Acceptable Use Policy

Shop Operator: FIRSTSTONE TRADING spółka z ograniczoną odpowiedzialnością (FIRSTSTONE TRADING sp. z o.o.) KRS: 0001254766 | NIP: 7831958614 Registry court: District Court Poznań – Nowe Miasto i Wilda in Poznań, 8th Commercial Division of the National Court Register Date of registration: 17 February 2026 Registered office (as per KRS): ul. Wierzbięcice 44A/40A, 61-568 Poznań, województwo wielkopolskie Voivodeship Correspondence address / Shop support: ul. Wierzbięcice 44A/40A, 61-568 Poznań (100 shares of PLN 50.00 each) Representation: Krystian Dawidowski — Member of the Management Board (sole management board, independent representation) Address for electronic deliveries (ADE): AE:PL-21312-60691-FGBFV-19 E-mail (compliance / breach reports): compliance@purepoint.pl E-mail (Shop support): contact@purepoint.pl Domain: purepoint.pl

Document version: 2.0 Effective date: 6 June 2026

---

Table of contents

1. § 1. Purpose of the Policy and legal status
2. § 2. Definitions
3. § 3. Subjective and objective scope
4. § 4. Absolute prohibitions
5. § 5. Compliance monitoring procedure
6. § 6. Block procedure (Tier 1 / Tier 2 / Tier 3)
7. § 7. Financial consequences of breaches
8. § 8. Reporting breaches by third parties
9. § 9. Cooperation with public authorities
10. § 10. Final provisions
11. § 11. Bibliography and sources of law
12. § 12. Change history
13. Closing clause

---

§ 1. Purpose of the Policy and legal status

1. The Acceptable Use Policy (hereinafter: AUP or the Policy) sets out the catalogue of conduct that is unacceptable when using the Shop operated under the domain purepoint.pl, the procedure for monitoring breaches, the account block procedure and the manner of cooperation between the Operator and State authorities.
2. The AUP forms an integral part of the Operator’s regulatory documentation and is applied jointly with the Shop Terms and Conditions, the Privacy Policy, the Cookies Policy and the other policies in force in the Shop. In the event of a conflict, mandatory provisions of Polish law and European Union law take precedence, followed by the Shop Terms and Conditions, and thereafter this Policy.
3. This Policy implements the Operator’s obligations arising from: a) the Act of 18 July 2002 on the provision of services by electronic means (consolidated text: Journal of Laws 2020 item 344, as amended) — hereinafter the UŚUDE; b) Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a single market for digital services — the Digital Services Act (DSA); c) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (hereinafter: the GDPR); d) the Act of 6 September 2001 — the Pharmaceutical Law (consolidated text: Journal of Laws 2025 item 750, previously Journal of Laws 2024 item 686, as amended) — hereinafter the PF; e) the Act of 6 June 1997 — the Penal Code (consolidated text: Journal of Laws 2024 item 17, as amended) [VERIFY current publication reference] — hereinafter the KK; f) the Act of 23 April 1964 — the Civil Code (consolidated text: Journal of Laws 2024 item 1061, as amended) — hereinafter the KC.
4. The Shop is intended exclusively for Qualified Buyers (see § 2 para. 4). Consumers within the meaning of Art. 22(1) KC are excluded from the possibility of concluding agreements in the Shop.

