Privacy Policy

SIA METALEKSPO – Privacy Policy | 1 / 5

PRIVACY POLICY

Effective from 2 October 2026. Replaces the version of 27 July 2018.

I. GENERAL PROVISIONS

1. This Privacy Policy (the “Policy”) explains how SIA METALEKSPO (the “Company”, “we”,

“us”) processes the personal data of natural persons (“data subjects”, “you”): for what purposes and on what legal basis, how long the data are kept and what rights you have.

2. The Policy has been prepared in accordance with Regulation (EU) 2016/679 of the European

Parliament and of the Council (General Data Protection Regulation, “GDPR”), the Latvian Personal Data Processing Law and other applicable legislation.

3. The Policy applies to:

– visitors to the website www.metalekspo.com (the “Website”);

– persons who contact the Company by e-mail, telephone or through the enquiry forms on the Website;

– representatives and contact persons of the Company’s customers, suppliers, carriers and other business partners;

– job applicants.

4. The Policy does not apply to the processing of the Company’s employees’ personal data

(employees are informed about it separately) or to third-party websites linked from the Website.

II. CONTROLLER AND CONTACT DETAILS

5. The controller of your personal data is SIA METALEKSPO, registration No. 40003440140,

registered address: Rencenu iela 32, Riga, LV-1073, Latvia.

6. For any questions about the processing of personal data, or to exercise your rights, please

contact us: E-mail: metalekspo@metalekspo.com (please write “Personal data” in the subject line) Telephone: +371 66 103 445 Postal address: SIA METALEKSPO, Rencenu iela 32, Riga, LV-1073, Latvia

III. PURPOSES, LEGAL BASES AND RETENTION PERIODS

7. We process only the personal data that are necessary for a specific purpose. The purposes, the

data processed, the legal basis and the retention period are set out below.

7.1. Operating and securing the Website

Data: IP address, browser and device technical information, date and time of the request, page requested. Legal basis: the Company’s legitimate interest in keeping the Website available and protecting it against attacks and misuse (Article 6(1)(f) GDPR). Retention: the data are processed in technical logs by our hosting and security provider, Cloudflare, Inc., in accordance with its service terms and only for as long as necessary for security purposes. The Company does not build visitor profiles and does not use analytics or advertising tools.

SIA METALEKSPO – Privacy Policy | 2 / 5

7.2. Handling enquiries, quotation requests and material offers

Data: first name, surname, company name, position, e-mail address, telephone number, country and the content of the enquiry (for example, material type, quantity, material location or collection address, packaging, timing). Legal basis: the Company’s legitimate interest in responding to enquiries and developing its business (Article 6(1)(f) GDPR); where the enquiry is made by a natural person on their own behalf, steps taken at the data subject’s request prior to entering into a contract (Article 6(1)(b) GDPR). Retention: 2 years after the last communication if no contract is concluded. If a contract is concluded, the period in point 7.3 applies. Note: The enquiry forms on the Website (on the “Contact”, “Products” and “Procurement” pages) do not store the data you enter and do not send them to a server. When you press the button, your e-mail application opens with a pre-filled message, and the data reach the Company only if you send that message.

7.3. Concluding and performing contracts with customers, suppliers and business partners

Data: first name, surname, position, business contact details and signature of the partner’s representatives and contact persons, details of documents confirming their authority to represent, communication history. Legal basis: the Company’s legitimate interest in concluding and performing a contract with the legal entity the data subject represents (Article 6(1)(f) GDPR); where the contracting party is a natural person, performance of a contract (Article 6(1)(b) GDPR); compliance with legal obligations in accounting and taxation (Article 6(1)(c) GDPR). Retention: for the term of the contract and, after its termination, until the limitation period for claims expires; data contained in accounting source documents – at least 5 years (Section 28 of the Latvian Accounting Law).

7.4. Business partner due diligence and sanctions compliance

Data: first name, surname, position and country of the partner’s board members, ultimate beneficial owners and representatives, information from public registers, results of sanctions list screening; where necessary to identify a representative, identity document details. Legal basis: compliance with a legal obligation under the Latvian Law on International Sanctions and National Sanctions and directly applicable EU regulations (Article 6(1)(c) GDPR); the Company’s legitimate interest in verifying the reliability of its business partners (Article 6(1)(f) GDPR). Retention: 5 years after the end of the business relationship.

7.5. Preparing waste shipment, customs and transport documents

Data: first name, surname and contact details of contact persons, driver’s first name and surname, vehicle registration number, signatures on shipping documents (for example, CMR consignment notes and waste shipment documents). Legal basis: compliance with legal obligations under Regulation (EU) 2024/1157 on shipments of waste, the Latvian Waste Management Law and customs legislation (Article 6(1)(c) GDPR); the Company’s legitimate interest in organising the transport of goods (Article 6(1)(f) GDPR). Retention: at least 5 years (Section 28 of the Latvian Accounting Law), unless specific legislation requires a longer period.

SIA METALEKSPO – Privacy Policy | 3 / 5

7.6. Recruitment

Data: first name, surname, contact details, information in your CV and cover letter (education, work experience, skills), interview notes, references from previous employers (only with your knowledge). Legal basis: steps taken at the data subject’s request prior to entering into an employment contract (Article 6(1)(b) GDPR); for keeping your data for future vacancies – your consent (Article 6(1)(a) GDPR). Retention: 6 months after the end of the selection process (taking into account the three-month period for bringing a claim under Section 34(1) of the Latvian Labour Law); with your consent – 12 months, or until you withdraw consent, if earlier. If an employment contract is concluded, the data are added to the employee’s personnel file. Note: If you send us your CV without applying for a specific vacancy, we will review it and, if there is no suitable vacancy, ask for your consent to keep your data. If consent is not given within 30 days, the data are deleted.

