This Privacy Policy applies to Users who:

• are registered on our Platform;

• access and use our Platform; and

• use our App.

The processing of personal data (or simply "processing") means any operation performed on personal data, including, for example:

• collection of your personal data;

• processing;

• storage;

• deletion;

• transfer.

Personal data is any information relating to an identified or identifiable natural person. Any information relating to you as a User of the Platform constitutes personal data.

For the purposes of this Policy, Elefante Letrado acts as the Data Processor of your personal data, in accordance with applicable law and as described in this Policy.

Important: You are not required to provide us with your personal information. However, if you choose not to provide certain information when requested, you may not be able to access some of the Platform's features.

In addition to the information you provide directly, whenever you interact with the Platform or the App, certain information is collected automatically. Such information is generally not capable of identifying you on its own. However, if combined with other information that makes it possible to identify you, Elefante Letrado will treat it as personal data.

To the extent permitted by applicable law, Elefante Letrado may process the following personal data provided by you:

To the extent permitted by applicable law, Elefante Letrado may process the following sensitive personal data provided by you:

Please note that the personal data listed above will only be collected and processed by Elefante Letrado to the extent necessary to fulfill the purposes described in this Policy.

We do not intentionally collect, store, or otherwise process personal data that is excessive or unnecessary for the purposes for which it was collected. Therefore, we ask that you refrain from sharing such information with us. If we become aware that such data has been inadvertently collected and processed, it will be deleted from our records.

The legal basis applicable to the personal data stored and processed by Elefante Letrado, as described above, is determined based on the specific context in which the data is collected.

Personal data processed by Elefante Letrado is generally collected only when:

• Article 7, I of Law No. 13,709 (LGPD): With your consent.

• Article 7, II of Law No. 13,709 (LGPD): To comply with a legal or regulatory obligation.

• Article 7, V of Law No. 13,709 (LGPD): When necessary for the performance of a contract or preliminary procedures related to a contract.

Whenever necessary to achieve the purposes described in Section 2, Elefante Letrado may share your personal data with the third parties listed below in order to properly provide its services, ensure the secure storage of your personal data, and improve your experience with Elefante Letrado.

Whenever personal data is shared, such sharing will occur only within the limits and purposes of our business activities, in accordance with the purposes for which the personal data is processed and as authorized by applicable law.

Accordingly, your personal data may be shared with:

Subject to the applicable laws and regulations, you, as the data subject, may contact us to exercise your rights, including requesting:

You may submit your request free of charge by emailing privacidade@elefanteletrado.com.br.

We will review your request and respond as promptly as possible, in accordance with the deadlines and requirements established by applicable law. If we cannot fulfill your request immediately, we will provide the factual and legal reasons preventing us from doing so.

Elefante Letrado is not responsible for the accuracy, truthfulness, authenticity, completeness, or timeliness of the information provided by the Data Subject. It is the sole responsibility of the Data Subject to provide accurate, truthful, authentic, complete, and up-to-date information.

Elefante Letrado implements appropriate technical and organizational security measures to safeguard all stored personal data. These measures include internal policies, confidentiality obligations, and strict access controls, ensuring that our personnel have access only to the personal data necessary to perform their specific duties, as described in Section 2.

With respect to the personal data collected through our Platform and App, such data is stored, processed, and protected in accordance with industry best practices for hosting and data processing.

Nevertheless, you acknowledge that no internet-based security system can be guaranteed to be completely secure against unauthorized access. Accordingly, Elefante Letrado's commitment is limited to implementing security measures that are considered appropriate and consistent with current industry standards.

Elefante Letrado will transfer your personal data to other countries or international organizations only when strictly necessary to fulfill the purposes for which your personal data was collected, giving preference, whenever possible, to storage on servers located within the Federative Republic of Brazil.

Whenever your personal data is transferred outside Brazil, Elefante Letrado will implement appropriate safeguards to ensure an adequate level of protection in accordance with applicable data protection laws, including, where necessary, entering into appropriate data transfer agreements with third parties.

Accordingly, please be informed that your personal data may be shared with and stored on the following internationally located servers:

10.1. EUROPEAN UNION – GDPR

If you are subject to the European Union General Data Protection Regulation (GDPR), the provisions of this section apply to you in addition to the remainder of this Privacy Policy.

10.1.1. Legal Bases for Processing Personal Data Under the GDPR

For the purposes of the GDPR, Elefante Letrado acts as the Data Controller of the Personal Data processed under the jurisdiction of the European Union.

Accordingly, your Personal Data is processed only under circumstances authorized by the GDPR and based on the legal basis that is most appropriate for the specific purpose of the processing.

10.1.2. International Data Transfers

To facilitate our global operations, Elefante Letrado may transfer and store your Personal Data in the Federative Republic of Brazil. Because Brazilian law differs from the data protection laws applicable in your country of residence, Elefante Letrado implements safeguards required under the GDPR, including the use of Standard Contractual Clauses (SCCs) where applicable.

Our Platform is hosted on Amazon Web Services (AWS), with servers located in West Virginia, United States, which provides a high level of security for the processing of personal data.

