Legal Notice

1. Service provider (Impressum)

1.1 Information pursuant to § 5 E-Commerce-Gesetz (ECG), § 14 Unternehmensgesetzbuch (UGB) and § 25 Mediengesetz (MedienG) for sovsec.com, prismara.eu and their subdomains and for the SovSec and Prismara services offered in the EU.

Until the Austrian subsidiary assumes the EU business

Item Details

Name / firm SovSec Ltd

Legal form Private company limited by shares (Limited) under the law of England and Wales

Seat / registered office [REGISTERED OFFICE ADDRESS], United Kingdom

Register and register Registrar of Companies for England and Wales (Companies House), company no. [COMPANY number NUMBER]

Managing director Jake Gliddon

VAT ID UK VAT [UK VAT]; EU VAT (OSS / UID) [NUMBER]

Austrian branch (if [Zweigniederlassung — name, address, FN, Landesgericht — or “none”] registered)

From the date of assumption (planned 2028)

Item Details

Name / firm [SOVSEC FLEXCO NAME]

Legal form Flexible Kapitalgesellschaft (FlexCo)

Seat [ADDRESS, AUSTRIA]

Company register number FN [FN NUMBER]

Company register court Landesgericht [COURT]

Managing director Jake Gliddon

VAT ID (UID) ATU[NUMBER]

1.2 We will update this notice and inform existing clients by notice when the Austrian subsidiary assumes contracts (see the provider clause in the applicable terms).

2. Contact

Purpose Contact

General and legal enquiries, complaints legal@sovsec.com

Sales and partners Contact form on sovsec.com / prismara.eu · partners@sovsec.com

Purpose Contact

Client support support@sovsec.com

Billing billing@sovsec.com

Privacy and data protection privacy@sovsec.com

Security vulnerabilities security@sovsec.com (SOV-LG-013)

Abuse of Prismara services / notices of abuse@prismara.eu (SOV-LG-008) illegal content

Telephone [TELEPHONE NUMBER] · Monday to Friday, 08:00–18:00 CET/CEST, excluding Austrian public holidays

Post SovSec Ltd, [REGISTERED OFFICE ADDRESS]; from 2028: [SOVSEC FLEXCO NAME], [ADDRESS, AUSTRIA]

3. Trade, chamber and supervisory information

Item (§ 5(1) ECG) Details

Object of business Information security and managed IT services; development, licensing and operation of software (Unternehmensgegenstand) and cloud services (Prismara)

Trade licence (Gewerbe) [Dienstleistungen in der automatischen Datenverarbeitung und Informationstechnik (free trade) — confirm]; registered with [GEWERBEBEHÖRDE]

Chamber membership Wirtschaftskammer Österreich (WKO), [Wirtschaftskammer OBERÖSTERREICH / WIEN — confirm], Fachgruppe Unternehmensberatung, Buchhaltung und Informationstechnologie (UBIT) [confirm] — membership arises with the Austrian trade licence

Applicable trade regulations Gewerbeordnung 1994 (GewO), available at www.ris.bka.gv.at

Supervisory / trade authority [BEZIRKSHAUPTMANNSCHAFT / MAGISTRAT — district administrative authority of the seat]

Professional title / regulated Not applicable (no regulated profession) profession

Data protection authority the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb.gv.at — or the supervisory authority of your habitual residence, place of work or place of the alleged infringement

3.1 Until SovSec has an establishment in Austria, SovSec Ltd provides its services from the United Kingdom; the trade, chamber and authority details above apply from registration of the Austrian branch or subsidiary.

3.2 EU representative under Art. 27 GDPR (while SovSec Ltd has no establishment in the EU): [EU REPRESENTATIVE NAME AND ADDRESS].

3.3 Digital Services Act (Regulation (EU) 2022/2065): single point of contact for authorities, the Commission and the Board (Art. 11) and for recipients of the service (Art. 12): legal@sovsec.com; languages: English and German. Legal representative in the EU (Art. 13), while SovSec Ltd is not established in the EU: [DSA LEGAL REPRESENTATIVE NAME AND ADDRESS].

3.4 SovSec operates an integrated management system aligned to ISO 9001, ISO/IEC 20000-1 and ISO/IEC 27001. SovSec is not certified to these standards at the date of this notice; certification is planned.

