1. framework

This Privacy Policy establishes the commitment of ANTARR SUSTAINABLE PRODUCTIVE FOREST , S.A. (“Antarr”), with its stakeholders (e.g. customers, employees, suppliers, shareholders and investors) in the protection of the personal data it is responsible for, intending to contribute to strengthening and consolidating the relationship of trust and proximity it has with them, through the clear and transparent communication of what it does with this data and what rights it recognizes to the respective holders and how they can exercise them.

Antarr acts in strict compliance with the principles described in this policy, Regulation (EU) 2016/679 (General Data Protection Regulation) and the applicable data protection legislation, in all the personal data processing activities for which it is responsible.

Antarr processes personal data through various operational and technical means to support the activities of its business processes.

a. Objectives

The Privacy Policy, as a communication tool, has the following main objectives:

• Strengthen and consolidate Antarr’s relationship of trust and proximity with all its stakeholders;
• Demonstrate transparency about the purposes and processing activities carried out by Antarr, as well as the retention periods for the personal data involved;
• Informing personal data subjects of their rights in relation to data protection and how they can exercise them;
• Informing the holders of personal data who are responsible for Antarr and to whom they can turn to exercise their rights or clarify how their personal data is processed.

b. Scope of application

The Privacy Policy applies exclusively to the processing of personal data carried out by Antarr, in the context of the intended purposes. For the purposes of this policy, personal data means any information relating to an identified or identifiable natural person (data subject). An identifiable data subject is one who can be identified directly or indirectly, namely by means of an identification number or by means of specific characteristics of his or her physical, physiological, genetic, mental, economic, cultural or social identity.

c. Maintenance, communication and application of the policy

The Privacy Policy must be reviewed annually when there is a change in circumstances and whenever there are legislative changes, to validate that it remains current and appropriate in the light of applicable regulations and laws. Proposals to revise the policy and supervision of its application and compliance are the responsibility of Antarr’s competent management body.

This policy must be known to all Antarr employees and must be made available to its stakeholders, whenever the processing of their personal data is involved, through the appropriate channels, namely on the Antarr website.

2. Content of the Privacy Policy

a.Our Commitment to Privacy

Antarr operates on the basis of trust and transparency. This commitment carries over into our day-to-day relationships with our customers, employees, suppliers and other stakeholders.The privacy and security of the data you entrust to us is a priority for us.

We are committed to only collecting, storing, processing, transmitting or deleting your personal data transparently and in a way that is essential to our relationship.We will inform you of how we use your personal data and for what purposes with the guarantee that we collect, share and store your personal data with reference to the best practices in the field of security and protection of personal data.When your personal data is collected, stored, processed, transmitted or deleted by other entities, we demand the same level of privacy and security.

We want you to feel confident that your personal data is safe with us, as we will always be committed to protecting your privacy, and we take our responsibilities regarding the protection of your personal data very seriously and with great commitment.

Whenever you have any questions about our use of your personal data, we will be happy to help you by emailing protecaodados@antarr.pt.

b. Who is Responsible for Your Personal Data

Antarr is responsible for processing your personal data under the terms of the General Data Protection Regulation and the complementary legislation on personal data protection in force in the countries in which it operates.

c. Personal Data We May Collect

In this Privacy Policy, the term “Personal Data” means the set of information that relates to you and that allows us to identify you, directly or indirectly.Your personal data may include, for example, your name, your tax identification number and your contact details (physical and/or electronic).We may also receive your personal data from other companies, particularly when they collect, process or store it as part of a service contract.

d. How and Why We Use Your Personal Data

We use your personal data to the extent strictly necessary for our relationship.

e. How Long We Keep Your Personal Data

We only keep your personal data for as long as is necessary to fulfill the objectives defined within the framework of the relationship maintained and to comply with the law.

Once the maximum retention period has been reached, your personal data will be anonymized or securely destroyed/deleted.

f. With Whom We May Share Your Personal DataIn some cases we may disclose your personal data to other entities as part of the services they provide. In such cases, we require them to have appropriate security measures in place to protect your personal data.

Where required by law, we may have to disclose your personal data to authorities or third parties.In the event of transfer or access to your personal data by suppliers or service providers based outside the European Union, we ensure that your personal data is processed in accordance with appropriate security and protection measures, compatible with those we use.

g. How You Can Exercise Your Personal Data Protection Rights

In certain circumstances, you have the right to access or request from us:

• Additional information about our use of your personal data;
• Your personal data;
• That we transmit your personal data that you have provided to us to another entity;
• Update your personal data;
• The deletion of your personal data;
• Opposing the processing of your personal data;
• Limiting the way we use your personal data while we correct it or clarify any doubts about its content or the use we make of it;
• The provision of a channel for you to challenge decisions based on your personal data.

You also have the right to withdraw or change, at any time, the consent you have given us to use your personal data.

The exercise of these rights is excepted when your personal data is used to safeguard the public interest, namely in cases of crime detection and prevention, or when it is subject to professional secrecy.

To exercise your personal data protection rights or if you have any questions about our use of your personal data, please contact us at protecaodados@antarr.pt.

If you are dissatisfied with the way we use your personal data or with our response to your request to exercise your rights, you may lodge a complaint with a competent supervisory authority.

h. Cookies

Antarr uses cookies on its website to improve the performance and browsing experience of our users, on the one hand increasing the speed and efficiency of response and, on the other, eliminating the need to repeatedly enter the same information.

A cookie is a text file that is automatically stored in users’ web browsers when they access certain sites. The cookie allows Antarr and third parties to identify the web browser on the server, making it possible to store information in order to improve the user experience, as well as analyze and review website performance.

Cookies can be classified as session cookies or persistent cookies. Session cookies expire automatically when you close your web browser. Persistent cookies remain in your web browser until their expiry date, or until they are deleted. Expiry dates vary per cookie, with some expiring after a few minutes and others only after several years.

The Antarr website uses the cookies listed below.

Cookies and other immediate tracking technologies do not collect personal data about you, except in cases where you voluntarily provide this type of information by registering on the website or sending communications, these technologies may be used to obtain more information about your use of the website.

Each user is assigned an individual cookie, thus guaranteeing data privacy and security. Statistical data is presented in aggregate form and not individually, and does not allow the user to be identified. In this way, it is possible to evaluate the performance of the website, with a view to constant updating and improvement, in order to make the user experience more efficient.

In order to set your cookies, you should access “Cookie settings” on the Antarr website. In addition, web browsers allow users to manage their cookies. They can set their devices to accept all cookies, know when a cookie is set or never receive cookies. You can disable the cookie function at any time via the web browser, usually in the “Preferences” or “Tools” menu. For more details on how to configure this in your browser, please consult its “Help” menu.

Please note that if you disable cookies completely, some or all of the website’s features may no longer be available.

i. How we protect your personal data

We have a variety of information security measures in place, in line with national and international best practices, in order to protect your personal data, including technological controls, administrative, technical, physical measures and procedures that guarantee the protection of your personal data, preventing its misuse, unauthorized access and disclosure, loss, improper or inadvertent alteration, or unauthorized destruction. In terms of information security, we are committed to continuous improvement in our daily activities.

Among others, we highlight the following measures:

Restricted access to your personal data only by those who need it for the purposes set out above;
Storage and transfer of personal data only in a secure manner;
Protection of information systems through devices that prevent unauthorized access to your personal data;
Implementation of mechanisms that guarantee the integrity and quality of your personal data;
Permanent monitoring of information systems in order to prevent, detect and stop the misuse of your personal data;
Redundancy of personal data storage, processing and communication equipment, to avoid loss of availability.

When required by law, we may have to disclose your personal data to authorities or third parties, in which case our control over how your personal data is protected is limited.

j. Updates to this Privacy Policy

This Privacy Policy may be updated from time to time, which will be disclosed through the appropriate channels, namely the Antarr website.