Legal document

Sanctions & Export Policy

Operator: FIRSTSTONE TRADING sp. z o.o.
Version: 2.0
Effective date: 2026-06-06
Last updated: 2026-08-09
Language: Polish
Legal contact: compliance@purepoint.pl

Store Operator (Responsible Entity): FIRSTSTONE TRADING spółka z ograniczoną odpowiedzialnością (hereinafter: FIRSTSTONE TRADING sp. z o.o. or the Operator) KRS: 0001254766 | NIP: 7831958614 District Court Poznań – Nowe Miasto i Wilda in Poznań, 8th Commercial Division of the National Court Register (KRS) Date of registration: 17 February 2026 Registered office: ul. Wierzbięcice 44A/40A, 61-568 Poznań, województwo wielkopolskie Voivodeship Correspondence / Store service address: ul. Wierzbięcice 44A/40A, 61-568 Poznań Share capital: PLN 5,000.00 (fully paid up, 100 shares of PLN 50.00 each) Representation: Krystian Dawidowski — Member of the Management Board (sole management board, independent representation) Electronic delivery address (ADE): AE:PL-21312-60691-FGBFV-19 Compliance e-mail: compliance@purepoint.pl General e-mail: contact@purepoint.pl Domain: purepoint.pl

Version: 2.0 Effective date: 6 June 2026 Version superseded: 1.0 (22 May 2026) and 1.1 (24 May 2026) Review cycle: quarterly (next: 6 September 2026)

§ 1. Purpose and legal basis
§ 2. Definitions
§ 3. Geographic delivery exclusions (geo-block)
§ 4. Geo-block mechanism — IP, delivery, invoicing
§ 5. End-Use Declaration
§ 6. Value thresholds and compliance tiers
§ 7. Customs documentation and tariff classification
§ 8. Re-export prohibition clause
§ 9. Manual review procedure
§ 10. Cooperation with state authorities
§ 11. Procedure for refusing an export
§ 12. Sanctions against the Buyer for breach of the policy
§ 13. REACH, CLP and chemical legislation
§ 14. Document retention and archiving
§ 15. Change history
§ 16. Bibliography
§ 17. Final clause

§ 1. Purpose and legal basis

This International Sanctions and Export Control Policy (hereinafter: the Sanctions Policy or the Policy) sets out the rules for verifying and handling orders placed in the online Store operated under the purepoint.pl domain (hereinafter: the Store) as regards compliance with the international sanctions regimes imposed by the European Union (hereinafter: EU), the United Nations Organization (hereinafter: UN), the Office of Foreign Assets Control of the United States Department of the Treasury (hereinafter: OFAC), the Office of Financial Sanctions Implementation in the United Kingdom (hereinafter: OFSI), as well as compliance with the EU and national export control system for chemical, biotechnological and potential dual-use products.
Objectives of the Policy:
ensuring compliance of the Operator’s activity with the mandatorily applicable provisions of Polish law, European Union law and international law concerning sanctions, embargoes and trade restrictions;
minimising the risk of acting as an intermediary in the transfer of Research Materials to sanctioned entities, to natural persons on sanctions lists, to territories subject to restrictions, and to applications connected with weapons of mass destruction (hereinafter: WMD — Weapons of Mass Destruction);
ensuring compliance with Regulation (EC) No 1907/2006 of the European Parliament and of the Council of 18 December 2006 concerning the Registration, Evaluation, Authorisation and Restriction of Chemicals (hereinafter: REACH), with Regulation (EC) No 1272/2008 of 16 December 2008 on the classification, labelling and packaging of substances and mixtures (hereinafter: CLP), and with the Act of 29 November 2000 on trade with foreign countries in goods, technologies and services of strategic importance for State security and for the maintenance of international peace and security (Journal of Laws 2024, item 1075, as amended) (hereinafter: the Strategic Trade Act);
protecting the Operator from criminal, administrative and civil liability arising from a breach of the aforementioned regimes.
Legal basis of the Policy:
Council Regulation (EU) No 833/2014 of 31 July 2014 concerning restrictive measures in view of Russia’s actions destabilising the situation in Ukraine, together with all amending packages (hereinafter: Regulation 833/2014) — including package 14 (Council Regulation (EU) 2024/1745 of 24 June 2024) and subsequent packages implemented after the effective date of this Policy;
Council Regulation (EU) No 269/2014 of 17 March 2014 concerning restrictive measures in respect of actions undermining or threatening the territorial integrity, sovereignty and independence of Ukraine;
Council Regulation (EC) No 765/2006 of 18 May 2006 concerning restrictive measures in view of the situation in Belarus and the involvement of Belarus in the Russian aggression against Ukraine;
Council Regulation (EU) No 2017/2063 of 13 November 2017 concerning restrictive measures in view of the situation in Venezuela;
Council Regulation (EU) No 401/2013 of 2 May 2013 concerning restrictive measures in respect of Myanmar/Burma;
Council Regulation (EU) No 36/2012 of 18 January 2012 concerning restrictive measures in view of the situation in Syria;
Council Regulation (EU) No 267/2012 of 23 March 2012 concerning restrictive measures against Iran;
resolutions of the UN Security Council concerning North Korea (DPRK) — including resolutions 1718 (2006), 1874 (2009), 2270 (2016), 2321 (2016), 2371 (2017), 2375 (2017), 2397 (2017), together with the implementing Council Regulation (EU) 2017/1509;
Regulation (EU) 2021/821 of the European Parliament and of the Council of 20 May 2021 setting up a Union regime for the control of exports, brokering, technical assistance, transit and transfer of dual-use items (hereinafter: the dual-use Regulation);
the Strategic Trade Act;
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter: GDPR) — as regards the processing of personal data of Buyers subject to sanctions verification;
the Act of 23 April 1964 — Civil Code (consolidated text: Journal of Laws 2024, item 1061, as amended, hereinafter: the CC);
the Act of 6 June 1997 — Penal Code (consolidated text: Journal of Laws 2024, item 17, as amended, hereinafter: the PC);
the Act of 6 September 2001 — Pharmaceutical Law (consolidated text: Journal of Laws 2025, item 750, hereinafter: the PL) — in particular Art. 124 para. 1: “Whoever places a medicinal product on the market without the required authorisation shall be liable to a fine, a penalty of restriction of liberty, or imprisonment for up to 2 years.”
The Sanctions Policy forms an integral part of the Store Terms and Conditions and of the Operator’s compliance documentation. Acceptance of the Terms and Conditions is equivalent to acceptance of this Policy by the Buyer.

