Personal Data Privacy Notice

This Privacy Notice contains information about the processing of personal data carried out by Grupo Avante, with the purpose of demonstrating absolute transparency on the subject and strengthening its commitment to its corporate values, in line with the provisions set forth in the General Data Protection Law (LGPD) and regulations issued by the National Data Protection Authority.

This Privacy Notice was prepared in compliance with Federal Law No. 12,965 of April 23, 2014 (Brazilian Internet Civil Framework) and Federal Law No. 13,709 of August 14, 2018 (General Data Protection Law - LGPD).

By accessing or using the website https://www.grupoavante.com.br, the data subject declares that they have read, understood, and agreed to this Privacy Notice.

This Privacy Notice provides information regarding the processing of your personal data when using the services and/or purchasing products from Grupo Avante and/or providing services to Grupo Avante.

This Privacy Notice explains which personal data is processed, for what purposes, and how to access and update it.

For a better understanding of this Notice, we clarify the following definitions:

• Processing agents: the controller and the processor.
• Anonymization: The use of reasonable and available technical means at the time of processing, through which data loses the possibility of association, directly or indirectly, with an individual.
• National Authority: Public administration body responsible for overseeing, implementing, and enforcing compliance with this Law throughout the national territory: National Data Protection Authority - ANPD.
• Database: A structured set of personal data, established in one or more locations, in electronic or physical format.
• Consent: A free, informed, and unequivocal expression by which the data subject agrees to the processing of their personal data for a specific purpose.
• Controller: A natural or legal person, of public or private law, who is responsible for decisions regarding the processing of personal data.
• Anonymized data: Data relating to a data subject that cannot be identified, considering the use of reasonable and available technical means at the time of processing.
• Personal data: Information relating to an identified or identifiable natural person.
• Sensitive personal data: Personal data concerning racial or ethnic origin, religious conviction, political opinion, membership in a trade union or religious, philosophical, or political organization, data relating to health or sexual life, genetic or biometric data, when linked to a natural person.
• Data Protection Officer: Person appointed by the controller and processor to act as a communication channel between the controller, data subjects, and the National Data Protection Authority (ANPD).
• Processor: A natural or legal person, of public or private law, who processes personal data on behalf of the controller.
• Data subject: A natural person to whom the personal data being processed refers.
• International data transfer: Transfer of personal data to a foreign country or international organization of which the country is a member.
• Processing: Any operation performed with personal data, such as those related to collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, deletion, evaluation or control of information, modification, communication, transfer, dissemination, or extraction.
• Shared use of data: Communication, dissemination, international transfer, interconnection of personal data, or shared processing of personal databases by public bodies and entities in the performance of their legal competencies, or between these and private entities, reciprocally, with specific authorization, for one or more processing modalities permitted by these public entities, or between private entities.
• General Data Protection Law - LGPD: Federal Law No. 13,709 of August 14, 2018, which provides for the processing of personal data, including in digital media, by natural persons or legal entities of public or private law, with the objective of protecting the fundamental rights of freedom and privacy and the free development of the personality of natural persons.
• Personal data breach: A security breach that accidentally or unlawfully causes the destruction, loss, alteration, disclosure, or unauthorized access to personal data transmitted, stored, or subject to any other type of processing.

Grupo Avante is committed to complying with the rules set forth in the General Data Protection Law (LGPD) and respecting the principles set out in Article 6, namely:

• Purpose: processing for legitimate, specific, explicit purposes communicated to the data subject;
• Adequacy: compatibility of processing with the purposes communicated to the data subject, according to the context of the processing;
• Necessity: limitation of processing to the minimum necessary for achieving its purposes, covering relevant, proportional, and non-excessive data in relation to the purposes of data processing;
• Free access: guarantee to data subjects of easy and free consultation about the form and duration of processing, as well as the completeness of their personal data;
• Data quality: guarantee to data subjects of accuracy, clarity, relevance, and currency of data, according to the need and for fulfilling the purpose of its processing;
• Transparency: guarantee to data subjects of clear, precise, and easily accessible information about the processing and the respective processing agents, subject to commercial and industrial secrets;
• Security: use of technical and administrative measures capable of protecting personal data from unauthorized access and accidental or unlawful situations of destruction, loss, alteration, communication, or dissemination;
• Prevention: adoption of measures to prevent the occurrence of damages due to the processing of personal data;
• Non-discrimination: impossibility of processing for unlawful or abusive discriminatory purposes;
• Accountability: demonstration by the agent of the adoption of effective measures capable of proving compliance with personal data protection rules and the effectiveness of such measures.

The terms of this Notice apply to all those who access the pages and domains of GRUPO AVANTE, whether they are customers or not.

