Privacy Policy

1. PURPOSE OF THIS POLICY

The Aço Cearense Group adopts this Privacy Policy as a means of protecting the Personal Data of all Data Subjects who interact with its companies, ensuring a uniform security standard and in full compliance with current legal standards, in particular with the General Law on the Protection of Personal Data (Law No. 13,709/2018).

The purpose of this Policy is to establish the parameters for the collection and processing of your Personal Data by Grupo Aço Cearense, and covers all environments of your interaction, whether online or offline, as well as the means by which you may exercise your rights over your Personal Data.

2. DEFINITIONS

a. For the purposes of this Policy and its better understanding and comprehension, the following definitions and descriptions should be considered:

(i) Anonymization: use of reasonable technical means available at the time of Processing, through which data loses the possibility of association, directly or indirectly, with an individual;

(ii) Log Files: These are files (logs) that detail website activities and collect statistics about the user's browsing habits;

(iii) Cookies: small files sent by Our Environments, saved on your devices, which store preferences and a little other information, with the purpose of personalizing your browsing according to your profile;

(iv) Data: any information entered, processed or transmitted through Our Environments;

(v) Personal Data: data related to an identified or identifiable natural person;

(vi) IP addresses: is a number used on the internet or a network to identify your computer;

(vii) Cearense Steel Group, or Group: economic group composed of the following companies: AÇO Cearense Comercial Ltda, Aço Cearense Industrial Ltda, Siderúrgica Norte Brasil SA – SINOBRAS, Sinobras Florestal Ltda., WMA Participações SA and Instituto Aço Cearense;

(viii) Our Environments: are all platforms, websites and means through which you can interact with the Aço Cearense Group, such as: (a) websites and pages of the Group's companies on the internet; (b) pages of the Group's companies on social networks, such as Linkedin, Facebook, Instagram, Twitter, among others; (c) electronic mail and instant messaging systems, such as WhatsApp, Telegram, SMS (short message service) and similar; (d) the Group's mobile applications, whether provided directly by it or by third parties, such as Google or Apple; (e) customer service channels and sales center; (f) advertisements, advertisements and online forms; (g) offline records and registrations and physical documents delivered or sent to the Aço Cearense Group;

(ix) Web beacons: also known as webbugs or web beacons, these are small sequences of code that allow the delivery of a graphic image on a web page with the aim of transferring data back to the page owner;

(x) Holder of personal data: natural person to whom the personal data that are subject to processing refer (hereinafter also referred to as you);

(xi) Processing: any operation carried out with Personal Data, such as those relating to collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, elimination, evaluation or control of information, modification, communication, transfer, dissemination or extraction.

3. WHAT PERSONAL DATA WE COLLECT AND HOW IT IS COLLECTED

3.1. During your interaction with Grupo Aço Cearense through one of Our Environments, some of your Personal Data may be collected, as detailed below:

(i) Contact Information: physical mailing address, telephone numbers, email addresses, websites and social media profiles;

(ii) Login information: registration name (login), password in unrecoverable format (encrypted) and security questions, when used to access Our Environments;

(iii) Technical information about your computer equipment or mobile devices: record of the IP address used to connect your computer or device to the internet, including your geographic location, the type and version of operating system and the type and version of web browser;

(iv) Information about how you use our websites and services: details such as which links you click, which pages or content you view and for how long, and other similar information and statistics about your interactions, such as content response times, download errors and length of visits to certain pages;

(v) Market research and consumer feedback: information that you voluntarily share with Grupo Aço Cearense about your experience using our products and services.

(vi) Content generated by you: any content that you create and share with Grupo Aço Cearense on third-party social networks, including your profile, and that you allow the third-party social network to share with us, or by uploading to one of our websites, applications and other online and offline services, such as Facebook, Instagram, Linkedin and similar;

(vii) Financial and payment information: any data that Grupo Aço Cearense needs to fulfill an order, or that you use to make a purchase, such as your debit or credit card details, bank details, or other forms of payment used;

(viii) Contacts with our Customer Service and Sales Center: your interactions with our Customer Service Center and sales channels may be recorded, in accordance with applicable laws, for the operational needs of Grupo Aço Cearense.

3.2. We use Cookies to improve the use and functionality of the Aço Cearense Group's websites and other compatible web services and to better understand how you use our websites and online services, as well as the tools and services they offer, in order to adapt the Aço Cearense Group's websites to your personal needs, making their use as easy as possible.

3.2.1. You do not need to have Cookies enabled to use or browse most of the Aço Cearense Group websites and online services, and you can freely ensure that the settings on your computer or portable device reflect whether you consent to accept Cookies or not. However, if you do not consent, we cannot guarantee that you will be able to access all the resources available on our online channels.

3.2.2. To learn more about the use of Cookies on our online channels, visit our Cookies Policy.

3.3. Aço Cearense Group’s websites and compatible services may also use other tracking technologies similar to Cookies, which may collect information such as IP Addresses, Log Files and Web Beacons, among others. This data is also used to help us adapt Aço Cearense Group’s websites and other compatible services to your personal needs.

3.3.1. Because our web beacons may be part of a web page, you cannot “opt-out” of this type of feature, but you can make it completely non-functional by enabling the “opt-out” feature for the Cookies placed by that beacon.

3.3.2. More information and details about these tracking technologies can also be obtained through our Cookies Policy.

3.4. The Aço Cearense Group does not knowingly request, collect, process, store or share personal data of children and adolescents under the age of majority, except in cases where there is a legal provision, or explicit consent from one of their parents or legal guardians, in accordance with current legislation.

3.4.1. If we discover that any type of processing of this type of personal data has occurred unintentionally, we will remove the personal data of that child or adolescent from our records quickly, securely and with a record of this processing.

4. REASONS FOR COLLECTING YOUR PERSONAL DATA

4.1. Aço Cearense Group collects your Personal Data in accordance with legal precepts, based on compliance with legal or contractual obligations or legitimate interest and, when necessary, with your consent. The main situations of collection and processing occur based on:

(i) Facilitate commercial relations and supply of our products;
(ii) Carrying out promotions and marketing actions;
(iii) Interactions on social networks and third-party websites;
(iv) Meeting your demands;
(v) Other legal purposes and situations in general.

5. ABOUT THE SHARING OF YOUR PERSONAL DATA

5.1. In addition to the entities that are part of the Aço Cearense Group, your Personal Data may be shared with:

(i) Service providers;
(ii) Credit analysis, debt collection and financial services agencies;
(iii) Third-party companies that use Personal Data for their own marketing purposes:
(iv) With competent judicial, administrative or governmental authorities, whenever there is a legal determination, request, requisition or court order; and
(v) In the case of corporate transactions such as mergers, acquisitions and incorporations.

6. ABOUT THE RETENTION PERIOD OF YOUR PERSONAL DATA

6.1. Grupo Aço Cearense uses your Personal Data for as long as necessary to satisfy the purposes for which they were collected, as described in this Policy.

6.2. You can obtain further details about the retention of your Personal Data through the communication channels detailed in this Policy.

6.3. When the processing of your Personal Data is completed, it will be deleted within the scope and technical limits of the activities, with storage authorized for auditing, security, fraud control, credit protection and preservation of rights purposes, in accordance with current legislation.

7. ABOUT THE PROTECTION OF YOUR PERSONAL DATA

7.1. The Aço Cearense Group adopts appropriate measures to ensure that your Personal Data is kept confidential and secure, with regard to access, storage and transfer:

(i) People who can access your Personal Data: your Personal Data will be processed by our authorized employees or agents, provided that they need to have access to such information, depending on the specific purposes for which your Personal Data has been collected;

(ii) Measures taken in operating environments: your Personal Data is stored in operating environments that use reasonable security measures, both technical and administrative, to prevent any type of unauthorized access. We follow reasonable protocols to protect Personal Data;

(iii) Transfer of your Personal Data: given the nature of our business, we may have to transfer your Personal Data stored within the Aço Cearense Group to third parties, in accordance with the purposes set out in this Privacy Policy. For this reason, we may transfer your Personal Data to other countries, provided that these countries have laws and regulations compatible with those in force in Brazil.

7.2. The protections applied by Grupo Aço Cearense do not apply to information that you have chosen to share in public areas, such as third-party social networks.

7.3. It is important that you also take steps to keep your Personal Data secure, such as:

(i) When creating an online account, be sure to choose a password that is strong enough to prevent unauthorized parties from guessing it. Never reveal or share your password with others. You are solely responsible for maintaining the confidentiality of your password and for any actions taken through your account on Grupo Aço Cearense websites and compatible services;

(ii) If you use a shared or public computer, never choose to remember your login name, email address or password, and make sure you log out of your account whenever you leave the computer.

(iii) You must also use any privacy settings or controls that Grupo Aço Cearense provides on our website, services or applications, including those considered optional.

7.4. You are entirely responsible for the veracity and accuracy of the Data you provide to Grupo Aço Cearense, assuming the consequences in the event of inaccuracy of the data provided.

8. ABOUT YOUR RIGHTS REGARDING YOUR PERSONAL DATA AND HOW TO EXERCISE THEM

8.1. Through the communication channels provided for in this Policy, you may exercise the Rights related to information, access and modification of your Personal Data, including:

(i) Ask questions or make comments about this Policy, the Cookie Policy, and our privacy and Personal Data protection practices;
(ii) Make a complaint regarding the Processing of your Personal Data;
(iii) Request confirmation of the existence of Processing of your Personal Data;
(iv) Obtain information on how to access your Personal Data;
(v) Correct incomplete, inaccurate or outdated personal data;
(vi) Obtain information about the Anonymization, blocking or deletion of unnecessary, excessive data or data processed in non-compliance with the provisions of current legislation;
(vii) Obtain information about the portability of your personal data to another service or product provider, upon express request, in accordance with current legislation;
(viii) Request details of the public and private entities with which we share your Personal Data;
(ix) Obtain information about the possibility of not providing consent and the consequences of such refusal;
(x) Request details about the origin of your Personal Data or the sharing of such data with third parties;
(xi) Limit the use and disclosure of your Personal Data;
(xii) Revoke consent and/or object to any of our Processing activities of your Personal Data;
(xiii) Request the deletion of your Personal Data.

8.1.1. There are situations in which, if you request the deletion of your Personal Data, or request the limitation of use in Our Environments, it may be impossible to continue the relationship with Grupo Aço Cearense.

8.1.2. Some situations require the retention of your Personal Data after you request its deletion, to satisfy contractual obligations and/or under applicable law.

8.2. You may exercise your rights through the communication channels detailed in item 9 of this Policy, upon proof of identity by providing a copy of your ID or equivalent means of identification, in accordance with current legislation.

9. COMMUNICATION CHANNELS

9.1. Grupo Aço Cearense provides you with the following communication channels for any and all dealings related to this Policy and/or your Personal Data collected by us:

(i) Data Controller:

Name: Marcelo Rangel
privacy@acocearense.com.br

(ii) Privacy Portal:

https://previews.elleven.digital/acocearense/privacidade

(iii) By telephone:

55 85 40111333 (Ext.: 1614)

(iv) In person or by conventional mail:

Av. Barão de Studart, 300 – Meireles Fortaleza – CE, Zip Code: 60120-000 – Data Protection Officer

9.2. Grupo Aço Cearense will receive, investigate and/or respond, within a reasonable period of time, to any request or complaint about the way we process your Personal Data, including complaints about disrespect for your rights under current privacy and Personal Data protection laws.

9.3. In the event of communication without due proof of the identity of the Data Subject, as per item 8.2 above, the communication will be automatically rejected. Any and all identification information provided to Grupo Aço Cearense will only be processed in accordance with, and to the extent permitted by, applicable laws.

10. ABOUT THIS PRIVACY POLICY

10.1. Grupo Aço Cearense reserves the right to make changes to its privacy, data protection and information security practices, including this Privacy Policy and the Cookies Policy, at any time and without prior notice to you, according to the purpose or need of the Group, or for legal adequacy and compliance with a provision of law or regulation that has equivalent legal force.

10.2. We recommend that you access this Policy frequently, or whenever you access Our Environments or use our services, in order to ensure any updates or changes. The date of the last updated version will always be included at the end of this Policy.

10.3. If there are any updates to this Policy that imply new consent collection, you will be notified through the contact channels you have informed us of.