Privacy Policy | Grupo Ultra

1. Introduction

1.1 This Privacy Policy (“Policy”) aims to establish the rules regarding the use, storage, and Processing of Personal Data collected within the scope of ULTRAPAR’s activities in digital media. The online platforms are available for access and use through the Links www.ultrapar.com.br and ri.www.ultra.com.br, among others that may be made available in the future by ULTRAPAR (“Sites”), in accordance with the laws in force, especially the General Data Protection Law.

1.2 As a condition for using the exclusive functionalities of the Sites, you (“User”) declare that you have read this document thoroughly and carefully, being fully aware of its terms and freely agreeing with the text of this Policy.

2. Definitions

2.1 To simplify your reading of the Policy, we will define some terms below:

Anonymization: Use of reasonable and available technical means at the time of Personal Data Processing, through which data loses the possibility of being associated, directly or indirectly, with an individual.
Activities: Activities carried out and services provided by ULTRAPAR, including but not limited to services available on the investor relations website (disclosure of information, financial results, mailing, and other relevant interactions), the dissemination of ULTRAPAR’s events and marketing actions, recruitment and selection of new employees for job opportunities, and the promotion of ULTRAPAR websites, products, and services.
Cloud Computing: A technology that enables the virtualization of services built by interconnecting more than one server through a common information network (e.g., the Internet), aiming to reduce costs and increase the availability of supported services.
Cookies: Small files sent by the Sites, stored on your devices, that store preferences and other information related to the User’s visit to the Sites, with the purpose of personalizing your navigation according to your profile.
Data: Any information entered, processed, or transmitted for the execution of services related to the Activities and the use of the Sites.
Personal Data: Data related to an identified or identifiable individual.
Solely Automated Decisions: Decisions that affect a user that are programmed to operate automatically, without the need for human intervention, based on automated Personal Data Processing.
Data Protection Officer (DPO): The agent responsible and appointed by ULTRAPAR to act as a communication channel between it, the Users, and the National Data Protection Authority (“ANPD”).
Session ID: The identification of the User’s session when accessing the Sites.
IP: Abbreviation for Internet Protocol; it is an alphanumeric set that identifies a user’s devices on the Internet.
General Data Protection Law: Law No. 13.709/18.
Link: Terminology for Internet address.
Partners: Companies that, through an agreement or contract with ULTRAPAR, are authorized to offer rewards, discounts, products, and services to the User.
Personal Data Processing: Any operation performed with Personal Data, such as collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, elimination, evaluation, control, modification, communication, transfer, dissemination, or extraction of information.
ULTRAPAR: ULTRAPAR PARTICIPAÇÕES S.A., located in the City of São Paulo/SP, at Avenida Brigadeiro Luís Antônio, No. 1.343, 9th floor, registered with the CNPJ under No. 33.256.439/0001-39.

3. About the Collected Data

3.1 How the Data is Collected. Data, including Personal Data, may be collected when the User (i) submits it; (ii) uses the Sites; or (iii) participates in its Activities. The data collected, as well as the reason for its collection, include:

What is collected?	Why is it collected?
Full Name	(i) To identify and authenticate the User. (ii) To fulfill the obligations arising from the Activities.
Professional Data	(iii) To enhance the relationship between the User and ULTRAPAR, informing them about news, features, content, events, and other relevant interactions in relation to the Activities, if requested.
E-mail	(iv) To store the history of contact and relationship between ULTRAPAR and the User for permitted legal purposes.
Phone	(v) To protect the User regarding the prevention of fraud and associated risks, in addition to compliance with legal and regulatory obligations.
Inquiry, suggestion, request, complaint, and/or report	(vi) Ensure the portability of Registration Data to another controller in the same line of business, if requested by the User and in accordance with ANPD regulations, fulfilling the obligation of article 18 of the General Personal Data Protection Law.

