CONTRACT CERTIFICATION SERVICES Today, in Sofia between: 1. SPEKTAR AD, registered upon company case No 5909/1990 in the register of the Sofia City Court, main office and address of management: Sofia, SÎ-region Sredets, 11A Carnegie street, BULSTAT: 831431323, Correspondence address: Sofia, 11À Carnegie street, SPEKTAR AD, Registration Authority, IBAN : BG89 FINV 9150 10BG N0G7 2J, BIC : FINVBGSF, FIB AD, branch Vitosha, Sofia, Represented by the Executive Director Gabriel Todorov Todorov through - attorney, further down called Certification Services Provider (Provider in short) in the meaning of the EDESA, and 2. , With data, as in the Appendix OWNER’s data – integral part of this contract, further down called OWNER, the other side, On the basis of the User’s Manual and article 23 from the Electronic Document and Electronic Signature Act(EDESA), was agreed the following: ². SUBJECT Article 1 THE PROVIDER provides to the OWNER in return of payment certification services for issuance, maintenance certificate certification, information, cryptographic and consultant services in accordance with the requirements of the EDESA and the operating legislation. The requested certificate Application form for the specific type of certificate and in the Certification Services Application, part of this contract. ²². VALIDITY Article 2 (1) This contract comes into force from the moment of its signing and is valid for one year from the date of publishing the certificate on the electronic public register of the PROVIDER. (2) In case the certificate issued in accordance to this contract is renewed, the validity of the contract is extended to the expiry date of the renewed certificate. III. RIGHTS AND OBLIGATIONS OF THE PARTIES Article 3 The PROVIDER is obliged to: 1. inform the OWNER of the conditions for issuance and use of the certificate, including restrictions, as well as of procedures for submitting claims and conflicts solving; 2. issue a certificate to the OWNER and to publish it immediately, in accordance to the instructions; 3. not keep and copy data for generation of private keys; 4. to take actions in relation to suspension, renewal and revocation of the certificate, establishing the existence of respective reasons; 5. immediately inform the OWNER of circumstances concerning the validity or reliability of the issued certificate; 6. give to third parties only the personal information included in the certificate; 7. publish and update in electronic way accessible by everyone certificate revocation list and to perform all duties implemented in the User’s Manual. Article 4 The PROVIDER has the right to: 1 Spektar Org ® Revision: 1.2 / 05.06.06 Certification Services Contract from and management of a certificate for electronic signature (further down called ) and other and certification services are shown in the immediately after 1. request from the OWNER additional information when issuing a of the OWNER and check of the data given by him when processing the application form for a certificate with the purpose of identification certificate; 2. publish only the information on the OWNER and SIGNATORY, which is part of the issued certificate. 3. revoke or suspend the certificate of the OWNER in accordance with the conditions and order implemented in the User’s Manual.

Article 5 By signing this contract the PROVIDER declares that every certificate with shown identifier (OID) of its Policy (CP) is issued in accordance with this policy and the conditions implemented in the User’s Manual. Article 6 The OWNER (in person or through the Signatory) is obliged to: 1. pay the PROVIDER the agreed amount of money, formed in accordance with the Certification Services Application, part of this contract; 2. keep/safeguard the private key during the whole validity period of the certificate in a way which protects it from discredit, loss, disclosure, modification and unauthorized use; 3. change the PIN for access to the smart card before using the certificate; 4. give the PROVIDER true and complete information requested in accordance with the Application for the specific type of 5. accept the content of the issued before its publishing in the register; 6. In a period of 3 (three) days from the publishing of the requested to check the correctness of the content and in case of discrepancies between the information given and the content of the the PROVIDER immediately; 7. ask the PROVIDER to suspend or revoke the in all cases described in the User’s Manual, including change of information shown in the issued 8. inform the PROVIDER of any change in the information which is not included in the issued given in accordance with the requirements in the Application for the specific type of 9. use the issued only with licensed cryptographic software; 10. only for the purposes in accordance with the respective Policy and to observe all other conditions, requirements and obligations implemented in the User’s Manual, rising from the respective Policy for certification services provision for the respective type of Article 7 The OWNER is responsible for: 1. generation of a key pair, the public key of which is certified in the certificate issued under this contract; 2. the confidentiality and integrity of the private key from the moment of creation of the key pair; 3. use of the private key.The PROVIDER is not responsible for the use of the key pair. Every use is considered an action by the Signatory. Article 8 By signing this contract the OWNER declares that: 1. he has received, read and accepted the User’s Manual for the provided by SPEKTAR AD Spektar Org certification, information, cryptographic and consultant services and the Policy for the requested certificate; 2. he is informed by the Provider that he is registered according to chapter IV of the EDESA certification services provider; 3. he is informed by the Provider that he is not a member of organizations for voluntary accreditation; 4. he is informed by the Provider of the conditions for issuance and use of the certificate, including of restrictions, as well as of the procedures for claim submission and conflicts solving; 5. he is aware of the requirements related to the use of certificates for electronic signature implemented in the EDESA and the subdelegated legislation on its application; 6. the technical means, software, communication and procedures which he uses in distant generation of the 2 Spektar Org ® Revision: 1.2 / 05.06.06 Certification Services Contract certificate; certificate certificate certificate to inform certificate certificate; certificate, but is certificate; certificate use the issued certificate certificate. private-public key pair are sufficiently secure and reliable and in case of security breach he will inform the Provider immediately; 7. in cases when he is also the Signatory, he has changed the initial personal code for access to the system of SPEKTAR AD Spektar Org® and the new personal code which he has personally generated, in accordance with the security requirements of SPEKTAR AD Spektar Org® is known only to him and pledges to keep it secret; 8. the entire information given to the Provider in the process of in this document is true and complete and will immediately inform the Provider for any change in the certificate issuance as well as this contained information given or the information included in the issued certificate; 9. in cases when he is also the Signatory he will keep the private key for the whole validity period of the certificate in a way which protects it from discredit, loss, disclosure, modification and unauthorized use; 10. he has printed the text of this contract from the website of the Provider without making any changes; http://www.spektar.org 11. he agrees to receive electronic messages from the Provider; 12. he agrees that the Provider will collect, keep and process his personal data and declares that he is aware of the following: the Provider will use them for the purposes of its activities as a provider of certification,

