Hwesta thanks you for your interest in our products and services. Your privacy is important to us, and therefore we are committed to the correct and ethical processing of your personal data.

We process your personal data based on how you interact with Hwesta and its products (online, offline, by phone, etc.). Whenever we do so, we comply with all the principles of Federal Law No. 13,709 of August 14, 2018 (“General Data Protection Law” or “LGPD”), such as respect for purpose, adequacy, necessity, free access, quality, transparency, security, prevention, non-discrimination, accountability, and international best practices for personal data protection.

For all purposes, this document, referred to as the “Privacy Notice,” outlines how we handle personal data, explaining how your personal data is collected and used by HWESTA, as well as the procedure for requesting the exercise of your rights guaranteed under the LGPD.

This notice applies to individuals (natural persons) who interact with HWESTA's services (“you”). Our services are not directed to individuals under the age of 18 (eighteen).

General Provisions on the Processing of Personal Data

When visiting HWESTA's websites or applications, you can browse various sections without being requested to provide any type of information. However, to access certain features of the Websites or applications, the User must provide certain necessary personal data.

Access to and use of the websites and applications depend, in several cases, on the collection and processing of personal data, and such processing will take place in accordance with the provisions of this External Privacy Notice. Collected information will be deleted when it is no longer useful for the purposes set forth in this Privacy Notice, except when necessary to meet other supervening purposes, comply with legal or regulatory obligations, present a judicial defense, transfer to a third party, or for the exclusive and anonymized use by HWESTA.

Likewise, when you contact our IVR (Interactive Voice Response) system or Customer Service (SAC) by phone, the system or attendants may request personal information to validate your identity. In any case, this information will be treated with due confidentiality. We work hard to ensure your privacy.

Our websites, applications, IVR, and Customer Service do not process, nor do they intend to process, personal data of individuals under the age of 18 (eighteen). If you are a minor and wish to contact us, please seek the assistance of your parents or legal guardian. In the event that data of minors is processed during service, the provisions of current Brazilian legislation will apply, ensuring the best interests of the child or adolescent at all times.

Sources of Personal Data

We collect your personal data through the following sources:

Information provided directly by you:

• (a) e-mail, login, and password;
• (b) name;
• (c) occupation/line of business;
• (d) date of birth;
• (e) sex/gender;
• (f) social media details;
• (g) RG (Identity Card) and CPF/CNPJ (Taxpayer IDs);
• (h) address/phone number;
• (i) any information describing your demographics or behavioral characteristics, such as age or age range, geographic location (e.g., ZIP/Postal code), favorite products, hobbies, interests, and family information (e.g., number of children) or lifestyle;
• (j) information that allows us to better understand your consumer profile, such as transactions made on our websites;
• (k) information you voluntarily share with HWESTA regarding your experience using our products and services, such as complaints, satisfaction surveys, and requests for improvement; and
• (l) other data you may otherwise voluntarily provide to HWESTA.

Eventually, we may request additional information or documents to confirm the accuracy of the data provided to us.

The personal data listed above may be processed by HWESTA for the following purposes:

• a) To allow you to contact us through our communication channels;
• b) To allow access to features that require logging into the restricted area of our websites and applications;
• c) To allow you to register or request registration in programs and surveys;
• d) To allow communication for support requests and conducting surveys;
• e) To allow the sending of communications about our products, services, programs, and activities in general, via SMS, e-mail, phone, social media, among others;
• f) To allow the sending of product samples exclusively classified as food and/or promotional gifts;
• g) To allow the understanding of your behavior and consumer profile, based, for example, on transactions carried out on our websites;
• h) To improve and personalize your experience on our websites and applications through the analysis of preferences and habits;
• i) To ensure that the content of our websites and applications is optimized for the user and their computer or device;
• j) To send targeted advertising and content to the user;
• k) To allow you to participate in interactive features when you choose to do so;
• l) To allow us to offer you the opportunity to participate in our loyalty programs containing exclusive discounts and benefits.

Information collected automatically from our websites and applications:

In addition to the aforementioned data, information may be collected automatically, such as URLs, IP addresses (with date and time), pages accessed, searches performed, browsers used, access time, number of clicks or downloads, and survey results.

This data may be processed for the following purposes:

• a) To comply with legal obligations regarding the retention of access logs;
• b) To allow continuous technical improvement of our websites, fixing errors, adapting content to the most widely used devices, and prioritizing the performance of this portal;
• c) To allow constant improvement of our products and services.

Other forms of personal data collection:

• Electronic mail and instant messaging systems (such as WhatsApp and similar): Services used to maintain electronic communications between you and HWESTA.
• Offline logs: Forms filled out offline, distributed during events, and other interactions with HWESTA.

Use of Cookies, Log Files, and Similar Technologies

Cookies are small text files that can be placed on your computer or mobile device by websites or services visited on the web. They are used to ensure the proper functioning of websites and other online services.

At HWESTA, cookies are used to improve the performance of our portal and understand how you interact with our services.

Our websites also feature other tracking technologies similar to cookies, such as pixels, which enable the collection of information like IP addresses, log files, and web beacons, among others. This data is also used to help us adapt our websites and other services to your personal needs.

Most browsers allow you to manage the cookies placed on your devices; however, by disabling certain types of cookies, you may encounter difficulties accessing all features of our websites.

