User Account Terms

Shop Operator and Account Administrator: FIRSTSTONE TRADING spółka z ograniczoną odpowiedzialnością (abbreviation: FIRSTSTONE TRADING sp. z o.o.) KRS: 0001254766 | NIP: 7831958614 District Court Poznań – Nowe Miasto i Wilda in Poznań, 8th Commercial Division of the National Court Register Date of registration: 17 February 2026 Registered office: ul. Wierzbięcice 44A/40A, 61-568 Poznań, województwo wielkopolskie Voivodeship Correspondence and Shop service address: ul. Wierzbięcice 44A/40A, 61-568 Poznań Share capital: PLN 5,000.00 (100 shares of PLN 50.00 each) Representation: Krystian Dawidowski — Member of the Management Board (sole management board, independent representation) E-mail address (account matters): contact@purepoint.pl E-mail address (compliance and data protection matters): compliance@purepoint.pl e-Delivery address (ADE): AE:PL-21312-60691-FGBFV-19

Telephone contact is available to Buyers holding an active Account in the order service panel and — in urgent matters — at compliance@purepoint.pl.

Document version: 2.0 Effective date: 6 June 2026

---

Table of contents

• § 1. Purpose of the Account Terms
• § 2. Definitions
• § 3. Account registration
• § 4. Verification of Qualified Buyer status
• § 5. Login, password and Account security
• § 6. Account functionality
• § 7. Modification of Account data
• § 8. Account deletion at the Account Holder’s request
• § 9. Consequences of false declarations
• § 10. Suspension and termination of the Account by the Operator
• § 11. Complaints regarding the operation of the Account
• § 12. Final provisions
• § 13. Bibliography
• § 14. Change history
• § 15. Closing clause

---

§ 1. Purpose of the Account Terms

1. These User Account Terms (hereinafter: “Account Terms”) set out the rules for creating, using, modifying, suspending, blocking and deleting a User Account in the Service under the domain purepoint.pl, operated by the Operator named in the header.
2. The Account Terms constitute a document separate from the Shop Terms at /regulamin/. The Shop Terms govern the rules for concluding, performing and settling Sales Agreements for Products (Research Materials). The Account Terms govern solely the organisational and technical matters relating to maintaining the Account as a service provided by electronic means within the meaning of the Act of 18 July 2002 on the provision of electronic services (consolidated text: Journal of Laws 2020 item 344, as amended; hereinafter: “uśude”).
3. In matters not regulated by these Account Terms, the provisions of the Shop Terms (/regulamin/), the Privacy Policy (/polityka-prywatnosci/), the Cookie Policy (/polityka-cookies/) and the generally applicable provisions of Polish and European Union law shall apply.
4. Holding an active Account is a necessary condition for placing an Order in the Shop. Due to the Qualified Buyer model, which requires prior verification of status and the submission and recording of a Qualified Profile Declaration (KOP) before checkout (Shop Terms § 1 para. 5, § 4 para. 1), the Shop does not provide a “guest” purchase mode. Each Order is preceded by Account registration and a positive verification of Qualified Buyer status.
5. The purpose of the Account comes down to: 1) facilitating contact between the Operator and the Account Holder in respect of the performance of Sales Agreements; 2) storing transaction data (order history, invoices, Product quality documentation); 3) providing a durable medium for the Qualified Profile Declaration (KOP) submitted by the Qualified Buyer; 4) enabling the use of functions reserved for verified Qualified Buyers, including access to the order service telephone and specialist product documentation (Certificates of Analysis — COA, safety data sheets — SDS).

§ 2. Definitions

For the purposes of these Account Terms, the following terms shall have the meanings set out below:

