Responsibility and ethics are Amazon Aço's core values. We also recognize that building trust is essential as our focus on innovation to our consumers. That's why we implement technical and organizational measures to protect any personal data we process and update them as necessary.

At Amazon Aço, we are committed to maintaining a high standard of personal data protection and complying with law and legal department.

This Data Protection Policy is based on the provisions of the Brazil's Law of Data Protection No. 13,709/2018 and other complementary and/or modifying rules, being updated according to regulatory and technical needs, representing Amazon Aço's commitment to protect the processing of personal data collected from consumers, employees, customers, suppliers, service providers and other business partners.

Although the definitions of this policy guide Amazon Aço's commitment to all forms of processing of personal data by the company, we may implement complementary policies, including to regulate specific legal measures, such as measures with employees, partners, those arising from procedures applicable to physical and/or information security.

Anonymization: the use of reasonable technical means available at the time of Processing, by means of which the possibility of identification or association, direct or indirect, with an individual is lost.

ANPD: Brazil's National Data Protection Authority, the public administration body responsible for ensuring, implementing and monitoring compliance with the LGPD.

Blocking: temporary suspension of any Processing operation, by keeping Personal Data, Sensitive Data or the database.

Amazon Aço Privacy and Data Protection Committee: specific committee composed of Amazon Aço members, including the Personal Data and Sensitive Data Handler, to act in the adoption of measures and supervision to protect data privacy.

Consent: free, informed and unequivocal expression by which the Data Subject agrees to the processing of their Personal Data and Sensitive Data for a specific purpose.

Controller: a natural or legal person, governed by public or private law, who is responsible for decisions regarding the processing of Personal Data or Sensitive Data.

Personal Data: any information relating to an identified or identifiable natural person (such as name, identification number, location data, image, among others)

Sensitive Data: any personal data on racial or ethnic origin, religious conviction, political opinion, membership of a trade union or religious, philosophical or political organization, data relating to health or sex life, genetic or biometric data, when linked to a natural person.

Delete data: deletion of data or a set of data stored in a database, regardless of the procedure used.

Handler: a person appointed by Amazon Aço to act as a communication channel with the Owner and the ANPD.

Operator: a natural or legal person, governed by public or private law, who processes Personal Data and Sensitive Data on behalf of the Controller.

Portability: the possibility of sending data to another service or product provider.

Data User: natural person to whom the Personal Data and Sensitive Data processed by Amazon Aço.

International Data Transfer: transfer of Personal Data and/or Sensitive Data to a foreign country or international body of which the country is a member.

Processing: any operation carried out with Personal Data and/or Sensitive Data, such as those relating to the collection, production, reception, classification, use, access, reproduction, transmission and distribution, processing, archiving, storage, deletion, evaluation or control of information, modification, communication, transfer, dissemination or extraction.

For the sake of transparency, the Holder is fully aware of the Treatment activities that concern them, either through this policy or by contacting Amazon Aço directly.

Your Personal Data and/or Sensitive Data may be collected, processed and shared, with your consent or in compliance with other legal bases provided for in the LGPD, in fulfillment of the following purposes:

1. Sale of products from the Amazon Aço portfolio;
2. Customer service;
3. Advertising campaigns, marketing actions;
4. Conclusion and execution of contracts;
5. Improving the communications necessary for your relationship with Amazon Steel;
6. Carrying out other activities associated with the above operations.

Amazon Aço processes Personal Data and/or Sensitive Data for specific purposes. The processing of data carried out by Amazon Aço has a legitimate, specific and explicit purpose.

We may process Personal Data in the following cases:

1. For the purposes set out in this transparency policy;
2. For the fulfillment of a legal or regulatory obligation by the Controller;
3. For studies carried out by research organizations, guaranteeing, whenever possible, the anonymization of Personal Data and/or Sensitive Data;
4. When necessary for the execution of a contract, commercial relationship, or procedures connected with the relationship that Amazon Aço has with the Holder;
5.For the regular exercise of rights in legal, administrative or arbitration proceedings;
6. For the protection of the life or physical safety of the Card Holder or third parties;
7. In the event that the fundamental rights and freedoms of the Data User which require the protection of Personal Data and/or Sensitive Data prevail; or
8. For credit protection, including the provisions of the relevant legislation.

Amazon Aço recognizes the importance of the security of Personal Data and/or Sensitive Data. Appropriate technical and organizational measures are taken to ensure that data is processed in such a way as to protect it from accidental loss, destruction or damage that may affect its confidentiality or integrity.

With regard to the tools required for Processing, we guarantee that, during their design and/or development, we will check with the respective developers to ensure, where applicable, an adequate level of data protection.

Amazon Aço ensures the necessary measures for compliance with the principles of protection in the implementation of these tools, taking the characteristics of the data processed. We will use data anonymization or encryption techniques whenever possible and/or necessary.

We apply security policies at Amazon Aço to ensure that the data we process is transferred only to individuals authorized to access it and exclusively for the fulfillment of the purposes for which it was provided by the Holder, or in application of the corresponding legal basis. When an International Data Transfer is made, Amazon Aço will ensure that the entity in the recipient country complies with levels of protection compatible with national ones in accordance with the LGPD and applicable legislation. In the event that the recipient country does not provide such levels of protection, Amazon Aço will, prior to the transfer of data, take the necessary measures to provide adequate security for the processing of Personal Data and/or Sensitive Data in Brazil.

Amazon Aço is aware of the need to respect the rights of the Holder and, in this regard, recognizes the following rights:

1. to information;
2. access to data;
3. the correction of incomplete, inaccurate or outdated data;
4. the anonymization, blocking or deletion of data that is unnecessary, excessive or processed in breach of the provisions of the law;
5. the portability of data to another service or product provider, upon express request, in accordance with LGPD regulations, with due regard for commercial and industrial secrets;
6. the deletion of data processed with the consent of the Data Subject, except in the cases provided for by law;
7. information on the public and private entities with which the Controller has shared data;
8. information on the possibility of not providing consent and the consequences of refusing to do so; and
9. revocation of the Data Subject's consent.

Retention period and disposal of Personal Data and/or Sensitive Data Your Personal Data and/or Sensitive Data will be retained for the time necessary to fulfill the purpose for which they were collected and, upon exhaustion of this purpose, your data will be completely discarded and eliminated, except when necessary to comply with legal or regulatory requirements.

Requests received from Data User to exercise their rights throughout the processing period will be answered in the manner and within the time limits required by the applicable regulations.

Unless specifically indicated otherwise, the Data User may send requests to: protecao.dados@amazonaco.com.br

The Data User may also direct their request to: Amazon Aço Indústria e Comércio LTDA - Amazon Aço Privacy and Personal Data Protection Committee - Avenida Puraquequara, N° 5328, Puraquequara - Manaus - AM CEP: 69009-000.Avenida Puraquequara, N° 5328, Puraquequara - Manaus - AM CEP: 69009-000.

The Data User must clearly indicate their full name, insert a copy of an ID document and indicate the address to which the reply should be sent.

The Data Controller can be contacted at protecao.dados@amazonaco.com.br to answer any questions or for more information on this Data Protection Policy.

Amazon Aço reserves the right to change or update this Policy. The most recent version, will be accessible at https://dev.amazonaco.com.br/en/privacy-policy/ and we ask that you read it regularly.