Remember that cookie collection preferences must be adjusted on each device used to access our websites.

It is important to highlight that HWESTA is not responsible for the use of cookies by third parties. Be aware, as cookies placed by third parties may eventually monitor your online activities even after leaving our website.

Retention and Termination of Personal Data Processing

In accordance with current legislation, HWESTA uses your personal data only for the time necessary to fulfill the purposes described in this notice. It is possible that some personal data may be retained after these purposes are fulfilled if relevant to comply with legal requirements, to enable HWESTA to exercise its rights, or for other activities that are justified and in the interest of HWESTA and/or other companies with whom this data was shared, always in accordance with applicable legislation.

Sharing and Transfer of Your Personal Data

Your personal data is only shared when necessary, such as in the situations described below:

• a) when involving companies belonging to the HWESTA group and affiliated companies;
• b) when necessary for the provision of HWESTA products and services, including on our websites and applications. In this case, we may share personal data with partner companies;
• c) when necessary for corporate transactions, subject to safeguards to ensure the secure and confidential processing of the shared data;
• d) when necessary to comply with a legal obligation or upon the express request of competent public authorities; and
• e) when necessary to defend HWESTA's interests in administrative, arbitration, or judicial proceedings. In this case, we may share personal data with law firms and other legal representatives.

HWESTA’s websites and applications may provide links to other websites managed by third parties. HWESTA, however, is not responsible for the content of these sites, nor for the processing and security of the information entered on those portals. In case of redirection, we recommend reading the terms of use and privacy policies of those domains.

Disclosure, Storage, and Security of Your Personal Data

HWESTA adopts appropriate and reasonable measures to ensure that personal data under our responsibility is kept confidential and secure, excluding information shared by you in public areas of our sites, such as our official social media pages.

We store your personal data in operating environments that feature reasonable security measures, both technical and administrative, to prevent security incidents, which include but are not limited to unauthorized access, disclosure, loss, alteration, or destruction of personal data. We follow reasonable protocols to protect your personal data.

Furthermore, HWESTA employs technological systems and information security measures compatible with the best security resources offered by the market, such as antiviruses and firewalls.

It is worth noting that our employees or authorized agents may process your personal data, having limited access to the personal information necessary for the development of their activities, which relate to the purposes described in this notice, always respecting the principles and rules established in the applicable legislation.

It is important that you also do your part to protect your personal data. For example, when creating an online account, remember:

• a) your password is personal and non-transferable. Never reveal it to anyone;
• b) to use complex password combinations, avoiding the compromise of this information's confidentiality;
• c) when using a shared or public computer, never choose the option to remember your login name, e-mail address, or password. Furthermore, upon finishing, ensure that you have logged out of your account.

If you identify or become aware of any activity that compromises the security of your personal data, please contact us immediately via e-mail at: [email protected].

Rights Regarding Your Personal Data (LGPD & GDPR)

The LGPD and the GDPR (General Data Protection Regulation) introduced strict rights regarding your personal data.

Thus, in addition to concerning ourselves with the security of this information, we also guarantee that you have access to and knowledge of all rights relating to your personal data and how to exercise them. Depending on your location and the applicable jurisdiction, your rights include:

• Right to Confirmation and Access: Right to request confirmation of the existence of the processing and to request access to your personal data processed by HWESTA;
• Right to Rectification: Right to request the correction or update of your personal data, provided it is incorrect, inaccurate, or outdated;
• Right to Erasure ("Right to be Forgotten"): Right to request the deletion, blocking, or anonymization of your personal data if you believe the processing was excessive, unnecessary, carried out in non-compliance with the legislation, or if you withdraw your consent;
• Right to Restriction of Processing: Right to request the limitation of the processing of your personal data under certain conditions, as provided by the GDPR;
• Right to Object: Right to request opposition to the processing of your personal data based on legitimate interests or if you believe the processing was carried out in non-compliance with data protection laws;
• Right to Data Portability: Right to request the portability of your personal data to another service or product provider, pursuant to the regulations of the competent supervisory authorities (such as the ANPD or European Data Protection Authorities);
• Right to Withdraw Consent: Right to revoke any consent previously provided for the processing of your personal data at any time, easily and free of charge;
• Right to Information on Sharing: Right to request information about the public and private entities with which HWESTA has shared your personal data;
• Right to Information on Consequences: Right to request information about the possibility of not providing consent and the negative consequences of such refusal;
• Right to Object to Automated Decision-Making: Right to request a review of decisions taken solely on automated processing (including profiling/without human intervention) provided they affect your interests or produce legal effects; and
• Right to Lodge a Complaint: Right to petition and lodge a complaint with a supervisory authority (such as the National Data Protection Authority - ANPD in Brazil, or an EU Data Protection Authority) if you believe your rights have been infringed and you cannot resolve the issue directly with HWESTA.

To submit requests to exercise your rights, please contact our privacy and personal data protection department at: [email protected]

The processing of these requests depends on meeting the minimum criteria stated above, as well as identity validation and the technical and legal feasibility of fulfilling these requests, within the limits of applicable law.

Privacy Notice Change History

We reserve the right to make changes to this privacy notice at any time, always in accordance with current legislation.

Last modified: May 06, 2026