Personal Data Processing Agreement (operator's instruction)

Version dated 21 September 2026.

This is an English translation for convenience. In case of any discrepancy, the Russian version prevails.

This Agreement is a separate agreement between the Company and the owner of the kup2b platform, not an appendix to the Offer. It is signed through an electronic document management operator (Kontur.Diadoc) or on paper in two copies. The Platform inserts the Company's details into the form (values in curly brackets); a completed form can be downloaded and a signed copy uploaded in the Personal Account. In this Agreement, the “Operator” is the Company (the personal data operator), while the platform owner is referred to as the “Processor”.

AGREEMENT on personal data processing (operator's instruction)

Krasnogorsk, Moscow Region · __________

__________, represented by __________, acting on the basis of __________, hereinafter the “Operator”, on the one hand, and

Individual entrepreneur Yulia Viktorovna Konovalova (OGRNIP 326508100405306), hereinafter the “Processor”, on the other hand, jointly the “Parties”,

have entered into this personal data processing agreement (the “Agreement”) as follows.

1. In accordance with the laws of the Russian Federation on personal data, the Operator instructs the Processor to process the personal data of individuals whose details the Operator enters on the kup2b platform (https://kup2b.ru, the “Platform”) not as Platform users: contact persons and representatives of the Operator's counterparties, delivery recipients (consignees), employees and other representatives of the Operator who do not have an account on the Platform (the “Data Subjects”). This Agreement does not apply to the personal data of Platform users who registered an account themselves and gave consent to the Processor: in relation to them, the Processor acts as an independent operator.

2. The personal data of the Data Subjects is processed for the purposes of placing, confirming and fulfilling the Operator's orders on the Platform; arranging shipment, delivery and receipt of goods; sending order notifications to persons specified by the Operator; and providing the Operator's counterparty with the data necessary for a particular transaction, in accordance with the terms of the Offer Agreement on the use of the kup2b platform accepted by the Operator on __________ and entered into between the Operator and the Processor (the “Agreement”). The Processor may not process the Data Subjects' personal data for its own purposes, including marketing, mailings, ratings, analytics or profiling.

3. Under this Agreement, the Operator instructs the Processor to process the following personal data of the Data Subjects:

• surname, first name and patronymic;
• position;
• telephone number;
• email address;
• delivery address and other information entered by the Operator about the Data Subject in order fields.

The Operator does not enter special categories of personal data or biometric personal data on the Platform.

4. The list of personal data actions (operations) includes collection, recording, systematisation, accumulation, storage, clarification (updating and modification), extraction, use, transfer (provision to the Operator's counterparty—the party to the relevant order—and to the persons specified in clause 12), blocking, deletion and destruction. Dissemination of personal data and its cross-border transfer are not carried out.

5. Method of personal data processing: automated processing of personal data in the Platform's information system. The databases used for collection, recording, systematisation, accumulation, storage, clarification and extraction of personal data are located in the Russian Federation.

6. When processing personal data, the Processor must maintain the confidentiality of personal data and ensure its security during processing; independently take the necessary legal, organisational and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision or dissemination, as well as from other unlawful actions in relation to personal data; and familiarise employees and representatives directly involved in processing personal data with the provisions of Russian legislation on personal data and local acts concerning personal data processing.

7. Personal data security is ensured, in particular, by:

• identifying personal data security threats when processing personal data in personal data information systems;
• applying organisational and technical measures to ensure the security of personal data when processing it in personal data information systems, as required to comply with personal data protection requirements, the implementation of which ensures the levels of personal data security established by applicable law;
• using information security tools where required by applicable law;
• assessing the effectiveness of measures taken to ensure personal data security before commissioning the personal data information system;
• accounting for machine-readable personal data media;
• detecting unauthorised access to personal data and taking measures;
• restoring personal data modified or destroyed as a result of unauthorised access;
• establishing access rules for personal data processed in the personal data information system, and ensuring registration and accounting of all actions performed with personal data in the information system;
• monitoring the measures taken to ensure personal data security and the security level of information systems.

8. The Processor undertakes to take all necessary measures to ensure the security of personal data transferred to it by the Operator or collected by it for the Operator in accordance with applicable law, taking into account current personal data security threats when processing personal data in the Processor's information systems and the information technologies it uses. The specific organisational and/or technical measures included by the Processor in its personal data protection system are determined by the Processor taking into account current personal data security threats and the information technologies used in the Processor's information systems, and must ensure compliance with personal data protection requirements, the implementation of which ensures the levels of personal data security established by applicable law.

9. To protect personal data when processing it in the Processor's information system, the Processor must, among other things, comply with the following requirements:

• organise a security regime for the premises and equipment where the personal data information system is located, preventing uncontrolled entry or presence of persons without access rights (including through the infrastructure provider, clause 12);
• ensure the preservation of personal data media;
• approve a document defining the list of persons whose access to the Data Subjects' personal data processed in the Processor's information systems is necessary for their official (employment) duties or civil-law obligations;
• use appropriate information security tools that have passed conformity assessment under Russian legislation on information security where such tools are necessary to neutralise current personal data security threats;
• appoint a person responsible for ensuring the security of the Data Subjects' personal data in the Processor's information system.

10. At the Operator's request, the Processor must provide documents and other information confirming that the measures and requirements specified in this Agreement and in legislation on personal data processing have been adopted and complied with, including information the Operator needs to identify the Processor in a personal data processing notification.

