PRIVACY POLICY SUMMARY

Brazil Iron Limited is a private iron ore exploration and mining company, registered in the United Kingdom (registration number: 07941434). At Brazil Iron, we take individual privacy very seriously. Therefore, any relationship between us that involves the processing of your personal data will always be guided by legality and security, ultimately preserving your right to informational self-determination.

Originating in the United Kingdom, Brazil Iron Mineração Limitada has operated under privacy protection legislation since May 2018, when the European GDPR, or General Data Protection Regulation, came into force. Therefore, when the Brazilian LGPD, or General Personal Data Protection Law, came into effect in September 2020, we were already ahead in preserving your privacy!

We diligently advocate for the conscious and legitimate use of personal data belonging to our employees, visitors, partners, and any other natural person with whom we have contact. Under no circumstances do we use your personal data for direct commercial purposes, such as buying or selling databases.

Below, you will find access to our Privacy Policy, which provides a simplified explanation of our personal data processing procedures. However, should you have any questions regarding the processing activities, please do not hesitate to contact our Data Protection Officer via email at ouvidoria@braziliron.com.br.

UPDATING YOUR CONTACT PREFERENCES

In instances where we contact you for purposes other than fulfilling a legal or regulatory obligation, or for the drafting or execution of a contract to which you are a party or intend to become a party, we will ALWAYS grant you maximum autonomy to determine the exact moment such processing should be interrupted. Therefore, any communication made by Brazil Iron, which has a legal basis other than those listed above, will allow for the full exercise of your right to object, either through a specific link at the end of the communication, in the case of emails, or through your express declaration in the case of telephone contacts.

Nevertheless, should you observe any type of processing of your personal data to which you object, please contact our Data Protection Officer immediately via email at ouvidoria@braziliron.com.br, so that they can make the necessary corrections or, if that is not possible, clarify the legal reasons for such processing.

METHODS BY WHICH WE COLLECT INFORMATION

Brazil Iron Mineração Limitada is a mining company with strictly B2B (Business to Business) operations, and does not have individual final consumers. For this reason, the overwhelming majority of personal data processed by the company belongs to its own employees, collected during recruitment, selection, and hiring processes. However, there are instances where you may actively contact us, and in some cases, this contact may lead to registration depending on the reason for contact.

Therefore, we collect data from employees during onboarding processes, from website visitors via cookies (see cookie policy at the end), and from individuals who contact us through our official channels to address requested issues.

Brazil Iron Mineração Limitada does not purchase or enrich databases.

INFORMATION WE COLLECT

Depending on your relationship with Brazil Iron Mineração Limitada, we will always process your data in observance of necessity and adequacy, with the aim of achieving the intended purpose within each operation.

This means that when you apply for a position in a recruitment and selection process, we will collect the data strictly necessary and appropriate for conducting this process, such as your name, contact details, academic and professional history, resume, salary expectation, etc.

In cases where data collection occurs due to contact initiated by you, the information collected will be limited to that necessary to process your request, such as in the case of a public inquiry made to our ombudsman.

RISKS AND INCIDENTS

While we take your privacy with utmost seriousness, no organization can absolutely guarantee the invulnerability of its information systems. For this reason, we work diligently and constantly to add increasing maturity to our information security processes and tools. Nevertheless, even this work cannot guarantee the non-occurrence of incidents. Therefore, we ask that if you observe any circumstance that might suggest the occurrence of a security incident in our systems, please contact us immediately so that we can take all appropriate mitigation and remediation measures.

WHERE YOUR INFORMATION IS STORED

Your information will be stored according to the processing operation to which it pertains. This means that in some cases it will be stored on Brazil Iron’s servers, and in others, it may be stored on third-party servers, such as cloud services.

Regardless of the processing purpose, we rigorously and judiciously select the third parties with whom we share your personal data, ensuring that all involved in the processing chain are able to, at a minimum, demonstrate full compliance with Brazilian and European personal data protection legislation (LGPD and GDPR).

HOW LONG WE STORE INFORMATION

Your personal data is retained according to the purpose of its processing. This means that we will only keep your data for the necessary period to achieve the proposed purposes, whether for the execution of a contract, compliance with a legal obligation, or even for the preservation of Brazil Iron’s own rights.

Nevertheless, regardless of the reason for which we store your data, you have the right to confirm the existence of such processing, request access to this data, and even request its correction in cases of proven error or outdatedness.

All these rights and those listed below can be exercised by contacting our Data Protection Officer via email at ouvidoria@braziliron.com.br.

YOUR RIGHTS

The General Personal Data Protection Law establishes a series of rights that can be exercised by the data subject, depending on the circumstances of its processing. We list the main ones below. Should you wish to exercise any of them, please contact our Data Protection Officer via email at ouvidoria@braziliron.com.br, at which time we will promptly address your request or, if it is not possible to comply, we will explain in detail the reasons for it.

• Every natural person is assured ownership of their personal data and guaranteed the fundamental rights to freedom, intimacy, and privacy, in accordance with this Law.
• The data subject has the right to obtain from the controller, regarding the data processed by them, at any time and upon request:

I – Confirmation of the existence of processing;
II – Access to data;
III – Correction of incomplete, inaccurate, or outdated data;
IV – Anonymization, blocking, or elimination of unnecessary, excessive, or unlawfully processed data;
V – Data portability to another service or product provider, upon express request, in accordance with national authority regulations, observing commercial and industrial secrets;
VI – Elimination of personal data processed with the data subject’s consent, except in the cases provided for in Article 16 of this Law;
VII – Information on public and private entities with which the controller shared data;
VIII – Information on the possibility of not providing consent and on the consequences of refusal;
IX – Revocation of consent, in accordance with § 5 of Article 8 of this Law.