Legal document

Compliance Notice

Operator: FIRSTSTONE TRADING sp. z o.o.
Version: 2.0
Effective date: 2026-06-06
Last updated: 2026-08-09
Language: Polish
Legal contact: compliance@purepoint.pl

Store Operator: FIRSTSTONE TRADING spółka z ograniczoną odpowiedzialnością (FIRSTSTONE TRADING sp. z o.o.) KRS number: 0001254766 | NIP: 7831958614 Registry court: District Court Poznań – Nowe Miasto i Wilda in Poznań, 8th Commercial Division of the National Court Register (KRS) Date of entry in the register: 17 February 2026 Registered office (as per KRS): ul. Wierzbięcice 44A/40A, 61-568 Poznań, województwo wielkopolskie Voivodeship Correspondence address / address for Store service matters: ul. Wierzbięcice 44A/40A, 61-568 Poznań (100 shares of PLN 50.00 each; fully paid up) Representation: Krystian Dawidowski — Member of the Management Board (sole-director management board, independent representation) E-mail address for legal and compliance matters: compliance@purepoint.pl Store e-mail address: contact@purepoint.pl Registry / invoicing e-mail address: k2benterprise.biz@gmail.com e-Delivery address (ADE): AE:PL-21312-60691-FGBFV-19 Store domain: purepoint.pl

Document version: 2.0 Effective date: 6 June 2026 Review cycle: quarterly (next: 6 September 2026)

Telephone contact is available to Buyers holding an active account in the order management panel (the “Help” tab) and on request at compliance@purepoint.pl. The Operator deliberately does not publish a general telephone number, in order to redirect all compliance-sensitive enquiries to a written channel in which proper identification of the caller and an audit trail can be ensured.

Purpose and addressees of the document
Legal nature of the Operator’s activity
Classification of products and legal bases
Regulatory obligations and implemented mechanisms 4.1. REACH (Regulation 1907/2006) 4.2. CLP (Regulation 1272/2008) 4.3. GDPR (RODO) (Regulation 2016/679) and the national Data Protection Act (UODO) 4.4. Anti-money laundering (AML) 4.5. Tax obligations (CIT, VAT, KSeF) 4.6. Professional sport, the WADA code and exclusions
Requirements for the Buyer (Qualified Buyer, KOP, resale prohibition)
Article 124 para. 1 of the Act — Pharmaceutical Law — critical erratum
Compliance mechanisms built into the Store
Cooperation with State authorities
Ethics, transparency and the prohibition of human-use marketing
Reporting irregularities (whistleblowing)
Document amendment procedure
Normative bibliography and authority communications
Change history
Final clause

§ 1. Purpose and addressees of the document

This Compliance Notice (hereinafter: the Compliance Statement or the Document) constitutes a formal declaration by FIRSTSTONE TRADING sp. z o.o. (hereinafter: the Operator) describing the legal nature of the activity conducted within the purepoint.pl Store (hereinafter: the Store), the catalogue of regulatory obligations to which the Operator is in fact subject, and the compliance mechanisms implemented at the organisational and technical level of the Store.
The Document is addressed in particular to:
State and local government authorities: the Chief Pharmaceutical Inspector (hereinafter: GIF), the Voivodeship Pharmaceutical Inspectors, the Office for Personal Data Protection (hereinafter: UODO), the President of the Office of Competition and Consumer Protection (hereinafter: UOKiK), the Chief Sanitary Inspector (hereinafter: GIS), the National Revenue Administration (hereinafter: KAS), the General Inspector of Financial Information (hereinafter: GIIF), the National Police Headquarters, the public prosecutor’s office, the customs authorities and the European Chemicals Agency (hereinafter: ECHA);
payment and technology partners: Stripe Payments Europe Limited (Dublin, Ireland), cyber_Folks S.A. (hosting), Plausible Insights OÜ (Tallinn, Estonia) — analytics, Sendinblue SAS (Paris, France) operating under the Brevo brand — newsletter;
potential Qualified Buyers interested in verifying the Operator’s legal status before establishing cooperation;
financial institutions, insurers, legal advisers, statutory auditors and the banks servicing the Operator.
The Operator publishes this Document in order to ensure full transparency of the activity conducted and in order to avoid any interpretative doubts as to its legal classification. The Document does not replace the Store Terms and Conditions, the Privacy Policy or the Cookies Policy — it supplements them with a regulatory layer.
Any questions directed by authorities, partners or Qualified Buyers in the area of compliance should be addressed in writing to compliance@purepoint.pl, with a note in the subject line indicating the enquiring party (e.g. “GIF enquiry”, “UODO enquiry”, “KYC payment partner”).

