Privacy Policy

1.1 The purpose of this Privacy Policy is to demonstrate the commitment of LITHOGEO SISTEMAS LTDA - (“LITHOGEO”), registered under CNPJ No. 57.902.469/0001-33, headquartered at Sala Comercial No. 302, Edifício São Vicente, Rua Silviano Brandão, No. 78, Centro, Formiga–MG, ZIP Code 35570-112, to the protection of the personal data it processes by reason of the offering of its software and services.

1.2. This Policy applies to all personal data processing activities carried out by LITHOGEO, including through its site, digital platforms, systems, applications and commercial relationships with customers, leads, partners, staff and candidates.

1.3. LITHOGEO develops a software-as-a-service (SaaS) solution focused on geographic and territorial analysis, which operates through remote access via a web platform, allowing registered users to submit and analyze geospatial data, including KML files and other compatible formats.

1.4. We recommend that you carefully read this Policy and its eventual updates before proceeding with the use of our services and products.

2.1 To demonstrate LITHOGEO's commitment to the security and privacy of data and information collected from its customers, leads, commercial partners, staff, candidates for opportunities and partners.

3.1 The Policy comes into force as of July 22, 2025, and shall remain in force for an indefinite period, and may be revised and updated whenever necessary.

4.1 The Policy applies to all persons who were or are users of LITHOGEO's platforms and software, customers, leads, commercial partners, LITHOGEO staff and candidates interested in joining the company's team.

5.1 The Policy shall be published and disclosed by LITHOGEO on its Site at the URL: https://lithogeo.com.br/privacy-policy and shall be available for reading.

5.2 In the Policy, we explain, in a clear and transparent manner, to the persons who are or were users of LITHOGEO's platforms and software, customers, leads, commercial partners, staff and candidates for opportunities, what is done with the personal data we process.

5.3 The topics below clarify for which purposes your personal data is used, for how long, how it is possible to access it, update it and obtain additional information.

WHICH PERSONAL DATA DO WE PROCESS?

6.1 We process the following personal data divided by categories of data subject:

CUSTOMERS, COMMERCIAL PARTNERS AND LEADS

6.2 Registration data: Name, ID (RG), Individual Taxpayer Registry (CPF), parentage, education, e-mail, residential address, landline telephone, mobile, language, position, company, profession, sex, date of birth, nationality, marital status.

6.3 Financial data (banking data and other financial data – as applicable to the context of the services provided to the customer);

STAFF

6.4 Registration data: name, corporate e-mail, ID (RG), Individual Taxpayer Registry (CPF), parentage, marital status, date of birth, telephone, address, profession, education, professional registration, position held, work card, PIS, voter registration card, military reservist certificate, signature, education, sex, termination date, admission date and changes in position;

6.5 Financial data: salary, banking data, FGTS statement;

6.6 Sensitive data: photos, videos, medical certificate and Occupational Health Certificates (ASOs): admission, periodic, return-to-work and dismissal.

CANDIDATES FOR OPPORTUNITIES:

6.7 Registration data: name, e-mail, date of birth, telephone, address, profession, education, professional registration, professional experiences and academic certificates;

6.8 Behavioral data: professional experience and competency assessment.

7.1 LITHOGEO, in the capacity of controlling agent, shall make the decisions regarding the personal data processed within the scope of the relationship established with you.

8.1 We process personal data for the following purposes:

8.1.1 To make contact to send communications, such as security alerts, updates, to present our Services, carry out marketing operations;

8.1.2 To make contact to offer assistance and support and solve problems;

8.1.3 To operate, protect, carry out functionality tests, maintenance and continuous improvements to the services, enhancing the Users' experience;

8.1.4 To maintain the security and integrity of our services and users, carry out identity confirmations, fraud prevention, internal investigations, investigate and prevent legal, regulatory and contractual violations;

8.1.5 To carry out development research;

8.1.6 To carry out backups;

8.1.7 To consult and edit registrations, access the user's account to carry out changes requested by them and provide assistance in the use of the features;

8.1.8 To register/change the user's forms of payment for the services and systems, consult and manage the user's financial situation with LITHOGEO, transfer the ownership of the subscription; carry out refunds or charges; issue Invoices.

8.1.9 Sharing of data with the Federal Revenue Service for compliance with legal determinations, such as: Name, CPF, CNPJ, address, telephone, e-mail, corporate name, municipal/state registration, sale data;

8.1.10 Sharing of data with the Ministry of Labor and Employment for compliance with legal determinations and completion of SEFIP, GRRF, CAGED, DIRF, RAIS and other labor obligations.

8.1.11 Internal and external audits, for validations of information security matters, seeking as far as possible the confidentiality and anonymization of this data;

8.1.12 To meet legal requests from public authorities and maintain the custody of documents to support legal, tax and business requirements;

8.1.13 Generation of technical reports, maps and analyses from geographic data submitted by users;

9.1 The following are hypotheses of the sharing of personal data by LITHOGEO:

9.1.1 When permitted, under the terms of the applicable law, we may process certain personal data, such as e-mail address, to share it with social media platforms, such as Facebook and Google, to generate leads, drive traffic to our site or otherwise promote our services. These processing activities are based on our legitimate interest in carrying out marketing activities to offer services that may be of interest to you.

9.1.2 Any question about how your application providers, such as, for example, Facebook and Google, process your personal information, should be directed to those providers.

9.1.3 LITHOGEO may share users' data with public authorities, such as tax, treasury, judicial and police authorities, or authorized third parties, if and to the extent necessary or permitted to comply with the law, in situations such as:

9.1.3.1 To comply with legal obligations;

9.1.3.2 To comply with a valid legal request and respond to allegations made against LITHOGEO;

9.1.3.3 To bring or defend against legal actions;

9.1.3.4 To respond to a valid legal request related to criminal investigations, suspicions of illegal activity or any other activity that may expose LITHOGEO and its users, customers and staff to legal liability;

9.1.3.5 To carry out the physical and cybersecurity of LITHOGEO, in all its assets, and of its users, customers and staff;

9.1.4 For the execution of the services it provides, LITHOGEO may share the data of users, customers, commercial partners, leads and staff with outsourced service providers, who act in various processes, such as:

9.1.4.1 Storage of information in the cloud;

9.1.4.2 Information technology service providers in general;

9.1.4.3 Verification of the identity of users, for fraud prevention and credit risk assessment;

9.1.4.4 Verification of information in comparison with public databases;

9.1.4.5 Research, development and maintenance of applications;

9.1.4.6 Provision of LITHOGEO's Services through third-party platforms and software tools;

9.1.4.7 User Service;

9.1.4.8 Marketing promotion, including advertising services on social networks, lead prospecting and data analysis;

9.1.4.9 Provision of information for consulting, law, accounting and other professional service providers;

9.1.4.10 Processing and ensuring the security of payments.

9.1.4.11 Suppliers related to the physical security of those who access LITHOGEO's premises.

9.2 In the cases cited, the service providers shall act as operating agents of the respective personal data strictly pertinent to the fulfillment of their attributions, such that LITHOGEO is the controlling agent.

9.3 It is necessary to highlight that the service providers have limited access to the data of users, customers, leads, commercial partners and staff to perform specific tasks with a delimited purpose and are contractually obliged to protect the information, using it only for the contracted purposes and under the supervision of LITHOGEO.

9.4 In selection processes for candidates for job openings, we may share data with outsourced companies for the processing of data under the instructions and on behalf of LITHOGEO. In this case, we ensure that the outsourced parties offer sufficient guarantees, based on adequate technical measures, so that the processing satisfies the legal requirements, in full observance of the rights of the data subjects;

9.5 LITHOGEO may share the data of its staff with:

9.5.1 Companies supplying benefits, such as, medical insurance, life insurance, private pension, transport voucher, meal voucher and gym;

9.5.2 Educational institutions and suppliers for professional development and corporate education;

9.5.3 Public authority (judicial and extrajudicial), governmental entity, competent regulatory or tax agency, before which LITHOGEO is subject to complying with a legal or regulatory obligation or in accordance with applicable local legislation.

10.1 LITHOGEO uses cloud computing services provided by third parties for the hosting and operation of its platform, which may result in the eventual international transfer of personal data, by reason of backups or replications carried out in datacenters outside the national territory.

Sole paragraph: To ensure that your personal data is processed exclusively for the purposes mentioned, we shall adopt guarantees and safeguards such as specific clauses, standard clauses, global corporate rules.

11.1 The personal data collected and processed by LITHOGEO shall be stored until the purpose of the processing is exhausted or when there is no longer a legitimate purpose or a legal and regulatory reason that allows LITHOGEO to retain it.