4. Disclosure under § 25 MedienG

Item Details

Media owner SovSec Ltd, [REGISTERED OFFICE ADDRESS]; from 2028 [SOVSEC FLEXCO NAME], [ADDRESS, (Medieninhaber) and AUSTRIA] publisher

Object of business As in section 3

Managing director Jake Gliddon

Ownership [100]% held by Jake Gliddon [confirm shareholding at publication]

Basic orientation Information about the security and managed services of SovSec and the Prismara product suite; (grundlegende Richtung) publication of articles, guidance and the Sovereignty Index on information security, data protection and digital sovereignty. Content reflects SovSec's own views and is independent of any political party or interest group.

4.1 Newsletters and other periodic electronic media we send carry an imprint (§ 24 MedienG) naming the media owner and its address.

5. Complaints procedure

5.1 We want to put things right if you are unhappy with our websites, products or services. Our complaints procedure is free of charge.

 Step                  What happens                                                                                  Timeline

 1. Tell us            Email legal@sovsec.com (subject: “Complaint”), use the contact form, or write to us at        —
                       the address above. Existing clients may also raise a ticket via support@sovsec.com.
                       Please give your name, contact details, account or contract reference (if any), what went
                       wrong and what you would like us to do.

 2.                    We confirm receipt in writing, give you a reference and name the person handling your         Within 2 business
 Acknowledgement       complaint.                                                                                    days

 3. Response           We investigate and send you a full written response explaining our findings and what we       Within 10 business
                       will do. If we need longer (for example because a third party is involved), we tell you why   days
                       and when you will hear from us.

 4. Escalation         If you are not satisfied, ask for a review by the company's director. The review is carried   Final response
                       out by someone not previously involved where possible.                                        within 10 business
                                                                                                                     days of your request

5.2 Business clients may also use the escalation and dispute resolution procedure in their services agreement, which takes precedence for contractual disputes. Complaints about how we handle personal data can be made to privacy@sovsec.com and to Datenschutzbehörde (DSB) (see the Privacy Policy, SOV-LG-005).

6. Consumer dispute resolution

6.1 The European Commission's Online Dispute Resolution (ODR) platform was discontinued on 20 July 2025 following Regulation (EU) 2024/3228. It is no longer available, and we therefore do not link to it.

6.2 If you are a consumer and our final response does not resolve your complaint, SovSec is willing to participate in

conciliation    proceedings        before        the     following      Austrian         consumer     conciliation    bodies   (Alternative
Streitbeilegungsstellen under the Alternative-Streitbeilegung-Gesetz, AStG):

 Body                                           Covers                                                      Contact

 Internet Ombudsstelle                          Disputes about online purchases and internet services       www.ombudsstelle.at

 Schlichtung für Verbrauchergeschäfte           Consumer disputes not covered by a specialised body         www.verbraucherschlichtung.at

6.3 Conciliation is voluntary and free of charge for consumers; a conciliation body's proposal is not binding unless both parties accept it. Your right to go to court is not affected. Consumers resident in other Member States may also contact a recognised ADR body in their own country; we will consider participation in good faith.

7. Accessibility (European Accessibility Act)

7.1 The European Accessibility Act (Directive (EU) 2019/882), implemented in Austria by the Barrierefreiheitsgesetz (BaFG), applies to certain consumer services, including e-commerce services, from 28 June 2025. Microenterprises (fewer than 10 employees and annual turnover or balance sheet total not exceeding EUR 2 million) that provide services are exempt from its service requirements.

7.2 SovSec currently qualifies as a microenterprise and is therefore exempt while this remains the case. We nevertheless aim for our websites and Prismara web applications to meet WCAG 2.2 level AA (EN 301 549), and we will publish an accessibility statement describing conformance and known limitations, and will comply in full once the exemption no longer applies.

7.3 If you have difficulty using our websites or services, contact support@sovsec.com and we will try to provide the information or service in an accessible way.

