Politica de Privacidade JHSF

JHSF Participações S.A. , a publicly-held company, Corporate Taxpayers’ ID (CNPJ/MF) No. 08.294.224/0001-65, with headquarters located at Avenida Magalhães de Castro, nº 4. 800, Tower 3, Continental Tower, 27o andar (parte), in the City of São Paulo, State of São Paulo (“JHSF” or “Company” or “we”), jointly with all the respective direct or indirect subsidiaries (“JHSF Group” ), joining their efforts and in accordance with the best corporate governance practices, issues this Privacy Policy ( “Policy” ) to regulate, in an objective and transparent manner, the data that may be collected, used, stored and shared by the JHSF Group with its customers, partners, employees and users in the development of their respective business activities.

JHSF has the purpose to surprise, inspire, transform and accomplish. We are motivated to maintain our quality and excellence in the first place. Our philosophy is that the customer, user, partner and employee are the center of our actions and the most important link in our business. Through our care focused on their satisfaction, we ensure sustainability to our long-term vision. As part of our routine activities and operations, we need to collect personal data from users, customers, partners and employees, among others, in order to provide our services, business and products with the highest possible quality and excellence.

The purpose of this Policy is to keep you informed about how we collect, use, store and share your Personal Data, as well as to reaffirm our commitment to always maintain and respect your privacy. The privacy of your personal information is of utmost importance to us. This Policy establishes rules for data treatment that include collection, production, receipt, classification, use, access, transmission, distribution, processing, storage, evaluation, modification, communication, transfer, dissemination, elimination or extraction of data collected from customers, users, partners and employees, in addition to the recording of their activities, in accordance with applicable laws.

The Policy applies to all data processing media used by the JHSF Group, either digital or physical, including websites, information systems and digital or paper documents, related to any JHSF Group companies, their brands, services, products, businesses and activities.

This Policy may be modified and/or updated by JHSF at any time and, after any change, its new version will be updated in the JHSF Group’s websites and/or by e-mail, as the case may be. This Policy will also be available to users, customers, partners and employees on the Company’s Investor Relations website.

By accessing JHSF websites or contracting one of its services, products or businesses, you accept the practices described in this Policy and authorize the storage of information generated from your browsing. In addition, aiming solely and exclusively at the best development of JHSF Group’s business activities, customers, users, partners and employees accept that JHSF Group companies may share among themselves information and personal data collected from customers, users, partners and employees, always aiming at keeping the entire JHSF Group database updated on all business fronts, being able to offer products, services, businesses, opportunities and information to its users, customers, partners and employees, always guided by their safety and the best possible experience with JHSF products and services.

1 Which Personal Data can be collected?

The collection of your Personal Data will depend on the interaction you have with our services, business areas, products, opportunities and communication channels. Some of these interactions are exemplified below.

Personal contact information. Any information that you provide to us that may be used to contact you, such as your name, ID, postal address, e-mail, social networking details or phone number.

Demographic information and interests. Any information that describes your demographic data or your behavioral characteristics. Examples include your date of birth, age or group, gender, geographic location (e.g., zip code), favorite products, hobbies, interests and family or lifestyle information.

Technical information about the computer/mobile device. Any information about the computer system or other device you use to access one of our websites, communication channels or applications, such as the IP address used to connect your computer or device to the internet, the type of operating system used and the type and version of your web browser. If you access a JHSF website or application using a mobile device, such as a smartphone, the information collected may also include your phone’s unique device ID, advertising ID, geographic location and other similar mobile device data.

Information on the use of websites/communication. As you navigate and interact with our sites and communication channels, we use automatic data collection technologies to collect certain information about your actions. This includes information such as which links you click on, what content pages you view and for how long, and other similar information and statistics about your interactions, such as response times to content, download errors and length of visits to particular pages. This information is captured through automated technologies such as Cookies (Browser Cookies, Flash Cookies, among others) and web beacons, and also via third party tracking.

Market surveys and consumer feedback. This includes information that you voluntarily share with us about your experience using our products, business and services.

