Privacy Policy

1. Introduction

OMX Transportes e Locação LTDA ("we", "our", or "us"), registered under CNPJ 39.311.646/0001-25, with its registered office at Av. Sidney Cardon de Oliveira, 2941, Sala 11, Paulínia - SP, 13146-052, is committed to protecting your privacy and personal data.

This Privacy Policy describes how we collect, use, store, and share your personal information in compliance with Brazil's General Data Protection Law (Lei Geral de Proteção de Dados — LGPD, Law No. 13.709/2018) and other applicable regulations. As a holding company managing equity participations in non-financial institutions operating in the transport and leasing sectors, we handle corporate, financial, and governance data with the highest standards of confidentiality.

2. Data We Collect

• Identification data: full name, CPF/CNPJ, RG, nationality, marital status
• Contact data: email address, phone number, physical address
• Corporate data: shareholder registries, equity participation records, board and officer appointments, and governance documentation
• Financial data: dividend distributions, capital contributions, intercompany transactions, and consolidated financial statements of portfolio companies
• Portfolio company data: operational performance metrics, fleet inventories, leasing portfolios, and revenue reporting from subsidiaries and investees
• Due diligence data: target company assessments, financial audits, legal opinions, and valuation reports
• Governance data: board minutes, committee resolutions, voting records, and compliance certifications
• Professional data: advisors, consultants, and service provider credentials and engagement records
• Payment data: billing information processed through secure payment systems
• Fiscal data: information required for tax compliance, including IRPJ/CSLL, DCTF, ECF, and transfer pricing documentation
• Navigation data: IP address, browser type, cookies, access logs

3. How We Use Your Data

• Managing equity participations and exercising shareholder rights in transport and leasing subsidiaries
• Administering corporate governance frameworks, board appointments, and compliance protocols
• Conducting consolidated financial oversight, performance monitoring, and group reporting
• Evaluating strategic acquisitions and managing due diligence processes
• Coordinating with legal, accounting, and financial advisors on corporate matters
• Processing intercompany transactions, dividend distributions, and capital allocations
• Complying with Junta Comercial corporate registration requirements, Receita Federal tax obligations, ANTT regulations applicable to transport subsidiaries, and applicable corporate law

4. Legal Basis for Processing

• Performance of a contract or preliminary procedures related to a contract
• Compliance with legal or regulatory obligations, including corporate and tax law
• Legitimate interests of the controller, including corporate governance and asset protection
• Consent provided by the data subject

5. Data Sharing

• Portfolio companies for governance execution, board representation, and shareholder coordination
• Legal counsel for corporate, tax, and regulatory advisory under professional privilege
• Accounting and audit firms for financial reporting and statutory audits
• Junta Comercial for corporate registration and amendment filings
• Receita Federal for tax compliance, ECF, and transfer pricing documentation
• ANTT and transport regulatory bodies for subsidiary compliance when applicable
• Financial institutions for treasury management and capital operations
• Prospective counterparties in M&A transactions, subject to executed non-disclosure agreements

6. Data Retention

Personal data will be retained only for as long as necessary to fulfill the purposes described in this policy, or as required by applicable law. Corporate governance records, shareholder registries, and board minutes are retained permanently as required by corporate law and the Código Civil. Financial records and tax filings are retained for the period required by Receita Federal, typically five years from the fiscal year end, or longer if subject to ongoing proceedings. Transfer pricing documentation is retained as required by applicable regulation. Due diligence materials are retained for the duration of the related investment plus the applicable statute of limitations. Upon expiration of retention obligations, data will be securely deleted or anonymized.

7. Your Rights

Under the LGPD, you have the following rights:

• Confirmation of the existence of data processing
• Access to your personal data
• Correction of incomplete, inaccurate, or outdated data
• Anonymization, blocking, or deletion of unnecessary or excessive data
• Portability of data to another service provider
• Deletion of data processed with your consent
• Information about entities with which your data has been shared
• Information about the possibility of denying consent and its consequences
• Revocation of consent

Please note that certain corporate records and financial documentation may be subject to legal retention requirements under corporate and tax law that supersede deletion requests. To exercise any of these rights, please contact us using the information in Section 10.

8. Cookies

Our website may use cookies and similar technologies to enhance your browsing experience. You may configure your browser to refuse cookies; however, some features may not function properly without them.

9. Data Security

We implement rigorous technical and organizational measures to protect all data under our control. Corporate governance records, shareholder data, and consolidated financial information are maintained in encrypted systems with multi-factor authentication and role-based access controls. Due diligence and M&A materials are stored in isolated, access-restricted environments. Portfolio company operational data is logically segregated. All professional advisors and staff are bound by confidentiality agreements. Despite our efforts, no method of electronic transmission or storage is completely secure.

10. Contact Information

11. Changes to This Policy

We reserve the right to update this Privacy Policy at any time. Any changes will be posted on this page with a revised "Last updated" date.