Last updated: 05.25.2026

GranBio Investimentos S.A. (“GranBio”), CNPJ No. 14.191.427/0001-29, is the data controller of personal data collected through the website [www.granbio.com]. This document describes how we process your data in compliance with the Brazilian General Data Protection Law (LGPD — Law No. 13,709/2018).

1. Data Collected We may collect the following personal data: Provided directly by the user: name, email address, and phone number when filling out contact forms; Collected automatically: IP address, browser type, visited pages, and session duration through cookies and analytics tools; No sensitive personal data is collected for the purposes described in this policy.

2. Purpose of Processing The data may be used for the following purposes:
i. Responding to user inquiries and contact requests;
ii. Sending commercial and informational communications, subject to user consent;
iii. Improving website navigation and performance;
iv. Complying with legal and regulatory obligations.

3. Legal Basis Data processing is based on the following legal grounds under the LGPD:
i. Consent (Article 7, I): for sending marketing communications;
ii. Legitimate interest (Article 7, IX): for traffic analysis and website improvement;
iii. Performance of a contract (Article 7, V): when processing data to respond to client requests.

4. Data Sharing Your data may be shared with:
i. Employees, partners, and contracted service providers who require access to the collected information to deliver services;
ii. Affiliated, associated, subsidiary, parent, or controlled companies within the same economic group;
iii. Third parties necessary for management, advisory services, data analysis, operations, decentralized agencies, or in the event of corporate restructuring, mergers, demergers, or acquisitions involving GranBio;
iv. Competent authorities, when required by law or court order. GranBio does not sell or disclose personal data to third parties for profit.

5. Data Retention Data is stored for as long as necessary to fulfill the purposes described herein or to comply with legal obligations. After this period, it will be deleted or anonymized in accordance with Article 16 of the LGPD.

6. Data Subject Rights In accordance with the LGPD, users may exercise the following rights:
i. Confirmation of the existence of data processing;
ii. Access, correction, or deletion of personal data;
iii. Data portability;
iv. Withdrawal of consent at any time; v. Objection to processing based on legitimate interest. To exercise your rights, please contact our Data Protection Officer (DPO): juridico@granbio.com.br

7. Security We adopt appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or improper disclosure, including SSL encryption, access controls, among others.

8. Policy Updates This policy may be updated from time to time. Relevant changes will be communicated via the website or by email. We recommend that users review this document periodically.

9. Contact and DPO Data Protection Officer: Nathalia Emy Carvalho Fukuchi Email: juridico@granbio.com.br