Privacy Policy and Governance

4.1. Executive Board

The Executive Board is responsible for ensuring that Economatica has adequate resources, policies and controls to comply with the LGPD and other regulations related to data protection and information security.

The Executive Board's responsibilities are to:

• Approve this Policy and other data governance documents
• Ensure that personal data processing is carried out in accordance with the company's legal and ethical principles
• Ensure institutional support and the necessary resources for the Data Protection Officer (DPO)
• Deliberate on significant security incidents and the associated corrective measures
• Promote a culture of data protection and privacy at all levels of the organization

4.2. Ethics Committee / Privacy and Data Protection Committee ("Committee")

The Ethics Committee is a multidisciplinary advisory body responsible for supporting the Executive Board and the DPO in decisions related to privacy and data governance.

The Committee's duties are to:

• Support the implementation and monitoring of the privacy and data protection program
• Analyze situations of high or critical risk related to the processing of personal data
• Monitor and review, when necessary, impact reports (DPIA) and legitimate interest assessments (LIA)
• Support the DPO in incident response and in communications with the ANPD
• Promote communication, training and awareness initiatives on good practices in ethics, privacy and compliance

4.3. Data Protection Officer (DPO)

The Data Protection Officer (DPO) is the professional appointed by Economatica to act as a communication channel between the company, data subjects and the ANPD.

The DPO's duties are to:

• Supervise and coordinate Economatica's privacy and data protection program
• Implement and review personal data processing controls, processes and policies
• Ensure adequate legal grounds for collection and processing
• Receive, record and respond to data subject requests, in accordance with the LGPD deadlines
• Support the updating of the RoPA and the conducting of DPIAs and LIAs, when applicable
• Support the Executive Board and the Committee in incidents and communications to the ANPD
• Promote internal training and campaigns
• Keep up to date with legislation, regulations and best practices

4.4. Information Security Department

The Information Security Department is responsible for implementing and maintaining technological and operational protection practices for the personal data processed by Economatica.

The Information Security Department's responsibilities are to:

• Develop and review security policies, controls and procedures
• Monitor and mitigate confidentiality, integrity and availability risks
• Support the DPO in the investigation and management of incidents
• Ensure controlled and auditable access
• Promote best practices and guide employees on secure use

4.5. Department Managers

Each Department Manager (Products, Technology, Sales, Support, Specialists and other departments) is responsible for ensuring compliance with this Policy and with the privacy and security guidelines within the scope of their activities.

Department Managers' responsibilities are to:

• Ensure ethical processing, in compliance with the LGPD and this Policy
• Keep the RoPA and retention periods up to date
• Inform the DPO of new processes involving personal data before they begin
• Support the preparation of DPIAs/LIAs when applicable
• Immediately report incidents or data subject requests

4.6. Employees

All of Economatica's employees and service providers have a duty to protect the personal data under their responsibility and to act in accordance with the principles of this Policy and the legislation in force.

Each employee's responsibilities are to:

• Process personal data only for legitimate and authorized purposes
• Safeguard the confidentiality of the information accessed
• Follow the guidance of the DPO and Department Managers
• Immediately report incidents, misuse or suspected breaches
• Participate in training and awareness campaigns

5.1. Categories of Data Collected

Economatica processes personal and business data exclusively for legitimate purposes linked to the provision of its services, business relationships, legal obligations and information security.

The collection of personal data is limited and occurs mainly in corporate (B2B) contexts, involving the professional contact data of representatives of clients, suppliers and partners. In addition, technical data on the use of the platforms and business data necessary for the performance of contracts may be processed.

Cookies and telemetry: Economatica may use cookies, SDKs and telemetry tools to record technical events (e.g., performance, errors, authentication, security) and improve the experience on the platforms. Their use is limited to strictly necessary, security and service improvement purposes.

Minors: Economatica's platforms and services are not intended for children. The company does not intentionally collect data from children or adolescents.