Content generated by consumers. It refers to any content that you create and share with us on third-party social networks and channels or by uploading to one of our websites, channels or applications, including the use of third- party social networking applications such as Facebook. Examples include photos, videos, personal stories or other similar content and media. We may collect and publish content generated by you in connection with a variety of activities, including contests and other promotions, community features of the website, channel or application, customer engagement, and third party social networking sites.

Information from third-party social networks. It refers to any information that you share publicly on a third-party social network or information that is part of your profile on a third-party social network (such as Facebook), which you allow the third-party social network to share with us. Examples include your basic account information (for example, name, e-mail address, gender, date of birth, current city, profile picture, user ID, and friend list) and any other additional information or activities that you allow the third-party social network to share.

Financial and payment information. Any information we need to fulfill an order, or that you use to make a purchase or business with JHSF Group, such as your debit or credit card details (such as cardholder name, card number, expiration date and code) or other forms of payment (if available).

Calls to the Customer Service. Communications with a JHSF customer service may be recorded or heard, in accordance with applicable laws, for local operational needs (for example, for quality or training reasons). Payment card details can be recorded. When required by law, you may be informed of such recording at the beginning of your call.

Sensitive Personal Data. We do not intend to collect or process your sensitive Personal Data in the normal course of our activities. When it is necessary to process your sensitive Personal Data for any reason, we will rely on your prior express consent for any processing that is voluntary (for example, for marketing purposes). If we process your sensitive Personal Data for other purposes, we rely on the following legal grounds: (i) crime detection and prevention (including for example fraud prevention); and (ii) compliance with applicable standards.

2 What are the purposes of collecting your Personal Data?

The following table describes some of the various purposes for which we collect your Personal Data.

Purpose	Type of Data Collected
Legal Obligation: comply with the legal obligations of IP guard, date and time of access to our website, applications and channels.	Navigation data, such as your IP address, date and time, device identifiers, type of browser used, among others.
Financial transactions: data used for receiving and transferring values.	Address, Taxpayers’ number – CPF, RG, financial, banking and credit card numbers, among others.
Rendering of Services, Business, and Purchases: data necessary for granting services, conducting business and purchasing.	Name, CPF, RG, CNH, RNE, adhesion date, financial references, nationality, address, marital status, e-mail, among other
Marketing and advertising actions: sending of ads, advertisements, direct marketing and contests, related to your interests.	Navigation data, name, nationality, address, marital status, e-mail, among others.
Sending of communications and satisfaction surveys: sending of communications and satisfaction surveys as part of our feedback process.	Name, CPF, RG, CNH, RNE, adhesion date, financial references, nationality, address, marital status, e-mail, among others.
Behavior analysis on our websites and applications: Our websites, channels and applications can contain data analysis tools that allow us to analyze behaviors to ensure platform quality and provide the best user experience.	Name, CPF, RG, CNH, RNE, adhesion date, financial references, nationality, address, marital status, e-mail, among others.
Protection of the Company’s legitimate interests: issues involving the security of our physical facilities, legal claims for defense in cases of litigation, improvement in the management and execution of our business and services.	Name, CPF, RG, CNH, RNE, adhesion date, financial references, nationality, address, marital status, e-mail, among others.

3 What are your rights as owner of the Personal Data?

You are the owner of your Personal Data, and the Brazilian law guarantees that you have several rights related to them, such as:

• Request access to your Personal Data;
• Request the rectification of your Personal Data;
• Request the deletion of your Personal Data;
• Oppose the treatment of your Personal Data;
• Request the portability of your Personal Data;
• Request information about the sharing of your Personal Data;
• Revoke a previously given consent; and
• Request automated decision review.

You may exercise any of your rights regarding your Personal Data by giving written notice to dpolgpd@jhsf.com.br

4 With whom will your Personal Data be shared?

The JHSF Group operates in partnership with a number of other companies to offer its services, businesses, products and opportunities. Accordingly, we may share your Personal Data with these companies, to the extent reasonably necessary for the purposes informed and in accordance with applicable law, always seeking to preserve to the maximum extent your privacy and, whenever possible, anonymizing your information. Here we describe situations in which we will share your Personal Data:

• Companies owned by JHSF Group: We may share your information with other companies in the JHSF Group, which are in accordance with this Policy.
• Our suppliers and business partners: We have several suppliers and business partners that we need to hire to operate our services, products and businesses, and some of them may handle the Personal Data we collect. We always seek to carefully evaluate our suppliers and business partners and sign contractual obligations with them for information security and protection of Personal Data, in order to minimize risks to the holders.
• Public Authorities: If a judge or legal authority requires JHSF to transmit certain Personal Data for, for example, an investigation, we will share. We are against any abuse of authority and, in case JHSF understands that a certain order is abusive, we will always defend the privacy of the holders.

