Counterparty Confidential Information Protection Policy

Edition dated April 29, 2026

Scope. This Policy governs the regime of confidential information in B2B relations with clients, partners, subcontractors, and other counterparties within the meaning of Federal Law No. 98-FZ of 29.07.2004 "On Commercial Secrets" and does not replace the Personal Data Processing Policy, which governs the processing of personal data of natural persons under Federal Law No. 152-FZ.

This English version is provided for reference only. In case of discrepancies, the Russian version prevails.

1. General Provisions

1.1. This Counterparty Confidential Information Protection Policy (hereinafter — the "Policy") establishes the principles, procedures, and measures applied by IBG Technology LLC (TIN 7708823942, PSRN 5147746256180, hereinafter — the "Company") to protect confidential information received from clients, partners, contractors, and other parties (hereinafter — "Counterparties") in the course of its business activities, development, delivery, and support of software products and services.

1.2. The Policy applies to all confidential information disclosed to the Company, its employees, subcontractors, and other persons with access to such information in connection with obligations to Counterparties.

1.3. The Policy is developed in accordance with:

• Federal Law No. 98-FZ of 29.07.2004 "On Commercial Secrets";
• the Civil Code of the Russian Federation (Articles 1465–1472 — trade secrets);
• Federal Law No. 149-FZ of 27.07.2006 "On Information, Information Technologies and Protection of Information";
• Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" (with respect to personal data within Counterparty confidential information);
• orders of the Federal Service for Technical and Export Control of Russia (FSTEC), including Order No. 21 of 18.02.2013 (for personal data information systems) and Order No. 17 of 11.02.2013 (for state information systems), and orders of the Federal Security Service of Russia (FSB) as applicable;
• the Criminal Code of the Russian Federation (Articles 183, 272, 272.1, 274 — liability for unlawful actions with confidential information and information systems).

1.4. This Policy does not replace or supersede the Personal Data Processing Policy and applies concurrently with it. With respect to personal data processing, the Personal Data Policy and applicable data protection laws take precedence.

2. Definitions

• Confidential Information — any information (industrial, technical, economic, organizational, financial, commercial, or other) having actual or potential commercial value to a Counterparty due to being unknown to third parties, to which third parties have no lawful free access, and in respect of which the Counterparty has introduced a confidentiality or commercial secret regime.
• Commercial Secret — confidentiality regime within the meaning of Federal Law 98-FZ.
• Client Data — data of a Counterparty processed by the Company in its software products (FS-KUB, AURA, AI agents, 1C configurations, etc.), including financial information, management reporting, project, contract, payment, estimate, budget, and master data.
• Employee — an employee of the Company, as well as an individual engaged under a civil-law contract.
• Subcontractor — a legal entity engaged by the Company to perform specific work in the interest of a Counterparty.

3. Scope of Confidential Information

3.1. Confidential Information includes, but is not limited to:

a) Commercial and financial information of the Counterparty:

• contract terms (prices, discounts, payment procedures);
• cost structure, cost of goods sold, project profitability;
• budgets, cash flow plans, P&L budgets, management reporting;
• NPV, IRR, covenants, and debt load information;
• M&A deals, investments, development plans.

b) Technical and project information:

• technical documentation, integration diagrams, architectural decisions;
• source code developed for the Counterparty under custom development;
• configurations and settings of the Counterparty's information systems;
• BIM model data, design documentation of capital construction facilities.

c) Information about contractors and subcontractors:

• supplier database, procurement terms, tender results;
• contractor scoring, SRM data.

d) Data within the Company's software products processed for the Counterparty.

e) Other information that the Counterparty has notified the Company in writing as confidential, or that objectively has commercial value.

3.2. Confidential Information does not include information that:

• was publicly available at the time of receipt without breach of any obligation;
• became publicly available through no fault of the Company;
• was lawfully obtained from third parties not bound by confidentiality obligations;
• was independently developed by the Company without use of the Counterparty's confidential information;
• is subject to mandatory disclosure under law or court order.

4. Company's Obligations

4.1. The Company undertakes to:

• use Confidential Information solely for the purpose of performing obligations to the Counterparty;
• not disclose Confidential Information to third parties without the Counterparty's written consent;
• provide access to Confidential Information on a need-to-know basis;
• promptly (within 24 hours of discovery) notify the Counterparty of incidents that have resulted or may result in unauthorized access to Confidential Information;
• upon termination of the contract, return or destroy Confidential Information at the Counterparty's request (except for copies required to be retained by law).