§ 2. Legal nature of the Operator’s activity

The Operator conducts business activity consisting in the sale of Research Materials (Products) in the form of chemical substances dedicated exclusively to in vitro laboratory, educational and research-and-development applications. The Store does not serve consumers within the meaning of Art. 22(1) of the Act of 23 April 1964 — Polish Civil Code (consolidated text: Journal of Laws 2024 item 1061, as amended; hereinafter: the CC) and is reserved exclusively for Qualified Buyers within the meaning of the Store Terms and Conditions.
The Operator declares and confirms the following catalogue of negative qualifications — i.e. it lists the legal statuses that the Operator does not hold, indicating the legal basis for the exclusion:

2.1. The Operator DOES NOT operate a pharmaceutical wholesaler within the meaning of Art. 72 et seq. of the Act of 6 September 2001 — Pharmaceutical Law (consolidated text: Journal of Laws 2025 item 750, previously Journal of Laws 2024 item 686, as amended; hereinafter: PF). The Operator does not trade in medicinal products, does not place them on the market, and does not provide distribution, storage or transport services for medicinal products. Consequently, it does not require a permit to operate a wholesaler, as referred to in Art. 74 para. 1 PF.

2.2. The Operator DOES NOT operate a pharmacy or a pharmacy outlet within the meaning of Chapter 7 PF. The Operator does not provide pharmaceutical services within the meaning of Art. 86 PF, does not dispense medicinal products or medical devices to patients, does not fill medical prescriptions, and does not prepare compounded or pharmacy-made medicines. Consequently, it does not require a permit to operate a general public pharmacy.

2.3. The Operator IS NOT a manufacturer of medicinal products within the meaning of Art. 38 PF and does not hold a manufacturing or import permit as referred to in Art. 38 para. 1 PF. The Operator does not manufacture, process or package medicinal products or active substances (API) for the purposes of medicine production.

2.4. The Operator IS NOT a responsible entity for a medicinal product within the meaning of Art. 2 point 24 PF — it holds no marketing authorisation for a medicinal product issued by the President of the Office for Registration of Medicinal Products, Medical Devices and Biocidal Products (URPL), by the European Commission under the centralised procedure, or under the decentralised or mutual-recognition procedures.

2.5. The Operator IS NOT a distributor of medical devices within the meaning of Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices (hereinafter: MDR) and has not been registered in the EUDAMED database as an economic operator. The Store does not offer medical devices of any class.

2.6. The Operator IS NOT an entity supplying cosmetic products within the meaning of Regulation (EC) No 1223/2009 of the European Parliament and of the Council of 30 November 2009 on cosmetic products. The substances available in the Store are not cosmetic products and are not intended for contact with the surface of the human body.

2.7. The Operator IS NOT a food business operator within the meaning of Regulation (EC) No 178/2002 of the European Parliament and of the Council of 28 January 2002 laying down the general principles and requirements of food law. Research Materials are neither foodstuffs nor dietary supplements.

2.8. The Operator DOES NOT place biocidal products on the market within the meaning of Regulation (EU) No 528/2012 of the European Parliament and of the Council of 22 May 2012 concerning the making available on the market and use of biocidal products. Research Materials are not intended for combating harmful organisms.

2.9. The Operator IS NOT a bank, a credit institution, a payment institution, a national payment institution, an electronic money institution or a payment services bureau within the meaning of the Act of 19 August 2011 on payment services. The Operator uses payment services provided by Stripe Payments Europe Limited, established in Dublin (Ireland), which is an electronic money institution authorised by the Central Bank of Ireland.

2.10. The Operator IS NOT an obliged institution within the meaning of Art. 2 para. 1 of the Act of 1 March 2018 on counteracting money laundering and the financing of terrorism (consolidated text: Journal of Laws 2025 item 124; hereinafter: the AML Act). The Operator does not conduct activity listed in the catalogue of obliged institutions — it does not provide financial services or real estate intermediation, and does not trade in precious metals or luxury goods within the meaning of the Act. In particular, the Operator is not “an entrepreneur within the meaning of the Act of 6 March 2018 — Entrepreneurs’ Law who accepts or makes payments for goods in cash with a value equal to or exceeding EUR 10,000”, because the Store essentially does not handle cash payments.

Despite the absence of obliged-institution status, the Operator has implemented proactive, internal mechanisms consistent with the spirit of the AML Act — described in detail in § 4 para. 4 of the Document. These mechanisms serve to protect the integrity of the Store, to detect abuse attempts at an early stage and to facilitate cooperation with the authorities in the event of enquiries.
The Operator conducts business activity under PKD (Polish Classification of Activities) codes covering in particular: – 46.75.Z — wholesale of chemical products, – 46.46.Z — wholesale of pharmaceutical and medical products (a contextual code, used for catalogue purposes — this does not mean that the Operator trades in medicinal products; the code permits the sale of chemicals used in the biomedical sector), – 47.91.Z — retail sale via mail order houses or via the Internet, – 72.11.Z, 72.19.Z — scientific research and development in the field of biotechnology and other natural sciences, – 74.10.Z — specialised design activity (for the purposes of R&D of Research Materials).
Given the nature of the sale, which is directed exclusively to professional entities, the Operator has, in the Store Terms and Conditions, excluded the warranty for physical and legal defects on the basis of Art. 558 § 1 CC in B2B relations.