8. Other legal documents

Document Reference

Website Terms of Use SOV-LG-007

Privacy Policy · Cookie Policy SOV-LG-005 · SOV-LG-006

Acceptable Use Policy SOV-LG-008

Vulnerability Disclosure Policy SOV-LG-013

Penetration testing / Crucible authorisation SOV-LG-011

Drafting notes — remove before publication

• Placeholders: [COMPANY NUMBER], [REGISTERED OFFICE ADDRESS], [UK VAT], OSS/UID [NUMBER], [TELEPHONE NUMBER], [SOVSEC FLEXCO NAME], [FN NUMBER], [COURT], [ADDRESS, AUSTRIA], ATU[NUMBER], [GEWERBEBEHÖRDE], WKO Landeskammer and Fachgruppe, [EU REPRESENTATIVE], [DSA LEGAL REPRESENTATIVE], shareholding.
• Rechtsanwalt to confirm: whether SovSec Ltd needs an Austrian branch registration (Zweigniederlassung, §§ 12–13 UGB) and trade licence before October 2027 given the founder's Austrian residence, and which Gewerbe / WKO Fachgruppe applies.
• MedienG § 25: confirm whether the sites are 'small websites' (§ 25(5)) — given articles and the Sovereignty Index, full disclosure (including ownership and basic orientation) is assumed. A German version of the Impressum is recommended.
• ODR platform closure (20 July 2025, Regulation (EU) 2024/3228) checked against multiple law-firm sources (Nov 2026). Conciliation bodies: willingness to participate is a business decision; confirm current AStG information duties (§ 19 AStG) and that both bodies accept disputes with a non-Austrian (UK) trader.
• DSA: confirm with counsel that Prismara Mail/Spaces/Talk are intermediary services and that Art. 13 legal representative appointment is required for SovSec Ltd; the representative may be combined with the Art. 27 GDPR representative if the provider offers both.
• EAA / BaFG microenterprise exemption: confirm thresholds and that SovSec still qualifies at the time of each publication; plan the accessibility statement before headcount reaches 10 or turnover EUR 2 m.

End of SOV-LG-014 Legal Notice (Impressum) & Disclosure v1.0 (EU edition). SovSec Ltd · Company no. [COMPANY NUMBER] (England and Wales) · VAT no. [UK VAT] · EU OSS / UID [NUMBER]; from 2028: [SOVSEC FLEXCO NAME], FN [FN NUMBER], UID ATU[NUMBER].

1. Company information

1.1 The websites sovsec.com, sovsec.co.uk, prismara.eu and their subdomains, and the SovSec and Prismara services, are operated by:

Item Details

Registered name SovSec Ltd

Legal form Private company limited by shares

Registered in England and Wales

Company number [COMPANY NUMBER]

Registered office [REGISTERED OFFICE ADDRESS]

Trading names SovSec; Prismara (product brand)

Director Jake Gliddon

VAT registration number [VAT NUMBER]

Data protection ICO registration no. [ICO REGISTRATION NUMBER] (Information Commissioner's Office register of fee registration payers)

1.2 This information is provided under the Companies (Trading Disclosures) Regulations 2008 (made under the Companies Act 2006) and regulation 6 of the Electronic Commerce (EC Directive) Regulations 2002.

2. Contact details

Purpose Contact

General and legal enquiries, legal@sovsec.com complaints

Sales and partner enquiries Contact form on sovsec.com / prismara.eu · partners@sovsec.com

Support for clients support@sovsec.com

Billing billing@sovsec.com

Privacy and data protection privacy@sovsec.com

Security vulnerabilities security@sovsec.com (Vulnerability Disclosure Policy, SOV-LG-013)

Abuse of Prismara services abuse@prismara.eu (Acceptable Use Policy, SOV-LG-008)

Telephone [TELEPHONE NUMBER] · Monday to Friday, 08:00–18:00 UK time, excluding bank holidays in England

Post SovSec Ltd, [REGISTERED OFFICE ADDRESS]

2.1 We aim to reply to general enquiries within 2 business days. Clients' support response times are set by their service level.

3. Regulatory information

3.1 SovSec is not authorised or regulated by the Financial Conduct Authority or any other regulator, and its services are not subject to an authorisation scheme at the date of this notice. SovSec does not belong to a regulated profession.

3.2 SovSec processes personal data as a controller (for example for its own customers and website visitors) and as a processor for its clients, under the UK GDPR (as defined in section 3(10) of the Data Protection Act 2018), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), each as amended (including by the Data (Use and Access) Act 2025). The supervisory authority is the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk, 0303 123 1113.

3.3 SovSec monitors legislation that may bring managed security service providers into regulation, including the Cyber Security and Resilience Bill. We will update this notice if SovSec becomes subject to supervision.

3.4 SovSec operates an integrated management system aligned to ISO 9001, ISO/IEC 20000-1 and ISO/IEC 27001. SovSec is not certified to these standards at the date of this notice; certification is planned.

3.5 SovSec subscribes to no codes of conduct at the date of this notice. Prices on our websites are stated exclusive of VAT for business customers and inclusive of VAT for consumers, unless stated otherwise.