§ 2. Definitions

1. Operator — FIRSTSTONE TRADING sp. z o.o. with its registered office in Poznań (KRS 0001254766), operating the Shop under the domain purepoint.pl.
2. Shop — the online shop operating at the address purepoint.pl, run by the Operator and intended exclusively for Qualified Buyers.
3. Buyer — a natural person with full legal capacity, a legal person or an organisational unit without legal personality to which the law grants legal capacity, using the Shop.
4. Qualified Buyer — a Buyer who has submitted a positively verified Qualified Profile Declaration (KOP), purchasing Products for a purpose connected with business, professional, research or academic activity (Art. 43(1) KC), excluding consumer status (Art. 22(1) KC). A Qualified Buyer belongs to one of five categories: STUDENT, LAB, SCIENTIST, BIZ_RD, OTHER_PRO.
5. KOP — Qualified Profile Declaration — a set of five compliance declarations, a category declaration and supplementary data, constituting a necessary condition for using the Shop.
6. Products / Research Materials — peptides and other compounds offered in the Shop exclusively for in vitro laboratory research purposes, not intended for use in humans or animals, and not being a medicinal product, dietary supplement, medical device or cosmetic.
7. Account — an individual Buyer profile in the Shop, linked to a verified KOP, an e-mail address and a transaction history.
8. Breach — any conduct of a Buyer or a third party acting on the Buyer’s behalf that is contrary to § 4 of this Policy, the Shop Terms and Conditions or generally applicable provisions of law.
9. Tier — the level of the Operator’s response to a Breach (Tier 1 / Tier 2 / Tier 3 — see § 6).
10. AML — counteracting money laundering and the financing of terrorism, within the meaning of the Act of 1 March 2018 on counteracting money laundering and the financing of terrorism (consolidated text: Journal of Laws [VERIFY — inconsistency of the publication reference between v2 documents: 2024 item 197 / 2025 item 124 / 2025 item 419]).

§ 3. Subjective and objective scope

1. The AUP binds every Buyer and every person obtaining access to the Shop in any manner — including a person merely browsing the public resources of purepoint.pl, using the contact forms, the newsletter or the order support panel.
2. The AUP covers all layers of interaction with the Shop: registration, the KOP, the placing of orders, payment, e-mail and messenger communication, the use of the Operator’s network infrastructure, content published by the Buyer and all feedback channels (reviews, complaint submissions, contact forms).
3. Acceptance of the AUP takes place through the creation of an Account, the placing of an order or the actual use of the Shop. Failure to accept the AUP excludes the right to use the Operator’s services.

§ 4. Absolute prohibitions

The Buyer undertakes to refrain from any of the conduct listed below. The catalogue is open-ended — any other conduct contrary to law, good morals or undermining the security of the Shop is also subject to sanctions.

1. Making false declarations within the KOP — including providing untrue information about professional status, the Qualified Buyer category (STUDENT, LAB, SCIENTIST, BIZ_RD, OTHER_PRO), the field of study, the laboratory’s NIP number, the ORCID identifier or the PKD scope of research and development activity (74.10.Z / 72.11.Z / 72.19.Z / 72.20.Z / 21.20.Z). Submitting a false declaration gives rise to criminal liability under Art. 233 § 1 KK (imprisonment from 6 months to 8 years) and liability in damages under Art. 471 KC.
2. Resale of Products to unauthorised persons — resale, gift, lending, barter exchange or any other transfer of Products to persons who are not Qualified Buyers, in particular to consumers within the meaning of Art. 22(1) KC, as well as any placing of Products into retail circulation.
3. Use of Products in humans or animals — using Products in any manner other than in vitro laboratory research, in particular: administering them to oneself or to other persons, administering them to animals, and any other application to a human or animal organism. Research Materials are intended exclusively for in vitro laboratory research and have not been approved for use in humans or animals.
4. Advertising Products as medicinal products, dietary supplements, medical devices or cosmetics — suggesting in any content (reviews, social media posts, correspondence, forms, comments) that the Products treat, alleviate, diagnose or prevent any disease. Such conduct constitutes a breach of Art. 124 para. 1 PF: “whoever, without the required authorisation, places a medicinal product on the market shall be subject to a fine, the penalty of restriction of liberty or imprisonment for up to 2 years”.
5. Using the trademarks of pharmaceutical brands in consumer-facing content — in particular the use of registered trade names of preparations (e.g. Ozempic®, Wegovy®, Mounjaro®, Zepbound®, Saxenda® and others) in a manner suggesting that the Product is identical to the original medicine, infringing Art. 9 of Regulation (EU) 2017/1001 of the European Parliament and of the Council of 14 June 2017 on the European Union trade mark and the national provisions on combating unfair competition (the Act of 16 April 1993, Journal of Laws 2022 item 1233, as amended).
6. Circumventing the geo-block and the age-gate — the Shop does not provide services to users from territories subject to international sanctions (RU, BY, IR, KP, SY, CU, VE, MM) or to persons under 21 years of age (the Operator voluntarily applies a 21+ threshold, higher than the statutory minimum of 18 years — see the Compliance Notice § 7). Attempts to circumvent the above restrictions (e.g. using a VPN, a false age declaration, a false shipping address) are prohibited.
7. Creating multiple accounts in order to circumvent AML limits — the Operator applies control thresholds of EUR 5,000 / EUR 15,000 / EUR 50,000 (proactively, even though the Operator is not an obligated institution within the meaning of the AML Act). It is prohibited to register parallel Accounts or to use the data of front persons or false entities in order to fragment transactions.
8. Data manipulation in the checkout process — falsifying the surname, address, NIP, price, quantity or other order parameters, including manipulation of coupons, discount codes, the cart value or tax status (e.g. zeroing out VAT).
9. Using stolen payment cards or unauthorised payment methods — including third-party cards without their consent, payment instruments derived from phishing, data breaches or other crimes. The breach gives rise to criminal liability under Art. 287 KK and Art. 286 KK (fraud).
10. Chargeback in bad faith — initiating a chargeback procedure with the payment operator in a situation where the Product was duly delivered in accordance with the order, with the aim of simultaneously retaining the Product and recovering the funds. This constitutes fraud (Art. 286 KK) and a breach of contract within the meaning of Art. 471 KC.
11. SQL injection, XSS and other attacks on the application layer — entering into forms, URL parameters or HTTP headers sequences intended to manipulate the database, execute foreign script in another Buyer’s browser or escalate privileges. This constitutes an offence under Art. 267 KK (unauthorised access to information), Art. 268a KK (disruption of system operation) and Art. 269b KK.
12. DDoS and other attacks on availability — in particular Distributed Denial of Service attacks, brute-force attacks on the login panel, form-flooding scenarios, attempts to exhaust the resources of the hosting infrastructure of cyber_Folks S.A. or the Operator’s partners. Breach of Art. 268a KK.
13. Reverse engineering — recovering the source code of the Shop application, decompilation, disassembly, analysis of the Operator’s internal protocols or generating one’s own copies of the infrastructure, with the exception of the strictly defined cases of interoperability under Art. 75 para. 2 and 3 of the Act of 4 February 1994 on copyright and related rights (consolidated text: Journal of Laws 2025 item 24).
14. Automated scraping — downloading the Shop’s content using bots, scrapers, crawlers or other automated tools without the Operator’s express consent, in particular for the purpose of mass copying of Product descriptions, prices, specification cards or the educational content database. The robots.txt files and the HTTP headers define the scope of permitted automated traffic.
15. Newsletter spam — using the newsletter sign-up form to add third parties without their consent, to test the capacity of mailing lists, to bombard mailboxes (email bombing) or for other conduct breaching Art. 10 UŚUDE and Art. 172 of the Act of 16 July 2004 — the Telecommunications Law (consolidated text: Journal of Laws 2024 item 34, as amended).
16. Other prohibitions — conduct contrary to good morals, impersonation, inducing the Operator’s staff to act in breach of procedures, attempts to manipulate the KOP verification process, the use of stolen identity documents, false ORCIDs, false student IDs or false employment certificates from research institutions.