§ 3. Classification of products and legal bases

The Products offered in the Store are chemical substances (primarily synthetic peptides, small-molecule organic compounds and ancillary reagents) supplied in packaging with unit masses typically ranging from 1 mg to 100 mg, dedicated exclusively to in vitro, research, educational and comparative applications.
General legal basis for the classification: Regulation (EC) No 1907/2006 of the European Parliament and of the Council of 18 December 2006 concerning the Registration, Evaluation, Authorisation and Restriction of Chemicals (hereinafter: REACH) and Regulation (EC) No 1272/2008 of the European Parliament and of the Council of 16 December 2008 on the classification, labelling and packaging of substances and mixtures (hereinafter: CLP).
Classifications which the Products DO NOT have — with an unequivocal legal justification:

3.1. They are NOT a medicinal product within the meaning of Art. 2 point 32 PF: they hold no marketing authorisation issued by URPL or EMA, they are not pharmaceutically labelled, they have not been approved for use in humans or animals, and the packaging and leaflets contain no therapeutic indications, dosage or signature of the responsible entity.

3.2. They are NOT a medical device within the meaning of the MDR: they are not intended for the diagnosis, prevention, monitoring, treatment or alleviation of diseases.

3.3. They are NOT a cosmetic product within the meaning of Regulation 1223/2009: they are not intended for application to the external parts of the human body.

3.4. They are NOT a foodstuff within the meaning of Regulation 178/2002: they are not intended for human consumption.

3.5. They are NOT a biocidal product within the meaning of Regulation 528/2012.

3.6. They are NOT a dietary supplement within the meaning of the Act of 25 August 2006 on food and nutrition safety.

3.7. They are NOT a fertiliser or a plant protection product within the meaning of separate acts.

Classifications to which the Products ARE SUBJECT:

4.1. REACH — the Products are chemical substances within the meaning of Art. 3 point 1 REACH. Given that the quantities placed on the market by the Operator do not exceed 1 tonne per year per manufacturer/importer, the Products are covered by the exemption from the REACH registration obligation, in accordance with Art. 6 para. 1 REACH (registration threshold). The Operator monitors volumes and maintains a register which, if the threshold is approached, triggers the procedure for preparing a REACH registration dossier. Safety Data Sheets (SDS — Safety Data Sheet) are supplied in accordance with Art. 31 REACH to every Qualified Buyer — in the 16 sections provided for in Annex II to REACH, updated to reflect changes.

4.2. CLP — the Operator applies classification, labelling and packaging compliant with CLP. Labels contain GHS pictograms, a signal word (“Danger” / “Warning”), hazard statements (H-statements) and precautionary statements (P-statements) in accordance with the annexes to CLP.

4.3. UN rule for small quantities — in transport, the Operator uses the exemptions provided for small quantities and excepted quantities in accordance with the ADR provisions (road transport), where applicable.

The Operator publishes in the Store a detailed document “Legal nature of the Products” — available at /charakter-prawny-produktow/ — in which, for each Product category, the classification, REACH/CLP status, research application and restrictions are indicated.

§ 4. Regulatory obligations and implemented mechanisms

§ 4.1. REACH — Regulation 1907/2006

The Operator’s status with respect to REACH: the Operator acts as a participant in the supply chain (downstream user and distributor) within the meaning of Art. 3 points 13 and 14 REACH.
Exemption from the registration obligation: the Operator places substances on the market in quantities below 1 tonne per year per substance, which — in accordance with Art. 6 para. 1 REACH — excludes the obligation to register with ECHA. This threshold is monitored in an internal volume register (SKU → kg/year), with an alert at 80% of the threshold.
Information obligations (Art. 31 REACH): for each hazardous substance supplied to a Qualified Buyer, the Operator provides an SDS in 16 sections, in Polish or English (at the recipient’s request), in its current version. The sheets are generated on the basis of supplier data and the Operator’s own assessment, and are verified once every 12 months or immediately following a change in classification.
SVHC and the candidate list: the Operator verifies whether the substances contained in the Products appear on the candidate list of substances of very high concern (SVHC) maintained by ECHA, and fulfils the notification obligations where applicable.
Cooperation with ECHA and national authorities: the Operator undertakes to make available technical data, SDS dossiers and supply-chain documentation at the request of ECHA, GIS or another authority, within the time limit and in the form indicated in the request.

§ 4.2. CLP — Regulation 1272/2008

Classification: each substance offered in the Store is classified in accordance with the CLP criteria (physical, health and environmental hazards). The classification is based on experimental data, literature data and information from suppliers.
Labelling: the CLP label contains: the supplier identifier (the Operator), the chemical name of the substance, the nominal content, the hazard pictograms (GHS), the signal word, H-statements, P-statements and supplementary information (CAS number, EC number, where applicable).
Packaging: the packaging meets the CLP requirements — tightness, chemical resistance, child-resistant protection where applicable (e.g. for substances of toxicity classes subject to the CRC requirement).
H- and P-statements used in the Store: – example H-statements: H315 — “Causes skin irritation”, H319 — “Causes serious eye irritation”, H335 — “May cause respiratory irritation”; – example P-statements: P261 — “Avoid breathing dust”, P280 — “Wear protective gloves”, P305+P351+P338 — “IF IN EYES: Rinse cautiously with water for several minutes”.