12.1 We adopt the security standards established in the applicable laws and regulations, such as:

12.2 Training, governance, internal security Policies;

12.3 Control of storage on contracted servers;

12.4 Software to encrypt collected data;

12.5 Protection against unauthorized access;

12.6 Access authorized only to specific persons to the place where your personal information is stored, provided that this access is essential to the development of the intended activity;

12.7 Confidentiality of the professionals who access the information/data;

12.8 Application of the applicable administrative, disciplinary and legal sanctions to staff and third parties who improperly use your information, in violation of this Privacy Policy;

12.9 Absolute commitment to the principles set out by the applicable legislation, as well as to the storage, and deletion of the data, the latter when requested;

12.10 Access by the data subject to all of their information that is stored and exercise of their rights prescribed in the legislation on personal data protection

12.11 Even though our best efforts are made to preserve your privacy and to protect your personal data, it is important that you know that no transmission of information is fully secure. For this reason, LITHOGEO cannot fully guarantee that all the information it receives and/or sends will not be the target of unauthorized access carried out through methods developed to obtain information improperly, such as viruses or database intrusions.

12.12 In the event of a breach of the personal data that is under our custody, we guarantee full effort to remedy the consequences of the event.

13.1 The LGPD guarantees that you, in the capacity of data subject, may exercise, at any time and upon request, your rights in relation to the controllers of your information. We provide the references below so that you understand in a clear and transparent manner how to exercise your rights and the means for our service.

13.2 Confirmation of the existence of Processing and Access to Personal Data:

13.2.1 You may request that LITHOGEO confirm whether it has carried out or is carrying out the processing of your personal data and request that it inform which personal data it holds about you.

13.3 Portability of the data to another service or product supplier:

13.3.1 You may request that LITHOGEO transmit the personal data it holds about you to another party responsible for the processing, ensuring that it is transmitted with the appropriate level of security, observing the commercial and industrial secrets of LITHOGEO.

13.4 Information on the entities with which LITHOGEO has carried out or carries out the shared use of data:

13.4.1 You may request that LITHOGEO provide the information relating to the sharing of your personal data with third parties.

13.5 Correction of incomplete data:

13.5.1 If you verify that your personal data is incomplete, inaccurate or outdated, you may request that LITHOGEO correct or complement your personal data.

13.6 Information on Consent:

13.6.1 Some personal data processing carried out by LITHOGEO is authorized by the LGPD without the need for express consent by the data subject, as it fits into the authorized hypotheses of article 7 and item II of article 11, both of the LGPD. If, in the future, your consent is necessary to use a certain product or service, you may ask LITHOGEO to clarify whether it is possible to provide that product or render that service without your consent for the processing of your personal data, or what the consequences of not providing consent are for this case.

13.7 Anonymization, blocking or elimination of unnecessary, excessive or unlawfully processed data:

13.7.1 To the extent technically possible, LITHOGEO eliminates and anonymizes unnecessary or unlawfully processed personal data, such that it shall always observe the minimization of the personal data processed.

13.8 Revocation of Consent:

13.8.1 Should the data processing be based on the legal basis of Consent, you as the data subject may at any time request its revocation.

13.9 Complaint to the National Data Protection Authority (ANPD):

13.9.1 With the constitution of the ANPD, you may make a complaint to the ANPD in relation to your personal data, but should you have any complaint or question in relation to the Processing of your data, contact us through the specific communication channel with the Officer, as described in item 14 and we will be available to assist you with your matter.

13.10 Elimination of the Personal Data:

13.10.1 You as the data subject may request the elimination of your data; however, should the retention/storage of the Personal Data occur by virtue of situations such as a legal or regulatory obligation, this data may be retained/stored regardless of the consent of the data subject, as an exceptional hypothesis of processing.

13.11 Objection to the Processing, if irregular:

13.11.1 You may object to the processing of your personal data, if it is found that it is an irregular processing. LITHOGEO shall take the appropriate measures and without undue delay in the event of a contestation of the data processing, in whole or in part.

13.12 Review of automated decisions:

13.12.1 You may question the decisions taken solely on the basis of personal data processed in an automated manner that affect your interests, such as, for example, decisions intended to define your personal, professional, consumer and credit profile or the aspects of your personality, as well as knowing what the criteria and procedures used for the automated decision are, observing the commercial and industrial secrets.

13.13 With the aim of guaranteeing your privacy and the protection of your data, LITHOGEO shall facilitate the exercise of the rights described in article 18 of the Brazilian General Data Protection Law.

13.14 To meet the above requests, LITHOGEO undertakes all reasonable efforts in the shortest possible time, but you must be aware that there may occur:

13.14.1 An eventual delay in the service due to justifiable factors, such as the complexity of the request.

13.14.2 Rejection of your request for formal reasons (for example, should you be unable to prove your identity) or legal reasons (such as the request for elimination of data that must be kept by force of law or regulation; request for a copy of a document that will only be provided if there is explicit consent; request for portability due to the absence of specific regulation for the activity carried out by LITHOGEO).

13.14.3 For any hypothesis of impossibility of meeting your request, LITHOGEO shall present the due reasons in a justified manner.

13.14.4 To effect the exercise of your rights, as a security measure and fraud prevention, we will always request the verification of your identity.

14.1 Through the Communication Channel between the personal data subjects and LITHOGEO, the data subject may exercise their rights as a data subject, requesting information or requiring what they deem pertinent to the protection of their personal data. The Communication Channel between the personal data subjects and LITHOGEO is the e-mail: suporte@lithogeo.com.br.

15.1 Every solicitation or request from the data subjects shall be received by LITHOGEO's Data Protection Officer (DPO), responsible for the safekeeping of LITHOGEO's personal data, who shall carry out the analysis of the request and adopt the measures for the swiftest possible response to the data subject.

Name of the Officer: Fábio Viana

E-mail: dpo@lithogeo.com.br

15.2 The main attributions of the Officer involve, without prejudice to other activities established in specific policies and procedures that compose the Privacy Program:

15.2.1 Management of the Privacy Program;

15.2.2 Development, maintenance, and proposal for the revision of the Organization's privacy procedures and policies, including this Policy;

15.2.3 Oversight of compliance with the procedures and policies of the Privacy Program;

15.2.4 Monitoring of the level of compliance of the Organization, by means of recurring diagnostic analyses, with the definition of action plans to improve the training and the clarity of the documents that make up the Privacy Program;

15.2.5 Acting as a point of contact for the ANPD and the Data Subjects;

15.2.6 Receipt of requests from the Data Subjects, and

15.2.7 Preparation of the Personal Data Protection Impact Reports, with the assessment and review of the risks of the activities.

15.3 Finally, the Officer must assist LITHOGEO's staff and clarify for them any question about the Privacy Program and the correct form of Personal Data Processing to be adopted during the execution of their activities.

16.1 This Policy contains all the relevant and necessary information about the processing of your personal data and, for this reason, the complete reading of this document is strongly recommended.

16.2 Should any doubt still remain, after the complete reading of this Policy, you, the data subject, may contact our Officer (DPO) through the e-mail dpo@lithogeo.com.br

17.1 We may record the activities you carry out when you use our digital platforms. We may also use cookies and similar technologies, our own or third parties', to monitor the activities carried out while you access our Site. All the technologies used by us shall always respect the terms of this Privacy Policy.

17.2 Cookies are internet files that temporarily store what you are visiting on the network, enabling a personalized access experience. We have third-party cookies activated on our Site. In this case, we merely warn that the privacy practices shall be governed by the privacy policies and the terms of use of these third parties, therefore, to understand how these third parties use cookies, we recommend analyzing the cookie policy.

17.3 We use Cookies for purposes of authentication, security and integrity of the product, advertising, recommendations, measurements, insights, performance, analysis and research that allow us to understand the usage behavior of the Site to improve our services and offer the best possible experience.

17.4 You may, at any time, block the use of cookies by activating a setting in your internet browser and your ability to limit Cookies shall be subject to the settings and limitations of your browser.

17.5 You may also delete the existing cookies through the same settings of your internet browser. Should you choose to disable cookies, you may continue browsing the sites and blogs, but some parts of the pages may cease to function.

17.6 The types of cookies collected are as follows:

17.7 The data subject is guaranteed control over the use of cookies through the web browser configuration, being aware that, in case of deactivation, the use of certain resources and functions of the accessed pages may be limited.

17.8 The data subject acknowledges being solely responsible for the veracity of the information provided at the time of their registration and subsequent use on the Site.

18.1 We list the meaning of some terms contained in this Privacy Policy for your better understanding:

19.1 LITHOGEO undertakes to reevaluate its Privacy Policy and adapt it whenever necessary. Every time a relevant change is made and changes to this Policy are implemented, the version in force shall be disclosed on our Site.

20.1. This Privacy Policy shall be interpreted in accordance with the legislation in force, especially, but not limited to, the following norms:

Federal Law No. 13.709/2018 — Brazilian General Data Protection Law (LGPD);

Federal Law No. 12.965/2014 — Brazilian Civil Rights Framework for the Internet (Marco Civil da Internet);

Federal Law No. 8.078/1990 — Consumer Protection Code (CDC);

Other specific legislation applicable to the activities carried out by LITHOGEO, including sectoral or technical norms that regulate the provision of services in digital environments and the processing of personal data;

National and international norms and guidelines on personal data protection, in particular the ISO/IEC 27701 Standard, which deals with the information privacy management system.

Cordially,

LITHOGEO SISTEMAS LTDA

CNPJ 57.902.469/0001-33