Governance Policy on Privacy and Personal Data Protection

Last updated: June 10, 2026

MARLUVAS EQUIPAMENTOS DE SEGURANÇA LTDA values the privacy and protection of personal data of all individuals who interact with the company. This Privacy Policy aims to explain, clearly and transparently, how we collect, use, store, share, and protect personal data, as well as to inform data subjects of their rights and how they can exercise them.

1. To Whom This Policy Applies

This policy applies to individuals external to Marluvas who interact with the company: clients, potential clients, suppliers, service providers, sales representatives, candidates, visitors, event participants, website users, and other contacts through physical or digital channels.

2. Important Concepts

Personal data: information related to an identified or identifiable natural person (name, CPF, phone number, email, image, etc.).
Processing: operations involving personal data (collection, storage, use, sharing, deletion, etc.).
Controller: the legal entity responsible for decisions regarding processing — Marluvas acts as the Controller.
Data Subject: the natural person to whom the data refers.
Data Protection Officer (DPO): the communication channel between Marluvas, data subjects, and the National Data Protection Authority.

3. What Personal Data We May Process

We collect only the necessary data according to the relationship with the company and the purpose. Among the categories processed are:

Identification data: name, CPF, RG, CNH, address, signature.
Contact data: email, phone number, address.
Personal characteristics: age, gender, date of birth.
Curriculum data: professional history, education, courses.
Records, images, and videos: surveillance cameras, photos, and marketing materials.
Public data: information from public sources or disclosed by the data subject.

4. Purposes of Processing

Marluvas will use personal data for legitimate and specific purposes, including (among others):

Recruitment, selection, and talent pool management.
Asset security and video monitoring.
Credit analysis and risk assessment.
Supplier relationship management and contract management.
Financial management and accounts receivable.
Loyalty programs and awards.
Fairs, events, and commercial actions.
Scheduling, transportation, and delivery of goods; return of goods.
Landing pages, forms, digital campaigns, and email marketing.
Image bank and marketing materials.

5. Sharing Personal Data

We may share data with third parties and partners when necessary to fulfill the purposes, such as:

Providers of administrative and communication tools;
Marketing and messaging platforms;
Technology infrastructure partners;
Service providers (logistics, payments, events, support);
Public authorities and regulatory bodies, if required by law.

6. International Data Transfer

Some partners may have servers outside of Brazil (especially in the USA). International transfers may occur in accordance with applicable legislation and with appropriate protection measures.

7. Storage Time

Data will be retained for the time necessary for the purposes or for legal, regulatory, or contractual periods. Examples:

Contractual information while the contract is in force and for the necessary period after its termination.
Data for credit analysis for the period necessary for the purpose of the inquiry.
Communications with suppliers maintained as long as necessary for contractual or legal purposes.

At the end of the applicable period, data will be deleted, anonymized, or retained when there is a legal basis for preservation.

8. How We Protect Personal Data

Marluvas adopts technical and organizational measures to protect data against unauthorized access, misuse, loss, alteration, or destruction. Access is restricted to authorized persons, and environments are physically and logically protected.

9. Use of Cookies and Similar Technologies

The website may use cookies to improve navigation, personalize content, measure performance, and support marketing. The user can configure their browser to block or delete cookies — some functionalities may be impacted.

10. Data Subjects' Rights

The data subject may request from Marluvas, in accordance with applicable legislation:

Confirmation of the existence of processing and access to data.
Correction of incomplete, inaccurate, or outdated data.
Anonymization, blocking, or deletion of unnecessary data or data processed in non-compliance.
Data portability, where applicable.
Deletion of data processed based on consent.
Information about entities with which data has been shared.
Withdrawal of consent and objection to processing, where applicable.

To prevent fraud, Marluvas may request proof of identity before fulfilling data subjects' requests.

11. How to Contact Marluvas Regarding Personal Data

In case of questions, exercise of rights, or complaints about data processing, please contact our Data Protection Officer (DPO):

DPO: Genesis Marques LeôncioEmail: dpo@marluvas.com.br

12. Changes to This Privacy Policy

Marluvas may update this Policy periodically to reflect improvements, changes in activities, new legal requirements, or enhancements in data protection practices. We recommend regular review of this page.

Last updated: May 19, 2026