Basic Principles

1. What data may we collect?

“Personal Data” means any information relating to an individual that identifies them or makes them identifiable, excluding information in which the identity has been removed or cannot be associated with an individual (“Anonymized Data”). We may collect, use, store, process, and transfer different categories of Personal Data about an employee, obtained over the course of any relationship between us. Such Personal Data may include, but is not limited to, the following types of information:

a. Identity Data: Documents and/or personal information of the data subject and/or their children or spouse, including: first and last name, gender, nationality, date of birth, marital status, username, employee ID or similar identifier, and personal documents (RG, CPF, Voter Registration Card);

b. Employment Data: Work card number, social security number, degree of disability (if applicable), salary and other compensation, job description, work schedule, absences (particularly medical leave, special leave, maternity leave, parental leave), and when applicable, paid leave, as well as any additional data necessary to manage the employment relationship;

c. Contact Data: Address, mailing address, email address, and landline or mobile phone numbers;

d. Financial Data: Bank agency and account number, debit and credit card details, and credit history;

e. Transaction Data: Details regarding payments “to” and “from” the employee, as well as products and services provided and/or acquired;

f. Access Control Data: Access records via badge, and information from electronic monitoring and security systems such as CCTV (video recordings, access information, and time logs);

g. Technical Data: IP address, login information, browser type and version, time zone settings and location, browser plug-in types and versions, operating system and platform, and other technologies used on devices through which the employee accesses any of our websites, applications, or social networks;

h. Profile Data: Username and password, comments, and responses to surveys;

Health-related data may be collected and processed to comply with legal and regulatory obligations, particularly those under labor, social security, or welfare laws, as well as for the purposes of preventive medicine, occupational health, assessing employee fitness for work, and administering health plans and insurance programs; 

Likewise, biometric data required for entry into company facilities, access control, timekeeping, and other internal Company controls may be collected and processed strictly for these specific purposes;

Except where necessary to comply with applicable legal or regulatory requirements and/or to fulfill a specific labor or contractual obligation, we do not collect Sensitive Personal Data such as racial or ethnic origin, religious belief, political opinion, union membership or affiliation with a religious, philosophical, or political organization, health or sexual-life data, genetic data, or biometric data beyond what is required for access and security controls.

Personal data may be shared among Nagase’s internal departments and business units, with access granted only to identified employees and authorized partners who are able to address requests made by data subjects.

In compliance with applicable laws and regulations, personal data may also be shared with professional associations, national and international research institutions, authorities, public agencies, and health regulatory bodies whenever required by law, formal request, or court order.

Personal data may additionally be shared in the context of corporate transactions, such as acquisitions, mergers, consolidations, or corporate reorganizations.

Personal data may also be shared, as permitted by law, with the National Data Protection Authority (ANPD), when mandated by judicial authorities or any other legally empowered public authority.

All data transmissions will be conducted using encrypted digital systems that ensure privacy and security during transfer.

Such processing, use, or handling may occur, for example, for the following purposes:

• to enable us to effectively and efficiently perform and manage our operational and administrative activities;

• to ensure a consistent approach to employee management;

• to maintain compliance with laws, regulations, and internal policies, rules, and procedures; or

• to contact the employee or their family in case of emergency.

The Company may also process, use, and handle your data based on your explicit consent, when applicable. In cases where processing relies on consent, the employee should be aware that they may withdraw such consent at any time; however, withdrawal shall not affect the lawfulness of processing carried out prior to its revocation.

Data will be made available only to those who need access and/or must process it, primarily including the following areas: Human Resources, Corporate and Institutional Communications, Controlling and Finance, Legal, and Executive Management. In specific circumstances, your data may be shared with additional business areas, depending on the intended purpose.

We may need to share your personal data with certain third parties to fulfill the purpose for which the data was collected, comply with contractual, legal, or regulatory obligations, pursue our legitimate interests or those of third parties (whether engaged by us or not), and/or for credit protection.

In general, data will be shared in anonymized form whenever possible; however, individual (non-anonymized) data may need to be shared in certain situations, most commonly with the following recipients:

a) Service providers acting as data processors who perform essential activities related to our operations, including IT service providers and system administration services for Company websites;
b) Professional consultants and advisors, including attorneys, financial institutions, auditors, and insurers;
c) Public authorities, regulatory bodies, and labor unions, in circumstances established by law or collective labor agreements.

We require all third parties to maintain appropriate security measures and to process your personal data in accordance with applicable laws.

We do not permit our vendors or service providers to use employees’ personal data for any purpose other than those explicitly defined and in accordance with our formal instructions.

When personal data is shared with third parties, the contract shall require compliance with the General Data Protection Law (LGPD) and establish penalties for failure to meet legal and contractual obligations related to the protection of personal data. Contractual clauses will include, at a minimum:

• an obligation of confidentiality regarding personal data;

• a commitment to strict adherence to Nagase’s Policies and Procedures and those of its affiliates;

• compliance with Policies and Procedures related to information technology security; and

• the return or disposal of personal data at the end of the contract or when the data is no longer necessary for processing.

1. Context, Purpose, and Scope

To enable the integrated management of our operations, Nagase transfers personal data to companies within the Nagase Group, specifically to the headquarters NAGASE & CO., LTD., a foreign company duly registered in Brazil under CNPJ/MF No. 15.663.612/0001-31 in Japan, and to the subsidiary NAGASE AMERICA LLC, a foreign company duly registered in Brazil under CNPJ/MF No. 15.663.616/0001-10 in the United States.
The purposes of these transfers are strictly limited to:

• Global Human Resources management (career development, succession planning, evaluations);

• Centralized Information Technology (IT) systems support;

• Preparation of consolidated managerial and financial reports.

