Cleva Solutions, SA undertakes to process all personal data, in the context of its activities, in accordance
with Regulation EC 2016/679 of the European Parliament and of the Council, of 27 April 2016 and the
Portuguese law 58/2019, on the protection of natural persons with regard to the processing and the free
movement of personal data.

Cleva:
• undertakes to collect only the personal data that are strictly necessary for the performance of its
contractual, legal and resource management obligations, and which may be shared with other
entities of the group;

• undertakes to collect the informed consent of the data subjects directly and in advance, thus
obtaining their authorisation for the use of the data in question in the company’s business
environment, whenever legally required;

• may, in the course of the provision of services to its clients, and in order to comply with its legal
obligations, need to share its employees’ personal data, undertaking to share only the data strictly
necessary and to ensure that appropriate technical and organizational measures are taken for
their protection;

• may rely on third parties – sub-processors – to provide specific services, which may entail the
access by these third parties to the employees’ personal data; in such cases, Cleva will try to
ensure that the sub-processors adopt appropriate technical and organizational measures to
protect these personal data;

• undertakes to inform the data subjects, in accordance with the legislation in force, of any
anomalous situation that has occurred, and which poses significant risks to their fundamental
rights and freedoms.

Cumulatively, Cleva assures data subjects that the data are:

• processed lawfully, fairly and in a transparent manner;

• collected for legitimate and determined recipients and purposes, and explicitly communicated if
required;

• adequate, relevant and limited to what is necessary in relation to the purposes for which they are
processed;

• kept for no longer than the retention period necessary and legitimate for the purposes for which
they are processed, with prior information to the data subjects when the processing requires prior
consent from the data subject;

• processed in a manner that ensures their security, including protection against unauthorised or
unlawful processing and against accidental loss, destruction or damage.

Cleva also guarantees the following rights to the data subjects:

• the right to access the personal data collected concerning the data subject, and to exercise this
right easily;

• the right to have his/her personal data rectified or erased, or to withdraw his/her consent or to
restrict the processing of his/her personal data, within the legal limits applicable to Cleva;

• the right to know and obtain communication with regard to the purposes for which the personal
data are processed, the period for which they will be processed, possible recipients, the logic
involved in any automatic personal data processing and, at least when based on profiling, the
consequences of such processing;

• the right to receive his/her personal data, in a structured, commonly used, machine-readable and
interoperable format (which can be read and processed by any organisation), and to transmit it
to another controller;

• the right to lodge a complaint with Cleva or the supervisory authority concerning any situation
that the data subject considers abnormal regarding the protection of his/her personal data or
privacy.

To guarantee the rights of the data subjects, as well as to address any other questions regarding the
protection of personal data, Cleva appointed a Data Protection Officer (DPO). This collaborator has the
responsibility to ensure the implementation and continuous improvement of the technical and
organisational measures required for the effective and efficient protection of personal data, and ensure
the communication to Cleva’ Executive Committee, in order to report any problem related to noncompliance with the regulation.

Cleva’s staff members have a responsibility to comply with and enforce this privacy and data protection
policy, as well as any other standards and regulations in force on this matter, and to communicate any
weakness or abnormal situation detected and which may have an impact, even if potential, on the data
subjects’ fundamental rights and freedoms.

Any violation by Cleva’s staff members of the rules established by this regulation will be handled (if
applicable) through disciplinary and/or criminal proceedings.
Cleva’s Data Protection Officer may be reached at privacy.cleva.pt@cleva-solutions.com