This Policy aims to establish the internal and procedural rules so that Casa dos Ventos Energias Renováveis ​​(“CVER”) complies with the standards:

(i) privacy and data protection of customers, individuals, legal entities, employees, suppliers, service providers, business partners, lessors and all holders of personal data and sensitive personal data to which CVER has access in the regular exercise of its business activities;

(ii) application to the processing of personal data, including collection, recording, storage, processing, use, sharing, enrichment and deletion of data;

(iii) the General Data Protection Law (“LGPD”);

It is recommended that this Policy be read and interpreted in conjunction with the Casa dos Ventos Code of Conduct and other company rules, including those issued by the Person in Charge or Data Protection Officer (“DPO”).

Goal

Casa dos Ventos' Data Privacy and LGPD Compliance Policy applies to its employees, collaborators, administrators, partners, third parties, suppliers and service providers, regardless of their place of activity or function.

Furthermore, it applies to employees, partners, third parties, suppliers and service providers of companies associated with Casa dos Ventos, including, but not limited to, Special Purpose Entities (“SPEs”) holding wind and solar energy projects. in development or in the implementation phase.

Coverage

Brazilian Federal Constitution

Civil Rights Framework for the Internet – Law 12,965/14

General Data Protection Law – Law 13,709/18

Related legislation

**Processing agents** – the controller and the operator.

**Internet applications** – the set of functionalities that can be accessed through a terminal connected to the internet.

**National authority** – public administration body responsible for ensuring, implementing and monitoring compliance with this Law throughout the national territory.

**Database** – structured set of personal data, established in one or more locations, in electronic or physical format.

**Internet connection** – enabling a terminal to send and receive data packets over the internet, through the assignment or authentication of an IP address.

**Controller** – natural or legal person, governed by public or private law, who is responsible for decisions regarding the processing of personal data.

**Personal data** – information related to an identified or identifiable natural person. It may include first name, last name, nickname, age, residential or email address, location data, license plates, shopping profile, Internet Protocol (IP) number, academic data, purchase history, among others.

**Sensitive personal data** – personal data on racial or ethnic origin, religious conviction, political opinion, membership of a trade union or organization of a religious, philosophical or political nature, data relating to health or sexual life, generic or biometric data, when linked to a natural person.

**Elimination** – deletion of data or set of data stored in a database, regardless of the procedure used.

**In Charge** – person appointed by the controller and operator to act as a communication channel between the controller, data subjects and the National Data Protection Authority (ANPD).

**Internet** – the system consisting of a set of logical protocols, structured on a global scale for public and unrestricted use, with the purpose of enabling data communication between terminals through different networks.

**Operator** – natural or legal person, governed by public or private law, who processes personal data on behalf of the controller.

**Data holder** – natural person to whom the personal data subject to processing refers.

**Data processing** – any operation carried out with personal data, such as those relating to collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, elimination, evaluation or control of information, modification, communication, transfer, diffusion or extraction.

**Shared use of data** – communication, dissemination, international transfer, interconnection of personal data or shared processing of personal databases by public bodies and entities in compliance with their legal powers, or between these and private entities, reciprocally, with specific authorization, for one or more treatment modalities permitted by these public entities, or between private entities.


Glossary

**a) All employees, collaborators, administrators, partners, third parties and service providers**

i. Comply with the guidelines imposed by current legislation, the Casa dos Ventos Code of Conduct and internal Policies.

ii. Care for the assets, data and information owned by Casa dos Ventos

iii. Ensure the privacy of data collected and processed by Casa dos Ventos.

iv. Adopt the best efforts to protect the security of data, especially personal and sensitive data, under the custody of Casa dos Ventos.

 

**b) Information Technology Area**

i. Determine all information security rules to be adopted by Casa dos Ventos and its employees.

ii. Determine the rules for processing data legitimately collected by Casa dos Ventos.

iii. Carry out, under the coordination of the person in charge and whenever requested by the data subject, the deletion of all information from the Casa dos Ventos database.

 

**c) Data Controller or Data Protection Officer**

i. Represent Casa dos Ventos before the National Authority and data holders.

ii. Determine the internal rules for Casa dos Ventos’ compliance with the terms of the General Data Protection Law.

iii. Determine data collection, processing and deletion procedures.

iv. Maintain records of data processing carried out by Data Operators hired by Casa dos Ventos.

