Ethics Line Channel of ZEN S.A.

1. This website is a confidential online tool operated by Deloitte Touche Tohmatsu ("DELOITTE") to enable employees, clients, suppliers and third parties of the"COMPANY" report suspected violations and/or deviations of the Code of Ethics, policies, and/or pertinent laws and regulations. The use of this website is entirely voluntary. We encourage you ("Whistleblower") to report possible violations and/or deviations through the Whistleblowing Channel, which is seen as a strong contribution to the good and ethical progress of "COMPANY" activities. However, if you feel more comfortable and secure you can use this channel to make your report.

2. Be aware that the information provided about you, your colleagues, third parties or any aspect of the "COMPANY" operations, may result in decisions that affect others. Therefore, we ask that you provide only information that, in your best knowledge, is correct, and complete. You will not be subject to retaliation by the "COMPANY", for any report of suspected violations and/or deviations of the Code of Ethics, "COMPANY" policies and/or pertinent laws and regulations made in good faith, even if, subsequently, the content turns out to be incorrect or unfounded.

Be aware, however, that the intentional provision of false or misleading information will not be tolerated.

3. When registering a report you can choose the form of identification you find most appropriate according to the following options:
Identified: You identify yourself and record your personal data, which may be viewed by the Ethics and Compliance Committee, by the Compliance team and by eventual investigators who will analyse your content. Identified manifestations are important for rapid and objective investigation.
Confidential: You identify yourself only to DELOITTE and will remain anonymous to the COMPANY. DELOITTE will contact you if it needs further information.
Anonymous: You do not identify yourself but may provide an optional email address to DELOITTE to contact you (even if fictitious).

4. A anonymous report is accepted, but it is recommended that you leave some form of identification or contact so that we can follow your case and ask possible questions. For this purpose, it is possible to share a fictitious email. In all situations, the information you submit will be treated in an absolutely confidential manner. If you choose anonymity, do not provide details in the report that may reveal your identity.

Although DELOITTE collects the registration of Internet Protocol Addresses (IPs) of the Protesters' computers (responsible for recording the report), this collection occurs only for the purposes of compliance with the determinations of the Internet Civil Framework (Law nº 12.964/2014) so that this data will not be used for your identification in the context of the Whistleblower Channel, which is Confidential ("Confidential Whistleblower Channel"), unless there is a legal obligation to the contrary direction.

5. The content, photographs, brands, titles, sounds, videos contained on this website, with the exception of personal data, files and information contained in the report, are the property of DELOITTE, and it is not authorized for reproduction, transmission, exploitation, storage or any other type of use. The Whistleblower assumes any and all liability, of a civil and/or criminal nature, for the misuse of any and all material of the website.

6. The content of the reports filled in the electronic form of the website is sole and exclusive responsibility of the Protester. DELOITTE is not responsible for any damage arising from reports recorded by third parties.

7. Any unauthorized access to the private areas of the website, as well as attempts or consummation of access to the source code, shall be considered acts of violation and shall be properly treated in accordance with applicable and pertinent legislation.

8. This document may be altered without the need of prior notice, as in cases of change in legislation. The Protester may periodically review the altered content to have access to such modifications.

ZEN S.A. values integrity, transparency and responsibility in the relationship with its public. Therefore, true and honest information and the caring about the ethical conduct of leaders, collaborators and suppliers are always valued.

Any act that disagrees with the company’s Code of Ethics and Conduct should be reported. In addition, any information or situation that can cause damage to any somewhat public is relevant, demands attention and needs to be reported to Ethics Line Channel of ZEN S.A.

Ethics Line Channel of ZEN S.A. is operated by Deloitte, a serious and independent company, which ensures the confidentiality of your information. There is no registration of the IPs of the users’ computers of the system via the internet.

Get to know the ZEN S.A Code of Ethics and Conduct by clicking here.

You can also register your report by sending an e-mail to linhaeticazen@ethicspeakup.com or by contacting us at 0800 721 9149.

By registering a report on this Confidential Whistleblower Channel (via website or toll free phone), you may provide us personal data (information that identifies or may lead to the identification of a natural person) and sensitive personal data (racial or ethnic origin, religious belief, political opinion, union membership, or religious, philosophical or political organization, health or sexual life data, genetic or biometric data) about you; Protester, denounced or third party mentioned in the report.

This Privacy Notice it is intended to clarify how DELOITTE treats your personal data and sensitive personal data (collectively referred to herein only as personal data) when you contact us to use the services of the Confidential Whistleblower Channel or when you are targeted or mentioned in a report.

All personal data collected in this Confidential Whistleblower Channel will be treated by DELOITTE in accordance with the provisions of the General Law on Protection of Personal Data (Law No. 13,709/2018 – "LGPD") and relevant regulations.

For more details on the measures we apply in the treatment of personal data, please visit DELOITTE's Privacy Policy via the link

1. What types of personal data are collected?

Will be collected only the personal data provided voluntarily by the Protester through the registration of the report in this Confidential Whistleblower Channel - via website or toll-free phone.

Any personal data informed in the report that is considered excessive, unnecessary or that has no relevance to the investigation of what happened will be disregarded and will only be stored for the purpose of maintaining the entirety of the original text contained in the report, for the period necessary to achieve the processing purposes.

Protester

The personal data of the Protester will be collected according to the identification profile chosen, and may include name, gender (statistical purposes), position, area, e-mail, telephone, mobile phone, type of audience and voice recording (reports via toll free phone).

In addition, any other personal data contained in the report and files attached by the Protester may be collected, which may include images, voice recordings and other types of personal data.

Denounced and third parties

The following personal data may be collected of the accused and third parties from a report voluntarily registered by the Protester:

i) first name, surname, position and workplace;
ii) description of suspected violation of the Company's Code of Ethics, policies, and/or applicable law and regulations, including all relevant facts and details;
iii) any other personal data that may be mentioned by the Protester during the description of the event, which may include images, voice recordings and other types of personal data.

This Confidential Whistleblower Channel is not designed or intentionally targeted to collect personal data from children and adolescents. However, in any situations where the collection of these types of personal data is necessary in the context of receipt and investigation of a report, the treatment will take place in the best interests of the child and / or adolescent and all provisions of the LGPD and pertinent regulations will be respected.

2. What is the purpose of collecting personal data?

Protester:

The processing of personal data aims to allow the identification and contact between DELOITTE and /or the COMPANY and the Protester to clarify doubts, collect additional information and progress of the investigations, respecting, in any case, the identification profile chosen by the Protester (identified, confidential or anonymous). In addition, this data may be processed for the purposes of compliance with legal or regulatory obligations, regular exercise of rights and statistical analysis (in an anonymized manner).

Denounced and third parties

The collection of this personal data is intended to verify the facts reported and take appropriate action, in accordance with applicable legislation. Such investigation will be carried out by the COMPANY, and DELOITTE is merely an intermediary, responsible only for the sharing of personal data and reports registered in this Confidential Whistleblower Channel. In addition, this data may be processed for the purposes of compliance with legal or regulatory obligations, regular exercise of rights and statistical analysis (in an anonymized manner).

3. What is the legal basis that justifies the processing of personal data?

All personal data collected will be processed based on the COMPANY's legitimate interests and sensitive personal data based on regular exercise of rights, since both treatments, in the context and scope of the services provided by DELOITTE, aim to assist the COMPANY in the investigation, prevention and mitigation of behaviors and misconduct that violate the COMPANY's Code of Ethics, internal policies, laws and regulations.

It is also possible that the processing of personal data and sensitive personal data occurs to comply with legal or regulatory obligations, depending on the alleged misconduct practiced.

4. With whom do we share the personal data collected?

The personal data of the Protester, denounced and third parties may be shared with:

i) The COMPANY, for the purposes of knowledge and investigation of the content of the report, always respecting the identification profile of the Protester;
ii) Authorities, Agencies and Government Entities, to comply with legal or regulatory obligations and regular exercise of rights;
iii) Technology companies that manage the integrated systems or responsible for the storage and guarantee of security in the processing of the personal data collected; and
iv) Third-party companies that will replace DELOITTE in the provision of Confidential Whistleblower Channel services to the COMPANY.

For more details on the shares described above, please contact the DELOITTE Clerk /DPO (Data Protection Officer) via the link Contact us.

5. How long is personal data stored?

Personal data will be kept only for as long as necessary to fulfill the purposes described in this document or as necessary to comply with legal or regulatory obligations and regular exercise of rights. When personal data is no longer necessary or relevant to the intended purposes, its erasure will be provided.

For statistical purposes, personal data will remain stored in an anonymized manner.

6. What are the rights relating to personal data?

According to the LGPD, the owners have several rights over their personal data, among them: confirmation of processing, access to personal data, updating and correction of incorrect, incomplete or inaccurate personal data; anonymisation, blocking and deletion of personal data that are unnecessary, excessive or non compliance with LGPD; opposition to the processing of personal data, when we no longer have a legitimate or legal need to process it; information on the sharing of personal data with public and private entities.

These rights are not absolute and should be interpreted in the light of legislation and other regulations. Thus, DELOITTE will evaluate legal claims individually in order to maintain the confidential nature of the Confidential Whistleblower Channel and not compromise the progress of investigations that may be ongoing with the COMPANY.

It is noteworthy that when the Protester chooses not to identify himself when recording the report, DELOITTE will not be able to guarantee access to the rights provided for in the LGPD since it will not have access to the identification data of the owner.

If you would like to access any of your rights provided for in the LGPD for free, please contact deloitte's DPO through the link Contact us.

7. Security

DELOITTE adopt technical and organisational measures to protect personal data from unauthorized access and accidental or unlawful situations of destruction, loss, alteration, communication or any form of improper or unlawful treatment.

In addition, access to personal data is restricted only to DELOITTE professionals who need to access it to develop activities related to the treatment of the report.

Whenever possible and applicable, anonymization and encryption techniques will be adopted for the security of personal data.

8. Alterations

This document may be changed without the need of prior notice, such as in cases of change in legislation or any decision or guidance of the National Personal Data Protection Authority ("ANPD"). The Protester may periodically review the altered content to have access to such modifications.