§ 5. Compliance monitoring procedure

1. The Operator carries out ongoing monitoring of compliance in the use of the Shop, covering: a) logins and login attempts to the Account (analysis of IP addresses, device fingerprints, geolocation); b) checkout behaviour (quantity anomalies, order fragmentation, unusual shipping patterns); c) content submitted by Buyers (contact forms, complaints, comments); d) network traffic (SQL injection attempts, XSS, brute force, scraping); e) AML thresholds (exceeding EUR 5,000, EUR 15,000, EUR 50,000).
2. Monitoring is carried out on the basis of Art. 6 para. 1 point (f) GDPR (the Operator’s legitimate interest in ensuring the security of the Shop, combating abuse and protecting the rights of third parties) and on the basis of the obligations arising from the UŚUDE, the DSA and the PF.
3. Analytics of internal traffic is conducted using Plausible Insights OÜ (Tallinn, Estonia), in accordance with the Privacy Policy — without cookies, without user profiling, within the EEA, which eliminates the Schrems II risk.
4. The Operator does not appoint a Data Protection Officer — there is no such obligation in light of Art. 37 para. 1 GDPR. Matters relating to the protection of personal data should be directed to compliance@purepoint.pl.
5. The Operator uses rule-based tools and selected machine learning mechanisms solely for the purpose of detecting statistical anomalies. Each automated detection is subject to manual verification before the procedure under § 6 is initiated.

§ 6. Block procedure (Tier 1 / Tier 2 / Tier 3)

1. Depending on the gravity of the Breach, the Operator applies a three-stage response procedure. Each escalation of the tier requires a decision of the Operator preceded by an assessment of the evidence.

2. Tier 1 — Warning and education: a) applies to Breaches of low gravity (e.g. an incomplete KOP verification, a single inappropriate phrasing in correspondence, minor formal infringements); b) the Operator sends to the e-mail address associated with the Account a message containing a description of the Breach, an indication of the breached §§ of the AUP and a demand to remedy the deficiency within 7 days; c) effective remedy of the deficiency concludes the proceedings without further consequences; d) Tier 1 does not deprive the Operator of the right to escalate the tier in the event of a repetition of the same Breach within a period of 12 months.

3. Tier 2 — Suspension of the Account for 30 days: a) applies to Breaches of medium gravity (e.g. an attempt to circumvent the geo-block, repeated failed KOP submissions, discount abuse, single marketing content non-compliant with the PF, suspicion of creating a second Account); b) the Operator suspends the Account for a period of 30 calendar days, blocking the ability to place new orders, use the support panel and conduct commercial communication; c) the Buyer receives the justification for the block within 24 hours of its application, together with information on the appeal procedure — an appeal may be lodged at compliance@purepoint.pl within 14 days; d) after the lapse of 30 days the Account is restored provided that there are no further Breaches. In the event of a repetition of the Breach, the procedure escalates to Tier 3.

4. Tier 3 — Permanent block and reporting to the authorities: a) applies to serious Breaches (false KOP declarations, the use of stolen cards, chargeback in bad faith, attacks on the infrastructure, advertising Products as medicines/supplements/cosmetics, administering Products to humans or animals, attempts to resell to consumers, organised networks for registering multiple Accounts); b) the Operator permanently blocks the Account and all linked Accounts (analysis of IP addresses, devices, payment instruments, address data); c) the Operator retains the complete evidentiary data for the period provided for by law (Art. 19 para. 2 UŚUDE — a minimum of 12 months; Art. 74 of the Act of 29 September 1994 on accounting — 5 years for accounting documentation, Journal of Laws 2024 item 619); d) in justified situations the Operator reports the Breach to the law enforcement authorities (Police, Public Prosecutor’s Office), the regulatory authorities (the Chief Pharmaceutical Inspectorate — GIF, the President of the Office for Registration of Medicinal Products, Medical Devices and Biocidal Products — URPL, the General Inspector of Financial Information — GIIF for AML matters, the President of the Personal Data Protection Office — UODO for GDPR breaches); e) an appeal against a Tier 3 decision lies solely through the courts.

5. The Operator reserves the right to apply Tier 3 by skipping the lower tiers in the case of Breaches that pose a direct risk to the health of third parties, the security of the Shop, or that infringe criminal provisions.