§ 2. Definitions

The terms used in this Policy have the following meanings:

Operator — FIRSTSTONE TRADING sp. z o.o. with its registered office in Poznań, operating the Store under the purepoint.pl domain;
Store — the online service for the sale of Products (Research Materials) available at purepoint.pl;
Buyer — a natural person conducting business or professional activity, a legal person, or an organisational unit without legal personality to which the law grants legal capacity, making or intending to make a purchase in the Store;
Qualified Buyer — a Buyer who has completed the verification procedure (KOP — Qualified Profile Statement) in accordance with the Terms and Conditions and belongs to one of five categories: STUDENT, LAB, SCIENTIST, BIZ_RD, OTHER_PRO; the Store sells exclusively to Qualified Buyers, excluding consumers within the meaning of Art. 22(1) CC;
Research Material (Product) — a chemical or biochemical substance offered in the Store exclusively for research, laboratory, educational and analytical purposes, not intended for administration to humans or animals, not being a medicinal product within the meaning of Art. 2(32) PL;
Sanctions — restrictive measures imposed by the EU, UN, OFAC, OFSI or other competent international authorities on States, territories, natural persons, legal persons or categories of goods;
High-Risk Country — a State or territory subject to EU/UN/OFAC/OFSI sanctions to which the Operator applies a total delivery ban in accordance with § 3;
Sanctions List — a consolidated list of persons and entities subject to sanctions, comprising in particular: the EU Consolidated List of Sanctions, the OFAC SDN List (Specially Designated Nationals and Blocked Persons), the Polish sanctions list maintained by the Minister of the Interior and Administration (Art. 2 of the Act of 13 April 2022 on special measures to counter support for aggression against Ukraine, Journal of Laws 2024, item 507);
End-Use Declaration — a written statement by the Buyer specifying the identity of the end user, the purpose of use, the absence of any connection with WMD, and the absence of any connection with sanctioned actors, together with a re-export prohibition;
WMD (Weapons of Mass Destruction) — weapons of mass destruction: nuclear, chemical, biological, and the means of their delivery (ballistic missiles) — in accordance with Art. 4 para. 1 of the dual-use Regulation;
Dual-use — dual-use (civilian and military) items, technologies and software listed in Annex I to the dual-use Regulation;
Geo-block — an automated mechanism blocking checkout and shipment based on analysis of the IP address, delivery address and billing address;
HS Code (Harmonized System Code) — the customs tariff code of the World Customs Organization (WCO) used to classify goods in international trade;
REACH — Regulation (EC) No 1907/2006;
CLP — Regulation (EC) No 1272/2008;
SDS (Safety Data Sheet) — the safety data sheet for a hazardous substance, prepared in accordance with Annex II to REACH;
Manual Review — a manual assessment of an order by a qualified compliance officer of the Operator, conducted outside the automated checkout process, within up to 5 business days.

§ 3. Geographic delivery exclusions (geo-block)

The Operator applies a total geographic ban on the delivery of Products to the following States and territories (hereinafter jointly: the High-Risk Countries):

ISO code	State / territory	Legal basis of sanctions
RU	Russian Federation	Council Regulation (EU) 833/2014 together with packages 1–14 (Regulation 2024/1745) and packages adopted after the effective date of this Policy
BY	Republic of Belarus	Council Regulation (EC) 765/2006 together with amending acts
IR	Islamic Republic of Iran	Council Regulation (EU) 267/2012; UN sanctions; OFAC SDN List
KP	Democratic People’s Republic of Korea (North Korea)	UN Security Council Resolutions 1718/2006, 1874/2009, 2270/2016, 2321/2016, 2371/2017, 2375/2017, 2397/2017; Council Regulation (EU) 2017/1509
SY	Syrian Arab Republic	Council Regulation (EU) 36/2012
CU	Republic of Cuba	US embargo (CACR — Cuban Assets Control Regulations, 31 CFR Part 515); risk of OFAC secondary sanctions
VE	Bolivarian Republic of Venezuela	Council Regulation (EU) 2017/2063 (selective); OFAC Executive Orders (selective)
MM	Republic of the Union of Myanmar (Burma)	Council Regulation (EU) 401/2013

