Business Ethics and Conduct Policy

1. Purpose and scope

This Policy sets out the standards of ethical conduct binding at House of Product sp. z o.o., a limited liability company under Polish law (the "Company"). It expresses our commitment to doing business honestly, lawfully, and with respect for people, clients, business partners, and the environment. The Policy applies to: • all employees and persons working with the Company, regardless of legal basis (employment contract, civil-law contracts, B2B contracts), • subcontractors and suppliers acting on behalf of or for the Company — to the extent they perform work for the Company or its clients. The Company is a micro-enterprise providing product consulting services. This Policy is proportionate to that scale: we do not create sham compliance structures; we assign responsibility to real people and real processes.

2. Values and general principles

Our working culture rests on three values. They are not decoration for this document — they are the interpretive key to all of its remaining provisions: in a situation of doubt, we act as the values require. 1. Courage — we tell the truth even when it is inconvenient: to clients about the risks and weak points of their product, to partners about problems in our cooperation, to each other about our own mistakes. We have the courage to say "no" — to a project, practice, or expectation that conflicts with the law, this Policy, or the client's well-understood interest. 2. Transparency — we openly communicate blockers, problems, and limitations — our own, the project's, and our tools' — at the moment we notice them, not when they become impossible to hide. We disclose conflicts of interest, communicate the terms of cooperation clearly, and do not make promises we cannot keep. 3. Curiosity — we work on evidence: our recommendations, decisions, and assessments are based on data and verified information, not on hunches, fashion, or authority. We ask questions before forming a judgment, and we are prepared to change our minds when the data says otherwise. Each of the Company's shareholders is personally responsible for upholding one of the values and for building the Company's practices upon it:

Responsibility for a value means: leading by example in one's own practice, responding to behaviour inconsistent with it, and developing the tools and processes that make it the team's everyday practice. The values are complemented by general principles: 1. Legal compliance — we comply with the laws of every jurisdiction in which we operate; where local standards fall below this Policy, the Policy applies. 2. Accountability — every person covered by this Policy is personally responsible for their decisions and raises concerns instead of ignoring them. 3. Respect — we do not tolerate discrimination, harassment, or any form of degrading treatment. We are also guided by recognized international standards, including the principles of the UN Global Compact and the OECD Guidelines for Multinational Enterprises, to the extent appropriate to the scale of our business.

3. Anti-corruption and anti-bribery

1. We apply a zero-tolerance rule to corruption in all its forms — bribery, facilitation payments, trading in influence — in relations with both the public and the private sector. 2. We do not offer, promise, give, or accept financial or personal benefits to obtain an improper business advantage. 3. Gifts and hospitality: only customary, low-value gifts and hospitality are permitted (indicatively up to PLN 200; the PLN amount is controlling), provided they cannot influence business decisions and are not exchanged during negotiations, tenders, or other decision-making situations. Gifts in cash or cash equivalents are prohibited without exception. 4. Charitable donations and sponsorships must not be used to circumvent anti-corruption rules; we do not fund political parties or election campaigns. 5. We apply these rules in line with the corruption offences under the Polish Criminal Code and — where applicable to our clients and projects — with regard to standards such as the UK Bribery Act and the FCPA.

4. Conflicts of interest

1. A conflict of interest arises when a private interest (financial, family, professional) may influence — or appear to influence — the objectivity of decisions made in the course of work for the Company or its clients. 2. Any actual or potential conflict of interest must be disclosed without delay to one of the Company's shareholders. A conflict concerning a shareholder is disclosed to the other shareholders; a conflict concerning all shareholders is disclosed directly to the client concerned. 3. Disclosure is required in particular for: parallel engagements with a client's competitors in the same product area, financial interests in a client's business or its competitors, and personal relationships affecting purchasing decisions or recommendations. 4. Disclosing a conflict does not automatically prohibit acting — it triggers an obligation to agree on how the conflict will be managed (recusal, information barriers, client consent).

