PRIVACY POLICY – DIGIAGE

At Digiage Technologies, we value your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use and protect your data.

1. Purpose

Codework Serviços de Informática Ltda., a private legal entity registered under CNPJ no. 09.552.152/0001-71, headquartered at Rua José Rocha Bomfim, 214 – Bloco Paris, salas 223 à 228 – Loteamento Center Santa Genebra – Campinas/SP, considers sensitive and relevant the electronic records and personal data you (the “User”) leave when using the websites and services of Digiage Technologies (the “Pages”). This Privacy Policy (the “Policy”) sets out, in a simple, transparent and objective manner, which data and information will be collected and when they may be used.

The purpose of this policy is to ensure the protection of personal data collected by Digiage Technologies, informing users which data is collected, how it is used and with whom it is shared. The policy ensures compliance with Brazil's General Data Protection Law (LGPD) and other applicable legislation, promoting transparency in data processing. It also provides guidance on users' rights and the measures adopted to keep information secure.

This policy applies to data collection and processing activities carried out through the website www.digiage.com.br and other platforms managed by Digiage Technologies. Below, we detail the main aspects of our policy to ensure users understand it clearly.

This policy refers solely and exclusively to data processed by Digiage Technologies. For the policies that apply to your personal data processed by third parties, we recommend visiting their respective websites.

2. What Personal Data Does Digiage Collect?

Digiage Technologies may collect information actively entered by the User at registration, as well as information collected automatically when the pages and network are used, such as identification of the business establishment used and IP address with connection date and time, among others.

There are therefore two types of personal data being processed:

2.1. Information Provided by the User

Digiage Technologies collects all information actively entered by the User on the Pages, such as full name, email, gender, date of birth, phone number, city and state, when the User fills out forms on the Pages. Digiage Technologies will use this information to share marketing materials, promotions and events.

2.2. Automatically Collected Data

Digiage Technologies also automatically collects a range of information, such as: characteristics of the access device and browser, IP address (with date and time), IP origin, click data, pages visited, pages visited after leaving the Pages, and any search terms typed on or referring to the sites, among others. For this collection, Digiage Technologies uses standard technologies such as cookies, pixel tags, beacons and local shared objects, which serve to improve the User's browsing experience on the Pages according to their habits and preferences.

The information collected may be shared by Digiage Technologies with:

— Other partner companies, when necessary for the proper delivery of the services within the scope of its activities;

— To protect the interests of Digiage Technologies in any type of dispute;

— Under court order or at the request of a competent authority.

We also clarify that your information may be shared with companies that provide the technology and operational infrastructure required for the activities of Digiage Technologies, such as payment processors and data storage service providers.

2.3. Explicit Consent and Cookie Control

Under the LGPD, explicit consent is required for the use of cookies and automatic data collection technologies, except when they are strictly necessary for the website to function. The Digiage Technologies platform provides a cookie consent banner that allows users to opt in to specific cookie categories, such as:

— Necessary Cookies; — Performance Cookies; — Functionality Cookies; — Marketing Cookies.

In addition, users can change their cookie preferences directly in the website settings at any time. Users who wish to disable all cookies through their browser may do so, although this may affect certain website features, as mentioned above.

3. Managing Cookie Preferences

Digiage Technologies uses cookies and similar technologies to enhance the user experience on its pages, tailoring content and ads based on user preferences. To ensure full transparency and user control, we provide a dedicated cookie consent management tool.

At Digiage Technologies, we respect your preferences regarding cookie collection. You can configure your cookie preferences in several ways:

3.1. Website Settings

When you first visit our website, a banner will inform you about the use of cookies. In this banner, you can choose to accept all cookies, customize your preferences or reject non-essential cookies.

If you choose to customize, you can select which cookie categories to allow. The categories include:

— Necessary Cookies: essential for the website to function. — Performance Cookies: used to analyze website performance and improve the user experience. — Functional Cookies: enable personalization and additional features. — Advertising Cookies: used to deliver relevant ads and measure the effectiveness of advertising campaigns.

3.2. Browser Settings

You can manage cookies through your browser settings. Below are instructions for disabling cookies in some of the most popular browsers:

• Google Chrome: Go to “Settings” > “Privacy and security” > “Cookies and other site data” and adjust your preferences.
• Safari: Go to “Preferences” > “Privacy” and select “Manage Website Data” to adjust your settings.

3.3. Cookie Opt-Out

In addition, users may opt out of Digiage Technologies advertising campaigns and newsletters at any time by accessing their communication preferences in the website settings, or by requesting to unsubscribe via email at dpo-digiage@digiage.com.br.

We reiterate that, when adjusting your settings, you should be aware that disabling cookies may affect website functionality and the user experience.

4. How Digiage Uses the Information Collected

The information collected by Digiage Technologies is used to establish a contractual relationship or to manage, administer, deliver, expand and improve the Pages for the User, tailoring them to the User's tastes and preferences, as well as to create new services and products to be offered to Users.