11. If an unlawful or accidental transfer (provision, dissemination or access) of personal data is discovered and this has resulted in a violation of the Data Subjects' rights, the Processor must notify the Operator:

• immediately, but in any event no later than 10 hours after the incident, of the incident, its suspected causes that led to the violation of the Data Subjects' rights, the suspected harm caused to those persons, and the measures taken to eliminate the consequences of the incident;
• within 50 hours, of the results of the internal investigation of the incident and the identities of persons whose actions caused the incident, if any.

The notification is sent through the Platform's Personal Account and to the Operator's email address specified in its details.

12. The Processor may engage persons providing the Platform's infrastructure (hosting and cloud infrastructure, object storage, and email and notification delivery service—only providers located in the Russian Federation) to process personal data under agreements that meet the requirements of Part 3 of Article 6 of the Federal Law “On Personal Data”. The list of such persons is provided in clause 4.9 of the Personal Data Processing Policy (https://kup2b.ru/legal/privacy). The Processor is liable to the Operator for the actions of engaged persons as for its own actions.

12.1. Integrations connected by the Operator. If the Operator configures the transfer of transaction details to external systems in the Personal Account (notifications to an address specified by the Operator or exchange with an accounting system), the Operator itself determines the recipient and place of processing. The Processor transfers the information to the specified address on the Operator's instructions and is not responsible for the recipient's further processing; the Operator bears the obligations of a personal data operator in relation to this transfer, including notifying the authorised body of a cross-border transfer if the recipient is outside the Russian Federation.

13. The Processor forwards requests and appeals from Data Subjects concerning data processed under this Agreement to the Operator within 3 business days; at the Operator's instruction, it clarifies, blocks, deletes or anonymises the data within 7 business days from the date of the instruction. The period established by this clause does not apply where the law provides for a shorter period: upon discovering unlawful processing, the Processor immediately stops it and blocks the relevant data, while the requirements of Article 21 of the Federal Law “On Personal Data” are fulfilled within the periods established by that Article.

14. The Operator warrants that it has obtained the Data Subjects' written consents to processing their personal data, including transfer to the Processor for processing under this instruction and provision to the Operator's counterparties to the extent of the transaction; has notified the Data Subjects of the processing in accordance with Article 18 of the Federal Law “On Personal Data”; and stores the consents for the processing period. At the Processor's request—including when a Data Subject or an authorised body makes an appeal—the Operator provides confirmation that consent exists within 5 business days. The Operator is liable to the Data Subjects for the Processor's actions performed in accordance with the Agreement (Part 5 of Article 6 of the Federal Law “On Personal Data”); the Processor is liable to the Operator.

15. The Processor must store personal data in a form that makes it possible to identify the personal data subject, for no longer than required by the purposes of processing. Upon termination of the Agreement or at the Operator's instruction, the Processor provides the Operator with an opportunity to export the personal data and, within 30 days, deletes or anonymises it, including data in backups as they are rotated. The exception is information forming part of orders, which is stored for 5 years as part of transaction documents in the interests of both parties to the transaction (clause 17.7 of the Agreement), after which it is deleted or anonymised.

16. Obligations to preserve personal data confidentiality:

16.1. The Processor may provide access to personal data (also “Confidential Information”) received from the Operator only to its employees or representatives who need access to Confidential Information to achieve the purpose for which it was provided, who are bound by an obligation not to disclose confidential information (including an obligation not to disclose confidential information of third parties received by the Processor's employee/representative while performing official duties or duties under a civil-law agreement) in an employment or civil-law agreement, and who have been informed of the fact that this Agreement was entered into.

16.2. The Processor must keep all Confidential Information permanently secret and must not disclose or reveal it without the Operator's written consent, except for providing data to the Operator's counterparty under an order (clauses 2 and 4) and to the persons specified in clause 12.

16.3. The Processor and its representatives who have access to Confidential Information must use it solely to achieve the purpose for which it was provided and must not use it for any other purposes.

16.4. The Processor must ensure that copies, extracts or other documents (including those created using electronic means) relating to Confidential Information are made only to the extent reasonably necessary to achieve the purpose for which it was provided, including backup, and must keep records of where they are held.

16.5. Confidential Information transferred between the Parties must be protected from third-party access during transfer using appropriate security measures; when transferred through the Platform, it must be protected by encryption of the communication channel.

16.6. The Processor must ensure secure processing of Confidential Information on technical equipment accessible only to authorised users and reliable storage that prevents unauthorised persons from accessing the information, including outside working hours.

17. The Processor compensates the Operator for documented actual losses arising from the Processor's breach of this Agreement, including amounts paid by the Operator to Data Subjects and administrative fines imposed on the Operator through the Processor's fault, within the limits established by clause 13.4 of the Agreement. The Processor is not liable for consequences of the Operator's failure to obtain Data Subjects' consents, failure to notify Data Subjects, or entry of inaccurate or excessive information.

18. This Agreement enters into force on the date it is signed by the Parties and remains effective for the term of the Offer Agreement on the use of the kup2b platform entered into between the Operator and the Processor.

19. This Agreement is concluded in Russian and signed by the Parties through an electronic document management operator or on paper in two copies, one for each Party.

20. Details and signatures of the Parties: