Buttini de Moraes Advogados (ButtiniMoraes) is committed to protecting your privacy and takes all necessary steps to ensure that your personal data is processed in line with industry’s best practices.

This privacy policy (Policy) explains what personal data we collect, use, and share, and the purposes for doing so, providing you with clear and transparent information about how ButtiniMoraes processes your personal data.

1. Policy scope and ButtiniMoraes’ role as a Personal Data Processing Agent.

This Policy applies to personal data processing carried out by ButtiniMoraes in connection with its legal services and the information available on its website. Depending on the type of processing, ButtiniMoraes may act as a Personal Data Controller or Co-Controller alongside the data subject (Data Subject or you) or its legal representative.

Subject to applicable law and based on your relationship with the firm, ButtiniMoraes may process the personal data outlined below:

• Identification, qualification, and contact details: full name; address, date of birth, nationality, and identification document(s) data, such as Identity Card (RG), National Register of Individual Taxpayers (CPF), Driver’s License (CNH), Bar Association Registration (OAB), as applicable, as well as email address, and telephone number;

• Academic and professional information: place of work, occupation, job title, and education.

In delivering legal services, especially in the Tax practice, ButtiniMoraes may need to access and process personal data relating to you or to others involved in each matter (for instance, a counterparty). Depending on the scope and purpose of the engagement, some examples of personal data that may be processed are:

• Registration information: Full name, CPF, RG, address, and telephone number;

• Financial information: remuneration, transaction history, credit, sales, possessions, debt certificates, and loans;

• Information disclosed in court filings: date of birth, nationality, place of birth, age, marital status, country, address, CNH, voter registration, military service details, occupation, education, languages, professional registration, Work Record Booklet (CTPS), and social security workers’ identification registrations, including those with the Social Integration Program Contribution (PIS/PASEP), Social Identification Number (NIS), Worker Identification Number (NIT), and Social Security Specific Registration (CEI).

The personal data listed above is processed only in specific circumstances, when necessary to achieve the purposes outlined in this Policy, particularly for delivering legal services.

ButtiniMoraes may collect this information in multiple ways, including directly from the Data Subject, from individuals or entities associated with the Data Subject (e.g., your company), or from publicly available sources.

2. With whom do we share personal data?

ButtiniMoraes works in partnership with various companies. As a result, we may share information collected through our institutional website in the following circumstances:

• In collaboration with partner companies, to review website usage data and user behavior and produce reports on possible operational improvements;

• To cooperate with authorities and other interested parties in safeguarding ButtiniMoraes’s interests in disputes of any kind, including court cases;

• When required by a court order or upon request from administrative authorities with legal authority to do so.

3. For what purpose do we process personal data?

As a rule, we process your personal data to support our clients and to offer legal services in both advisory and contentious matters.

We may also process your personal data to formalize our engagement with you, as well as for billing and collection purposes, whether you are an individual client or a representative of a corporate client.

We may also process your personal data to maintain our relationship with you by:

• Sharing institutional updates or newsletters on relevant subjects and sending event invitations;

• Managing events, including registration, and sending save-the-date notices, reminders, and follow-up messages. To better support your access and comfort at events hosted by ButtiniMoraes, we may request information about any disabilities or mobility restrictions; and

• Requesting feedback and conducting satisfaction surveys related to our services and initiatives.

From time to time, ButtiniMoraes may provide your personal data to national legal directories so they may contact you to assess and reference our services.

For ButtiniMoraes’s business partners (individuals or representatives of legal entities), we process personal data to set up and manage the partnership. This may involve contract formalization, communication with partners, and compliance with related obligations. Some personal data may be shared with our clients or third parties, but only as needed and to ensure the partnership functions smoothly.

4. How long will we retain personal data?

We will store and retain your information: (i) for the period mandated by law; (ii) until the personal data processing has been completed, as outlined below; (iii) for as long as necessary to uphold ButtiniMoraes’s legitimate interests, where applicable; and (iv) for the duration required to protect ButtiniMoraes’s rights in court, administrative, or arbitration proceedings. This means we may retain your data during the applicable limitation periods or whenever needed to meet legal or regulatory requirements.

Personal data processing will end when:

• The purpose of the collection has been fulfilled and/or the data is no longer needed or pertinent;

• The Data Subject requests the cessation of processing and deletion of the data; and

• The law requires processing to stop.

5. What are your rights over the personal data we process?

You have the following rights over your personal data:

(i) confirmation that processing is taking place;

(ii) access to your data;

(iii) correction of incomplete, inaccurate, or outdated data;

(iv) anonymization, blocking, or deletion of data;

(v) data portability;

(vi) information about data sharing;

(vii) information about the option to withhold consent and the consequences of doing so;

(viii) withdrawal of consent, where applicable; and

(ix) the right to petition the National Data Protection Authority (ANPD).

Certain rights may be restricted under the law. This may occur when sharing information would reveal ButtiniMoraes’s trade secrets, where legal or regulatory duties apply, or when nondisclosure is necessary to ensure ButtiniMoraes’s defense in court or administrative proceedings.

To exercise your rights, please contact us at: contato@buttinimoraes.com.br

6. Collection and use of cookies

ButtiniMoraes uses proprietary essential cookies to monitor, control, and detect vulnerabilities, potential incidents, and information security risks, enabling preventive measures and ensuring a secure environment for clients, partners, suppliers, and other users.

We may also use third-party cookies to help us understand how users browse the site. These cookies do not identify the Data Subject. If identification becomes possible, we will process the data only when there is a legitimate interest and always with due consideration for the Data Subjects’ rights.

7. Third-Party Websites

Our website may contain links to other sites. ButtiniMoraes is not responsible for those sites or their content and does not control or endorse how they collect, use, or share personal data. We encourage you to read the privacy policies of any external site you visit to understand how your personal data is processed.

8. Changes to this Privacy Policy

ButtiniMoraes may change this Policy at any time by publishing the updated version on this page.