The information collected may also be used for advertising purposes, such as sending information about brands, products and promotions of Digiage Technologies, promoting events or conducting purchase satisfaction surveys, subject to the data subject's consent. If the User no longer wishes to receive advertising from Digiage Technologies, the User may contact Digiage Technologies at any time via email at dpo-digiage@digiage.com.br.

Digiage Technologies is committed to upholding the principles established by Brazil's Internet Civil Framework (Law No. 12,965/2014), which governs internet use in Brazil. We guarantee net neutrality, ensuring that users' data traffic is not subject to discrimination or interference, fostering a fair and equitable digital environment. The company is also dedicated to ensuring equal access to online services, adopting data protection best practices and respecting users' digital rights.

Legal Basis: in these cases, data processing is authorized by Article 7, item I, of Law No. 13,709/2018, Brazil's General Data Protection Law (“Lei Geral de Proteção de Dados – LGPD”).

5. How, When and With Whom Digiage Shares Your Information

We share personal data with third parties to expand our ability to communicate with you and our partners, as well as to comply with applicable laws and regulations, protect our rights and respond to court orders. We may also obtain publicly available personal data through partners of Digiage Technologies, including social networks. Digiage Technologies will respect the consent limitations granted by data subjects to its partners.

Digiage Technologies may share the personal data collected with third parties, always in line with the purposes set out in this Privacy Policy and based on the permissions granted by the data subject. Data may be shared in the following situations:

— Business Partners: Digiage Technologies partners with various companies to deliver services and enhance your user experience. These include, but are not limited to:

• Hosting and data storage providers: responsible for ensuring the security and availability of information in cloud environments.
• Data analytics companies: for reporting purposes and to improve the services offered.
• Marketing and advertising purposes: data may be shared with partners that help run marketing campaigns; these companies are responsible for following LGPD guidelines on the use of data for such purposes.

— Legal and Government Authorities: Digiage Technologies may share data with public, judicial or government authorities to:

• Comply with court orders or official requests;
• Ensure compliance with applicable laws;
• Protect its rights in legal disputes or conflicts involving the company.

— Security audits and consulting: to ensure compliance with security and data protection standards, Digiage Technologies may share information with companies specializing in cybersecurity and data protection audits. This ensures ongoing adherence to industry best practices and regulations, such as ISO 27001.

— Corporate Transfers: in the event of mergers, acquisitions or other corporate restructuring, user information may be transferred to the legal successors of Digiage Technologies, ensuring continuity of service and maintenance of the data protection practices set out in this Policy.

Digiage Technologies is committed to ensuring that all third parties with whom it shares personal data maintain the same level of protection and confidentiality required by the LGPD and other applicable legislation.

6. International Data Transfers

In exceptional circumstances, Digiage Technologies may transfer personal data to other countries when necessary to deliver services, fulfill contractual obligations or for other legitimate reasons. Although this is possible, the company does not frequently carry out international data transfers.

Should such a transfer occur, it will be carried out in compliance with applicable data protection regulations, using appropriate safeguards such as standard contractual clauses to ensure personal data is processed in accordance with legal standards. Every international data transfer will be properly documented and recorded, as required by internal policies and applicable law.

Information on potential international data transfers will be available in this Privacy Policy, and clients may request details on the countries to which their data may be transferred and the protection mechanisms adopted.

7. How Digiage Protects Your Information

Digiage Technologies will store the information collected on its pages on its own servers or on servers it contracts. Our company adopts a range of technical and organizational measures to protect its users' personal data, in line with cybersecurity best practices and the requirements of the LGPD and ISO 2700, in compliance with the security standards guidelines set out in Decree No. 8,771/2016. The main measures implemented are:

— Data Encryption: use of industry-standard methods to encrypt and anonymize the data collected. All data collected by Digiage Technologies is stored on secure servers, and sensitive information such as passwords and financial data is protected by advanced encryption both in transit and at rest.

— Access Control: protection against unauthorized access to its systems. Access to the location where collected information is stored is restricted to pre-authorized individuals only. Access to personal data is limited to authorized employees and service providers, solely for specific purposes related to their roles. Such access is regularly monitored and audited.

— Information Confidentiality: all employees and service providers commit to maintaining strict confidentiality regarding the information they access, with civil liability in the event of a breach of confidentiality, under Brazilian law.

— Regular Audits: Digiage Technologies conducts periodic security audits to identify vulnerabilities and ensure its security practices comply with international standards, including ISO 27001. These audits are conducted by specialized internal and external teams.

— Security Incident Monitoring: we run a continuous monitoring system to quickly detect and respond to cyber threats and unauthorized access attempts. This includes intrusion detection technologies and next-generation firewalls.

— Security Awareness Programs: all employees of Digiage Technologies undergo periodic information security training, covering everything from safe system use to awareness of cyber threats such as phishing and social engineering.

— Incident Response Plans: in the event of a security incident, Digiage Technologies has a well-defined incident response plan that includes notifying affected data subjects and informing the competent authorities, as required by law.

