Privacy and Cookies Policy

This policy applies to all users who browse the pages operated by Agence Consultoria, including websites, blogs, and landing pages, as well as to the selection process (both internal and third-party). Here you will find information on the collection, use, storage, processing, and protection of the personal data of users of Agence Consultoria's pages, with the aim of demonstrating complete transparency on the subject and clarifying for all interested parties what types of data are collected, the reasons for collecting them, and how users can manage or delete their personal information. By registering through our contact or job application forms and providing personal information, the user automatically accepts our Privacy Policy. This indicates that the user is aware of and fully agrees with the way we use their information and data, as described in sections 03 and 04. Any processing of personal data carried out by Agence Consultoria will have a legal basis and will be conducted in a manner appropriate to the purpose established for its collection, following strict standards of security, confidentiality, and reliability. This document was drawn up in accordance with Brazilian legislation in force on the protection of personal data, including the Federal Constitution, the Consumer Protection Code, the Civil Code, the Brazilian Civil Rights Framework for the Internet (Federal Law No. 12.965/2014), its implementing decree (Decree No. 8.771/2016), and the General Personal Data Protection Law (LGPD – Federal Law No. 13.709/2018). We reserve the right to amend this Privacy Policy at any time with a view to its continuous improvement. Whenever any relevant condition of this Policy is changed, such changes will be valid, effective, and binding once the new version is published on our sites. By providing personal information after any modifications, the user demonstrates agreement with the new rules. For this reason, it is very important that you review this Privacy Policy frequently. If you have questions, suggestions, or need further information, you may contact us directly at: dpo@agence.com.br.

Agence Consultoria collects data in order to operate effectively and provide better experiences with our products. Through interaction on our site, blog, or similar channels, Agence Consultoria may collect personal information, meaning information that identifies an individual or relates to an identifiable individual. Personal information may include, but is not limited to, your name, physical address, telephone number, email address, company affiliation, and associated interests. If you interact with our recruitment team, your data will be processed in accordance with section 03 of this document. Contact form: the data submitted by users who choose to make contact via the form will be collected and stored until the user requests removal. Data for browsing optimization: pages accessed, keywords used in searches, recommendations, comments, IP address.

A) those who register on our online platform (Work With Us) or are approached by our recruiters through the LinkedIn platform (https://www.linkedin.com) ("Candidate") and others. If you fall into the category above, this section of the policy applies to your personal data processed by us. The use and completion of any registration on our site, or acceptance to take part in our selection processes, presupposes acceptance of this Privacy Policy. If you do not agree with this Privacy Policy, we ask that you do not use our site and do not send us any personal data. This Policy is a document supplementary to AGENCE's contracts and must be interpreted together with those documents. I – Our services Our services consist of talent recruitment and selection, as well as building high-performance teams in the main areas of the digital market (software, data, operations, product, sales, marketing, and design) for the companies that engage us (our "Clients"). II – Our role as processor of personal data The processor of personal data is the natural or legal person that processes personal data on behalf of the controller. When we carry out our talent recruitment and selection service at the request of a specific Client, we act solely as the processor for part of the processing of the personal data collected. In such cases, the party responsible for making decisions regarding the processing of your data will be our Client, with AGENCE acting only as processor of your data, carrying out the processing on behalf of the controller and in accordance with the instructions provided by it. If you are taking part in a Client's selection process, that company, our Client, is the one that will administer and be responsible for decisions on the processing of your data when it uses that data or when it determines that AGENCE, as processor, should carry out specific processing. In that case, the exercise of your rights must be directed to that organization, which may have its own rules and privacy policy. Interested Candidates may submit their personal data through direct access to AGENCE's website or through a link to a specific vacancy sent by an AGENCE recruiter on behalf of the Client. This will initiate the selection process. The Client is responsible for control over the personal data collected and processed by us in the course of providing the services. And although we pass on good-practice guidance regarding the processing of personal data to all our Clients, it is up to them, as controllers of your personal data, to decide on the processing. III – Our role as controller and joint controller of personal data The controller of personal data is the natural or legal person responsible for decisions regarding the processing of personal data. We also act as controller and joint controller of your data. This occurs when it is we at AGENCE who make the decisions regarding the processing of the data. Talent Pool. When you submit your data to take part in our Clients' selection processes, you also become part of our AGENCE Talent Pool. Your data will therefore be accessible to us and to all our Clients. IV – What personal data we process General personal data. If you are a Candidate, we collect the personal data you provide on our platforms or through another channel (email, LinkedIn, telephone, etc.), which includes full name, email, mobile telephone, city and state of residence, LinkedIn profile link, salary expectations, information on technical skills or experience, information about previous selection processes at the same company, and any other data entered in your résumé or in your introductory/personal responses. We also access personal data made public by the Candidate through the LinkedIn platform. Sensitive personal data. On occasion, we may access sensitive personal data, which may occur because of sensitive personal data made manifestly public by the Candidate or reported directly by them. V – Purposes and legal bases for processing We only process personal data for legitimate, specific, explicit purposes disclosed herein. Processor of personal data. In our role as processor, we will carry out the processing determined and contracted by our Client, provided such processing is lawful and contractually provided for. Controller of personal data. We also use Candidates' data to build our own Talent Pool for future selection processes. Sensitive personal data. When we carry out recruitment and selection services for diversity vacancies, we collect sensitive personal data. The legal basis for this processing will, as a rule, be the data subject's consent. VI – When and where we store personal data If the data controller is a Client, that Client is responsible for storage and processing in accordance with its own regulations and privacy policies. If Agence is the data controller, storage will be carried out as described in the corresponding sections of this Privacy Policy. VII – The security practices we adopt We at AGENCE will not intentionally disclose your personal data. The systems and procedures used by AGENCE meet reasonable standards of precaution and care. VIII – With whom and for what purpose we share personal data Authorities. The personal data we collect and the activities recorded may be shared with competent judicial or administrative authorities whenever there is a legal requirement to do so. Clients. We also share Candidates' personal data with our Clients for the purpose of carrying out hiring processes. Third parties. In providing our services, the use of sub-processors, business partners, and third-party services may also lead to the sharing of the personal data we process. Among the services used, we highlight: LinkedIn, ActiveCampaign, WhatsApp, Typeform, Instagram, Facebook, Slack, Google Dialogflow, Pipefy, N8N, Zapier, Backoffice, Huggy, and Microsoft. International transfer. International data transfers may occur when we use third-party software that stores data outside Brazil or when the Client has units in other countries. IX – Your rights as a personal data subject Your rights as a personal data subject are respected by us and, when we act as controller, we guarantee the exercise of all rights provided for in the LGPD. If the Client is the controller of your personal data, requests regarding the exercise of your rights must be directed to that Client, not to AGENCE.