5.2. Purposes and Legal Bases for Processing

The data processed is used for legitimate purposes related to the company's business activities. Processing operations are based on the legal grounds provided for in the LGPD, the predominant ones being:

• Performance of a contract (Art. 7, V, LGPD): provision of services, technical support, billing, collections and business relationship
• Compliance with a legal or regulatory obligation (Art. 7, II, LGPD): tax, labor, social security and regulatory requirements
• Legitimate interest (Art. 7, IX, LGPD): information security, maintenance of records, service improvement and B2B communication
• Consent (Art. 7, I, LGPD): when the processing does not fall under the grounds above or involves optional communications

Examples of processing purposes:

• Management and performance of service agreements
• Registration of and service to clients, suppliers and partners
• Technical support, maintenance and monitoring of the platforms
• Compliance with tax, accounting and regulatory obligations
• Access control, logs and security records
• Institutional communication and relationship with corporate clients
• Selection and management of employees and service providers

5.3. Governance Requirements and Principles in Data Processing

Economatica observes the principles of the LGPD and adopts practices proportional to its size and the nature of its activities:

• Purpose: only for legitimate, specific and previously communicated purposes
• Adequacy: compatible with the purposes communicated and the context of collection
• Necessity: only strictly necessary data is collected and processed
• Transparency: data subjects are informed about the processing and their rights
• Security: technical and administrative measures to protect against unauthorized access, loss or alteration
• Prevention: practices to avoid incidents and minimize risks
• Responsibility and Accountability: employees and managers ensure compliance with policies and legislation

In addition, it is desirable that:

• Each department keep its Record of Processing Activities (RoPA) up to date
• DPIAs and LIAs be prepared whenever there is a high risk to the data subject or processing based on legitimate interest
• Processing be documented and periodically reviewed by the DPO and the Executive Board

Economatica makes reasonable efforts to ensure that the data is accurate and up to date. Whenever outdated data is identified, the data subject or the corporate client must communicate the corrections to the DPO/relationship department.

Any new product, feature or significant process change involving personal data must be assessed in advance by the DPO (and the department manager), with an update of the RoPA and, when applicable, the performance of an LIA/DPIA.

5.4. Data Processing on Behalf of Third Parties (Economatica as Processor)

When acting as a Data Processor, carrying out processing on behalf of institutional clients or partners, Economatica will strictly follow the Controller's instructions, in accordance with the contracts in force and the LGPD.

In these situations:

• Processing is limited to the purposes defined by the Controller
• The same security and confidentiality measures adopted internally are observed
• The use of the data for any of Economatica's own purposes is prohibited
• Security incidents are reported to the Controller and the DPO immediately

6.1. Data Sharing

Economatica may share personal and business data with third parties only when there is a legal basis and a legitimate purpose, ensuring processing under the same security and confidentiality standards adopted internally.

Sharing may occur:

• With technical providers and partners (operations, hosting, support, infrastructure and maintenance)
• With governmental and regulatory authorities when required by law (e.g., CVM, BACEN, Receita Federal and ANPD)
• With law firms, accounting firms or external consultants (regular exercise of rights, audits and legal obligations)
• In specific commercial or corporate transactions, with adequate contractual guarantees
• With institutional clients, when Economatica acts as a Processor, following the Controller's instructions

Economatica does not commercialize personal data and adopts contractual clauses and due diligence to ensure that third parties observe ethical and legal standards.

Sub-processors: When contracted third parties involve sub-processors, the latter must comply with the same security, confidentiality, retention and disposal obligations set forth in this Policy and in the contract, with Economatica remaining responsible for supervision.

6.2. International Data Transfer

Economatica may carry out international data transfers, especially when using cloud storage services or tools from foreign providers (for example, hosting and security).

Such transfers will only take place when:

• The destination country offers a level of protection compatible with the LGPD, or
• There are specific contractual clauses, additional guarantees or the data subject's consent, as required by law

Economatica requires from international suppliers and partners contractual safeguards that ensure adequate protection of the transferred data.

6.3. Data Subject Rights

We respect and guarantee data subjects the exercise of the rights provided for in the LGPD. Data subjects may, at any time and upon request to the DPO, exercise the following rights:

Channel and response time: Requests must be sent to the Data Protection Officer (DPO) by email at incidente@economatica.com.br. Economatica will confirm receipt immediately and will respond within 15 (fifteen) calendar days, and may request additional information to verify identity.

