OBJECTIVE

Brazilian Nickel (“BRN”) recognizes the importance of protecting personal data and is committed to processing this information in a transparent and secure manner, in compliance with the Brazilian General Data Protection Law (Law No. 13,709/2018 – LGPD).

For this reason, we have prepared this Privacy Notice (“Notice”), which aims to clearly and accessibly explain how your personal data is collected, used, stored, shared, and protected during your relationship with BRN.

In this Notice, you will find information about which personal data may be processed by BRN, the respective purposes, any potential sharing, how long the information may be stored, the technical and organizational measures adopted to protect your data, and your rights as a data subject and how to exercise them.

This Notice may be updated whenever there are changes to our personal data processing activities, changes in applicable legislation, or a need to improve the information provided herein. Whenever this occurs, the most recent version will be made available through BRN’s official channels. For this reason, we recommend consulting this document periodically.

If you have any questions about this Notice or the processing of your personal data, please contact us at dpo@brnickel.com.

SCOPE

This Privacy Notice applies to all users of our website (https://www.braziliannickel.com), our contractors, service providers and suppliers, job applicants, employees’ dependents, and visitors who have a relationship with BRN.

In addition, all BRN employees, service providers, and contractors must comply with this Notice to ensure the security and privacy of personal data throughout all stages of processing.

TERMS AND DEFINITIONS

To facilitate understanding of this Notice, the main concepts used are defined below:

WHAT DATA DO WE PROCESS AND FOR WHAT PURPOSES

If you have applied for a position at Brazilian Nickel, we may process the following data:

WEBSITE USERS

When you browse our website, we may record the activities you perform to improve your user experience, including collecting cookies and access log and IP information.

Regarding cookies, our website uses the following types of cookies:

• Strictly Necessary Cookies (Always active) These are essential to ensure the secure and proper operation of the Brazilian Nickel website. These cookies allow the page to perform basic functions and operate correctly and cannot be disabled in our systems.
• Functionality Cookies These are used to provide a more personalized experience on our website, allowing us to record and remember your choices and preferences (such as your region or language).
• Analytics or Performance Cookies These are used to collect aggregated information about traffic on our website. These cookies help us understand how visitors interact with the page, allowing us to identify which areas are visited most frequently, monitor errors, and improve the overall performance of the Brazilian Nickel website.

You may block the use of cookies at any time by changing your internet browser settings. Your ability to limit cookies will be subject to your browser’s settings and limitations. You may also delete existing cookies through the same browser settings. If you choose to disable cookies, you may continue browsing the website, but some pages may not function properly or may cease to function.

In addition, BRN provides a Transparency Channel through its website. Personal data of reported individuals may be entered into the channel, as may the personal data of a complainant who chooses to identify themselves, with confidentiality of the information ensured. This data is processed for the purpose of investigating ethical and integrity violations involving our employees and business partners.

When using the Contact Us channel, BRN may process the personal data you provide, such as your name, telephone number, and other information included in your message, for the purpose of reviewing, responding to, and following up on your request, as well as maintaining the records necessary for service and relationship management.

CHILDREN AND ADOLESCENTS' DATA

Brazilian Nickel may process personal data of children and adolescents only when strictly necessary for the development of its activities and in compliance with applicable legislation, especially the Brazilian General Data Protection Law. Whenever applicable, processing will be carried out in accordance with the best interests of the child or adolescent and other applicable legal requirements.

Our website is not directed at children or adolescents and does not intentionally collect their personal data. If it is identified that personal data of children or adolescents has been collected inadvertently, Brazilian Nickel will take the appropriate measures to stop the processing and securely delete such information, except where its retention is required by legal or regulatory obligations.

SHARING

Brazilian Nickel may share your personal data whenever such sharing is necessary for the development of its activities, compliance with legal or regulatory obligations, performance of contracts, the exercise of rights, or to meet other circumstances authorized by the Brazilian General Data Protection Law. In such situations, personal data may be shared, as applicable, with:

• a) Public Administration bodies and entities, judicial, administrative, or regulatory authorities, where required by law, by a competent order, or where necessary for the regular exercise of rights;
• b) Financial institutions and companies responsible for processing payments and other financial transactions;
• c) Technology, hosting, cloud storage, corporate systems, IT infrastructure, technical support, and information security providers;
• d) Service providers and business partners that assist BRN in carrying out its activities;
• e) Consultants, auditors, law firms, and other specialized service providers;
• f) Other companies or third parties whenever sharing is necessary for the provision of services, compliance with legal obligations, performance of contracts, or to meet BRN’s legitimate purposes, within the limits of applicable legislation.

In addition, personal data may be accessed by BRN employees and authorized individuals exclusively to the extent necessary to perform their duties and in accordance with the principles of necessity and least privilege.

Whenever third parties process personal data on behalf of BRN, they will act in accordance with the instructions provided by the company and will be subject to contractual obligations regarding confidentiality, information security, and personal data protection, as well as compliance with the LGPD and other applicable regulations.

BRN adopts appropriate technical, administrative, and organizational measures to ensure that all sharing of personal data occurs securely, following adequate standards of protection against unauthorized access, loss, alteration, disclosure, or any improper or unlawful processing.

Brazilian Nickel does not commercialize, sell, or exchange personal data. All sharing occurs only when necessary to fulfill the purposes described in this Notice or under other circumstances authorized by applicable legislation.