7.7. Publishing business partner testimonials on the Website

Data: first name, surname and position of the partner’s representative, the text of the testimonial and the signed testimonial letter. Legal basis: the data subject’s consent (Article 6(1)(a) GDPR). Retention: until consent is withdrawn or the testimonial is removed from the Website.

7.8. Protecting the Company’s legal interests

Data: data necessary to establish, exercise or defend legal claims (for example, contracts, correspondence, payment information). Legal basis: the Company’s legitimate interests (Article 6(1)(f) GDPR). Retention: until the dispute is finally resolved and any decision has been enforced.

8. When the retention period expires, personal data are deleted or anonymised.

9. The Company does not make decisions based solely on automated processing, including

profiling (Article 22 GDPR).

IV. SOURCES OF PERSONAL DATA

10. We obtain personal data:

– from the data subject (for example, when you send an enquiry, an offer or a CV);

– from the data subject’s employer or the company they represent (for example, when a contact person is named in a contract or order);

– from public registers and sources (for example, the Latvian Register of Enterprises and foreign commercial registers, sanctions lists).

11. Providing personal data is voluntary. However, without it we cannot respond to an enquiry,

conclude or perform a contract, or consider a job application.

V. RECIPIENTS OF PERSONAL DATA

12. We do not sell personal data. Personal data may be disclosed only to the following categories

of recipients, and only to the extent necessary for the specific purpose:

– IT service providers processing data on the Company’s behalf (Website hosting and security – Cloudflare, Inc.; e-mail, data storage and office software providers);

– accounting, audit and legal service providers;

SIA METALEKSPO – Privacy Policy | 4 / 5

– credit institutions, for making payments;

– carriers, freight forwarders, customs brokers, and inspection and laboratory service providers – for the transport of goods and quality control;

– the other party to a contract (customer or supplier) – to the extent necessary to perform the contract;

– state and municipal authorities, courts and bailiffs – in the cases and manner provided by law.

13. Service providers processing personal data on the Company’s behalf are bound by agreements

in accordance with Article 28 GDPR.

VI. TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA

14. The Company exports its products and works with partners outside the European Economic

Area (“EEA”), for example in China, India, Japan, the Republic of Korea, Malaysia, Thailand, Singapore, the United Arab Emirates, the United States, Canada, the United Kingdom and Switzerland. Contact person data and documents necessary to perform a contract may be transferred to these countries.

15. We transfer personal data outside the EEA on the basis of one of the following GDPR

mechanisms:

– a European Commission adequacy decision (Article 45 GDPR) – for example, for Japan, the Republic of Korea, the United Kingdom, Switzerland, Canada (commercial organisations) and US companies certified under the EU–US Data Privacy Framework;

– standard contractual clauses adopted by the European Commission (Article 46 GDPR);

– where the above mechanisms do not apply – where the transfer is necessary for the performance of a contract, or for the conclusion or performance of a contract concluded in the interest of the data subject (Article 49(1)(b) and (c) GDPR).

VII. COOKIES

16. Information about cookies and similar technologies used on the Website is provided in the

Company’s Cookie Policy, available on the Website.

VIII. DATA SECURITY

17. The Company applies appropriate technical and organisational measures to protect personal

data against unauthorised access, disclosure, loss or destruction, including restricted access rights, an encrypted connection (HTTPS) on the Website and confidentiality obligations of employees.

IX. YOUR RIGHTS

18. You have the right to:

– access your personal data and obtain a copy (Article 15 GDPR);

– have inaccurate data rectified or incomplete data completed (Article 16 GDPR);

– have your data erased (Article 17 GDPR);

– restrict the processing of your data (Article 18 GDPR);

– receive the data you have provided in a structured, commonly used and machine-readable format and transmit it to another controller, where processing is based on consent or a contract (Article 20 GDPR);

– object to processing based on the Company’s legitimate interests (Article 21 GDPR);

SIA METALEKSPO – Privacy Policy | 5 / 5

– withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

19. You can submit a request by e-mail to metalekspo@metalekspo.com or by post to the

Company’s registered address. No special form or electronic signature is required. If we have reasonable doubts about the identity of the person making the request, we may ask for additional information necessary to confirm it (Article 12(6) GDPR).

20. We will respond without undue delay and in any event within one month of receiving the

request. This period may be extended by two further months where necessary, taking into account the complexity and number of requests; we will inform you of any extension within the first month (Article 12(3) GDPR). Information is provided free of charge.

21. Your rights may be limited where exercising them would conflict with the Company’s legal

obligations (for example, regarding documents that must be retained by law).

X. COMPLAINTS

22. If you believe that your personal data are being processed in breach of the law, please contact

us first so that we can resolve the matter.

23. You have the right to lodge a complaint with the supervisory authority – the Data State

Inspectorate of Latvia (Datu valsts inspekcija, Elijas iela 17, Riga, LV-1050; e-mail: pasts@dvi.gov.lv; telephone: +371 67223131; www.dvi.gov.lv) – or with the supervisory authority in the EU Member State of your habitual residence or place of work (Article 77

GDPR).

XI. FINAL PROVISIONS

24. The Company reviews the Policy regularly and may amend it. The current version, with its

effective date, is available on the Website at www.metalekspo.com.

25. The Policy takes effect on 2 October 2026. From that date the Privacy Policy of 27 July 2018

ceases to apply.