The present Policy aims to establish the internal procedural framework to ensure that Casa dos Ventos Renewable Energies (“CVER”) is in compliance with legal regulations

(i) privacy and data protection for individuals, legal entities, employees, suppliers, service providers, business partners, lease-holders and all holders of personal data and sensitive personal data to which CVER has access in the regular practice of its business activities; (ii) application and processing of personal data, including data collection, registration, storage, processing, usage, sharing, enrichment and elimination of data; (iii) General Data Protection Law (“LGPD”);

It is recommended that these Policies be read and interpreted in conjunction with the Casa dos Ventos Code of Conduct and other company standards, including those edited by the Supervisor or Data Protection Officer (“DPO”).

Casa dos Ventos’ Data Privacy and LGPD Compliance Policy applies to its employees, collaborators, administrators, partners, third parties, suppliers and service providers, regardless of place of activity or function.

Furthermore, it applies to employees, partners, third parties, suppliers and service providers of companies associated with Casa dos Ventos, including, but not limited to, Special Purpose Companies (“SPEs”) that own wind and solar energy projects under development or in the implementation phase.

Brazilian Federal Constitution

Civil Framework of the Internet – Law 12.965 / 14

General Data Protection Law – Law 13,709 / 18

Process treatment agents – the controller and the operator.

Internet applications – the set of tools that can be accessed through a platform with internet access.

National authorities – public administration body responsible for overseeing, implementing and supervising compliance with this Law throughout the national territory.

Database – structured set of personal data, established in one or several locations, in digital or physical support.

Internet connection – enabling a terminal to send and receive data packets over the internet, by assigning or authenticating an IP address.

Controller – natural or legal person, under public or private law, who is responsible for decisions regarding the processing of personal data.

Personal data – information related to an identified or identifiable natural person. It may include, name, surname, nickname, age, home or electronic address, location data, license plates, purchase profile, Internet Protocol (IP) number, academic data, purchase history, among others.

Sensitive personal data – personal data about racial or ethnic origin, religious belief, political opinion, union membership or organization of a religious, philosophical or political nature, data relating to health or sexual life, generic or biometric data, when linked to a natural person.

Deletion – deletion of data or data sets stored in a database, regardless of the procedure employed.

Person in charge – person appointed by the controller and operator to act as a communication channel between the controller, the data holders and the National Data Protection Authority (ANPD).

Internet – the system made up of a set of logical protocols, structured on a worldwide scale for public and unrestricted use, with the purpose of enabling digital data communication between terminals through different networks.

Operator – natural or legal person, under public or private law, who performs the processing of personal data on behalf of the controller.

Data holder – natural person to whom the personal data that is being processed refers to.

Data processing – any operation performed with personal data, such as those relating to the collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, elimination, evaluation or control of information, modification, communication, transfer, diffusion or extraction.

Data processing – any operation performed with personal data, such as those relating to the collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, elimination, evaluation or control of information, modification, communication, transfer, diffusion or extraction.

a) All employees, collaborators, administrators, partners, third parties and service providers

i. Comply with the guidelines imposed by current legislation, the Casa dos Ventos Code of Conduct and internal policies. ii.

ii. Safeguard the Casa dos Ventos property, data and information

iii. Ensure the privacy of data collected and processed by Casa dos Ventos.

iv. Adopt the best practices to safeguard data security, especially those pertaining to sensitive or personal nature, under the custody of Casa dos Ventos.

b) Information Technology Area

i. Determine all information security rules to be adopted by Casa dos Ventos and its collaborators.

ii. Determine the rules for data processing and treatment legally collected by Casa dos Ventos.

iii. Execute, under supervised coordination of the person in charge and whenever requested by the data holder, the deletion of all information from the Casa dos Ventos database.

c) Data supervisor or Data Protection Officer

i. Represent Casa dos Ventos before the National Authorities and data holders.

ii. Determine the internal regulations for Casa dos Ventos’ compliance with the terms of the General Data Protection Law.

iii. Determine the procedures for data collection, processing and elimination.

iv. Store data processing records carried out by Data Operators hired by Casa dos Ventos.

These Policies are determined by the following principles and obligations:

– Every natural person is assured of the ownership of his personal data and the guarantee of his fundamental rights to freedom;

– The General Data Protection Law is appliable regardless of the means and or forms of processing data collected or received;

– The data holder retains the right to access information regarding the processing of his personal data, in order to determine which data has been processed, which is being shared and the purpose of the processing.

– Casa dos Ventos will store the records that demonstrate the adoption of measures in implenting the principles established in the LGPD;

– The General Data Protection Law requires that the data belonging to the data holders can only be processed if they are based on the following principles:

Purpose – the processing of personal data must be carried out for legitimate, specific, explicit and informed purposes to the holder, observing the original purposes;

Adequacy – the processing of personal data must be compatible with the purposes informed to the data holder, according to the context of the processing;

Necessity – the processing of personal data must be limited to the minimum requirements necessary for the accomplishment of its purposes, with the scope of the relevant data, proportional and not excessive in relation to the purposes of the data processing;

Free access – holders are guaranteed free and easy consultation on the manner and duration of data processing treatment, as well as on the integrity of their personal data;

Data quality – holders are guaranteed that their data is accurate, clear, relevant and up-to-date, according to the need and for the fulfillment of the purpose of its treatment;

Transparency – holders are guaranteed the right to clear, accurate and easily accessible information about the treatment and the respective treatment agents, observing commercial and industrial confidentiality;

Security – technical and administrative measures must be used to protect personal data from unauthorized access and accidental or unlawful situations of destruction, loss, alteration, communication or dissemination;

Prevention – preventive measures must be adopted to prevent the occurrence of damages due to the processing of personal data;

Non-discrimination –it is forbidden to carry out treatment for illicit or abusive discriminatory purposes; and

Responsibility and accountability – demonstration, by the agent of the adoption of effective measures capable of proving the observance and compliance of the regulations pertaining to personal data protection as well as the effectiveness of these measures;

Aiming to guarantee the security of the information provided by the data holders, Casa dos Ventos will adopt physical, logical, technical and administrative security procedures compatible with the sensitivity of the information collected.

