Privacy Policy

Purpose

To set out M8 Partners' rules, policies, procedures and internal controls for complying with the norms below, defining the rights and responsibilities of both M8 Partners and its Staff regarding the processing of personal data.

Applicable norms

Brazilian General Data Protection Law (Federal Law No. 13,709/2018 - LGPD), CVM Resolution 21, and ANBIMA's Rules and Procedures on Basic Duties, together with their subsequent updates.

Responsibility

Coordinating the activities related to this document is the responsibility of the Risk and Compliance Officer.

Classification

Public, available at www.m8partners.com.br.

Scope

This document applies to all of M8 Partners' Staff.

Related documents

This document is to be followed together with the Code of Ethics and Conduct and M8 Partners' other policies.

Staff acceptance

Staff must formally accept this document by signing the Commitment Term on joining M8 Partners and every 2 (two) years thereafter, or whenever a relevant change to the documents occurs.

Non-compliance

Non-compliance with the rules and procedures in this document must be reported to the Risk and Compliance Officer, following the flow set out in M8 Partners' Code of Ethics and Conduct, and, in the event of a personal-data breach, to the Data Protection Officer (DPO) or their deputy.

Questions and clarifications

For questions or clarification, Staff should contact the Risk and Compliance Officer or their deputy directly, and, in the event or possibility of a personal-data breach, the Data Protection Officer (DPO) or their deputy.

Evidence and record-keeping

The procedures and controls described in this document are consistent, verifiable and compatible with M8 Partners' size and complexity. All records are kept electronically and available for review by the supervisory and enforcement authorities for 5 (five) years from their creation.

Periodic review

This document is reviewed at least every 2 (two) years, or more often when there are regulatory or legal changes, or relevant changes to the products and services M8 Partners offers.

Manager

M8 Partners Gestora de Recursos Ltda.; and M8 Gestão de Crédito Estruturado Ltda.

M8 Partners

The M8 Partners group, made up of the two managers named above.

Staff

All those who hold a position, role, employment or internship relationship with M8 Partners, and service providers who work on an exclusive basis.

Risk and Compliance Officer

The officer designated to ensure compliance with rules, policies, procedures and internal controls, as well as risk management and AML/CTF, under CVM Resolution 21 and CVM Resolution 50.

Head of Portfolio Management

The officer responsible for managing securities portfolios, under CVM Resolution 21. Each manager has its own Head of Portfolio Management and a segregated investment team.

Senior Management

The Executive Committee, made up of the founding partners of the M8 Partners group.

LGPD

Brazilian General Data Protection Law (Federal Law No. 13,709/2018).

Personal Data

Information relating to an identified or identifiable natural person.

Sensitive Personal Data

Personal data on racial or ethnic origin, religious conviction, political opinion, union membership or membership of a religious, philosophical or political organisation, data concerning health or sex life, and genetic or biometric data, when linked to a natural person.

Data subject

The natural person to whom the personal data being processed relates.

Controller

The natural or legal person, of public or private law, responsible for the decisions regarding the processing of personal data.

Processor

The natural or legal person, of public or private law, that processes personal data on the controller's behalf.

Data Protection Officer (DPO)

The person appointed by the controller and processor to act as the channel of communication between the controller, the data subjects and the National Data Protection Authority (ANPD).

Processing

Any operation carried out with personal data, such as collection, production, receipt, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, deletion, evaluation or control of the information, modification, communication, transfer, dissemination or extraction.

ANPD

The National Data Protection Authority, the public body responsible for overseeing, implementing and enforcing compliance with the LGPD.

Cookies

Small text files stored on the user's device when they access a website, used to improve the browsing experience and collect information about site use.

AML/CTF

Prevention of Money Laundering and of the Financing of Terrorism and of the Proliferation of Weapons of Mass Destruction.

Approval date

06/07/2026

Editors

Risk and Compliance Officer / the Head of Portfolio Management of each Manager.