§ 4.3. GDPR (RODO) — Regulation 2016/679 and the national Data Protection Act (UODO)

The Operator’s status: the Operator is the controller of personal data within the meaning of Art. 4 point 7 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (hereinafter: GDPR (RODO)) in respect of the data of Qualified Buyers, contact persons, newsletter subscribers, users visiting the Store and job applicants.
Record of processing activities (Art. 30 GDPR (RODO)): the Operator maintains a record of processing activities in a spreadsheet managed by the Compliance Officer, containing: the name of the activity, the purpose, the categories of data subjects, the categories of data, the legal basis, the recipients, the retention period, and a description of security measures. The record is updated with every change to a process.
Data Protection Officer (DPO) — justification for not appointing one: – the Operator analyses the obligation to appoint a DPO in the light of Art. 37 para. 1 GDPR (RODO) and Art. 9 of the Act of 10 May 2018 on the protection of personal data (Journal of Laws 2019 item 1781); – the Operator is not a public authority or body (point a); – the Operator’s core activity does not consist of processing operations requiring regular and systematic monitoring of data subjects on a large scale (point b) — the Operator does not profile consumers, does not observe the online behaviour of users (Plausible is privacy-first, no cookies, no IP in the database), and does not use biometric or location data on a continuous basis; – the Operator’s core activity does not consist of large-scale processing of special categories of data (point c) — the Operator does not process data concerning health, religion, sexual orientation, racial or ethnic origin; – accordingly, the appointment of a DPO is not mandatory. Compliance-coordination functions are performed by the Compliance Officer (compliance@purepoint.pl), who does not hold the formal status of a DPO within the meaning of the GDPR (RODO) but ensures an appropriate level of oversight.
Schrems II and transfers to the USA: the Operator has audited all processors. It does not use Google products (Analytics, Tag Manager, reCAPTCHA, Google-hosted Fonts), does not use Meta Pixel or other tools liable to transfer data to the USA. The technology stack is limited to the EEA (Stripe Ireland, cyber_Folks PL, Plausible Estonia, Brevo France). Accordingly, the Operator does not carry out transfers of data outside the EEA within the meaning of Chapter V of the GDPR (RODO); should such transfers occur in the future, they will be based on an adequacy decision (e.g. the EU-US DPF) or standard contractual clauses (SCC) with a TIA assessment.
Data subjects’ rights (Art. 15-22 GDPR (RODO)): the Operator has implemented a procedure for exercising data subjects’ rights — in the Qualified Buyer’s panel the following functions are available: “Download my data (Art. 15/Art. 20)”, “Change data (Art. 16)”, “Delete account (Art. 17)”, “Restriction (Art. 18)”, “Objection (Art. 21)”. Written requests are fulfilled within 30 days of receipt.
Data breaches (Art. 33-34 GDPR (RODO)): the Operator reports breaches to UODO within 72 hours and informs the data subjects where the breach is likely to result in a high risk to their rights and freedoms.
Details concerning legal bases, retention and recipients are set out in a separate Privacy Policy (/polityka-prywatnosci/).

§ 4.4. Anti-money laundering (AML)

The Operator’s status: as indicated in § 2 para. 2 point 2.10 — the Operator is not an obliged institution within the meaning of Art. 2 para. 1 of the AML Act.
Three proactive thresholds (despite the absence of obliged-institution status): – Threshold 1: EUR 5,000 (or equivalent) — automatic verification of the Qualified Buyer’s data (confirmation of the NIP in VIES, verification of the IP address against the delivery address); – Threshold 2: EUR 15,000 — manual review of the order by the Compliance Officer; in case of doubt, contact with the Buyer in order to obtain additional KYC documentation; – Threshold 3: EUR 50,000 — requirement of a signed counterparty declaration, documentation of the source of financing, and formal verification of the ultimate beneficial owner (UBO) status before the shipment is dispatched.
Sanctions lists: the Operator verifies Buyers and shipping addresses against the EU sanctions lists (Regulation 2580/2001 and sector-specific regulations), OFAC (USA — solely for risk-assessment purposes, not for extraterritorial application) and HM Treasury (UK). The verification result is recorded in the audit log.
Geo-block: the Store blocks IP addresses from high-risk jurisdictions — the Russian Federation, the Republic of Belarus, Iran, North Korea, Syria, Cuba, Venezuela and Myanmar.
GIIF reporting: the Operator is not obliged to file reports with the General Inspector of Financial Information under the AML Act. Should a suspicion of money laundering or the financing of terrorism be detected, the Operator will report the matter voluntarily and without undue delay.