   

2. Binding Nature and Safeguards

This Policy and its associated procedures serve as the foundation for Nagase’s Global Corporate Rules (GCR), establishing a binding framework for all group entities that receive personal data.

Nagase ensures that the level of data protection in the destination countries will be no less stringent than the requirements established by the LGPD, adopting robust technical and organizational security measures. This document formalizes the appropriate safeguards for international transfers, which will be submitted to the ANPD for acknowledgment and transparency.

3. Legal Bases for Transfer

International data transfers carried out by Nagase are based on the following legal grounds under the LGPD:

• Execution of a contract, or preliminary procedures related to a contract to which the data subject is a party;

• Compliance with a legal or regulatory obligation by the controller;

• When necessary to meet the legitimate interests of the controller or a third party;

• Upon explicit and highlighted consent provided by the data subject.

The retention of personal data will occur exclusively for the period established by law or for as long as the data is necessary to fulfill the purposes set forth in this Privacy and Personal Data Protection Policy.

In situations involving administrative inquiries by Government Authorities or in judicial proceedings, the data will be preserved until a final decision is issued and no further administrative or judicial appeals remain available.

Nagase undertakes and affirms that it will always use systems designed to protect against loss, alteration, unauthorized access, unauthorized copying, unlawful use, or the misappropriation of personal data under its custody.

In the event of an incident that exposes, alters, compromises, or results in the unauthorized circulation of personal data under Nagase’s responsibility, users will be notified of the incident and of the measures to be taken as soon as possible.

The data subject is jointly responsible for the confidentiality of their personal data when they share their passwords or access credentials with other individuals or organizations in connection with Nagase’s service channels. Such conduct constitutes a violation of this Privacy Policy by the data subject.

Retention and Disposal of Personal Data

We will retain your Personal Data, in physical and/or electronic form, only for as long as necessary to fulfill the purposes for which it was collected, as well as for the retention periods established by law or required to safeguard rights and obligations.

To determine the appropriate retention period for your Personal Data, we consider the applicable statutory limitation periods, the volume, nature, and sensitivity of the Personal Data, the potential risk of harm arising from unauthorized use or disclosure, the purposes for which we process the data, and the legal requirements that apply.

The employee may withdraw their consent at any time and request the deletion of their data, and we will do so as promptly as possible, except for data necessary to comply with contractual, legal, regulatory, or legitimate interest obligations, which will be retained for as long as such obligations remain in effect.

In certain circumstances, such as for research or statistical purposes, we may anonymize your Personal Data so that it can no longer be associated with you. In such cases, the information is no longer considered Personal Data and may be used indefinitely for these specific purposes.

Examples of Personal Data and Document Retention and Disposal:

a) Human Resources: Data and documents are stored for the duration of the employee’s tenure with the Company and retained after the termination of the Employment Contract in order to comply with statutory retention periods established under labor, tax, and/or social security legislation;

b) Security Records: Images captured in areas monitored by cameras are retained for a predefined period. Badge and biometric data are retained for the duration of the employee’s tenure and, after termination of the Employment Contract, for the period necessary to comply with applicable labor regulations. Visitor data is retained according to a predetermined standard retention timeframe;

c) Audits or Administrative and Judicial Proceedings: Data and documents are archived for the period necessary to comply with applicable statutory limitation and expiration periods and may be retained longer, as a precautionary measure, in the event of administrative or judicial proceedings—until a final judgment is issued.

Physical data and documents that are no longer necessary or whose retention period has expired are destroyed—through shredding or another appropriate and secure method—on a quarterly, semiannual, or annual basis by the responsible managing area or by the Central Archive team, whichever holds custody of such documents.

Nagase is not responsible for the completeness, accuracy, or absence of data provided by the data subject through our service channels, nor is it responsible for outdated information when the provision or updating of such data is the responsibility of the data subject.

Any individual whose data has been collected by Nagase may, at any time, request:

• Information regarding which personal data Nagase holds;

• The updating or correction of personal data held by Nagase;

• The deletion or restriction of the use of personal data held by Nagase;

• The anonymization of unnecessary personal data;

• The portability of personal data from Nagase to another public or private organization;

• Objection to the processing of personal data by Nagase through the withdrawal of consent previously provided by the data subject.

Requests may be denied when justified on the basis of applicable legislation or if the data has already been deleted by Nagase within the legally established timeframe.

All rights described herein may be exercised directly through Nagase’s website, by telephone at (11) 3251-3111, or by email at contato@nagasebrasil.com.br

.

Each data subject may also submit questions or complaints to the National Data Protection Authority (ANPD) as provided by law.

Consumer registration data will be stored for a period of five (5) years after the end of the contractual relationship, in accordance with Articles 12 and 34 of the Consumer Protection Code.

Digital identification data will be stored for six (6) months, in accordance with Article 15 of the Brazilian Internet Civil Framework (Marco Civil da Internet).

Infractions

Any violation of this Privacy Policy by our employees may result in the initiation of an internal procedure to determine responsibility.

After due investigation, Nagase’s Executive Management will apply the legal and contractual measures applicable to those involved.

Nagase may amend this Personal Data Privacy Policy at any time.

Whenever a change substantially modifies the form, justification, or use of personal data, Nagase will seek to contact users, informing them of the changes and requesting a new consent agreement.

If it is not possible to contact the user/data subject, or if the data subject elects to exercise data portability or choose not to renew consent for the processing of their data, such data will be deleted or transferred according to the data subject’s decision.

Questions

All rights and provisions expressed herein may be exercised directly by data subjects through the following contact channels:

Name: Wataru Ishihara
Phone: +55 11 3251-3111
Centralized Contact Channel: contato@nagasebrasil.com.br

Published on: Dec/01/2025