1. Service — the Shop website under the domain purepoint.pl together with subdomains and administrative panels made available to Account Holders.
2. Shop — the e-commerce functionality of the Service enabling the conclusion of Sales Agreements for Products (Research Materials).
3. Account — a separate space within the Service, accessible upon entering an individual login (e-mail address) and password, containing the Account Holder’s data and the functionalities listed in § 6.
4. Account Holder (User) — the person for whom the Account has been created and is maintained. In accordance with the Operator’s policy (Shop Terms § 4), an Account may be maintained solely for a Qualified Buyer.
5. Qualified Buyer (QB) — a natural person conducting business activity, a legal person or an organisational unit without legal personality to which the law grants legal capacity, purchasing Products for a purpose directly connected with conducted business, professional, research or academic activity (Art. 43(1) of the Act of 23 April 1964 — Polish Civil Code, consolidated text: Journal of Laws 2024 item 1061, as amended; hereinafter: “CC”), excluding a consumer within the meaning of Art. 22(1) CC. The detailed categories of QB (STUDENT, LAB, SCIENTIST, BIZ_RD, OTHER_PRO) and the verification procedure are set out in § 4 of the Shop Terms.
6. KOP — Qualified Profile Declaration — a set of five compliance declarations, a declaration of the Qualified Buyer category, and supplementary data (NIP, ORCID, name of institution, field of study, PKD code, description of activity), submitted in the course of Account registration and stored on a durable medium in the Account panel.
7. Session cookies — cookie files deleted automatically upon termination of the browser session, necessary to maintain the Account Holder’s logged-in state. They constitute functional cookies (Art. 173 para. 3 of the Act of 16 July 2004 — Telecommunications Law, consolidated text: Journal of Laws 2024 item 1221, as amended; hereinafter: “TL”) and do not require separate consent from the Account Holder.
8. 2FA (Two-Factor Authentication) — an optional mechanism for additional protection of the Account, requiring — in addition to the password — entry of a one-time code generated by a TOTP application (e.g. Google Authenticator, Authy) or sent to the Account Holder’s e-mail.
9. Research Material (Product) — a peptide or chemical compound intended exclusively for research purposes in vitro or ex vivo, not being a medicinal product within the meaning of Art. 2 point 32 of the Act of 6 September 2001 — Pharmaceutical Law (consolidated text: Journal of Laws 2025 item 750; hereinafter: “PL”).
10. GDPR (RODO) — Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) — OJ EU L 119 of 04.05.2016, p. 1, as amended.
11. CrimC — the Act of 6 June 1997 — Criminal Code (consolidated text: Journal of Laws 2024 item 17, as amended).
12. CRA — the Act of 30 May 2014 on consumer rights (consolidated text: Journal of Laws 2024 item 1796, as amended).

§ 3. Account registration

1. Creating an Account is voluntary and free of charge. The sole condition for registration is the successful completion of the Qualified Buyer status verification procedure described in § 4 of these Account Terms and in § 4 of the Shop Terms.
2. Account registration takes place online in the following order: 1) Step 1 — Initiation: the user selects the “Create Account” option in the Service and provides an e-mail address to which an activation link will be sent; 2) Step 2 — E-mail verification: the user clicks the activation link sent to the provided e-mail address (link validity: 24 hours); 3) Step 3 — Password: the user sets a password meeting the security requirements set out in § 5 para. 2; 4) Step 4 — QB category and KOP: the user selects one of the five Qualified Buyer categories (STUDENT, LAB, SCIENTIST, BIZ_RD, OTHER_PRO), completes the KOP form and provides the supplementary data appropriate to the selected category; 5) Step 5 — Documents: the user attaches the documents required for the selected category (e.g. student ID card, NIP, ORCID, CEIDG/KRS entry, laboratory declaration) — details in § 4 para. 3; 6) Step 6 — Acceptance: the user accepts (by actively ticking checkbox-type fields) the Shop Terms, the Account Terms, the Privacy Policy and the Cookie Policy, and confirms having read the content of the KOP; 7) Step 7 — Submission for verification: the application is sent to the Operator’s panel; Account status: “Awaiting verification” (the Account is not active, orders cannot be placed); 8) Step 8 — Operator’s decision: within 5 (five) business days the Operator carries out the verification and decides whether to activate the Account or refuse activation (with a justification sent by e-mail).
3. The data required for registration includes: 1) first name and surname (natural person) or business name (legal person / unit); 2) correspondence address and delivery address (if different); 3) e-mail address; 4) telephone number (required for Qualified Buyers due to the obligation to make contact in matters relating to order fulfilment); 5) NIP (LAB, BIZ_RD categories; optionally other categories, if a VAT invoice is required); 6) ORCID or individual researcher identifier (SCIENTIST category); 7) student ID card number and field of study (STUDENT category); 8) PKD code (BIZ_RD: 74.10.Z, 72.11.Z, 72.19.Z, 72.20.Z or 21.20.Z); 9) a description of research or professional activity of a minimum length of 100 characters (OTHER_PRO category); 10) the content of the five KOP declarations (compliance, absence of a consumer purchasing purpose, no infringement of Art. 124 PL, awareness of Art. 233 CrimC, undertaking to report any change of status).
4. The Operator does not accept registration from persons: 1) who are minors (under 18 years of age); 2) residing or having their registered office in countries subject to geo-blocking (Russian Federation, Belarus, Iran, North Korea, Syria, Cuba, Venezuela, Myanmar); 3) in respect of whom there is a justified suspicion of an intention to infringe Art. 124 para. 1 PL, Art. 165 § 1 point 2 CrimC, or the provisions on counteracting drug addiction; 4) appearing on the sanctions list of the Minister of the Interior and Administration (implementing regulation to the Act of 13 April 2022 on special measures to counteract support for aggression against Ukraine and to protect national security, Journal of Laws 2024 item 1601) or on EU sanctions lists (CFSP).
5. An Account may be held by only one Account Holder. Sharing the password and login with third parties is prohibited and may result in suspension of the Account (§ 10 para. 2 point 4).