§ 4.5. Tax obligations (CIT, VAT, KSeF)

CIT: the Operator is a corporate income tax payer within the meaning of the Act of 15 February 1992 on corporate income tax (Journal of Laws 2024 item 2160, as amended). The tax year = the calendar year. Accounting is performed by an accounting office.
VAT: the Operator is an active VAT payer (basic rate 23%; preferential rates do not apply to the Products). The Operator is registered for intra-Community transactions (VAT-EU).
KSeF (National e-Invoicing System): the Operator issues invoices in the KSeF system from the date on which this follows from the Act. Invoices are issued simultaneously in PDF format and transmitted electronically to Qualified Buyers. The Operator has prepared the technical documentation for the KSeF integration (XML, qualified certificate, the management board’s electronic signature).
Customs and import: in the case of importing Products from outside the EU, the Operator declares the goods in accordance with the Union Customs Code (Regulation 952/2013), using the CN code corresponding to the chemicals classification.

§ 4.6. Professional sport, the WADA code and exclusions

The Operator imposes a categorical prohibition on purchasing the Products for a purpose connected with participation in professional sport, doping in amateur sport, or an attempt to circumvent the prohibitions of the World Anti-Doping Agency (WADA), the Polish Anti-Doping Agency (POLADA) or international sports federations.
In the order placement process the Qualified Buyer makes a declaration (within the KOP — § 5 of the Document) confirming that they are not a professional athlete and that they are not purchasing the Products for the purpose of using them in commerce subject to the WADA or POLADA regulations. Making a false declaration gives rise to the consequences indicated in § 5 para. 5.

§ 5. Requirements for the Buyer

Qualified Buyer — definition: a natural person conducting business or professional activity, a legal person or an organisational unit without legal personality to which separate provisions grant legal capacity, purchasing the Products for a purpose connected directly with business, professional, research, educational or academic activity, within the meaning of Art. 43(1) CC, excluding the status of a consumer within the meaning of Art. 22(1) CC.
Five categories of Qualified Buyers: – STUDENT — a person studying in a biomedical, chemical, biotechnology or pharmaceutical field (confirmation of active university status); – LAB — a research laboratory (NIP + laboratory name + registered office address); – SCIENTIST — a researcher holding an ORCID, an institutional affiliation and publications; – BIZ_RD — an entity conducting activity under PKD codes 74.10.Z, 72.11.Z, 72.19.Z, 72.20.Z, 21.20.Z or a related code; – OTHER_PRO — another professional buyer who submits a declaration of at least 100 characters justifying the purpose of the purchase; subject to manual verification.
KOP — Qualified Profile Declaration: in the account registration process the Qualified Buyer makes five compliance declarations, including a declaration of the non-consumer nature of the purchase, a declaration of awareness of the status of the Research Materials, a declaration of the prohibition of use on humans, a declaration of the prohibition of consumer-facing resale, and a declaration of the absence of professional-athlete status subject to WADA/POLADA. The KOP records a hash + timestamp + IP in the database and is an evidentiary document.
Legal reasoning — exclusion of the UPK: – Primary argument: the Qualified Buyer is not a consumer within the meaning of Art. 22(1) CC, and therefore the provisions of the Act of 30 May 2014 on consumer rights (consolidated text: Journal of Laws 2024 item 1796; hereinafter: UPK), in particular Art. 27-39 UPK (the right of withdrawal from a contract concluded at a distance), do not apply; – Fallback argument (in the event the status is challenged): even if the consumer classification were challenged — the right of withdrawal would be excluded on the basis of Art. 38 point 3 UPK (a non-prefabricated item produced to the consumer’s specification), point 4 (an item liable to rapid deterioration or having a short use-by date) or point 5 (an item delivered in sealed packaging which cannot be returned after opening for health-protection reasons).
Prohibition of consumer-facing resale: the Qualified Buyer undertakes not to transfer the Products to natural persons not conducting business/research activity, in particular not to offer them in retail sales channels available to consumers.
Sanction for a false declaration: a Qualified Buyer who makes a false declaration in the KOP bears civil liability on the basis of Art. 471 CC (compensation for non-performance/improper performance of an obligation) and may be subject to criminal liability on the basis of Art. 233 § 1 of the Act of 6 June 1997 — Criminal Code (consolidated text: Journal of Laws 2024 item 17 [VERIFY the current publication reference]; hereinafter: CC (Criminal)) — which provides: “Whoever, in giving testimony intended to serve as evidence in court proceedings or in other proceedings conducted on the basis of an act, gives false testimony or conceals the truth, shall be subject to the penalty of deprivation of liberty for a term of between 6 months and 8 years”.

§ 6. Article 124 para. 1 of the Act — Pharmaceutical Law — critical erratum

The Operator informs that earlier versions of the terms-and-conditions documents (v1.0) contained an erroneous reference to the content of Art. 124 para. 1 PF (allegedly: “the penalty of deprivation of liberty for up to 8 years and a fine of up to PLN 5 million”). The above reference was incorrect and, upon the entry into force of version v2.0 of the documents (6 June 2026), it is corrected in its entirety.
The correct wording of the provision (verbatim quotation):

“Art. 124. 1. Whoever, without the required permit, places a medicinal product on the market shall be subject to a fine, the penalty of restriction of liberty or deprivation of liberty for up to 2 years.”

— the Act of 6 September 2001 — Pharmaceutical Law (consolidated text: Journal of Laws 2025 item 750, previously Journal of Laws 2024 item 686, as amended).

Practical consequences: – the Operator does not place medicinal products on the market, because the Products do not meet the definition of a medicinal product (§ 3 para. 3 of the Document); accordingly, the operative provision of Art. 124 para. 1 PF does not apply to the Operator’s activity; – this provision is cited solely for educational purposes — in order to make potential buyers aware of the consequences of attempts to circumvent the status of the Research Materials and to place them on the market as medicinal products (e.g. by adding pharmaceutical labels, packaging them into pharmacy containers, or offering them consumer-facing with dosage); – the sanction of deprivation of liberty for up to 2 years, the penalty of restriction of liberty or a fine — although numerically lower than the previous, erroneous formulation — still constitutes a serious criminal sanction, which the Operator firmly avoids and which it does not permit its Qualified Buyers to engage in acts that could trigger.
Corrective actions taken by the Operator: – correction of the quotation in all terms-and-conditions documents (Terms and Conditions, Privacy Policy, Legal nature of the Products, this Compliance Statement); – communication of the information to Qualified Buyers (mailing) together with a reference to the correct content of Art. 124 para. 1 PF; – retention of the archived version v1.0 with a note “ERRATUM — see v2.0” in order to preserve a complete audit trail.
Other criminal provisions of the PF of contextual relevance: – Art. 125 PF (manufacturing or importing a medicinal product without a permit), – Art. 126b PF (falsification of medicines), – Art. 127 PF (advertising of a medicine in breach of the provisions),

The Operator falls within none of these operative provisions; however, the Compliance Officer maintains a register of these provisions for training and audit purposes.

§ 7. Compliance mechanisms built into the Store

The Operator has implemented the following systemic, organisational and technical mechanisms. The list is updated once per quarter.

SKU Risk Matrix — each Product is classified in a risk matrix according to three dimensions: legal-classification risk, abuse risk (consumer-facing misuse) and reputational risk. The result determines the availability of the SKU for a given category of Qualified Buyer (e.g. SKUs marked “GLP-1” are visible only to SCIENTIST and LAB).
Compliance Gate (checkout 4/5-tier) — the final step of the order requires re-confirmation of four (or five — for high-risk SKUs) declarations: – confirmation of Qualified Buyer status, – confirmation of the research/laboratory purpose, – confirmation of the prohibition of use on humans/animals, – confirmation of the prohibition of consumer-facing resale, – for GLP-1 SKUs: additional confirmation of awareness of the specific regulatory features.
Forbidden phrases registry — in the Store copy, Product descriptions, blog and mailings, the Operator applies a list of forbidden words and phrases such as “medicine”, “pharmaceutical”, “treats”, “therapy”, “clinical dose”, “cure”, “dose”, “treat”, “IU/kg body weight”, “injection protocol”. The list is verified automatically (a script) and manually upon each publication.
Age gate 21+ — entry to the Store requires confirmation of having reached the age of 21 (in line with the strictest threshold applied for the trade in chemicals in EEA jurisdictions, even though PL requires 18 years — the Operator voluntarily applies the higher threshold).
Basic and enhanced KYC — automatic and manual verification mechanisms described in § 4 para. 4.
Audit trail in the order metadata — for each order, the following are recorded in the database: IP, User-Agent, KOP timestamp, hash of the declarations, geo-block result, sanctions verification result, VIES verification result, and the list of accepted terms and conditions (versioning).
Data retention compliant with the GDPR (RODO) and tax provisions — 5 years from the end of the year in which cooperation with the Buyer was concluded (on the basis of the Tax Ordinance and the Accounting Act); marketing data — until consent is withdrawn.
Team training — all employees and associates with access to the Store panel undergo mandatory compliance training (REACH, CLP, GDPR (RODO), AML, PF) — once a year, with a final test and a certificate.
GDPR (RODO) record of processing activities (Art. 30) — updated quarterly.
Data backup — daily backups of the Store database in a geographic location different from the main server (cyber_Folks PL), with 30-day retention.
Encryption — all connections HTTPS (TLS 1.3), the database encrypted at rest (AES-256), sensitive data (hashes of declarations) additionally encrypted with an application layer.
2FA for administrative accounts — all accounts with access to the administrative panel (WordPress + WooCommerce) require two-factor authentication (TOTP + a hardware U2F key for the management board).
Symmetrical cookies banner — the cookies banner offers Accept / Reject / Customise in a single view, with equal visibility, in accordance with UODO decision 02/2025 (case bearing the UODO publication reference number from 2025 — a fine of EUR 420,000 for an asymmetrical banner).
Geo-block — the list of blocked jurisdictions (§ 4 para. 4 point 4).
Exclusion of the B2B warranty — in the Terms and Conditions on the basis of Art. 558 § 1 CC.
B2B liability cap — the Operator’s liability towards the Qualified Buyer is limited to the value of the order plus the cost of shipping, excluding indirect losses, lost profits and reputational costs (permissibility on the basis of Art. 473 § 1 CC in conjunction with Art. 361 § 2 CC in B2B relations; the limitation does not cover damage caused intentionally — Art. 473 § 2 CC).

