Code of Conduct

Last updated: [TBD] · This is a working draft pending legal review.

1. Purpose and scope

Coded B.V. ("Coded", "we", "us", "our") is committed to operating with integrity, fairness, and respect for the law and for people, wherever we do business. This Code of Conduct sets out the standards of behaviour we expect of ourselves and of those who work with us.

This Code is made up of two connected parts:

• A business code of conduct (Sections 4–13) that applies to everyone who acts for or on behalf of Coded — including directors, officers, employees, contractors, temporary and agency personnel, and individuals engaged through our development and operations partners.
• A supplier code (Section 14) that we expect our suppliers, vendors, fulfilment and payment partners, resellers, and other business partners to meet, and to flow down to their own subcontractors and supply chains.

Coded is a private limited company (besloten vennootschap) registered in the Netherlands, with Coded Holding B.V. as its parent. Coded operates internationally and serves merchants worldwide. This Code is written to apply across all jurisdictions in which we operate. Where local law sets a higher standard than this Code, local law applies; where this Code sets a higher standard than local law, this Code applies, to the extent permitted by law.

2. About Coded and how it relates to this Code

Coded provides a commerce platform on which a merchant can run one or more branded online shops, drawing on a curated product catalog, with built-in payments and built-in fulfilment supplied through third parties. The merchant's shops and other items they create are referred to with the umbrella term "projects", and a merchant's account is referred to in our product as an "Organization". Coded charges a 0% platform fee on a merchant's payment transactions; merchants pay only the pass-through cost charged by our payment providers, and subscription fees may apply to publishing a project.

Coded provides storefront, hosting infrastructure, and payment-facilitation services. Each merchant operates its own branded shop and is the seller and trader of record for the goods sold through it. Coded acts as a hosting and intermediary service provider; it is not the seller of the goods offered by merchants and is not a party to the sales contract between a merchant and its customers. This Code governs Coded's own conduct and the conduct we expect of our suppliers and partners; it does not transfer to Coded any merchant's obligations as a seller.

3. Our core principles

We hold ourselves to four principles, which underpin every standard in this Code:

• Integrity — we are honest, we keep our commitments, and we do not cut corners.
• Compliance — we obey the law and act within it, in letter and in spirit.
• Respect — we treat people fairly, with dignity, and free from harassment and discrimination.
• Responsibility — we take ownership of our decisions and their effect on people, customers, and the environment.

4. Integrity and legal compliance

Everyone covered by this Code must comply with all applicable laws, regulations, and Coded policies in the jurisdictions where they operate. This includes, without limitation, laws on competition, anti-corruption, financial crime, sanctions and export controls, data protection, consumer protection, employment, and health and safety.

We do not ask anyone to break the law on Coded's behalf, and no business objective, deadline, or commercial pressure justifies doing so. If you believe a Coded instruction, practice, or request conflicts with the law or with this Code, you must raise it (see Section 15). We never retaliate against a person for raising a genuine concern in good faith.

Where this Code overlaps with a more specific Coded policy — for example our Anti-Bribery and Anti-Corruption Policy, our Anti-Money-Laundering Policy (aml-policy), our Sanctions Policy (sanctions-policy), or our Acceptable Use Policy (acceptable-use) — that more specific policy governs the detail, and this Code states the underlying principle.

5. Fair dealing and competition

We compete on the merits of our product and service. We deal fairly with merchants, customers, suppliers, partners, and competitors, and we do not take unfair advantage of anyone through manipulation, concealment, abuse of confidential information, misrepresentation of material facts, or any other unfair dealing practice.

5.1 Competition and antitrust law

We comply with the competition and antitrust laws of the jurisdictions in which we operate, including EU and Dutch competition law. In particular, those covered by this Code must not:

• agree, coordinate, or exchange competitively sensitive information with a competitor on prices, pricing methods, costs, terms of sale, market allocation, customers, territories, or bid responses;
• enter into arrangements that unlawfully restrict competition, including resale-price maintenance or unlawful exclusivity; or
• abuse any position of market strength.

If a competitor attempts to discuss any of the above, you must end the conversation and report it (see Section 15). Because these rules are technical and the penalties severe, seek guidance from legal@coded.eu before any arrangement that could raise a competition-law question.

5.2 Honest marketing and accurate records

Our public statements, marketing, and product descriptions must be truthful and not misleading. We do not make claims we cannot support. Our books, records, and reports must be accurate, complete, and timely, and no undisclosed or off-the-record account or transaction may be created for any purpose.

6. Anti-bribery and anti-corruption

Coded has a zero-tolerance approach to bribery and corruption, in any form, in any market, whether involving a public official or a private party. We comply with all applicable anti-corruption laws, including the Dutch Criminal Code, the UK Bribery Act 2010, and the U.S. Foreign Corrupt Practices Act, as recognised international benchmarks.

