Multiplan Empreendimentos Imobiliários S.A. (“Multiplan” or “We”) is committed to your privacy. For this reason, this Privacy Policy (“Policy” or “Privacy Policy”) aims to inform how we process personal data in the context of the relationship with our investors, analysts and users of interactive services available on our website (“Investor” or “You”). Our efforts are aimed at ensuring that the personal data provided or collected is only used in accordance with this Policy and with applicable privacy and data protection legislation.

This Policy may be accessed in the section “Privacy Policy” made available at the bottom of our website (https://ri.multiplan.com.br/en/) (“Website”). We also remind you that you can contact Multiplan at the address https://www.multiplan.com.br/pt-br/privacidade-de-dados or by email ri@multiplan.com.br so we can answer your questions about our Privacy Policy.

1. Who is the controller of your personal data?

Multiplan is the controller of the personal data for the purposes of processing personal data described herein. For the purposes of the applicable data protection legislation, the controller is the one responsible for decisions regarding the processing of personal data.

2. What personal data do we process?

In general, when an Investor invests or, in any other way, interacts with Multiplan, in the scope of investor relations, we process his/her personal data. Such data may include:

• Full name, CPF, email, address and phone and cell phone numbers;
• Date of birth, age and nationality;
• Photographs and images at events;
• Educational and professional background;
• Number of shares;
• Bank data;
• Access and browsing data (when you interact with our Website, we may also record information, such as time, browser type, browser language, Internet Protocol (IP) address, date and time of your connections);
• Other data that you have spontaneously shared with uso.

In general, Multiplan does not collect sensitive data from its Investors. However, in the event this type of data is collected, Multiplan shall take all the measures required to ensure the legality of the processing and inform you about the referred processing (by updating this Policy or by communicating directly with you).

3. Use of Cookies

Multiplan may use “cookies” that will be sent to the browser and stored on your computer’s hard drive.

Some cookies are required for the functioning of the Website. These cookies are generally set in response to actions taken by you, such as setting privacy preferences, logging in or filling out forms.

Another purpose of cookies is to collect information about how you use the Website. Performance cookies help us, for example, to identify most accessed areas of our website. In this way, we can adapt the content of our sites more specifically to your needs and, thus, improve the Investor’s experience and, possibly, facilitate your browsing with the characteristics, preferences and quality of the information conveyed to your browsing. These cookies are used to send relevant information to you, for example, based on the web pages you have visited, within the limits authorized by law.

We inform you that Multiplan does not currently use a technical solution that allows us to fully respond to the “do not track” signals from your browser. Still, you can manage your cookie settings in your browser settings any time you want. By disabling all cookies in your browser settings, it is possible that certain sections or features of the Website may not work or cause slow website loading, as your browser may prevent us from setting the required cookies.

4. What do we use your personal data for?

We use the Investor’s personal data for the following purposes:

• Gathering information about the investor base to foster relationships;
• Managing information for generating reports, graphs, among other metrics, for a better understanding of the market;
• Sharing information about Multiplan’s shares and operations, as a listed company;
• Maintenance of the direct communication tool with Investors or interested parties;
• Meeting legal or regulatory requirements;
• Promoting the acts inherent to the functioning of the publicly-held company, such as the calling of meetings;
• Evaluating website performance and functionality;
• Sending invitations to events to establish close relationships with Investors;
• Defending Multiplan’s rights, as required, and comply with legal and regulatory obligations;
• Meeting our legitimate interests.

In order to achieve some of the above purposes, the processing of your data may be based on your consent. Should this situation occur, we will ensure that this consent is freely-given, informed and unambiguous in relation to the purpose for which it is being collected by us.

5.  Third-party websites

Third-party websites that may be accessible from the Multiplan website are under the responsibility of the respective third parties. Multiplan will not be responsible for ordering and/or providing personal data on third-party websites. We recommend that you read the respective privacy policies of such websites to understand how your personal data is used in this context.

6. With whom do we share your personal data?

We may share the personal data collected about you with third parties and regulatory bodies, judicial or administrative authorities, that are relevant for the purposes of achieving the purposes described herein. Said sharing occurs based on the following criteria and for the purposes described below.

