Personal Data Processing Policy of the kup2b platform

Version dated 7 October 2026.

This is an English translation for convenience. In case of any discrepancy, the Russian version prevails.

1. General provisions

1.1. Purpose of the Policy. This Personal Data Processing Policy for the kup2b platform (the “Policy”) establishes requirements for organising and directly operating the personal data processing processes of kup2b platform users, as well as the personal data protection requirements implemented by Individual Entrepreneur Yulia Viktorovna Konovalova (also the “Operator”) in accordance with the regulatory legal acts of the Russian Federation on personal data processing and protection (also “PD”). Personal data is confidential, protected information, and all requirements established by the Operator's internal documents for protecting confidential information apply to it.

1.2. This Policy is publicly available and must be posted on the Platform at https://kup2b.ru/legal/privacy.

1.3. The Policy applies to all personal data the Operator receives from personal data subjects when they use the Platform, contact support, and from Companies participating in the Platform in relation to their employees and representatives.

1.4. Key concepts. The following concepts and definitions are used in this Policy:

Automated personal data processing means processing PD using computer equipment;

Blocking of PD means temporary cessation of PD processing, except where processing is necessary to clarify the PD;

PD information system (PDIS) means the combination of PD contained in databases and information technologies and technical means that ensure its processing;

PD confidentiality means the requirement binding on a person who has obtained access to PD not to allow its dissemination or transfer to third parties without the PD subject's consent or another lawful ground;

Operator means Individual Entrepreneur Yulia Viktorovna Konovalova, INN 590402889790, OGRNIP 326508100405306, address: apartment 228, 5 Serebryany Boulevard, Opalikha microdistrict, Krasnogorsk, Moscow Region, 143444, Russia (also the “Operator's Address”), independently or jointly with other persons organising and/or processing PD and determining the purposes of PD processing, the composition of PD to be processed and the actions (operations) performed with PD;

Platform (Website) means https://kup2b.ru, its subdomains, mobile versions, applications and application programming interfaces (API) belonging to the Operator;

Company means a legal entity or individual entrepreneur that has entered into an agreement with the Operator on the use of the Platform under the Offer;

User means an individual with an account on the Platform acting on behalf of one or more Companies (an employee, manager or Company representative);

Visitor means any person visiting the Platform's public pages without authorisation;

Counterparty representative means an individual whose details a Company enters on the Platform as a contact person of its counterparty, warehouse or delivery recipient;

PD processing means any action (operation) or set of actions (operations) performed with PD using or without using automation tools, including collection, recording, systematisation, accumulation, storage, clarification (updating and modification), extraction, use, transfer (dissemination, provision and access), anonymisation, blocking, deletion and destruction of PD;

Personal data / PD means any information relating directly or indirectly to an identified or identifiable individual, the personal data subject (also the “PD Subject”);

Provision of PD means actions aimed at disclosing PD to a particular person or group of persons;

Dissemination of PD means actions aimed at disclosing PD to an indefinite group of persons;

Cross-border transfer of PD means transfer of PD to the territory of a foreign state, to an authority of a foreign state, foreign individual or foreign legal entity;

Destruction of PD means actions that make it impossible to restore the content of PD in the PDIS and/or destroy physical PD media;

Cookie files means small data fragments that the Platform saves on a Visitor's or User's device and that are transmitted to the Platform on subsequent requests; they are used for authentication, saving settings, security and analysing use of the Platform.

2. Legal grounds for processing personal data

2.1. The legal grounds for processing personal data are the body of legal acts under and in accordance with which the Operator processes personal data. The Operator processes personal data on the basis of: the Constitution of the Russian Federation; the Civil Code of the Russian Federation; the Tax Code of the Russian Federation; Federal Law No. 149-FZ dated 27 July 2006 “On Information, Information Technologies and Information Protection”; Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data”; Federal Law No. 63-FZ dated 6 April 2011 “On Electronic Signature”; Federal Law No. 402-FZ dated 6 December 2011 “On Accounting”; Resolution of the Government of the Russian Federation No. 1119 dated 1 November 2012 “On Approval of Requirements for Personal Data Protection when Processing Personal Data in Personal Data Information Systems”; Order No. 21 of the Federal Service for Technical and Export Control of Russia dated 18 February 2013 “On Approval of the Composition and Content of Organisational and Technical Measures to Ensure Personal Data Security when Processing Personal Data in Personal Data Information Systems”; Resolution of the Government of the Russian Federation No. 687 dated 15 September 2008 “On Approval of the Regulation on the Specifics of Personal Data Processing without the Use of Automation Tools”; and other regulatory legal acts governing personal data processing.

2.2. Personal data is also processed on the basis of: the Offer on the use of the kup2b platform and agreements with Companies entered into under it; the personal data subject's consent to processing their personal data; the Company's instruction to process Counterparty representatives' personal data under a Personal Data Processing Agreement entered into as a separate document between the Company and the Operator; and the need to process data to exercise the Operator's or third parties' rights and legitimate interests, provided that the PD subject's rights and freedoms are not violated.

2.3. A personal data subject gives consent when registering an account by checking a separate box; the consent is documented separately from acceptance of the Offer and other documents confirmed by the personal data subject. Consent is specific, subject-specific, informed, conscious and unambiguous; the Operator does not preselect the boxes. Consent to receive informational (advertising) mailings is given by a separate box, is voluntary and does not affect the ability to use the Platform. The Operator records and stores the date, time, version of the Personal Data Processing Consent and the IP address from which consent was given or withdrawn.

3. Purposes of personal data processing, categories of subjects and categories of PD processed

3.1. Personal data is processed for the purposes of:

• registering Users and Companies on the Platform, identifying and authenticating Users, and entering into and performing the Offer on the use of the Platform;
• verifying Companies and checking the authority of Company representatives;
• providing Users with Platform functionality: maintaining a catalogue, Price Requests, Orders, generating Invoices, communication between Company representatives in chats, and managing counterparties and delivery recipients;
• sending service notifications about events on the Platform;
• handling support requests and considering claims;
• ensuring Platform security, preventing fraud, unauthorised access and violations of the Offer;
• complying with legal requirements, including retaining documents and responding to requests from state authorities;
• analysing use of and improving the Platform in anonymised form;
• informing about Platform capabilities and new features;
• providing Visitors and Users with free Platform tools;
• sending a list of catalogue Products with password access to the email address specified by the Visitor;
• considering complaints from Participants and third parties about posted Content.

3.2. PD characteristics:

3.3. Personal data is processed to the extent necessary to achieve the stated purposes. The Operator does not process special categories of personal data (race, nationality, political views, religious or philosophical beliefs, health or intimate life), biometric personal data or criminal record information; Users are prohibited from posting such information on the Platform.

4. General rules for personal data processing

4.1. A User's personal data is obtained directly from the User during registration and use of the Platform; for this data, as well as Visitors' data and data of persons contacting support, the Operator is an independent personal data operator. Counterparty representatives' personal data is obtained from the Company entering the data; the Company is the operator of such personal data, and the Operator processes it on the Company's instruction under a Personal Data Processing Agreement entered into as a separate document between the Company and the Operator. The Company obtains the Counterparty representative's consent to processing their personal data, including transfer to the Operator and Counterparties, and notifies them as required by law; the Operator, as a person processing data on instruction, does not obtain the subject's consent. The Company is liable to the Counterparty representative for the Operator's actions; the Operator is liable to the Company.

Information in the “Tools” section forms is entered by the Visitor, including information about third parties, with confirmation that the Visitor has the right to use it, or such information is publicly available.

4.2. Personal data may be processed in the following cases:

• the personal data is processed with the personal data subject's consent;
• the personal data is necessary to perform an agreement to which the personal data subject is a party, beneficiary or guarantor, or to enter into an agreement at the personal data subject's initiative or an agreement under which the personal data subject will be a beneficiary or guarantor;
• the personal data is necessary to exercise the Operator's or third parties' rights and legitimate interests, including Companies entering into transactions through the Platform, provided that the personal data subject's rights and freedoms are not violated;
• at the request of authorised state authorities in cases provided by federal law;
• the personal data is processed on the basis of regulatory legal acts establishing the purpose and conditions for obtaining personal data and the group of subjects whose personal data is to be processed, as well as defining the Operator's powers;
• the personal data is processed for statistical purposes, provided it is mandatorily anonymised;
• the personal data is processed in connection with a person's participation in civil, administrative or criminal proceedings or proceedings in arbitration courts;
• the personal data is necessary to enforce a judicial act or an act of another body or official that must be enforced under Russian legislation on enforcement proceedings.

4.3. Personal data is stored electronically in the Operator's personal data information systems (the Platform database, file storage, mail system and support system), as well as in archived database copies. Personal data is stored on paper only as part of documents received from PD Subjects or Companies by mail.

4.4. Collection, recording, systematisation, accumulation, storage, clarification and extraction of PD are carried out using databases located in the Russian Federation.

