PRIVACY POLICY OF JHSF PARTICIPAÇÕES S.A.

Approved on September 18, 2026

Attention! By accessing our websites, applications, social media, communication channels or marketplaces ("Platforms"), you declare that you are aware of the content of this Privacy Policy ("Policy")

JHSF Participações S.A., a publicly traded corporation, enrolled in the Corporate Taxpayer Registry (CNPJ) under No. 08.294.224/0001-65, with Headquarters established at Avenida Alcides Sangirardi, s/nº, 301 Usina SP – Espaço C.01.01, in the City of São Paulo, State of São Paulo, and together with its direct and indirect subsidiaries ("JHSF" or "Company"), develops its business with a focus on sustainable value generation and respect for the specificities of each brand and segment of operation.

In the scope of its activities, JHSF processes personal data (as defined in specific legislation) of users, clients, partners, suppliers, employees, among others, with the purpose of providing its services, businesses and products with the highest quality and excellence.

Committed to the protection of personal data, to the best corporate governance practices and to compliance with applicable legislation on privacy and personal data protection, JHSF issues this Policy, applied to its entire conglomerate, with the objective of informing, in a transparent manner, which data may be collected, used, stored and shared by the Company with its clients, partners, suppliers, employees and users ("Personal Data Subject(s)") in the development of its business activities.

This Policy is applicable to all Personal Data Subjects with whom JHSF maintains or has maintained any type of relationship, whether as an employee, client, supplier, partner, among others, and is also applicable to all means of personal data processing used by the Company, whether physical or digital, including electronic pages, information systems and documents, related to JHSF, its brands, services, products, businesses and business activities.

If, after reading this Policy, you still have questions, you may contact the Company via e-mail: dpolgpd@jhsf.com.br.

1. Personal data controller

For the purposes of the personal data processing described in this Policy and in applicable legislation, JHSF will be the Controller of personal data.

Pursuant to applicable legislation, the Controller is the party responsible for decisions regarding the processing of personal data.

2. What personal data may be collected?

The collection of personal data will depend on the interaction we maintain with the Personal Data Subject, and may occur directly, when provided by the Personal Data Subject, automatically through technologies used in the Company's digital environments, or through third parties authorized by the Company, in compliance with applicable legislation. Some of these interactions are exemplified below:

Personal registration information for contact. Any information that the Personal Data Subject provides to JHSF and that may be used to allow contact, such as, for example, name, Address, e-mail, social media details or phone number.
Personal information from recruitment and selection. Any information that the Personal Data Subject provides to JHSF during the selection process, such as, for example, academic and professional history.
Personal data for employee admission. Any information related to the admission process, such as, for example, full name, Date of Birth, Address, phone number, dependent information (when applicable), banking details, among others.
Demographic and interest information. Any information that describes demographic data or behavioral characteristics, such as, for example, Date of Birth, age or age group, gender, geographic location (for example Postal Code), favorite products, hobbies, interests, family information or information about lifestyle.
Technical information about the computer/mobile device. Any information about the computer system or other device used to access the Company's websites, communication channels or applications, such as, for example, the IP Address used to connect the computer or device to the internet, the type of operating system used and the type and version of the web browser. If the Personal Data Subject accesses JHSF's Platforms using a mobile device, such as, for example, a smartphone, the information collected may also include the unique phone device ID, the advertising ID, geographic location and other similar mobile device data.
Website/communication usage information. As the Personal Data Subject browses and interacts with the Platforms, the Company uses automatic data collection technologies to collect certain information about actions. This includes information such as which links the Personal Data Subject clicks, which pages or content are viewed and for how long, and other similar information and statistics about these interactions, such as content response times, download errors and duration of visits to certain pages. This information is captured through automated technologies, such as Cookies (browser Cookies, Flash Cookies, among others), web beacons and third-party tracking.
Market research information and consumer feedback. This includes information that the Data Subject voluntarily shares with the Company about their experience using JHSF's products, businesses, and services.
Consumer-generated data. Refers to any content that the Data Subject creates and shares with JHSF on social media and third-party channels or by uploading to one of the Platforms, including the use of third-party social networking applications, such as Facebook, Instagram, TikTok, among other platforms. Examples include photos, videos, personal stories, or other similar content and media.
Third-party social network information. Refers to any information that the Data Subject publicly shares on a third-party social network or information that is part of their profile on that network (such as Facebook) and that the Data Subject authorizes the social network to share with JHSF. Examples include their basic account information (e.g., name, email address, gender, Date of Birth, current city, profile photo, user ID, and friends list), as well as any additional information or activities that the Data Subject permits the third-party social network to share.
Financial and Payment information. Any information that is necessary for the management of accounts receivable and accounts payable, related to employees, clients, users, partners, and suppliers, such as bank account data, debit or credit card data (such as the cardholder's name, card number, Validity / Expiration Date, and security code) or other forms of Payment (if made available).
Calls to the Consumer Service Center. Any information reported in the customer service channels, such as your full name, Identity Document / ID, phone number, credit or debit card data, among others. Please note: communications with a JHSF consumer service center may be recorded or monitored, in accordance with applicable laws, for local operational needs (e.g., for quality or training purposes). When required by law, the Data Subject will be informed about the recording at the beginning of their call.
Sensitive Personal Data. We may collect health-related data pertaining to employees, such as information regarding persons with disabilities (PCD), medical certificates containing ICD codes, information related to workplace accidents, as well as biometric data. Whenever sensitive personal data is collected, the Company adopts strict measures to protect such information, with a legal basis for its processing.
Personal Data obtained from third parties. JHSF may receive personal data from legitimate third parties, such as companies within its conglomerate, business partners, service providers, social media platforms (when authorized by the Data Subject), public authorities, and public databases, always for legitimate purposes and in accordance with applicable legal bases.
Data arising from interactions with partners and external platforms. When the Data Subject interacts with JHSF through third-party digital platforms, social networks, or technological tools integrated into its services, JHSF may receive information made available by the Data Subject on such platforms, subject to the privacy settings defined by them and the authorizations granted.

3. What are the purposes for collecting your personal data?

The personal data collected may be processed for the following purposes and in accordance with the respective legal bases:

Purpose	Type of personal data	Legal basis
Compliance with legal, regulatory obligations, or court orders, including retention of IP address, date, and time of access to websites, applications, and channels	Browsing data, such as IP Address, date and time of access, device identifiers, type of browser used, among others	Compliance with legal or regulatory obligation
Execution of financial transactions, including receipt, transfer of amounts, reservations, Payments, and related processes	Address, Individual Taxpayer Registry (CPF), Identity Card (RG), financial data, banking data, credit card number, among others	Compliance with legal or regulatory obligation; Contract execution
Provision of services and execution of business transactions and purchases	Name, Individual Taxpayer Registry (CPF), Identity Card (RG), Driver's License (CNH), National Registry of Foreigners (RNE), enrollment date, financial references, Place of Birth, Nationality, Address, Marital Status, email, among others	Contract execution
Making reservations, Payments, and processes related to stays at hotels, clubs, and restaurants	Registration data, Identity Documents / IDs, contact data, Payment data, reservation data, and consumption data	Contract execution; Pre-contractual procedures
Preliminary procedures related to contracting, reservations, Payments, partnerships, and development of new business	Registration data, contact data, Identity Documents / IDs, commercial information, and data necessary for the assessment of the intended relationship	Pre-contractual procedures
Execution of contracts with employees	Registration data, Identity Documents / IDs, professional data, banking data, contractual data, and information necessary for the employment relationship or provision of services	Compliance with legal or regulatory obligation; Contract execution
Credit analysis and fraud prevention	Registration data, identification documents, financial references, financial data, browsing data and information necessary for identity validation and risk prevention	Compliance with a legal or regulatory obligation; legitimate interest
Responses to requests from the Judiciary Power	Registration data, identification documents, contractual data, financial data and other information necessary to fulfill the request	Compliance with a legal or regulatory obligation
Handling of inquiries, complaints and suggestions	Name, email, phone number, identification documents, relationship data, service history and information provided by the data subject	Contract execution; Legitimate interest
Communication with the data subject	Name, email, phone number, Address, registration data and information related to the relationship with the Company	Contract execution; Legitimate interest
Sending of notices and satisfaction surveys	Name, Individual Taxpayer Registry (CPF), Identity Card (RG), Driver's License (CNH), RNE, membership date, financial references, Place of Birth, Nationality, Address, Marital Status, email, among others	Legitimate interest; Consent
Promotion of marketing and advertising actions, including sending of advertisements, direct marketing, contests and communications related to the data subject's interests	Browsing data, name, Place of Birth, Nationality, Address, Marital Status, email, among others	Legitimate interest; Consent
Customization of user experience and improvement of solutions, features, websites, channels and applications	Browsing data, device identifiers, preferences, interactions with platforms, registration data and usage information	Legitimate interest; Consent, when applicable
Behavioral analysis on websites and applications, including the use of analytical tools for improving platform quality and user experience	Name, Individual Taxpayer Registry (CPF), Identity Card (RG), Driver's License (CNH), RNE, membership date, financial references, Place of Birth, Nationality, Address, Marital Status, email, browsing data, device identifiers and usage information, among others	Legitimate interest; Consent, when required
Research and analysis of the Company's strategic indicators	Registration data, relationship data, transactional data, browsing data, consumption information and aggregated or statistical data, when applicable	Legitimate interest
Partnership and development of new business	Registration data, contact data, professional information, identification documents, commercial data and information necessary for the evaluation of the partnership or opportunity	Preliminary procedures to the contract; legitimate interest
Protection and exercise of the Company's legitimate interests, including physical premises security, legal claims, defense in litigation, management and execution of business and services	Name, Individual Taxpayer Registry (CPF), Identity Card (RG), Driver's License (CNH), RNE, membership date, financial references, Place of Birth, Nationality, Address, Marital Status, email, among others	Legitimate interest
Regular exercise of rights in judicial, administrative or arbitral proceedings	Registration data, identification documents, contractual data, financial data, relationship records, evidence and other information necessary for the defense or exercise of rights	Regular exercise of rights
Protection of the life or physical safety of data subjects or third parties	Registration data, identification data, contact data, images, access records, security information and data necessary for the protection of life or physical integrity	Protection of life or physical safety
Protection and security of the Company's premises	Name, identification documents, contact data, images, access records, visitor data, vehicle data and information related to asset security	Legitimate interest; Protection of life or physical safety
Preparation and management of guest lists and attendees at events	Name, email, phone number, company, position, companion data, attendance confirmation, preferences and information necessary for event organization	Contract execution; Legitimate interest

4. What are the rights of Personal Data Subjects?

Personal Data Subjects have rights guaranteed by law that may be exercised at any time. They are:

Information on the existence of Personal Data – right to request information on the existence of processing activities involving their Personal Data
Access to Personal Data – right to request access to their Personal Data that are processed by JHSF
Correction of Personal Data – right to request the correction of their Personal Data that are incomplete, inaccurate or outdated
Anonymization, blocking or deletion of Personal Data – right to request the anonymization, blocking or deletion of unnecessary, excessive or non-compliant Personal Data
Portability of Personal Data – right to request the portability of their Personal Data to another service or product provider, upon express request and pursuant to the regulations of the competent authority
Right to request information about public and private entities with which we share their Personal Data
Right to request the deletion of Personal Data processed without their consent
Right to request information about the possibility of not providing consent and the consequences of refusal
Right to revoke consent at any time
Right to object to the Processing of Personal Data in cases where the legal basis is not consent and there is non-compliance with the LGPD
Right to request the review of decisions made solely on the basis of automated processing that may affect their interests

The Personal Data Subject may exercise any of their rights through written notification to the email: dpolgpd@jhsf.com.br.

Attention! It is possible that in some cases it may not be possible to fulfill the request to exercise rights, due to legal impediments that will be duly justified.

5. Automated decisions and profiling

JHSF may use, in certain activities, automated support tools and technologies in the processing of Personal Data, with the purpose of making its processes more efficient, secure and aligned with best market practices.

As a general rule, JHSF does not adopt decisions based exclusively on automated processing of personal data, including those intended for profiling, that produce legal effects or significantly impact the interests of Personal Data Subjects, without proper human intervention.

When there are automated decisions with relevant impacts, the Personal Data Subject may consult the privacy notices for the information, conditions and safeguards applicable to each case.

