Legal Notes

1. OBJECTIVE

This Privacy Policy of CENTRO DE TECNOLOGIA CANAVIEIRA S/A, registered with CNPJ under No. 06.981.381/0001-13 (“CTC”) aims to:

• inform Data Subjects on how their personal data is used and processed by CTC, whether through digital or physical means, websites, in-person contacts, by phone or other means of interaction, maintaining a transparent and honest relationship with them; and.
• clarify that CTC has privacy and respect for the General Data Protection Law – LGPD (Law No. 13.709/2018) as fundamental principles to be observed in all its activities and relationships.

2. SCOPE

This privacy policy covers all those whose personal data is processed by CTC in the context of relationships with investors and users of our website (http://ri.ctc.com.br/).

3. GENERAL GUIDELINES

3.1. WHAT PERSONAL DATA WE COLLECT AND HOW WE USE IT

In general, when an Investor invests or, in any other way, interacts with CTC in the context of investor relations, personal data may be processed, which may include:

• Full name, CPF, email, profession, nationality, address and phone number;
• Photographs and images at events, such as shareholders’ meetings;
• Banking data and number of shares;
• Access and navigation data (as detailed in the website’s cookies section).
• Other data that the Data Subject voluntarily shares with CTC.

As a rule, CTC does not collect sensitive data from its Investors. However, in cases where the collection of such data occurs, the company will adopt all necessary measures to ensure the legality of the processing and will inform about such processing (through updates to this Policy or direct communication with the data subject).

Below, we describe some situations in which personal data may be collected and the purposes for which we use it:

• Mailing to receive alerts about CTC’s investor relations, corporate governance matters and related news;
• “Contact RI” – for contact through the dedicated form in the RI website’s contact section;
• Acts inherent to the operation of publicly-held companies, such as convocations for assemblies, information on material facts, dividend payments, shareholder identification confirmation and mandatory reports;
• Sending invitations to investor relations events targeted at investors and other interested parties;
• Gathering information on the investor base and management regarding reports and metrics for market condition analysis;
• Sending invitations to events to establish close relationships with Investors;
• Verification and compliance with legal and regulatory obligations;
• Evaluating the performance and functionality of the website, as well as ensuring the security of information and assets and in accordance with access standards within CTC environments (whether physical or digital installations).

3.2. SHARING DATA WITH THIRD PARTIES

CTC may share Personal Data with third parties:

• Third-party service providers: that assist CTC in managing information and registration, sending invitations, information and access control at events/assemblies.
• Financial institutions: due to the operation of a publicly-held company, we share data with financial institutions responsible for the administration, management and custody of assets.
• Regulatory bodies, judicial or administrative authorities: we may share your personal data to provide competent authorities with all requested information regarding the Investor. Additionally, personal data may be shared with public authorities or private entities to combat fraud and abuse in the use of provided services, to investigate suspected violations of the law, to defend CTC’s rights or to combat any other suspected breach of its policies and contracts.
• Corporate reorganization: if CTC’s corporate structure is reorganized, personal information may be transferred without consent to ensure service continuity.
• Exceptionally, CTC may transfer some of your personal data to partners or service providers located abroad, including cloud technology service providers. When personal data is transferred outside Brazil, CTC will take appropriate measures to ensure adequate protection of personal data in compliance with applicable data protection legislation requirements, including through the execution of relevant data transfer contracts with third parties, when necessary.

3.3. HOW WE KEEP DATA SECURE

Market-standard and legally required means are used to preserve the privacy of the collected personal data. Thus, we adopt technical and administrative security measures, applied through the best information security practices, both technical and behavioral, capable of protecting personal data from unauthorized access and accidental situations.

3.4. DATA RETENTION

In order to protect the privacy of Data Subjects, the personal data processed by CTC will be automatically deleted when it is no longer useful for the purposes for which it was collected, or when the Data Subject requests its deletion, except if its maintenance is expressly authorized by applicable law or regulation.

However, information may be retained to comply with legal or regulatory obligations, transfer to third parties – provided data processing requirements are respected – and exclusive use by CTC, including for the exercise of its rights in judicial or administrative proceedings.

4. DATA SUBJECT RIGHTS

Every natural person may make requests based on the rights listed in art. 18 of the LGPD that are applicable:

• Confirmation of processing;
• Access to data;
• Correction of incomplete, inaccurate or outdated data;
• Anonymization, blocking or deletion of unnecessary, excessive or non-compliant data;
• Deletion of personal data processed with the data subject’s consent (except as provided);
• Information on entities with which the controller has shared data;
• Information on the possibility of not providing consent and its consequences;
• Revocation of consent.
• Portability of data to another service or product provider, when applicable;

5. CONTACT

In case of doubts about the Privacy Policy or personal data processing, as well as for requests as per item 4, the Data Subject may contact through the communication channel(s) below, with the request being responded to within 15 days.

e-mail: lgpd@ctc.com.br.

Physical correspondence: Caixa Postal 162 CEP:13.400-970 – Piracicaba/SP

Data Protection Officer (DPO): Fernando Souza de Araújo
Alternate (DPO): Mayara Muniz de Freitas Bertan

• The Company does not guarantee that the content, instruments and materials included, used and offered on this website are accurately updated or complete, and it shall not be held liable for damages caused by eventual errors of content or equipment failure.
• The Company shall not be held liable, either expressly or tacitly, for the misuse of the information, instruments, and materials made available and/or the equipment used by this website, for whatever purpose, made by any user, who will be the sole responsible for any harm to own or third-party rights, caused or not by this improper use.
• In no circumstances will the Company, its executive officers or employees be held liable for any direct or indirect, special, incidental or consequential damages, or any losses or expenses arising from the connection with this website or its use by users themselves or inability to use by any party, or in connection with any failure of performance, error, omission, interruption, defect or operation or transmission delay, computer viruses, line or system failure, even if the Company or its representatives have been advised of the possibility to occur such damages, losses or expenses.
• The adequate provision of all Internet resources, without exception, is the sole responsibility of the website users.
• The Company is not responsible for the content of other websites (a) whose addresses are available on the pages of this website, or (b) on which the address of this website is available. The Company does not guarantee the compensation for any damages caused by the websites mentioned in this item.
• Before taking an investment decision, prospective investors should consider with caution, in the light of their own financial situation and investment objectives, all the information available on this website and, in particular, evaluate the Risk Factors.

The Company reserves the right to improve the functionalities of this website based on the analysis and consolidation of the information and suggestions collected and on the opportunities arising from them for all the website.

Unless stated otherwise, all content on the pages of this website, such as information, materials, instruments, page organization, charts and drawings belong to the Company or to third parties who lawfully assigned their right of use.

_{(*) Cookie: small file placed on your computer to track movements within websites.}