Name

### INTRODUCTION

The General Data Protection Regulation of the European Union (GDPR) – Regulation (EU) 2016/679 of the European Parliament and the Council of April 27, 2016, establishes rules regarding the protection of personal data of individuals, and it is directly applicable in the legal systems of all Member States, imposing a series of duties, particularly for public legal entities. In Portugal, Law No. 58/2019, of August 8, remains in force, ensuring the implementation of the GDPR.

In light of this Regulation, “personal data” refers to any information related to an identified or identifiable individual.

An identifiable person is one who can be identified, directly or indirectly, particularly by reference to, for example, a name, an identification number, location data, electronic identifiers, or one or more elements of the physical, physiological, genetic, mental, economic, cultural, or social identity of that individual.

This Privacy and Data Protection Policy establishes how CATIM processes the personal data of its employees, clients and/or potential clients, participants and/or potential participants in industry-oriented projects, partners, and other stakeholders in the course of its activities.


### PURPOSES AND LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA

Under the GDPR, the use of personal data must be justified by at least one of the legal grounds defined in the Regulation, Article 6.

The personal data we collect and process is essential for us to properly provide our services. We do not collect unnecessary information for the purposes for which it is intended.

Personal data is collected and used by CATIM for the following purposes:

- Compliance with legal obligations.
- Execution of contracts.
- Management of business relationships.
- Industry-oriented projects.
- Evaluation of the interest in potential business relationships.
- Communication and marketing actions.


### PROCESSING OF PERSONAL DATA
The data provided in the relationship established with CATIM is processed in accordance with the applicable regulatory requirements, including:

- Processed lawfully, fairly, and transparently in relation to the data subject.
- Used only to fulfill the purposes for which it was collected.
- Used in an appropriate, relevant, and limited manner to what is necessary for the purposes for which it is processed.
- Accurate and, where necessary, updated.
- Retained only for the period necessary and legally permissible for the purposes for which it is processed.
- Protected against accidental and unlawful loss, destruction, or damage, as well as unauthorized or unlawful processing.


### DATA CONTROLLER
CATIM is the Data Controller for the personal data in the scope of its activities.


### SECURITY OF PERSONAL DATA

CATIM employs a variety of technical and organizational measures to protect and maintain the security, integrity, and availability of personal data, including:

- Restricted access to personal data based on the “need to know” criterion, and only within the scope of the purposes arising from contractual or business relationships or expressly consented to.
- Protection of information technology systems through firewalls to prevent unauthorized access, particularly to personal data.
- Personal data in transit is protected by encryption mechanisms such as the access to CATIM's website via a secure SSL connection (“Secure Sockets Layer”), with communication between the browser and the web server occurring via the HTTPS protocol.
- Backup policies to safeguard information.
- Monitoring and controlling physical and electronic access to information technology systems to prevent, detect, and prevent misuse of personal data.
- Employees who come into contact with or have access to personal data due to their duties are subject to professional confidentiality and/or confidentiality obligations.


### SHARING PERSONAL DATA WITH THIRD PARTIES
CATIM only uses subcontractors who provide adequate security guarantees and meet the required standards as legally prescribed. Subcontractors must comply with documented instructions from CATIM, sign data processing agreements for subcontracting, be subject to appropriate legal confidentiality obligations, and adopt security measures to ensure compliance with the GDPR.


### RETENTION AND DELETION OF PERSONAL DATA
CATIM only retains personal data for the period necessary to fulfill the purpose for which it was collected.

Once the legal retention period has expired, personal data will be anonymized or securely destroyed.


### RIGHTS OF DATA SUBJECTS

The personal data we collect is owned by the data subject. Therefore, data subjects have the right to access, rectify, limit, delete, object to the processing of their data with CATIM, and/or transfer their data to another data controller, unless there is another legal basis for the processing that prevents such actions.

Any of the rights mentioned above can be exercised by the data subject by contacting CATIM's Personal Data Protection Coordination team at the email address coordenacao.rgpd@catim.pt, and the data subject will receive a response to their request within one (1) month.

For cases where data processing is based on consent, the data subject is entitled to completely withdraw their data when requested, no longer being contacted or receiving any communications related to the purposes described in this Privacy and Data Protection Policy.

The complete withdrawal of consent for data processing means that the data controller must immediately cease all personal data processing, including collecting new data, consulting and analyzing already collected data, or retaining data.

