CONSENT TO THE PROCESSING OF PERSONAL DATA

Version No. 1 dated 26 October 2026

1. GENERAL PROVISIONS
1.1. By this document, the individual who completes and submits a form on sortavala-timber.ru, or through the domains sortavala-timber.com and sortavala-sawmill.ru that redirect the user to the principal website (the “Personal Data Subject”), freely, voluntarily and in their own interest gives OOO “SORTAVALSKY LESOZAVOD” (ООО «СОРТАВАЛЬСКИЙ ЛЕСОЗАВОД»; the “Operator”) consent to process their personal data under the terms set out herein.
1.2. Operator details:
OOO “SORTAVALSKY LESOZAVOD” (ООО «СОРТАВАЛЬСКИЙ ЛЕСОЗАВОД»), a limited liability company incorporated under the laws of the Russian Federation (brand name: Sortavala Timber Mill)
Primary State Registration Number (OGRN): 1131001014539
Taxpayer Identification Number (INN): 1001276733
Tax Registration Reason Code (KPP): 100701001
Address: 8 Rautakangas settlement, Sortavala, Republic of Karelia, 186760, Russian Federation
Email address for enquiries concerning personal data processing: sortavala.timber@inbox.ru
Telephone: +7 (921) 727-45-27
1.3. Consent is provided by independently selecting a separate personal data processing consent checkbox and then submitting the website form.
1.4. Before selecting the checkbox, the Personal Data Subject is given an opportunity to read this Consent and the Personal Data Processing Policy.
1.5. The form must not be submitted unless the consent checkbox has been selected.

2. PURPOSES OF PERSONAL DATA PROCESSING
2.1. Personal data are processed for the following purposes:
— receiving, recording and considering enquiries, requests and applications;
— providing information about products, potential volumes, supply terms and delivery destinations;
— discussing supplies, cooperation and partnerships;
— preparing a response and providing the requested information;
— establishing and maintaining contact with the Personal Data Subject;
— preparing a commercial proposal;
— agreeing the specifications of a proposed supply arrangement or cooperation;
— taking steps necessary to enter into a contract at the Personal Data Subject’s request;
— recording the submission of an enquiry and the provision of consent to personal data processing;
— ensuring the security and stable operation of the website and preventing misuse of its forms.
2.2. Personal data must not be used for purposes incompatible with those specified in this Consent.

3. PERSONAL DATA PROCESSED
3.1. Under this Consent, the Operator may process the following personal data:
— name;
— telephone number;
— email address;
— content of the enquiry or message;
— organisation name;
— position;
— country or region of location;
— information about the product of interest;
— anticipated volumes, supply terms and delivery destinations;
— other information voluntarily provided by the Personal Data Subject in the form or message and directly related to the enquiry.
3.2. The following data may also be processed to record form submission, ensure website security and record the provision of this Consent:
— IP address;
— date and time of form submission;
— address of the page from which the form was submitted;
— name or identifier of the form;
— information confirming that the consent checkbox was selected;
— version number or date of this Consent;
— technical browser and device information automatically transmitted when the website is used.
3.3. The Operator does not intentionally collect special categories of personal data concerning racial or ethnic origin, political opinions, religious or philosophical beliefs, health or intimate life.
3.4. The Operator does not intentionally collect biometric personal data.
3.5. The Personal Data Subject should not include special-category personal data, biometric data, health information, passport details, bank details or other information unnecessary for considering the enquiry in free-text form fields.

4. SOURCE OF PERSONAL DATA
4.1. Personal data are provided directly by the Personal Data Subject by completing and submitting a website form, sending a message by email, or communicating subsequently with the Operator’s representatives concerning the enquiry.
4.2. The technical data listed in Clause 3.2 of this Consent may be recorded automatically by the information systems that operate the website and its forms.

5. OPERATIONS PERFORMED ON PERSONAL DATA AND PROCESSING METHODS
5.1. Consent is provided for the following operations involving personal data:
— collection;
— recording;
— organisation;
— accumulation;
— storage;
— updating;
— retrieval;
— use;
— transfer, provision and provision of access to the persons specified in Section 6 of this Consent;
— blocking;
— deletion;
— destruction.
5.2. Personal data may be processed by automated means, without automated means, or through mixed processing.
5.3. The Operator may use the contact details provided to make a telephone call or send an email solely in connection with the Personal Data Subject’s enquiry, the discussion of a potential supply arrangement or cooperation, or the preparation of a response.

6. PERSONS INVOLVED IN PERSONAL DATA PROCESSING
6.1. To achieve the purposes specified in this Consent, personal data may be transferred, provided or made available to the following persons, solely to the extent necessary for them to perform the relevant functions:
— JSC Tilda Publishing (АО «Тильда Паблишинг») — website hosting and technical operation, receipt of data through web forms, transmission of data to the Operator and processing in Tilda CRM;
— JSC Selectel (АО «Селектел») and Yandex Cloud LLC (ООО «Яндекс.Облако») — provision of infrastructure used by the Tilda platform for hosting and storing data;
— VK LLC (ООО «ВК») — operation of the Mail.ru email service through which enquiries from website users are received.
6.2. JSC Tilda Publishing processes personal data on the Operator’s instructions. Infrastructure and email service providers participate in processing within the scope of their functions and under the applicable contracts and terms of use.
6.3. These persons may perform only those operations involving personal data that are necessary to operate the website and to receive, store, transmit and consider the user’s enquiry.
6.4. Persons processing personal data on the Operator’s instructions must maintain the confidentiality and security of personal data. The Operator’s liability to the Personal Data Subject is determined in accordance with the laws of the Russian Federation.

7. RESTRICTIONS ON DATA PROCESSING AND TRANSFER
7.1. This Consent does not permit the dissemination of personal data or the provision of access to such data to an indefinite group of persons.
7.2. This Consent does not cover advertising, informational or other bulk communications. Advertising messages may be sent only with the Personal Data Subject’s separate prior consent.
7.3. This Consent does not govern the use of analytics cookies or web analytics services. Such processing is carried out on the basis of the user’s separate consent and in accordance with the Personal Data Processing Policy.
7.4. In connection with the processing described in this Consent, the Operator does not intend to transfer personal data from the Russian Federation to a foreign country. Where a person located outside the Russian Federation submits personal data directly through the website, those data are transmitted by that person to and processed in an information system located in the Russian Federation. This does not constitute a cross-border transfer by the Operator.
7.5. This Consent does not cover the processing of personal data of applicants for vacant positions or the creation of a talent pool. Separate consent must be provided for those purposes.

8. DURATION OF CONSENT AND DATA RETENTION
8.1. This Consent takes effect when it is provided and remains valid until the purposes of personal data processing have been achieved, but for no longer than one year from the Personal Data Subject’s last substantive interaction with the Operator concerning the relevant enquiry.
8.2. If the enquiry results in a contract or another legal relationship between the Personal Data Subject and the Operator, the processing of certain personal data may continue on other legal bases and for the periods established by the laws of the Russian Federation and the relevant contract.
8.3. Once the purposes of processing have been achieved or the established period has expired, the personal data must be destroyed unless another lawful basis exists for their continued processing.
8.4. Information recording the fact that Consent was obtained, its content and version, the date and time it was provided, and any subsequent withdrawal may be retained for the period during which the personal data are processed and for no longer than three years after processing ceases, solely to demonstrate the Operator’s compliance with applicable law and protect its rights and legitimate interests, provided that this does not infringe the Personal Data Subject’s rights and freedoms. Such retention after this Consent ceases to apply is based on the grounds provided by the laws of the Russian Federation.

9. WITHDRAWAL OF CONSENT
9.1. The Personal Data Subject may withdraw this Consent at any time.
9.2. A withdrawal request may be submitted:
— by email to: sortavala.timber@inbox.ru;
— by post to: 8 Rautakangas settlement, Sortavala, Republic of Karelia, 186760, Russian Federation.
9.3. The withdrawal request should preferably include:
— the applicant’s name;
— the telephone number or email address used when submitting the form;
— the approximate date of the enquiry;
— a request to cease processing personal data.
9.4. The Operator may request information necessary to identify the applicant and confirm that the personal data relate to them. The information requested must not be excessive in relation to the purpose of identification.
9.5. After receiving a withdrawal request, the Operator will cease personal data processing carried out solely on the basis of this Consent. If retention is no longer necessary for the purposes of processing and no other lawful basis exists, the personal data will be destroyed within no more than 30 calendar days from receipt of the withdrawal request. The minimum information necessary to record the provision and withdrawal of Consent may be retained in accordance with Clause 8.4 of this Consent.
9.6. Withdrawal of Consent does not affect the lawfulness of personal data processing carried out before the Operator received the withdrawal request.

10. RIGHTS OF THE PERSONAL DATA SUBJECT
10.1. The Personal Data Subject has the right to:
— obtain information concerning the processing of their personal data;
— require incomplete, outdated or inaccurate personal data to be updated;
— require personal data to be blocked or destroyed where they have been obtained unlawfully, are no longer necessary for the stated purpose, or are otherwise processed unlawfully;
— withdraw this Consent;
— request the cessation of personal data processing in the cases provided for by law;
— lodge a complaint concerning the Operator’s actions or inaction with Roskomnadzor, the Russian data protection authority, or bring a claim before a court;
— exercise other rights provided for by the laws of the Russian Federation.
10.2. Enquiries concerning personal data processing may be sent to sortavala.timber@inbox.ru or to the Operator’s postal address.

11. CONFIRMATIONS BY THE PERSONAL DATA SUBJECT
11.1. By selecting the consent checkbox and submitting the form, the Personal Data Subject confirms that they:
— have read this Consent before submitting the form;
— provide their personal data voluntarily;
— have provided accurate information;
— understand the purposes and conditions of personal data processing;
— understand the procedure for withdrawing Consent;
— act on their own behalf or have the authority necessary to provide the relevant information.
11.2. Where the Personal Data Subject provides information concerning another individual, they confirm that a lawful basis exists for providing that information to the Operator.

12. FINAL PROVISIONS
12.1. This Consent is provided separately from other documents and information that the user reads or acknowledges when using the website.
12.2. The Personal Data Processing Policy is published on a separate website page and applies to personal data processing to the extent that it does not conflict with this Consent.
12.3. The Operator may amend this Consent. A new version applies to consent provided after the date on which that version is published, unless otherwise provided by the laws of the Russian Federation.
12.4. The fact that Consent has been provided, its version, and the date and time it was provided must be recorded by the website or the information system used.
12.5. This English-language version is intended for users of the English-language website and has the same meaning as the Russian-language version. In the event of any discrepancy or difference in interpretation, the Russian-language version shall prevail unless otherwise required by mandatory applicable law.

Publication date of this version: 26 October 2026.