Digital Identification Data
IP Address and Source Logical Port	(i) To identify and authenticate the User on the Sites and in their Activities.
Device (operating system version)	(ii) To comply with legal obligations to maintain records established by the Civil Rights Framework for the Internet – Law No. 12.965/2014.
Geolocation	(iii) To protect the User regarding the prevention of fraud and associated risks, in addition to compliance with legal and regulatory obligations.
Date and time logs for each action the User performs Which screens were accessed Session ID	(iv) When you visit one of the Sites, a Cookie is inserted into your browser through an analytics tool to identify how many times you return to our Internet address. Information is collected anonymously, such as IP address, geographic location, referral source, browser type, duration of visits, and pages visited.
Cookies	Some of our Cookies are used only while the User browses our pages and are deleted afterward.

3.2 Required Data: The functionality of the Sites directly depends on some of the Data provided in the table above, especially the User’s registration data. If the User chooses not to provide some of this Data, they may be unable to participate in the Activities.
3.3 Updating and Accuracy of Data: The User is solely responsible for the completeness, accuracy, and veracity of the Data provided at the time of registration on the Sites. It is the User’s responsibility to keep it updated, and they can correct or update it through the Sites. 3.3.1 Similarly, ULTRAPAR is not obligated to process or treat any of the User’s Data if there are reasons to believe that such Personal Data Processing may result in any violation of any applicable law, or if it is verified that the User is providing Data, using the Sites, and/or participating in its Activities for any illegal, unethical, unlawful, or immoral purposes.
3.4 Database: The database formed through the collection of Data is owned and managed by ULTRAPAR, and its use, access, and sharing, when necessary, will be carried out within the limits and purposes of the business described in this Policy.
3.5 Data of Minors: Our platforms are not intended for individuals under 18 (eighteen) years of age, and therefore, we do not collect or intentionally conduct any type of Personal Data Processing related to such Data. If the User does not meet the minimum age requirement, they should not register on the Sites or access them without the representation of their parents, guardians, or legal representatives, in accordance with the law. If we identify Personal Data of minors unintentionally in our database, we will remove such Data.
3.6 Technologies Used: ULTRAPAR uses Cookie technology, and the User can block them by configuring their Internet browser. In this case, some features offered by the Sites may be limited. 3.6.1 The technology used by ULTRAPAR will always comply with the current legislation and the terms of this Policy.
3.7 During the use of the Sites, ULTRAPAR may employ Solely Automated Decisions to enhance the User’s experience, as provided in this Policy and in compliance with current legislation.

4. About Data Sharing

4.1 Data Sharing Scenarios. The Data collected and the activities recorded may be shared, always respecting the minimum information necessary to achieve the purposes described in this Policy:

(i) with Partners whose actions are necessary for the execution of the Activities or for the User’s benefit, ensuring that such Partners always comply with the security and data protection guidelines as per item 5.5 of this Policy;
(ii) with companies contracted to provide operational services inherent to the Sites and the execution of the Activities, ensuring that such organizations always comply with the security and data protection guidelines as per item 5.5 of this Policy; and
(iii) with competent judicial, administrative, or governmental authorities, whenever there is a legal determination, request, requisition, or court order.

