Approved by the Decision of the General Meeting of LLC “Western Consulting Group” No. 01/19 of January 10, 2019 Regulations on the Processing and Protection of Personal Data of LLC “Western Consulting Group” General Concepts and Scope of Application Limited Liability Company “Western Consulting Group” (hereinafter – ” Company”) respects the rights related to the personal data of the subjects of personal data that it receives in the course of its activities and strives to protect them. This Regulation defines the methods of collection, processing, use and protection of personal data, which includes (including, but not limited to) data about: visitors to websites and other online resources of the Company (hereinafter – the “Site”); individuals and legal entities with whom the Company cooperated in the framework of activities (counterparts, buyers and suppliers of goods and services); any other third parties, within the framework of interaction, communication, cooperation with which the Company obtained or could obtain access to the personal data of such third parties. This Regulation is mandatory for the application of the authorized person (as this term is defined below) and employees/representatives of the Company who directly process and/or have access to personal data in connection with the performance of their duties; In this Regulation, the following terms are used in the following sense: personal data base – a named set of organized personal data in electronic form and/or in the form of personal data files; authorized person – a designated person among the employees/representatives and/or partners of the Company who organizes work related to the protection of personal data during their collection and processing; the owner of the personal data base – the Company, which, with the consent of the subject of personal data, has been granted the right to process this data, which approves the purpose of processing personal data in this database, establishes the composition of this data and the procedures for its processing, unless otherwise specified by the Law (as this the term is defined below); publicly available sources of personal data – directories, address books, registers, lists, catalogs, databases, other systematized collections of open information that contain personal data, posted and published with the knowledge of the Subject (as this term is defined below); Law – Law of Ukraine “On Protection of Personal Data” No. 2297-VI of June 1, 2010 (as amended); consent of the subject of personal data – a voluntary expression of the will of a natural person (provided that he is informed) regarding the granting of permission for the processing of his personal data in accordance with the stated purpose of their processing, expressed in writing or in a form that makes it possible to conclude that consent has been given; processing of personal data – any action or set of actions performed in whole or in part in the information (automated) system of personal data, which are related to the collection, registration, accumulation, storage, adaptation, change, renewal, use and distribution (distribution, implementation, transfer), depersonalization, deletion of information about Subjects; the Company’s partners are Yanovsky and Partners Law Firm, “Saved Assets” Limited Liability Company, “Saved Assets Medium” Limited Liability Company, Private Enterprise “Academy of a Professional Accountant”; personal data – data that personally identify the Subject, both individually and in combination with other information available to the Company, including from publicly available sources of personal data; controller of personal data – a natural or legal person who is authorized by the owner of personal data or by law to process this data on behalf of the owner; the subject of personal data (hereinafter – the Subject) – any natural person whose personal data is processed by the Company in accordance with its goals and the purpose of processing defined by these Regulations.

This document defines: who is the owner and controller of the data under this policy and how the Subject can contact the Company; the purpose of the Company’s collection and processing of the Subject’s personal data; methods of obtaining the Subject’s personal data by the Company; ways of using the Subject’s personal data by the Company; terms of storage of personal data of the Subject by the Company; methods of transfer by the Company of the Subject’s personal data to third parties; the Subject’s rights regarding his personal data; amending the Regulations. The purpose of collecting and processing personal data The company collects and processes personal data for the purpose of: registration, accumulation, storage and updating of information about the Subjects, as well as other third parties; obtaining information by the Subjects regarding the Company’s activities; interaction with the Subjects for the purpose of selling goods (providing services) of the Company; obtaining assistance to protect the legal rights and interests of the Company; implementation of the goals and objectives provided for by the Company’s founding documents. Owner of personal data The Company is the owner of the Subject’s personal data within the meaning of Article 1 of the Law. In case of questions or doubts regarding the Company’s handling of the Subject’s personal data, the Company can be contacted at the following address: office@zkg.ua, or at other contact details posted on the Site. The official address of the Company: Ukraine, 79005, Lviv, st. Dudayeva, bldg. 19, sq. 1. Information that the Company can collect about the Subject The Company can collect and process the Subject’s personal data: in the course of its activities, including through the Site; when communicating with the Company by e-mail or other means of communication; when registering the Subject for the Company’s events and activities or when inquiring about them; when the Subject sends requests to receive information about the Company’s goods (services), as well as when the Subject receives it; as part of the Subject’s responses to messages or requests for information from the Company. Personal data that the Company may collect and process includes (but is not limited to): the name of the Subject, the name of the business entity, enterprise, institution or organization represented by the Subject, the owner, founder, participant, member of which there is an Entity in which the Subject works or has worked, the position of the Subject; postal address, e-mail address, contact phone numbers of the Subject, identifiers of other means of communication with the Subject; information about visits to the Site, company pages or company partners in social networks; information about materials and messages that the Company sends to the Subject in electronic form; information provided by the Subject for the purposes of: obtaining information about the terms of service provision, purchase, consumption or use of the Company’s products, attending Company events and activities; identification and reference information provided by the Entity or collected as part of the Company’s operational processes.

Obtaining the Subject’s information 6.1. Personal data that the Subject provides to the Company The Company collects and processes the Subject’s personal information as part of the Company’s production processes, as well as for communication, marketing, promotion, sales, production, quality control, reviews of the Company’s products and the conduct of the Company’s events and activities . 6.2. Information that the Company may automatically collect When visiting the Company’s Site, certain information is automatically collected that does not allow identification of the Subject. This information may include the following. 6.2.1. Browsing statistics The Company collects information about the sections of the Site that are mainly viewed by visitors, the frequency of connections to the Site, the software and hardware used to visit the Site, and the geography of visitors. This information allows the Company to understand how visitors interact with the Site. 6.2.2. Logs The Company’s hosting provider’s equipment may record requests made by visitors to the Site, information about the software and hardware used to visit the Site, IP address assignment, and the time associated with access. The company uses this information to improve the security of the Site. 6.2.3. Cookie A cookie is a text string that the Site sends to a browser cookie on the Subject’s computer so that the Site can remember the Subject’s settings. The company uses cookie data to analyze visitor behavior and improve user experience. The subject can disable cookies through the browser settings. The company places a disclaimer on the website, in the form of Appendix 1 to this provision. 6.3. Information that the Company collects from other sources The Company may receive information about the Subject from other sources (including publicly available sources of personal data), as well as from third parties who help: update, expand and analyze the Company’s records; identify persons interested in the Company’s goods (services); prevent or detect fraud. The Company may also receive information about the Subject from social media platforms, including but not limited to when the Subject interacts with the Company on those platforms or accesses the Company’s social media content. The information that the Company can obtain is governed by the privacy settings and procedures of the relevant social network, which the Company advises you to familiarize yourself with. Use of the Subject’s information The Company collects and processes the Subject’s personal data in various ways, including, but not limited to, through the use of the Site.

