BAMBOO INVESTIMENTOS ALTERNATIVOS LTDA., a business entity headquartered at Rua Gomes de Carvalho, nº 1.629, conjunto 142, São Paulo – SP, CEP: 04547-006, registered under CNPJ No. 42.932.190/0001-25 (“BAMBOO” or “we/us/our”), values the privacy of its clients, partners, suppliers, and other users (“user” or “you”).’

Therefore, BAMBOO has prepared this Privacy Policy (“Policy” or “Privacy Policy”) to reflect our commitment to ensuring the privacy, protection of personal data, and information security of our users when you visit and/or interact with our Website and/or our Platform (collectively, the “Platform”).

Through this Policy, we aim to demonstrate in a clear and transparent manner how we handle your information.

It is very important that you read this document carefully and contact us, as indicated at the end of this document, if you have any questions.

BY USING THE PLATFORM OR PROVIDING YOUR PERSONAL DATA, YOU ACKNOWLEDGE AND AGREE TO THE PRACTICES DESCRIBED IN THIS POLICY. IF YOU DO NOT AGREE WITH THIS POLICY, PLEASE DO NOT REGISTER ON OUR PLATFORM, ACCESS, BROWSE, OR USE THE PLATFORM.

For the purposes of this Privacy Policy:

Personal Data: refers to any information that, directly or indirectly, identifies or could identify a natural person, such as name, CPF, date of birth, IP address, among others. It includes the concept of Sensitive Personal Data.

Sensitive Personal Data: refers to any information that reveals, regarding a natural person, racial or ethnic origin, religious beliefs, political opinions, union membership or affiliation with a religious, philosophical, or political organization, health or sexual life data, genetic or biometric data.

Data Protection Officer: refers to the person designated by BAMBOO to act as the communication channel between BAMBOO, the data subjects, including you, and the National Data Protection Authority ("ANPD").

LGPD: refers to Law No. 13.709/2018, the General Data Protection Law.

Other terms defined and used in this Policy, unless altered, will have the same meaning as assigned to them in the Terms of Use and/or applicable laws.

BAMBOO may collect the following Personal Data that will be provided (i) directly by you; or (ii) automatically collected about you, as follows:

Information provided directly by you:

Contact Us: On the "Contact Us" page, the user may actively input Personal Data into the platform, such as first name, last name, email address, phone number, and any other information in the content of their message sent to us.

Careers: When contacting us for potential participation in a recruitment and selection process, the user may actively provide Personal Data into the platform, such as name, email, and other information contained in their resume and message.

Registration Information: If you wish to use the tools and services available on our platform, either as an Originating User, Investor User, or their representatives, you will need to register on our platform. In this case, we will collect the following information about you: first name, last name, business email address, business phone number, mobile phone number, company you belong to, and your position in the company

Information automatically collected about you:

When navigating or logging into the platform, without any direct interaction with us, through the use of various technologies, BAMBOO may collect information such as:

Browsing Information: Information about the browser and device you are using, your IP address, your location, the website address from which you arrived, using technological tools that include cookies. For more information, please refer to our "Technologies used by BAMBOO" section

Investment Information: All allocations in Offers made by the user will also be linked to their profile. For example, we may know which investments you made, the date of the investments, the amounts invested, the offers you participated in, and the sectors you showed interest in, using the technological tool Google Firebase. For more information, refer to our "Technologies used by BAMBOO" section. This data will be linked to the person you represent when accessing the platform, for example, your employer.

You acknowledge that you are solely responsible for the truthfulness, accuracy, and authenticity of the data provided directly by you, and you are solely responsible in this regard.

We do not collect or intend to collect or infer Sensitive Personal Data from users.

We do not collect or intentionally request Personal Data from individuals under 18 (eighteen) years of age. If you are under 18 (eighteen), please do not use the platform and/or provide any data.

Cookies

Cookies are small text files placed on your computer or other devices when you visit a website. The use of cookies helps websites recognize your device on subsequent visits. Additionally, cookies collect general information, such as how users access and use websites or the region of the country through which they access the websites.

When you visit the Platform, it may store or retrieve information in your browser, either in the form of cookies or other similar technologies. Cookies are used to ensure that our website functions more efficiently and provides information to the website owners about its performance. This ensures that you can make full use of the website's functionality. A cookie can adjust the operation of our site/platform to your needs, likes, and dislikes by collecting and remembering data about your personalized preferences. A cookie will not give us access to your computer files or any data about you.