5. How Data is Protected and How Users Can Protect It

5.1 Password Sharing: The User is also responsible for keeping their Data confidential and should always be aware that sharing passwords and access data violates this Policy and may compromise the security of their Data, the Sites, and their Activities.
5.2 Precautions the User Should Take: It is very important that the User protects their Data against unauthorized access to their computer, account, or password, and ensures they always click “logout” when ending their browsing on a shared computer. If the user suspects that their password may have been exposed/compromised, they should change it promptly to avoid exposing the information protected by this password. It is equally important that the User knows that ULTRAPAR will never send electronic messages with executable attachments (extensions: .exe, .com, among others).
5.3 Access to Personal Data, Proportionality, and Relevance: At ULTRAPAR, the collected Personal Data will only be accessed by duly authorized professionals, respecting the principles of proportionality, necessity, and relevance to the objectives of the Activities, in addition to the commitment to confidentiality, protection of Personal Data, and preservation of the User’s privacy under the terms of this Policy.
External Links: When using the Sites, the User may be directed via Link to other portals or platforms that may collect the User’s information and have their own privacy policies and Personal Data Processing practices.
- 5.4.1 It is the User’s responsibility to read the privacy policies and Personal Data Processing practices adopted by such external portals or platforms and to accept or reject them. ULTRAPAR is not responsible for third-party policies or the content of any websites or services linked to environments other than the Sites.
- 5.4.2 The User may also be redirected to the websites of companies directly or indirectly controlled by ULTRAPAR. As this Policy addresses only the Sites, the User should be aware of the usage and privacy rules of such websites.
5.5 Services of Partners: ULTRAPAR may enter into agreements with Partners who will offer services and/or products directly to the User, whose terms and conditions may be accessed through ULTRAPAR’s official communication channels. The Data provided directly by the User to these Partners will be the sole responsibility of the Partners, subject to their own data collection and usage practices.
5.6 Processing by Third Parties under ULTRAPAR’s Directive: If third-party companies carry out the Processing of Personal Data on behalf of ULTRAPAR, they must comply with the conditions stipulated in this Policy and the information security standards adopted by ULTRAPAR.

6. How Personal Data and Activity Records Are Stored

6.1 The Personal Data collected and the activity records are stored in a secure and controlled environment for as long as necessary for the Processing of Personal Data, while also ensuring ULTRAPAR’s right to retain the historical record of the User’s Data for audit purposes, security, fraud prevention, and preservation of rights in the cases established by law or regulatory standards or for the preservation of rights.
6.2 ULTRAPAR may contract cloud data storage services on servers located outside of Brazil. If this occurs, ULTRAPAR will contract Cloud Computing services that have all the technical, organizational, and administrative structures to ensure the security and integrity of Personal Data, as well as compliance with the principles and obligations related to Personal Data Processing.

7. What Are the User’s Rights and How to Exercise Them

7.1 Basic Rights: The User may request the Data Protection Officer, via email at privacidade@www.ultra.com.br:
(i) confirmation of the existence of Personal Data Processing;
(ii) limitation of the use of their Data;
(iii) display and/or rectification of their Data;
(iv) expression of opposition and/or revocation of consent regarding the use of their Personal Data; or
(v) request for deletion or Anonymization of their Personal Data collected within the scope of the Sites.
7.2 If the User opposes the Processing of Personal Data linked to essential purposes, thereby impacting the proper functioning of the Activities and Sites, the User should be aware that they will not have access to the Activities and functionalities offered by the Sites.
7.3 After the retention period and legal necessity, the Personal Data will be deleted using secure disposal methods or used anonymously for statistical purposes.

8. Information About the Policy

8.1 Policy Changes and Updates: This Policy is subject to continuous improvements and enhancements, and ULTRAPAR reserves the right to modify it at any time, at its sole discretion or to comply with legal or regulatory requirements, and the User is responsible for checking it whenever using the Sites and participating in their Activities.

8.2 If updates to this document require new consent collection, the User will be notified through the contact channels they provide.

8.3 Inapplicability: If any part of this Policy is deemed inapplicable by an irreversible decision of the ANPD or the Judiciary, the remaining conditions will remain in full force and effect.

8.4 Electronic Communication: The User acknowledges that all communications made via email (to the addresses provided in their registration), SMS, instant messaging applications, or any other digital form are valid, effective, and sufficient for disclosing any subject related to the Policy, their Data, or any other matter linked to it.

8.5 Support Channels: If you have any questions regarding the provisions of this Policy, the User may contact us through the support channel provided below, which operates Monday to Friday, from 9:00 am to 6:00 pm, except on holidays: Contact Us.

The User may also contact the Data Protection Officer directly via email at privacidade@www.ultra.com.br, or at the address located at Avenida Brigadeiro Luís Antonio, 1343, São Paulo – São Paulo, Brazil.

8.6 Applicable Law and Jurisdiction: This Policy will be interpreted according to Brazilian law, with the jurisdiction of ULTRAPAR’s domicile elected to resolve any controversy involving this document, except for specific reservations of personal, territorial, or functional competence under applicable law.