019 as sources for the control set as defined in the SoA.

Certification number 11860521 Certification date 31st May 2021 Certificate valid from 1st June 2021 Certification valid until 31st May 2024

________________________________________________________ _______________________________________________________

Wilhelm Dolle Georg Hartmann Managing Director Certification body

Annex to certificate nr. 11860521

2 / 8 THIS ANNEX (EDITION: 31. MAY 2021) IS ONLY VALID IN CONNECTION WITH THE ABOVE-MENTIONED CERTIFICATE.

Governing the operations of SAP Business Technology Platform and the services as provided on the Annex of the certificate. Services in scope

Application Autoscaler Service

SAP BTP, Serverless runtime SAP HANA Spatial Services

Business Entity Recognition SAP Business Application Studio

SAP HTML5 Application Repository service for SAP BTP

Data Attribute Recommendation

SAP Cloud for Energy SAP Information Collaboration Hub

Document Classification SAP Cloud Identity Access Governance

SAP Integration Suite (incl. SAP API Management, Cloud Integration, Integration Advisor, Open Connectors)

Document Information Extraction

SAP Cloud Integration for data services

SAP Intelligent Robotic Process Automation

Hyperledger Fabric on SAP BTP

SAP Cloud Portal service SAP Internet of Things

Identity and Authentication SAP Cloud Transport Management

SAP Job Scheduling service

Identity Provisioning SAP Connectivity service SAP Keystore service

Invoice Object Recommendation

SAP Continuous Integration and Delivery

SAP Kubernetes Gardener (internal consumption only)

Java Application Lifecycle Management for SAP BTP

SAP Credential Store SAP Launchpad service

Java Debugging for SAP BTP SAP Custom Domain service SAP Leonardo Machine Learning Foundation

Java Profiling for SAP BTP SAP Data Privacy Integration SAP Logistics Business Network (incl. incl. freight collaboration option, global track and trace option, material traceability option)

Annex to certificate nr. 11860521

3 / 8 THIS ANNEX (EDITION: 31. MAY 2021) IS ONLY VALID IN CONNECTION WITH THE ABOVE-MENTIONED CERTIFICATE.

MongoDB on SAP BTP SAP Data Quality Management

SAP Market Rates Management (incl. Bring your own rates, Refinitiv data option)

MultiChain on SAP BTP SAP Data Retention Management

SAP Mobile services

OAuth 2.0 on SAP BTP SAP Data Warehouse Cloud SAP Monitoring service for SAP BTP

Object Store on SAP BTP SAP Destination service SAP OData Provisioning

PostgreSQL on SAP BTP / PostgreSQL on SAP BTP, Hyperscaler Option

SAP Digital Manufacturing Cloud

SAP Platform Identity Provider service for SAP BTP

RabbitMQ on SAP BTP SAP Document Center SAP Software-as-a-Service Provisioning service

Redis on SAP BTP / Redis on BTP, Hyperscaler Option

SAP Document Management service (incl. integration option, application option)

SAP Solutions Lifecycle Management service for SAP BTP

SAP Alert Notification service for SAP BTP

SAP Document service SAP Sports One

SAP Analytics Cloud including SAP Digital Boardroom and SAP Analytics Hub

SAP Edge Services SAP Subscription Billing

SAP Application Logging Service for SAP BTP

SAP Event Mesh SAP Virtual Machine service

SAP ASE service SAP Feature Flags service SAP Web Analytics

SAP Audit Log service SAP Fiori Cloud SAP Web DIE

SAP Authorization and Trust Management service

SAP Fiori Mobile SAP Workflow Management (incl. Workflow service, SAP Business Rules, SAP Process Visibility service)

SAP BTP, ABAP environment

SAP Forms service by Adobe Service Ticket Intelligence

Annex to certificate nr. 11860521

4 / 8 THIS ANNEX (EDITION: 31. MAY 2021) IS ONLY VALID IN CONNECTION WITH THE ABOVE-MENTIONED CERTIFICATE.

SAP BTP, Cloud Foundry runtime

SAP Git service UI Theme Designer

SAP BTP, Kyma runtime SAP HANA Cloud (incl. SAP HANA database and SAP HANA Cloud, data lake)

UI5 flexibility for key users

SAP BTP, Neo runtime SAP HANA service for SAP BTP

Governing the operations of SAP Business Technology Platform and the services as provided on the Annex of the certificate. Country Site location Scope

Germany Dietmar-Hopp-Allee 16 69190 Walldorf

Headquarters, Operations

Germany SAP-Allee 15 68789 St. Leon-Rot

Operations

Germany Rosenthaler Strasse 30 10178 Berlin

Operations

Bulgaria Tzar Boris III, Blvd, 136 A 1618 Sofia

Operations

Israel 14 Eli Huruvitz St 4366202 Raanana

Operations

India No. 138, Export Promotion Industri 560066 Bangalore

Operations

Annex to certificate nr. 11860521

5 / 8 THIS ANNEX (EDITION: 31. MAY 2021) IS ONLY VALID IN CONNECTION WITH THE ABOVE-MENTIONED CERTIFICATE.

Governing the operations of SAP Business Technology Platform and the services as provided on the Annex of the certificate. Country Site location Scope

Canada 910 Mainland Street V6B 1A9 Vancouver

Operations

France 35, rue d' Alsace 92309 Levallois Perret CEDEX

Operations

United States

3412 Hillview Ave 94304 Palo Alto

Operations

China 47th floor, Wheelock Square 1717 Nan Jing West Road 200040, Shanghai

Operations

Governing the operations of SAP Business Technology Platform and the services as provided on the Annex of the certificate. Country Site location Scope

Germany St. Leon-Rot Data Center

United States

Colorado Springs, Colorado, US West

Data Center

Co-location data centers listed below house the infrastructure used to deliver the SAP services. Excluded from scope are all supporting operations by co-location data centers. Monitoring of these operations fall under the SAP Supplier Management process: Country Site location Scope

Annex to certificate nr. 11860521

6 / 8 THIS ANNEX (EDITION: 31. MAY 2021) IS ONLY VALID IN CONNECTION WITH THE ABOVE-MENTIONED CERTIFICATE.

Co-location data centers listed below house the infrastructure used to deliver the SAP services. Excluded from scope are all supporting operations by co-location data centers. Monitoring of these operations fall under the SAP Supplier Management process: Country Site location Scope

Australia Sydney Data Center (Co-location)

United States

Ashburn, Virginia Data Center (Co-location)

United States

Chandler, Arizona Data Center (Co-location)

United States

Sterling, Virginia Data Center (Co-location)

Japan Tokyo Data Center (Co-location)

UAE Dubai Data Center (Co-location)

Saudi Arabia Ryadh Data Center (Co-location)

Canada Toronto Data Center (Co-location)

Russia Moscow Data Center (Co-location)

Brazil Sao Paulo Data Center (Co-location)

Annex to certificate nr. 11860521

7 / 8 THIS ANNEX (EDITION: 31. MAY 2021) IS ONLY VALID IN CONNECTION WITH THE ABOVE-MENTIONED CERTIFICATE.

Co-location data centers listed below house the infrastructure used to deliver the SAP services. Excluded from scope are all supporting operations by co-location data centers. Monitoring of these operations fall under the SAP Supplier Management process: Country Site location Scope

Netherlands Amsterdam Data Center (Co-location)

Germany Frankfurt Data Center (Co-location)

China Shanghai Data Center (Co-location)

Germany Frankfurt (AWS) Data Center (Hyperscaler)

United States

US East, Virginia (AWS) Data Center (Hyperscaler)

Brazil Sao Paulo (AWS) Data Center (Hyperscaler)

Japan Tokyo (AWS) Data Center (Hyperscaler)

Canada Montreal (AWS) Data Center (Hyperscaler)

Australia Sydney (AWS) Data Center (Hyperscaler)

Singapore Singapore (AWS) Data Center (Hyperscaler)

Netherlands Amsterdam (Azure) Data Center (Hyperscaler)

Annex to certificate nr. 11860521

8 / 8 THIS ANNEX (EDITION: 31. MAY 2021) IS ONLY VALID IN CONNECTION WITH THE ABOVE-MENTIONED CERTIFICATE.

Co-location data centers listed below house the infrastructure used to deliver the SAP services. Excluded from scope are all supporting operations by co-location data centers. Monitoring of these operations fall under the SAP Supplier Management process: Country Site location Scope

United States

Washington, US West (Azure)

Data Center (Hyperscaler)

Japan Tokyo (Azure) Data Center (Hyperscaler)

United States

Council Bluffs, Iowa (GCP) Data Center (Hyperscaler)

Germany Frankfurt (GCP) Data Center (Hyperscaler)

Singapore Singapore (Azure) Data Center (Hyperscaler)

United States

US East (Azure) Data Center (Hyperscaler)