Our cookies have different functions:

Essential Cookies: Some cookies are essential for accessing specific areas of our website. They enable navigation and the use of the website’s applications, such as accessing secure areas of the site through login. Without these cookies, services that require them cannot be provided.

Analytical Cookies: We use these cookies to analyze how users interact with the website and monitor the performance of the Platform. This allows us to provide a high-quality experience by personalizing our offerings and quickly identifying and fixing any issues that arise. For example, we use performance cookies to identify the most popular pages, determine the most effective method of linking pages, or understand why some pages receive error messages. Based on the use of the Platform, we may also use these cookies to highlight articles or services on the Platform that we think may interest users. These cookies are used only for statistical creation and analysis, without ever collecting personal information. We use Google Analytics. For more information, click here.

Third-party Cookies: These are used to measure the success of applications and the effectiveness of third-party advertisements on our website.

All internet browsers allow users to accept, refuse, or delete cookies or to receive notifications about receiving cookies by selecting the appropriate settings in the respective browser. You can configure cookies in the "options" or "preferences" menu of your browser. Below are links with more details on how to adjust cookie preferences in the most popular internet browsers:

• Google Chrome
• Mozilla Firefox
• Safari
• Internet Explorer
• Microsoft Edge
• Opera

Note that by disabling cookies, you may prevent some web services from functioning properly, affecting, either partially or entirely, the browsing experience and user interaction with the site.

Google Analytics for Firebase

Firebase is a digital application development platform launched by Google. We use Firebase in the development of our Platform and utilize the "Google Analytics" feature to measure the performance and other usage data of the Platform. Through Google Analytics, it is possible to understand basic interactions with the Platform, such as how often it is accessed, the frequency of operations performed, and how many users were active during a given period. Additionally, demographic information and user interests are also available. For more information on Google Analytics for Firebase, click here.

We collect and process personal data primarily to fulfill our legal or regulatory obligations; to comply with the contract established with you, as applicable; based on your consent; and also based on our legitimate interest in managing our activities. Examples of how we use personal data include:

• In the case of users who express interest in working with us, to assess their qualifications and profile for a potential open position.
• For users who contact us via "Contact Us", to provide effective user service or technical support.
• For all users, to allow you to access and use the platform.
• To conduct analytical studies regarding platform usage and user interactions, as mentioned in the "Technologies used by BAMBOO" section
• To enable the sending of email marketing and newsletters.
• For users registered on the platform, to maintain access logs, in compliance with the Internet Civil Framework (Marco Civil da Internet).
• For the personalized offering of products, based on investments made by you (and your company).
• To fulfill our legal and regulatory obligations, particularly with the regulations of the Securities and Exchange Commission (“CVM”).
• To insert watermarks in documents viewed or downloaded by users, as a means of preventing data leakage and maintaining the confidentiality of documents and information accessed by the user.
• Bamboo DCM will process your personal data only for the purposes communicated to you, unless we deem it necessary for other purposes compatible with the original ones, and there is a legal basis for further processing.

We do not disclose your Personal Data to third parties in a way that would be considered a sale or commercialization. BAMBOO will only share your Personal Data with those who have a legitimate need to access it. Whenever BAMBOO allows a third party to access Personal Data, BAMBOO ensures that the data will be used in a manner consistent with this Privacy Policy and any other applicable guidelines.

• Your Personal Data may be shared with third parties, such as service providers, other business partners, and/or competent authorities for legitimate purposes as follows:
• To perform services on the Platform (for example, when there is a software malfunction and we need technical support from a third party);
• For the legitimate exercise of rights in judicial, administrative, or arbitral proceedings, including preventing harm or threat to rights;
• To comply with legal, regulatory, or contractual obligations to which we are subject or respond to a judicial or administrative process, audit, or legal requests from public and law enforcement authorities, when we believe we are legally obligated to do so;
• In the context of BAMBOO’s corporate restructuring operations;
• In the case of Investor Users, with Originator Users, and vice versa, so they can conduct negotiations and for Originator Users to understand who is interested in their operations.

Your Personal Data may also be shared with companies that are part of the same economic group as BAMBOO. This sharing is carried out to facilitate an Offer or to provide other services related to an Offer.

The personal data of users who send us information through "Contact Us" is stored only for as long as necessary to address your request/respond to your inquiries, unless there is any other reason that justifies further retention, such as compliance with legal, regulatory, or contractual obligations, defense of our rights in any judicial or administrative process, among others.

The personal data, including the résumé, sent by users through "Join Our Team" will be stored for 12 months, unless there is any other reason that justifies further retention, such as compliance with legal, regulatory, or contractual obligations, defense of our rights in any judicial or administrative process, among others.

The personal data of Originating Users and Investor Users, as well as their transaction information on the Platform, are maintained as long as the user is active on the Platform, unless there is any other reason that justifies further retention, such as compliance with legal, regulatory, or contractual obligations, defense of our rights in any judicial or administrative process, among others.

BAMBOO processes your Personal Data both domestically and internationally. When we transfer your data to another country, for example, in the case of cloud data storage, we will ensure that the transfer complies with applicable regulations and is conducted in a way that preserves your rights.

You, individual user, may exercise the following rights at any time:

• confirmation that your Personal Data is being processed;
• access to your Personal Data;
• corrections to incomplete, inaccurate, or outdated data;
• anonymization, blocking, or deletion of unnecessary, excessive data, or data processed in non-compliance with the law;
• portability of Personal Data to another service provider, provided that this does not affect our trade and industrial secrets;
• deletion of Personal Data processed with your consent, to the extent permitted by law;
• request information about the entities with whom your Personal Data has been shared;
• request information about the possibility of not providing consent and the consequences of refusal, when applicable;
• revocation of consent, when applicable.

Additionally, whenever applicable, you may request a review of decisions made solely based on automated processing of personal data that affects your interests. Users will always be notified if any Personal Data processing involves automated processes. Moreover, users can object to the processing of Personal Data. In the Platform, there is automated data processing: creating a profile for the targeting of products of interest.

Please note that there are exceptions to these rights. For instance, it will not be possible to delete your data if we are legally required to retain it or if we have other legitimate purposes for doing so. Similarly, access to your data may be denied if the information provided could reveal Personal Data of others or, even, information that could disclose our business secrets.

If you have created an account on the Platform, you can access and update some or all of your personal information in your account settings or profile page. If this is not possible, or if the right you wish to exercise is not related to the rectification of your data, you may contact us directly through the email dpo@bamboodcm.com..

Upon receiving your request, we will contact you and may ask for additional information to verify your identity. Please note that we may limit or deny your request if we cannot verify your identity.

We take commercially reasonable precautions to protect the confidentiality, integrity, and security of your personal information. Therefore, BAMBOO adopts appropriate technical, physical, and organizational measures to prevent the breach of Personal Data. For example, BAMBOO employs physical and digital access controls, firewalls, and antivirus software on its machines, conducts regular monitoring and scanning procedures on its equipment, uses encryption, requires access passwords, two-factor authentication, applies challenge-response (captcha), and other measures on the Platform. BAMBOO staff or third parties contracted by BAMBOO who have access to Personal Data are required to keep this information confidential and comply with internal security policies and procedures. Third parties with whom we share your Personal Data are also required to maintain measures that ensure the security of your Personal Data.

Any legally required disclosures in the event of a security incident will be promptly communicated to you via email or made publicly available on BAMBOO's communication channels, as well as to the competent authorities, including the National Data Protection Authority, as necessary.

If you have reasons to believe that your interaction with us is no longer secure or that your identifying data has been accessed improperly, you should immediately notify us via email at dpo@bamboodcm.com..

We reserve the right to modify this Privacy Policy at any time by posting the updated text on the Platform and the updated effective date at the bottom of this page. As we add new features and functionalities to our Platform or as applicable laws evolve, we may need to update or revise this Privacy Policy. We reserve the right to do so at any time without prior notice by posting a revised version on our Platform. The changes will take effect from the date we publish a revised version on our website.

If we make changes to this Privacy Policy that materially alter the way we handle your Personal Data, we will make reasonable efforts to notify you immediately through reasonable means.

If you wish to exercise any of the rights provided in this Privacy Policy or resolve any questions related to the processing of your Personal Data, please contact us via email at dpo@bamboodcm.com or at the address Rua Gomes de Carvalho, nº 1.629, conjunto 142, São Paulo – SP, ZIP: 04547-006.

For your information, our Data Protection Officer is Edson Catarino de Paula.