1. INTRODUCTION

This Policy aims to demonstrate the commitment of CONSULCAMP AUDITORIA E ASSESSORIA LTDA., enrolled in the Brazilian Tax Registry (CNPJ) under No. 48.622.567/0001-26, registered with the CRC/SP under No. 2SP010626/O-4, headquartered at Rua Conceição No. 233, 23rd floor, Suite 2303, Centro, in the city of Campinas, State of São Paulo – hereinafter referred to simply as “We”, to privacy and Personal Data protection, as well as to establish rules for the processing of Your Personal Data within the scope of the services and features of the institutional website, available at www.consulcamp.com.br, in accordance with applicable laws and with transparency and clarity toward You and the market in general.

The processing and storage of Personal Data is carried out based on the legal grounds provided in the LGPD (Brazil’s General Data Protection Law), such as compliance with legal obligations, performance of preliminary contractual procedures, legitimate interest, and consent, where applicable.

By using the website and providing your data, You acknowledge and accept this Privacy Policy.

MINORS UNDER 18 – Our website is not directed at individuals under 18 years of age. If we identify any improper processing, the data will be deleted. Do not provide your Personal Data on our website if you are under 18 years of age.

2. ABOUT THE DATA WE COLLECT

• How We Collect Data – Data, including Personal Data, may be collected when You submit it, or when You interact with our mailing list and services.

WHAT DATA WE COLLECT AND WHY

• Data Accuracy and Updates – The data subject is responsible for providing correct and up-to-date information and may request corrections at any time. Similarly, We are not obligated to process or handle any of Your Data if there are reasons to believe that such processing may expose us to any violation of applicable law, or if You are using our database for any illegal, illicit, or immoral purposes.

• Database – The personal database formed through data collection is managed under our responsibility, and its use, access, and sharing, when necessary, will be carried out within the limits and business purposes described in this Policy.

• Technologies Used – We use market-standard tools to enable website operations, institutional communication, marketing, recruitment, and administrative management. These providers act as Data Processors, handling information according to our instructions and under contractual obligations of security and confidentiality. Some of these solutions may involve storage on servers abroad, with the legal safeguards required by Brazilian law being adopted.

• • Cookies: You may manage cookie preferences directly in your browser. In this case, some features we offer may be limited;

• • All technologies used will always comply with applicable legislation and the terms of this Policy.

• • We do not use any form of solely automated decision-making that impacts You.

3. HOW WE SHARE DATA AND INFORMATION

• Data Sharing Scenarios – The collected Data and recorded activities may be shared:

• • With competent judicial, administrative, or governmental authorities, whenever required by law, legal request, or court order;

  • Automatically, in the event of corporate transactions, such as mergers, acquisitions, and incorporations; and

  • With companies contracted to provide recruitment and selection services, always requiring such organizations to comply with data security and protection guidelines, as per item “4” of this Policy.

4. HOW WE PROTECT YOUR DATA AND HOW YOU CAN PROTECT IT TOO

• Access to Personal Data, Proportionality and Relevance – Internally, the collected Personal Data is accessed only by duly authorized personnel, observing the principles of proportionality, necessity, and relevance to our business objectives, as well as the commitment to confidentiality and privacy protection as described in this Policy. Those who improperly use the collected Personal Data, in violation of this Policy, will be subject to disciplinary measures, without prejudice to legal action where applicable.

• External Links– When You access our Website or receive our mailing, You may be directed, via link, to other portals or platforms that may collect your information and have their own Data Processing Policy.

• • It is Your responsibility to read the Privacy and Data Processing Policies of such third-party portals or platforms, and to decide whether to accept or reject them. We are not responsible for the Privacy and Data Processing Policies of third parties, nor for the content of any websites, content, or services linked to environments outside our own.

• Third-Party Processing Under Our Guidelines – Should third-party companies process, on our behalf, any Personal Data we collect, they shall mandatorily comply with the conditions stipulated herein and with information security standards.

• Email Communication – To optimize and improve our communication, when we send an email to You, we may receive a notification when it is opened, where such functionality is available. It is important that You remain aware that emails are sent exclusively from the domains: @consulcamp.com.br and @consulcamp.emp.br.

5. HOW WE STORE YOUR PERSONAL DATA AND ACTIVITY LOGS

• The collected Personal Data and activity logs are stored in a secure and controlled environment for a minimum period of:

• • Registration data and other data provided by You – For as long as the relationship lasts or for the period required to comply with legal and regulatory obligations;

  • Digital identification data – 6 months – Art. 15, Internet Civil Framework.

• Extended Storage Periods – For audit, security, fraud control, and rights preservation purposes, we may retain the history of your Data records for a longer period when required by law or regulatory standards.

• The collected Data will be stored on our servers located in Brazil, as well as in cloud computing environments (cloud computing), which may require a transfer and/or processing of such Data outside of Brazil

6. YOUR RIGHTS AND HOW TO EXERCISE THEM

• Basic Rights – You may request confirmation of the existence of Personal Data processing, as well as the display or correction of your Personal Data, through our Service Channel: lgdp@consulcamp.com.br.

• Restriction, Objection, and Deletion of Data – Through the Service Channel, You may also request:

• • Restriction of the use of your Personal Data;

  • To object to and/or withdraw consent regarding the use of your Personal Data; or

  • The permanent deletion of your Personal Data collected by We. The request will be reviewed and fulfilled within the applicable legal deadlines.

  • Upon the expiration of the retention period and legal necessity, Personal Data will be deleted using secure disposal methods, or used in anonymized form for statistical purposes.

7. INFORMATION ABOUT THIS POLICY

• Amendments and Updates – This Policy may be updated at any time to reflect legal, regulatory, or operational changes. The current version will always be available on our website, indicating the date of its last update. We recommend reviewing this Policy periodically to stay informed of any updates.

• Severability – Should any provision of this Policy be deemed inapplicable by a Data Authority or court, the remaining conditions shall remain in full force and effect.

• Service Channel. For any questions regarding the provisions of this Privacy and Data Processing Policy, or to exercise your rights with respect to your Data, You may contact the Personal Data Protection Officer via email: lgpd@consulcamp.com.br.

• Applicable Law and Jurisdiction. This Policy shall be interpreted in accordance with Brazilian law, in the Portuguese language, with the court of your domicile being elected to resolve any disputes arising from this document, unless otherwise specified by applicable law based on personal, territorial, or functional jurisdiction.

• • You, if not domiciled in Brazil, acknowledge that by using the features of our website, you will be subject to Brazilian law, and therefore agree that, should any dispute arise, the action must be filed in the Courts of the District of Campinas/SP.

8. GLOSSARY

For the purposes of this Policy, the following definitions and descriptions shall be considered for better understanding:

• Personal Data: Information relating to an identified or identifiable natural person.

• Processing: Any operation carried out with Personal Data, such as collection, use, storage, sharing, or deletion.

• Data Subject: The natural person to whom the Personal Data refers.

• Controller: The legal entity responsible for decisions regarding the processing of Personal Data.

• Processor: The legal entity that processes Personal Data on behalf of the Controller.

• Anonymization: The process by which data loses the possibility of being directly or indirectly associated with an individual.

Last Updated: March 2026