By way of example, this Notice applies:

• to visitors;
• to natural persons who access the GRUPO AVANTE website;
• to legal entities, through the natural person of their representative; as well as those who in any way have their personal data processed by GRUPO AVANTE.

We emphasize that this Privacy Notice does not apply to anonymized or aggregated personal information, that is, anonymous versions of data subject information, aggregated data, or data that does not identify a particular individual.

Grupo Avante, within the scope of its services, needs to collect some personal data from Data Subjects so that contractual and commercial interactions can be established, and even so that legal obligations imposed by Brazilian legislation can be fulfilled.

By providing your personal data, the Data Subject authorizes Grupo Avante to collect, process, use, and disclose their data in accordance with the rules defined in this Notice.

Data processed by Grupo Avante will only be used in accordance with the rules set forth in this Personal Data Privacy Notice, as well as in Brazilian legislation.

Grupo Avante, when processing personal data, seeks to respect best practices in data security and protection, promoting actions and improving systems to ensure the protection of personal data provided by Data Subjects.

All personal data is processed by Grupo Avante with specific legal bases, in accordance with the purpose.

Grupo Avante collects and processes only the personal data necessary for the manufacture and marketing of its products, as well as for activities related to its employees and the execution of employment contracts, as well as services provided by third parties.

Regarding the external public that maintains a relationship with Grupo Avante, the following data is processed:

• Individual registration data: full name, CPF (tax ID), RG (identity card), address, marital status, phone number, email, resume (job applicants);
• Supplier, partner, and representative data: full name, address, phone number, email, position information, bank details;
• Location data: IP address of your computer or mobile device, date and time, and geolocation data;
• Photos and recordings: registration and internal CCTV system on the physical premises of GRUPO AVANTE;
• Sensitive personal data: biometrics for access to GRUPO AVANTE facilities, health-related data for the purposes of Socio-Environmental Perception Research for territory diagnosis and Social License assessment.

The personal data covered by this Privacy Notice will be processed for the following purposes:

• Creating and maintaining user accounts on our website;
• Sending communications and products marketed by GRUPO AVANTE;
• For the execution of contracts or preliminary procedures related to a contract to which the data subject is a party;
• When necessary to comply with legal and/or regulatory obligations by GRUPO AVANTE;
• To serve the legitimate interests of GRUPO AVANTE;
• For the regular exercise of rights by GRUPO AVANTE in judicial, administrative, and arbitration proceedings;
• For conducting corporate research and campaigns;
• For promoting health protection and protecting the life or physical safety of the data subject or third parties;
• Identifying, preventing, and managing physical and cybersecurity risks on the GRUPO AVANTE website;
• For hiring new employees;
• For business management, including financial management, asset management, acquisitions and disposals, implementation of controls, issuance of management reports, analysis, internal audits, and investigations;
• For secondary purposes that are not conflicting with or excessive in relation to the purposes listed in this Privacy Notice, always in compliance with Brazilian legislation and in observance of the individual rights and freedoms of personal data subjects.

In order to fulfill the purposes described in this Privacy Notice, GRUPO AVANTE may share your personal data with companies within the same economic group and partner companies, seeking the optimization and improvement of the service and product marketed, which will be carried out in a justified manner and always maintaining the highest security standards.

The following describes some situations in which the sharing of data subjects' data may occur:

• Service providers: GRUPO AVANTE works in partnership with and contracts external services from other organizations in order to enable its commercial activities;
• Public Authorities;
• Clients and/or Companies that are clients of GRUPO AVANTE;
• Authorized agents, licensees, service providers, and/or subcontractors of GRUPO AVANTE, especially those related to Accounting, Banks, and IT (software) suppliers;
• If GRUPO AVANTE undergoes any corporate transaction or intellectual property disposal that is part of a sale, merger, change of control, or any preparatory event for any of these operations, it will be authorized to share the personal data of data subjects with third parties participating in the event.

Cookies are collected from visitors to the Grupo Avante website when they access or browse the portal.

By accessing the website, you authorize the use of cookies in accordance with this Notice.

Grupo Avante seeks to clearly and thoroughly explain what cookies are, how, when, and why they are used on its website.

What are Cookies and which Cookies does Grupo Avante collect?

Cookies are small text files installed in the browser of the computer or mobile device by the websites the visitor accesses, so that the server can read them later. For example, data about the device used by the user, as well as their location and time of access to the site, may be stored.

It is important to note that not every cookie contains personal data of the user, as certain types of cookies may be used solely for the service to function correctly.

Information eventually stored in cookies is also considered personal data, and all rules set forth in this Privacy Notice also apply to them.

Grupo Avante uses cookies to improve the user experience, allowing you to navigate between different parts of our website and for it to function correctly.

Cookies are also used to generate reports and improve website performance.

The cookies collected by the Grupo Avante website are:

Grupo Avante may carry out international data transfers to other countries, with the objective of enabling the provision of services or supply of products, especially regarding the archiving of data within the company, through its Systems or Cloud services.

In such cases, data protection and information security standards compatible with this Privacy Notice will be contractually established, so that data processing is carried out with an adequate level of security.

When you interact with Grupo Avante through social media, your personal data will also be visible to all other visitors, according to your privacy settings in each of these environments. In this case, Grupo Avante is not responsible for the processing of such personal data or for the privacy policies of social media platforms.

Data received from social media, when used, will be subject to this Privacy Notice.

The processing of personal data by Grupo Avante will occur until:

• It has been verified that the indicated processing purposes have been achieved or that the data is no longer necessary/relevant for achieving the desired purpose; or
• The processing period stipulated by labor, social security, or any other applicable legislation has ended.

Personal data will be deleted after the end of its processing, within the scope and technical limits of Grupo Avante's activities.

Grupo Avante may retain collected personal data, even after the end of processing, in any of the following situations:

• Compliance with legal or regulatory obligations;
• Constitution of evidence to safeguard the regular exercise of rights, including in contracts and in judicial, administrative, and arbitration proceedings;
• Exclusive use by Grupo Avante, with third-party access prohibited and provided that the data is anonymized;
• Transfer to third parties, provided that the data processing requirements set forth in the Law are respected.

In accordance with applicable legislation, in particular the provisions of Articles 9 and 18 of the LGPD, the Data Subject may request, at any time, by submitting a request to Grupo Avante:

• Confirmation of the existence of processing;
• Access to the data;
• Correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or deletion of unnecessary or excessive data;
• Data portability, within legal limits;
• Deletion of personal data processed with the consent of the data subject, except in the cases provided for in Article 16 of the LGPD;
• Information about public and private entities with which Grupo Avante, as controller, has shared data;
• Information about the possibility of not providing consent and about the consequences of refusal;
• Revocation of consent.

The requests described above should be directed to one of the channels indicated in this Notice.

Grupo Avante will retain personal data for the time necessary to fulfill its activities. However, the company may retain certain information as required by applicable law.

When there is no basis for continuing to process personal data, it will be deleted or anonymized in accordance with applicable laws.

The data subject is solely responsible for the accuracy, truthfulness, or lack thereof in relation to the data they provide or for its outdatedness.

The Company is committed to ensuring the confidentiality, protection, and security of the personal data of its Data Subjects, through the maintenance of security, technical, and administrative measures sufficient to protect the personal data processed by it from unauthorized access and accidental or unlawful situations of destruction, loss, alteration, communication, or any form of inadequate or unlawful processing, as well as requiring that other processing agents with whom personal data may be shared adopt the same measures indicated herein.

Grupo Avante has systems and equipment designed to ensure data security, creating and updating procedures that prevent unauthorized access, accidental losses, and/or destruction of personal data, in accordance with Article 46 of the LGPD, committing to respect the legislation regarding the protection of personal data of Data Subjects and to process this data only for the purposes for which it was collected, as well as to ensure that this data is processed with adequate levels of security and confidentiality.

It is also important to emphasize that the company maintains, with the third parties with whom it shares data, contractual relationships with requirements for guarantees and privacy standards compatible with those practiced by Grupo Avante.

The database formed through the collection of Personal Data is under our responsibility, and its use, access, and sharing, when necessary, will be done within the limits and business purposes described in this Notice.

Every employee must commit to ensuring its application and observance.

Access to Systems containing data will be restricted to employees and data processors who depend on them to perform their tasks, through controls that identify authorized users. Thus, access to Systems will be assigned according to the user profile, and access to certain files may be restricted based on the position held by Employees and/or authorized processors.

Access to Systems will only be permitted through the use of login and password, which are personal and non-transferable.

Grupo Avante will communicate to the National Data Protection Authority (ANPD) and/or the data subject if a security incident occurs that may pose a relevant risk or damage, in accordance with Article 48 of Law No. 13,709/2018.

The Company adopts a contingency plan aimed at guiding the conduct of its employees in the event of data leaks, inadequate data processing, and system invasions by hackers.

Human error, although inevitable, is mitigated through the adoption of manuals and internal policies aimed at guiding employee conduct in the performance of activities within the company, thereby seeking to prevent them from processing data inadequately and/or causing data leaks. System invasion by hackers is mitigated through the use of firewalls and antivirus software.

The Data Subject may contact Grupo Avante for further information about the processing of their personal data, as well as any questions related to the exercise of their rights as attributed by applicable legislation and, in particular, those referred to in this Notice, through the following channel:

The company reserves the right, at any time, to make modifications or updates to this Notice, with such changes being duly communicated to personal data subjects and updated in our policies.

We recommend that the data subject periodically check this Privacy Notice to familiarize themselves with any changes made.