4.2. Confidentiality obligations remain in force for the entire term of the contract with the Counterparty and for 5 (five) years after its termination, unless a different term is set out in the contract. With respect to information constituting a commercial secret under 98-FZ, obligations apply indefinitely for as long as such information retains the attributes of a commercial secret.

5. Protection Measures

5.1. Organizational measures

• appointment of information security officers;
• non-disclosure agreements (NDAs) with Employees;
• inclusion of confidentiality obligations in contracts with Subcontractors;
• maintenance of a register of persons with access to Confidential Information;
• training and awareness programs for Employees;
• role-based access control (RBAC).

5.2. Technical measures

• encryption in transit (TLS 1.3) and at rest (AES-256);
• authentication and authorization (JWT, MFA for administrative access);
• logging of user and administrator actions;
• regular backups with isolated storage;
• firewalling, intrusion detection and prevention systems;
• antivirus protection, vulnerability management;
• segregation of development, testing, and production environments;
• secure credential and secret management (vault).

5.3. Measures specific to Client Data within the Company's products

• for on-premise deployments, Client Data remains within the Counterparty's perimeter; the Company accesses it only upon the Counterparty's request for support purposes, with access logged;
• for cloud deployments, Client Data resides in an isolated tenant; Company personnel access is restricted, logged, and granted only upon justified request;
• remote access to the Counterparty's systems is performed over secure channels (VPN, SSH with MFA).

6. Employees and Subcontractors

6.1. Employees are granted access to Confidential Information only after signing a non-disclosure agreement.

6.2. Employees are informed of their liability for disclosure of Confidential Information, including disciplinary, material, civil, and criminal liability (Article 183 of the Criminal Code of the Russian Federation).

6.3. Subcontractors may be engaged to handle Confidential Information only if their contract contains confidentiality provisions no less stringent than those in this Policy, and, where applicable, with prior written notice to the Counterparty.

7. Disclosure to Third Parties

7.1. The Company does not disclose Confidential Information to third parties, except:

• with the Counterparty's written consent;
• to engaged Subcontractors to the extent required for contract performance, provided they assume equivalent confidentiality obligations;
• where mandatory disclosure is required by authorized government bodies, courts, or law enforcement agencies in accordance with applicable law.

7.2. Where permitted by law, the Company will notify the Counterparty of any such mandatory disclosure request prior to actual disclosure, so that the Counterparty may take legal protective measures.

8. Liability

8.1. Persons who violate this Policy bear liability in accordance with the legislation of the Russian Federation and the terms of the concluded contracts.

8.2. In the event of documented disclosure of Confidential Information resulting in losses to the Counterparty, the Company compensates such losses in the manner and to the extent established by the contract with the Counterparty and applicable law.

9. Subcontractors and Cloud Infrastructure

9.1. When using external infrastructure (cloud providers, hosting providers, DNS, CDN), the Company selects providers ensuring an adequate level of information protection and includes confidentiality provisions in contracts with them.

9.2. A list of material external providers is provided to the Counterparty upon request as part of due diligence.

10. Information Security Incidents

10.1. In the event of an incident affecting the Counterparty's Confidential Information, the Company:

• takes measures to contain and remediate the incident;
• notifies the Counterparty within 24 hours of establishing the fact of the incident;
• provides a report on the incident, its causes, and measures taken;
• assists the Counterparty in fulfilling its own notification obligations (including obligations under 152-FZ and notification of Roskomnadzor).

11. Termination and Return of Information

11.1. Upon completion of obligations to the Counterparty or upon its written request, the Company:

• returns media containing Confidential Information;
• destroys electronic copies, except for copies required to be retained by law (accounting, tax documentation);
• provides an act of destruction to the Counterparty upon request.

12. Relationship with Other Documents

12.1. This Policy does not replace individual non-disclosure agreements (NDAs) concluded with Counterparties. In case of conflict, the more stringent provision applies.

12.2. Personal data processing is governed by the Company's Personal Data Processing Policy and applicable data protection legislation.

13. Amendments

13.1. The Company may amend this Policy. The current version is published at https://ibgt.ru/pages/confidentiality-en.html.

13.2. Material changes are communicated to existing Counterparties no less than 30 days prior to their entry into force.

14. Contacts

For confidentiality-related inquiries:

• Email: it@ibgt.ru
• Postal address: 7 Krasnoproletarskaya Str., room 4/P, Moscow, 127006, Russia
• Phone: +7 (495) 920-19-02