LLK – External Privacy Policy

LLK, a private law legal entity, takes your privacy seriously and ensures the security and protection of data of all its customers, partners, suppliers and users of the domain website and any other website, store or application operated by the retailer.

This Privacy Policy is intended to inform you about how we use and disclose information collected during your visits to our store and in messages we exchange with you.

This Privacy Policy applies only to information collected through the store.

BY ACCESSING THE STORE, SENDING COMMUNICATIONS OR PROVIDING ANY TYPE OF PERSONAL DATA, YOU DECLARE THAT YOU ARE AWARE OF THE TERMS SET FORTH HEREIN AND IN ACCORDANCE WITH THE PRIVACY POLICY, WHICH DESCRIBES THE PURPOSES AND FORMS OF PROCESSING YOUR PERSONAL DATA THAT YOU PROVIDE IN THE STORE.

This Privacy Policy provides an overview of our privacy practices and the choices you can make, as well as the rights you can exercise regarding the Personal Data we process. If you have any questions about our use of Personal Data, please contact us at [email protected].

Additionally, this Privacy Policy does not apply to any third-party applications, products, services, websites or social media features that may be offered or accessed through the Store. Accessing these links will cause you to leave our Site and may result in the collection or sharing of information about you by third parties. We do not control, endorse, or make any representations about third-party websites or their privacy practices, which may differ from ours. We encourage you to review the privacy policy of any website you interact with before allowing the collection and use of your Personal Data.

If you send us Personal Data relating to other individuals, you represent that you have the authority to do so and that you have obtained the necessary consent to authorize the use of such information under the terms of this Privacy Policy.

Section 1 – Definitions

For the purposes of this Privacy Policy:

  1. Personal Data“: means any information that, directly or indirectly, identifies or may identify a natural person, such as name, CPF, date of birth, IP address, among others;
  2. Sensitive Personal Data“: means any information that reveals, in relation to a natural person, racial or ethnic origin, religious belief, political opinion, membership of a trade union or organization of a religious, philosophical or political nature, data relating to health or sexual life, genetic or biometric data;
  3. Processing of Personal Data“: means any operation carried out on Personal Data, whether or not by automatic means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or, alternatively, making available, harmonization or combination, restriction, erasure or destruction. Any other operation provided for under the applicable legislation is also considered Processing of Personal Data;
  4. Data Protection Laws“: means all legal provisions that regulate the Processing of Personal Data, including, but not limited to, Law No. 13,709/18, General Law on the Protection of Personal Data (“LGPD“).

Section 2 – Use of Personal Data

We collect and use Personal Data to manage your relationship with us and to better serve you when you are purchasing products and/or services in the store, by personalizing and improving your experience. Examples of how we use data include:

  1. Enable you to purchase products and/or services in the store;
  2. To confirm or correct information we hold about you;
  3. To send you information we believe may be of interest to you;
  4. To personalize your experience using the store;
  5. To contact you at a telephone number and/or email address you have provided. We may contact you in person, by voice message, through automatic dialing equipment, by text message (SMS), by email, or by any other means of communication that your device is capable of receiving, as permitted by law and for reasonable business purposes.

In addition, the Personal Data provided may also be used in any way we deem necessary or appropriate: (the) under Data Protection Laws; (b) to meet the requirements of legal proceedings; (w) to comply with a court order, regulatory decision or decision of competent authorities, including authorities outside the country of residence; (d) to enforce our Terms and Conditions of Use; (and) to protect our operations; (f) to protect our, your or third parties’ rights, privacy, safety; (g) to detect and prevent fraud; (h) allow us to pursue available remedies or limit the damages that we may sustain; and (i) as otherwise permitted by law.

Section 3 – Failure to provide Personal Data

There is no obligation to share the Personal Data we request. However, if you choose not to share it, in some cases we may not be able to provide you with full access to the store, some specialized features or be able to provide you with the necessary assistance or, even, facilitate the delivery of the product or provide the service contracted by you.

Section 4 – Data collected

The general public may browse the store without the need to register or send Personal Data. However, some of the store's features may depend on registration and sending Personal Data, such as completing the purchase/contracting of the service and/or enabling the delivery of the product/provision of the service by us.