The Company uses the following information for: answers to the Subject’s questions about the goods (services) sold by the Company, regarding its activities; improvement of the Site. Retention of personal data The Company will retain collected personal data as long as it is necessary to fulfill the purpose of processing defined in this Regulation. To determine the appropriate retention period, the Company will consider the scope and nature of the collected data, including the special categories of personal data defined in Part 1 of Article 7 of the Law, the potential risk of harm from unauthorized use or disclosure, and the purposes for which the Company processes personal data. After the expiration of the storage period, the collected personal data will be destroyed taking into account the security rules. Transfer of personal data to third parties The Company may transfer the Subject’s personal data to some third parties, including: the Company’s IT providers, including cloud service management service providers; third parties involved in the sale of goods (provision of services) of the Company. If necessary or for the reasons set out in this Regulation, personal data may also be provided to state authorities and local self-government bodies, courts, government institutions and law enforcement agencies. The Company does not sell, rent, or provide personal data of Subjects for commercial purposes in any other way. Rights of the Subject The subject has the right to: request access to his personal data and learn about their processing; make a request to correct the Subject’s personal data; make a request for the destruction of the Subject’s personal data; to demand restriction of the processing of personal data of the Subject; to object to the processing of the Subject’s personal data; withdraw consent (if given) to the processing of the Subject’s personal data; file a complaint regarding the Company’s processing of the Subject’s personal data. Contact information of the local supervisory body can be obtained at http://www.ombudsman.gov.ua/uk/page/applicant/. The subject may exercise his other rights in accordance with the legislation on the protection of personal data. If personal data is deleted at the request of the Subject, the Company will only keep such copies of the information as are necessary to protect the legitimate interests of the Company or third parties, resolve disputes or perform any transaction for the performance of any agreement that the Subject entered into with the Company . Processing of information regarding minors The site is not directed to and is not intended for persons under the age of 18. If the Subject is under 18 years of age, he must not provide the Company with personal data without the consent of his parents, guardian, guardianship and guardianship authorities. If the Company detects personal data of Subjects under the age of 18, such personal data will be promptly deleted. Links The Site may contain links to third-party websites. The Company is not responsible for the personal data protection, content and privacy practices of such third-party websites.

Authorized person of the Company The authorized person organizes work related to the protection of personal data during their processing in accordance with the law. The authorized person is determined by the Director of the Company. The authorized person is obliged to: know the legislation in the field of personal data protection; to ensure that the Company’s representatives/employees and/or partners comply with the requirements of the legislation in the field of personal data protection, the General Data Protection Regulation (GDPR; Regulation (EU) 2016/679), this Regulation and other documents in the field of personal data, which the Company may adopt from time to time; notify the Company’s management of violations by employees and/or partners of the requirements of Ukrainian legislation in the field of personal data protection, this Regulation and other documents in the field of personal data that the Company may adopt from time to time no later than 1 (one) working day from the moment such violations are discovered . In order to fulfill his duties, the authorized person has the right to: make copies of received documents, including copies of files, any records stored in local computer networks and autonomous computer systems; access to all premises, documents, means of telecommunications of the Company; participate in the discussion of issues related to the protection of personal data; to interact with other representatives/employees and/or partners of the Company in the performance of their duties related to the organization of work related to the protection of personal data during their processing. Representatives/employees and/or partners who have access to personal data and carry out their processing are obliged not to allow the disclosure in any way of personal data entrusted to them or which became known in connection with the performance of professional or official duties or labor duties. Persons who have access to personal data, including those who process it, in case of violation of the requirements of the legislation on the protection of personal data bear the responsibility provided for by the current legislation. Amendments to this Regulation are approved by the General Meeting of the Company’s participants. The company reserves the right to make changes and additions to these Regulations by decision of the General Meeting of participants. The Company recommends that the Subjects periodically review the page of the Site, which contains information on the processing and protection of personal data. In case of making any significant changes to these Regulations, the Company will notify the Subject by publishing a notice of changes on the Site. Obligation of the provision for the Company’s partners This Provision is binding and valid for the Company’s partners – Yanovsky and Partners Law Firm, “Saved Assets” Limited Liability Company, “Saved Assets Medium” Limited Liability Company, Private enterprise “Academy of Professional Accountant”, in case of their interaction in any way with the Subject’s personal data. 16. Application of international legislation on the protection of personal data. In case of implementation of international legislation (for example – GDPR) in the legislation of Ukraine, its provisions will become mandatory for the company. Appendix 1 Disclaimer The site uses cookies and other technologies in order to remember your preferences and learn exactly how you use the site. The processing of the indicated data is carried out in accordance with the Regulation on the processing and protection of personal data of the Limited Liability Company “Western Consulting Group”, which can be found at the link. By clicking “YES”, you consent to the use of cookies and other technologies while visiting the site and to the processing of personal data.