5. Fair competition

1. We compete on the quality of our work, not through unfair practices. We comply with competition law (including the Polish Act on Competition and Consumer Protection and Articles 101–102 TFEU). 2. We do not enter into price-fixing agreements, do not allocate markets, and do not exchange competitively sensitive information with competitors. 3. We do not gather competitor intelligence through illegal or unethical means and do not spread false information about competitors. 4. In marketing materials and proposals, we present our competencies and experience truthfully.

6. Confidentiality and client information

1. We protect clients' confidential information — strategies, product data, financial data, roadmaps, research results — regardless of whether a separate NDA has been signed. 2. We do not use one client's confidential information for the benefit of another client or for our own benefit. 3. Confidentiality obligations survive the end of the engagement. 4. We store client materials with reasonable security measures (access control, device encryption, avoiding unsecured channels) and delete or return them after the project ends, as agreed contractually.

7. Integrity of advisory work

1. We do not tailor conclusions to the client's expectations. A recommendation that is inconvenient for the project sponsor is not softened, omitted, or postponed — it is communicated directly, together with the data behind it. 2. We honestly present the limitations of our work: the quality and scope of the data, the level of uncertainty, and the assumptions made. We do not present hypotheses as facts, or opinions as research results. 3. If new data emerging during a project undermines earlier recommendations — including our own — we are the first to tell the client.

8. Public communication and case studies

1. Case studies, references, and project examples are published only with the client's consent as to the scope and form of publication. 2. The client's image is protected. The public narrative shows the problem and the solution — not the client's weaknesses. We do not publicly comment, directly or by implication, on the client's starting point, mistakes, or internal realities in a way that casts the organization in a bad light. This also applies to former clients and to anonymized descriptions that nevertheless allow the client to be identified. 3. In public communication (media, conferences, social media) we express opinions as our own, we do not disclose confidential information or client data, and we disclose commercial relationships where omitting them would mislead the audience.

9. Personal data protection

1. We process personal data in accordance with the GDPR and the Polish Personal Data Protection Act: lawfully, for specific purposes, limited to what is necessary, and for a limited time. 2. Where we process personal data on a client's behalf, we do so solely under a data processing agreement (Article 28 GDPR) and in line with the client's documented instructions. 3. We report personal data breaches without delay to the person responsible within the Company and — where we act as a processor — to the client, so that statutory deadlines can be met (in principle 72 hours for the controller's notification to the supervisory authority). 4. Subcontractors are given access to personal data only after equivalent safeguards have been ensured.

10. Ethical and responsible use of AI

As a product consultancy, we use AI tools and advise clients on them. We commit to: 1. Human oversight — outputs of AI tools are substantively reviewed by a human before delivery to a client; responsibility for the result always rests with a human, not the tool. 2. Transparency — on the client's request, we disclose the extent to which, and with which AI tools, we supported a project; we label AI-generated content where required by law (including the transparency obligations of Article 50 of the EU AI Act, applicable from 2 August 2026). 3. Protection of client data — we do not enter clients' confidential data into public AI tools without a contractual basis or the client's consent; we use tools with verified data-processing terms (no training on inputs, or that option explicitly disabled). 4. AI literacy — in line with Article 4 of the EU AI Act, we support the development of AI literacy among people working with these tools for the Company. 5. Avoiding harmful uses — we do not use AI for manipulation, disinformation, discriminatory profiling, or practices prohibited by the AI Act; nor do we advise clients toward solutions that would implement such practices.

11. Intellectual property

1. We respect third-party intellectual property: we use software, content, and data in accordance with their licenses; we do not copy others' work in a manner that violates the law or fair practice. 2. Rights to work products created for clients are transferred or licensed as agreed contractually; until transfer, we manage them with due care. 3. We protect the Company's know-how and respect the equivalent rights of our associates and subcontractors.