No one covered by this Code may offer, promise, give, request, agree to receive, or accept a bribe, kickback, secret commission, or any other improper advantage in order to obtain or retain business or to influence any decision. Facilitation payments are prohibited. Gifts and hospitality are permitted only where they are modest, infrequent, transparent, lawful, given without expectation of return, and consistent with our gift-and-hospitality rules.

The detailed rules — including thresholds, due-diligence expectations for third parties, and the treatment of donations and sponsorships — are set out in our Anti-Bribery and Anti-Corruption Policy (anti-bribery). Where that policy is not yet published, the principle in this Section governs and you must seek guidance from legal@coded.eu.

7. Data protection and confidentiality

7.1 Data protection and privacy

Coded is built privacy-by-design. We operate a cookieless analytics approach, we host platform infrastructure and customer data within the European Union (Frankfurt, Germany), and we do not sell or share personal data for the commercial benefit of third parties. Everyone covered by this Code must:

• collect and use personal data only for legitimate, specified purposes and only to the extent necessary;
• apply the safeguards and data-handling rules in our Privacy Policy (privacy) and Data Processing Agreement (dpa); and
• promptly report any actual or suspected personal-data breach in line with our incident-response process.

Questions on data protection go to privacy@coded.eu.

7.2 Confidentiality and protection of assets

We protect confidential and proprietary information — our own and that entrusted to us by merchants, customers, suppliers, and partners. Confidential information must be used only for its intended business purpose, must not be disclosed without authorisation, and must be protected during and after the relationship with Coded.

We protect Coded's assets — including systems, devices, credentials, intellectual property, and funds — against loss, theft, and misuse, and we use them for legitimate business purposes. We follow Coded's information-security requirements; suspected security incidents or vulnerabilities must be reported to security@coded.co.

8. Anti-discrimination and a respectful workplace

We are committed to a workplace that is safe, inclusive, and free from discrimination and harassment. We treat people fairly regardless of race, colour, ethnic or national origin, nationality, religion or belief, age, sex, gender identity or expression, sexual orientation, disability, marital or family status, pregnancy, genetic information, political opinion, trade-union membership, or any other characteristic protected by applicable law.

We do not tolerate:

• discrimination in recruitment, pay, promotion, training, discipline, or termination;
• harassment, including sexual harassment, bullying, intimidation, or the creation of a hostile or degrading environment; or
• retaliation against anyone who reports a concern or participates in an investigation in good faith.

We make reasonable accommodations for disability and for other protected needs as required by law, and we expect everyone to contribute to a culture of respect.

9. Health, safety, and well-being

We are committed to providing a safe and healthy working environment and to complying with applicable health-and-safety laws. This includes our offices, our remote-working arrangements, and any worksite where Coded personnel are present. Everyone is expected to follow safety rules, to work free from the influence of substances that impair judgement or safety, and to report hazards, incidents, and near-misses promptly. We prohibit threats, intimidation, and violence in the workplace.

10. Conflicts of interest

A conflict of interest arises when personal, family, financial, or other outside interests could improperly influence — or appear to influence — a person's judgement or actions on behalf of Coded. We act in Coded's legitimate interests and avoid conflicts; where a conflict cannot be avoided, we disclose it promptly so it can be managed.

Situations that must be disclosed include, without limitation:

• a financial interest in, or a personal relationship with, a merchant, supplier, partner, or competitor that does business with Coded or seeks to;
• accepting gifts, hospitality, or benefits that could create a sense of obligation (see Section 6);
• outside work, board positions, or business activities that compete or interfere with Coded responsibilities; and
• hiring, supervising, or making decisions about a close personal relation.

Disclose actual or potential conflicts to your manager or to legal@coded.eu. Disclosure does not by itself make an arrangement acceptable; it allows Coded to decide how the conflict will be managed.

11. Sanctions, export controls, and financial crime

We comply with applicable sanctions, export-control, anti-money-laundering, and counter-terrorist-financing laws. We do not knowingly do business with sanctioned parties, and we screen and monitor as required. Detailed obligations are set out in our Sanctions Policy (sanctions-policy) and Anti-Money-Laundering Policy (aml-policy). Concerns about possible financial crime must be raised immediately (see Section 15).

12. Use of platform and acceptable conduct

Those covered by this Code must not use Coded's platform or services to facilitate any activity that is unlawful or that breaches our Acceptable Use Policy (acceptable-use) or our list of prohibited and restricted businesses (prohibited-businesses). Suspected illegal content or abuse should be reported to report@coded.co.

13. Public communications and political activity

Only authorised individuals may speak on Coded's behalf to media, regulators, or the public. Personal political activity is a private matter undertaken in a personal capacity, on personal time and resources, and must not be presented as Coded's position. Any lawful corporate political donation or lobbying activity must be approved in advance in line with Coded policy and Section 6.

14. Supplier Code

This Section 14 is Coded's Supplier Code. It states the minimum standards we expect of our suppliers, vendors, fulfilment partners, payment partners, resellers, contractors, and other business partners ("Suppliers"), and that we expect Suppliers to apply to their own personnel, subcontractors, and supply chains. These standards apply in addition to, and do not replace, the obligations in a Supplier's contract with Coded. Where a contract and this Supplier Code conflict, the stricter standard applies.

14.1 Legal compliance and ethics

Suppliers must comply with all applicable laws and regulations, conduct business with integrity, and uphold standards consistent with Sections 4–6 of this Code, including a zero-tolerance approach to bribery and corruption.

14.2 Labour rights and human rights

Suppliers must respect internationally recognised human rights, consistent with the International Bill of Human Rights and the core conventions of the International Labour Organization (ILO), and the UN Guiding Principles on Business and Human Rights. Suppliers must:

• ensure all work is freely chosen, and prohibit forced, bonded, indentured, trafficked, or involuntary labour, and the retention of identity documents or charging of recruitment fees to workers;
• prohibit child labour, observe the applicable minimum working age, and protect young workers from hazardous work;
• pay at least the legally required wages and benefits, and pay on time;
• respect lawful working-hour limits and provide rest days and leave as required by law;
• respect workers' lawful rights to freedom of association and collective bargaining; and
• prohibit discrimination, harassment, and degrading treatment, consistent with Sections 8 and 9 of this Code.

Coded has zero tolerance for modern slavery and human trafficking in its operations and supply chains. This expectation is set out further in our Modern Slavery Statement (modern-slavery).

14.3 Health and safety

Suppliers must provide a safe and healthy workplace consistent with applicable law, manage workplace hazards, and provide appropriate training, equipment, and emergency preparedness.

14.4 Environmental responsibility

Suppliers must comply with applicable environmental laws and permits, work to reduce waste, emissions, and the environmental impact of their operations, and handle hazardous materials lawfully and responsibly. We favour partners who demonstrate continual improvement in environmental performance.

14.5 Data protection, confidentiality, and security

Suppliers who process personal data for or with Coded must comply with applicable data-protection law and with the terms agreed with Coded, including our Data Processing Agreement (dpa) where applicable, and must protect Coded and merchant confidential information and maintain appropriate security controls.

14.6 Monitoring, audit, and consequences

Coded may assess a Supplier's adherence to this Supplier Code through self-assessment, documentation, or — where contractually agreed — audit. Suppliers must cooperate reasonably with such assessments, address identified gaps through a corrective-action plan, and notify Coded promptly of any serious breach. Failure to meet this Supplier Code, or refusal to remediate, may lead to remediation requirements, suspension, or termination of the business relationship.

14.7 Raising concerns

Suppliers and their workers may report concerns about conduct connected to Coded confidentially through the channels in Section 15. We do not tolerate retaliation against anyone who reports a concern in good faith.

15. Raising concerns and non-retaliation

If you become aware of conduct that may breach this Code or the law, you must speak up. You can raise a concern with your manager, with Coded's legal team at legal@coded.eu, or — for security matters — at security@coded.co, or — for abuse, illegal content, or platform reports — at report@coded.co.

Concerns may also be raised confidentially, and where possible anonymously, by contacting report@coded.co or legal@coded.eu. We do not tolerate retaliation against anyone who raises a concern in good faith.

Coded does not tolerate retaliation against any person who, in good faith, raises a concern, reports suspected misconduct, or participates in an investigation. Retaliation is itself a breach of this Code. Concerns will be handled fairly and confidentially, and investigated proportionately.

16. Compliance with this Code and consequences

Compliance with this Code is a condition of working for or with Coded. Breach by a person covered by Sections 4–13 may lead to disciplinary action up to and including termination of employment or engagement, and, where conduct is unlawful, referral to the competent authorities. Breach of the Supplier Code (Section 14) may lead to the consequences described in Section 14.6.

Nothing in this Code creates a contract of employment or alters the at-will or statutory nature of any engagement beyond what applicable law requires, and nothing in this Code limits any right a person has under mandatory local law, including whistleblower-protection law.

17. Governance, review, and changes

This Code is owned by Coded's legal and leadership function. We will review it periodically and update it as our business, applicable law, and good practice evolve. The current version is published at coded.co/legal. Material changes will be communicated through appropriate internal and partner channels.

18. Governing law

This Code is governed by the laws of the Netherlands, and any dispute relating to it is subject to the exclusive jurisdiction of the competent courts of Amsterdam, the Netherlands, without prejudice to any mandatory provision of the local law of the jurisdiction in which a person resides or works that applies regardless of this choice.

Contact

Coded B.V. — registered office De Taling 15, 2761 SL Zevenhuizen, The Netherlands; Chamber of Commerce (KVK) number 42027097; VAT number NL869368795B01. Effective from 11 June 2026.