4.5. Personal data processed for different purposes defined by this Policy must be stored separately, including by logically separating different Companies' data in the Platform database.

4.6. The storage period for personal data processed in personal data information systems must not exceed the period necessary to achieve the processing purposes unless a different period is established by federal law or an agreement.

4.7. Personal data processing ends within the periods established by Russian law in the following cases:

• when the purposes of personal data processing are achieved or the need to achieve them is lost;
• when the personal data processing period established at collection expires;
• when a User deletes their account or is removed from all Companies, or when an agreement with a Company ends, taking into account the storage periods established by clause 4.8;
• at the request of the personal data subject or the authorised body for protecting the rights of personal data subjects, if the personal data is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated processing purpose;
• when the violations committed in processing personal data cannot be remedied;
• when the regulatory legal acts establishing the legal grounds for processing personal data are amended or repealed;
• when the personal data subject withdraws consent, if under Federal Law No. 152-FZ dated 27 July 2006 “On Personal Data” processing is permitted only with their consent.

4.8. Processed personal data is destroyed or anonymised when the processing purposes are achieved or the need to achieve them is lost, unless federal law provides otherwise. Electronic personal data is destroyed by deleting records from databases and file storage using methods that prevent recovery. Personal data on paper is destroyed mechanically (shredding). The destruction of personal data processed using automation tools is confirmed by a personal data destruction certificate and an extract from the register of personal data destruction events, prepared using forms established by regulatory legal acts. The Operator does not record or store data entered in “Tools” section forms. Backups containing destroyed personal data are destroyed within no more than 30 days.

4.9. The Operator does not carry out cross-border transfers of personal data. The Operator's databases are located in the Russian Federation. The Operator uses external services (Russian entities): hosting and object storage (Beget), a counterparty and address verification service (DaData), telephone number confirmation by call (GreenSMS), protection against automated requests (Yandex SmartCaptcha), web analytics (Yandex Metrica) and a mail service. Browser push notifications are delivered by browser manufacturers' services; no personal data is transferred in them—only the event type and a link to the Platform.

4.10. The Platform uses cookie files and similar technologies to maintain a User session, authenticate, save settings, ensure security, prevent fraud and analyse use of the Platform.

Mandatory cookie files are used to the extent necessary for the Platform's operation, authentication and security. Disabling them may make certain Platform functions unavailable.

Information collected using cookie files and similar technologies may include a session identifier, browser and device information, IP address, User settings, date and time of access, information about actions on the Platform and other technical data. If such information can be associated with a User or account, it is processed as personal data under this Policy.

Optional cookie files and web analytics services (Yandex Metrica, including recording visitor actions on pages) are used to analyse traffic and improve the Platform only when there is a legal ground provided by law, including the personal data subject's consent where required. A Visitor is notified about cookie use on the first visit to the Platform; optional cookie files can be disabled in browser settings. Refusal of optional cookie files does not prevent use of the Platform's core functions.

The Operator does not use cookie files to publicly disclose personal data. Information obtained using cookie files may be transferred to third parties only to persons processing data on the Operator's instruction and to the extent necessary for the stated processing purposes.

The storage periods for device information and language selection are 12 months; other information is stored for 30 days.

4.11. The Operator does not control and is not responsible for third-party websites and services to which a User may navigate through links available on the Platform, including Company websites.

4.12. The Platform's public pages display only Company information: name (for an individual entrepreneur, their surname, first name and patronymic), logo, description, city, website address and Seller rating. The full name, position, telephone number, email address, messenger identifiers and other contact details of Users and Company representatives are not displayed on public pages unless expressly provided by law or by the personal data subject's separate consent.

Users of Companies participating in a particular transaction may be provided with the full name, position and contact details of Users and representatives of the other Company participating in the relevant interaction, solely to the extent necessary to enter into, perform or support the transaction.

Personal data entered on the Platform by a Company is processed by the Operator on the Company's instruction and provided only to the Company and participants connected with a particular transaction, to the extent necessary for its performance, under the Personal Data Processing Agreement.

Such personal data is not intended for public dissemination, open access or use for purposes unrelated to the relevant transaction. Companies and their Users must use the received data only to perform and interact in relation to the relevant transaction and must keep it confidential.

5. Basic principles of personal data processing

5.1. Personal data may be processed only in accordance with the purposes that determined its collection.

5.2. Databases containing personal data processed for purposes incompatible with one another may not be combined.

5.3. When personal data is processed, its accuracy, sufficiency and, where necessary, relevance to the stated processing purposes are ensured. A User may update their data independently in account settings.