12. People: equal treatment and working environment

1. We ensure equal treatment in employment and cooperation regardless of sex, age, disability, race, religion, nationality, political beliefs, trade union membership, ethnic origin, creed, sexual orientation, form of employment, and other legally protected characteristics. 2. We do not tolerate workplace bullying (mobbing), harassment (including sexual harassment), intimidation, or humiliating treatment — in the office, in remote work, and in electronic communication. 3. Decisions on engagement, remuneration, and advancement are based on competence and results. 4. We provide safe and healthy working conditions appropriate to the nature of our business (office/remote work), including respect for the right to rest and to boundaries of availability outside working hours. 5. We strictly prohibit child labour and forced labour — in our own operations and at our suppliers. 6. Protection works both ways. If a representative of a client or business partner violates the dignity of a person working for the Company, the Company stands by its own person and responds — up to and including terminating the engagement. No contract is worth tolerating degrading treatment of our people.

13. Human rights and the supply chain

1. We respect human rights in line with the UN Guiding Principles on Business and Human Rights (UNGPs). 2. When selecting suppliers and subcontractors, we consider — alongside quality and price — their legal compliance, labour practices, and ethical reputation. 3. We expect subcontractors working for our clients to observe standards at least equivalent to this Policy, and we are prepared to terminate cooperation in the event of a material breach.

14. Environment

Our direct environmental footprint is limited (a services business, largely remote), but we commit to: 1. limiting business travel to what is necessary and choosing low-emission transport where practical, 2. extending the life cycle of electronic equipment and responsibly recycling e-waste, 3. considering environmental criteria when selecting service providers (including hosting/cloud), 4. complying with applicable environmental regulations.

15. Financial and record-keeping integrity

1. We keep books and records honestly; all transactions are properly documented and accounted for. 2. We meet our tax obligations in accordance with the law; we do not participate in money laundering or terrorist financing, and we do not enter into engagements whose legality we cannot verify. 3. We comply with applicable international sanctions (EU, UN, and other relevant sanctions regimes).

16. Reporting violations and whistleblower protection

1. Every person covered by this Policy is obliged to report a suspected breach of the Policy or of the law. Reports are received by the Company's shareholders: [email protected]. If a report concerns one of the shareholders, it may be directed to another shareholder; if it concerns all shareholders — to competent external authorities and, where the matter concerns a specific client, also directly to that client. 2. Fewer than 50 persons perform paid work for the Company, which is therefore not subject to the statutory obligation to implement an internal reporting procedure under the Polish Whistleblower Protection Act of 14 June 2024 — we nevertheless apply the standards of that Act voluntarily, including: • confidentiality of the reporting person's identity, • acknowledgment of receipt within 7 days and feedback within 3 months, • diligent and impartial examination of every report. 3. No retaliation: no retaliatory measures (termination, worsening of terms, exclusion from projects, harassment) will be taken against a person who reports in good faith. The prohibition also covers persons assisting with a report. 4. Knowingly false reports constitute a breach of this Policy. 5. Independently of the internal channel, everyone has the right to make an external report to the Polish Commissioner for Human Rights (Rzecznik Praw Obywatelskich) or the competent public authority, in accordance with the Whistleblower Protection Act.

17. Responsibility, implementation, and review

1. The Company's Management Board is responsible for implementing, communicating, and enforcing this Policy. The shareholders designated in Section 2 are responsible for building the practices tied to their respective values. 2. A breach of the Policy may result in consequences appropriate to the form of cooperation: from corrective feedback, through measures provided for by labour law, to termination of the cooperation or supplier agreement, and — where the law has been broken — notification of the competent authorities. 3. Every person starting cooperation with the Company reads the Policy and confirms this in writing or electronically. 4. The Policy is reviewed at least annually and whenever there is a material change in law or in the nature of the business. 5. In matters not regulated by this Policy, a practical test applies: Would this decision hold up if it became publicly known — to the client, to a regulator, and to the public? If the answer is in doubt, consult before acting.

Annex A. The values in practice — example scenarios