Effective October 2026

Acronis AG and its affiliates (collectively, “Acronis”) expect their suppliers, vendors, contractors, consultants, distributors, resellers, service providers and other business partners, whether individuals or organizations, that do business with or on behalf of Acronis (collectively, “Suppliers”) to uphold comparable standards when conducting that business.

Each Supplier is responsible for the conduct of its directors, officers, employees and other individuals who work under its direction in connection with Acronis (“Supplier Personnel”) and is expected to communicate this Code to them and take reasonable measures to promote their compliance. Supplier Personnel are not themselves Suppliers, or parties to or bound by this Code, by reason of their position with a Supplier. Subcontractors, agents and other third parties engaged by a Supplier are addressed in Section 1 and Section 11. An individual engaged directly by Acronis as a contractor or consultant is a Supplier.

Acronis is committed to conducting business with integrity, transparency, and social responsibility, in compliance with applicable laws and high ethical standards.

This Supplier Code of Conduct (“Code”) establishes the principles and expectations applicable to Suppliers in connection with their business relationship with Acronis. Suppliers are expected to communicate these principles to relevant Supplier Personnel and to take reasonable measures to promote compliance within their operations and supply chains. Where appropriate based on the nature of the services or relationship, Suppliers are expected to impose substantially similar obligations on subcontractors, agents, and other third parties engaged in connection with products or services provided to Acronis.

Suppliers must comply with all applicable laws and regulations in the jurisdictions where they operate or provide products or services, including applicable laws in the areas shown in (a)–(g) below. Where this Code establishes standards that exceed applicable legal requirements, Acronis expects Suppliers to make reasonable efforts to meet those standards, subject to applicable law and any applicable agreement with Acronis. If a requirement of this Code conflicts with applicable law, the Supplier must comply with applicable law and promptly notify Acronis of the conflict, unless the Supplier is legally prohibited from providing such notice.

• a. Anti-bribery and anti-corruption;
• b. Sanctions, export controls, and international trade;
• c. Competition and fair dealing;
• d. Data protection, privacy, and information security;
• e. Labor, employment, workplace safety, and human rights;
• f. Environmental protection; and
• g. Artificial intelligence and automated systems, where applicable.

Suppliers must conduct business ethically and comply with all applicable anti-bribery and anti-corruption laws, including, where applicable, the U.S. Foreign Corrupt Practices Act, the UK Bribery Act, and comparable laws in other jurisdictions. Suppliers must maintain controls reasonably designed to prevent, detect, and address bribery and corruption risks associated with their activities including with Public Officials (defined below). Suppliers must not, directly or indirectly:

• i. Offer, promise, authorize, give, request, or accept a bribe, kickback, improper payment, or other improper benefit;
• ii. Provide anything of value to obtain or retain business or secure an improper advantage;
• iii. Make an improper payment through an agent, intermediary, subcontractor, or other third party;
• iv. Maintain undisclosed or improperly recorded funds or transactions;
• v. Offer, authorize, make or request facilitation or expediting payments in connection with Acronis business. “Facilitation or expediting payments” are small, unofficial payments or benefits given to a Public Official to secure or speed up a routine, non-discretionary governmental action, such as processing visas, permits or licenses, scheduling inspections, or providing police protection, utilities, mail or cargo handling. This prohibition applies regardless of the amount, local custom, or whether the payment is permitted under applicable law.

This prohibition does not apply to a lawful, published, official fee paid directly to a government entity (and not to an individual Public Official) for an officially available expedited service, provided that the payment is supported by documentation showing it is the published official fee, is accurately recorded, and, where made on behalf of Acronis or charged to Acronis, is approved in advance by Acronis. A Supplier asked by a Public Official for a facilitation or expediting payment in connection with Acronis business must decline and promptly notify Acronis.

For purposes of this Code, a “Public Official” means any elected or appointed government official, officer, employee, or representative; any person acting in an official or public capacity on behalf of a government, governmental authority, legislative, judicial, administrative, or regulatory body; any employee, officer, agent, or representative of a government-owned or government-controlled entity or public international organization; any political party, party official, or candidate for political office; and any other person treated as a public official under applicable anti-corruption laws. Depending on the circumstances and applicable law, the term may also include family members, close associates, former officials, or consultants advising a government or Public Official.

Suppliers shall comply with applicable Referenced Policies (as defined in Section 21 below) concerning anti-corruption in connection with all activities relating to Acronis products, services, incentives, rebates, market development funds, government opportunities, and customer engagements.