When the user registers through our contact forms: we collect basic identification data such as full name, company name, email, telephone, the message written by the user, and any other data needed to facilitate initial contact in line with the proposal offered. When a user accesses our pages: we collect information about interaction and access in order to ensure a better user experience. This data may concern the keywords used in a search, comments, page views, the URL the user came from, the browser used, and their access IP addresses, among other information that may be stored and retained. In recruitment, we collect the information set out in Section 03. Sensitive data: no sensitive user data will be collected, meaning data as defined in Articles 9 and 10 of the GDPR and in Articles 11 et seq. of the General Personal Data Protection Law. Exceptions apply to the processing of data of candidates in specific processes, as described in Section 03. Agence Consultoria may collect and process personal data of minors (persons under 18 years of age) in the case of dependants, beneficiaries, or clients. A minor's data, such as full name and CPF (Brazilian individual taxpayer number), is collected with specific and prominent consent from at least one parent or legal guardian, and is used to ensure continued access to services and products. IT IS WORTH EMPHASIZING THAT AGENCE CONSULTORIA DOES NOT USE MINORS' DATA FOR MARKETING PURPOSES AND/OR TO OFFER PRODUCTS AND SERVICES.

The user's personal data collected and stored by Agence Consultoria is intended to: • Improve the user experience: enhance the product and/or service offered, make contact easier and faster, and provide specific features depending on the user's basic characteristics. • Improve services: understand how the user uses our services in order to support business and technical development. • Marketing: present personalized advertisements to the user based on the data provided, personalize the content offered, and publicize vacancies, events, new products, and updates. • Commercial: generate input for new business and improve the quality of our services. Contact with the user for commercial and/or promotional purposes may take place via email (including email marketing), telephone call, or messages through apps and/or social media. The processing of personal data for purposes not provided for in this Privacy Policy will only take place with prior notice to the user, and the rights and obligations set out herein remain applicable.

Users' personal data is stored by Agence Consultoria for the period necessary to provide the service or fulfill the purposes set out in this document, in accordance with the General Personal Data Protection Law (LGPD). In the case of candidates, they may request the deletion of their data at any time, should they not wish to continue with their application, by notifying their recruiter or contacting a legal representative of Agence Consultoria. Data may be removed or anonymized at the user's request, except in cases where the law provides for different treatment. Furthermore, users' personal data may only be retained after the end of its processing in the following circumstances provided for in Article 16 of that law: 1. Compliance with a legal or regulatory obligation by the controller. 2. Study by a research body, ensuring, wherever possible, the anonymization of personal data. 3. Transfer to a third party, provided the data processing requirements set out in this Law are observed. 4. Exclusive use by the controller, with access by third parties prohibited and provided the data is anonymized.