When contacting the store, we can collect:

  1. Contact details: first name, last name, telephone number, address, city, state and email address;
  2. Information sent: information you send via form (questions, complaints, suggestions, criticisms, compliments, etc.).

In general browsing of the store, we may collect:

  1. Location data: geolocation data when you access the store;
  2. Preferences: information about your preferences and interests in relation to products/services (when you tell us what they are or when we infer them from what we know about you);
  3. Store navigation data: information about your visits and activities, including the content (and any advertisements) you view and interact with, information about the browser and device you are using, your IP address, your location, the address of the website from which you arrived. Some of this information is collected using our Automatic Data Collection Tools, which include cookies, web beacons and embedded web links. To learn more, please read how we use Automatic Data Collection Tools in section 7 below;
  4. Anonymous or aggregated data: anonymous responses to surveys or anonymous, aggregated information about how the store is used. During our operations, in certain cases, we apply a de-identification or pseudonymisation process to your data so that it is reasonably unlikely that you will be identified through the use of that data with available technology;
  5. Other information we may collect: information that does not specifically reveal your identity or that does not directly relate to an individual, such as browser and device information; Store usage data; and information collected through cookies, pixel tags, and other technologies.

We do not collect Sensitive Personal Data.

Section 5 – Sharing Personal Data with Third Parties

We may share your Personal Data:

  1. With the partner company(ies) you select or choose to send your data, questions, inquiries, etc., as well as with service providers or partners to manage or support certain aspects of our business operations on our behalf. These service providers or partners may be located in the United States, Argentina, Brazil, or other global locations, including servers for certification and production, and providers of hosting and data storage services, fraud management, customer support, sales on our behalf, order fulfillment, content personalization, advertising and marketing activities (including digital and personalized advertising), and IT services, for example;
  2. With third parties, for the purpose of helping us manage the store;
  3. With third parties in the event of any reorganization, merger, sale, joint venture, assignment, conveyance or transfer of all or any portion of our business, assets or capital (including in connection with bankruptcy or similar proceedings).

Section 6 – International data transfers

Personal Data and other information collected by us may be transferred to or accessed by entities belonging to the corporate group of partner companies worldwide in accordance with this Privacy Policy.

Section 7 – Automatic Collection of Personal Data

When you visit a store, it may store or retrieve information on your browser, mostly in the form of cookies, which are text files containing small amounts of information. This information might be about you, your preferences or your device and is mostly used to make the store work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience.

In accordance with this Privacy Policy, we and our third-party service providers, with your consent, may collect your Personal Data in a variety of ways, including, but not limited to:

  1. Via browser or device: Some information is collected by most web browsers or automatically through your internet access devices, such as the type of computer, screen resolution, operating system name and version, device manufacturer and model, language, and the type and version of the internet browser you are using. We may use this information to ensure that the store functions properly.
  2. Use of cookies: Information about your use of the store may be collected by third parties through cookies. Cookies are information stored directly on the computer you are using. Cookies allow the collection of information such as browser type, time spent in the store, pages visited, language preferences, and other anonymous traffic data. We and our service providers use information for security purposes, to facilitate navigation, display information more efficiently, and personalize your experience using the store, as well as for online tracking. We also collect statistical information about store usage to continually improve our design and functionality, to understand how the store is used, and to assist you in resolving store-related issues. If you do not wish for your information to be collected through cookies, there is a simple procedure in most browsers that allows cookies to be automatically rejected, or gives you the option to accept or reject the transfer of a specific cookie (or cookies) from a given website to your computer. However, this may cause inconvenience in using the store.

    The settings you choose may affect your browsing experience and the operation that requires the use of cookies. In this sense, we decline any responsibility for the consequences resulting from the limited operation of the store caused by the deactivation of cookies on your device (inability to set or read a cookie).

  3. Use of pixel tags and other similar technologies: Pixel tags (also known as web beacons and clear GIFs) may be used to track the actions of users of the store (including email recipients), measure the success of our marketing campaigns, and collect statistics about store usage and response rates, and for other unspecified purposes. We may employ behavioral advertising companies to report on store advertising across the Internet. To do this, these companies use cookies, pixel tags, and other technologies to collect information about your use, or the use of other users, of our store and third-party websites. We are not responsible for pixel tags, cookies, and other similar technologies used by third parties.

