1. INTRODUCTION

At BRK Ambiental, we are committed to protecting the personal data used in our activities. In this sense, this Privacy and Data Protection Policy contains clear and transparent information about the processing of personal data and how we protect data and its Subjects (as defined below).
The Data Subjects, when sharing their personal data with BRK Ambiental, agree with the rules of use, protection and security established herein, since the “consent” is only one of the legal grounds that legitimize the processing of personal data.
The following information is intended to inform the Subjects about BRK Ambiental’s commitments to data protection, in its capacity as entity in charge of the processing of his/her personal data.

2. PURPOSE

This Privacy and Data Protection Policy aims at informing the Subject on how his/her personal data is used, processed and protected by BRK Ambiental and the extent of his/her rights as a Subject of personal data, according to Brazilian laws.

3. DATA SUBJECTS AND THEIR PERSONAL DATA

Natural person (“Subject”) whose personal data processing is necessary to enable the rendering of water supply and sanitary sewage services in BRK Ambiental’s areas of operation (“Services”).
BRK Ambiental may process the following personal data of the Subjects, such processing being dependent upon compliance with the requirements set forth in the Data Protection General Law and other applicable laws:
• Name: full name;
• Personal Characteristics: gender, date of birth, photo;
• Parentage: mother’s name and father’s name, nationality, place of birth;
• Identification Documents: Identity Card (RG) and Taxpayer’s ID (CP)F, as well as scanned images of those documents, PIS/PASEP numbers;
• Contact information: home address, telephone, e-mail, mobile phone number;
• Financial information: bank data, credit score, financial and billing position inside BRK Ambiental;
• Health information: any information concerning the Subject’s health necessary to comply with legal and/or regulatory obligations;
• Professional information: professional history, level of education, training and other information collected during the selection process for job openings at BRK Ambiental;
• Others: voice recording, CDC/registration and consumption data from BRK Ambiental’s customers.

4. COLLECTED DATA

Personal data of data Subjects will be collected by BRK Ambiental as follows, to enable the purposes stated in item 5 of this Privacy Policy:
a. Data provided by the Subjects: personal data directly provided by the Subjects to BRK Ambiental, by filling in forms or by any other means.
b. Automatically collected data: personal data automatically collected by BRK Ambiental, through technological tools including, but not limited to, the IP number with date and time of access, characteristics of the device used for access, browser and accessed pages, with the purpose of disclosing products, services and prevention of undue and/or suspicious accesses.
c. Data collected from business partners or other sources: personal data collected by BRK Ambiental from its business partners or other sources

5. TREATMENT PURPOSE

BRK Ambiental uses personal data of the Subjects for the following purposes:
• Hiring, registration, supply, cancellation and interruption of the provision of the Services;
• Clients’ services regarding the Services provided;
• Billing and collection arising from the provision of Services;
• Communication with the client regarding the provision of the Services including, but not limited to information about scheduled interruptions, changes in service channels, new products and services;
• Payment of federal, state and/or municipal taxes, according to the tax laws in effect;
• Permission to access BRK Ambiental’s digital platforms and guarantee of operation of all functionalities made available by this service channel;
• Management and improvement of the services provided, including the preparation of reports for statistical purposes;
• Performance of administrative and operational activities and engagement of outsourced services required for purposes of the provision of the Services;
• Compliance with legal or regulatory obligations, as well as for the regular exercise of rights in judicial, administrative or arbitration proceedings.
Personal data of the Subjects may be used in other services directly provided by BRK Ambiental, as long as the purposes presented to the Subjects are respected or upon the Subjects’ prior consent, whenever there is a legal requirement in such sense.
BRK Ambiental may process personal data based on its lawful interest, always within the limits of the Subject’s expectation, and never to the detriment of his/her interests, rights and fundamental freedoms.

6. SHARING OF DATA

BRK Ambiental may assign, dispose of or share with third parties any information collected in the following events:
a. With partner companies, to the extent necessary to provide the Services, to meet the other purposes set forth in item 5 of this Privacy Policy;
b. With public or private government entities, regulatory agencies, and contract-letting agencies for the fulfillment of legal or regulatory obligations;
c. With any public or private entities, for various purposes, including offering or providing new services and facilities to the Subject;
d. To protect the interests of BRK Ambiental, and its economic group in any type of conflict, including credit protection, judicial, administrative or arbitration proceedings;
e. In the case of corporate transactions and changes involving BRK Ambiental, in which case the transfer of information will be necessary for the continuity of its activities;
f. By virtue of a judicial or arbitral order, or at the request of administrative authorities having legal jurisdiction to make such request;
g. Companies of the same economic and financial group as BRK Ambiental, to meet purposes directly related to the corporate governance model.
Additionally, it is possible that some of the foregoing transfers may occur outside the Brazilian territory, in which case BRK Ambiental undertakes to do so in the manner allowed by the applicable laws.