Suppliers must ensure that gifts, hospitality, meals, travel, entertainment, promotional activities, charitable contributions, sponsorships, and other benefits offered, provided, requested, or accepted in connection with Acronis business are lawful, reasonable, transparent, supported by a legitimate business purpose, appropriately approved, and accurately recorded. Such benefits must not be intended, or reasonably appear to be intended, to improperly influence any person, obtain or retain business, secure an improper advantage, or create an improper obligation. Cash and cash equivalents must not be offered or provided in connection with Acronis business. Suppliers must apply additional scrutiny to any benefit involving a Public Official and comply with any applicable approval or contractual requirements.

Suppliers must avoid actual or potential conflicts of interest that could improperly influence, or appear to influence, business decisions relating to Acronis. Suppliers must promptly disclose to Acronis any actual or potential conflict of interest involving the Supplier, Supplier Personnel, Acronis’s directors, officers, employees or other individuals engaged to work for Acronis, or any person acting on behalf of any of them. Suppliers must cooperate in implementing reasonable measures to manage or resolve disclosed conflicts.

Suppliers must comply with applicable competition, antitrust, fair-trading, and consumer-protection laws. Suppliers must not engage in collusion, unlawful information sharing, bid rigging, market allocation, price fixing, or other conduct that improperly restricts competition. Suppliers must compete fairly and must not make false, misleading, or deceptive statements concerning Acronis, competitors, customers, or other market participants.

The anti-corruption expectations described in this Code form part of Acronis's broader Ethics & Compliance Program and should be read together with applicable Referenced Policies and any anti-corruption representations, warranties, certifications, or other compliance obligations contained in an applicable agreement with Acronis. If an applicable agreement or Referenced Policy establishes more specific or stringent requirements, the Supplier must comply with those requirements.

Suppliers must respect internationally recognized human rights and comply with applicable labor and employment laws to the extent applicable to the Supplier’s operations. Suppliers are expected to operate consistently with internationally recognized labor principles, including relevant principles of the International Labor Organization, as applicable to their operations. Suppliers must:

• a. Prohibit forced, compulsory, bonded, trafficked, or involuntary labor;
• b. Prohibit unlawful child labor;
• c. Provide lawful wages, working hours, benefits, and working conditions;
• d. Respect workers’ lawful rights relating to freedom of association and collective representation;
• e. Maintain fair and lawful employment practices;
• f. Provide mechanisms through which workers may raise workplace concerns without fear of retaliation; and
• g. Treat workers with dignity and respect.

Acronis is committed to preventing the use of forced labor, unlawful child labor, human trafficking, or other forms of modern slavery in its operations or supply chain. Suppliers must not use, support, or benefit from such practices. Suppliers are expected to implement measures appropriate to their size, activities, location, and risk profile to identify, assess, prevent, and address modern slavery and human trafficking risks in their operations and supply chains to the extent applicable to the Supplier’s operations. Suppliers must promptly notify Acronis if they identify credible information indicating that products or services supplied to Acronis may be connected to forced labor, unlawful child labor, human trafficking, or other forms of modern slavery. Suppliers must cooperate with reasonable remediation measures where such risks are substantiated.

Suppliers must maintain workplaces that provide equal opportunity and prohibit unlawful discrimination, harassment, intimidation, and abusive or inhumane treatment to the extent applicable to the Supplier’s operations. Employment decisions must be based on legitimate business considerations and must comply with applicable employment and anti-discrimination laws. Suppliers must maintain and communicate appropriate workplace conduct and disciplinary standards consistent with applicable law and the principles of this Code.

Suppliers must provide a safe and healthy working environment and comply with applicable occupational health and safety laws. Suppliers are expected to maintain measures appropriate to their operations to identify and address workplace hazards, prevent workplace violence, prepare for emergencies, and provide relevant health and safety information and training.

Suppliers must comply with applicable environmental laws, permits, and regulatory requirements. Acronis expects Suppliers to take reasonable measures appropriate to their operations to:

• i. Reduce waste and inefficient resource consumption;
• ii. Promote responsible energy and water use;
• iii. Manage hazardous materials appropriately;
• iv. Prevent or mitigate environmental harm; and
• v. Continuously improve relevant environmental practices.

Suppliers must protect Acronis confidential information, proprietary information, personal data, customer information, systems, and other information entrusted to them. Unauthorized access to, disclosure of, or misuse of Acronis or customer information is prohibited. Suppliers must:

• a. Use information only for authorized and lawful purposes;
• b. Limit access to Supplier personnel and subcontractors with a legitimate need to know;
• c. Maintain technical and organizational measures appropriate to the nature and sensitivity of the information and associated risks;
• d. Prevent unauthorized access, use, alteration, disclosure, loss, or destruction;
• e. Comply with applicable data protection and privacy laws;
• f. Comply with applicable confidentiality, security, data-processing, and contractual obligations; and
• g. Return, delete, or securely dispose of information when required by applicable agreements or law.

Under the U.S. Defend Trade Secrets Act (18 U.S.C. § 1833(b)), an individual will not be held criminally or civilly liable under any federal or state trade secret law for disclosing a trade secret (a) in confidence to a federal, state or local government official or to an attorney, solely for the purpose of reporting or investigating a suspected violation of law, or (b) in a complaint or other document filed under seal in a lawsuit or other proceeding. An individual who files a lawsuit for retaliation for reporting a suspected violation of law may disclose the trade secret to their attorney and use it in the court proceeding, if the individual files any document containing the trade secret under seal and does not disclose it except by court order.

Suppliers must maintain accurate, complete, transparent, and appropriately detailed books, records, invoices, expense documentation, and other supporting information relating to their business with Acronis. Transactions must be properly authorized, recorded, and supported. Suppliers must not falsify, conceal, mischaracterize, or improperly destroy records or create misleading entries. Suppliers must retain records for the periods required by applicable law and relevant contractual obligations.

Suppliers must comply with applicable economic sanctions, export controls, import controls, customs requirements, anti-boycott laws, and other international trade restrictions. Suppliers must not knowingly engage in prohibited dealings involving restricted parties, prohibited jurisdictions, embargoed destinations, or restricted end uses. Suppliers must maintain risk-based measures appropriate to their activities to identify and address sanctions and export control risks involving relevant transactions, counterparties, products, technologies, destinations, and end users. As applicable to their relationship with Acronis, Suppliers must also comply with applicable Referenced Policies and other relevant contractual requirements relating to sanctions, export controls, and international trade including the Acronis Platform Terms and Conditions and other relevant contractual requirements. This Section should be read together with applicable Referenced Policies addressing anti-corruption, sanctions, export controls, and related compliance matters. Violations of sanctions, export controls, anti-corruption, or related compliance requirements frequently present overlapping legal and compliance risks and may result in corrective action, suspension, or termination of the applicable business relationship.

Suppliers remain responsible for the performance of subcontractors, agents, and other third parties engaged by the Supplier in connection with products or services provided to Acronis, except to the extent otherwise expressly agreed in writing. Suppliers must:

• a. Select and oversee subcontractors using risk-based processes appropriate to the engagement;
• b. Ensure that relevant subcontractors are subject to written obligations appropriate to the products or services provided;
• c. Flow down applicable confidentiality, information security, data protection, trade compliance, human rights, and ethical-business requirements; and
• d. Obtain any approval required under an applicable agreement before permitting a subcontractor to access Acronis information, systems, facilities, or personal data.

Suppliers that develop, provide, deploy, or materially use artificial intelligence, machine learning, or automated decision-making systems in connection with Acronis products, services, operations, information, or customers must do so responsibly and in compliance with applicable law and in accordance with applicable Referenced Policies and contractual requirements. Acronis may restrict or prohibit the use of an AI or automated system in connection with Acronis where Acronis reasonably determines that the system presents unacceptable legal, security, privacy, ethical, or operational risk. Depending on the nature and risk of the system, Suppliers must maintain controls appropriate to:

• a. Identify, assess, and manage legal, security, privacy, ethical, and operational risks;
• b. Protect Acronis confidential information, personal data, systems, and intellectual property;
• c. Prevent unauthorized use of Acronis information to train or improve AI models or systems;
• d. Test, validate, monitor, and document system performance and material limitations;
• e. Address foreseeable risks of inaccurate, discriminatory, unsafe, or unlawful outcomes;
• f. Maintain appropriate human oversight where automated outputs may materially affect individuals, Acronis, or Acronis customers;
• g. Provide information reasonably requested by Acronis concerning the system’s intended use, information reasonably available regarding data provenance, safeguards, and risk controls; and
• h. Notify Acronis before using an AI system in connection with Acronis activities where prior notice or approval is required by an applicable agreement.

Acronis encourages Suppliers to support responsible environmental, social, and governance practices appropriate to their size, activities, location, and risk profile. Any environmental or sustainability information provided to Acronis must be accurate, supportable, and not misleading. The nature and extent of requested information may vary based on supplier risk, applicable law, customer requirements, contractual obligations, and the nature of the products or services provided. Where relevant to the products or services provided, Suppliers are expected to:

• a. Maintain practices supporting environmental responsibility, ethical business conduct, human rights, and fair labor conditions;
• b. Take reasonable measures to reduce emissions, waste, and unnecessary resource consumption;
• c. Promote responsible sourcing and supply-chain practices;
• d. Maintain governance processes supporting legal compliance and ethical decision-making; and
• e. Provide reasonable and substantiated information, to the extent reasonably available to the Supplier and relevant to the products or services provided, that may be requested by Acronis for supplier due diligence, customer commitments, sustainability assessments, or legally required disclosures.

Suppliers must promptly notify Acronis, without undue delay, after becoming aware of a confirmed or reasonably likely security incident that affects or is reasonably likely to affect: (a) Acronis data or confidential information; (b) personal data processed for or on behalf of Acronis; (c) Acronis systems, networks, products, or operations; or (d) Acronis customers in connection with products or services provided by the Supplier. Notification must be provided within any period specified in an applicable agreement or required by applicable law. The notice must include information reasonably available at the time concerning the nature of the incident, the information or systems affected, the likely consequences, and mitigation or remediation measures taken or planned. Except where required by applicable law, Suppliers must coordinate with Acronis before making a notification or public communication that identifies Acronis, Acronis customers, or an incident involving Acronis information. A Supplier who is legally required to make such a notification must, where legally permitted, provide Acronis with advance notice. Suppliers must:

• a. Take prompt and appropriate measures to contain, investigate, mitigate, and remediate the incident;
• b. Preserve relevant evidence;
• c. Provide reasonable updates as material information becomes available;
• d. Cooperate with Acronis in investigating and responding to the incident; and
• e. Comply with applicable contractual, legal, and regulatory notification requirements.

Where a Supplier processes personal data or confidential information for or on behalf of Acronis, the Supplier must comply with applicable data-processing agreements and other contractual privacy, confidentiality, and security requirements. The Supplier remains responsible for its subcontractors to the extent provided by applicable law and the relevant agreement. The Supplier must impose appropriate written obligations on authorized subcontractors that process such information. Those obligations must address, as applicable:

• a. Confidentiality;
• b. Information security;
• c. Restrictions on use and disclosure;
• d. Security incident notification;
• e. Data subject rights support;
• f. Retention, return, and deletion;
• g. Regulatory cooperation; and
• h. International data transfers.

Acronis may assess Supplier’s compliance with this Code through reasonable and risk-based mechanisms, which may include due diligence reviews, questionnaires, certifications, requests for supporting documentation, monitoring, or audits. Suppliers are expected to cooperate with reasonable compliance assessments and provide information that is accurate, complete, and not misleading. Nothing in this Code independently obligates a Supplier to provide access, information, certifications, audit rights, or other compliance-related accommodations beyond those required by applicable law or a written agreement with Acronis. Nothing in this Code expands an audit right beyond the rights available under applicable law or the relevant agreement. Any assessment or audit will be conducted where appropriate and subject to the following:

• a. Applicable law;
• b. The terms of the applicable agreement;
• c. Reasonable notice, except where urgent circumstances justify a different approach;
• d. Appropriate confidentiality and information-security protections; and
• e. Reasonable consideration of the nature, scope, and risk of the Supplier relationship.

Suppliers are encouraged to promptly raise concerns relating to suspected violations of this Code, applicable law, or contractual compliance obligations connected with their work for Acronis and must do so where their agreement with Acronis requires it. Suppliers and Supplier Personnel may raise concerns confidentially and, where permitted by applicable law and supported by the reporting channel, anonymously, through (a) report.syntrio.com/acronis; (b) other reporting channels communicated by Acronis; or (c) the Company’s Legal Compliance Department: [email protected]. Acronis prohibits retaliation against any person who raises a concern, requests guidance, reports suspected misconduct or participates in a review or investigation, provided they have reasonable grounds to believe the information was true when reported. Suppliers must maintain appropriate mechanisms through which Supplier Personnel can raise concerns without fear of retaliation. Nothing in this Code or in any requirement to coordinate communications restricts any person from reporting possible violations of law to, or communicating with, a governmental, regulatory, law-enforcement or judicial authority, or from making any disclosure protected by law. No authorization from or notice to Acronis is required.

Acronis may take reasonable action in response to suspected or substantiated non-compliance with this Code. Any action will be taken subject to applicable law and contractual rights and obligations. Depending on the nature, severity, frequency, and circumstances of the issue, action may include:

• a. Requesting additional information;
• b. Requiring a corrective action plan;
• c. Monitoring remediation;
• d. Suspending particular activities or access;
• e. Exercising rights available under an applicable agreement; or
• f. Ending the business relationship where appropriate.

Acronis may request that a Supplier acknowledge this Code or certify its compliance where appropriate based on the Supplier’s risk profile, the nature of the relationship, customer or regulatory requirements, or the applicable agreement. A Supplier may be asked to confirm that it has reviewed, understands and complies with this Code, applicable Referenced Policies, and related compliance obligations in its agreements with Acronis. Any acknowledgment or certification will be implemented in accordance with the relevant contractual arrangements and applicable law. Publication of this Code alone does not require every Supplier to provide periodic certification.

Acronis may amend this Code from time to time to reflect changes in applicable law, regulatory expectations, business operations, customer requirements, or compliance practices. The version published on the Acronis website will identify its effective date. Where an applicable agreement requires notice of a material change, Acronis will provide notice in accordance with that agreement. Questions concerning this Code may be directed to: Acronis’s Legal Compliance Department: [email protected].

For purposes of this Code, “Referenced Policies” means the Acronis policies, standards, guidelines, procedures, compliance requirements, and related documents identified in this Code or otherwise communicated by Acronis to a Supplier from time to time, including, where applicable, Acronis policies concerning anti-corruption, sanctions and export controls, data protection, information security, artificial intelligence, ethics, compliance, supplier management, and platform use.

Acronis may update, replace, consolidate, supplement, or rename Referenced Policies from time to time to reflect changes in applicable law, regulatory expectations, industry standards, business operations, customer requirements, or compliance practices. References in this Code to a Referenced Policy include any successor or replacement document addressing substantially the same subject matter.

Suppliers are responsible for reviewing and complying with Referenced Policies applicable to their relationship with Acronis. Referenced Policies may be made available through the Acronis website, supplier portal, partner portal, procurement process, contractual documentation, compliance communications, certification processes, or other channels designated by Acronis.

Where this Code, an applicable agreement, or a Referenced Policy expressly requires compliance with a Referenced Policy, the applicable Referenced Policy forms part of Acronis's compliance requirements for the Supplier relationship. Failure to comply with an applicable Referenced Policy may constitute a breach of an applicable agreement to the extent that agreement incorporates the Referenced Policy, or a violation of applicable law.

This Code establishes general supplier expectations and forms part of Acronis’s broader Ethics & Compliance Program. It should be read together with applicable Referenced Policies and any compliance requirements incorporated into the Supplier's relationship with Acronis including the Acronis Platform Terms and Conditions where relevant, and any other compliance requirements incorporated into the Supplier’s relationship with Acronis. This Code supplements, and does not replace or modify, an applicable agreement between Acronis and a Supplier. If this Code conflicts with an applicable written agreement, the agreement will control with respect to the subject matter of the conflict, unless the agreement expressly provides otherwise. Suppliers remain responsible for complying with all applicable laws and any additional obligations contained in their agreements with Acronis. Supplier Personnel have no rights or obligations under this Code, and any obligations on a Supplier’s workforce arise only through the Supplier’s own policies and agreements.

This Code does not by itself create contractual rights or obligations. A Supplier’s obligations arise from applicable law and from its agreements with Acronis, including any agreement that incorporates this Code. This Code is intended to communicate Acronis's general expectations regarding supplier conduct and responsible business practices. The requirements applicable to a Supplier will depend on the Supplier's relationship with Acronis, applicable law, and any written agreement between the parties. This Code does not expand any audit rights, information rights, certification obligations, reporting obligations, or other contractual rights beyond those established by applicable law or a written agreement with Acronis. Nothing in this Code creates third-party beneficiary rights or constitutes legal advice. Acronis may update this Code from time to time to reflect changes in applicable law, regulatory expectations, business operations, customer requirements, or compliance practices.

This Code is written in English. Translations may be published for convenience and to support understanding by Suppliers worldwide. If there is any inconsistency or ambiguity between the English version and a translation, the English version prevails and governs interpretation, except where applicable law, a collective agreement or another binding local requirement provides that a local-language version prevails or must be provided. Translations may be published after the English version; the version date shown on the English version at https://www.acronis.com/en/company/supplier-code-of-conduct/ identifies the current Code.