information, cryptographic and consultant services; will process and keep them in electronic format and on paper; presentation of the requested by the EDESA personal data is obligatory, giving all personal data outside the activities of the Provider is voluntary and the refusal to give personal data is a reason for not signing this contract or for its suspension; the data can be only given further to the CRC; access to the personal data for application for changes is requested through the Provider at the address given on the website of the Provider http://www.spektar.org IV. PRICES AND WAYS OF PAYMENT Article 9 (1) The price for issuance and use of a certificate to the OWNER and for the requested services is formed in accordance with the Certification Services Application, part of this contract, accordingly to the prices (2) Payment of the amounts due is done by bank transfer to the bank account of the PROVIDER, shown in this contract or in cash at the PROVIDER’s office. (3) In case of bank transfers used as way of payment under this contract the date if certification of the PROVIDER’s account is considered date of payment. (4) Payment for issuance and use of the certificate of the OWNER and for the requested services shall be done before certificate issuance. V. LIMITED LIABILITY OF THE PROVIDER Article 10 The PROVIDER is not liable before the OWNER and third parties for damages caused: 1. by use of certificates issued on the basis of incorrect/concealed data, given by the OWNER; 2. by use of certificate outside their restrictions; 3. because the OWNER has not requested from the PROVIDER suspension of the certificate although he has found out that the private key was misused or there is a danger of such misuse; 4. by repudiation of duties of the PROVIDER caused by technical problems outside his control; 5. by repudiation of duties of the OWNER implemented in this contract or in the User’s Manual. VI. TERMINATION OF CONTRACT Article 11 This contract is suspended: 1. with the expiry of the validity of the issued certificate; 2. with revocation of the issued 3. in presence of other reasons, implemented in the User’s Manual. VII. ADDITIONAL PROVISIONS Article 12 3 Spektar Org ® Revision: 1.2 / 05.06.06 Certification Services Contract in the Price list for services done by the PROVIDER. certificate; 1. This contract can have special conditions with priority over the User’s Manual of the PROVIDER which has he meaning of general provisions of this contract. 2. The User’s Manual is available for the OWNER at the internet address (URL): for printing. http://www.spektar.org Article 13 The parties will solve all conflicts rising during the realization of this contract with negotiations and in cases when this is impossible they will refer the matter to the competent court in the city of Sofia in accordance with article 117 of the Code of Civil Procedure(CCP). Article 14 For matters not agreed with this contract or the User’s Manual the operation legislation of Republic of Bulgaria is applied. Article 15 Integral part of this contract are the User’s Manual (general provisions), the Price List for services offered (Form1), Appendix OWNER’s data (Form 4. ), Application for the specific certificate (Form 2. ), with

number: , as well as the following appendices: 1. 2. 3. This contract consists of four pages and is drawn up and signed in two identical copies, one for each party. PROVIDER: OWNER: /SPEKTAR AD/ 4 4. 5. 6. 7. 8. 9. 10. Spektar Org ® Revision: 1.2 / 05.06.06 Certification Services Contract Certification Services Application (Form 3)