§ 7. Financial consequences of breaches

1. No refund of funds: in the event of a Breach that results in the application of Tier 2 or Tier 3, the Buyer loses the right to demand a refund of funds for orders that have been paid for but not yet fulfilled — with the exception of amounts corresponding to the Operator’s claims arising from the logistical, handling and operational costs incurred. The remaining portion of the funds is subject to retention on account of compensation (Art. 471 KC).
2. Pursuing claims for damages: the Operator retains the right to pursue from the Buyer full compensation on general principles (Art. 471 KC et seq.), including claims for reimbursement of the costs of the complaint proceedings, legal service costs, chargeback dispute costs (representment fee), security audit costs, and the costs of supplementary compliance peer-review.
3. Contractual penalty for particular abuses: in the event of a finding of a false KOP declaration, the resale of Products to consumers or the use of the trademarks of pharmaceutical brands in consumer-facing content, the Operator retains the right to impose a contractual penalty amounting to five times the value of the order affected by the Breach, while retaining the right to pursue supplementary compensation.
4. Cap on the Operator’s liability: the Operator’s liability towards a Qualified Buyer in B2B transactions (Art. 43(1) KC) is limited to the value of the order plus the cost of shipping. Liability under the warranty for defects (Art. 558 § 1 KC) is excluded. The limitation does not cover situations of the Operator’s wilful misconduct or breaches of mandatory provisions of law.

§ 8. Reporting breaches by third parties

1. The Operator provides a reporting channel for third parties who have observed Breaches on the part of Buyers or in the Shop’s infrastructure. Reports should be directed to the address compliance@purepoint.pl.
2. The report should contain: a) a brief description of the Breach; b) an indication of the suspected Account, URL address, content or other identifier; c) the date and time the Breach was observed; d) the contact details of the person submitting the report (optional — the Operator accepts anonymous reports if they contain sufficient evidentiary material); e) any evidentiary documentation (screenshots, links, logs).
3. The Operator confirms receipt of the report within 72 working hours. Analysis of the report is conducted in accordance with the DSA and this Policy.
4. The person submitting the report receives information on how the report was handled. The Operator does not disclose the personal data of the Buyer who is the subject of the report, unless a legal order provides otherwise.
5. In accordance with Art. 16 para. 6 DSA, the Operator introduces additional safeguards against abuse of the reporting channel (false reports made in bad faith, attempts to silence competitors, defamation). Repeated abuse may result in restriction of the reporting person’s access to the channel.

§ 9. Cooperation with public authorities

1. The Operator cooperates with public authorities to the extent arising from the provisions of law, in particular with: a) the Police and the Public Prosecutor’s Office — in matters concerning criminal offences (Art. 124 PF, Art. 233 KK, Art. 286 KK, Art. 287 KK, Art. 267–269b KK); b) the Chief Pharmaceutical Inspectorate (GIF) and the President of URPL — in respect of breaches of the Pharmaceutical Law, including the illegal placing of medicinal products on the market; c) the General Inspector of Financial Information (GIIF) — in matters concerning counteracting money laundering and the financing of terrorism (even though the Operator is not an obligated institution, it applies proactive thresholds of EUR 5,000 / 15,000 / 50,000); d) the President of the Personal Data Protection Office (UODO) — in matters concerning the GDPR, including the reporting of personal data breaches within 72 hours (Art. 33 para. 1 GDPR); e) the National Revenue Administration (KAS) — in respect of tax documentation and SAF-T reporting; f) the National Computer Security Incident Response Team (CERT Polska / CSIRT NASK) — in respect of cyber incidents.
2. The Operator makes data available to the authorities on the basis of requests compliant with Art. 18 para. 6 UŚUDE and Art. 9–10 DSA, to an extent no broader than necessary. Each request is assessed for formal correctness and legal basis.
3. The Operator reserves the right to inform the Buyer of the transfer of their data to the authorities, unless the law precludes such information (e.g. Art. 156a § 2 KK in the course of criminal proceedings, confidentiality clauses).
4. In the event of an order to secure content or block an Account, the Operator performs the obligation without undue delay, retaining complete documentation of such an operation.