Section 8 – Cookie Categories

The cookies used in our store comply with legal requirements and fall into the following categories:

  1. Strictly necessary: These cookies allow you to browse the website and enjoy essential features safely. One example is security cookies, which authenticate users, protect their data and prevent the creation of fraudulent logins.
  2. Performance: Cookies in this category collect information in an encoded and anonymous form related to our online store, such as the number of visitors to a specific page, the origin of visits to the website and which pages the user accessed. All data collected is used only for possible improvements to the website and to measure the effectiveness of our communication.
  3. Functionality: These cookies are used to remember user preference settings in order to improve your visit to our website, such as, for example, settings applied to the website layout or your responses to promotion and registration pop-ups -; this way, it will not be necessary to ask numerous times.
  4. Advertising: We use cookies to create targeted campaigns and deliver ads based on your consumption profile in our online store.

Section 9 – User Rights

You may, at any time, request: (i) confirmation that your Personal Data is being processed; (ii) access to your Personal Data; (iii) corrections to incomplete, inaccurate or outdated data; (iv) anonymization, blocking or deletion of unnecessary, excessive data or data processed in non-compliance with the provisions of the law; (v) portability of Personal Data to another service provider, as long as this does not affect our industrial and commercial secrets; (vi) deletion of Personal Data processed with your consent, to the extent permitted by law; (vii) information about the entities with which your Personal Data has been shared; (viii) information about the possibility of not providing consent and the consequences of refusal; and (ix) revocation of consent. Your requests will be handled with special care so that we can ensure the effectiveness of your rights. You may be asked to provide proof of your identity in order to ensure that the Personal Data is only shared with the data subject.

You should bear in mind that in certain cases (for example, due to legal requirements) your order may not be immediately fulfilled, and we may not be able to fulfill it due to compliance with legal obligations.

Section 10 – Personal Data Security

We seek to adopt appropriate technical and organizational measures provided for by Data Protection Laws to protect Personal Data within our organization. Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure (for example, if you believe that the security of any of your accounts has been compromised), please notify us immediately.

Section 11 – Hypertext links to other websites and social networks

The Store may, from time to time, contain hypertext links that will redirect you to websites of our partners' networks, advertisers, suppliers, etc. If you click on one of these links to any of these sites, please remember that each site has its own privacy practices and that we are not responsible for these policies. Please review these policies before submitting any Personal Data to these sites.

We are not responsible for the collection, use, and disclosure policies and practices (including data protection practices) of other organizations, such as Facebook, Apple, Google, Microsoft, or any other software developer or application provider, social media store, operating system, wireless service provider, or device manufacturer, including any Personal Data that you disclose to other organizations through the Applications, in connection with such Applications, or posted on our social media pages. We encourage you to read the privacy policy of each website you visit or service provider you use.

Section 12 – Updates to this Privacy Policy

If we modify our Privacy Policy, we will post the new text on the store with an updated revision date. We may modify this Privacy Policy at any time. If there is a material change to the terms of this Privacy Policy, we may notify you through the contact information we have in our database or through a notification on our store.

We remind you that we are committed to not processing your Personal Data in a manner incompatible with the purposes described above, unless otherwise required by law or court order.

Your use of the store after the changes are made means that you accept the revised Privacy Policies. If, after reading the revised version, you do not agree with its terms, please end your access to the store.

Section 13 – Controller of Personal Data

If you wish to exercise any of the rights provided for, including withdrawing your consent, in this Privacy Policy and/or in the Data Protection Laws, or resolve any queries related to the Processing of your Personal Data, please contact us at [email protected].

EXTERNAL PERSONAL DATA PROTECTION POLICY

LLK ENGINEERING AND INNOVATION

Last updated June 17, 2025.

1. Purpose and scope of this Data Protection Policy

1.1. LLK Engenharia e Inovação is concerned with complying with applicable laws and regulations related to Personal Data Protection in Brazil, and in other countries in which it may operate.

1.2. This Privacy Policy indicates the manner in which LLK ENGINEERING INDUSTRY TRADE AND REPRESENTATIONS LTDA., a private law legal entity, registered with the CNPJ under no. 10,521,728/0001-12, with headquarters at Rua Professor José Viera de Mendonça, no. 770, Room 501A, Bairro Engenho Nogueira, in Belo Horizonte/MG, CEP 31,310-260, hereinafter referred to as “LLK”, carries out the Processing of Personal Data of representatives of its customers, suppliers, employees and other individuals with whom it has a relationship, being applicable to all of them.

1.3. If you have any questions or concerns regarding how we process your Data, please contact us by email at [email protected].

2. Definitions of terms used in this Privacy Policy

2.1. The following definitions of the terms used in this Privacy Policy are taken from Article 5 of the General Data Protection Law (“LGPD”):

2.1.1. “Data Subject” or “Holder”: any natural person, holder of Personal Data or Sensitive Personal Data, who in any way relates to LLK;

2.1.2. “Personal Data”: information relating to the Data Subject, which identifies him or her or which, if combined with other information, makes him or her identifiable;

2.1.3. “Sensitive Personal Data”: information relating to the Data Subject about racial or ethnic origin, religious belief, political opinion, membership of a trade union or organization of a religious, philosophical or political nature, data relating to health or sexual life, genetic or biometric data;

2.1.4. “Data”: term used to indicate, jointly, Personal Data, Sensitive Personal Data and Public Data;

2.1.5. “Minors”: Data Subject who is considered a child or adolescent by the Child and Adolescent Statute, whose Personal Data and/or Sensitive Personal Data are Processed;

2.1.6. “Purpose”: reason(s) why the Parties process Personal Data and Sensitive Personal Data;

2.1.7. “Legal Basis”: legal basis, under the terms of the LGPD, which gives the Parties permission to Process Data;

2.1.8. “Controller”: data processing agent responsible for decisions regarding the Processing of Personal Data;

2.1.9. “Operator”: data processing agent that carries out the processing of personal data on behalf of the Controller;

2.1.10. “Data Processing” or “Treatment”: all operations carried out with Personal Data and Sensitive Personal Data, which includes the collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, elimination, evaluation or control of information, modification, communication, transfer, dissemination or extraction;

2.1.11. “LGPD”: Law 13,709, of August 14, 2018 or General Data Protection Law;

2.1.12. “ANPD”: National Data Protection Authority, a public administration body created by the LGPD, responsible for ensuring, implementing and monitoring compliance with the law throughout Brazilian territory.

2.1.13. “Public Data”: Personal Data and Sensitive Personal Data whose access is public, or which have been made manifestly public by the Holder, and which must be Processed considering the terms of § 4 of article 7 of the LGPD.

3. Data Collection by LLK

3.1. All data collected or requested by LLK is necessary and appropriate for the offering, provision and development of its services, as well as for the internal management of its employees and suppliers.

3.2. Thus, LLK collects Data in the following ways:

3.2.1. When the Holder, as a company representative, contacts LLK expressing interest in contracting LLK products and services for the company they represent;

3.2.2. When LLK locates, in public databases, the Holder's contact channels, as a representative of a company that may be interested in contracting the products and services offered by LLK;

3.2.3. When the Holder is appointed, by the company he represents, to conduct the contractual relationship with LLK;

3.2.4. When the Holder sends his/her CV to LLK via social media, email or other communication channels;

3.2.5. When the Holder becomes part of LLK’s staff, whether as an employee, intern or service provider;

3.2.6. When the Holder, as a supplier representative, establishes contact or a contractual relationship with LLK;

3.2.7 When the Holder, as a representative of a commercial partner, establishes contact or a contractual relationship with LLK.

4. Data Collected by LLK

4.1. Considering the forms of Data collection set out in Clause 3 above, LLK may collect the following Data:

4.1.1. Personal identification data, such as full name, email, telephone number, ID, CPF, CTPS, CNH, gender, address, professional address, profession, position, education, date of birth;

4.1.2. Financial data, such as bank account number, branch number, bank number and payment details;

4.1.3. Contact information, such as telephone, email, social media profile;

4.1.4. Image and voice data, such as video, image or voice records and recordings;

4.1.5. Authentication data, as a physical or digital signature;

4.1.6. Data necessary to comply with labor and regulatory obligations, such as the results of periodic occupational safety examinations, certificates, proof of course completion and number of dependents.

4.2. Some of the Data Processed by GCA may be considered Sensitive Personal Data by the LGPD (article 5, II, LGPD), however, they are necessary and essential to provide guarantee and legal security to the services offered by GCA.

5. Purpose and Legal Basis for Data Processing by Shopping Cidade

5.1. LLK processes Data for the following Purposes, authorized by the respective Legal Bases:

5.1.1. Purpose: Active prospecting of new customers. Legal Basis: Legitimate Interest (article 7, IX, LGPD);

5.1.2. Purpose: Assistance to representatives of companies that contacted LLK and showed interest in contracting the products and services offered. Legal Basis: Preliminary procedures for the execution of the contract (article 7, V, LGPD);

5.1.3. Purpose: Implementation and monitoring of services previously contracted by a company of which the holder is a representative. Legal Basis: Execution of the Contract (article 7, V, LGPD);

5.1.4. Purpose: Conducting satisfaction surveys. Legal Basis: Consent (article 7, I, LGPD);

5.1.5. Purpose: Sending institutional communications and carrying out marketing actions with clients. Legal Basis: Legitimate Interest (article 7, IX, LGPD);

5.1.6. Purpose: Carrying out the selection process for new employees. Legal Basis: Consent (article 7, I, LGPD);

5.1.7 Purpose: Admission and regularization of new employees in the LLK staff. Legal Basis: Compliance with legal or regulatory obligation (article 7, II, LGPD);

5.1.8 Purpose: Supporting employees throughout their journey at LLK. Legal Basis: Compliance with legal or regulatory obligations (article 7, II, LGPD) or Execution of the Contract (article 7, V, LGPD) – depending on the type of relationship established with the employee.

5.1.9. Purpose: Selection, monitoring and management of suppliers and business partners. Legal Basis: Execution of the Contract (article 7, V, LGPD).

5.2. The consent given by the Data Subject to LLK is made in accordance with the provisions of the LGPD, provided by means that demonstrate the manifestation of the Data Subject's will, being collected in a clear and highlighted manner, for the specific purposes mentioned in this Personal Data Protection Policy and informed to the Data Subject at the time of consent.

5.3. LLK may carry out Data Processing, especially in storage and archiving operations, in order to comply with legal or regulatory obligations (article 7, II, LGPD), or even in order to guarantee the regular exercise of its rights in judicial, administrative or arbitration proceedings (article 7, VI, LGPD).

5.5 LLK may process Personal Data of children and adolescents, observing the best interests of the minor, in accordance with article 14 of the General Personal Data Protection Law (LGPD), the Statute of Children and Adolescents and other applicable regulations, adopting the appropriate legal basis as the case may be.

6. Storage, retention and deletion of data by LLK

6.1. The Data Processed by LLK are stored only for the period necessary to fulfill their respective purposes, and, if applicable, to comply with legal or regulatory obligations, to guarantee the regular exercise of their rights in judicial, administrative or arbitration proceedings, as well as for the purposes of providing accounts or requests from competent authorities or public bodies.

6.2. Once the terms set out in item 6.1 have been exceeded, if applicable, the Data will be deleted by LLK.

6.3. Data collected through consent will be deleted when requested by the Data Subject, unless there is a legal obligation to retain such Data, if they are still necessary for the provision of services by LLK, or if they are necessary to guarantee the regular exercise of LLK's rights in judicial, administrative or arbitration proceedings.

7. Data Sharing by Shopping Cidade

7.1. LLK may share Data with third parties, within or outside Brazil, in the following cases:

7.1.1. Enable and improve the provision of services and supply of products by LLK with the support of suppliers;

7.1.2. Respond to judicial, administrative or arbitration requests, as well as claim LLK's rights in or out of court;

7.1.5. Allow for legal audits and independent audits.

7.2. In all cases, LLK undertakes to share only essential, necessary and adequate Data to fulfill the respective purposes.