The geo-block also covers:
occupied territories and so-called “self-proclaimed republics” — Donetsk (DPR), Luhansk (LPR), Crimea, Sevastopol, Kherson, Zaporizhzhia (in accordance with Council Regulation (EU) 692/2014 and subsequent regulations);
any vessels and entities flagged under, or with ownership linked to, the States in the table above, irrespective of the physical delivery address;
any natural and legal persons appearing on the EU Consolidated List of Sanctions, irrespective of the country of residence or registered office;
entities expressly named in Art. 5n of Regulation 833/2014 (prohibition on providing services to the Russian government).
Update clause. The list of High-Risk Countries is dynamic. The Operator is required to continuously monitor:
the Official Journal of the European Union;
announcements of the Export Policy Department of the Ministry of Foreign Affairs of the Republic of Poland;
announcements of OFAC (Treasury Department, USA) — as regards secondary sanctions;
announcements of OFSI (HM Treasury, United Kingdom);
resolutions of the UN Security Council. The list is updated immediately after the publication of a new legal act — at the latest within 5 business days. The change does not require an annex to the contract with the Buyer; it is published in the Store and in this Policy.
A Buyer whose delivery address, billing address or IP address points to a High-Risk Country receives a blocking message and cannot place an order. The Operator does not refund the cost of the attempted purchase — the order is not accepted and no amount is charged.

§ 4. Geo-block mechanism — IP, delivery, invoicing

The geo-block mechanism operates in three layers of verification simultaneously:
Layer 1 — IP address. Detection of the country of origin based on geolocation of the IP address (the MaxMind provider’s GeoIP2 database or equivalent). The result is compared against the list of High-Risk Countries.
Layer 2 — delivery address. Verification of the country entered in the delivery address field at checkout. The result is compared against the list of High-Risk Countries.
Layer 3 — billing address. Verification of the country of the billing address and the country of the payment card issuer (BIN check). The result is compared against the list of High-Risk Countries and the Sanctions Lists.
Conflict rule. The occurrence of any of the following circumstances results in an automatic block of the order:
any of the three layers indicates a High-Risk Country;
the three layers indicate different countries, and at least one of them does not belong to the EEA or to the Operator’s list of trusted countries (UK, US, CH, NO, IS, LI);
the surname, company name or address of the Buyer appears on the EU Consolidated List of Sanctions or the OFAC SDN List;
the Buyer uses a VPN, proxy or traffic anonymisation service whose exit point is located in a High-Risk Country (the Operator uses lists of IP addresses identified as Tor exit nodes and known commercial VPNs/proxies).
EEA + trusted jurisdictions whitelisting rule. Conflict-free orders from European Economic Area States and from trusted States (United Kingdom, United States, Switzerland, Norway, Iceland, Liechtenstein, Canada, Australia, New Zealand, Japan, South Korea, Singapore, Israel) proceed to further compliance verification without an additional manual sanctions check.
Blocking message. A Buyer whose order has been blocked receives the following message on the checkout screen: “Fulfilment of an order from your location is not possible due to the applicable EU/UN sanctions provisions. If you believe the block has been applied in error, please contact compliance@purepoint.pl.” The Operator does not disclose the details of the sanctions rules or the layers that triggered the block.
Event logging. Each blocking event is recorded in the Operator’s compliance log together with an anonymised hash of the IP address, the date, the time, an indication of the conflict layer, and the High-Risk Code. Logs are retained for 5 years from the date of the event (in accordance with Art. 5 para. 1 letter e GDPR and the need to defend against claims).

§ 5. End-Use Declaration

The Operator requires the Buyer to submit a written End-Use Declaration (hereinafter: EUD — End-Use Declaration) for:
each order with a value exceeding EUR 5,000 (or the equivalent in PLN at the average exchange rate of the National Bank of Poland (NBP) of the date the order is placed) shipped outside the territory of the European Union;
each order comprising a Product classified as dual-use within the meaning of Regulation 2021/821, irrespective of value and direction of shipment;
each order flagged by the risk algorithm as requiring an EUD irrespective of value — in particular where the Buyer was previously marked with a compliance flag or where the delivery address points to a location atypical for the Buyer’s profile.
The content of the EUD mandatorily includes:
Identity of the final Buyer (End-User). Full name or first and last name, registered office address, tax identification number, contact details of the responsible person (telephone, e-mail). Where the Store Buyer and the End-User are different entities — the details of both are required.
Final purpose of use. Description of the Product’s intended use in the End-User’s activity. Examples of acceptable purposes: in vitro research in a university laboratory, validation of analytical methods, determination of a standard in HPLC/LC-MS chromatography, extraction of a reference structure, quality control in the R&D of a biotechnology company.
Absence of any connection with WMD. Statement: “I hereby declare that the Products will not be used, in whole or in part, in any aspect of the design, development, production, storage or use of weapons of mass destruction (nuclear, chemical, biological weapons) or the means of their delivery, including ballistic missiles, in accordance with Art. 4 of Regulation (EU) 2021/821.”
Absence of any connection with sanctioned actors. Statement: “I hereby declare that neither the Buyer, nor the End-User, nor any natural or legal person exercising control over any of them appears on the EU Consolidated List of Sanctions, the OFAC SDN List, or any other EU/UN/US/UK sanctions list.”
Re-export prohibition clause. Statement: “I undertake not to re-export the Products or their derivatives to the High-Risk Countries specified in the Operator’s Sanctions Policy or to other territories subject to an EU/UN/US embargo, without the prior written consent of the Operator and without obtaining all required export authorisations.”
Signature and date. Signature of the person authorised to represent the End-User. Acceptable forms: qualified signature, ePUAP trusted signature, scanned handwritten signature (with identity verification via videoconference or the CEIDG/KRS database), e-mail from an institutional domain with an explicit statement of acceptance of the EUD content.
Awareness of consequences. The EUD contains the clause: “I am aware that submitting a false statement in this Declaration constitutes an offence under Art. 233 § 1 PC (punishable by imprisonment from 6 months to 8 years) and may give rise to civil liability under Art. 471 CC for damage caused to the Operator, as well as criminal and administrative liability arising from a breach of EU and national sanctions provisions.”
Form and archiving. The EUD is accepted in electronic form (PDF + qualified or trusted signature) or in the form of a scan with identity verification. Archiving: 10 years from the date of shipment of the Product (in accordance with Art. 8 para. 5 of the dual-use Regulation and the requirements of the National Revenue Administration (KAS)).
No EUD = no fulfilment. The Operator reserves the unconditional right to refuse to fulfil an order if the Buyer fails to submit a complete and properly signed EUD within the required period (up to 5 business days from the request).

§ 6. Value thresholds and compliance tiers

The Operator applies a three-tier system of value thresholds for compliance verification:

Order value	Required documentation	Processing time
below EUR 1,000	No EUD. The Qualified Buyer’s KOP (Qualified Profile Statement) and a positive geo-block result are sufficient.	Standard fulfilment (up to 48 hours)
EUR 1,000 – EUR 5,000	Simplified EUD (short form: End-User identity, purpose of use, declaration of absence of WMD, declaration of absence of sanctions, re-export clause, signature).	Up to 3 business days
above EUR 5,000	Full EUD (in accordance with § 5 para. 2) + manual review conducted by the Operator’s compliance officer.	Up to 5 business days

Currency conversion. Thresholds expressed in EUR are converted into PLN at the average exchange rate of the National Bank of Poland (NBP) of the date the order is placed, published in NBP’s Table of average exchange rates of foreign currencies No. A.
Aggregation of orders. In order to prevent circumvention of the thresholds, orders of the same Buyer or End-User over a period of 30 calendar days are aggregated. A sum above the threshold triggers the corresponding level of verification retroactively.
AML thresholds. Irrespective of the sanctions compliance thresholds, the Operator applies anti-money-laundering (AML) thresholds: EUR 5,000 (identity verification), EUR 15,000 (enhanced analysis of the source of funds), EUR 50,000 (manual review by the management board + report to the Inspector General of Financial Information, where there are reasonable grounds for suspicion). The Operator applies these thresholds proactively, even though it is not an obliged institution within the meaning of Art. 2 of the Act of 1 March 2018 on counteracting money laundering and terrorist financing (consolidated text: Journal of Laws 2023, item 1124, as amended).
Enhanced controls. Orders with a value above EUR 5,000 are additionally subject to:
verification of the reliability of the End-User (checks in the CEIDG, KRS, REGON databases and their foreign counterparts — Companies House UK, EU EBR);
verification of the Buyer’s history in the complaints, returns and compliance reports database;
verification of the consistency of the delivery address with the declared purpose (e.g. no residential addresses for laboratory deliveries above EUR 5,000 — except for individual scientists with a documented context).

§ 7. Customs documentation and tariff classification

Shipments outside the territory of the EU require the Operator to prepare full customs documentation, including:
Commercial Invoice. Prepared in English, marked “Research materials — for laboratory use only — not for human or veterinary use”, containing: the details of the Operator and the recipient, a description of the Product (common name + CAS name, if any), net and gross weight, quantity, unit and total value in the transaction currency, delivery terms (Incoterms — DAP by default in accordance with the Operator’s policy), HS Code, country of origin, the Operator’s EORI number.
Customs Declaration. Lodged in the AES (Automated Export System) of the National Revenue Administration — PUESC — through a customs agency or directly by the Operator. For shipments below EUR 1,000 and below 1,000 kg, a simplified procedure is possible (CN23/CN22 for postal consignments).
Safety Data Sheet (SDS). Required for each Product classified as a hazardous substance within the meaning of CLP. The SDS is prepared in accordance with Annex II to REACH, in the language of the country of destination (where it is an EU/EEA State) or in English (for third countries accepting EN).
End-Use Declaration — if required in accordance with § 5.
Certificate of Origin — if required by the country of destination (e.g. countries associated with the EU under preferential agreements — prepared by the Polish Chamber of Commerce or in the REX system).
HS Code tariff classification. The Operator classifies Research Materials by default under one of the following customs tariff headings (Combined Nomenclature, CN):
HS 2933.79.00 — “Other heterocyclic compounds with nitrogen hetero-atom(s) only” — used for cyclic peptides, structures with nitrogen rings, imidazole and indole derivatives;
HS 3822.00.00 — “Diagnostic or laboratory reagents on a backing; prepared diagnostic or laboratory reagents whether or not on a backing” — used for reagents, reference standards, analytical standards;
HS 3504.00.90 — “Peptones and their derivatives; other protein substances and their derivatives, not elsewhere specified” — used for simple linear peptides not meeting the criteria of 2933.79.00;
HS 2937.19.00 — “Other polypeptide and protein hormones and their derivatives” — used exclusively for hormone derivatives listed in the WHO/ICH register; classification requires individual compliance verification and may give rise to increased export sanctions risk.
BTI verification. For Products with an ambiguous classification, the Operator may apply to the KAS for a binding tariff information (BTI — Binding Tariff Information) in accordance with Art. 33 of the Union Customs Code (Regulation (EU) 952/2013). A BTI is valid for 3 years.
Dual-use control. Each shipment outside the EU is checked against Annex I to Regulation 2021/821. If the Product is included in the list (e.g. certain toxins, chemical weapon precursors, biological materials) — the Operator suspends fulfilment until an individual, global or general authorisation is obtained from the Export Policy Department of the Ministry of Foreign Affairs.
Sanctions for incorrect classification. The Operator applies a “classify above the risk” policy — in the event of doubt, it adopts the more restrictive HS Code. The deliberate use of an incorrect classification in order to avoid export control constitutes an offence under Art. 88 para. 1 of the Act of 10 September 1999 — Fiscal Penal Code (Journal of Laws 2024, item 628, as amended) and may give rise to liability under the Strategic Trade Act.

§ 8. Re-export prohibition clause

Every Buyer making a purchase in the Store undertakes — by the very fact of accepting the Terms and Conditions — not to transfer the Products (in any manner: sale, gift, lending, deposit, exchange) to entities from the High-Risk Countries specified in § 3 para. 1 or to entities on the Sanctions List.
The re-export clause also covers:
a prohibition on the transfer of technical knowledge (know-how) concerning the Product to persons from High-Risk Countries;
a prohibition on providing intermediation services in the sale of the Products to such entities;
a prohibition on using the Products in projects financed by the governments or State institutions of High-Risk Countries, regardless of the location of the project itself.
The clause is in force for a period of 5 years from the date of delivery of the Product to the Buyer.
Breach of the clause results in:
immediate deactivation of the Buyer’s account in the Store;
civil liability under Art. 471 CC for damage caused to the Operator (in particular for the costs of compliance proceedings, administrative penalties and loss of reputation);
a report by the Operator to the Export Policy Department of the Ministry of Foreign Affairs and to law enforcement authorities, where there is a suspicion that an offence has been committed;
the pursuit of a contractual penalty of PLN 100,000 for each breach, irrespective of the pursuit of damages under general principles;
criminal liability under Art. 33 of the Strategic Trade Act (imprisonment from 1 year to 10 years).
The re-export clause is an intra-contractual clause — the Buyer may not unilaterally exclude or modify it. An attempt to modify it on an individual basis requires the written consent of the Operator under pain of nullity.

§ 9. Manual review procedure

Manual review (a manual compliance assessment) is triggered in the following cases:
an order with a value above EUR 5,000 with delivery outside the EU;
a geo-block layer conflict of an ambiguous nature (e.g. EEA + trusted jurisdiction, but divergent IP, delivery and billing countries);
orders in the OTHER_PRO Buyer category (a statement of 100+ characters, manual review mandatory);
an order comprising a dual-use Product;
an order requiring an individual export authorisation;
an order with an AML flag (exceeding the EUR 15,000 threshold or reasonable grounds for suspicion);
an order referred for assessment by the Store’s risk-score algorithm.
Processing time. Manual review is conducted within up to 5 business days from the moment the procedure is triggered. In complex cases — in particular those requiring an individual authorisation from the Ministry of Foreign Affairs — the period may be extended to 30 business days, of which the Buyer is informed by e-mail to the address provided in the account.
Activities within the manual review.
verification of the End-User in the KRS, CEIDG, REGON, KRD databases, the EU Sanctions List, the OFAC SDN List, the OFSI UK list, the Polish sanctions list of the Ministry of the Interior and Administration (MSWiA);
verification of the purpose of use for credibility (cross-checking scientific publications, ORCID profiles, the institution’s website);
verification of the Buyer’s order history and of the frequency and pattern of purchasing;
verification of the consistency of the HS Code classification with the declared purpose;
assessment of dual-use risk;
decision: approval, refusal, conditional approval with additional documentation, or return to the Buyer with a request for completion.
Documenting the decision. Each decision within the manual review is documented in the Operator’s internal compliance system together with:
a decision identifier;
the date and name of the decision-maker;
a justification (minimum 200 characters);
reference to the specific legal basis (the article of the regulation/act);
a list of the databases checked. The documentation is retained for 10 years from the date of the decision.
Communication with the Buyer. Upon completion of the manual review, the Operator informs the Buyer by e-mail of:
approval of the order (with the planned shipment date); or
the need to complete the documentation (with a specific list of documents); or
refusal of fulfilment (in accordance with § 11).

§ 10. Cooperation with state authorities

The Operator cooperates with state authorities as regards the information, reporting and control obligations arising from the sanctions and export provisions. The cooperation covers in particular:
The Export Policy Department of the Ministry of Foreign Affairs of the Republic of Poland — as regards individual, global and general authorisations for the export of dual-use Products (Art. 6–11 of the Strategic Trade Act), as regards consultations on the classification of Products, and as regards reporting attempts to circumvent sanctions;
The National Revenue Administration (KAS) — as regards customs declarations, tariff classification, BTI, customs proceedings and fiscal penal proceedings;
The Border Guard — as regards the detention of consignments at the EU external border, ad-hoc inspections, and cooperation with Europol;
The Inspector General of Financial Information (GIIF) — as regards voluntary AML reports, in particular suspicious transactions within the meaning of Art. 86 of the Act on counteracting money laundering and terrorist financing (consolidated text: Journal of Laws 2023, item 1124, as amended) [VERIFY the article number — Art. 74 concerns above-threshold transactions, Art. 86 concerns suspension, Art. 89 concerns notification of suspicion];
The Internal Security Agency (ABW) — as regards terrorist threats, attempts to transfer materials to entities under monitoring, and reports from partner services;
The Chief Sanitary Inspector (GIS) — as regards breaches of Art. 124 PL and other provisions concerning medicinal products;
The Office for Registration of Medicinal Products, Medical Devices and Biocidal Products (URPL) — as regards the exchange of information on substances with a disputed regulatory status;
The European Commission, Directorate-General for Trade (DG TRADE) — as regards interpretative consultations on dual-use provisions and multilateral consultations;
OFAC / OFSI — as regards secondary sanctions and the exchange of information on attempts to circumvent sanctions.
Direct response to an authority’s request. The Operator responds to requests from state authorities submitted under:
Art. 217–220 of the Act of 17 November 1964 — Code of Civil Procedure (Journal of Laws 2024, item 1568) — in civil proceedings;
Art. 218 of the Act of 6 June 1997 — Code of Criminal Procedure (Journal of Laws 2024, item 37) — in criminal proceedings (with respect for the principles of the GDPR);
Art. 79 of the Act of 16 November 2016 on the National Revenue Administration (Journal of Laws 2025, item 200) — in KAS proceedings. The Operator responds within the periods indicated in the request, with respect for the principles of the GDPR and professional secrecy.
Self-reporting. The Operator has implemented a proactive reporting (self-reporting) policy — in the event of detecting an attempt to circumvent sanctions, an attempt to purchase by a sanctioned entity, or any other circumstance indicating organised activity inconsistent with the sanctions provisions, the Operator submits a report to the relevant authority (usually the Ministry of Foreign Affairs + ABW) within up to 7 days of identifying the event.
Internal whistleblowing. The Operator’s employees and associates are obliged to report any suspected breach of this Policy to compliance@purepoint.pl or directly to the Member of the Management Board. The Operator applies whistleblower protection rules consistent with the Act of 14 June 2024 on the protection of whistleblowers (Journal of Laws 2024, item 928).

§ 11. Procedure for refusing an export

The Operator reserves the unconditional and independent right to refuse to fulfil an export order if any of the following circumstances arises:
the Buyer or End-User appears on a Sanctions List (EU, UN, OFAC, OFSI, the Polish sanctions list);
the delivery address or billing address points to a High-Risk Country;
the EUD has not been submitted within the required period or is incomplete;
the EUD contains internal contradictions or circumstances giving rise to reasonable doubts on the part of the compliance officer;
the Product is subject to an individual authorisation that the Buyer lacks;
the order exhibits the features of an organised attempt to circumvent sanctions (atypical pattern recognition);
AML verification has revealed doubts as to the source of funds;
a reasonable suspicion of a breach of Art. 124 PL or another pharmaceutical provision;
other circumstances indicating an unjustified legal risk for the Operator.
Communication of the refusal. The decision to refuse fulfilment is communicated to the Buyer by e-mail within up to 3 business days of the decision being made. The content of the message contains:
an indication that the order will not be fulfilled;
the general basis for the refusal (without disclosing the details of the detection algorithms, in order to preserve the effectiveness of the compliance mechanisms);
information on the full refund of any funds charged within 14 days;
an indication of the appeal channel (compliance@purepoint.pl).
Appeal procedure. The Buyer may, within 14 days of receiving the refusal decision, lodge an appeal at compliance@purepoint.pl. The appeal is examined by the Operator’s compliance officer within 14 business days. The decision determining the appeal is final in the internal course. This does not exclude the Buyer’s right to pursue claims before the courts — in accordance with the Terms and Conditions, the governing law is Polish law, jurisdiction: the common court competent for the Operator’s registered office.
No right to compensation. A refusal to fulfil an order justified by the sanctions provisions does not give rise to a claim for compensation on the part of the Buyer. The Operator is not liable for damage arising from the detention of a consignment by state authorities, the freezing of funds by a payment institution, or any other circumstance arising from the sanctions regime.
Reporting obligation. In the event of a refusal of fulfilment justified by the presence of the Buyer/End-User on a Sanctions List, the Operator makes a mandatory report to the Ministry of Foreign Affairs (Export Policy Department) and to the ABW within up to 7 days of the decision.

§ 12. Sanctions against the Buyer for breach of the policy

A breach by the Buyer of this Policy — in particular providing false data in the EUD, an attempt to circumvent the geo-block, a breach of the re-export prohibition clause — results in:
immediate termination of the contract for the provision of electronic services (the account in the Store) with immediate effect;
deactivation of the account and a block on re-registration;
criminal liability under Art. 233 § 1 PC (false statement), under Art. 33 of the Strategic Trade Act, and under Art. 124 PL (where the Product was treated as a medicinal product);
civil liability under Art. 471 CC and Art. 415 CC for damage caused to the Operator;
liability for the contractual penalties provided for in § 8 para. 4 point 4 (PLN 100,000 for each breach of the re-export clause).
The Operator reserves the right to pursue claims irrespective of whether state authorities have initiated proceedings against the Buyer.
The clause limiting the Operator’s liability towards the Qualified Buyer (a cap at the value of the order + shipment, in accordance with the Terms and Conditions) does not apply to the Operator’s claims against the Buyer — the Buyer’s liability for a breach of the Policy is not limited in amount.

