PRIVACY POLICY

This Privacy Policy was last updated on July 12, 2022

In order to carry out customs and international logistics processes, in addition to managing import and export operations, we would like to ask you to take the time to learn about our privacy practices so that you can understand how and for what purpose your personal data may be processed.

This Policy covers our data collection activities both online and offline, covering Personal Data (not just the legal entity), through our various channels, including – but not limited to, website forms, whatsapp, email sending , phones, service desk systems, apps, social media, satisfaction surveys, according to your interests and please note that we may aggregate combined Personal Data from different sources (e.g. our website and offline events).

We want to provide a good service and serve you efficiently and to improve your experience, we will number the topics in case you want to evaluate just a few.

1. Important Definitions

2. Security

3. Data collection sources

4. Personal information collected

5. Personal data of children and adolescents

6. Purpose of data collection

7. Cookies and Tracking

8. Sharing of Personal Data

9. Transfers of Personal Data Outside Brazil

10. Users' rights

11. Data storage period

12. Changes and updates to this policy

1. Definições importantes

General Data Protection Law (LGPD): Federal Law No. public or private, with the objective of protecting the fundamental rights of freedom and privacy and the free development of the personality of the natural person.

Processing Agents: They are those responsible for the Processing of Personal Data and are separated into two categories: Controller, Operator and Sub-Operator.

The Controller is the person or company that collects the data and is responsible for decisions regarding the Processing of Personal Data. The Operator, in turn, is the person or company that carries out the Processing of Personal Data on behalf of the Controller (supplier of the Controller), strictly following its instructions.

The sub-operator is the person or company engaged by the Operator to perform the contract with the Controller. Personal Data: Information related to an identified or identifiable natural person (You), such as your CPF, RG, address, telephone number, among others.

Processing: Any operation performed with Personal Data, whether automated or not, that is, collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, storage, archiving , elimination, evaluation or control of information, modification, communication, transfer, dissemination or extraction.

2. Security

Our policy is designed to let you know how we will collect, handle, store, process, share and protect your information. To earn this trust, it is critical that we clearly demonstrate how we use your information and protect your rights. Personal Data processed by ORIGINAL is protected by physical, technical and organizational security measures to reduce risks of loss, misuse and unauthorized access, disclosure and alteration, such as firewalls, policies, access controls, appropriate Operators, contractual commitments, secure systems.

3. Data collection sources

To serve you, ORIGINAL may collect information from the following sources: ORIGINAL Sites: Our site may be used to collect personal data. This includes both the website that we operate directly through our domain, and the websites or pages that we establish on third-party services, such as Facebook, Linkedin, and other third parties that offer this type of service.

Electronic mail and instant messaging systems: Services used to maintain electronic communications between You and ORIGINAL, including those made available directly by us, or third-party services such as WhatsApp, Telegram, SMS (messaging service short) and the like.

Customer Service and Sales Center: Communications with You through our Sales and Service Centers.

Offline Records: Records completed offline, distributed during events and other interactions with ORIGINAL.

Data received from third parties: Including, but not limited to, social networks and third party websites such as, for example, Facebook, Instagram, Linkedin, and the like, data aggregator services, ORIGINAL partners, sources information and data received during the acquisition of other companies.

4. Personal information collected

During your interaction with ORIGINAL, using one of the previously mentioned collection sources, we may collect various types of personal data about You, which can be divided into two categories:

1. Data you provide to us: When you purchase, use or interact with the Services or communicate with us in any way, you (or your company) may provide us with certain data. This data includes:

• Professional contact details, such as your name, position, corporate name, CNPJ, partner details, location, telephone number and email address; Payment information, bank details and billing address;

• Financial data such as billing, salary, gross income, expenses, incoming and outgoing cash flow, sales accounting data. Third-party data for exclusive use under the terms of the contracted services (representative, for example).

2. Data we collect from other sources: we may collect data from other sources, such as public databases, data from public profiles on social networks and credit protection entities.

5. Personal data of children and adolescents

ORIGINAL, as a rule, does not request, collect, process, store or share personal data from underage children and adolescents, unless they are present in corporate documents and are essential for the execution of the contract.

In this case, we collect consent from at least one of your parents or legal guardians, and in accordance with the rules of current legislation.

6. Purpose of data collection

We use the data collected or received from using the Services for the following purposes:

• Fulfill our contractual obligations to you or your company. That includes:

- provision of customs services in import and export;

- contracting international and national transport;

- storage;

- advice on the use of special regimes;

- temporary admission;

- ex-tariff, radar, drawback, project charges;

- development of project cargo for national industry and multinational corporations that want to enter the Brazilian market with full customs and logistical support;

- among other services related to foreign trade.

• Manage risk and detect, prevent and/or remediate fraud or other potentially illegal or prohibited activities, in addition to violations of applicable policies, contracts or terms of use;

• As necessary, to establish, exercise and defend rights in judicial, administrative or arbitration proceedings;

• Comply with legal or regulatory obligations, or as required in a legal proceeding, by any law enforcement or government agency with jurisdiction, or claiming jurisdiction, over ORIGINAL.

• For other purposes for which we provide specific notice at the time of collection, or otherwise as authorized or required by law.

7. Cookies and Tracking

Cookies are small text files that can be placed on your computer or portable device by websites or web services you use. They are used to ensure the proper functioning of websites and other online services.

We do not use any cookie collection and only cookies that are essential for its correct functioning are active on our website.

8. Sharing of Personal Data

We may share the personal data collected with other units, third parties and business partners (dispatchers) of ORIGINAL, which are relevant for the purposes of enabling the provision and integration of the Services. Said sharing takes place based on the following criteria and for the purposes described below.

• Our structure:

- São Paulo, branches in the cities of Santos (SP), Rio de Janeiro (RJ) and Viracopos International Airport, in Campinas (SP).

- Outposts: Portos Secos de Sorocaba (SP), Campinas (SP), Varginha (MG), Guarulhos Airport (SP), and

- Representatives in the main ports and borders of the country.

• Third-Party Service Providers: We work with third-party service providers to ............. When we share data with third-party service providers, we require them to use your data in accordance with our instructions. All of them have their obligations and prudence, documented in contracts and confidentiality terms.

• Credit Protection Entities: We may share your registration data with partner companies and financial institutions for analysis, credit risk reduction, fraud prevention and credit offering. ORIGINAL and its service partners, for the purpose of analyzing and offering credit, may consult information in credit bureaus, including the Credit Information System-SCR, Receivables Registrars authorized by the Central Bank and Credit Card Accreditors, These provisions are applicable for the entire period in which the data subject has an active contract, applying in this context art. 7th items I, II and X of the LGPD.

• Regulatory bodies, judicial or administrative authorities: we may share your personal information to perform the contract that You have with Original, provide the competent authorities with all information that is requested in relation to the Holder and operations performed by him. In addition, we may share your personal data with public authorities or private entities to combat fraud and abuse in the use of the Services, to investigate suspected violations of the law, or to combat any other suspected breach of our policies and contracts.

• Transfer of Assets: If an Original company or business unit is reorganized or sold and all or substantially all of the assets are transferred to a new owner, your personal information may be transferred to the purchaser regardless of your authorization to ensure continuity of services;

• With your authorization: In other cases not provided for above, with the purpose of sharing personal data and information, we will send you a notification with information about such sharing to request your consent, for a specific purpose.

9. Transfers of Personal Data Outside Brazil

We may transfer some of your personal data to service providers located abroad, including cloud service providers from us or our sub-operators.

Validate whether, in addition to Original's servers and environments, any supplier has in their contract information that uses an international supplier's cloud (Azure, Amazon and others).

When your personal data is transferred outside Brazil, ORIGINAL will take appropriate measures to ensure adequate protection of your personal data in compliance with the requirements of applicable data protection legislation, including by entering into appropriate data transfer agreements. with third parties of your personal data when required.

10. Users' rights

Data Subjects have certain rights with regard to their personal data and can exercise them by contacting us via email: lgpd@originallogistica.com.br.

• Confirmation of the existence of processing of personal data;

• Access to personal data, pursuant to applicable legislation;

• Correction of incomplete, inaccurate or outdated data;

• Data portability;

• Deletion of data, when it is processed based on the consent of the Owner or when the data is unnecessary, excessive or treated in violation of applicable legislation;

• Request for information about shared use of data. Note that this Privacy Policy describes ORIGINAL's personal data sharing activities;

• Withdrawal of consent, when applicable;

For security reasons, we will only be able to fulfill your request if we are certain of your identity. Therefore, we may request additional data or information to confirm the identity and authenticity of the Holder.

ORIGINAL has as Data Officer (DPO) Cesar Desiderio.

11. Data storage period

This Privacy Policy applies to the above-mentioned circumstances throughout the period in which ORIGINAL stores personal data. We store and maintain your information:

• for the time required by law;

• until the end of the processing of personal data, as mentioned below;

Thus, we will process your data, for example, during the applicable statute of limitations or while necessary to comply with a legal or regulatory obligation.

The end of the processing of personal data will occur in the following cases:

• when the purpose for which the personal data was collected is achieved, and/or the personal data collected is no longer necessary or relevant to the scope of that purpose;

• when the Holder requests the deletion of their data; and

• when there is a legal determination in this regard.

In cases of termination of processing of personal data, except for the cases established by applicable legislation or by this Privacy Policy, the personal data will be deleted and this Policy will no longer apply to your relationship with ORIGINAL.

12. Changes and updates to this policy

With the constant evolution of the business model, ORIGINAL reserves the right to change this privacy policy at any time, by publishing the updated version on its website.

Please review the Policy as often as you wish and you will have the opportunity to review the revised policy before deciding to continue using our Services.