Appendix 2 to the Public Offer Agreement

Procedure for Handling Requests from Government Authorities and Authorized Third Parties

1. General Provisions and Principles

This Procedure establishes the conditions and processes under which the Platform (Marketplace) responds to requests for user information and activity records received from:

• law enforcement agencies,
• courts,
• other governmental or municipal bodies (hereinafter "Government Authorities"),
• as well as third-party representatives acting under lawful procedures (e.g., attorney inquiries, civil or arbitration proceedings supported by a court order).

The Platform is committed to:

• safeguarding the confidentiality of user data and the right to privacy,
• complying with applicable laws and cooperating with Government Authorities as required.

Core Principles:

• Legality — data is disclosed only where a valid legal basis exists.
• Necessity and Proportionality — disclosure is limited strictly to what is required by the request.
• Data Protection — the Platform takes measures to avoid excessive disclosure.

2. Grounds for Disclosure

The Platform may disclose information only under one of the following legal bases:

1. Official request from a Government Authority, issued in accordance with applicable law, including:
   • court orders, warrants, or rulings;
   • requests from investigative or prosecutorial bodies in connection with an initiated case or pre-investigation review;
   • requests from other competent agencies (e.g., tax, antitrust) acting within their statutory authority.
2. Emergency circumstances involving an imminent threat to the life or serious health risk of a User, Platform employee, or third party. In such cases:
   • only the minimum necessary data will be disclosed;
   • a formalized request from the competent authority must follow.
3. Voluntary user consent, provided in written or electronic form.
4. Compliance with AML/CFT regulations (anti-money laundering and counter-terrorism financing), where applicable.

3. Request Handling Procedure

1. Form and Content of Requests

Requests must be:

• submitted in writing on the official letterhead of the requesting authority, or
• in electronic form from an official domain, with the original document provided upon request.

Each request must specify:

• the name of the requesting authority,
• the legal basis (statutory provision, procedural status, or other authority),
• the purpose of the request,
• the specific information sought (e.g., usernames, IP addresses, communications, activity logs),
• the deadline for response,
• contact details of the requesting official.

2. Review by the Platform

The Platform will verify:

• compliance of the request with applicable law,
• existence of valid legal grounds,
• authority of the signatory,
• clarity and scope of the requested data.

The Platform may:

• refuse to disclose information if the request is non-compliant,
• seek clarifications or corrections,
• postpone execution pending legal review.

3. Response Timeframes

The Platform will endeavor to comply within the specified deadline. If no deadline is indicated, the Platform will respond within a reasonable period, normally not exceeding 10 business days.

4. User Notification

Unless prohibited by law, the Platform may notify the User of the request and any disclosure of their data. Notification may be delayed or withheld if:

• a legal prohibition applies (e.g., in criminal proceedings),
• disclosure risks compromising evidence or interfering with an investigation.

4. International Requests

The Platform may process and respond to requests from foreign authorities subject to the following conditions:

• existence of an international treaty or agreement between the requesting country and the Platform’s jurisdiction,
• submission of an official translation into Russian (or another legally required language),
• legal validity and compliance with both international and domestic law,
• in exceptional emergency cases (e.g., imminent threats to life or health), preliminary action may be taken before full formalities are completed, followed by proper official processing.

5. Restrictions and Refusals

The Platform reserves the right to refuse disclosure if:

• the request fails to meet formal requirements, lacks mandatory details, or is submitted by an unauthorized party;
• no legal grounds exist, or statutory procedure has been violated;
• the scope of requested data is disproportionate to the stated purpose;
• the request infringes on Users’ rights and freedoms (e.g., absence of a mandatory court order);
• authenticity or reliability of the request is in doubt.

6. Record-Keeping and Storage

All requests and related actions are logged and stored in an encrypted system, including:

• date and time of receipt,
• sender information,
• request content and legal grounds,
• details of disclosed data,
• responsible employee,
• reasons for refusal (if applicable).

7. Final Provisions

This Procedure applies to all Platform Users, regardless of nationality or location.

The Platform may unilaterally amend this document.

All updates will be published publicly, and continued use of the Platform constitutes acceptance of such updates.