INTRODUCTION AND PURPOSE OF THE POLICY

Industrial Madeireira S/A (“Vimasa”) is committed to the privacy and protection of the personal data of its visitors, customers, suppliers, employees, and business partners. To this end, this Privacy Policy aims to clarify in a transparent manner how we collect, use, store, process, share, and protect personal data through our institutional website and other digital communication channels, in compliance with the General Personal Data Protection Law (Law No. 13,709/2018 – “LGPD”), the General Data Protection Regulation (“GDPR”), and other applicable standards.

By accessing our website, the Data Subject declares, in a free, express, and informed manner, to have read, understood, and agreed to the terms of this Privacy Policy, consenting to the collection, storage, processing, and sharing of their data and information as set forth herein.

COLLECTION OF PERSONAL DATA

We collect personal data directly and indirectly, based on interactions performed on our website and communication channels:

1. Data Collected Directly

   When you fill out contact forms, request quotes, send suggestions, compliments, complaints, reports, or register to receive information, we may collect, among others:

   • Full name;
   • Email address;
   • Telephone number;
   • Company/Corporate name and Tax ID (CNPJ);
   • Business address;
   • Message or description of the request.

   The information provided in this contact may be collected, stored, processed, and monitored to ensure your security and privacy, as well as the quality of service.

2. Data Collected Automatically

   During your navigation on our website, certain technical and browsing data are automatically collected, including:

   • IP Address;
   • Browser type and version;
   • Operating system;
   • Pages visited and time spent;
   • Date and time of access;
   • Origin of access;
   • Cookies and similar technologies.

   If you access our site via a mobile device, we may record information such as the unique device identifier (“Device ID”), carrier, manufacturer, model, phone number, and, depending on your settings, approximate location data. We will never collect your exact location without your consent, but we may identify, for example, the city or country from which you are accessing. We may link the Device ID to contact information or other personal data you share with us.

3. Third-Party Data

   In specific situations, we may receive personal data through business partners, service providers (Processors), or public platforms, always based on the legal hypotheses provided for in the LGPD and GDPR.

4. Sensitive Data

   We will not, under any circumstances, process sensitive personal data without your explicit consent, defined as personal data revealing racial or ethnic origin, religious beliefs, political opinions, trade union membership, or data concerning health or sex life, genetic or biometric data.

PURPOSES OF DATA PROCESSING

The personal data collected is processed for the following purposes:

1. Primary Purposes

   • Commercial Communication: To respond to contact requests, quotes, and information about products and services;
   • Contractual Execution: To process orders, issue tax documents, perform deliveries, and provide after-sales support;
   • Relationship Management: To manage registrations, contracts, payments, and evaluate professional information for job openings;
   • Feedback Management: To receive, analyze, and respond to suggestions, compliments, complaints, and reports.

2. Secondary Purposes

   • Marketing and Institutional Communication: To send newsletters and promotional materials (subject to consent);
   • Service Improvement: To analyze browsing data to enhance user experience;
   • Security and Fraud Prevention: To protect our systems against unauthorized access and cyberattacks;
   • Legal Compliance: To meet legal, regulatory, and judicial requirements.

SHARING AND STORAGE OF DATA

We will not share information that identifies you, such as name or email, unless you grant specific permission. However, data may be shared with Processors or partners in the following cases:

• Service Providers: Companies contracted for technical support, hosting, email marketing, ERP/CRM systems, and logistics, always under contracts ensuring data protection;
• Business Partners: Partners necessary for contract execution and standard business activities;
• Public Authorities: When there is a legal obligation, court order, or request from competent authorities.

COOKIES AND TRACKING TECHNOLOGIES

Cookies are text files stored on your device to analyze preferences and browsing patterns. Types used include:

• Essential Cookies: Necessary for basic site functionality and security;
• Performance Cookies: To improve navigation based on usage;
• Functionality Cookies: To provide a personalized experience;
• Marketing Cookies: To display relevant ads.

You may manage or disable cookies via your browser settings, though disabling essential cookies may impair site functionality.

RIGHTS OF THE DATA SUBJECT

In accordance with the LGPD (Art. 18) and the GDPR, the Data Subject has the following rights:

• Confirmation and Access: To know if we process your data and obtain access to it;
• Rectification: To request the correction of incomplete or inaccurate data;
• Anonymization, Blocking, or Erasure: For unnecessary or excessive data;
• Portability: To transfer data to another service provider;
• Information on Sharing: To know which entities we share data with;
• Withdrawal of Consent: To revoke consent at any time.

Requests will be answered within a reasonable period, not exceeding 15 days, as determined by the LGPD.

SECURITY MEASURES

We adopt appropriate technical and organizational measures to protect personal data from unauthorized access or destruction. However, absolute security cannot be guaranteed. In the event of a security incident, we will notify the National Data Protection Authority (ANPD) and the affected Data Subjects as per applicable law.

LEGAL BASIS FOR PROCESSING

Data processing is based on the following legal grounds:

• Consent: For specific purposes (e.g., marketing);
• Performance of a Contract: Necessary for agreements where you are a party;
• Legal or Regulatory Obligation: When required by law;
• Legitimate Interest: To meet the legitimate interests of the Controller or third parties.

DATA RETENTION AND ERASURE

Personal data will be kept for the time necessary to fulfill the purposes of collection or to comply with legal obligations. Upon request for erasure, we will delete or anonymize data unless retention is required for legal compliance, judicial defense, or legitimate business interests..

CONTACT AND DATA PROTECTION OFFICER (DPO)

To exercise your rights or clarify doubts, please contact: