Privacy
Policy.

1. Introduction

Locatelli Group recognizes the importance of the privacy and protection of the personal data of all visitors, clients, partners and users of its services, and is committed to handling such data in a transparent, secure manner and in compliance with applicable legislation.

This Privacy Notice describes how we collect, use, store, share and protect your personal data obtained through our website https://www.locatelligroup.com.br/ and associated digital channels, and explains your rights as a data subject, as set out in the Brazilian General Data Protection Law – LGPD (Law No. 13.709/2018) and, where applicable, in the European Union General Data Protection Regulation – GDPR (Regulation EU 2016/679).

By accessing our website, using our services or providing any personal data, you declare that you are aware of and agree to the terms of this Privacy Notice.

2. What personal data is

Under the LGPD and the GDPR, personal data is any information relating to an identified or identifiable natural person, directly or indirectly, by means of an identifier such as a name, identification number, location data, electronic identifiers or other elements that allow their identification.

In practical terms, personal data includes, among others:

• Full name
• E-mail address
• Phone number
• IP address
• Job title and professional information
• Browsing and digital interaction data

The personal data we process is detailed in section 5. How personal data is used.

3. Rights of data subjects

Under the LGPD and the GDPR, you have the following rights, which we respect and guarantee:

• Right to information – To know how and why your personal data is processed.
• Right of access – To request confirmation of the existence of processing and access to your data.
• Right to rectification – To request the correction of incomplete, inaccurate or outdated data.
• Right to erasure (right to be forgotten) – To request the deletion of personal data that is unnecessary or processed in breach of the law.
• Right to restriction of processing – To request the restriction of the use of your data in certain circumstances.
• Right to object – To object to the processing of data carried out on the basis of legitimate interests.
• Right to data portability – To request the transfer of your data to another service or product provider, where applicable.

To exercise any of these rights, please contact our Data Protection Officer (DPO) through the channels provided at the end of this Notice, in section 9. Contacts. We will respond to your request within 15 days, in accordance with the period set out by the LGPD.

You may also obtain additional information from the Brazilian National Data Protection Authority (ANPD) or, where applicable, from the Information Commissioner’s Office (ICO) of the United Kingdom, through the links below:

• https://www.gov.br/anpd/pt-br
• https://ico.org.uk/

4. Personal data we collect

We may collect personal data in different ways, according to the relationship established with you.

Website users

Data provided voluntarily through:

• Contact forms
• Newsletter sign-ups
• Sending of inquiries, requests or complaints

Browsing data

When you visit our website, we automatically collect certain information through cookies and analytics tools, such as Google Analytics, including:

• IP address
• Browser and device type
• Pages accessed
• Time spent on the website

This data is used exclusively for statistical purposes and to improve the user experience, without directly identifying individuals.

Cookies

We use cookies to:

• Improve navigation on the website
• Personalize content
• Analyze usage patterns

You can manage or disable cookies in your browser settings.

Suppliers and partners

We collect professional data, such as name, job title, corporate e-mail and phone number, when you act as a representative of a partner or supplier company.

Direct communication

Data provided by you in communications carried out by phone, e-mail or other means.

Public sources and third parties

We may receive data from publicly available sources or legitimate third parties, such as:

• Public and commercial registries
• Professional and regulatory bodies
• Referrals/recommendations sent by partners or clients
• Social media platforms and analytics/marketing platforms

Locatelli Group is not responsible for personal information that you voluntarily share on public platforms or social networks.

Sensitive data (e.g., health, religion, union membership) is not requested. Should you inadvertently send such data, we will handle it in accordance with the LGPD, and may remove it if it is not necessary.

5. How personal data is used

We always process personal data on a valid legal basis, including: consent, performance of a contract, legal obligation or legitimate interest.

The main purposes include:

• Commercial contact and request for proposals
• Handling of data subject requests
• Sending institutional communications and marketing materials
• Compliance with legal and regulatory obligations
• Audit and compliance processes
• Provision of consulting, BPO, BPS and tax services
• Management of résumés and recruitment processes

Data is stored securely and accessed only by authorized persons. For requests related to your data, please contact our DPO at: dpo@locatelligroup.com.br.

6. Data retention and deletion

Personal data will be kept only for as long as necessary to fulfill the purposes for which it was collected, including:

• Handling of requests
• Compliance with legal and regulatory obligations
• Regular exercise of rights
• Marketing

After this period, data will be deleted or anonymized, except where retention is legally required, observing technical and audit deadlines.

Some information may be kept where there is a legal or contractual obligation, or a need to protect the company’s rights, as permitted by the LGPD.

7. Security and international data transfer

We adopt appropriate technical and administrative measures to protect personal data against unauthorized access, incidents, loss, alteration or improper disclosure, such as:

• Encryption at rest and/or in transit, where applicable;
• Access control, environment segregation and log recording;
• Least privilege and credential management;
• Backups and incident response plan;
• Supplier assessment and confidentiality agreements.

We adopt ongoing measures to protect your data. Even so, no system is entirely infallible. In the event of a security incident with relevant risk, we will adopt the measures provided for in the General Data Protection Law, including assessing notification to data subjects and to the National Data Protection Authority, where applicable.

Your data may be stored or transferred to countries outside Brazil or the European Economic Area, always observing adequate legal protection mechanisms, as required by applicable legislation.

8. Sharing of personal data

We may share personal data, when necessary, with:

• Companies within the same economic group
• Business partners and service providers
• Professional advisors (lawyers, auditors, accountants, insurers)
• Governmental and regulatory authorities

Financial and payment data is processed directly by third-party payment providers, subject to those providers’ own privacy policies.

9. Contacts

For questions, requests or to exercise rights related to the protection of personal data, please contact:

Locatelli Group

Phone: +55 (11) 3886-4800

E-mail: dpo@locatelligroup.com.br

10. Changes to the Privacy Policy

This Privacy Notice may be updated periodically to reflect legal or operational changes. We recommend that you review it regularly.

11. ISO 27001 and 27701 certification

Locatelli Group holds ISO 27001 and ISO 27701 certifications, which attest to the compliance of its processes with international standards for Information Security and Data Privacy, reinforcing our commitment to the protection of information and to the LGPD.