Privacy Policy

1. Introduction

RIVIO TECH LTDA understands that the trust of our clients, partners and employees is our most valuable asset. As a Personal Data Controller, we have an undeniable responsibility to protect the information entrusted to us.

In a world where data is essential to innovation, security and privacy are not a detail but a fundamental pillar of our operation.

This policy reflects our commitment to ensuring data protection in all of our activities. It was written to be a clear and transparent guide, explaining how we process and protect your personal data with the highest technical and ethical rigor, always in compliance with the Brazilian General Data Protection Law (LGPD).

2. Purpose

The main purposes of this Privacy Policy are:

• Transparency and awareness: to inform you clearly and accessibly of the conditions under which we process and protect your personal data. We want you to understand exactly what data we collect, why we do so and how it is used to improve our services.
• Guarantee of rights: to describe your rights as a data subject under the LGPD and explain how you can exercise them. Our goal is to make it easy to reach us so you can ask questions or request any action related to the protection of your data.

The guidelines in this policy apply to all Users and/or Visitors who interact with our Digital Channels, including our website, www.rivio.com.br, ensuring that privacy is a priority across all of our platforms.

3. Source of personal data

RIVIO TECH LTDA collects and processes your Personal Data, which may be provided: by the company that hires RIVIO TECH LTDA’s services for your benefit; and through information collected from other reliable sources.

The information collected by RIVIO TECH LTDA includes:

1. for individuals: name, CPF (Brazilian taxpayer ID), RG (Brazilian ID card), email, phone and mobile numbers, address and date of birth;
2. for legal entities: corporate name, CNPJ (Brazilian company taxpayer ID), name of the legal representative, the legal representative’s RG and CPF, number of employees, revenue, full address and phone number.

4. Purposes for which we use personal data

At RIVIO TECH LTDA, collecting your personal data is a fundamental and intentional process, guided by the principle of purpose limitation. We collect and use your information to ensure that our services not only meet but exceed your expectations, operating in a way that is secure, reliable and, above all, useful to you.

The data entrusted to us has a clear purpose. It allows us to:

• Deliver our services: we use your information to administer and fulfill all obligations related to the services we offer, ensuring a smooth, uninterrupted experience.
• Improve your experience: through data, we identify opportunities to improve our products and services, creating more efficient solutions aligned with your needs.
• Keep you informed: we use your data to keep you up to date on news, features, promotions and other events that may interest you, always with the goal of adding value to our relationship.
• Ensure security: data helps us strengthen the security of our services and prevent fraud, protecting you and the integrity of our platform.
• Comply with our legal obligations: in specific cases, we may use your data to cooperate with authorities or comply with court orders, always strictly following the applicable legislation.

It is important to stress that RIVIO TECH LTDA does not sell or trade your personal data. Your privacy is our priority, and your information is handled with the highest level of care and confidentiality. If any other purpose for using your data arises, you will be informed transparently and clearly at the time of collection.

5. Legal basis for processing personal data

RIVIO TECH LTDA processes Personal Data as part of performing and managing our contractual relationship with you and/or with the company that hires our services, in our legitimate interest or that of third parties, provided the legal requirements for doing so are met, in compliance with certain legal or regulatory obligations, or when necessary for the regular exercise of rights in judicial, administrative or arbitration proceedings. Your Personal Data may also be processed based on your prior consent, if, under certain circumstances, your consent is requested.

6. Sharing of personal data

The security and confidentiality of your Personal Data are very important to us. That is why we restrict access to your Personal Data to our duly authorized professionals who need to know such data in order to process your requests or provide the services requested.

We will not disclose your Personal Data to unauthorized third parties. However, we may share your Personal Data with entities within the group (client) and with authorized service providers we work with (for example: call center; relationship agents; back-office services; technology and IT consultants; etc.), whom we may engage for the purpose of providing our services.

In these cases, we ensure that your Personal Data is processed only for legitimate, specific and explicit purposes that have been disclosed to you, with no possibility of further Processing in a manner incompatible with the stated purpose.

In addition, we may share Personal Data about you when we believe, in good faith, that we are obliged to:

1. comply with a law, regulation or court order;
2. respond to requests for information from a regulatory body, law enforcement authority or other public authorities, including in matters of national security;
3. enforce and/or protect the property or rights of RIVIO TECH LTDA, including to investigate fraud and help prevent security threats, including information security threats, or other criminal or malicious activities; or
4. protect the legitimate interests of third parties, including the personal safety of RIVIO TECH LTDA employees.

7. Storage of your personal data

We store your Personal Data in our databases, in a secure environment that ensures its secrecy and confidentiality, only for as long as necessary to fulfill the purposes for which it was collected, observing any legal deadlines and RIVIO TECH LTDA’s need to defend itself in proceedings. However, we may occasionally need to keep your Personal Data for a longer period because of applicable laws or regulations. Once the legal period and need have ended, your Personal Data will be deleted using secure disposal methods or used in anonymized form for statistical purposes.

8. Sensitive personal data and data of children and adolescents

If it is strictly necessary to collect such data to achieve the purpose for which processing is carried out, we will do so in accordance with local legal requirements for the protection of Personal Data and, in particular, with your specific and prominent prior consent, for specific purposes under the conditions described in this Policy.

9. International transfer of personal data

Because RIVIO TECH LTDA’s area of operation follows that of its CLIENTS, your Personal Data may occasionally be transferred to recipients located outside Brazil and authorized to perform services on our behalf. In the event of an international transfer to recipients located in other countries, we will take the necessary measures to ensure that adequate safeguards exist for the protection of your Personal Data in accordance with the LGPD and in observance of the protections described in this Policy.

10. Exercising your rights under the LGPD

RIVIO TECH LTDA respects the rights you hold as a Personal Data subject and enables you to exercise them in accordance with article 18 of Law No. 13,709/2018. To exercise any of your rights, see section 14. Contact us about your rights under the LGPD.

To protect your privacy, and as a security and fraud-prevention measure, we may ask you to prove your identity before we fulfill your rights.

11. Security applied to the protection of personal data

We have implemented the best technical and administrative security practices available on the market to protect your Personal Data from unauthorized access and from accidental or unlawful destruction, loss, alteration, communication or dissemination, as required by current legislation.

12. Access to and updates of our Privacy Policy

By accessing RIVIO TECH LTDA’s DIGITAL CHANNELS, you expressly agree to this Policy.

For your own security, you should read and make sure you have understood all the conditions set out in this Policy, as well as in the other documents incorporated into it by reference.

By accepting the terms of this Policy, you expressly agree to provide only true, current and accurate Personal Data. You will be solely responsible for any false, outdated or inaccurate information you provide directly to RIVIO TECH LTDA.

If any change is made to this Policy, we will publish the new version on the DIGITAL CHANNELS, indicating the date of the revision, so that you can always be aware of the updated content.

All modifications take effect immediately after the revised Privacy Policy is published, unless otherwise specified. We therefore recommend that you consult this Policy periodically to stay informed of any changes.

The date of the last update to this Policy is shown at the top of this page and reflects the effective date of this Policy. Previous versions of this Policy may be requested at the email address given in this Policy.

13. Governing law and jurisdiction

This Privacy Policy is governed by and interpreted in accordance with Brazilian law, with priority given to the Brazilian General Data Protection Law (LGPD).

To resolve any dispute or controversy arising from this document, the parties choose the courts of the District of São Paulo. This choice does not preclude the specific personal, territorial or functional jurisdiction provided for by law.

In addition, to promote friendlier and more efficient conflict resolution, matters involving data subjects may be referred to JUSPRO – Justiça Sem Processo Mediação e Conciliação S/S Ltda., acting as a Mediation Chamber, in accordance with article 52, §7 of the LGPD. This approach seeks constructive dialogue and the resolution of issues without the need for legal proceedings.

14. Contact us about your rights under the LGPD

RIVIO TECH LTDA is pleased to announce the appointment of Dr. Simone Leme Bevandick as our Data Protection Officer (DPO). This decision reinforces our commitment to ensuring the security and privacy of your personal data.

The DPO will lead all the new data protection practices adopted in our group from October 2025, guiding our journey toward compliance and excellence. If you have any questions or need information about the processing of your personal data, you can contact the DPO directly through the following channels:

• Phone: +1 (250) 702‑6703
• Email: lgpd@rivio.com.br

You may also file a complaint directly with the Brazilian National Data Protection Authority (ANPD).