7.3. When Data is processed through consent, LLK undertakes to request the Data Subject's consent if it shares such Data with third parties.

8. International Data Transfer by LLK

8.1. LLK may transfer Data to another country, but only when it ensures that these operations meet security standards and are in compliance with international legislation and the LGPD.

8.2. LLK may use third-party services that have technological infrastructure established outside of Brazil, such as servers and cloud services. In this case, we seek to hire third parties that meet security standards and comply with Brazilian and international legislation.

9. Data Subject Rights

9.1. In compliance with the terms and principles established in the LGPD, LLK guarantees the Data Subject the exercise of the following rights:

9.1.1. Confirmation the existence of Data Processing carried out by LLK;

9.1.2. Access to Data Processed by LLK;

9.1.3. Correction of the Data Processed by LLK and that are incomplete, inaccurate or out of date;

9.1.4. Anonymization, blockade or elimination Data that is unnecessary, excessive, or processed in non-compliance with the provisions of the LGPD;

9.1.5. Portability of the Data to another service or product provider, upon express request;

9.1.6. Elimination of Data processed with the consent of the Holder, except if the hypotheses contained in article 16 of the LGPD are configured;

9.1.7. Obtaining information about the public or private entities with which LLK shared the Data;

9.1.8. Information about the possibility of the Holder not providing consent and the consequences of this, if the answer is negative;

9.1.9. Revocation of consent previously given;

9.2. The Data Subject may request LLK to comply with any of their rights listed above through the functionality of the following electronic address: [email protected]

9.3. LLK makes every effort to respond to Data Subjects' requests as quickly as possible, always complying with applicable legal deadlines. However, Data Subjects must allow a reasonable period of time between submitting the request and receiving a response, especially considering the complexity of their request.

9.4. The Holder must understand that compliance with some of the requests by LLK may have consequences that may not be desired by the Holder, such as, for example, preventing the continued provision of a certain service or the supply of a certain product.

9.5. When LLK is acting as controller, the data controller (DPO) must take the necessary measures to inform third parties that may process such Data as operators to comply with any request for deletion of the Data.

10. Data Protection and Security

10.1. LLK takes all reasonable and necessary technical and organizational measures to ensure the protection and security of the Data it processes.

10.2. LLK stores all Processed Data in its own files and servers or those contracted by it, always considering the level of security.

10.3. LLK makes every effort to preserve the privacy of Data Subjects' data. However, it is important to emphasize that no structure is completely secure enough to fully guarantee data security and completely prevent unauthorized access to such data. Therefore, Data Subjects must also take appropriate measures to protect their information.

11. Cookies

11.1. To ensure that the holder has a pleasant experience while visiting the LLK website, cookies and/or other similar tracking technologies are used that automatically or passively collect some information about the Holder and their activity, as is done by most websites.

11.2. Data collected through cookies is processed in accordance with the provisions of this Personal Data Protection Policy.

12. Updates to the Privacy Policy

12.1. LLK reserves the right, at its sole discretion and convenience, to change or update this Policy at any time, and LLK will notify of each update on the LLK website.

13. Data Protection Officer

13.1. LLK has a data protection officer, who acts as a communication channel between LLK (both when occupying the position of controller and when occupying the position of operator), Data Subjects and the National Data Protection Authority.

13.2. The role of LLK's Data Protection Officer (DPO) is performed by the employee Luiza Farias Santos Motta, whose email address is [email protected].

14. General Provisions

14.1. This Data Protection Policy shall be governed by and construed in accordance with the legislation of the Federative Republic of Brazil, in particular Law No. 13,709 of August 14, 2018, the LGPD, regardless of the laws of other states or countries.

14.2. If the Data Subject has any questions, or would like more information about the Policy, they should send an email to [email protected].

14.3. In the event of any conflicts between this Privacy Policy and the information provided by the email service indicated above, the provisions contained in this Personal Data Protection Policy will prevail.

Belo Horizonte/MG, June 17, 2025.

Version 1.0 – Approved on June 20, 2025.