Privacy Policy and Personal Data Protection

01Purpose

This Privacy Notice aims to transparently inform how i9DX Desenvolvimento e Soluções Tecnológicas Ltda. ("i9DX", "we" or "our") processes personal data in the course of its activities — including the development, licensing and commercialization of software and systems for financial market institutions, as well as the provision of related technical support, consulting and maintenance services.

i9DX is committed to the privacy and security of personal data under its responsibility, strictly observing applicable legislation, especially the LGPD.

02Scope

This policy applies to all personal data processing carried out by i9DX, including employees, service providers, clients and all other parties involved in the company's activities.

Compliance is mandatory for all professionals and partners who, in the scope of their activities, have access to personal data processed by i9DX. Exceptions must be formally approved by the data governance team.

03Data we collect

i9DX processes personal data in different operational contexts:

• Commercial relationships: for contract formalization with clients, we collect the minimum necessary data, such as the name of the legal representative, tax ID, role, phone number and corporate email.
• Employees and contractors: data required to fulfill applicable labor and contractual obligations.
• Technical support: in specific support situations, access to personal data strictly necessary to resolve the incident may occur.
• Cloud services: when clients opt for cloud-hosted deployments, aggregated data may be stored in our systems with appropriate security and confidentiality standards.

04How we use data

Personal data processed by i9DX is used exclusively for the purposes that justify its collection, including:

• Formalization and management of contracts with clients and partners
• Provision of technical support and maintenance services
• Compliance with legal, regulatory and contractual obligations
• Recruitment processes and employee management
• Communications related to contracted services
• Continuous improvement of the quality of systems and services offered

Processing is carried out under legal bases provided by the LGPD, including contract performance, compliance with legal or regulatory obligation, legitimate interest and, where applicable, the data subject's consent.

05Data sharing

i9DX may share personal data with third parties in the following situations:

• Service providers: companies contracted to support i9DX's operations (such as legal and accounting firms), who access data only to the strictly necessary extent and under contractual confidentiality obligations.
• Authorities and regulatory bodies: when required by law, court order or competent authority determination.
• Corporate restructuring: in cases of merger, acquisition or incorporation, to the extent necessary for service continuity.

In any case of sharing required by legal or court order, i9DX will notify the involved party within a maximum of 2 (two) business days, unless such communication is prohibited by law or by the requesting authority, disclosing only the content strictly required.

Servers used may be located outside Brazil, in secure and controlled environments, as governed by applicable terms of use and contracts.

06Data retention

Personal data is retained for the time necessary to fulfill the purposes for which it was collected. After that need is met, data is securely deleted, unless its retention is required by legal, regulatory or contractual obligation.

• Contractual data is retained for the duration of the contract and for the applicable statute of limitations after its termination.
• Recruitment data is processed based on consent or legitimate interest, solely for candidate evaluation, and deleted after the process concludes.
• Employee data is retained in accordance with applicable labor legislation.

07Information security

i9DX adopts technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration or destruction. Practices include:

• Physical and logical access management based on the principle of least privilege
• Segregation of duties to minimize risk exposure
• Mandatory periodic training for all employees
• Continuous monitoring of systems and critical infrastructure
• Password policies and authentication controls
• Encryption of data in transit and at rest where applicable

Any incident involving personal data must be immediately reported to the Data Protection Officer (DPO) through the channel indicated in section 10 of this policy.

08Your rights as a data subject

In accordance with the LGPD, data subjects have the following rights, which may be exercised by submitting a request to our DPO:

• Confirmation and access: to know whether we process your data and to obtain a copy.
• Correction: to request the update or correction of incomplete, inaccurate or outdated data.
• Anonymization, blocking or deletion: when data is unnecessary, excessive or processed in violation of the LGPD.
• Portability: to receive your data in an interoperable format for transfer to another service provider.
• Withdrawal of consent: where processing is based on consent, you may withdraw it at any time.
• Objection: to object to processing carried out under legal bases other than consent.
• Information on sharing: to know which public and private entities we share your data with.

09Changes to this policy

This Privacy Policy may be updated periodically to reflect changes in our practices, services or applicable legislation. The date of the last update is indicated at the top of this page.

We recommend checking this document periodically. Material changes will be communicated through the usual channels of contact with our clients and partners.

10Contact & DPO

For inquiries, requests to exercise your rights as a data subject, incident reports or any questions about personal data processing by i9DX, please contact our Data Protection Officer:

If you do not receive a satisfactory response, you may contact the Brazilian National Data Protection Authority (ANPD) at gov.br/anpd.