Appendix #2

APPENDIX 2

Procedure for Processing Requests from Government Authorities and Authorized Third Parties

1. General Provisions and Principles

1.1. This Procedure defines the terms and procedures under which the Platform (Marketplace) processes requests for the provision of information about Users and their actions on the Platform received from law enforcement agencies, judicial authorities, other state (municipal) authorities (hereinafter, "Government Authorities"), as well as from authorized representatives of third parties acting on the basis of lawful legal procedures (for example, attorney requests, requests within civil or arbitration cases where a relevant court act is available).

1.2. The Platform strives to protect the confidentiality of its Users’ data and to respect their rights to privacy. At the same time, the Platform is obliged to comply with the applicable laws of the jurisdictions in which it operates and to cooperate with Government Authorities in the manner established by law.

1.3. Key principles of request processing:
* Legality: The Platform provides data only where sufficient legal grounds exist and where they are executed in accordance with applicable law.
* Necessity and Proportionality: The scope of the data provided is limited to the information directly specified in the request and necessary to achieve the lawful purposes stated therein. The Platform does not provide excessive information.
* User Data Protection: When processing requests, the Platform takes measures to protect Users’ data from unauthorized access and disclosure beyond the amounts required by law.

2. Grounds for Providing Information

2.1. The Platform may provide information about Users and their actions on the Platform to Government Authorities or authorized third parties where one of the following grounds exists:
* An official, legally binding request from a Government Authority, executed in strict accordance with the requirements of the applicable law of the Platform’s jurisdiction and/or the jurisdiction of the requesting authority (where relevant international agreements exist), including, but not limited to:
* A court ruling (court order, warrant).
* A request from investigative bodies, inquiry bodies, or the prosecutor’s office, issued within an initiated criminal case or a review of a crime report, specifying the specific legal provisions granting the right to request information.
* Requests from other authorized government authorities (for example, tax, antimonopoly, consumer protection authorities) within their competence and where lawful grounds exist.
* Emergency circumstances: In exceptional cases, where there is an immediate threat to the life or serious physical harm of a User, Platform employees, or third parties, the Platform may voluntarily provide a limited amount of information necessary to prevent such a threat, with subsequent notification of the relevant authorities and obtaining a formal request, if applicable. The decision to disclose information in emergency cases is made by authorized Platform employees.
* User Consent: Based on the User’s explicit, informed, and voluntary consent to provide their data to a specific person or authority.
* Compliance with legal requirements on countering the legalization (laundering) of proceeds of crime and the financing of terrorism (AML/CFT), if applicable to the Platform’s activities and the specific request.

3. Request Processing Procedure

3.1. Form and content of the request:
* The request must be submitted in writing on the official letterhead of the requesting authority (or in electronic form from the official email address of the agency, with subsequent provision of the original if necessary) and signed by an authorized official.
* The request must clearly specify:
* The full name of the requesting Government Authority or the details of the authorized third party.
* The legal basis for the request with references to specific provisions of law granting the right to request information.
* The purpose of the request (for example, investigation of a specific criminal case, verification of information within administrative proceedings, enforcement of a court decision).
* Precise identification of the User or data to be provided (for example, User ID, nickname, email, IP addresses, activity period, specific goods/services, transaction history, etc.). General requests ("all data about User X") may be rejected or returned for clarification.
* The specific time period for which information is requested, if applicable.
* Contact details of the responsible officer (full name, position, telephone, official email) for prompt communication and clarification.
* For requests from authorized third parties (non-government authorities) – a copy of a document confirming their authority and legal grounds for the request (for example, a certified copy of a court decision, an attorney’s warrant indicating the case details).

3.2. Review and validation of the request:
* Legal review: The Platform conducts a legal review of each request for its compliance with the applicable law of the Platform’s jurisdiction and, where relevant, international agreements (for example, mutual legal assistance treaties - MLAT).
* Territorial jurisdiction: Special attention is paid to the territorial jurisdiction of the requesting authority and the applicability of its powers to data controlled by the Platform.
* Completeness and correctness: The Platform checks the presence of all required information according to clause 3.1.
* If the request is improperly executed, insufficiently specific, lacks sufficient legal basis, or exceeds the competence of the requesting authority, the Platform reserves the right to:
* Reject the request, stating the reasons.
* Request additional information or clarifications.
* Challenge the request in the manner prescribed by law.

3.3. Types of data provided:
* The categories of data that may be provided are determined by the specific request and applicable law. This may include:
* User account information (for example, username/nickname, email address, registration date, login IP addresses, history of profile data changes).
* Data on goods and services listed by the Seller (descriptions, prices, change history).
* Transaction history (dates, amounts, transaction identifiers, but without disclosure of the content of the digital goods themselves, unless required by law and technically possible).
* Communication metadata (for example, logs of messages between Users through the Platform’s internal system, if such logs are stored and their provision is lawfully requested), but not the content of the messages themselves, unless there is a direct court decision authorizing access to the content of communications.
* The Platform adheres to the principle of data minimization and provides only the information that is directly requested and necessary for the purposes of the request.

3.4. User Notification:
* The Platform’s policy is to notify the User of receipt of a request for their data before disclosure, unless prohibited by law (for example, by a court non-disclosure order within an investigation), or if the Platform believes in good faith that notification may create a risk of harm (physical or otherwise), facilitate the destruction of evidence, obstruct an investigation, or otherwise violate the law.
* The decision on whether to notify or not notify the User is made in each specific case, taking into account all circumstances.

3.5. Request processing timeframes:
* The Platform strives to process requests as quickly as possible, but no later than the deadlines established by applicable law for responding to the relevant types of requests.
* The processing timeframe depends on the scope and complexity of the request and the need for additional legal review or technical measures.
* In emergency cases (according to clause 2.1.b), the Platform strives to provide a response immediately or within the shortest possible time.

3.6. International requests:
* Requests from foreign Government Authorities are processed in accordance with the applicable law of the Platform’s jurisdiction and international legal assistance agreements (for example, MLAT) or through letters rogatory procedures.
* The Platform may require that such requests be sent through official diplomatic or legal channels established for international cooperation.

3.7. Record keeping:
* The Platform maintains internal records of requests received, checks performed, decisions made, and responses provided in accordance with its internal policies and legal requirements for data retention.

3.8. Contact information for submitting requests:
* To submit official requests, Government Authorities and authorized third parties must use the following dedicated communication channel: [email protected]. Requests sent through other channels may be processed with delay or may not be accepted for consideration.

4. Liability and Updating of the Procedure

4.1. The Platform is not liable for unlawful actions of Government Authorities or authorized third parties related to the use of information lawfully provided.

4.2. This Procedure may be periodically updated by the Platform to reflect changes in legislation or internal policy. The current version of the Procedure is published on the Platform’s official website or provided upon request.