Whenever necessary, Casa dos Ventos will implement new procedures and technological improvements in order to protect the data collected from the different holders.

Personal data is collected when a relationship occurs and / or a contract is signed between the data holder and Casa dos Ventos.

The Personal Data collected varies according to the purposes of use and the activities carried out. This Personal Data includes registration, financial and transactional data.

The data may be provided directly by its owner, be collected as a result of the provision of services or supply of products by Casa dos Ventos, or may be provided by other companies related to Casa dos Ventos or by legitimate external sources.

– To comply with contractual obligations with the data holder or with the company to which they belong.

– To notify the holder of changes to the terms of signed contracts.

– To execute internal operations, including support and troubleshooting. – To reinforce data security and protection procedures.

– To establish, exercise and defend rights in judicial, administrative or arbitration proceedings when necessary.

– To comply with legal or regulatory obligations, or as required by legal proceedings, by any law enforcement agency or government with competence over Casa dos Ventos.

– To use the holder’s personal data to prove business viability with prospects.

Casa dos Ventos shares personal data when necessary or relevant, for the purposes set out in the contracts with its customers, observing strict security standards, always aiming at the confidentiality of information and following the rules of data protection and privacy.

The sharing of personal information can, for example, occur in the following situations:

– Service providers: personal data can be shared with service providers. Companies that offer services such as authentication systems, digital document signature systems, security services, etc. For these suppliers, there are terms of protection and proper use of the information shared;

– Associates: personal data can be shared between associates and / or companies within the same group.

– Public or governmental authorities: data may be shared with public authorities whenever required by the legislation or in response to court orders;

– Business operations: data may be shared during a corporate operation, such as the sale of assets. In such cases, the data holder will be promptly informed of any changes regarding the control of the data. The international transfer of data among Casa dos Ventos’ business partners, may only take place if proven necessary, limited to the personal data relevant to the business matter and with the explicit consent of the data holder.

The completion of the processing of personal data will take place in the following cases:

– When the proposed objective is reached or when there is no longer the need for personal data;

– When the holder requests the data to be deleted;

– In case of legal determination to do so.

After the completion of the data processing treatment, with the exception of cases provided for by law, personal data will be promptly deleted and Casa dos Ventos’ responsibility over them will cease to exist.

The Casa dos Ventos website may collect cookies and, for that, it will explicitly request user consent.

Cookies have different functions, in particular they enable easier navigation through pages, and they record preferences and optimize visitors’ user experience. These cookies can be stored on the Casa dos Ventos computer, enabling future access identification by the same user.

Before the website activates any cookies on a visiting user’s computer, he will be asked for clear and explicit authorization for the purpose for which the cookie is intended.

– Confirmation and access to data

– Correction of data that is incomplete, wrong or outdated

– Restriction on the treatment of part of your data, indicating which data may be kept by CVER.

– Cancellation or deletion of data

– Portability and data transfer from Casa dos Ventos to another data controller

– Rescinding of your unequivocal consent given to Casa dos Ventos

– Opposition to any data that is not in accordance with the law

– Explanation of the data processed by Casa dos Ventos

– Information on all data transfers or sharing by the Casa dos Ventos controller

The Board of Directors of Casa dos Ventos determines, by means of this policy, that the Data Protection Officer will always be the Director of Technology.

The main responsibilities of the Controller is:

– To inform and guide the controller, operator, and other contractors about the obligations and best practices to be adopted in regards to the General Data Protection Law.

– To monitor the implementation of the compliance program and comply with standards in all data processing activities carried out by Casa dos Ventos, proposing improvements whenever necessary.

– To document all information security measures adopted by Casa dos Ventos, so that, in the event of an incident in the processing of data, have elements to demonstrate the good faith and commitment of Casa dos Ventos.

– To report any incidents in data processing to the National Data Protection Agency (“ANPD”), cooperating in any inspections and diligences.

– To implement the recommendations received from the ANPD on the appropriate treatment of data processing.

– To process communication between company and data holders, receiving requests, complaints and deletion of personal data.

The policies must be adopted immediately upon approval by the Casa dos Ventos’ board of directors and must be adopted by all employees, collaborators, administrators, partners and third parties.

Any breach of the terms of these Policies must be immediately reported to the Casa dos Ventos Ethics Channel, the Compliance area or the Ethics Committee for due diligence and mitigation.

According to current legislation, the data holder’s rights are:

– Access to personal data;

– Correction and updating of data;

– Data portability;

– Exclusion of data, when they are excessive, unnecessary or treated in non-compliance with the purpose for which they are intended;

– Request for information regarding data sharing;

– Minimization and limitation of use;

– Rescinding consent, when applicable. It should be noted that any request made by the data holder is only met with proof of the applicant’s identity. In this way, additional information may be requested from the data requester.

This policy can be modified according to changes in the current legislation, technological advances or changes in the services provided by the company. The use of the information is linked to the version of the Privacy Policy enforced at the time of the use of the information.

Requests and / or inquiries regarding consent or the management of personal data can be sent to the email dpo@casadosventos.com.br or through the institutional website of Casa dos Ventos.