In addition, we reserve the right to share any Personal Data that we believe is necessary to fulfill a legal obligation, enforce or apply our terms of use, or to protect the rights, property or safety of JHSF, our employees and our customers, users, employees and partners.

Finally, JHSF will not disclose Personal Data of its customers, users, partners and employees to a third party without the reasonable and necessary relationship for the best experience of its customers, users, partners and employees, as established above and in this Policy.

5 Can your Personal Data be transferred to other countries?

JHSF may transfer your Personal Data beyond the borders of the national territory. Although JHSF has its headquarters in Brazil and a large part of its portfolio of products, businesses and services are conducted and/or intended for persons located in Brazil, thus applying the Brazilian laws related to the protection of Personal Data, JHSF also operates products and services in foreign territory. In this sense, the Personal Data we collect may be transferred to countries located abroad. These transfers may also occur on behalf of certain JHSF suppliers and business partners, who may provide their services abroad. In this sense, JHSF will maintain the same treatment applied in Brazilian territory abroad, ensuring the use of the same protection tools, aligned with Brazilian laws and regulations.

6 For how long will your Personal Data be stored?

JHSF must retain your personal information for as long as necessary to fulfill the purposes for which the information is processed or for other valid reasons to retain your personal information, such as compliance with legal obligations. The Personal Data we handle for any purpose will not be kept longer than necessary for such purposes.

We will retain your Personal Data as follows:

• Any Personal Data, such as CPF, e-mail, address, telephone number collected through website, channels or applications, will be kept for a minimum period of 5 (five) and a maximum of 10 (ten) years after the data collection; and
• In some cases, it is not possible to specify in advance the periods for which your Personal Data will be retained. In such cases, we will determine the retention period based on the following criteria, without prejudice to others: (i) the existence of a specific law or regulation requiring a determined period of time for data retention; (ii) JHSF internal policies; (iii) the existence of judicial, administrative or arbitration proceedings involving the Personal Data; and (iv) requests for information made by government authorities.

7 How is your Personal Data protected?

Our responsibility is to take care of your Personal Data and use them only for the purposes described in this Policy. Moreover, to ensure your privacy and the protection of your Personal Data, we adopt the appropriate security practices for our market, with the use of information security systems, including, as the case may be, the application of data encryption techniques.

Unfortunately, however, we cannot guarantee total security. Therefore, its performance is fundamental for the maintenance of a safe environment for everyone. You can help us by adopting good security practices regarding your account and your Personal Data. Please note that you are responsible for maintaining the confidentiality of your passwords. If you use a shared or public computer or device, never choose the option to remember your login ID, email address or password and make sure that you exit your account whenever you leave the computer or device; and if you identify or become aware of anything that compromises the security of your Personal Data, please contact us immediately at dpolgpd@jhsf.com.br

8 If in doubt, who can you contact?

If you believe that your Personal Information was used in a manner that is inconsistent with this Privacy Policy or your choices as the owner of the Personal Information, or if you have other questions, comments or suggestions regarding this Policy, please contact us at dpolgpd@jhsf.com.br

9 Changes to this Policy

As we are always seeking to improve our products, business and services, this Policy may undergo periodic updates to reflect the improvements made.

In case of significant changes to this Policy, we may communicate to you through e-mail about such changes or through specific messages in our services, channels or applications.

JHSF is not responsible for the misuse or loss of personal data to which it has no access or control. We are also exempt from liability for illegal and unauthorized use of this information because of misuse or detour of your access credentials, negligent or malicious conduct because of acts or omissions on your part or on behalf of someone authorized by you.

10 Review History

Review	Date	Reason
V1.0	11/10/2020	Initial version
V1.1	06/01/2021	Initial version + Review