Version 1.0 — effective 4 July 2026.

This Data Processing Agreement ("DPA") supplements the main agreement ("Agreement") between ECOMILHAS TECNOLOGIA LTDA (CNPJ 46.740.714/0001-37 — "ECOMILHAS") and the corporate client ("Client") that subscribes to the ESG goal-based variable-compensation program and other corporate services (the "Services"). It applies whenever ECOMILHAS processes personal data on behalf of the Client, in accordance with the LGPD, GDPR, UK GDPR, APPI, CCPA/CPRA and other applicable data protection laws.

In case of conflict on data protection, this DPA prevails over the Agreement.

1. Roles of the parties

For Client employee data processed within the Services, the Client is the Controller and ECOMILHAS acts as Processor, following the Client’s documented instructions. Where ECOMILHAS determines its own purposes and means (e.g., fraud prevention, legal compliance, generating carbon credits from trips), it acts as an independent Controller under the Privacy Policy.

2. Subject matter, nature and purpose

• Subject matter: processing of personal data necessary to provide the Services.
• Nature: collection, recording, organisation, storage, use, sharing with sub-processors, deletion.
• Purpose: enabling ESG benefits, validating trips, calculating rewards and producing decarbonisation reports.
• Duration: the term of the Agreement, plus statutory retention periods.

3. Categories of data subjects and data (Annex I)

• Data subjects: employees and representatives designated by the Client.
• Data: identification (name, corporate email, internal ID), employment link, trip and mobility data, geolocation, ecomilhas and rewards. Not intended for sensitive data; the Client must not submit it.

4. ECOMILHAS obligations (Processor)

ECOMILHAS will: (a) process data only on the Client’s documented instructions and the law; (b) ensure confidentiality of authorised persons; (c) implement the security measures in Annex II; (d) assist the Client, as far as possible, with data-subject requests, impact assessments and consultations with authorities; (e) notify the Client of security incidents without undue delay after becoming aware; (f) on termination, delete or return the data, save mandatory retention; (g) make available information to demonstrate compliance and allow audits under Section 8.

5. Client obligations (Controller)

The Client warrants that it has a legal basis for the processing and for providing the data to ECOMILHAS, that its instructions are lawful, that it has informed its employees as required by law, and that it has obtained any required consents (including for background geolocation, where applicable).

6. Sub-processors

The Client authorises ECOMILHAS to engage sub-processors (e.g., cloud providers, payment/Mastercard processors, PIX, analytics and communications) under contracts with protection obligations equivalent to this DPA. ECOMILHAS keeps a list of sub-processors available on request and will inform of material changes with reasonable notice, allowing the Client to raise a reasoned objection.

7. International transfers