§ 13. REACH, CLP and chemical legislation

The Operator ensures that all Products offered comply with the REACH Regulation:
substances placed on the EU market in quantities of 1 tonne/year or more are registered with the European Chemicals Agency (ECHA);
for substances requiring authorisation (Annex XIV REACH), the Operator does not place them on the market without authorisation;
for substances subject to restrictions (Annex XVII REACH), the Operator applies the conditions of the restrictions or excludes the Product from its range.
Products are labelled in accordance with CLP — the labels contain GHS hazard pictograms, H and P statements, UN codes (where the substance is classified as a dangerous good in transport in accordance with ADR/IATA/IMDG).
The Safety Data Sheet (SDS) is prepared in accordance with Annex II to REACH in sections 1–16 and made available to the Buyer:
mandatorily for hazardous substances within the meaning of CLP;
mandatorily for mixtures that are not classified as hazardous but contain substances posing a hazard at a concentration requiring an SDS in accordance with Art. 31 REACH;
on request — for all Products, irrespective of classification.
Transport of hazardous substances. The Operator works exclusively with carriers holding an ADR licence (road transport) or the relevant IATA (air) / IMDG (sea) certificates. All shipments containing dangerous materials are packed in accordance with the ADR/IATA/IMDG packing instructions and labelled in accordance with the requirements.
PIC / drug precursors annex. The Operator verifies whether the Product is listed in Regulation (EU) No 649/2012 (PIC — Prior Informed Consent) or in Regulation (EC) No 273/2004 concerning drug precursors. Substances from these lists require separate procedures, authorisations, and may be subject to additional export restrictions.

§ 14. Document retention and archiving

The Operator retains sanctions and export compliance documentation for the periods arising from the provisions of law and from internal policy:

Document	Retention period	Basis
End-Use Declaration	10 years from shipment	Art. 8 para. 5 of Regulation 2021/821
Manual review decisions	10 years from the decision	Internal policy + Art. 5 para. 1 letter e GDPR
Geo-block logs	5 years from the event	Internal policy + Art. 5 GDPR
Invoices and customs declarations	5 years from the end of the tax year in which the activity was carried out	Art. 86 § 2 of the Tax Ordinance + Art. 112 of the VAT Act
BTI (if obtained)	3 years from issue + 5 years of archiving	Art. 33 of the Union Customs Code
Correspondence with state authorities	10 years from the close of the case	Internal policy
AML / GIIF reports	5 years from the report	Art. 49 of the Act on counteracting money laundering

Form of retention. The documentation is retained in electronic form in the Operator’s compliance system with mechanisms for:
integrity (SHA-256 hash + timestamp);
non-repudiation (the Operator’s qualified signature for internal documents subject to audit);
recoverability (backups in three locations: cyber_Folks S.A. hosting + the Operator’s local server backup + an offline drive managed by the Member of the Management Board).
Access. Access to the compliance documentation is restricted to:
the Member of the Management Board of the Operator;
the designated compliance officer of the Operator;
the Operator’s legal advisers bound by a confidentiality agreement;
state authorities under the statutory procedure (upon request together with a legal basis).
Destruction of documentation. After the retention period has elapsed, the documentation is destroyed in accordance with a procedure ensuring permanent removal (overwrite + cryptographic erasure). The destruction is recorded in a protocol.

§ 15. Change history

Version	Date	Author	Scope of changes
1.0	2026-05-22	Operator	First publication of the Sanctions and Export Policy. Initial geo-block list: RU, BY, IR, KP, SY. EUD threshold: EUR 10,000. No manual review procedure.
1.1	2026-05-24	Operator	Expansion of the geo-block list to include CU, VE, MM. Correction of the EUD threshold to EUR 5,000. Addition of proactive AML thresholds.
2.0	2026-06-06	Operator	Full refactoring of the document. Introduction of the Qualified Buyer construct (KOP). Addition of 3-tier value thresholds (EUR 1k / 5k). Full manual review procedures (up to 5 business days). Expanded catalogue of state authorities. Appeal procedure. Full legal basis (Regulation 833/2014 package 14, the Strategic Trade Act, REACH/CLP). Update clause. Correction of the citation of Art. 124 PL in line with the current consolidated text Journal of Laws 2025, item 750. Introduction of rules on cooperation with OFAC/OFSI. Self-reporting policy. Internal whistleblowing procedure. Retention rules of 5–10 years. Default HS Code classification (2933.79.00 + 3822.00.00 + 3504.00.90).

§ 16. Bibliography

EU sanctions regulations:

Council Regulation (EU) No 833/2014 of 31 July 2014 concerning restrictive measures in view of Russia’s actions destabilising the situation in Ukraine (OJ EU L 229, 31.07.2014, p. 1) — as amended, including package 14 introduced by Council Regulation (EU) 2024/1745 of 24 June 2024.
Council Regulation (EU) No 269/2014 of 17 March 2014 concerning restrictive measures in respect of actions undermining or threatening the territorial integrity, sovereignty and independence of Ukraine (OJ EU L 78, 17.03.2014, p. 6).
Council Regulation (EC) No 765/2006 of 18 May 2006 concerning restrictive measures in view of the situation in Belarus (OJ EU L 134, 20.05.2006, p. 1) — as amended.
Council Regulation (EU) No 267/2012 of 23 March 2012 concerning restrictive measures against Iran (OJ EU L 88, 24.03.2012, p. 1).
Council Regulation (EU) No 36/2012 of 18 January 2012 concerning restrictive measures in view of the situation in Syria (OJ EU L 16, 19.01.2012, p. 1).
Council Regulation (EU) No 401/2013 of 2 May 2013 concerning restrictive measures in respect of Myanmar/Burma (OJ EU L 121, 03.05.2013, p. 1).
Council Regulation (EU) 2017/2063 of 13 November 2017 concerning restrictive measures in view of the situation in Venezuela (OJ EU L 295, 14.11.2017, p. 21).
Council Regulation (EU) 2017/1509 of 30 August 2017 concerning restrictive measures against the Democratic People’s Republic of Korea (OJ EU L 224, 31.08.2017, p. 1).
Regulation (EU) 2021/821 of the European Parliament and of the Council of 20 May 2021 setting up a Union regime for the control of exports, brokering, technical assistance, transit and transfer of dual-use items (OJ EU L 206, 11.06.2021, p. 1).