7.1. Information Security

Economatica adopts technical and administrative measures proportional to its size and complexity to protect personal and business data against unauthorized access, loss, alteration or improper disclosure.

Main practices and controls:

• Secure infrastructure, with dedicated servers and certified cloud providers (ISO 27001, SOC 2)
• Encryption in transit (SSL/TLS) and, when applicable, at rest
• Individualized access control, per-user authentication and logs
• Automatic daily backups in redundant environments
• Continuous monitoring of integrity and availability
• Periodic security updates and fixes
• Permission management and periodic access reviews
• Internal training on security, phishing and good digital practices

Employees and service providers are directly responsible for protecting information and must follow the guidance of the DPO and the Information Technology department regarding the secure use of systems, devices and passwords.

7.2. Procedure in the Event of Security Incidents

Economatica maintains an Incident Response Procedure, with steps for cases of actual or suspected breaches of personal data, business data or systems.

In any situation (e.g., unauthorized access, loss, leak or accidental deletion), the employee or service provider must immediately notify the DPO through the official channel.

Internal protocol steps:

• Identification and containment: initial assessment, isolation of the source and prevention of spread
• Analysis and recording: investigation of causes, impact, categories of affected data and corrective measures
• Communication: notification to the Executive Board and, if applicable, to the ANPD and data subjects, according to the risk and legal requirements
• Correction and mitigation: corrective actions and prevention of recurrence
• Documentation and learning: detailed record, lessons learned and improvements to controls

Failure to comply with security guidelines or failure to report incidents may result in disciplinary measures, depending on the severity.

8.1. Data Retention

This section defines internal guidelines for the retention, storage and secure disposal of personal and business data, in accordance with the governance and data protection best practices adopted by Economatica.

Data must be kept only for as long as necessary for the purposes for which it was collected, or for the period required by legal, regulatory or contractual obligations.

Retention may occur:

• For as long as the contractual relationship with clients, suppliers or partners lasts
• For as long as access to the platform remains active
• During the limitation period for the defense of rights (Art. 205 of the Civil Code, up to 10 years)
• For the legal and tax periods (e.g., accounting and tax documents, 5 years)
• In anonymized form, when full deletion is not technically possible or there is a legitimate interest in statistical/historical data

Personal data of employees and candidates follows the legal labor, social security and document retention periods defined by law.

8.2. Retention Periods by Data Category

8.3. Data Disposal and Deletion

Once the applicable retention period has ended, the data must be securely deleted or anonymized, in accordance with technical standards that prevent its reconstruction or re-identification.

Guidelines:

• Deletion is carried out by the Information Technology department, under the supervision of the DPO
• Systems, databases and backups must be included in the process
• When applicable, data will be anonymized, preserving statistical or aggregated information
• Physical documents must be shredded and properly disposed of
• Disposal operations must be recorded (date, person responsible and type of data deleted)

8.4. Data Shared with Third Parties

Third parties and processors that process data on behalf of Economatica must follow the same retention and disposal rules described in this Policy, formalized through specific contractual clauses.

Typical contractual guarantees:

• Deletion or return of the data at the end of the contract
• Proof of secure disposal, when requested
• Confidentiality and non-use for other purposes

8.5. Periodic Review

The DPO, with the support of the Executive Board, will carry out an annual review of the retention periods and disposal procedures, to maintain alignment with legal requirements and the company's operational reality.

9.1. Privacy and Incident Channel

For questions about the processing of personal data, the exercise of data subject rights or the reporting of security incidents, official contact with the DPO must be made by email: incidente@economatica.com.br.

9.2. Changes and Effective Date

This Policy takes effect on the date of its approval by the Executive Board and may be updated at any time through the publication of the new version. Economatica will keep the date of the last update visible in the document and will communicate significant changes when necessary.

9.3. Contractual Precedence

In the event of a conflict between this Policy and specific contractual terms entered into with clients or partners, the contractual terms shall prevail, provided that they are compatible with the LGPD and other applicable regulations.

9.4. Compliance and Consequences

Non-compliance with this Policy may subject the offender to disciplinary measures and other applicable legal and contractual actions.

9.5. Periodic Review

The Policy will be reviewed at least annually (or whenever there is a relevant regulatory change), under the coordination of the DPO, with approval by the Executive Board.