Certificate Number: This is to certify that the Management System of: ISMS 14078 Initial Certification Date: BravoSolution S.p.A. 01 March 2011 Date of Certification Decision: 23 June 2020 A JAGGAER company Issuing Date: 23 June 2020 Main Site: via Rombon, 11, 20134 Italy Valid Until: 18 March 2021 has been registered by Intertek as conforming to the requirements of:

ISO 27001:2013

The Management System is applicable to:

Design and provision of JAGGAER Software as a Service and JAGGAER Application Appliance (JAA) solutions for enterprise supply management and spend management processes with related consulting activities and Calin Moldovean professional services President, Business Assurance

Intertek Certification Limited, 10A Victory This is in accordance with the Statement of Applicability Version 9 dated Park, Victory Road, Derby DE24 8ZF, 04 March 2020. United Kingdom This certificate includes four appendices four sites legal entities, addresses and scopes of the multisite organization.

Intertek Certification Limited is a UKAS accredited body under schedule of accreditation no. 014. In the issuance of this certificate, Intertek assumes no liability to any party other than to the Client, and then only in accordance with the agreed upon Certification Agreement. This certificate’s validity is subject to the organization maintaining their system in accordance with Intertek’s requirements for systems certification. Validity may be confirmed via email at [email protected] or by scanning the code to the right with a smartphone. The certificate remains the property of Intertek, to whom it must be returned upon request.

This appendix identifies the locations by the management system of BravoSolution S.p.A. a JAGGAER company ISO 27001:2013 This appendix ISMS 14078-A is linked to main certificate ISMS 14078 and cannot be shown nor reproduced without it

Design and provision of JAGGAER Software as a Service BravoSolution S.p.A. and JAGGAER Application Appliance (JAA) solutions for via Rombon, 11 enterprise supply management and spend 20134 Milan/Italy management processes with related consulting activities and professional services

Design and provision of JAGGAER Software as a Service and JAGGAER Application Appliance (JAA) solutions for BravoSolution GmbH enterprise supply management and spend Ottobrunner St 41 D 82008 management processes with related consulting Unterhaching bei München/Germany activities and professional services

Design and provision of JAGGAER Software as a Service BravoSolution España S. A and JAGGAER Application Appliance (JAA) solutions for Avenida Manoteras 42 – Calle 3 enterprise supply management and spend Edificio Esindus 1 Planta management processes with related consulting 28050 /Spain activities and professional services

Design and provision of JAGGAER Software as a Service BravoSolution Italia S.p.A. and JAGGAER Application Appliance (JAA) solutions for Via Rombon, 11 – 20134 Milano, Italia enterprise supply management and spend Via Sallustiana, 26 Piano 5 - Interno 11 management processes with related consulting 00187 /Italy activities and professional services

Intertek Certification Limited is a UKAS accredited body under schedule of accreditation no. 014. In the issuance of this certificate, Intertek assumes no liability to any party other than to the Client, and then only in accordance with the agreed upon Certification Agreement. This certificate’s validity is subject to the organization maintaining their system in accordance with Intertek’s requirements for systems certification. Validity may be confirmed via email at [email protected] or by scanning the code to the right with a smartphone. The certificate remains the property of Intertek, to whom it must be returned upon request. CT-Appendix-UKAS-EN-A4-01.jul.17

This appendix identifies the locations by the management system of BravoSolution S.p.A. a JAGGAER company ISO 27001:2013 This appendix ISMS 14078-B is linked to main certificate ISMS 14078 and cannot be shown nor reproduced without it

Design and provision of JAGGAER Software as a Service BravoSolution UK Ltd and JAGGAER Application Appliance (JAA) solutions for 103 St. John Street, EC1M 4AS, enterprise supply management and spend , London, City of, United Kingdom management processes with related consulting activities and professional services

Design and provision of JAGGAER Software as a Service BravoSolution France S.A.S. and JAGGAER Application Appliance (JAA) solutions for Le Quintet - Batiment E, 81/83 Avenue Edouard Vaillant enterprise supply management and spend Boulogne Billancourt management processes with related consulting Hauts-de-Seine 92100/France activities and professional services

Intertek Certification Limited is a UKAS accredited body under schedule of accreditation no. 014. In the issuance of this certificate, Intertek assumes no liability to any party other than to the Client, and then only in accordance with the agreed upon Certification Agreement. This certificate’s validity is subject to the organization maintaining their system in accordance with Intertek’s requirements for systems certification. Validity may be confirmed via email at [email protected] or by scanning the code to the right with a smartphone. The certificate remains the property of Intertek, to whom it must be returned upon request. CT-ISO 9001:2015-UKAS-EN-A4-P-13.dec.17

This appendix identifies the locations by the management system of BravoSolution S.p.A. a JAGGAER company ISO 27001:2013

This appendix ISMS 14078-C is linked to main certificate ISMS 14078 and cannot be shown nor reproduced without it

Design and provision of JAGGAER Software as a Service and BravoSolution S.p.A. JAGGAER Application Appliance (JAA) solutions for via Rombon, 11 enterprise supply management and spend management 20134 Milan/Italy processes with related consulting activities and professional services

Datacenter Colocation services provided by Verizon Telehouse West Verizon Telehouse West Datacenter, for the installation and hosting of JAGGAER’s Coriander Avenue ICT infrastructure for the operation of JAGGAER’s solutions London, E14 2AA, United Kingdom Datacenter Verizon Business UK4 Colocation services provided by Verizon Business UK4 Skyways Central Way Datacenter, for the installation and hosting of JAGGAER’s North Feltham Trading ICT infrastructure for the operation of JAGGAER’s solutions London - Middlesex TW140XQ, United Kingdom Datacenter Colocation services provided by SunGard Data Systems Inc. SunGard Data Systems Inc Datacenter, for the installation and and hosting of 401 N Broad St, 11th Floor JAGGAER’s ICT infrastructure for the operation of Philadelphia, PA 19108 JAGGAER’s solutions

Datacenter Colocation services provided by Navisite Inc. Datacenter, Navisite Inc - for the installation and hosting of JAGGAER’s ICT Elwood Davis Road infrastructure for the operation of JAGGAER’s solutions Syracuse, NY 13212

Intertek Certification Limited is a UKAS accredited body under schedule of accreditation no. 014. In the issuance of this certificate, Intertek assumes no liability to any party other than to the Client, and then only in accordance with the agreed upon Certification Agreement. This certificate’s validity is subject to the organization maintaining their system in accordance with Intertek’s requirements for systems certification. Validity may be confirmed via email at [email protected] or by scanning the code to the right with a smartphone. The certificate remains the property of Intertek, to whom it must be returned upon request. CT-ISO 9001:2015-UKAS-EN-A4-P-13.dec.17

This appendix identifies the locations by the management system of BravoSolution S.p.A. a JAGGAER company ISO 27001:2013 This appendix ISMS 14078-D is linked to main certificate ISMS 14078 and cannot be shown nor reproduced without it

Datacenter Colocation services provided by Etisalat HRC Etisalat HRC Datacenter, for the installation and hosting of 1st Floor Data Center Office JAGGAER’s ICT infrastructure for the operation Opposite of Habib Bakery, Al Rasheed road, of JAGGAER’s solutions Hor Al Anz (E), Dubai, UAE Datacenter Colocation services provided by Etisalat Etisalat Khalifa City Datacenter, for the and hosting of Khalifa City Data Center JAGGAER’s ICT infrastructure for the operation 1st Floor, Data center Office area of JAGGAER’s solutions 15th Street, Khalifa City A Opposite NMC Hospital, Abu Dhabi, UAE Datacenter Colocation services provided by Colt Milan Colt Telecom Datacenter, for the installation and hosting of Via Lancetti, 23 JAGGAER’s ICT infrastructure for the operation 20158, Milan, Italy of JAGGAER’s solutions Infrastructure as a Service and Software as a Amazon Web Service Service provided through the Amazon European AWS EU-Central-1 Frankfurt Region data centers for the operation of JAGGAER’s solutions Infrastructure as a Service and Software as a Amazon Web Service Service provided through the Amazon European AWS EU-West-1 Ireland Region data centers for the operation of JAGGAER’s solutions

Intertek Certification Limited is a UKAS accredited body under schedule of accreditation no. 014. In the issuance of this certificate, Intertek assumes no liability to any party other than to the Client, and then only in accordance with the agreed upon Certification Agreement. This certificate’s validity is subject to the organization maintaining their system in accordance with Intertek’s requirements for systems certification. Validity may be confirmed via email at [email protected] or by scanning the code to the right with a smartphone. The certificate remains the property of Intertek, to whom it must be returned upon request. CT-ISO 9001:2015-UKAS-EN-A4-P-13.dec.17