The information collected by Agence Consultoria will be stored and handled in a secure and sound environment. The company uses technical and administrative measures suitable for protecting your personal data from unauthorized access and from accidental or unlawful destruction, loss, alteration, communication, or dissemination, with a security standard in line with the protocols adopted by the market for the protection of personal data. The personal data collected by Agence Consultoria may be stored and processed in your region, in Brazil, or in any other country where Agence Consultoria or its affiliates, subsidiaries, or service providers maintain facilities. We take steps to ensure that data collected under this Privacy Policy is processed in accordance with its provisions and with the requirements of applicable law, regardless of where the data is located. Agence Consultoria disclaims liability where fault lies exclusively with third parties, in the event of an attack by hackers or crackers, or where fault lies exclusively with the user, such as where the user themselves transfers their data to third parties. Agence Consultoria undertakes to notify the user of any security breach that may pose a significant risk or cause significant harm to their personal data. Stored personal data is treated confidentially, within legal limits. However, we may disclose personal information where we are required to do so by legal or regulatory determination or by order of a competent authority.

Posts made by the user themselves on our pages may contain personal information and, in such cases, are shared publicly with other users. The sharing of personal data processed by Agence Consultoria will occur only exceptionally, in the following situations: • Compliance with legal and/or regulatory obligations. • Performance of executed contracts that depend on data sharing. • Express request made by the data subject themselves. • Sharing with partner institutions and information technology suppliers, subject to a confidentiality obligation and a guarantee of compliance with the LGPD, including the adoption of security measures suitable for protecting the personal data shared. Data collected for recruitment purposes may be shared with our clients in order to enable candidates to take part in selection processes and job opportunities, as described in Section 03 of this Policy.

With the exception of the circumstances set out in sections 03 and 08, personal data is not shared with third parties.

Agence Consultoria will guarantee data subjects the exercise of the rights provided for in legislation and under applicable regulation, including: confirmation of the existence of processing of personal data, access to the data processed by the company, correction of incomplete, inaccurate, or outdated data, and anonymization, blocking, or deletion of unnecessary or excessive data or data processed in breach of the LGPD. These rights may be exercised by express request sent to dpo@agence.com.br. The data subject has, among others, the following rights: • Right of access. • Right to rectification. • Right to erasure. • Right to confirmation of the existence of processing. • Right to request the blocking or deletion of data. • Right to information about the public or private entities with which the data is shared. • Right to restrict processing of the data. • Right to review of automated decisions. • Right to object to the processing of data. • Right to an explanation of the logic used in the processing and collection of the data. • Right to information about the possibility of withholding consent and about the consequences of refusal. • Right to withdraw consent at any time. Data Protection Officer (DPO): Mayara Mendes Ribeiro Email: dpo@agence.com.br

Cookies are small identification files transferred to your browser or device that make it possible to recognize your browser and understand how and when the pages and resources of our services are accessed. When you access the site, you will see a banner allowing you to Accept all cookies, Reject non-essential cookies, or Customize your choice, separately authorizing Analytics and Marketing cookies. Non-essential cookies are only loaded after your consent; you can change your choice at any time by clearing this site's browsing data in your browser settings. We classify the cookies we use into two categories: • Essential cookies (always active): necessary for the basic and secure functioning of the site, including remembering your cookie choice. They cannot be disabled and do not depend on your consent. Example: consent preference cookie, stored locally in your browser. • Non-essential cookies (dependent on your consent): – Analytics cookies: help us understand how you browse the site, through Google Analytics, so that we can improve the content and the user experience. Example: _ga, _ga_*, _gid (Google Analytics, via Google Tag Manager). – Marketing and advertising cookies: used to measure campaign performance and display more relevant ads on other sites, through Google Ads and Remarketing tools. Example: _gcl_au, IDE, test_cookie (Google Ads, via Google Tag Manager). We may also use session cookies, which expire when the browser is closed, and persistent cookies, which remain stored until removed by the user. You may also choose to limit, refuse, or disable cookies through your browser settings. However, some areas of the site may not work correctly, which may affect your browsing experience. This Privacy Policy does not cover the use of cookies by third parties, and Agence Consultoria is not responsible for their respective privacy policies and practices. Browsers supporting cookie settings and private browsing: • Google Chrome. • Mozilla Firefox. • Internet Explorer. • Microsoft Edge. • Opera. • Safari.

Any questions relating to the interpretation of this Privacy Policy will be resolved in accordance with Brazilian law. Any disputes must be brought before the courts of the judicial district of São Paulo/SP.