We also review our security practices regularly to ensure they remain up to date in the face of new threats and emerging technologies in information security.

Digiage Technologies strictly complies with Brazil's Cybercrime Law (Law No. 12,737/2012), which defines illegal conduct in the digital environment. Any attempted intrusion, data breach or cybercriminal activity will be taken seriously and may result in legal sanctions. The company continuously monitors its systems and adopts robust security measures to prevent and report practices that could compromise the integrity of user information.

Although Digiage Technologies makes every effort to preserve the privacy of Users' data, it is important to note that no website is completely secure, and we cannot fully guarantee that all information transmitted through the Pages will not be subject to unauthorized access through methods designed to obtain information improperly. For this reason, we encourage Users to take appropriate measures to protect themselves, such as keeping all usernames and passwords confidential.

8. Document Classification and Labeling

Digiage Technologies follows a document classification and labeling procedure to ensure personal data and sensitive information are handled according to their level of confidentiality. The classifications are as follows:

— Public: information that can be disclosed to the general public with no risk to privacy or security, such as widely published company data. — Internal: data intended for internal use at Digiage Technologies that must not be shared externally without prior authorization, including information on internal policies, communications between departments, etc. — Confidential: information that requires a high level of protection and is restricted to a specific group of employees, including users' personal data, financial information and any data whose disclosure could cause harm to Digiage Technologies or its users. — Secret: data whose unauthorized disclosure could cause significant harm to Digiage Technologies or third parties, including business strategy, sensitive contractual agreements and high-risk personal data such as health information.

Every document and piece of information stored at Digiage Technologies is classified under this framework, and all employees are trained to understand and respect these categories, ensuring information is handled and protected according to its sensitivity level.

9. Your Rights

In compliance with applicable regulations on the processing of personal data, Digiage Technologies respects and guarantees the User's ability to submit requests based on the following rights:

— Confirmation that processing takes place; — Access to data; — Correction of incomplete, inaccurate or outdated data; — Anonymization, blocking or deletion of unnecessary, excessive or non-compliant data; — Portability of your data to another service or product provider, upon the User's express request; — Deletion of data processed with the User's consent; — Information about the public or private entities with which Digiage Technologies has shared your data; — Information about the option not to give consent and the consequences of refusing; — Withdrawal of consent.

These rights may be exercised by submitting a request for subsequent review and action by Digiage Technologies.

If you need any assistance exercising your rights, you may contact Digiage Technologies as described in this Policy.

Digiage Technologies will make every effort to fulfill such requests as quickly as possible. However, even in the case of a deletion request, the minimum retention period for internet application user data required by Brazilian law will be observed.

10. Disclosure of Personal Data

By providing your personal data, you consent to the company collecting, storing, using and sharing this information as described in this Privacy Policy. Consent is given freely, in an informed and unambiguous manner, and the data subject has the right to withdraw this consent at any time, in accordance with the provisions of Brazil's General Data Protection Law (LGPD).

If any change in the use or sharing of personal data requires renewed consent, we will contact you to obtain the necessary authorization.

You may, at any time, request information about the personal data we hold and exercise your data protection rights.

10.1. Contact for Personal Data Inquiries

If you have questions or requests, or wish to exercise your rights regarding your personal data as provided by applicable law, you can reach us through the following channels:

— Email: dpo-digiage@digiage.com.br — DPO: Wesley Forti – DPO — Address: Rua José Rocha Bomfim, 214 – Bloco Paris, salas 223 à 228 – Loteamento Center Santa Genebra – Campinas/SP

Our Data Protection Officer (DPO) is available to handle your requests and answer any questions about the processing of your personal data. If the primary DPO is unavailable, a backup DPO ensures continuity of service and support. We recommend including as much detail as possible in your communications to help us respond quickly.

10.2. Response Time and Request Procedure

We are committed to responding to requests regarding the processing of your personal data within the maximum period set by applicable law, currently up to 15 (fifteen) business days, except where specific provisions establish different deadlines.

Upon receiving your request, we will follow this procedure:

— We will confirm receipt of your message through one of the available channels. — We will verify your identity to ensure the request is made by the data subject or a duly authorized legal representative. — We will review the nature of the request and take the appropriate action, keeping you informed of the progress and outcome.

If your request requires more time to complete due to its complexity or the volume of information involved, we will notify you with a clear explanation and a new estimated completion date.

11. Updates to This Privacy Policy

Digiage Technologies reserves the right to amend this Policy as often as necessary to provide you with greater security and convenience and to continuously improve your experience. That is why it is important to review our Policy periodically. For your convenience, the date of the last update is shown at the top of the document. If we make material changes that require new authorizations from you, we will publish a new privacy policy.

12. Governing Law and Jurisdiction

This Policy shall be governed, interpreted and enforced in accordance with the laws of the Federative Republic of Brazil, especially Law No. 13,709/2018, regardless of the laws of other states or countries, and the courts of the User's place of residence shall have jurisdiction to resolve any matter arising from this document.