Once consent is withdrawn, CATIM ensures that the data is deleted, unless there is another legal basis for the processing.

The data subject may submit any clarification request or complaint regarding the use of their personal data to the email coordenacao.rgpd@catim.pt.

The data subject also has the right to file a complaint with the National Data Protection Commission (CNPD).


### PERSONAL DATA BREACH

In the event of a personal data breach, CATIM will notify the CNPD without undue delay and, where possible, within 72 hours of becoming aware of it, unless the breach does not pose a risk to the rights and freedoms of the data subjects.

In addition to notifying the CNPD, CATIM will also inform the data subject of the personal data breach without undue delay if the breach involves a high risk to their rights and freedoms.


### CHANGES TO THE PRIVACY AND DATA PROTECTION POLICY

This Policy may be periodically updated without prior consent from the data subject. Any significant changes will be communicated promptly.


### PRIVACY AND COOKIES

CATIM uses cookies on its website to improve the experience of those visiting it. All information related to cookies on our website can be found in our Privacy and Cookies Policy.

Privacy Policy and Cookies

In compliance with Law No. 93/2021 of December 20, 2021, which establishes the general regime for the protection of whistleblowers, transposing Directive (EU) 2019/1937 of the European Parliament and of the Council of October 23, 2019, regarding the protection of persons reporting breaches of Union law, CATIM provides an internal whistleblowing channel.

This channel allows for the safe submission and follow-up of reports, ensuring the completeness, integrity, and preservation of the report, the confidentiality of the whistleblower’s identity or anonymity, and the confidentiality of third parties mentioned in the report, while preventing unauthorized access.

WHO CAN REPORT?

The whistleblowing channel is available for:

- Employees;
- Service providers, contractors, subcontractors, and suppliers, as well as any individuals acting under their supervision and direction;
- Shareholders and persons belonging to management, governance, or supervisory bodies of legal entities, including non-executive members;
- Volunteers and interns, whether paid or unpaid.

How to Report? 
Reports can be made through the designated channel, email, in person, by phone, or by postal mail. All reports, regardless of the channel used, ensure independence, impartiality, confidentiality, data protection, secrecy, and the absence of conflicts of interest.

Report via the Channel
You can file a report through the channel by selecting the “Submit Report” option and filling out the provided form as thoroughly as possible.
If you wish to ensure anonymity, we recommend submitting the violation through this channel by choosing the “I wish to remain anonymous” option in the form.

Report by Email
Reports can be sent via email to denuncia@catim.pt, describing the facts that led to the violation.

Report by Postal Mail
Reports can be made by letter to the following address:
CATIM
Attn: Whistleblowing Manager
Rua dos Plátanos, 197
4100-414 Porto
SUBJECT: Violation Report / CONFIDENTIAL

Report in Person
Reports can be made in person. To do so, please contact CATIM and schedule an appointment using the following contact details:
Whistleblowing Management - denuncia@catim.pt

FOLLOW-UP OF THE REPORT

Regardless of the channel used to submit the report, it can always be followed up by the whistleblower through the CATIM whistleblowing portal. The whistleblower will receive a unique access key that will allow them to check the status of the investigation into their report.

Within seven days, CATIM will inform the whistleblower via the portal, clearly and accessibly, of the requirements, competent authorities, and the admissibility of the report.

Following the report, CATIM will initiate appropriate internal actions to verify the allegations made and, if necessary, to terminate the reported violation, including through the opening of an internal inquiry or others, or by reporting to the competent authority for the investigation of the violation, including European Union institutions, bodies, or agencies.

Within a maximum of three months, CATIM will inform the whistleblower, through the portal, of the measures planned or adopted to address the report and their rationale.

Upon completion of the process of implementing the planned measures, CATIM will inform the whistleblower via the portal, closing the report definitively.


**Access to the** [Whistleblowing Channel](https://denuncia.catim.pt/)

Whistleblowing Channel

Privacy Policy and Data Protection

The Corruption Risk Prevention Plan and Related Offenses aims, in addition to identifying situations that may lead to corruption risks and related offenses, to outline preventive and corrective measures designed to mitigate the likelihood of the risk occurring, define a methodology for monitoring the outlined measures, and identify those responsible for their implementation.

The Corruption Risk Prevention Plan and Related Offenses complies with Decree-Law No. 109-E/2021 of December 9, which establishes the General Regime for Corruption Prevention.









Anti-Corruption and Related Offenses Risk Prevention Plan