• Third-party service providers: We work with third-party service providers to help us manage data, information and information record, send invitations, information and control people at events. When we share data with third-party service providers, we require that they use your data in accordance with our instructions and terms or with your express consent, where applicable.
• Financial institutions: due to the operation of a publicly-held company, we share data with the financial institutions responsible for the administration, management and custody of the assets.
• Regulatory bodies, judicial or administrative authorities: we may share your personal data to provide the competent authorities with all information that is requested in relation to the Investor. In addition, we may share your personal data with public authorities or private entities to fight fraud and abuse in the use of the Services, to investigate suspected violations of the law, to defend our rights or to fight any other suspected non-compliance with our policies and contracts.
• Corporate reorganization: if Multiplan’s corporate structure is reorganized, your personal information can be transferred regardless of your authorization to guarantee the continuity of services.

7.  Transfers of your personal data outside Brazil

In exceptional cases, Multiplan may transfer some of your personal data to partners or service providers located abroad, including providers of cloud technology services. When personal data is transferred outside Brazil, Multiplan will take appropriate measures to ensure adequate protection of personal data in accordance with the requirements of the applicable data protection legislation, including by entering into relevant data transfer agreements with third parties when needed.

8. How long do we store your personal data?

We store and keep your information: (i) for as long as required by law; (ii) until the end of the processing of personal data, as mentioned below; or (iii) for the time required to preserve Multiplan’s legitimate interest (as, for example, during applicable periods of limitation or compliance with legal or regulatory obligations).

We will stop processing personal data when:

• The purpose for which the data was collected has been achieved, and that the personal data collected is no longer required or relevant to the achievement of the specific purpose aimed;
• We receive Investor’s statement in this regard, upon the end of the relationship between Multiplan and the Investor; or
• There is a Legal order.

In such cases of termination of the processing of personal data, except in the cases established by the applicable legislation or by this Privacy Policy, the personal data will be eliminated. In the case of withdrawing of consent or request for the deletion of your personal data, some information may still be kept as required to comply with legal obligations, regular exercise of rights, attendance of legitimate interest, detection and prevention of fraud.

9. What are your rights in relation to the personal data processed?

You have rights with regard to your personal data, including:

• Confirmation of the existence of personal data processing: Upon request from the Investor, Multiplan will confirm the existence of personal data processing, under the terms of the applicable legislation;
• Access to personal data: The Investor may request access to his/her processed personal data that is stored by Multiplan;
• Correction of incomplete, inaccurate or outdated data: The Investor can and must, at any time, correct and update his/her personal data;
• Information on shared data usage: The Investor may have access to additional information on the possible sharing of his/her personal data;
• Objection to the processing of data: The Investor may express his/her willingness to no longer have its data processed by Multiplan at any time, through a free and facilitated statement, if he/she understands that the processing of the data is unnecessary, excessive or violates any provision of the applicable data protection legislation. Investor may also stop receiving company announcements by choosing to opt-out, which will be indicated in the messages sent by the company. The processing carried out before the opposition is ratified. The objection will not automatically imply the end of the processing of personal data that is kept by Multiplan based on other legal grounds;
• Petition before the ANPD: The Investor has the right to petition before the National Data Protection Authority (ANPD – Autoridade Nacional de Proteção de Dados) in relation to the processing of his/her personal data by Multiplan.

To exercise any of the above rights, contact our Data Protection Officer at https://www.multiplan.com.br/pt-br/privacidade-de-dados or by email ri@multiplan.com.br. In some cases, we may not be able to respond to your request. Should this situation occur, we will properly explain the reasons and legal grounds that prevent us from attending to you.

10. How do we treat your data and ensure your security?

Personal data will be processed exclusively in accordance with the terms described herein and in accordance with the principles of transparency, necessity, minimization and legality provided for in the applicable data protection and privacy legislation.

Personal data can be processed in printed form or in automatic electronic format and through post, email, phone and any other electronic channel.

Multiplan uses appropriate technical and organizational measures to protect personal data against unauthorized or illegal processing and against accidental loss, destruction or damage. Personal data is securely stored on protected equipment and servers with controlled access.

Despite the best efforts made by the Multiplan Group to protect and preserve the data made available to it, it is important that the individuals are aware that such measures may not be sufficient to prevent any incidents, invasions or leaks that occur beyond our protection range.

11. Data Protection Officer Contact

If you have any questions regarding this Privacy Policy or how Multiplan processes your personal data, contact the Data Protection Officer at https://www.multiplan.com.br/pt-br/privacidade-de-dados or by email ri@multiplan.com.br.

12. Changes to this Privacy Policy

Multiplan reserves the right to change this Privacy Policy at any time by publishing the updated version on the Website.