Privacy Policy

1. Introduction

This Policy is intended to clarify the definitions, practices and information regarding the processing of personal data that you provide to us, directly or indirectly, in physical form or by electronic means. It also informs you about your privacy rights and legal protections, and it applies to everyone whose personal data is processed by EHS BRASIL.

2. Purpose

This policy explains how EHS BRASIL processes, that is, collects, handles, stores or otherwise uses the data collected from you, the Data Subject, whether through personal data you provide via our channels, such as telephone or email, through your participation in recruitment processes, contracts or within the scope of our relationships, in connection with the provision of our services, and in other ways related to the Company’s activities.

3. Scope

This instrument applies to everyone whose personal data is collected, processed, used and handled by EHS BRASIL within the scope of their relationship with us, such as candidates in our recruitment processes for positions at the company, employees, our clients’ employees and other stakeholders. Any change and/or modification can be consulted on the website/portal ehsbrasil.com.

4. Controller and Data Protection Officer

EHS BRASIL is the controller responsible for your personal data, as defined by Brazil’s General Personal Data Protection Law (LGPD). Its details are as follows:

Contact channel: contato@ehsbrasil.com
Phone (11) 4689.0636

EHS BRASIL has a Data Protection Officer, who acts as the communication channel between the company, you, the Data Subject, and the National Data Protection Authority (ANPD). The contact details of the company’s Data Protection Officer (DPO) are as follows:

Data Protection Officer: dpo@ehsbrasil.com

For questions, complaints, communications or requests related to Privacy and Personal Data Protection, including those concerning your rights, please contact the Data Protection Officer at the email address above.

5. Definitions

For the purposes of this document, the following definitions and descriptions apply for your better understanding:

• Processing Agents: the Controller and the Processor;
• Anonymization: the use of reasonable technical means available at the time of processing, through which data loses the possibility of being associated, directly or indirectly, with an individual;
• National Data Protection Authority (ANPD): the federal public administration body responsible for overseeing, implementing and enforcing compliance with the General Data Protection Law in Brazil, with technical and decision-making autonomy guaranteed by law;
• Consent: a free, informed and unambiguous statement by which the Data Subject agrees to the processing of their personal data for a specific purpose;
• Controller: a natural or legal person, governed by public or private law, responsible for decisions regarding the processing of personal data, to be carried out by its representatives, agents or third parties (processor) – (“EHS BRASIL”);
• Anonymized data: data relating to you, the data subject, that cannot be identified, considering the use of reasonable technical means available at the time of its processing;
• Personal data: information related to you that identifies you or can make you identifiable;
• Sensitive personal data: information about you concerning race, religion, political opinion, membership in a trade union or in a religious, philosophical or political organization, data concerning your health or sex life, and genetic or biometric data;
• Data Protection Officer (DPO): the person appointed by the Controller to act as the communication channel between the Controller, the Data Subjects and the National Data Protection Authority (ANPD), in addition to the other duties established by the LGPD;
• Processor: a natural or legal person, governed by public or private law, that processes personal data on behalf of the Controller;
• Pseudonymization: processing through which data loses the possibility of being associated, directly or indirectly, with an individual, except through the use of additional information kept separately by the controller in a controlled and secure environment;
• Processing: any operation carried out with personal data, such as collection, production, receipt, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, deletion, evaluation or control of information, modification, communication, transfer, dissemination or extraction;
• Data Subject: the natural person to whom the personal data being processed refers.

6. How we collect your personal data

Regardless of your relationship with EHS BRASIL, we only collect personal data on the basis of the legal grounds and in fulfillment of the specific processing purpose for that particular personal data. Accordingly, we may collect and process your data as provided by law in the following situations, through:

• information and/or personal data that you provide to us, directly or indirectly, when requesting our services, applying to a recruitment process to work with us, or starting an employment relationship or partnership with us, for example.
• our email or telephone.
• the systems used internally at the company to manage service, client, legal and/or regulatory relationships.

7. Why we use your personal data

EHS BRASIL only processes, uses and/or handles your personal data in the cases permitted by law. As provided by the LGPD, EHS BRASIL may rely on the different legal bases set out in the legislation to process personal data, always bearing in mind that, if the processing of certain personal data is based on your consent, you may revoke it at any time, at which point EHS BRASIL will stop processing/using your personal data, unless it must process it on the basis of another authorizing legal basis.

In any case, we will use your personal data strictly as necessary and for its intended purpose, guided by good faith, for legitimate and specific purposes, and only within the limits and authorization established by law.

Accordingly, the cases in which we use your personal data will normally be based on the following grounds:

• To comply with a legal and/or regulatory obligation;
• To perform a contract, or preliminary procedures related to a contract, to which you are a party;
• When necessary to serve our legitimate interests or those of third parties;
• For the regular exercise of rights, when necessary.

Thus, EHS BRASIL processes your personal data to manage its relationship with you, including but not limited to:

• Providing our services, when engaged by your company;
• Providing support and assistance during the term of the services engaged by your company;
• Complying with applicable legal and regulatory obligations;
• Managing your choices and rights regarding the processing of your personal data;
• Assessing your profile and enabling your participation in our recruitment processes, if you are a candidate for a position with us;
• Sending you a job offer, where applicable;
• Carrying out your onboarding or hiring process at our company, where applicable;
• Offering and implementing a benefit for you, where applicable;
• Carrying out your separation or termination process with our company, where applicable;
• Registering you on our platform, if your company has engaged us to provide our online courses to you;
• Making a payment to you, where applicable.

