Privacy Policy — ML e Filhos Participações

1. Introduction

Ml e Filhos Participações LTDA ("we", "our", or "us"), registered under CNPJ 48.282.427/0001-56, with its registered office at Av. Raja Gabáglia, 2708, Sala 125, 1º Andar, Estoril, Belo Horizonte - MG, 30494-170, is committed to protecting your privacy and personal data.

This Privacy Policy describes how we collect, use, store, and share your personal information in compliance with Brazil's General Data Protection Law (Lei Geral de Proteção de Dados — LGPD, Law No. 13.709/2018) and other applicable regulations. As a holding company managing equity participations in non-financial institutions, we handle corporate, financial, and governance data with the highest standards of confidentiality.

2. Data We Collect

Identification data: full name, CPF/CNPJ, RG, nationality, marital status
Contact data: email address, phone number, physical address
Corporate data: shareholder registries, equity participation records, board and officer appointments, and corporate governance documentation
Financial data: dividend distribution records, capital contribution history, intercompany transactions, and consolidated financial statements of portfolio companies
Due diligence data: target company assessments, financial audits, legal opinions, and valuation reports for M&A transactions
Governance data: board minutes, committee resolutions, voting records, and compliance certifications
Succession planning data: family governance structures, succession protocols, and estate planning documentation
Professional data: advisors, consultants, and service provider credentials and engagement records
Payment data: billing information processed through secure payment systems
Fiscal data: information required for tax compliance, including IRPJ/CSLL, DCTF, and ECF filings
Navigation data: IP address, browser type, cookies, access logs

3. How We Use Your Data

Managing equity participations and exercising shareholder rights in portfolio companies
Administering corporate governance frameworks, board appointments, and compliance protocols
Conducting financial oversight, performance monitoring, and consolidated reporting
Executing due diligence and integration for acquisition and divestiture transactions
Managing family governance, succession planning, and estate coordination
Coordinating with legal, accounting, and financial advisors on corporate matters
Processing intercompany transactions, dividend distributions, and capital allocations
Complying with Junta Comercial corporate registration requirements, Receita Federal tax obligations, and applicable corporate law

4. Legal Basis for Processing

Performance of a contract or preliminary procedures related to a contract
Compliance with legal or regulatory obligations, including corporate and tax law
Legitimate interests of the controller, including corporate governance and asset protection
Consent provided by the data subject

Shareholder registries, equity participation records, dividend distributions, and intercompany financial data are treated with the highest level of confidentiality. These records are accessible only to authorized officers and designated legal and financial advisors under non-disclosure obligations. Due diligence materials, valuation reports, and M&A transaction data are classified as strictly proprietary and are never disclosed to unauthorized parties under any circumstances. Family governance structures, succession protocols, and estate planning documentation receive the most restrictive access controls and are maintained under attorney-client or equivalent professional privilege where applicable.

5. Data Sharing

Portfolio companies for governance execution, board representation, and shareholder rights
Legal counsel for corporate, tax, and compliance advisory under professional privilege
Accounting and audit firms for financial reporting and statutory audits
Junta Comercial for corporate registration and amendment filings
Receita Federal for tax compliance and fiscal reporting
Financial institutions for treasury management and capital operations
Prospective counterparties in M&A transactions, subject to executed non-disclosure agreements
Tax authorities as required by fiscal regulations

We do not sell, rent, or trade personal data to third parties for any purpose. All data sharing with professional advisors is conducted under confidentiality agreements or professional privilege. M&A-related data is shared with counterparties only under executed NDAs and only to the extent necessary for transaction evaluation. All data sharing is conducted in compliance with the LGPD.

6. Data Retention

Personal data will be retained only for as long as necessary to fulfill the purposes described in this policy, or as required by applicable law. Corporate governance records, shareholder registries, and board minutes are retained permanently as required by corporate law and the Código Civil. Financial records and tax filings are retained for the period required by Receita Federal (typically five years from the fiscal year end, or longer if subject to ongoing proceedings). Due diligence materials are retained for the duration of the related investment plus the applicable statute of limitations. Succession planning documentation is retained for the duration of the relevant family governance arrangement. Upon expiration of retention obligations, data will be securely deleted or anonymized.

7. Your Rights

Under the LGPD, you have the following rights:

Confirmation of the existence of data processing
Access to your personal data
Correction of incomplete, inaccurate, or outdated data
Anonymization, blocking, or deletion of unnecessary or excessive data
Portability of data to another service provider
Deletion of data processed with your consent
Information about entities with which your data has been shared
Information about the possibility of denying consent and its consequences
Revocation of consent

Please note that certain corporate records, shareholder data, and financial documentation may be subject to legal retention requirements under corporate and tax law that supersede deletion requests. To exercise any of these rights, please contact us using the information in Section 10.

8. Cookies

Our website may use cookies and similar technologies to enhance your browsing experience. You may configure your browser to refuse cookies; however, some features may not function properly without them.

9. Data Security

We implement rigorous technical and organizational measures to protect all data under our control. Corporate governance records, shareholder data, and financial information are maintained in encrypted systems with multi-factor authentication and role-based access controls. Due diligence and M&A materials are stored in isolated, access-restricted environments. Physical documents are maintained in secure storage with controlled access. All professional advisors and staff with access to holding data are bound by confidentiality agreements. Despite our efforts, no method of electronic transmission or storage is completely secure.

10. Contact Information

ML e Filhos Participações
Ml e Filhos Participações LTDA
CNPJ: 48.282.427/0001-56
Av. Raja Gabáglia, 2708, Sala 125, 1º Andar
Estoril — Belo Horizonte, MG, 30494-170
Brazil

11. Changes to This Policy

We reserve the right to update this Privacy Policy at any time. Any changes will be posted on this page with a revised "Last updated" date.