§ 4. Verification of Qualified Buyer status

1. Verification of Qualified Buyer status is a necessary condition for activating the Account and for the ability to place orders. The verification procedure has been comprehensively regulated in § 4 of the Shop Terms (/regulamin/) and applies in full to the Account.
2. The Operator carries out verification based on: 1) analysis of the documents and data attached by the user (the STUDENT, LAB, SCIENTIST, BIZ_RD categories are subject to automatic or semi-automatic verification; the OTHER_PRO category — solely manual verification); 2) checking the consistency of the data with public registers (CEIDG, KRS, KRS Online, ORCID Registry, the POL-on database, the PKD list of the Central Statistical Office); 3) assessment of the completeness and internal consistency of the KOP; 4) optional additional enquiries to the user (e.g. an e-mail requesting clarification or supplementation of documentation).
3. Required documents broken down by category: 1) STUDENT — a scan of the student ID card (valid in the current academic year), a certificate from the dean’s office (alternatively), a field of study within the biomedical, chemical, biotechnological or pharmaceutical scope; 2) LAB — NIP, laboratory name, CEIDG/KRS entry, a declaration by the laboratory manager as to the research purpose of the Products; 3) SCIENTIST — ORCID or individual institutional identifier, affiliation (university, PAN institute, research and development unit); 4) BIZ_RD — NIP, CEIDG/KRS entry with a PKD code: 74.10.Z (specialised design activities), 72.11.Z (research and experimental development in the field of biotechnology), 72.19.Z (other research and experimental development in the field of natural sciences and engineering), 72.20.Z (research and experimental development in the field of social sciences and humanities — exceptionally, where justified by the scope of activity), 21.20.Z (manufacture of pharmaceuticals and other pharmaceutical products — solely for a research purpose); 5) OTHER_PRO — a declaration of a minimum length of 100 characters describing the purpose of purchase, professional activity and connection with research; subject solely to manual verification within 7 business days.
4. The Operator reserves the right to refuse activation of the Account without giving a detailed reason, where the circumstances of the case indicate a risk of infringement of pharmaceutical, criminal or sanctions law. The refusal is sent to the e-mail indicated at registration and does not require further justification on the part of the Operator beyond a general indication of the basis for the refusal.
5. The Account Holder is obliged to inform the Operator without undue delay — no later than within 14 days — of any loss of Qualified Buyer status (e.g. completion of studies without continuing to second-cycle studies in a qualifying field, cessation of business activity, loss of academic affiliation). Loss of status results in suspension of the Account until re-verification in another category.

§ 5. Login, password and Account security

1. Logging in to the Account takes place by entering a login (e-mail address) and password. After five consecutive unsuccessful login attempts, the Account is temporarily blocked for 30 minutes. After ten consecutive unsuccessful attempts, the Account is blocked until contact is made with the Operator at contact@purepoint.pl.
2. Password requirements: 1) minimum length: 12 characters; 2) mandatory components: at least one uppercase letter, at least one lowercase letter, at least one digit, at least one special character; 3) prohibition on using trivial passwords (sequences such as “123456”, “password”, “qwerty”); 4) prohibition on using as a password: the login, e-mail address, first name, surname or date of birth of the Account Holder; 5) recommended password change every 180 days (recommendation based on the NIST SP 800-63B guidelines); 6) the password is stored in the Operator’s database in the form of a cryptographic hash (bcrypt algorithm with a cost parameter ≥ 12) — the Operator has no technical ability to recover the password.
3. Two-Factor Authentication (2FA): 1) 2FA is optional and configurable in the Account panel; 2) supported methods: a TOTP application (Google Authenticator, Authy, Microsoft Authenticator) or a one-time code sent by e-mail; 3) activation of 2FA is voluntary but strongly recommended for Qualified Buyers placing orders above PLN 5,000.00; 4) in the event of loss of access to the device with the TOTP application, recovery of access requires a verification procedure (an e-mail with a link to the registration address + optionally backup codes generated upon activation of 2FA).
4. Session cookies and session management: 1) after a successful login, the Operator saves session cookies in the Account Holder’s browser, necessary to maintain the logged-in state; 2) session cookies are deleted automatically upon closing the browser or after 60 minutes of inactivity; 3) session cookies do not require separate consent under Art. 173 para. 3 point 2 TL — they are technical and necessary for the provision of the service requested by the Account Holder; 4) simultaneous active sessions on different devices are permitted; however, the Account Holder may in the Account panel force logout from all devices.
5. Account Holder’s security obligations: 1) keeping the password confidential and not leaving it in a place accessible to third parties; 2) immediately notifying the Operator (contact@purepoint.pl) of any suspicion that access to the Account has been gained by an unauthorised third party; 3) immediately changing the password in the event of a suspicion that it has been disclosed; 4) logging out of the Account after finishing work, in particular when using shared or public devices; 5) installing and updating antivirus software and operating system security updates on devices used for logging in.
6. The Operator shall not be liable for damage arising as a result of the Account Holder making the login or password available to third parties, failure to exercise due care in securing the Account, or use of the Account from devices infected with malware.

§ 6. Account functionality

1. An active Qualified Buyer Account provides the following functionalities: 1) Order history — a full list of orders with access to invoices, shipping documents and fulfilment status; 2) Product documentation — access to Certificates of Analysis (COA), safety data sheets (SDS) and quality documents associated with a specific order; 3) Invoice details — the ability to save a default set of invoice details (company, NIP, address); 4) Delivery addresses — the ability to save multiple delivery addresses and select a default one; 5) Communication preferences — management of the newsletter subscription (Brevo / Sendinblue SAS), transactional notifications and marketing preferences; 6) Operator telephone — access to a dedicated order service telephone number, available solely to logged-in Account Holders (the number is displayed in the panel); 7) QB verification status — information on the current verification status (verified / awaiting re-verification / lost); 8) Durable medium for the KOP — the ability to download in PDF format the content of the Qualified Profile Declaration together with the date of submission, a timestamp and a document hash; 9) GDPR data export — a button enabling the download of all of the Account Holder’s personal data in a structured format (CSV/JSON) — exercise of the right to data portability (Art. 20 GDPR); 10) Account deletion — a button initiating the Account deletion procedure in accordance with § 8; 11) 2FA management — activation, deactivation, regeneration of backup codes.
2. The Account functionality does not include: 1) the ability to place telephone orders — all orders must be placed in the Shop from within the Account; 2) access to the data of other Account Holders; 3) the ability for the Account Holder to publish content (no forum, no public reviews — reviews are collected solely in written form via compliance@purepoint.pl).
3. The Operator reserves the right to expand the Account functionality, of which the Account Holder will be informed in the Account panel or by e-mail at least 14 days in advance.

§ 7. Modification of Account data

1. The Account Holder may at any time modify their data in the Account panel, in particular: 1) delivery address, correspondence address; 2) telephone number; 3) communication preferences; 4) access password; 5) 2FA settings.
2. Modification of data critical from the point of view of QB verification (NIP, ORCID, QB category, legal entity data) requires the Operator’s acceptance and may involve the need for re-verification of Qualified Buyer status. Until re-verification, the Account may be temporarily suspended with regard to the ability to place new orders.
3. Changing the e-mail address (login) requires a two-step procedure: 1) confirmation from the old e-mail address (verification link); 2) confirmation of the new e-mail address (activation link).
4. The Account Holder is obliged to keep their data up to date. The Operator shall not be liable for the consequences of failure to deliver correspondence or Products to outdated data provided in the Account.

§ 8. Account deletion at the Account Holder’s request

1. The Account Holder may at any time request deletion of the Account: 1) via the “Delete Account” button in the Account panel (self-service procedure); 2) by sending a request to compliance@purepoint.pl from the e-mail address registered as the Account login.
2. Account deletion procedure: 1) receipt of the request; 2) confirmation of the Account Holder’s identity (verification link sent by e-mail); 3) a warning regarding the irreversibility of the operation and display of information on the retention of transaction data; 4) final confirmation by the Account Holder; 5) execution of Account deletion within 7 business days.
3. Data retention after Account deletion: 1) Transaction data (invoices, orders, KOP, shipping documentation) — stored for 5 years from the end of the tax year in which the tax obligation arose, on the basis of Art. 70 § 1 of the Act of 29 August 1997 — Tax Ordinance (consolidated text: Journal of Laws 2025 item 111, as amended) and Art. 86 § 1 of that Act in connection with the accounting regulations and the Act of 11 March 2004 on the tax on goods and services (consolidated text: Journal of Laws 2024 item 361, as amended); 2) System logs (server logs, access logs, 2FA logs) — stored for 30 days, for IT security and audit purposes in accordance with Art. 6 para. 1 point (f) GDPR (legitimate interest of the Operator); 3) Marketing data (newsletter, preferences) — deleted without undue delay, no later than within 30 days; 4) Password hash — deleted without undue delay together with the Account.
4. After deletion of the Account, its restoration is not possible. New registration requires repeating the QB verification procedure.
5. Deletion of the Account does not release the Account Holder from obligations arising from previously concluded Sales Agreements, nor does it cause the expiry of the tax obligations of either party.
6. The Account Holder retains the full rights arising from Art. 15-22 GDPR also after deletion of the Account — in respect of data stored within the framework of statutory retention (e.g. a request to inspect archived invoices is handled by means of an application to compliance@purepoint.pl).

§ 9. Consequences of false declarations

1. Making a false declaration in the content of the KOP, in particular: 1) declaring Qualified Buyer status while the purchase is made for a consumer, medical, therapeutic, cosmetic or other purpose outside the research and scientific scope; 2) declaring a false academic affiliation, a false ORCID, a false NIP or a false business activity; 3) concealing the intention to introduce the Products into the human or animal organism (other than in vitro / ex vivo models);

results in: 1) immediate blocking of the Account without prior warning; 2) cancellation of unfulfilled orders without any right to compensation; 3) filing a notification of a suspected offence with the competent law enforcement authorities, including the National Police Headquarters, the District Prosecutor’s Office competent for the Operator’s registered office and — in cases of infringement of pharmaceutical law — the Chief Pharmaceutical Inspector; 4) pursuit of claims for damages against the Account Holder on the basis of Art. 471 CC (contractual liability) and Art. 415 CC (tort liability). 2. Legal bases of the Account Holder’s criminal liability: 1) Art. 233 § 6 in conjunction with § 1 CrimC — the provisions of § 1–5 of Art. 233 CrimC apply accordingly to a person who makes a false declaration, where a statutory provision provides for the possibility of taking the declaration under pain of criminal liability; a false declaration is punishable by imprisonment of 6 months to 8 years — in cases where the KOP is taken and used as evidence in proceedings conducted on the basis of the Act; [VERIFY with legal counsel whether the KOP satisfies the condition that “a statutory provision provides for the rigour of criminal liability” — see the TO COUNSEL list]; 2) Art. 124 para. 1 of the Act of 6 September 2001 — Pharmaceutical Law (consolidated text: Journal of Laws 2025 item 750, previously Journal of Laws 2024 item 686, as amended) — “Whoever, without the required authorisation, places a medicinal product on the market, shall be liable to a fine, the penalty of restriction of liberty or imprisonment for up to 2 years.” — where the false declaration enabled the obtaining of a Product subsequently used for unlawful distribution as a medicinal product; 3) Art. 165 § 1 point 2 CrimC — causing a danger to the life or health of many persons by placing on the market substances harmful to health; 4) Art. 286 § 1 CrimC — fraud committed for the purpose of obtaining a financial gain. 3. The Operator cooperates with law enforcement authorities to the full extent required by law and may transfer the Account Holder’s data, the content of the KOP, the login history, the content of orders and evidence of communication without the need to obtain the Account Holder’s consent — on the basis of Art. 6 para. 1 points (c) and (e) GDPR and the applicable provisions of criminal procedure. 4. The Account Holder acknowledges that civil and criminal liability rests solely with their person and is not subject to limitation or exclusion by way of agreement.

§ 10. Suspension and termination of the Account by the Operator

1. The Operator may suspend the Account with immediate effect where at least one of the following circumstances occurs: 1) a justified suspicion of infringement of § 9 of these Account Terms (a false declaration in the KOP); 2) a justified suspicion of infringement of Art. 124 para. 1 PL, Art. 165 CrimC, or the provisions on counteracting drug addiction; 3) detection of unauthorised access to the Account by a third party; 4) making the login and password available to third parties; 5) an attempt to circumvent the QB verification procedures, including the submission of forged or outdated documents; 6) failure to settle overdue payments arising from concluded Sales Agreements; 7) a request for suspension submitted by law enforcement authorities or on the basis of a court order; 8) entry of the Account Holder or an associated entity on sanctions lists (CFSP, MSWiA); 9) a change of the address of residence to a state subject to geo-blocking (§ 3 para. 4 point 2).
2. Suspension procedure: 1) the Operator sends a notification of Account suspension to the e-mail address assigned to the Account, indicating the basis for the suspension (subject to the limitations arising from the provisions of criminal procedure — in some cases the basis may be indicated in general terms); 2) suspension of the Account blocks the ability to place new orders but does not halt the fulfilment of already accepted orders (unless the Operator expressly halts fulfilment); 3) the Account Holder has the right to lodge an appeal against the suspension decision within 14 days of the date of receipt of the notification, to the address compliance@purepoint.pl; 4) the Operator examines the appeal within 14 business days and informs the Account Holder of its decision together with a justification.
3. Termination of the Account (permanent deletion) may occur in the event of: 1) rejection of the appeal against suspension of the Account; 2) an indisputable finding of the infringements referred to in para. 1 points 1, 2, 5 or 8; 3) permanent inactivity (over 24 months without an order and without logging in) — following prior notification 30 days in advance.
4. Termination of the Account by the Operator does not release the Account Holder from financial obligations, nor does it deprive them of the rights arising from Art. 15-22 GDPR in respect of data subject to statutory retention.
5. Procedure for appealing against a decision to terminate the Account: 1) the appeal is lodged to the address compliance@purepoint.pl within 14 days; 2) the Operator examines the matter within 30 business days; 3) in the event of rejection of the appeal, the Account Holder has the right to pursue claims by judicial means in accordance with § 15 para. 4 of the Shop Terms.

§ 11. Complaints regarding the operation of the Account

1. Complaints regarding the operation of the Account (technical errors, login problems, unavailability of the panel) should be reported: 1) by e-mail to contact@purepoint.pl (technical matters); 2) by e-mail to compliance@purepoint.pl (QB verification, suspension, termination matters).
2. A complaint should contain: 1) the Account login (e-mail address); 2) a description of the problem; 3) the date and approximate time the problem occurred; 4) any screenshots or error messages.
3. The Operator examines complaints within 14 days of receipt of the complete report and informs the Account Holder of the manner of resolution of the matter by electronic means.
4. Complaints regarding Products (not the operation of the Account) are subject to the procedure described in the Shop Terms (/regulamin/).