EU chemical regulations:

Regulation (EC) No 1907/2006 of the European Parliament and of the Council of 18 December 2006 concerning the Registration, Evaluation, Authorisation and Restriction of Chemicals (REACH) (OJ EU L 396, 30.12.2006, p. 1).
Regulation (EC) No 1272/2008 of the European Parliament and of the Council of 16 December 2008 on the classification, labelling and packaging of substances and mixtures (CLP) (OJ EU L 353, 31.12.2008, p. 1).
Regulation (EU) No 649/2012 of the European Parliament and of the Council of 4 July 2012 concerning the export and import of hazardous chemicals (PIC) (OJ EU L 201, 27.07.2012, p. 60).
Regulation (EC) No 273/2004 of the European Parliament and of the Council of 11 February 2004 on drug precursors (OJ EU L 47, 18.02.2004, p. 1).

Polish acts:

The Act of 29 November 2000 on trade with foreign countries in goods, technologies and services of strategic importance for State security and for the maintenance of international peace and security (Journal of Laws 2024, item 1075, as amended).
The Act of 13 April 2022 on special measures to counter support for aggression against Ukraine and serving to protect national security (Journal of Laws 2024, item 507).
The Act of 1 March 2018 on counteracting money laundering and terrorist financing (consolidated text: Journal of Laws 2023, item 1124, as amended).
The Act of 6 September 2001 — Pharmaceutical Law (consolidated text: Journal of Laws 2025, item 750).
The Act of 23 April 1964 — Civil Code (consolidated text: Journal of Laws 2024, item 1061, as amended).
The Act of 6 June 1997 — Penal Code (consolidated text: Journal of Laws 2024, item 17, as amended).
The Act of 10 September 1999 — Fiscal Penal Code (consolidated text: Journal of Laws 2024, item 628, as amended).
The Act of 16 November 2016 on the National Revenue Administration (consolidated text: Journal of Laws 2025, item 200).
The Act of 14 June 2024 on the protection of whistleblowers (Journal of Laws 2024, item 928).
The Act of 11 March 2004 on the tax on goods and services (consolidated text: Journal of Laws 2024, item 361, as amended).

International acts:

UN Security Council resolutions concerning the DPRK: 1718 (2006), 1874 (2009), 2270 (2016), 2321 (2016), 2371 (2017), 2375 (2017), 2397 (2017).
Council Common Position 2008/944/CFSP of 8 December 2008 defining common rules governing control of exports of military technology and equipment (OJ EU L 335, 13.12.2008).
The U.S. Department of the Treasury Office of Foreign Assets Control — Specially Designated Nationals and Blocked Persons List (SDN List), updated on an ongoing basis.
UK Sanctions List maintained by OFSI (Office of Financial Sanctions Implementation), HM Treasury.

Implementing acts and supporting documents:

ECHA guidance for applicants and registrants of substances under REACH.
Common Position 2008/944/CFSP — criteria for the assessment of export authorisations.
Wassenaar Arrangement on Export Controls for Conventional Arms and Dual-Use Goods and Technologies.

§ 17. Final clause

This Sanctions Policy enters into force on 6 June 2026 and supersedes all earlier versions of this document.
The Operator reserves the right to update the Policy in an extraordinary manner (outside the quarterly cycle), in particular in the event of:
the entry into force of a new EU/UN/OFAC/OFSI sanctions package;
the addition of new entities to the Sanctions List;
a change in the interpretation by state authorities of the obligations of exporters;
a ruling of the CJEU or of national courts changing the practice of applying the provisions. An update of the Policy does not require an annex to the contract with the Buyer.
In matters not regulated by this Policy, the mandatorily applicable provisions of Polish law and European Union law apply, in particular the EU sanctions regulations, the Act on trade with foreign countries in goods, technologies and services of strategic importance, REACH, CLP, the Pharmaceutical Law, the Civil Code and the Penal Code.
In the event of any doubts as to the interpretation of the content of the Policy, its application, or the compliance of a specific order with the sanctions regime, the Operator’s compliance officer should be contacted at: compliance@purepoint.pl.
In the event of any conflict between the content of this Policy and the content of the Store Terms and Conditions — the Sanctions Policy takes precedence to the extent that it concerns compliance with the sanctions and export provisions.
The language of the document is Polish. Translations into other languages are for information purposes only; in the event of any discrepancy, the Polish version prevails.

Document prepared by the Operator’s compliance function — FIRSTSTONE TRADING sp. z o.o. — in compliance with the EU/UN/US/PL provisions applicable as at 6 June 2026. Next review scheduled: 6 September 2026.

Legal contact: compliance@purepoint.pl General contact: contact@purepoint.pl ADE (e-Delivery): AE:PL-21312-60691-FGBFV-19