§ 8. Cooperation with State authorities

The Operator declares its full readiness to cooperate with State and local government authorities in matters connected with the subject of the activity conducted.
Contact channel: written questions should be addressed to compliance@purepoint.pl (for electronic correspondence) or to the correspondence address ul. Wierzbięcice 44A/40A, 61-568 Poznań (for paper correspondence). The Operator also accepts service via the ADE: AE:PL-21312-60691-FGBFV-19.
Response times: the Operator undertakes to provide a response within the time limit arising from the legal provision on the basis of which the question was directed, and in the absence of such a time limit — within 14 working days. Where it is necessary to obtain documentation from subcontractors, the time limit is extended, of which the authority is informed without delay.
Scope of cooperation: – provision of KOP documentation and the order audit trail, if the matter concerns a specific Buyer; – provision of SDS and CLP classifications, if the matter concerns a specific Product; – provision of the GDPR (RODO) record of processing activities, if the matter concerns the processing of personal data; – provision of accounting documentation, if the matter concerns tax obligations; – enabling an on-site inspection at the registered office or correspondence address following prior notification.
Legally protected secrets: the Operator reserves the right not to disclose information covered by trade secrets, the professional secrecy of advisers or banking secrecy — to the extent arising from separate provisions — and the right to request that access to Buyers’ personal data be limited to the scope necessary for the given matter.

§ 9. Ethics and transparency

The Operator conducts the Store in accordance with the principles of industry ethics and in the spirit of full transparency towards the authorities, partners and Qualified Buyers.
Prohibition of human-use marketing: the Operator categorically does not direct marketing messages to persons who might use the Products on humans. Promotional materials: – do not contain images of people with needles, ampoules or vials in the context of application; – do not use therapeutic terminology; – do not publish dosage, injection protocols or clinical comparisons; – do not contain hashtags such as #weightloss, #musclegrowth, #antiaging; – all publications pass through the Compliance Officer’s gate before publication.
Cooperation with researchers: the Operator permits the publication of the results of research conducted using the Products solely in scientific channels — with the principles of transparency, declaration of conflicts of interest and peer-review verification observed.
Advertising rules: compliant with the Polish Act of 23 August 2007 on counteracting unfair market practices, the Act on combating unfair competition, and the code of good advertising practice adopted by the Advertising Council.

§ 10. Reporting irregularities (whistleblowing)

The Operator enables any person — an employee, associate, Qualified Buyer, partner, supplier or third party — to report a suspected breach of the provisions of law or of this Compliance Statement.
Reporting channel: compliance@purepoint.pl.
Scope of reports: – breaches of public law provisions (PF, AML, GDPR (RODO), tax); – attempts by Buyers to circumvent the Store’s compliance; – unethical marketing practices; – abuse of powers by the Operator’s employees/associates; – other material irregularities.
Anonymity: the reporting person may remain anonymous. The Operator undertakes not to disclose the identity of the reporting person to unauthorised persons and to provide protection against retaliatory actions, in accordance with the principles set out in Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law and in the Act of 14 June 2024 on the protection of whistleblowers (Journal of Laws 2024 item 928).
Handling of a report: the Compliance Officer confirms receipt of the report within 7 days and, within 3 months, informs the reporting person of the actions taken.
No need for an internal committee: given the Operator’s size — reports are examined by the Compliance Officer, who, in the event of a conflict of interest, refers the matter directly to the Management Board (Krystian Dawidowski).

§ 11. Document amendment procedure

Review cycle: quarterly. The next scheduled review — 6 September 2026.
Initiating amendments: amendments to the Document are initiated by the Compliance Officer (compliance@purepoint.pl) at the request of: – their own (e.g. following training, an audit, or the identification of a risk); – the Operator’s Management Board; – State authorities (e.g. post-inspection recommendations of UODO, GIF, KAS); – business partners (e.g. Stripe’s KYC requirements); – Qualified Buyers (by way of enquiry).
Amendment implementation procedure: – preparation of a draft version X.Y; – consultation with a legal adviser (a cooperating attorney-at-law); – acceptance by the Management Board; – publication on the Store website; – notification of Qualified Buyers by e-mail (via the terms-and-conditions newsletter); – update of the MOC in the Operator’s internal knowledge vault.
Version numbering: incremental changes (corrections, minor updates to quotations) — versions X.Y with an increment of the last digit; material changes (a new section, a new risk, a new technology partner) — versions X.0 with an increment of the first digit.
Archiving: every previous version of the Document is archived in the internal vault under the path _OBSIDIAN/20_BRANDS/PURE_POINT/Compliance/archive/ and remains available at the request of authorities or partners.

§ 12. Normative bibliography and authority communications

Polish legal acts

Act of 23 April 1964 — Polish Civil Code (consolidated text: Journal of Laws 2024 item 1061, as amended).
Act of 6 June 1997 — Criminal Code (consolidated text: Journal of Laws 2024 item 17, as amended) [VERIFY the current publication reference].
Act of 6 September 2001 — Pharmaceutical Law (consolidated text: Journal of Laws 2025 item 750, previously Journal of Laws 2024 item 686, as amended).
Act of 15 February 1992 on corporate income tax (Journal of Laws 2024 item 2160, as amended).
Act of 11 March 2004 on the tax on goods and services (consolidated text: Journal of Laws 2024 item 361, as amended) [VERIFY — Journal of Laws 2024 item 1112 was originally indicated; standardised to the publication reference used in doc. 14].
Act of 25 August 2006 on food and nutrition safety (consolidated text: Journal of Laws 2024 item 800).
Act of 19 August 2011 on payment services (consolidated text: Journal of Laws [VERIFY — the indicated publication reference Journal of Laws 2024 item 1112 is identical to the publication reference of the VAT Act and appears to be erroneous]).
Act of 30 May 2014 on consumer rights (consolidated text: Journal of Laws 2024 item 1796).
Act of 10 May 2018 on the protection of personal data (Journal of Laws 2019 item 1781).
Act of 1 March 2018 on counteracting money laundering and the financing of terrorism (consolidated text: Journal of Laws [VERIFY — three different publication references appear across the v2 documents: 2025 item 124 / 2024 item 197 / 2025 item 419; standardise to a single, current version]).
Act of 14 June 2024 on the protection of whistleblowers (Journal of Laws 2024 item 928).

European Union acts

Regulation (EC) No 178/2002 of the European Parliament and of the Council of 28 January 2002 laying down the general principles and requirements of food law.
Regulation (EC) No 1907/2006 of the European Parliament and of the Council of 18 December 2006 (REACH).
Regulation (EC) No 1223/2009 of the European Parliament and of the Council of 30 November 2009 on cosmetic products.
Regulation (EC) No 1272/2008 of the European Parliament and of the Council of 16 December 2008 (CLP).
Regulation (EU) No 528/2012 of the European Parliament and of the Council of 22 May 2012 concerning biocidal products.
Regulation (EU) No 952/2013 of the European Parliament and of the Council of 9 October 2013 laying down the Union Customs Code.
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR (RODO)).
Regulation (EU) 2017/745 of the European Parliament and of the Council of 5 April 2017 on medical devices (MDR).
Regulation (EU) 593/2008 of the European Parliament and of the Council of 17 June 2008 (Rome I).
Regulation (EU) 1215/2012 of the European Parliament and of the Council of 12 December 2012 (Brussels I bis).
Directive (EU) 2019/1937 of the European Parliament and of the Council of 23 October 2019 on the protection of persons who report breaches of Union law.

Authority communications and decisions

UODO decision No 02/2025 concerning an asymmetrical cookies banner (a fine of EUR 420,000 — UODO press release, 2025).
European Data Protection Board (EDPB) Guidelines 03/2018 on the territorial scope of the GDPR (RODO) (Art. 3).
EDPB Guidelines 04/2020 on informing data subjects about breaches.
GIF communication of 2024 concerning the classification of research peptides in online commerce (an archival communication — clarifying the boundaries of the liability of manufacturers and sellers).
UOKiK communication of 2024 concerning consumer protection on the market for supplements and “chemical reference” substances.

Operator documents referred to in this Document

Store Terms and Conditions of purepoint.pl (/regulamin/), version 2.0 — 6 June 2026.
Privacy Policy (/polityka-prywatnosci/), version 2.0 — 6 June 2026.
Cookies Policy (/polityka-cookies/), version 2.0 — 6 June 2026.
Legal nature of the Products (/charakter-prawny-produktow/), version 2.0 — 6 June 2026.
KOP Rules — Qualified Profile Declaration (/kop/), version 2.0 — 6 June 2026.
Internal SOP “SKU Risk Matrix” and SOP “Compliance Gate” — available to authorities on request.

§ 13. Change history

Version	Date	Author	Description of changes
1.0	2026-05-22	Compliance Officer	First publication of the Compliance Statement within the legal package v1.
1.1	2026-05-24	Compliance Officer	Editorial corrections. Added a section on GDPR (RODO)/Plausible.
2.0	2026-06-06	Compliance Officer + attorney-at-law	Full revision: erratum to Art. 124 para. 1 PF (up to 2 years, not 8 years); expansion of the REACH/CLP section; new construction of the Qualified Buyer and the KOP; three AML thresholds; justification for the absence of a DPO; symmetrical cookies banner; geo-block; cooperation with authorities; whistleblowing; full bibliography.

§ 14. Final clause

In matters not regulated by this document, the mandatorily applicable provisions of Polish law and European Union law shall apply. In the event of interpretative doubts, please contact compliance@purepoint.pl.

Document prepared by the Operator’s Compliance Officer in cooperation with an attorney-at-law specialising in e-commerce, pharmaceutical and GDPR (RODO) law. Approved by the Management Board of FIRSTSTONE TRADING sp. z o.o. — Krystian Dawidowski, Member of the Management Board — with an effective date of 6 June 2026.