Capitalized terms shall have the meanings assigned to them in this Privacy Policy and/or in the LGPD (Brazilian General Data Protection Law). For the purposes of this Privacy Policy, the following definitions apply:

Personal Data or Data: Any information relating to a Client and/or Website User that enables their identification, even if such identification requires the combination with other information, or that may be associated with such data, and which is subject to Processing Activities.

Processing Activities: Any activities and/or operations performed with Personal Data, including but not limited to collection, production, receipt, classification, use, access, reproduction, processing, storage, archiving, deletion, evaluation, modification, communication, transfer, or extraction of Personal Data.

Website User: Any natural person who accesses, browses, and/or uses the features and services available on our Website or Software, whether in a public or restricted environment (such as a logged-in area).

Purpose and Necessity: The reason why a Personal Data Processing Activity is required to achieve a specific objective.

Website: The website available at https://www.clavegroup.com.br through which Clients and/or Website Users can access information about the company and/or use its services.

Legal Basis for Processing: The legal grounds that support and legitimize the Processing Activities.

National Data Protection Authority (ANPD): The public authority responsible for overseeing, implementing, and enforcing compliance with the LGPD.

We collect your Personal Data from the following sources:

Clave Websites: All of our websites may be used to collect Personal Data. This includes both websites we operate directly through our domains and IP addresses, as well as websites or pages we establish on third-party platforms, such as Facebook, LinkedIn, and other similar services.

Email and instant messaging systems: Services used to maintain electronic communications between you and Clave, including those provided directly by us or by third parties such as WhatsApp, email, SMS (text messaging services), and similar platforms.

Clave mobile applications: Mobile applications provided directly by Clave or through third-party services such as Google or Apple.

Online ads, advertising, and forms: Interactions with any type of Clave advertisements, marketing campaigns, and online forms.

Offline records: Records completed offline, including those collected during events and other interactions with Clave.

Data received from third parties: Including, but not limited to, social media and third-party websites (such as Facebook, Instagram, LinkedIn, and similar platforms), ata aggregators, Clave partners, public sources, and data obtained through the acquisition of other companies.

During your interaction with Clave, through any of the data collection sources mentioned above, we may collect various types of Personal Data about you, as described below:

Contact Information: Includes any information that enables us to contact you, such as your mailing address, phone numbers, email addresses, websites, and social media profiles.

Purpose: To identify and contact Clients and/or Website Users; send newsletters and/or alerts; provide support and customer service through our communication channels; respond to requests such as information about Clave's services and solutions; and enable access to and use of Clave’s products, job opportunities, recruitment processes, young talent programs (trainee and internship), training, and specialized consulting.

Personal Background and Interests: Any information that may describe your demographic data, habits, or behavioral characteristics, including date of birth, gender, geographic location, hobbies, interests, family-related information, or lifestyle data. These fields are optional and self-declared by the data subject. As they are open-text fields, they must not include sensitive Personal Data, such as health, biometric or genetic data, race, sexual orientation, union membership, or religious, philosophical, or political beliefs.

Purpose: To assess professional and behavioral profiles in accordance with Clave's services, as well as for recruitment and selection processes.

Educational Information: Includes data used to assess profile, potential, and/or suitability for job opportunities, such as education level, institution, course, status, and start and completion dates.

Purpose: To support professional profile assessment in line with Clave's services and recruitment processes.

Professional Experience Information: Includes data used to assess profile, potential, and/or job fit, such as current role, employer, salary range, seniority level, and professional experience, including international experience.

Purpose: To support professional profile assessment and recruitment and selection processes.

Login Information: Includes data used for identification and authentication in Clave's systems, such as login email, encrypted (non-recoverable) password, and other security factors.

Purpose: To identify and authenticate Clients and/or Website Users; provide access to Clave's products and services; send communications; and support recruitment processes, training programs, and consulting services.

Technical Information About Devices: Optionally, when requested and authorized, we may collect details about your computer or mobile device used to access our websites, services, or applications. This includes IP address, geographic location, operating system type and version, browser type and version, and—when applicable—device identifiers and similar data.

Purpose: To identify the device used to access our platforms, ensure proper system functionality, and enhance user experience, accessibility, and performance.

Usage Information (Website and Services Interaction): Optionally, when authorized, we use automated technologies to collect information about your interactions with our websites and services. This may include clicked links, viewed pages, time spent, response times, download errors, and session duration. These data are collected through technologies such as cookies, web beacons, and third-party tracking tools. You may opt out of such technologies—please refer to the section “Your rights regarding Personal Data.”

Purpose: To ensure proper platform functionality and improve user experience, accessibility, and service quality.

Market Research and User Feedback: Information voluntarily shared with Clave regarding your experience with our services.

Purpose: To improve customer support and service quality.

User-Generated Content: Includes any content you create and share with Clave via social media or through uploads to our platforms, such as text, comments, articles, photos, videos, personal stories, or similar content. Where permitted, we may collect and publish such content in connection with marketing campaigns, promotions, community features, and social engagement initiatives.

Purpose: To develop and execute marketing strategies and campaigns.

Social Media Information: This refers to any data that you publicly share on a social media platform or that forms part of your profile on such platforms (such as Facebook, Instagram, LinkedIn, and similar services) and that you allow the platform to share with us. This data may include details such as your basic account information (name, email address, gender, date of birth, current city, profile picture, user ID, list of connections, and similar information), as well as any additional information or activities that you allow the social media platform to share. We receive your social media profile information (or parts of it) whenever you download content, interact with an application or web service of Clave on a social network, use a social media feature integrated into a Clave website, or otherwise interact with us through a social media platform. To learn more about how your data is obtained from third-party social networks (such as Facebook, Instagram, LinkedIn, and similar platforms), or to opt out of sharing such information, please visit the respective third-party social media platform.

Purpose: To support marketing strategies and engagement initiatives.

Sensitive Personal Data: Clave does not typically process sensitive Personal Data as defined by applicable law. Therefore, we do not intend to collect or process such data in the normal course of our services. If, for any reason, processing of sensitive Personal Data becomes necessary, we will obtain your prior, explicit, and formal consent. Where applicable, processing may also rely on legal bases such as: (i) crime prevention and detection; and (ii) compliance with applicable laws.

Clave does not knowingly request, collect, process, store, or share Personal Data of children and minors. If we become aware of any unintentional handling of such data, we will promptly remove the Personal Data of the child or adolescent from our records.

However, if there is a specific need that justifies the collection of Personal Data of children and adolescents, such data will be collected directly from their parents or legal guardians, with prior, clear, and explicit consent, and in accordance with applicable legal requirements.

In order to provide you with the best possible experience and opportunities, Clave may carry out Processing Activities in compliance with and supported by the LGPD. Examples of applicable legal bases include: (i) the regular exercise of rights in legal proceedings; (ii) the fulfillment of Clave's legitimate interests; and (iii) compliance with legal or regulatory obligations.

Cookies are small text files that may be placed on your computer or mobile device by websites or online services you use. They are used to ensure the proper functioning of websites and online services, as well as to provide information to the owners of those websites or services.

Cookies are used to improve the use and functionality of Clave's websites and services and to better understand how visitors interact with our platforms, tools, and services. Cookies help adapt Clave's websites to your personal needs, facilitate usability, and allow us to collect feedback on user satisfaction.

Clave uses the following types of cookies on its websites and compatible services:

Session cookies: Temporary cookies that are deleted when you close your browser. When you restart your browser and return to the website that created the cookie, you will be treated as a new visitor.

Persistent cookies: Cookies that remain on your browser until you delete them manually or until they expire according to their defined duration. These cookies recognize your return to a Clave website or service.

Strictly necessary cookies: Cookies that are essential for the operation of a Clave website or service. They enable navigation and the use of essential features.

Cookies that collect information about you: These cookies are placed on Clave websites or compatible services and are used to collect information about your interactions with our platforms.

Advertising cookies (Clave): We place cookies in advertisements displayed on third-party websites and services. Through these cookies, we collect information about your interaction with ads. Clave may place third-party cookies on its own websites and services, and use data collected by third-party cookies to deliver advertisements that we believe are relevant to your interests, based on your browsing behavior.

Third-party cookies: These are cookies placed on Clave websites by partner companies, such as online advertising providers. They may use the data collected through these cookies to anonymously deliver targeted advertisements on other websites, based on your visits to Clave websites or compatible services.

Clave websites and compatible services may also use other tracking technologies similar to cookies, which may collect information such as IP addresses, log files, and web beacons, among others. These data are also used to help us adapt our websites and services to your personal needs.

Further details are provided below:

IP Addresses: An IP address is a number used on the internet or a network to identify your computer. Whenever you connect to the internet, your device receives an IP address assigned by your internet service provider. We may record IP addresses for the following purposes:

• Troubleshooting technical issues;
• Maintaining the security and protection of our websites and online services;
• Gaining a better understanding of how our websites and services are used;
• Adapting content based on your geographic location.

Log Files: Clave, or third parties acting on our behalf, may collect information in the form of log files that detail website activities and gather statistics about user browsing habits. These logs are typically generated anonymously and help us understand:

• The type of browser and operating system used by visitors;
• Session details, including referring URL, date, time, pages visited, and duration of visits across our websites and compatible services.

Web Beacons: We may use web beacons (also known as transparent GIFs) on Clave websites. Web beacons are small pieces of code that allow a graphic image to be delivered on a web page for the purpose of transferring data back to us. We use web beacon information for various purposes, including:

• Understanding how users respond to email campaigns;
• Monitoring traffic across our websites and compatible services;
• Counting unique visitors, auditing, reporting on advertising and email campaigns, and personalizing our websites and services

It is important to note that you are responsible for ensuring that your computer or mobile device settings reflect your preferences regarding the acceptance of cookies and similar technologies.

Most web browsers allow you to configure settings to notify you before accepting cookies or to refuse them altogether. While you can browse most Clave websites without cookies enabled, some features may not function properly. We recommend consulting your browser’s “Help” section for instructions on how to manage these settings. If you use different devices or browsers, you will need to configure your preferences on each one individually.

Because web beacons may be embedded within web pages, it is not possible to opt out of them directly. However, you can disable them by managing your cookie preferences, which may limit their functionality.

We may provide third-party content on our Website and Applications, such as videos, images, articles, and social media content from platforms like Instagram, LinkedIn, Facebook, YouTube, among others.

When accessing content from these providers, it is likely that third-party cookies will also be installed on your devices. We do not have control over the use, purpose, or functionality of these cookies. We recommend that you review the cookie policies of these third parties for more information.

The items below describe the purposes for which Clave collects your Personal Data, as well as the types of Personal Data collected for each purpose. Please note that not all of the uses described below will be relevant to all individuals and may apply only in specific situations.

Custom Assessment and Talent Development Services: Your Personal Data is used for profile mapping and assessment purposes, identifying your potential. This typically requires contact information and personal data related to education, employment, and life background, such as training, professional experience, challenges, goals, and assessments.

Legal basis for processing in this context:

• Performance of contractual obligations;
• Compliance with legal obligations;
• Legitimate interests.

Our legitimate interests in this context:

• Helping individuals identify their talents through self-awareness, enabling personal fulfillment;
• Supporting professional development and growth.

Talent Acquisition Services: Your Personal Data is used to attract candidates for open positions and to create a pool of candidates with the best fit for available opportunities. This typically involves contact information and personal data related to education, employment, and life background, such as training, professional experience, challenges, goals, and assessments.

Legal basis for processing in this context:

• Performance of contractual obligations;
• Compliance with legal obligations;
• Legitimate interests.

Our legitimate interests in this context:

• Helping individuals identify their talents through self-awareness, enabling personal fulfillment;
• Supporting the hiring of professionals.

In accordance with applicable legislation, Clave retains your Personal Data for as long as necessary to fulfill the purposes for which it was collected, as described in this Privacy Policy, or to comply with applicable legal requirements.

Personal Data used to provide you with a personalized experience will be retained only for the period permitted under applicable law.

We may retain your Personal Data even after the original purpose has been fulfilled in the following cases: (i) to comply with legal obligations; (ii) to ensure the effective settlement of obligations under our responsibility; (iii) to offer products and services, whether our own or those of third parties; (iv) to enhance your experience as a Website User and/or Client; (v) to prevent fraud and improper conduct; and (vi) to exercise Clave's rights in judicial, administrative, or arbitration proceedings.

You may obtain further details regarding the retention of your Personal Data through the communication channels described in this Privacy Policy.

Reaffirming our commitment to the ethical, lawful, and respectful processing of Personal Data, Clave undertakes to observe good faith and all applicable laws governing its activities, including the following principles:

• Purpose, Adequacy, Necessity, and Data Quality: Processing Activities are carried out for legitimate, specific, and clearly communicated purposes, using Personal Data that is accurate, clear, relevant, up to date, and limited to what is necessary for such purposes.
• Free Access and Transparency: Providing clear and accurate information about Processing Activities and the relevant Data Controllers, ensuring facilitated and free access to such information, while respecting trade secrets.
• Security, Prevention, Accountability, and Responsibility: Adoption of technical and administrative measures designed to protect Personal Data against unauthorized access, loss, alteration, and unlawful or accidental destruction, as well as to prevent harm to individuals. Clave is committed to demonstrating the adoption and effectiveness of such measures.
• Non-Discrimination: Commitment to preventing Processing Activities that may result in discriminatory, unlawful, or abusive practices.

You have the right to confirm the existence of processing, access, review, modify, and/or request an electronic copy of your Personal Data processed by Clave.

You also have the right to request details regarding the origin of your Personal Data or its sharing with third parties.

At any time, you may also limit the use and disclosure of your Personal Data or withdraw your consent for any of our processing activities, except in situations provided for by applicable law.

Under the LGPD, as a data subject, you may at any time request that Clave:

• Confirm the existence of processing of your Personal Data;
• Access your Personal Data;
• Correct incomplete, inaccurate, or outdated Personal Data;
• Anonymize, block, or delete unnecessary, excessive, or non-compliant Personal Data;
• Withdraw consent, where applicable;
• Delete Personal Data;
• Object to Processing Activities carried out based on legal grounds other than consent, in case of non-compliance with the LGPD;
• Request data portability to another service or product provider, subject to ANPD regulation and trade/industrial secrets;
• Obtain information about public and private entities with which Clave has shared your Personal Data;
• Obtain information about the possibility of not providing consent and the consequences of refusal.

We clarify that Clave does not carry out fully automated processing activities. Should this change, this Privacy Policy will be updated accordingly.

Your rights may be exercised through the communication channels described in this Privacy Policy. It may be necessary to verify your identity by requesting a copy of an official identification document or equivalent means, in accordance with applicable law.

Requests submitted without sufficient proof of identity may be automatically rejected. Any identification data provided will be processed only as permitted by law.

In certain cases, we may not be able to delete your Personal Data without also deleting your user account. Additionally, some situations require the retention of Personal Data even after a deletion request, in order to comply with legal or contractual obligations.

Where available, our websites, applications, and services may include features that allow you to review and edit your Personal Data. Clave may require identity verification (e.g., login credentials or similar mechanisms) before granting access or allowing modifications, ensuring protection against unauthorized access.

Even if you request anonymization, blocking, deletion, or objection, we may retain or continue processing certain Personal Data in the following cases: (i) compliance with legal or regulatory obligations; (ii) protection and exercise of Clave's rights, including in judicial, administrative, or arbitration proceedings; (iii) prevention of unlawful acts; (iv) prevention of improper contact, among others.

To exercise your rights or if you have any questions about this Privacy Policy or our Processing Activities, you may contact Clave through our service channels or reach out to our Data Protection Officer via email:

privacidadededados@clavegroup.com.br

The security of your Personal Data is essential to us. Therefore, we maintain processes, controls, and technical and administrative measures to ensure confidentiality and security, prevent incidents, detect and respond to them, and manage risks. We use tools and technologies designed to safeguard your data and provide a secure experience.

In the event of a security incident that may result in data leakage, breach of confidentiality, or compromise of your Personal Data, Clave will take appropriate measures to inform affected individuals, as required by applicable law.

Your Personal Data, whether in aggregated or non-aggregated form, may be shared with service providers, data bureaus, strategic partners, public authorities, and other third parties, when necessary to fulfill the purposes of processing, in accordance with the LGPD and applicable legal bases, including: (i) credit protection; (ii) exercise of rights; (iii) compliance with legal or regulatory obligations; and/or (iv) Clave's legitimate interests.

Whenever Clave changes how your Personal Data is processed, this Privacy Policy will be updated. We reserve the right to modify this Policy at any time, provided compliance with applicable law is maintained.

We recommend that you review this Privacy Policy regularly to stay informed about any updates or changes.

This Privacy Policy is governed by the laws of Brazil. Any disputes not resolved amicably between the parties or through the listed communication channels, and not settled by the ANPD, shall be submitted to the courts of the Capital of the State of Rio de Janeiro, with express waiver of any other jurisdiction.