Personal Data Processing Policy of ENERGOTRADE LLC, dated September 29, 2025

This Policy on Personal Data Processing (hereinafter – the Policy) defines the procedure for the collection, processing, storage, and protection of personal data by ENERGOTRADE LLC (hereinafter – the Company), and also establishes the principles and conditions for the transfer of personal data to third parties. The Policy has been developed in accordance with the requirements of Federal Law No. 152-FZ of July 27, 2006 “On Personal Data” and other applicable legislation of the Russian Federation.

1. Key Definitions

- Personal Data: Any information relating directly or indirectly to an identified or identifiable individual (personal data subject).

- Personal Data Operator: Limited Liability Company “ENERGOTRADE”, registered in accordance with the legislation of the Russian Federation, TIN 7735198624, PSRN 1237700115168, located at: 124460, Moscow, Municipal District Matushkino, Zelenograd, Passage 4801-Y, Building 5, which independently or jointly with other persons organizes and (or) carries out the processing of personal data, and also determines the purposes of personal data processing, the composition of personal data to be processed, and the actions (operations) performed with personal data.

- Personal Data Processing: Any action (operation) or set of actions (operations) performed with or without the use of automation tools with personal data, including collection, recording, systematization, accumulation, storage, clarification (updating, modification), retrieval, use, transfer (dissemination, provision, access), anonymization, blocking, deletion, and destruction of personal data.

- Personal Data Subject: An individual to whom the personal data relate.

- Website: A set of graphic and informational materials, as well as computer programs and databases that make them available on the Internet at https://invertomatic.ru/.

2. Principles of Personal Data Processing

Personal data processing in the Company is carried out on the basis of the following principles:

- Lawfulness and fairness of the purposes and methods of personal data processing.

- Consistency of the purposes of personal data processing with the purposes predetermined and declared at the time of personal data collection.

- Consistency of the volume and nature of the personal data processed, and of the methods of personal data processing, with the purposes of personal data processing.

- Accuracy of personal data, their sufficiency for the purposes of processing, and their relevance in relation to the purposes of processing.

- Impermissibility of combining databases containing personal data the processing of which is carried out for purposes incompatible with each other.

- Storage of personal data in a form that allows identification of the personal data subject for no longer than required by the purposes of personal data processing, unless the retention period for personal data is established by federal law or by a contract to which the personal data subject is a party, beneficiary, or guarantor.

- Destruction or anonymization of personal data upon achievement of the purposes of processing or in the event that achievement of these purposes is no longer necessary, unless otherwise provided by federal law.

3. List of Personal Data Collected

The Company collects the following categories of personal data:

- Last name, first name, patronymic.

- Contact information: phone number, email address.

- Data relating to professional activity: position, place of work.

- Other data that may be provided by the Personal Data Subject voluntarily, or the collection of which is necessary to achieve the purposes specified in Section 4 of this Policy.

The Company collects only those personal data that are necessary and sufficient for the declared purposes of their processing.

4. Purposes of Personal Data Processing

Personal data of Personal Data Subjects are processed by the Company for the following purposes:

- Ensuring the operation of the Website and providing access to its services.

- Identifying the Personal Data Subject for the provision of services and interaction.

- Establishing and maintaining communication with the Personal Data Subject.

- Providing the Personal Data Subject with information about the Company’s services, products, and events (informational purposes).

- Conducting marketing, advertising, and commercial activities, including distribution of newsletters, special offers, advertising materials, and information about discounts and promotions (advertising and commercial purposes).

- Analyzing the preferences of Personal Data Subjects to improve the quality of services provided and to develop new products.

- Organizing and conducting research, surveys, and statistical analysis.

- Fulfilling contractual obligations to the Personal Data Subject.

- Ensuring compliance with the requirements of the legislation of the Russian Federation.

- Considering appeals, requests, and complaints of Personal Data Subjects.

5. Procedure and Conditions for Personal Data Processing

5.1. Personal data processing is carried out both with and without the use of automation tools.

5.2. Personal data are collected in the following ways:

- Provision of personal data by the Personal Data Subject through feedback forms on the Website, upon registration for Company events, or upon subscription to informational newsletters.

- Obtaining personal data from third parties (for example, the Company’s partners), subject to the consent of the Personal Data Subject or the existence of another lawful basis.

- Automatic collection of data when visiting the Website (for example, IP address, cookie data), as described in the Company’s Cookie Policy.

- By other means not contrary to the legislation of the Russian Federation, including through personal contact, by telephone, and via paper media.

5.3. Transfer of personal data to third parties: The Company is entitled to transfer personal data of Personal Data Subjects to third parties in the following cases:

- With the consent of the Personal Data Subject.

- If the transfer is necessary for the performance of the Company’s contractual obligations to the Personal Data Subject.

- To achieve the purposes specified in Section 4 of this Policy, provided that third parties observe the confidentiality of personal data and that relevant agreements are concluded. Such third parties may include:

-- Service providers (for example, mailing services, CRM systems, hosting providers, analytics platforms).

-- Partners of the Company participating in the provision of services or products to the Personal Data Subject.

-- Advertising agencies and platforms for conducting targeted advertising campaigns.

- Upon request of authorized state bodies in cases provided for by the legislation of the Russian Federation.

- In other cases provided for by the legislation of the Russian Federation.

5.4. Cross-border transfer of personal data (transfer of personal data to the territory of a foreign state) is carried out subject to ensuring adequate protection of the rights of personal data subjects by the relevant foreign state.

6. Personal Data Retention Periods

Personal data are stored by the Company for the period necessary to achieve the declared purposes of processing, but no longer than the periods established by the applicable legislation of the Russian Federation. Upon achievement of the purposes of processing or upon expiration of the retention period, as well as in the event of withdrawal of consent to personal data processing (unless otherwise provided by law), personal data are destroyed or anonymized.

7. Rights of the Personal Data Subject

The Personal Data Subject has the right:

- To obtain information relating to the processing of their personal data, except in cases provided for by federal laws.

- To clarification of their personal data, their blocking or destruction if the personal data are incomplete, outdated, inaccurate, unlawfully obtained, or are not necessary for the declared purpose of processing.

- To withdraw consent to personal data processing. Withdrawal of consent is effected by sending a corresponding written application to the Company’s address or to the email address indicated on the Website. In the event of withdrawal of consent to personal data processing, the Company ceases their processing and destroys the personal data within a period not exceeding 30 days from the date of receipt of said withdrawal, unless otherwise provided by federal law.

- To appeal the actions or inaction of the Operator to the authorized body for the protection of the rights of personal data subjects or in court.

8. Measures to Ensure the Security of Personal Data

The Company takes necessary legal, organizational, and technical measures to protect personal data from unlawful or accidental access, destruction, modification, blocking, copying, provision, dissemination, and other unlawful actions with respect to personal data.

9. Final Provisions

9.1. This Policy is a publicly available document and is posted on the Company’s Website.

9.2. The Company reserves the right to make changes to this Policy. When changes are made, the date of the last update is indicated in the Policy heading. The new version of the Policy takes effect from the moment it is posted on the Website, unless otherwise provided by the new version of the Policy.

9.3. Oversight of compliance with the requirements of the legislation of the Russian Federation on personal data is assigned to the person responsible for organizing personal data processing in the Company.

9.4. All suggestions, questions, and requests relating to this Policy or personal data processing should be sent to the email address indicated on the Company’s Website.

Date of last update: September 29, 2025.