6. With whom will your personal data be shared?

JHSF operates in partnership with several companies to offer its services, businesses, products and opportunities. Therefore, we may share personal data with these companies, to the extent reasonably necessary for the stated purposes and in accordance with applicable legislation, always seeking to preserve privacy to the greatest extent possible and, whenever possible, anonymizing the information. Here, we describe situations in which we may share personal data:

(i) Companies within the JHSF conglomerate: We may share the information of Personal Data Subjects with other companies within the JHSF conglomerate, whether controlled, controlling or subsidiary.
(ii) Suppliers and business partners: JHSF has a number of suppliers and business partners that need to be engaged to operate its services, products and businesses, and some of them may process the personal data collected. Suppliers and business partners are carefully evaluated and enter into contractual obligations regarding information security and personal data protection, with the aim of minimizing risks to Personal Data Subjects.
(iii) Public Authorities: If a judge or an authority with legal competence requires JHSF to transmit certain personal data for, for example, an investigation, the sharing will be carried out. JHSF is against any abuse of authority and, should JHSF determine that a given order is abusive, it will always defend the privacy of Personal Data Subjects.
(iv) In cases of changes to the corporate structure: JHSF may share personal data in the event of corporate transactions, such as mergers, acquisitions, incorporations or assignment of rights involving companies within its conglomerate.

Furthermore, JHSF reserves the right to share any personal data believed to be necessary to comply with a legal obligation, to enforce or apply the Company's Terms of Use, or to protect the rights, property or security of JHSF, as well as its employees, clients, users, suppliers and partners.

7. Cookies

Cookies are small files of letters and numbers, stored on your computer or device when accessing a website or application.

JHSF's websites and applications collect cookies to offer a more personalized web experience.

The collection of cookies will occur during browsing on our websites or applications. The Personal Data Subject will receive a statement in their browser, and it will be possible to customize their preferences through the cookie management tool.

The Personal Data Subject may manage cookies at any time through the browser used.

8. Can the personal data of Personal Data Subjects be transferred to another country?

Although JHSF has its Headquarters in Brazil and a large part of its portfolio of products, businesses and services are carried out and/or intended for persons in Brazil, with Brazilian laws related to personal data protection therefore applying, JHSF also operates products and services in foreign territory and, for this reason, personal data may be shared internationally.

Furthermore, the personal data collected may be transferred to countries located abroad due to JHSF's suppliers and business partners that provide their services abroad.

Whenever international sharing of personal data occurs, JHSF will take all necessary measures to ensure the security and protection of personal data, in compliance with applicable legislation and with the best market governance practices. Furthermore, the Company adopts information security and incident response measures in compliance with applicable legislation, including data protection regulations from other jurisdictions, where applicable.

9. For how long is personal data stored?

JHSF will not retain personal data for a period longer than necessary nor in non-compliance with legislation.

JHSF may retain personal data, as provided by law:

For the time necessary to fulfill the purposes for which the personal data are processed;
For the period provided by law, when the retention period is determined by applicable legislation or regulation; and
For the time necessary to preserve the legitimate interests of the Company.

When there is no longer a need to retain personal data, your information will be securely disposed of or anonymized.

10. How is personal data protected?

The Company's responsibility is to safeguard personal data and use it exclusively for the purposes described in this Policy. To ensure the privacy and protection of personal data, the Company adopts security practices appropriate to the market, with the use of information security systems, including the application of data encryption techniques and other technical and organizational measures, as applicable.

However, absolute security cannot be guaranteed. Therefore, the role of the Personal Data Subject is essential to maintaining a secure environment for everyone. The adoption of good security practices regarding accounts and personal data is recommended. It is the responsibility of the Personal Data Subject to maintain the Confidentiality of their passwords and access codes. When using shared or public computers or devices, one should not select the option to memorize login ID, email Address, or password, and it is necessary to ensure that the session is closed upon leaving the equipment. If any situation that compromises the security of personal data is identified or becomes known, contact must be made immediately via email: dpolgpd@jhsf.com.br.

11. In the event of a personal data breach

The Company adopts a structured process for managing information security and privacy incidents, in compliance with applicable legislation. This process encompasses the identification, recording, and handling of incidents, as well as the implementation of appropriate technical and organizational measures to mitigate their impacts and prevent their recurrence. The Company also maintains specific procedures for detection, response, and preservation of evidence, as well as a communication plan that guides the timely notification of competent authorities and other interested parties, when applicable, pursuant to current regulations.

12. In case of questions, who can the Personal Data Subject contact?

In case of questions or comments about this Policy or about the way personal data is processed, the Personal Data Subject may contact the Company's Data Protection Officer, Mr. JOÃO ALVES MEIRA NETO, via email: dpolgpd@jhsf.com.br.

13. Changes to this Policy

JHSF is constantly improving its respective products, businesses, and services. For this reason, this Privacy Policy may undergo periodic updates to reflect the improvements made. Even so, we recommend that the Personal Data Subject consult this Policy regularly, in order to stay informed about the ways in which personal data is processed.

REGIONAL NOTICES

The provisions below supplement this Policy and shall apply in accordance with the connecting criterion set forth in the legislation of each indicated jurisdiction.

The Uruguay notices apply to residents in the country and/or to Data Subjects whose Personal Data is processed in the context of operations subject to Uruguayan legislation.

The Florida notices apply to consumers residing or domiciled in that State, when applicable.

The European Union and United Kingdom notices apply to Data Subjects located in those jurisdictions, when the processing is related to the offering of products or services by JHSF or to the monitoring of their behavior in those locations, pursuant to the GDPR and the UK GDPR.

Notice to residents of Uruguay

Residents of Uruguay have, pursuant to Law No. 18.331/2008, specific guarantees regarding the processing of their Personal Data.

a) Right to proof of consent

The Data Subject may request proof of consent when the processing is based on this legal basis.

b) Supervisory authority and right to lodge a complaint

The Data Subject may lodge a complaint before the Unidad Reguladora y de Control de Datos Personales (URCDP).

Notice to consumer residents of the State of Florida (United States)

Consumer residents of the State of Florida have, pursuant to the state data protection legislation, Florida Digital Bill of Rights (FDBR), additional rights regarding the processing of their Personal Data, including:

a) Right to opt out of certain processing purposes

Consumer residents of the State of Florida may choose not to allow the processing of their Personal Data, when applicable, for the following purposes:

targeted advertising;
sale of Personal Data;
profiling to support decisions that produce legal or similarly significant effects.

b) Right to opt out of the processing of Sensitive Personal Data

Consumer residents of the State of Florida have the right to opt out of the collection or processing of Sensitive Personal Data, including precise geolocation data, except in legally permitted cases.

c) Right to opt out of data collection by recognition technologies

Consumers residing in the State of Florida have the right to opt out of the collection of Personal Data through voice recognition or facial recognition features, when such technologies are used.

d) Limitation on the use of technologies for surveillance purposes

Devices that have voice recognition, facial recognition, audio recording, video recording, or any other electronic, visual, thermal, or sensory features capable of collecting data shall not be used for surveillance purposes when such features are not in active use by the consumer, except upon express authorization.

e) Right of Appeal

Should JHSF decide not to fulfill, in whole or in part, a request related to the rights described in this notice, the consumer may request a review of the decision through the channels indicated in the Global Privacy Policy.

Information on the Sale of Personal Data

JHSF informs that it does not carry out the sale of consumers' Personal Data, in accordance with the understanding commonly adopted by the applicable legislation in the State of Florida.

Notice to Data Subjects in the European Union and the United Kingdom

The processing of personal data related to the European Union or the United Kingdom is subject, pursuant to Regulation (EU) No. 2016/679 (General Data Protection Regulation – GDPR) and the UK GDPR, to specific provisions set forth in such legislation.

a) Local Representative

Whereas JHSF offers products and services to Data Subjects located in the European Union and the United Kingdom, the Company may designate a local representative in those jurisdictions, pursuant to applicable legislation.

The contact information of the representative will be made available in this notice or through the appropriate channels, when formally appointed.

b) International Transfer of Personal Data

When Personal Data of Data Subjects located in the European Union or the United Kingdom are transferred outside those jurisdictions, JHSF shall ensure that such transfers take place on the basis of appropriate legal mechanisms, which may include, as applicable:

Adequacy decisions recognized by the competent authorities;
Standard contractual Clauses approved by the competent authorities;
Global corporate rules or other legally admitted instruments.

c) Supervisory Authority and Right to Lodge a Complaint

The Data Subject has the right to lodge a complaint before the competent data protection authority, should they consider that the processing of their Personal Data violates applicable legislation:

in the European Union Member State of their habitual residence, place of work, or place of the alleged violation; or
in the United Kingdom, before the Information Commissioner's Office (ICO);

Resultados para