5.4. Personal data is stored in a form that makes it possible to identify the personal data subject, for no longer than required by the processing purposes, unless the storage period is established by federal law or an agreement to which the personal data subject is a party, beneficiary or guarantor.

5.5. An agreement entered into with a personal data subject may not contain provisions restricting the rights and freedoms of the personal data subject, establishing cases for processing minors' personal data unless otherwise provided by Russian law, or allowing the personal data subject's inaction to be a condition of entering into the agreement.

5.6. The content and volume of personal data processed correspond to the stated processing purposes; the processed personal data is not excessive in relation to those purposes.

6. Transfer of personal data

6.1. Personal data of personal data subjects may not be transferred to third parties without their consent, except where necessary to prevent a threat to the subject's life or health, to perform an agreement involving the PD subject, and in other cases provided by law and this Policy.

6.2. Third parties receiving personal data must be informed that it may be used only for the purposes for which it was provided and subject to confidentiality. The Operator may require these persons to confirm compliance with this rule.

6.3. Where state authorities are entitled to request personal data or information must be provided by law, and in response to a court request, personal data-related information may be provided in the manner established by applicable Russian law.

6.4. The Operator may instruct third parties to process personal data under agreements entered into with those persons and meeting legal requirements, to achieve the purposes of personal data processing, provided Russian legal requirements are met. Such third parties may perform only the actions with personal data specified in the Operator's instruction.

6.5. A third party processing personal data on the Operator's instruction must comply with the principles and rules of personal data processing established by law, maintain personal data confidentiality and take the necessary measures to ensure compliance with the duties under the Federal Law “On Personal Data”. The Operator is liable to the PD subject for that person's actions.

6.6. An instruction to a third party processing personal data on the Operator's instruction must define the list of personal data, the list of actions (operations) with personal data and its processing purposes; establish the third party's duty to maintain personal data confidentiality, use databases in the Russian Federation, take all measures to ensure compliance with the personal data law, provide the Operator during the instruction term and until processing ends with documents and other information confirming adoption of measures and compliance with the personal data law upon request, ensure personal data security during processing, and state requirements for protecting the processed personal data under the Federal Law “On Personal Data”, including a requirement to notify the Operator of unlawful personal data processing.

6.7. Providing one Company's Users' personal data to representatives of another Company as part of a transaction on the Platform (clause 4.12) is not an instruction to a third party to process data; each Company acts as an independent operator of the data received.

7. Measures to ensure personal data security

7.1. When processing personal data, the Operator takes the necessary legal, organisational and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision or dissemination, and from other unlawful actions involving personal data.

7.2. Personal data security is ensured, in particular, by:

• appointing a person responsible for organising personal data processing;
• issuing documents defining the Operator's personal data processing policy and local acts on PD processing and protection;
• applying organisational and technical measures to ensure personal data security in personal data information systems as necessary to comply with personal data protection requirements, the implementation of which ensures the personal data security levels established by Russian law;
• transferring data between Users' devices and the Platform only over secure channels (HTTPS/TLS);
• storing User passwords exclusively as irreversible cryptographic hashes;
• differentiating access to personal data by User roles and by Operator employees and contractors, and maintaining access logs;
• regularly backing up and restoring personal data modified or destroyed due to unauthorised access;
• detecting unauthorised access to personal data and taking necessary measures, including detecting, preventing and eliminating the consequences of computer attacks on personal data information systems and responding to computer incidents in them;
• using protection against malicious software and unauthorised access;
• monitoring measures taken to ensure personal data security and the security level of personal data information systems;
• familiarising the Operator's employees and contractors directly involved in personal data processing with the provisions of personal data legislation and this Policy.

7.3. To protect personal data, transferring information containing personal data by telephone is prohibited because the person requesting the information cannot be identified.

7.4. To identify and prevent violations under personal data legislation, the Operator uses the following procedures:

• internal monitoring (audit) of processing compliance with personal data protection requirements;
• assessing harm that may be caused to personal data subjects;
• limiting personal data processing to specific, predetermined and lawful purposes;
• processing personal data in accordance with the principles and conditions established by personal data legislation;
• ensuring that processing incompatible with the purposes of collecting personal data is not carried out;
• ensuring that databases containing personal data processed for incompatible purposes are not combined;
• ensuring that the content and volume of processed personal data correspond to the stated processing purposes;
• ensuring the accuracy, sufficiency and relevance of personal data in relation to the processing purposes.

