1. GENERAL INFORMATION FOR USERS OF THIS WEBSITE

1.1. At COLORADO companies — Açúcar e Etanol Oswaldo Ribeiro de Mendonça LTDA and Central Energética Morrinhos S/A — privacy and security are priorities, and we are committed to transparency in the processing of personal data and sensitive personal data of those who visit or use our website, applications, systems, and services, as well as employees who access our intranet, whether from inside or outside COLORADO, including all of its offices, facilities, branches where related activities are performed, or who use corporate email accounts.

1.2. This PRIVACY POLICY aims to clarify what types of personal data are collected, the reasons for such collection, and how these data will be processed. However, before addressing this matter, it is important that you understand that:
(a) personal data are all information that allows the identification of an individual, such as name, ID number, tax number, email, cookies, phone number, among others;
(b) sensitive personal data are those related to racial or ethnic origin, religious beliefs, political opinions, membership in unions or organizations of a religious, philosophical, or political nature, data relating to health or sexual life, genetic or biometric data when linked to a person; and
(c) personal data processing means any operation, such as collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, elimination, evaluation, control, modification, communication, transfer, dissemination, or extraction, performed with personal data.

1.3. By accessing or using our website, the user acknowledges that we will collect and use their personal information in strict compliance with the rules established by Law No. 13.709/2018 (“General Data Protection Law” or simply “LGPD”). To access this Law, click here: http://www.planalto.gov.br/ccivil_03/_ato2015-2018/2018/lei/l13709.htm

1.3.1. A “user” is defined as anyone who accesses our website to:
(a) obtain institutional information about the companies referred to in item 1.1, as well as our activities in the sugar-energy markets;
(b) request quotes and conduct transactions related to the supply of products and services associated with COLORADO’s activities;
(c) obtain information on news involving COLORADO, such as sustainability, social responsibility, volunteer programs, employee training, market participation, and public service announcements;
(d) obtain information about our contact email, phone numbers, social networks, and addresses of companies belonging to COLORADO;
(e) request information regarding sugarcane supply, such as invoices, income statements, completed payments, among other documents that may be made available in due course.

---

2. HOW DO WE COLLECT THE USER’S PERSONAL DATA?

2.1. Personal data are collected through websites, applications, systems, or services when the user accesses them, or when there is a cross-reference of personal data originally collected by different COLORADO-owned websites, obtained by filling out forms and accepting cookies.

2.2. A cookie is a small text file stored by your browser when you visit a website. Cookies may store certain information, such as your IP address, information about content you view, information you provide so that it does not need to be retyped on future visits, as well as preferences and settings.

2.3. Our website uses cookies only to register user access. Thus, the following information is captured and stored for a 6-month period:
– User IP address;
– Browser data: browser type, version, and device.

---

3. WHAT PERSONAL DATA DO WE COLLECT ABOUT THE USER?

3.1. The personal data collected include:
(a) general information which may include, but is not limited to: IP address, actions performed, URLs and screens accessed, dates and times of each action, pages and tools accessed, device information, operating system version, browser, installed applications and software, session and user ID, type of connection (Wi-Fi or mobile), geolocation, keywords used in searches or document sharing, comments, profiles, among other data that may be stored and retained;
(b) data for receiving announcements or news at physical or electronic addresses provided by the user;
(c) data required to apply for job opportunities, such as full name, email address, and professional experience information included in résumés;
(d) data related to service provider or supplier contracts and agricultural partnerships, such as qualification of legal representatives and other individuals involved, business emails, among others.

3.2. Regarding the collection and use of data by social networks where we maintain profiles, we are aware of their privacy policies (as they are public), but we have no influence over the processing of data collected by such platforms.

---

4. FOR WHAT PURPOSES DO WE USE THE USER’S PERSONAL DATA?

4.1. User personal data collected and stored by our website are intended to:
(a) generate statistics, studies, research, and project planning, and understand user activities and behaviors when using COLORADO websites, applications, systems, and services, so that we may improve our tools, making them more efficient and functional, and facilitating labor, commercial, and operational relations with COLORADO;
(b) improve website tools by understanding how users access and use our services, allowing us to correct failures and offer more efficient functionalities that facilitate interactions with COLORADO;
(c) provide employees with useful information, including news, public service announcements, and training-related notices;
(d) provide useful information about quotes submitted by suppliers; and
(e) safeguard COLORADO’s rights and obligations related to the use of websites, applications, systems, and services.

---

5. HOW LONG ARE THE USER’S PERSONAL DATA STORED?

5.1. User personal data are stored for the period necessary to fulfill their intended purpose, pursuant to Article 15, item I, of the LGPD. After this period, data may be removed or anonymized at the user’s request, except in cases where the law requires different treatment.

5.1.1. Pursuant to Article 16 of the LGPD, personal data must be kept for the following purposes:
“I – compliance with legal or regulatory obligations by the controller;
II – study by research bodies, ensuring anonymization whenever possible;
III – transfer to third parties, provided legal requirements are observed;
IV – exclusive use by the controller, provided access by third parties is prohibited and the data are anonymized.”

5.1.2. A “controller” is defined as the natural or legal person, under public or private law, responsible for decisions regarding the processing of personal data.

5.2. COLORADO establishes the following storage periods for personal information:
(a) E-procurement: Indefinitely
(b) Agricultural Contracts: Indefinitely

---

6. HOW IS THE USER’S PERSONAL DATA SECURED?

6.1. COLORADO undertakes to apply technical and organizational measures to protect personal data from unauthorized access, destruction, loss, alteration, communication, or dissemination. This includes situations in which COLORADO uses cloud data processing and storage, ensuring that the provider complies with LGPD requirements.

6.1.2. If the incident impacts multiple individuals, a notice will be published on COLORADO’s website; if it involves a specific or isolated case, the user will be notified via email.

6.2. Although COLORADO adopts all security measures to prevent incidents, it is possible that problems occur due exclusively to third parties—such as hacker or cracker attacks—or due to the user’s own fault, for example, when they share their information with third parties. In such cases, while COLORADO remains responsible for collected personal data, it is exempt from liability for situations beyond its control. In such cases, affected users and the National Data Protection Authority will be duly notified in accordance with the LGPD.

6.3. COLORADO undertakes to notify involved parties of any cyber security violations and vulnerabilities as soon as it becomes aware of the incident.

6.4. Stored personal data are treated confidentially within legal limits. However, we will cooperate with and comply with court orders or administrative authorities, and fulfill obligations requiring preventive reporting to competent authorities. This includes situations where the user violates obligations established in written agreements, terms, contracts, or any document signed with COLORADO.

---

7. HOW IS THE USER’S PERSONAL DATA SHARED?

7.1. Personal data are shared only under the following circumstances:
(a) if the user is participating in a recruitment process, their data will be shared between the Human Resources department and the department requesting the job opening;
(b) if the user is an employee, their data may be shared among the Human Resources, Finance, Workplace Safety, and Occupational Medicine departments, and externally with the partnered bank, Ministry of Labor, Ministry of Economy, Federal Savings Bank, and judicial authorities;
(c) if the user is a supplier or service provider, their data will only be accessed by duly authorized COLORADO personnel, respecting the principles of purpose, adequacy, objectivity, and necessity, among others, as well as confidentiality and privacy obligations described in this PRIVACY POLICY.

---

8. WILL THE STORED PERSONAL DATA BE TRANSFERRED TO THIRD PARTIES?

8.1. User personal data may be transferred to third parties—financial institutions, government agencies, service providers, or suppliers—solely to the extent necessary for them to fulfill contracts, agreements, or legal obligations.

---

9. INTERNATIONAL TRANSFER OF PERSONAL DATA

COLORADO may share your data with partners and suppliers based in other countries, always in compliance with applicable legislation and contractual requirements.

---

10. HOW IS CONSENT FOR COLLECTING AND STORING PERSONAL DATA PROVIDED?

10.1. When using the available resources, the user is required to give their consent by selecting the “Accept” field regarding our PRIVACY POLICY. Optionally, the user may access the link directing them to the full PRIVACY POLICY page. Consent will be required each time the user uses the resource.

10.2. The user guarantees the accuracy of personal data provided and may withdraw their consent at any time. To do so, they must contact us via email at lgpdgrupocolorado@colorado.com.br or send a written request by postal mail with a return receipt to:
COLORADO – Attn.: Legal Department
Rua Hum, nº 160, Orlândia/SP
ZIP Code 14620-000

10.3. Our Data Protection Officer (DPO) is Anderson Cleiton Ferraz, email: lgpdgrupocolorado@colorado.com.br.

---

11. WHAT ARE YOUR RIGHTS?

11.1. Article 18 of the LGPD grants data subjects the following rights:
(a) confirmation of data processing;
(b) access to data;
(c) correction of incomplete, inaccurate, or outdated data;
(d) anonymization, blocking, or deletion of unnecessary or excessive data, or data processed in noncompliance with the LGPD;
(e) portability of data to another service or product provider;
(f) deletion of data processed based on consent;
(g) information about public and private entities with which data have been shared;
(h) information about the option to deny consent and the consequences of such denial;
(i) revocation of consent.

11.2. You may exercise any of the rights granted by the LGPD at any time in your interaction with COLORADO by submitting a request as described in items 10.2 and 10.3 above.

11.3. Upon receiving a deletion request, COLORADO will assess, in accordance with the LGPD, whether data removal is permissible. Deletion will not be possible when required to fulfill legal obligations (labor, social security, tax, civil, or regulatory).

11.4. We will make all reasonable efforts to comply with user requests as promptly as possible. However, justified factors may delay or prevent immediate fulfillment. In such cases, we will inform you of the reasons for the delay.

11.5. Some requests may be legally rejected due to formal reasons (e.g., inability to verify identity) or legal reasons (e.g., requests to delete data whose retention is necessary for the company to exercise its rights). In such cases, we will also provide the appropriate justification.

---

12. PRIVACY BY DESIGN

COLORADO reaffirms its commitment to responsible personal data processing and, in compliance with the LGPD, adopts the principle of privacy by design in the development of any information system or business project.
Thus, we seek to implement the principles of “privacy by design” through proactive responsibility in the development of our services.

---

13. UPDATES

This Policy may be revised at any time and without prior notice, based on applicable legislation and organizational changes to ensure its relevance and effectiveness.
This Policy does not replace, modify, or extend any other policies governing your relationship with our company.
This Policy was created in February 2022, and to date no updates have been necessary. Should any changes occur, they will be recorded here. Thus, this is version no. 1.

---

14. WHAT IS THE JURISDICTION FOR RESOLVING DISPUTES ARISING FROM PERSONAL DATA PROTECTION?

14.1. Any disputes related to this PRIVACY POLICY shall be submitted to the courts of the judicial district of Orlândia, State of São Paulo, with express waiver of any other forum, however privileged.