Privacy Policy

We, GRANVITAL INDÚSTRIA E COMÉRCIO DE ALIMENTOS LTDA-ME (“Company”), registered with the CNPJ/ME under number 08.986.657/0001-81 and headquartered in the City of Toledo, State of Paraná, at Estrada da Usina, s/nº, km 5, quadra E, Lote 01, Tecnoparque, take your privacy and the protection of your data seriously. This document explains how we process your personal data, what your rights are, and how you can exercise them.

1. BASIC CONCEPTS: WHAT DO YOU NEED TO KNOW TO UNDERSTAND THIS POLICY?

In order to simplify your reading of this document, we present some useful definitions for its interpretation. These terms will be used in capital letters:

2. What types of personal data does the company process?

The types of Personal Data and how the Company collects them depend on your relationship with the Company and why. For example, the Personal Data collected will differ depending on whether you are a purchaser of the products we offer or a user of our website.

Below are some situations in which we may process your Personal Data in the context of your relationship with the Company:

3. With whom does the company share your personal data?

We operate in partnership with a number of other organizations to enable our activities. In addition, as we provide a public service, we have a duty to transmit certain information to law enforcement and government authorities, as required by law. We describe here some situations in which we may share Personal Data:

4. What are your rights as a personal data subject?

Your Personal Data belongs to you, and Brazilian law guarantees you a series of rights related to it. We are committed to upholding these rights, and in this section, we will explain what these rights are and how you can exercise them. See below:

IMPORTANT NOTICES

For your security, whenever you submit a request to exercise your rights, the Company may request some additional information and/or documents to verify your identity and prevent fraud. We do this to ensure the security and privacy of everyone.

In some cases, the Company may have legitimate reasons for not fulfilling a request to exercise rights. These situations include, for example, cases where disclosing specific information could violate intellectual property rights or trade secrets of the Company or third parties, as well as cases where data deletion requests cannot be fulfilled due to the Company’s obligation to retain data, whether to comply with legal or regulatory obligations or to enable the defense of the Company or third parties in disputes of any nature.

Furthermore, some requests may not be answered immediately, but the Company undertakes to respond to all requests within a reasonable timeframe and always in accordance with applicable law.

If you have any questions about these issues or about how you can exercise your rights, please feel free to contact us through the channels provided at the end of this Policy.

5. HOW LONG WILL PERSONAL DATA BE STORED?

The Company has a Personal Data retention policy aligned with applicable law. Personal Data is stored only for as long as necessary to fulfill the purposes for which it was collected, unless there is any other reason for its retention, such as compliance with any legal, regulatory, contractual obligations, or others permitted by law.

We always conduct a technical analysis to determine the appropriate retention period for each type of Personal Data collected, considering its nature, the need for collection, and the purpose for which it will be processed, as well as any retention needs for compliance with obligations or the safeguarding of rights.

6. HOW DOES THE COMPANY PROTECT YOUR PERSONAL DATA?

Our responsibility is to care for your Personal Data and use it only for the purposes described in this Policy. To guarantee your privacy and the protection of your Personal Data, we adopt advanced technological resources to ensure the security of all data processed by the Company. Among the security measures implemented are the implementation of access controls to systems and data processing environments, encryption techniques, and the installation of barriers against unauthorized access to databases (including firewalls), among other information security controls.

We strive to protect the privacy of your Personal Data, but unfortunately, we cannot guarantee total security. Unauthorized access and use of your information by third parties, hardware or software failures beyond the Company’s control, and other external factors may compromise the security of your Personal Data. Therefore, your actions are fundamental to maintaining a secure environment for everyone. If you identify or become aware of any factor that compromises the security of your data in your relationship with the Company, please contact us using the contact information provided below.

7. HOW TO DISCUSS PERSONAL DATA WITH THE COMPANY?

If you believe that your Personal Data has been processed in a manner inconsistent with this Policy or with your choices as the Data Subject, or if you have any questions, comments or suggestions related to this Policy and how we process your Personal Data, please contact us. We have a Data Protection Officer who is available at the following contact addresses:

8. CHANGES TO THE PRIVACY POLICY

As we are always looking to improve our services and how we operate, this Privacy Policy may be updated to reflect those improvements. Therefore, we recommend that you periodically visit this page to stay informed about any changes made.

DATE OF LAST UPDATE: February 2026.