Roles and responsibilities

This Policy is governed by the following principles and obligations:

All natural persons have the right to ownership of their personal data and the guarantee of their fundamental rights of freedom.
The General Data Protection Law applies regardless of the means and/or forms of data processing collected or received.
The data subject has the right to access information about the processing of their data, for the purpose of determining which data have been processed, which are being shared, and what the purpose of the processing is.
Casa dos Ventos will keep records that demonstrate the adoption of data processing measures to the principles established in the LGPD.
The General Data Protection Law imposes that the data of the subjects can only be processed if they are based on the following principles:
Purpose – the processing of personal data must be carried out for legitimate, specific, explicit and informed purposes to the data subject, taking into account the original purposes;

Appropriateness – the processing of personal data must be compatible with the purposes informed to the data subject, according to the context of the processing;

Necessity – the processing of personal data must be limited to the minimum necessary for the realization of its purposes, with the scope of the relevant, proportional and not excessive data in relation to the purposes of the processing of data;

Free access – the data subjects are guaranteed free and easy access to the form and duration of the processing, as well as to the integrality of their personal data;

Data quality – it is guaranteed to the data subjects that their data are accurate, clear, relevant and updated, according to the need and for the fulfillment of the purpose of their processing;

Transparency – the data subjects are guaranteed the right to clear, precise and easily accessible information about the processing and the respective data controllers, observing commercial and industrial secrets;

Security – technical and administrative measures must be used to protect personal data from unauthorized access and accidental or unlawful situations of destruction, loss, alteration, communication or dissemination;

Prevention – measures must be taken to prevent the occurrence of damage due to the processing of personal data;

Non-discrimination – impossibility of carrying out the processing for unlawful or abusive discriminatory purposes; and

Accountability and accountability – demonstration, by the agent, of the adoption of effective measures capable of demonstrating compliance with and compliance with the personal data protection rules, including the effectiveness of these measures.

Guidelines

Aiming at the security of the information provided by data subjects, Casa dos Ventos will adopt physical, logical, technical and administrative security procedures compatible with the sensitivity of the information collected.

Whenever necessary, Casa dos Ventos will implement new procedures and technological improvements in order to protect the data collected from the various data subjects.

Information Security

Personal data is collected when a relationship occurs and/or a contract is signed between the data subject and Casa dos Ventos.

The Personal Data collected varies according to the purposes of use and the activities carried out. This Personal Data includes registration, financial and transactional data.

The data may be provided directly by its holder, collected as a result of the provision of services or products by Casa dos Ventos, or may be provided by other companies affiliated with Casa dos Ventos or by legitimate external sources.

Collection of personal data

Casa dos Ventos processes personal data in accordance with the legal bases provided for in the General Data Protection Law (LGPD). Data processing is carried out only by authorized personnel, for the purpose for which they were collected and as consented by the holder. Data processing occurs, for example, in the following scenarios:

– Comply with contractual obligations with the data subject or the company to which the data subject belongs.

– Notify the holder of changes to the terms of signed contracts.

– Perform internal operations, including support and problem solving.

– Strengthen security and data protection procedures.

– As necessary, to establish, exercise and defend rights in judicial, administrative or arbitration proceedings.

– Comply with legal or regulatory obligations, or as required in legal proceedings, by any law enforcement or government body with jurisdiction over Casa dos Ventos.

– Use the holder’s personal data to prove business viability with potential partners.

Processing of Personal Data

Casa dos Ventos shares personal data when necessary or pertinent, for the purposes set out in contracts with its clients, within strict security standards, always aiming for the confidentiality of information and following data protection and privacy standards.

The sharing of personal information may, for example, occur in the following situations:

– Service providers: personal data may be shared with service providers. Companies that offer services such as authentication systems, digital document signature systems, security services, etc. For these suppliers, there are terms of protection and appropriate use of shared information;

– Affiliates: personal data may be shared between affiliates and/or companies in the same group.

– Public or government authorities: data may be shared with public authorities whenever legislation requires or to respond to court orders;

– Business operations: Data may be shared during a corporate operation, such as an asset sale. In these cases, the data subject will be promptly informed of any changes regarding data control.

International data transfer occurs between Casa dos Ventos' commercial partners, only in cases of proven need, limited to personal data essential for negotiation and with the explicit consent of the holder.

Sharing Personal Data

The processing of personal data will be terminated in the following cases:

– When the proposed objective is achieved or when there is no longer a need for personal data;

– When the holder requests the deletion of data;

– In case of legal determination to do so.

After the end of data processing, except in cases provided for by law, personal data will be promptly deleted and Casa dos Ventos' responsibility for them will end.