If you would like additional information regarding AWS's processing of your personal data, please refer to:

https://d1.awsstatic.com/legal/privacypolicy/AWS_Privacy_Notice_Portuguese_2023-09-22.pdf

Elefante Letrado adopts technical and organizational measures to protect all stored personal data through internal procedures, confidentiality obligations, and strict access controls, ensuring that our personnel have access only to the data necessary to perform their specific duties. Personal data collected through our Platform is stored, processed, and protected in accordance with industry best practices for hosting and data processing.

In the event of any inconsistency between this section and the remainder of this Privacy Policy, the provisions of this section shall prevail.

10.2. UNITED STATES

The United States has multiple state-level laws governing privacy and data protection but does not currently have a comprehensive federal law regulating the collection and use of personal data nationwide.

Accordingly, the principal laws considered by Elefante Letrado when processing personal data in the United States include:

• Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM Act): governing unsolicited commercial email communications.

• Children's Online Privacy Protection Act (COPPA): governing the collection of personal information from children under 13 years of age by operators of websites and online services.

• Fair and Accurate Credit Transactions Act (FACTA): addressing identity theft and the handling of consumer account information.

• Family Educational Rights and Privacy Act (FERPA): governing the protection against improper disclosure of personally identifiable information (PII) derived from educational records.

10.3. CANADA

Canada has a comprehensive framework of federal and provincial privacy laws. The principal federal legislation is the Personal Information Protection and Electronic Documents Act (PIPEDA).

PIPEDA's ten fair information principles provide individuals with the right to understand why their personal information is collected, how it will be used, with whom it will be shared, and how they may request access to or information about their personal data.

10.4. JAPAN

Japan's Act on the Protection of Personal Information (APPI) governs the processing of personal data.

The APPI establishes the principal obligations applicable to organizations that process personally identifiable information (PII), including requirements relating to organizational safeguards, personnel controls, physical security measures, and technical security measures.

10.5. NEW ZEALAND

New Zealand regulates personal data privacy through the Privacy Act, which establishes the 12 Information Privacy Principles (IPPs).

These principles primarily address matters such as the purpose of data collection, methods of storage and access, limitations on the use of personal information, and restrictions on the disclosure of personal data.

We store and retain your personal data:

1. For the period required by applicable law;

2. Until the processing of your personal data has ended, as described below; and

3. For the period necessary to protect or exercise Elefante Letrado's rights in judicial, administrative, or arbitration proceedings.

Accordingly, we may process your personal data, for example, during the applicable statutory limitation periods or for as long as necessary to comply with legal or regulatory obligations.

The processing of your personal data will end in the following circumstances:

• When the purpose for which the personal data was collected has been fulfilled and/or the collected personal data is no longer necessary or relevant for that purpose;

• When the Data Subject withdraws their consent or exercises their legal right to request the termination of processing and the deletion of their personal data; or

• When required by applicable law.

In accordance with the principle of data minimization, certain information submitted through our Platform and App may be deleted from our records while maintaining routine operational logs where appropriate. We are under no obligation to retain personal data indefinitely and disclaim any liability arising from or related to the deletion of such personal data.

Upon the termination of the processing of your personal data, except where retention is required by applicable law or this Privacy Policy, your personal data will be deleted from Elefante Letrado's databases.

If immediate deletion is not technically feasible, the personal data will be securely stored and isolated from any further processing until deletion becomes possible.

We seek to avoid sending unsolicited emails and limit our communications to matters that are relevant or of specific interest to you.

If you no longer wish to receive our communications, you may unsubscribe by using the unsubscribe (opt-out) link included in the email or message you receive, or by submitting a request through our Website.

Please be aware that fraudsters may attempt to impersonate reputable companies in order to obtain personal information, including passwords and financial information.

ELEFANTE LETRADO WILL NEVER REQUEST YOUR FINANCIAL INFORMATION BY EMAIL OR TELEPHONE.

If you receive any suspicious communication, please send your questions or report the incident by email to privacidade@elefanteletrado.com.br.

Our Platform may contain links to, or embedded frames of, third-party websites. These links or frames are provided to offer Users additional content and services.

Please note that the inclusion of such links or frames on our Platform does not mean that Elefante Letrado has reviewed, endorses, agrees with, or is responsible for the content available through those websites or frames.

Although we strive to provide links only to reputable and trustworthy organizations, Elefante Letrado is not responsible for the information, products, or services obtained by Users through third-party websites, nor for the business practices or privacy policies adopted by those organizations. Accordingly, Elefante Letrado shall not be liable for any losses, damages, or lost profits arising from the use of such external resources.

Because these linked websites are not part of our Platform, we do not control, recommend, or endorse their websites, content, products, services, policies, or privacy practices. We also do not have access to any personal data collected or processed by such third parties, nor to their advertising policies, cookie practices, or terms of use.

For this reason, we strongly encourage you to carefully review the privacy policies, terms of use, and other applicable documents of any third-party websites you visit.

By accessing our Platform and our App, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy.