DATA PRIVACY POLICY

‍DOCUMENT CONTROL

DOCUMENT CONTROL
Date: January/2023 - Department: Compliance - Version: 001 - Changes/Inclusions: Policy creation
Date: April/2025 - Department: Compliance - Version: 002 - Changes/Inclusions: Policy translation

EFFECTIVE DATE
The Data Privacy Policy is of a permanent nature.

The content of this document may be modified at any time according to current needs.Always refer to the latest available version when necessary.

1. Introduction and Glossary
Your privacy is very important to us. We are committed to respecting the confidentiality of information and individuals’ privacy. This Policy outlines how Trace Finance processes personal data in compliance with current laws and regulations.

This Privacy Policy applies to the processing of personal data from clients, potential clients, job applicants, visitors to Trace Finance offices, websites and platforms, suppliers, and partners.

To make this document easier to understand, we’ve included definitions of key terms below:
‍
• LGPD: The LGPD is the Brazilian General Data Protection Law.It introduces new protective principles and rules for how companies handle individuals’ data. The law’s goal is to give you more privacy, freedom, transparency, and control over your personal data.

• Personal Data: Any information related to a natural person that can identify or make them identifiable in a given context.Examples include name, tax ID number, passport number, address, phone number, email, and IP address.

• Sensitive Data: Information related to racial or ethnic origin, religious beliefs, political opinions, union membership, health, sexual life, genetic or biometric data, when linked to a person.

• Processing: The ways in which Trace Finance uses personal data, including but not limited to: collection, storage, consultation, sharing, classification, reproduction, processing, and analysis.

• Legal Grounds: Legal justifications that allow Trace Finance to process personal data, such as your consent or compliance with legal obligations.

• Data Subject: You—the individual to whom the personal data refers. You may be a client, a client’s representative, or a job applicant.

• Platform or Website: The websites and applications owned by Trace Finance.

2. Information Security
Trace adopts technical and organizational procedures to ensure that your information is always secure. As part of these procedures, we regularly train and raise awareness among all our employees about the importance of maintaining, safeguarding, and respecting your personal information. We take data privacy violations very seriously, which is why we constantly monitor for breaches and apply appropriate disciplinary measures, along with establishing technological infrastructure to prevent data leaks.

3. What data does Trace Finance collect?
Data may be provided through forms, surveys, email, websites, mail, applications,phone calls, contracts, or by submitting personal documents.

Types of Data Collected
Personal data is requested for identification and qualification purposes depending on the specific use case.
Registration data such as name, email, phone number, gender, home address, CPF(tax ID), identification document, date of birth
Financial data such as average monthly income and net worth.
Professional data such as professional experience, current employer and job title ,education, and languages.
Sensitive data such as ethnicity or whether the person has a disability.
Operational data such as documents involved in the use of our services.

Purpose of Data Collection
Registration and Operations: To allow your registration and access to our products and services, such as the global banking platform and foreign exchange operations.Some data is required to comply with legal obligations, while others are needed to ensure your account’s security.
Work with us: We use our website and LinkedIn to publicize open job positions so you can apply to available opportunities.
Contact us: We ask for basic contact information (like name and email or phone) so you can reach our support team.

4. Why does Trace Finance collect and use your personal data?
I. To create your account
We need to verify your identity and qualifications in order to validate you as a client.The use of your personal information is necessary to confirm who you are, as we have a legal obligation to comply with "Know Your Customer" (KYC) regulations and other regulatory requirements related to the Fraud Prevention Program.
II. To provide the contracted services
Once your account is opened, we will need to use your personal data to perform our services and fulfill our obligations. We use this information to process orders and execute the purchase and sale of products and services as requested, based on our contractual relationship with you, in order to meet our contractual duties.
‍
III. To comply with legal obligations
There are a variety of legal requirements arising from applicable laws to which we and our partners are subject (e.g., financial services legislation, tax laws, etc.). We are also subject to oversight by various regulatory authorities. These legal obligations require us to carry out personal data processing activities for identity verification, compliance with court orders, tax laws, and other regulations.

IV. To send communications and satisfaction surveys
From time to time, we may send you communications and satisfaction surveys as part of our customer feedback process. It is in our legitimate interest to gather this feedback to ensure that our services and products are delivered at the highest standard.

V. To analyze behavior on our websites
Our websites may contain data analysis tools that allow us to understand user behavior to ensure quality and provide the best user experience. The information collected is not considered personal under the terms of the General Data Protection Law (LGPD), as it is anonymized and not linked to any identifiable user.


VI. For marketing purposes
We may use your personal data to send you marketing communications by email, phone, or other agreed-upon methods (including social media campaigns), to keep you informed about our products and services. These communications will be based on your consent. If you do not wish to receive marketing materials from Trace Finance, simply notify us and we will promptly remove your email from our marketing database.

VII. To ensure asset protection and physical safety
If you visit our facilities, we may record your image through our surveillance systems for security purposes. We also collect personal information to provide access credentials, helping maintain a secure work environment.

IX. To prevent fraud and ensure data subject security
We need to process personal data for fraud analysis and prevention in various scenarios. Additionally, we may process personal information to protect data subjects from potential crimes, intrusion attempts, and to ensure the security of our assets.

X. To protect legitimate interests
We process personal data to safeguard our legitimate interests. Examples of such activities include:
• Initiating legal claims and preparing our defense in legal disputes;
• Analyzing financial transactions to generate strategic reports;
• Implementing monitoring systems at our facilities for security purposes;
• Business management, performance optimization, and development of new products and services;
• Reviewing and updating your personal data in the context of anti-money laundering compliance.

XI. To manage relationships with third parties
We must verify your identity and qualifications to validate you as a third party. The use of your personal information is necessary to confirm who you are, in line with best practices such as "Know Your Employee" and "Know Your Supplier," and consistent with the standards of our Integrity Program.

5. Legal Bases Used by Trace Finance

• Consent: This legal basis allows the processing of personal databased on the data subject’s free, informed, and unambiguous expression of will in agreeing to the processing of their personal data for a specific purpose as informed by Trace Finance. In cases involving the processing of sensitive data, consent must be given explicitly and specifically for each intended purpose.

• Legitimate Interest: This basis allows the processing of your data (even without your consent), whenever the use of that data is necessary to serve the legitimate interests of Trace or third parties. The law states that these interests will only be considered legitimate if the data usage does not conflict with Brazilian legislation, and provided that transparency is ensured and your rights are respected.

• Contract Execution: The LGPD authorizes the processing of personal data when it is necessary for the execution of a contract or for preliminary procedures related to a contract to which the data subject is a party, upon the data subject’s request. In other words, data may be processed when it is essential to the provision of products and services at the request of the data subject, or to take steps before entering into a contract. Personal data may also be processed under this basis in employment relationships, as such processing is essential throughout the legal relationship between employer and employee, regardless of whether data processing activities are explicitly stated in the employment contract.

• Compliance with Legal or Regulatory Obligation: The processing of various personal data in certain economic sectors is required by law or regulation, especially in regulated sectors such as financial services, private healthcare, insurance, etc.

6. Sharing of Personal Data
In accordance with the criteria set forth in this Policy, Trace Finance will not disclose its clients’ personal data to third parties, except in the following cases:
• To comply with applicable laws, rules, or regulations;
• Where there is a legal obligation to disclose;
• When there is a legitimate interest requiring disclosure; or
• At the client’s request, with their consent.

Third-party entities with which personal information is shared in order to provide contracted services must handle the data in a way that ensures compliance with legal obligations. Even so, we require any organization outside of Trace Finance that handles or accesses personal data to recognize the sensitivity of this information, respect all individual privacy rights, and comply with all relevant data protection laws.

Below are some situations in which Trace Finance may share your personal data:

a) Third-party entities such as commercial service providers and consultants. Trace acts as an intermediary for account opening and foreign exchange correspondence.Therefore, we share registration and operational data with partners that perform these services. Depending on the product or service, when opening a global account, information may be sent to a different jurisdiction to fulfill the contract between the parties, meaning the data processing laws may differ from those established by theBrazilian LGPD.

b) Specialized third parties hired for administrative, financial, legal, security, research, and other services

c) Third parties performing auditing tasks.

d) Business partners, credit providers, courts, supervisory bodies, and regulatory authorities.

e) Payment service providers and/or financial institutions for generating and managing payments.

f) If we disclose your personal data to business partners such as payment companies in order to perform requested services, those partners may store your data to comply with their own legal obligations.

g) Any person or company, provided we have your consent.

Trace Finance is not responsible for the use of cookies by third parties. Be aware that cookies placed by third parties may continue to track your online activity even after you leave our website. It is recommended that you delete these cookies manually.

If you wish to remove cookies stored on your computer, you can delete them manually using your browser settings. For example, follow the instructions provided by GoogleChrome, Mozilla Firefox, Microsoft Edge or Safari. Please note that deleting certain cookies may render some website features unavailable.

7. Data Retention Period
Your personal data is stored only for as long as necessary to fulfill the purposes for which it was collected, unless there is another legal reason to retain it—such as compliance with legal, regulatory, contractual, or other obligations—provided these are supported by a valid legal basis.
For example, data related to financial transactions carried out within the BrazilianNational Financial System must be stored for 10 (ten) years, as required by the Central Bank of Brazil.

8. What are your rights as a data subject?
Your personal data belongs to you, and Brazilian law grants you a number of rights in relation to it. We are committed to ensuring these rights are respected, and in this section, we explain how you can exercise them with Trace Finance. The BrazilianGeneral Data Protection Law (LGPD) guarantees you the following rights:

• Confirmation and Access: You have the right to confirm whether we process your personal data, and, if so, to request a copy of the personal data we hold about you.

• Correction: You may request the correction of incomplete, inaccurate, or outdated personal data

• Anonymization, Blocking, or Deletion: You may request that we: (a) anonymize your data, making it no longer identifiable and therefore no longer considered personal data; (b) block your data, suspending our ability to process it temporarily; or (c)delete your data, in which case we will erase it completely and irreversibly, except in cases where the law requires otherwise.

• Data Portability: You have the right to request, through an express request, that Trace Finance provide your personal data to you or to a third party of your choice, in a structured and interoperable format, allowing its transfer to another service or product provider—provided this does not violate Trace Finance’s intellectual property or trade secrets.

• Information on Sharing: You have the right to know which public and private entities Trace shares your data with. If you have questions or want more details, you can request this information from us.

• Information About the Option Not to Consent: You have the right to receive clear and complete information about the possibility and consequences of not giving consent. Your consent, when required, must be free and informed. Therefore, whenever we ask for your consent, you are free to decline—although in such cases, we may be unable to offer certain services.

• Withdrawal of Consent: You have the right to withdraw your consent regarding data processing activities based on that consent. This will not affect the legality of data processing carried out before the withdrawal. If you withdraw your consent, we may be unable to provide certain services, and we will inform you of this if applicable.

• Objection: The law allows personal data to be processed without consent under certain conditions. If you disagree with such processing, in some cases you may object and request that the processing be stopped.

9. Contact Information
We have appointed a professional responsible for overseeing matters related to thisPrivacy Policy and data protection.If you have any questions about how to access your data or exercise your rights as a data subject, please contact us through our LGPD Channel:
https://forms.gle/kQAay2uZujyyWmAD7

10. Legal Notice
Trace Finance is not responsible for the misuse or loss of personal data to which it does not have access or control. We are also not liable for the illegal or unauthorized use of such information as a result of the misuse or compromise of your login credentials, negligence, or malicious conduct, whether caused by you or by someone authorized to act on your behalf.


‍
‍‍