Deletion of Personal Data

The Casa dos Ventos website may collect cookies and, for this purpose, will request express consent from its users.

Cookies have different functions, in particular they allow easier navigation through pages, remember your preferences and optimize the user experience of visitors. These cookies may be stored on Casa dos Ventos' computer, allowing future access by the same user to be identified.

Before the website activates any cookie on a visiting user's computer, clear and explicit authorization will be requested for the purpose for which the cookie is intended.

From Cookies

Through the Casa dos Ventos website, or by contacting the Casa dos Ventos Manager, any and all holders of personal data or sensitive personal data may request:

– Confirmation and access to data

– Rectification of data that is incomplete, erroneous or outdated

– Restriction of processing of part of your data, indicating which data may be kept by CVER.

– Canceling or deleting data

– Portability and transfer of data from Casa dos Ventos to another controller

– Revocation of your unequivocal consent provided to Casa dos Ventos

– Opposition to any data that does not comply with the law

– Explanation of the data processed by Casa dos Ventos

– Information about all transfers or sharing of data by the Casa dos Ventos Controller

The rights of data holders processed by Casa dos Ventos

The Board of Directors of Casa dos Ventos determines, through this policy, that the Data Protection Officer will always be the Technology Director.

The main functions of the Manager are:

– Inform and guide controller, operator, and other contractors about the obligations and good practices to be adopted in relation to the General Data Protection Law.

– Monitor the implementation of the compliance program and compliance with standards in all data processing activities carried out by Casa dos Ventos, proposing improvements whenever necessary.

– Document all information security measures adopted by Casa dos Ventos, so that, in the event of an incident in data processing, you have elements to demonstrate the good faith and commitment of Casa dos Ventos.

– Report any incidents in the processing of data to the National Data Protection Agency (“ANPD”), cooperating in any inspections and due diligence.

– Implement the recommendations received from the ANPD on adequate data processing.

– Carry out communication between the company and data holders, receiving requests, complaints and deletion of personal data.

From the Data Protection Officer (“DPO”)

This policy must be adopted immediately after approval by the Casa dos Ventos Board of Directors and must be adopted by all employees, collaborators, administrators, partners and third parties.

Any violation of the terms of this Policy must be immediately reported to the Casa dos Ventos Ethics Channel, the Compliance area or the Ethics Committee for appropriate investigations and mitigations.

Final dispositions

According to current legislation, the data subject's rights are:

– Confirmation of the existence of data processing;

– Access to personal data;

– Correction and updating of data;

– Data portability;

– Deletion of data, when they are excessive, unnecessary or treated in non-compliance with the purpose for which they were intended;

– Request for information regarding data sharing;

– Minimization and limitation of use;

– Revocation of Consent, when applicable.

It is worth noting that any request made by the data subject is only met upon proof of the requester's identity. In this way, additional information may be requested from the data requester.
This policy may be changed according to changes in current legislation, technological advances or changes in the services provided by the company. The use of information is linked to the version of the Privacy Policy in force during the period of use of the information.
Requests and/or questions regarding consent or management of personal data can be sent to the email [dpo@casadosventos.com.br](mailto:dpo@casadosventos.com.br) or through the institutional website of House of the Winds.

From Contact

We maintain strict security controls to protect the data of our employees, partners and customers in accordance with the Brazilian General Data Protection Law (LGPD – Law nº 13,709/2018) and the European General Data Protection Regulation (GDPR EU 2016/679) .


Folha Larga Sul

Babilônia Sul

Babilônia Centro

Rio do Vento

Serra do Tigre

Umari

Serra do Tigre

LOCATION

Currais Novos, São Tomé, Lajes Pintadas, Campo Redondo, Coronel Ezequiel, Picuí (RN)

STATUS

Under construction

Our addresses

São Paulo

Av. Brig. Faria Lima, 3477 Torre A - 14º Andar (11) 4084-4200

Our addresses

Social Media

Social Media

Folha Larga Sul

Babilônia Sul

Babilônia Centro

Rio do Vento

Serra do Tigre

Umari

Serra do Tigre

LOCATION

Currais Novos, São Tomé, Lajes Pintadas, Campo Redondo, Coronel Ezequiel, Picuí (RN)

STATUS

Under construction

Our addresses

São Paulo

Av. Brig. Faria Lima, 3477 Torre A - 14º Andar (11) 4084-4200

Our addresses

Social Media

Social Media

Av. Brig. Faria Lima, 3477 Torre A - 14º Andar (11) 4084-4200