7.5. If an incident results in unlawful transfer (provision, dissemination or access) of personal data, the Operator notifies the authorised body for protecting the rights of personal data subjects and informs affected PD subjects if the incident threatens their rights, within the periods established by applicable law.

8. Rights of a personal data subject

A personal data subject has the right:

8.1. To receive information concerning the processing of their personal data, including:

• confirmation that the Operator processes personal data;
• legal grounds and purposes of personal data processing;
• methods of personal data processing used by the Operator;
• the Operator's name and location, and information about persons who have access to personal data or to whom personal data may be disclosed under an agreement with the Operator or under federal law;
• the personal data processed in relation to the relevant personal data subject and its source, unless federal law provides another procedure for providing such data;
• personal data processing periods, including storage periods;
• the procedure for exercising the rights provided by the Federal Law “On Personal Data”;
• information about an actual or intended cross-border transfer of data;
• the name or surname, first name, patronymic and address of the person processing personal data on the Operator's instruction, if processing has been or will be instructed to that person;
• other information provided by the Federal Law “On Personal Data” or other federal laws.

8.2. To require the Operator to clarify, block or destroy their personal data if it is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated processing purpose, and to take legal measures to protect their rights.

8.3. To free and free-of-charge access to their personal data, including the right to receive copies of a record containing personal data and information about its processing, except as provided by Russian law. A User may view and change basic data in the Platform account settings.

8.4. To withdraw consent to personal data processing by sending the Operator a request under clause 10.2 of the Policy and also delete their Platform account. Withdrawal does not affect the lawfulness of processing carried out before withdrawal and does not end processing performed on other lawful grounds.

8.5. To refuse informational mailings by using the link in an email or account settings; service notifications necessary to perform the agreement and ensure security are sent regardless of that refusal.

8.6. To complain to the authorised body for protecting the rights of personal data subjects (Roskomnadzor) or a court about any unlawful action or omission by the Operator in processing and protecting their personal data. A personal data subject has the right to preserve and protect personal and family privacy and to protect their rights and legitimate interests, including compensation for losses and/or moral harm. In all cases, a personal data subject's waiver of their rights to preserve and protect the confidentiality of their personal data is invalid and legally void.

9. Operator's duties

The Operator undertakes to:

9.1. Take necessary and sufficient legal, organisational and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision or dissemination, and from other unlawful actions involving personal data.

9.2. Carry out organisational and technical measures to protect personal data in accordance with Russian legal requirements concerning personal data processing.

9.3. To ensure personal data protection, assess the harm that may be caused to personal data subjects if the security of their personal data is violated and identify current personal data security threats when processing personal data in personal data information systems.

9.4. When current threats are identified, apply necessary and sufficient legal, organisational and technical measures to ensure personal data security, including:

• identifying information security threats involving personal data when it is processed;
• applying organisational and technical measures to ensure the security of information containing personal data when it is processed;
• assessing the effectiveness of measures before commissioning a personal data information system;
• accounting for machine-readable media containing information with personal data;
• detecting unauthorised access to information containing personal data and taking measures;
• restoring personal data modified or destroyed as a result of unauthorised access;
• establishing access rules for information containing personal data and ensuring registration and accounting of all actions performed with such information in the personal data information system;
• monitoring the measures taken.

9.5. Store personal data in a manner preventing its loss and unlawful use, including on servers located in the Russian Federation.

9.6. Publish this Policy on the Platform and ensure unrestricted access to it, and provide a PD subject, upon request, with the information specified in clause 8.1.

10. Final provisions

10.1. The Operator may amend this Policy. The Policy must be updated if Russian personal data legislation changes. A new version takes effect on the date specified in it, but not earlier than the date it is posted on the Platform.

10.2. Requests from personal data subjects and their representatives are sent to hello@kup2b.ru with the subject “Personal data request” from the email address specified in the User's account or signed with an enhanced qualified electronic signature; or in writing by registered mail with an inventory of enclosed items or by courier service to: apartment 228, 5 Serebryany Boulevard, Opalikha microdistrict, Krasnogorsk, Moscow Region, 143444, Russian Federation.

10.3. The person responsible for organising the Operator's personal data processing is Yulia Viktorovna Konovalova; contact: hello@kup2b.ru.

10.4. Operator details: Individual Entrepreneur Yulia Viktorovna Konovalova, INN 590402889790, OGRNIP 326508100405306, address: apartment 228, 5 Serebryany Boulevard, Opalikha microdistrict, Krasnogorsk, Moscow Region, 143444, Russia; email: hello@kup2b.ru; website: https://kup2b.ru.