7. PERSONAL DATA SECURITY

Any personal data of the Subjects is processed by BRK Ambiental according to the strictest security standards, in its own servers and/or in those of third parties hired for this purpose.
As a general standard, BRK Ambiental adopts all reasonable measures used in the market to ensure the security of its systems and the of the processed personal data, in compliance with the guidelines on security standards established in the applicable laws and regulations, such as:
• Use of standard market methods to encrypt and anonymize the collected data in order to render it unreadable and to prevent unauthorized persons from accessing it;
• Use of software to protect against unauthorized access to its systems
• Restricted access of employees to the Subjects’ personal data, limiting access to the contents that is essential for the development of the intended activity.
BRK Ambiental maintains a privacy governance program applied to its activities and governance structure aiming at the protection of personal data and, additionally, ensures that its employees and third parties who process personal data undertake to keep the absolute secrecy of the accessed information, as well as to adopt the best practices for handling such information, as determined by the applicable laws.
Although BRK Ambiental uses its best efforts to preserve privacy and protect personal data processed by it, no transmission of information is fully secure, so that BRK Ambiental cannot fully guarantee that all information received and/or sent will not be subject to unauthorized access perpetrated by means of methods designed to improperly obtain information, such as technical failures, viruses or intrusions. However, in the unlikely event of occurrence of episodes of this nature, BRK Ambiental endures the use of all efforts to remedy the consequences of the event.

8. RIGHTS OF THE SUBJECTS

In accordance with the laws concerning the processing of personal data, BRK Ambiental assures to the Subjects the possibility of:
a. Confirming the existence of data processing;
b. Accessing the data;
c. Correcting any incomplete, inaccurate or outdated data;
d. Requesting the anonymization, blocking or exclusion of data that is unnecessary, excessive or processed in violation of the law;
e. Requesting the exclusion of data processed legally based on consent;
f. Obtaining information about public or private entities with which BRK Ambiental shared the Subject’s data;
g. Requesting information on whether or not the data Subject’s consent is required for the purposes of processing personal data, and the possible consequences;
h. Revoking the consent, when necessary, for the processing of personal data.
The foregoing rights may be exercised by the Subject through BRK Ambiental’s website or physical service points.
BRK Ambiental will use its best efforts to meet the requests of the Subjects within the shortest possible period. However, factors such as the complexity of the requested action may impact the time it takes to meet the requests, the term for which, whenever requested by the Subjects, shall be duly justified.
Data Subjects should be aware that the aforementioned requests may be declined, provided that justified, whether for formal reasons (such as their inability to prove their identity), or legal reasons, such as the request for exclusion of data the maintenance of which constitutes free exercise of right by BRK Ambiental.

9. DIGITAL PLATFORMS

Cookies and their use
According to common usage practices on the Internet, BRK Ambiental may use “Cookies” technology on its digital platforms to obtain marketing information of audience segmentation or customize the site according to the profile of the user accessing its platforms.
As a rule, Cookies refer to records of activity, including the IP address of the device used for access, accessed pages, the dates and times, information about the used device, operating system version, browser, among other installed applications. There are typically four categories of Cookies:
Strictly Necessary: These are Cookies essential for the technological platforms to load correctly and to allow platform users to navigate correctly, as well as to use of all available features.
Performance: – These are Cookies that help BRK Ambiental understand how users of the platform interact with the page, providing information about the visited areas, the time spent visiting the site, and any other problems found, such as error messages.
Functionality: These are Cookies that allow the website to memorize the user’s choices of platform, to provide a customized experience. They also allow users to watch videos and use social tools, offer comment fields, forums, among others.
Advertising: These are Cookies used to provide relevant contents of interest to users of the platform. They can be used to present advertising with a larger targeting or to limit the number of advertisements on BRK Ambiental’s pages. They also allow the measurement of the effectiveness of an advertising campaign, for example.

BRK Ambiental uses Cookies for the following purposes:
a. To facilitate the use and better adapt its digital platforms to the interests and needs of those accessing such digital platforms.
b. To assist and improve the structures and contents of its digital platforms.
c. To optimize the use of its services by the Subjects.
d. To carry on statistics and metrics of the services provided on its digital platforms.
Users of digital platforms are reserved the right to browse without the use of Cookies other than the strictly necessary ones, which are essential for the operation of digital platforms. The permission (opt-in) to use Cookies, or its revocation (opt-out) may be done through the option that BRK Ambiental websites offer on the main page or, when not available, through the browser.

10. ELECTRONIC PLATFORM SECURITY

BRK Ambiental is not liable for any other site that may be accessed from ours, and there is no link between any such site and the technological platforms of BRK Ambiental. Still in this context, BRK Ambiental is not liable for, neither endorses, the contents of sites which have links for redirection on its digital platforms.

11. CHANGES TO THIS POLICY

This Privacy and Data Protection Policy may be updated from time to time. Therefore, we recommend that you periodically visit this page so that you are aware of the modifications. It is essential that users of BRK Ambiental’s digital platforms, as well as the Data Subjects, make sure to be fully aware of the contents of this Privacy and Data Protection Policy, as well as commit to reading any communication sent with respect to changes in the Privacy and Data Protection Policy.