4. Complaints procedure

4.1 We want to put things right if you are unhappy with our websites, products or services. Our complaints procedure is free of charge.

 Step                 What happens                                                                                  Timeline

 1. Tell us           Email legal@sovsec.com (subject: “Complaint”), use the contact form, or write to us at        —
                      the address above. Existing clients may also raise a ticket via support@sovsec.com.
                      Please give your name, contact details, account or contract reference (if any), what went
                      wrong and what you would like us to do.

 2.                   We confirm receipt in writing, give you a reference and name the person handling your         Within 2 business
 Acknowledgement      complaint.                                                                                    days

 3. Response          We investigate and send you a full written response explaining our findings and what we       Within 10 business
                      will do. If we need longer (for example because a third party is involved), we tell you why   days
                      and when you will hear from us.

 4. Escalation        If you are not satisfied, ask for a review by the company's director. The review is carried   Final response
                      out by someone not previously involved where possible.                                        within 10 business
                                                                                                                    days of your request

4.2 Business clients may also use the escalation and dispute resolution procedure in their services agreement, which takes precedence for contractual disputes. Complaints about how we handle personal data can be made to privacy@sovsec.com and to ICO (see the Privacy Policy, SOV-LG-005).

Alternative dispute resolution for consumers

4.3 Since 6 April 2026 consumer alternative dispute resolution (ADR) in the UK is governed by Chapter 4 of Part 4 of the Digital Markets, Competition and Consumers Act 2024, which replaced the Alternative Dispute Resolution for Consumer Disputes (Competent Authorities and Information) Regulations 2015.

4.4 SovSec is not required by law or by membership of a trade association to use an ADR provider, and at the date of this notice it has not signed up to an ADR scheme. If you are a consumer and our final response does not resolve your complaint, we will tell you in writing whether an ADR arrangement is available and whether we are willing to use it for your dispute. We will consider any request to use an accredited ADR provider in good faith.

4.5 You can also get free advice from Citizens Advice (citizensadvice.org.uk, consumer helpline 0808 223 1133) or, in Northern Ireland, Consumerline. Your right to go to court is not affected.

4.6 The EU Online Dispute Resolution platform closed on 20 July 2025 and is not available for disputes with SovSec.

5. Accessibility

5.1 We aim for our websites and Prismara web applications to meet the Web Content Accessibility Guidelines (WCAG) 2.2 at level AA. We are preparing an accessibility statement, which we will publish on our websites, describing the current level of conformance and known limitations.

5.2 If you have difficulty using our websites or services, contact support@sovsec.com and we will make reasonable adjustments, as the Equality Act 2010 requires, and provide information in an alternative format where we can.

6. Other legal documents

Document Reference

Website Terms of Use SOV-LG-007

Privacy Policy · Cookie Policy SOV-LG-005 · SOV-LG-006

Acceptable Use Policy SOV-LG-008

Vulnerability Disclosure Policy SOV-LG-013

Penetration testing / Crucible authorisation SOV-LG-011

Drafting notes — remove before publication

• Placeholders: [COMPANY NUMBER], [REGISTERED OFFICE ADDRESS], [VAT NUMBER], [ICO REGISTRATION NUMBER], [TELEPHONE NUMBER]. Publish only after incorporation; Companies (Trading Disclosures) Regulations 2008 also require the registered name to be displayed on the website itself (e.g. footer) — not only in this notice.
• Telephone number: not strictly mandatory under reg. 6 E-Commerce Regulations if email allows rapid contact, but required on consumer pre-contract information under the Consumer Contracts Regulations 2013 where available; confirm.
• ADR: position (no scheme at launch; case-by-case willingness) is a business decision. Checked (Nov 2026) that DMCCA 2024 Part 4 Ch. 4 commenced 6 April 2026 and replaced the 2015 Regulations (secondary sources: Business Companion, SI 2026/263); solicitor to confirm the trader information duties under the new regime.
• Cyber Security and Resilience Bill: confirm Parliamentary status at publication and whether SovSec would be a 'relevant managed service provider' once in force.
• Consumer price display (VAT-inclusive) to be checked against the DMCCA 2024 drip-pricing rules for personal tiers.

End of SOV-LG-014 Company Information & Legal Notice v1.0 (UK edition). Company no. [COMPANY NUMBER] · Registered office: [REGISTERED OFFICE ADDRESS] · VAT no. [VAT NUMBER].