PERSONAL DATA RETENTION PERIOD

Brazilian Nickel will retain personal data only for as long as necessary to fulfill the purposes for which it was collected, observing the principles of necessity and minimization established by the Brazilian General Data Protection Law (LGPD).

Where applicable, personal data may be retained for longer periods whenever necessary to comply with legal or regulatory obligations, exercise rights in judicial, administrative, or arbitration proceedings, or meet other retention circumstances authorized by applicable legislation.

Once the applicable retention period has ended and there is no legal basis justifying continued retention of the personal data, it will be securely deleted or anonymized, except where otherwise provided by applicable legislation.

INTERNATIONAL TRANSFERS

In certain circumstances, Brazilian Nickel may transfer personal data internationally, including when using technology services, cloud storage, corporate systems, or service providers located outside Brazil or that process data outside Brazilian territory.

Whenever personal data is transferred internationally, Brazilian Nickel will adopt the measures necessary to ensure that the processing complies with the LGPD, particularly Articles 33 and following, as well as the mechanisms and requirements established by the ANPD, ensuring an adequate level of protection for personal data and respect for data subjects’ rights.

SECURITY MEASURES

Brazilian Nickel adopts appropriate technical, administrative, and organizational measures to protect personal data against unauthorized access, destruction, loss, alteration, disclosure, or any improper, unlawful, or accidental processing. The security measures adopted include:

• Strict Encryption in Transit (HSTS): Use of the Strict-Transport Security header to ensure that all connections are made exclusively through secure HTTPS, preventing data interception;
• Protection Against Cloning and Clickjacking: Implementation of the X-Frame Options (DENY) directive, which prevents the website from being maliciously embedded within other pages;
• Code Injection Prevention (XSS): Active implementation of X-XSS-Protection policies and mitigation through Content-Security-Policy (CSP);
• Logical Access Control Mechanisms: Strictly based on the principle of least privilege, in addition to antivirus tools and managed firewalls;
• Business Continuity and Monitoring Policies: Periodic backup routines and active management of information security incidents.

Although reasonable efforts are made to protect personal data, no security system is completely infallible. For this reason, Brazilian Nickel continuously monitors its processes and seeks to adopt applicable best practices to reduce risks and strengthen the protection of the information it processes.

YOUR RIGHTS AS A DATA SUBJECT

You, as a data subject, may exercise the following rights at any time:

• Confirmation of Processing and Access to Personal Data

  You may request that BRN confirm whether it processes your personal data and inform you which personal data it holds about you. BRN will provide the categories of personal data and how long the personal data will be stored.

• Data Portability to Another Service or Product Provider

  Where applicable, you may request that BRN transmit the personal data it holds about you to another data controller, ensuring that the data is transmitted with an appropriate level of security, subject to BRN’s commercial and industrial secrets.

• Information About Entities with Which BRN Has Shared or Shares Data

  You may request that BRN provide information regarding the sharing of your personal data with third parties.

• Correction of Incomplete, Inaccurate, or Outdated Data

  If you find that your personal data is incomplete, inaccurate, or outdated, you may request that BRN correct or supplement it.

• Information About the Possibility of Withholding Consent

  If BRN requests your consent for a specific processing activity, you may ask BRN to clarify whether the activity can be carried out without your consent or what the consequences of not providing consent would be in that case.

• Anonymization, Blocking, or Deletion of Unnecessary, Excessive, or Illegally Processed Data

  If any personal data is processed unnecessarily, excessively for its intended purpose, or in violation of the LGPD, you may request that BRN anonymize, block, or delete such data, provided that the excess, lack of necessity, or legal non-compliance is effectively established.

• Withdrawal of Consent

  You may request withdrawal of the consent you have provided for the processing of your data at any time. BRN will contact and communicate with other organizations where the data subject’s personal data is being processed in order to stop the processing in accordance with the data subject’s request. Please note that withdrawal of consent may result in the termination of services provided, but does not prevent the use of anonymized data or data whose processing is based on another legal basis provided for under the LGPD.

• Complaint to the ANPD

  You may file a complaint with the ANPD regarding your personal data. You may also contact us at any time through one of the channels indicated at the end of this section. We will be available to assist you with your request.

• Deletion of Personal Data

  If you have provided consent for the processing of your personal data for specific purposes (and purposes that are not necessary for the provision of our services or delivery of our products), you may request the deletion of such personal data. Please note that where personal data is retained or stored due to circumstances such as a legal or regulatory obligation, it may be retained or stored regardless of the data subject’s consent.

• Objection to Irregular Processing

  You may object to the processing of your personal data if it is determined that the processing is irregular. BRN will take appropriate measures without undue delay in the event of a challenge to the processing of data, in whole or in part.

• Review of Automated Decisions

  You may challenge decisions made solely on the basis of personal data processed by automated means that affect your interests, such as decisions intended to determine your personal, professional, consumer, or credit profile or aspects of your personality, and you may request information about the criteria and procedures used for the automated decision, subject to commercial and industrial secrets.

Please note: Your rights are not absolute and do not always apply in every situation, but we will always do everything we can to uphold your rights under applicable data protection laws. If your request is denied, we will explain the reasons why we are unable to fulfill it.

Brazilian Nickel may update this Privacy Notice at any time to reflect changes in its personal data processing activities, changes in applicable legislation, or improvements to its privacy and data protection practices.

We recommend consulting this Notice periodically so that you remain informed about how we process your data.