§ 12. Final provisions

1. The Operator may introduce changes to these Account Terms. Account Holders are informed of changes by electronic means at least 14 days in advance of their entry into force. Failure to accept the new version of the Account Terms entitles the Account Holder to request deletion of the Account in accordance with § 8.
2. Any disputes arising from these Account Terms are resolved before the court competent for the Operator’s registered office — the District Court Poznań – Nowe Miasto i Wilda in Poznań. The applicable law is Polish law, in accordance with Regulation (EC) No 593/2008 of the European Parliament and of the Council of 17 June 2008 on the law applicable to contractual obligations (Rome I) and Regulation (EU) No 1215/2012 on jurisdiction and the recognition and enforcement of judgments in civil and commercial matters (Brussels I bis).
3. The Account Holder acknowledges that the Operator applies an exclusion of the warranty for defects in B2B transactions on the basis of Art. 558 § 1 CC. The limitations of the Operator’s liability and the cap on liability up to the value of the order and the cost of shipping apply in accordance with the Shop Terms.

§ 13. Bibliography

Legal acts — Polish law:

1. Act of 23 April 1964 — Polish Civil Code (consolidated text: Journal of Laws 2024 item 1061, as amended).
2. Act of 6 June 1997 — Criminal Code (consolidated text: Journal of Laws 2024 item 17, as amended).
3. Act of 6 September 2001 — Pharmaceutical Law (consolidated text: Journal of Laws 2025 item 750, previously Journal of Laws 2024 item 686, as amended).
4. Act of 18 July 2002 on the provision of electronic services (consolidated text: Journal of Laws 2020 item 344, as amended).
5. Act of 16 July 2004 — Telecommunications Law (consolidated text: Journal of Laws 2024 item 1221, as amended).
6. Act of 30 May 2014 on consumer rights (consolidated text: Journal of Laws 2024 item 1796, as amended).
7. Act of 29 August 1997 — Tax Ordinance (consolidated text: Journal of Laws 2025 item 111, as amended).
8. Act of 11 March 2004 on the tax on goods and services (consolidated text: Journal of Laws 2024 item 361, as amended).
9. Act of 13 April 2022 on special measures to counteract support for aggression against Ukraine and to protect national security (Journal of Laws 2024 item 1601, as amended).

Legal acts — EU law:

10. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) — OJ EU L 119 of 04.05.2016, p. 1, as amended.
11. Regulation (EC) No 593/2008 of the European Parliament and of the Council of 17 June 2008 (Rome I) — OJ EU L 177 of 04.07.2008, p. 6.
12. Regulation (EU) No 1215/2012 of the European Parliament and of the Council of 12 December 2012 (Brussels I bis) — OJ EU L 351 of 20.12.2012, p. 1.

Decisions and guidelines of authorities:

13. UODO Decision 02/2025 of 18 February 2025 — administrative fine of EUR 420,000 for an asymmetric cookie consent mechanism.
14. NIST Special Publication 800-63B — Digital Identity Guidelines: Authentication and Lifecycle Management (2017, revision 2024).

Internal documents of the Operator:

15. purepoint.pl Shop Terms, version 2.0 of 6 June 2026 (/regulamin/).
16. purepoint.pl Privacy Policy, version 2.0 of 6 June 2026 (/polityka-prywatnosci/).
17. purepoint.pl Cookie Policy, version 2.0 of 6 June 2026 (/polityka-cookies/).

§ 14. Change history

Version	Date	Author	Scope of changes
1.0	2026-05-22	Compliance FIRSTSTONE TRADING	First version of the Account Terms — baseline draft
1.0.1	2026-05-24	Compliance FIRSTSTONE TRADING	Editorial corrections, supplementation of §§ on data retention
2.0	2026-06-06	Compliance FIRSTSTONE TRADING	Full revision: introduction of the Qualified Buyer (QB) concept, the five QB categories (STUDENT/LAB/SCIENTIST/BIZ_RD/OTHER_PRO), the KOP as a legal institution, correction of the citation of Art. 124 PL (up to 2 years — the earlier version incorrectly cited 8 years), strengthening of password security requirements (12 characters), introduction of optional 2FA, clarification of data retention after Account deletion (5 years / 30 days), expansion of § 9 and § 10

§ 15. Closing clause

In matters not regulated by this document, the mandatorily applicable provisions of Polish and European Union law shall apply. In the event of interpretation doubts, contact compliance@purepoint.pl.

---

Document prepared by the Compliance Department of FIRSTSTONE TRADING sp. z o.o. Legal status as at 6 June 2026.