All of these EHS BRASIL activities are in full compliance with the legal provisions applicable to personal data protection, with the aim of ensuring the privacy, security and confidentiality of the information you provide.

8. How we may share your personal data

Our company may share your personal data with certain third parties to the extent necessary to fulfill the specific purpose for which your data was collected, to comply with contractual, legal or regulatory rules, and to serve our legitimate interests or those of third parties, where applicable, in accordance with our rules and security measures.

Below are examples of sharing of your personal data with third parties that may occur:

• Suppliers and service providers, such as infrastructure and technology companies, and, if you are our employee, data may be shared with payroll and HR service providers, banking institutions, insurance brokers and insurance operators.
• Professional consultants and advisors, such as law or accounting firms.
• Public authorities and regulatory bodies, in certain circumstances established by law, if necessary.

In all cases, we at EHS BRASIL require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our service providers to use your personal data for purposes other than specific purposes and in accordance with our instructions.

EHS BRASIL is committed to adopting all measures necessary to ensure the security and protection of personal data transferred to third parties, in order to preserve the privacy and integrity of that information. Accordingly, third parties have a duty to observe the confidentiality, integrity and availability of your personal data; to ensure strict processing in line with the requirements of the LGPD; to apply information security procedures and processes; and to return or dispose of the personal data in their possession at the end of the contract or when there is no longer a purpose or need for its processing.

9. How we manage and process your personal data

All personal data processed by EHS BRASIL will be managed in the safest and most consistent manner, always in line with the provisions of the LGPD, making every effort to prevent any breach or security incident. To this end, we adopt control rules and measures that define responsibilities for the processing, handling and use of personal data, including authorized control of the people with access to it and of the storage means and locations.

When data is processed in electronic format, it will be stored in a secure folder and/or in the secure technology systems customarily used by EHS BRASIL.

10. International transfers of personal data

In certain situations, personal data may be transferred to countries outside Brazil, such as when we engage third-party servers that may be located abroad.

In these cases, EHS BRASIL will ensure that such transfers are made only to countries that offer an adequate level of data protection, in accordance with Brazilian law. In addition, EHS BRASIL may also carry out the transfer when there is prior authorization from the National Data Protection Authority (ANPD) or when appropriate safeguards are applied, such as signing standard contractual clauses or adopting global corporate data protection rules.

11. Data security

We at EHS BRASIL have established appropriate technological security measures to prevent any breach or security incident that may affect your personal data, including procedures for cases of suspected breach of any personal data.

Accordingly, in any case of suspected or confirmed leakage, misuse or security incident involving your personal data, or that of any data subject that comes to your attention, we ask that you contact our Data Protection Officer (DPO), identified in item 4 of this policy, immediately. The DPO, together with the other responsible persons at our company, will take action on risk mitigation and prevention measures and, where appropriate, address the matter with the National Data Protection Authority (ANPD).

12. Retention and disposal of personal data

We at EHS BRASIL will store your personal data only for the period necessary to fulfill the specific purposes for which it was collected, or until you, as the data subject, exercise your rights to object or to cancellation by requesting deletion of the personal data or withdrawing your consent, where applicable.

Once the personal data is no longer necessary or relevant to the specific purpose, or once you, as the data subject, exercise your right to deletion mentioned in item 13 of this Policy, it will be deleted from our database. However, even if the purpose has been fulfilled or you have withdrawn your consent or requested deletion of your personal data, EHS BRASIL may keep it stored for a longer period if necessary to protect its rights, comply with court orders or requests issued by competent authorities, or comply with legal and regulatory obligations, among other authorizing grounds established by law.

Our commitment is to ensure the protection of your personal data throughout the entire processing cycle, from collection to storage and disposal, following good security, privacy and personal data protection practices.

13. What your rights are and how to exercise them

As provided by the LGPD, you are assured ownership of your personal data, and the fundamental rights to freedom, intimacy and privacy are guaranteed during the processing of your personal data.

At any time, you may request from EHS BRASIL, free of charge:

• Access to your Personal Data;
• Correction of incomplete, inaccurate or outdated Personal Data;
• Revocation of consent and deletion of personal data, except for data necessary to comply with a contractual, legal or regulatory obligation, for as long as that obligation lasts;
• Confirmation that processing is taking place, and easy access to it;
• Anonymization, blocking or deletion of Personal Data that is unnecessary, excessive and/or processed in breach of the Law;
• Portability of Personal Data;
• Information about the possibility of not giving your consent and the consequences of doing so, where applicable;
• Objection to a processing activity;
• Information about the sharing of your data with third parties.

In addition, you may exercise any other right granted by law.

In all cases, you should contact our Data Protection Officer (DPO) directly through the channel provided in item 4.

14. Time limit for responding to requests from you or your legal representatives

We at EHS BRASIL will use our best efforts to respond to all reasonable requests within the applicable legal deadlines. Occasionally, a response may take longer if your request is particularly complex or if you have submitted several complaints.

Certain requests may require more in-depth analysis or involve complex information, which may affect the time needed to provide a complete and satisfactory response. We value your privacy and are committed to ensuring that your rights as a data subject are respected and addressed in the best possible way.

15. Questions and contacts

If you have any questions or issues, please contact our Data Protection Officer (“DPO”) through the channel provided in item 4.

16. Updates or changes to the Privacy and Personal Data Protection Policy

This Policy may be changed at any time, but rest assured: whenever changes or updates are made to our Policy, they will be published on our website.