§ 10. Final provisions

1. The AUP enters into force on 6 June 2026 and replaces all earlier versions of the acceptable use policy published by the Operator.
2. The Operator may update the AUP on a quarterly cycle or as a result of legal changes. The new version is published on the website purepoint.pl/akceptowalne-uzytkowanie/ with 14 days’ advance notice. Use of the Shop after the new version enters into force constitutes acceptance thereof.
3. The governing law is Polish law. The court competent for disputes is the common court having local jurisdiction over the Operator’s registered office, subject to the mandatory provisions of Regulation (EU) No 1215/2012 (Brussels I bis) and Regulation (EC) No 593/2008 (Rome I).
4. Severability clause: the invalidity or unenforceability of any provision of the AUP does not affect the validity of the remaining provisions.
5. Telephone contact is available to Buyers holding an Account in the order support panel and on request at compliance@purepoint.pl.

§ 11. Bibliography and sources of law

1. The Act of 23 April 1964 — the Civil Code (consolidated text: Journal of Laws 2024 item 1061, as amended).
2. The Act of 6 June 1997 — the Penal Code (consolidated text: Journal of Laws 2024 item 17, as amended) [VERIFY current publication reference].
3. The Act of 6 September 2001 — the Pharmaceutical Law (consolidated text: Journal of Laws 2025 item 750, previously Journal of Laws 2024 item 686, as amended).
4. The Act of 18 July 2002 on the provision of services by electronic means (consolidated text: Journal of Laws 2020 item 344, as amended).
5. The Act of 1 March 2018 on counteracting money laundering and the financing of terrorism (consolidated text: Journal of Laws [VERIFY — inconsistency of the publication reference between v2 documents: 2024 item 197 / 2025 item 124 / 2025 item 419]).
6. The Act of 4 February 1994 on copyright and related rights (consolidated text: Journal of Laws 2025 item 24).
7. The Act of 16 July 2004 — the Telecommunications Law (consolidated text: Journal of Laws 2024 item 34, as amended).
8. The Act of 16 April 1993 on combating unfair competition (consolidated text: Journal of Laws 2022 item 1233, as amended).
9. The Act of 29 September 1994 on accounting (consolidated text: Journal of Laws 2024 item 619).
10. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR).
11. Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 (DSA).
12. Regulation (EU) 2017/1001 of the European Parliament and of the Council of 14 June 2017 on the European Union trade mark.
13. Regulation (EU) No 1215/2012 on jurisdiction (Brussels I bis).
14. Regulation (EC) No 593/2008 on the law applicable to contractual obligations (Rome I).
15. Decision of the President of UODO 02/2025 concerning the cookie banner (administrative fine of EUR 420,000 — symmetry of the Accept / Reject / Customise options).

§ 12. Change history

Version	Date	Author	Scope of changes
1.0	2026-05-22 / 2026-05-24	Compliance FIRSTSTONE TRADING	First public version of the AUP. Basic catalogue of prohibitions (10 items). Single level of blocking. No references to the KOP and the Qualified Buyer. No procedural division into 3 tiers. Single references to the PF with an erroneous penalty description (“6 months to 8 years + PLN 5 million”).
2.0	2026-06-06	Compliance FIRSTSTONE TRADING	Full rebuild on the “Qualified Buyer” foundation. Erratum to Art. 124 PF (correct: fine / restriction of liberty / imprisonment for up to 2 years). Three-stage block procedure (Tier 1 / 2 / 3). Section on monitoring and Plausible. Section on the reporting of breaches by third parties in accordance with Art. 16 DSA. Section on cooperation with the authorities (GIF, URPL, GIIF, UODO, KAS, CSIRT NASK). Expanded catalogue of prohibitions (16 items). Financial clauses (B2B cap, no warranty for defects, contractual penalty). Bibliography with full Journal of Laws references. Closing clause.

---

Closing clause

In the scope not regulated by this document, the mandatory provisions of Polish law and European Union law apply. In the event of interpretative doubts, please contact compliance@purepoint.pl.