PRIVACY POLICY

GEPRODE CONSULTORES LTDA

We at GEPRODE CONSULTORES LTDA (“we”) operate in the provision of specialized services in geotechnical instrumentation and monitoring, encompassing the direction, coordination, and execution of associated technical operations. Our activities aim to support risk management, operational safety, and technical decision-making throughout the life cycle of monitored works and infrastructure.

We are committed to safeguarding the privacy and protection of personal data of individuals who interact with our actions and services. Therefore, you, the data subject, have the right and the duty to carefully read this document to understand how we process your information.

Here you will find information about how your personal data is collected, used, shared, and stored.

If you do not agree with this Policy, please do not continue providing your data and discontinue the use of our website.

Please refer to the Glossary prepared to better understand the concepts and terminology used in this document.

1. What Personal Data does GEPRODE process?

The Personal Data processed by GEPRODE may vary according to the type of interaction with our websites and services and the category of data subject to which you belong, as described in the section “Personal Data Subjects.” Data may be obtained directly from the data subject, from third parties, or collected automatically.

Personal Data may include:

• Access information, such as browsing history, content interaction, and page views;
• Registration information, such as full name, email address, telephone number, mobile number, CPF and RG;
• Browsing and device information, such as IP address, access dates and times, device information, and cookie data;
• Professional information, such as job title and the company where the data subject works or maintains a professional relationship.

We do not necessarily collect all the data listed above. The Personal Data collected depends on the interaction with our websites and services. For example, banking information is collected only when you become a GEPRODE Client, i.e., when you contract our services.

2. Who are the Personal Data subjects processed by GEPRODE?

We process Personal Data of different categories of individuals (“Personal Data Subjects”). You may fall into one or more of the following categories:

• Visitors: Individuals who visit or access GEPRODE websites or pages;
• GEPRODE Leads: Potential clients who have interacted with GEPRODE content or materials or have agreed to receive communications, such as newsletters and promotional content;
• GEPRODE Clients: Individuals or entities negotiating, about to sign, or who have already signed a service agreement with GEPRODE.

Last update: December 17, 2025

3. Legal bases for processing

All personal data processing carried out by GEPRODE is based on a legal basis provided for in applicable legislation. The legal bases used may vary depending on the context, including:

• Contract Performance: Processing necessary to execute contracts with GEPRODE Clients;
• Exercise of Legal Rights: Processing required for judicial, administrative, or arbitration proceedings;
• Compliance with Legal or Regulatory Obligations: Processing required by law or regulation;
• Legitimate Interest: Processing carried out to meet GEPRODE’s legitimate interests, after careful assessment of necessity, purpose, data subject expectations, and proportionality. This applies, for example, to newsletters and communications related to the data subject’s interests. Opt-out options are always provided.

3.1 Sensitive Personal Data

GEPRODE does not, as a rule, collect sensitive personal data (such as racial or ethnic origin, religious belief, political opinion, genetic or biometric data). If collected exceptionally, processing will be based on explicit consent or another lawful basis, with enhanced security measures.

4. What are the purposes of data processing by GEPRODE?

4.1 Visitor Data

When accessing and browsing GEPRODE websites, we may collect data to enable site access and improve marketing and communication strategies.

Examples:

4.2 GEPRODE Lead Data

We process data when individuals contact us via email, forms, messages, phone calls, or content interactions, for purposes such as responding to requests, sending useful communications, promoting services, and commercial contact.

Examples include:

• Service promotion
• Sending communications
• Commercial contact
• Customer service
• Marketing performance analysis

All under the Legitimate Interest legal basis.

4.3 GEPRODE Client Data

When you become a GEPRODE client, your data is processed to ensure the continuity of contracted services, in compliance with the Brazilian General Data Protection Law (LGPD – Law No. 13,709/2018).

4.4 Data of Minors

GEPRODE services are not intended for individuals under 18 years old. Any inadvertently collected data will be deleted unless legally authorized.

5. How do we use Cookies?

5.1 What are cookies?

Cookies are small text files stored in the user’s browser to improve navigation and enable website functionality. They may be first- or third-party cookies and include technologies such as pixel tags and mobile identifiers.

Types include:

• Strictly necessary cookies
• Performance cookies
• Functional cookies
• Advertising or targeting cookies

Consent is managed through a banner, in accordance with applicable law.

5.2 How does GEPRODE use cookies?

5.3 Managing Preferences

Users may manage cookie preferences via browser settings at any time.

6. With whom does GEPRODE share data?

Personal Data may be shared with:

• Service Providers: Platforms supporting sales, marketing, and customer success;
• Authorities and Courts: When legally required or for the exercise of rights.

6.1 International Transfers

When data is transferred outside Brazil, GEPRODE ensures compliance with LGPD using appropriate safeguards.

7. How is data protected?

GEPRODE adopts technical and administrative measures, including:

• Secure data storage with access control;
• Encryption and information security technologies;
• Logical and physical access monitoring;
• Staff training and privacy governance practices;
• Secure partnerships with compliant vendors.

In case of incidents, appropriate measures and notifications will be taken as required by law.

8. What are your rights as a data subject?

You have the right to:

• Access
• Rectification
• Deletion
• Objection (opt-out)
• Explanation (transparency)
• Review of automated decisions
• Data portability

Requests can be made via geprode@geprode.com, with responses within 15 days, as provided by LGPD.

9. Data retention period

Personal Data will be retained until:

• The processing purpose is fulfilled;
• Data is no longer necessary;
• Contract termination;
• Data deletion request;
• Legal or regulatory penalties apply.

Data may be retained longer to comply with legal obligations or defense of rights.

10. Changes to this Policy

This Privacy Policy may be updated periodically. We recommend regular review. Updates may be communicated via email when applicable.

11. Contact GEPRODE

For questions or requests related to this Policy, contact:
📧 geprode@geprode.com