Approved by

Senior Management.

Summary of changes

New structure for M8 Partners' policies and procedures, now also covering the new manager M8 Gestão de Crédito Estruturado Ltda.

The previous version was approved on 31/03/2026 (a general review and new structure of the policies and procedures). This version control has been recorded in the body of each document since March 2026, although the policies have existed since M8 Partners was authorised to operate and the versions are duly archived on M8 Partners' internal network.

M8 Partners is committed to protecting the privacy and personal data of everyone it deals with, in accordance with the Brazilian General Data Protection Law (Federal Law No. 13,709/2018 - LGPD).

This Privacy Policy sets out clear guidelines on the collection, use, purpose, storage and sharing of the personal data of Staff, job Candidates, Clients (fund shareholders, managed-portfolio clients and their representatives), Service Providers and site Visitors.

M8 Partners recognises the importance of privacy and personal-data protection as a fundamental right, and undertakes to process personal data transparently, securely and in compliance with applicable law. This Policy applies to all personal data collected by M8 Partners, whether physically, electronically, through the site, by email or by any other means of communication.

M8 Partners processes data in line with the principles of purpose, suitability, necessity, free access, data quality, transparency, security, prevention, non-discrimination and accountability set out in the LGPD.

Personal Data is information that identifies or can identify a natural person, directly or indirectly. It includes, but is not limited to:

• Full name and social name;
• Home and business address;
• Landline and mobile phone numbers;
• Personal and corporate email address;
• CPF and ID (RG) number;
• Date of birth;
• Banking and payment information;
• Professional-registration data (CVM, ANBIMA, OAB, CRC, etc.);
• Health information (where needed for benefits or legal obligations);
• Biometric data (where applicable);
• Professional and academic background;
• Browsing data on corporate systems and platforms; and
• IP address and geolocation data.

Sensitive Personal Data includes information on racial or ethnic origin, religious conviction, political opinion, union membership, data concerning health or sex life, and genetic or biometric data, which receive special protection under the LGPD.

The managers that make up M8 Partners are the joint controllers of the Personal Data and are responsible for the decisions regarding its processing. The controllers act jointly and share the same Data Protection Officer (DPO), named in Section 7 below. Controller details:

• Legal name: M8 Partners Gestora de Recursos Ltda. — CNPJ 18.038.439/0001-79;
• Legal name: M8 Gestão de Crédito Estruturado Ltda. — CNPJ 67.732.819/0001-14;
• Address: Rua dos Pinheiros, 1060, 2nd floor, Suite 22, Pinheiros, São Paulo/SP, 05422-002; and
• Site: www.m8partners.com.br.

M8 Partners has appointed a Data Protection Officer (DPO), who — together with the deputy DPO — can be contacted at the email below:

• DPO: Thaís Tamborim Herrero — thais.tamborim@m8partners.com.br; and
• Deputy DPO: Michel Rubin — michel.rubin@m8partners.com.br.

Under the LGPD, the DPO's duties include, but are not limited to: communicating with data subjects; liaising with the National Data Protection Authority (ANPD); guiding employees and contractors on data-protection and security practices; monitoring and ensuring compliance with the LGPD and internal rules; and managing personal-data incidents. The Deputy performs all of the DPO's functions in the event of absence, impediment or temporary delegation.

The DPO and the Deputy carry out their duties with full independence and autonomy, and are guaranteed the resources needed for effective performance, including access to the information and tools essential to carrying out their responsibilities.

M8 Partners collects and processes different categories of personal data according to the type of relationship with the data subject:

Personal data is processed for the following purposes, according to the category of data subject:

• Common to all: compliance with legal and regulatory obligations; the regular exercise of rights in judicial, administrative or arbitration proceedings; fraud prevention and the data subject's security; and handling requests and communications;
• Staff: performance of the employment contract and management of the relationship; payroll, holidays and terminations; benefits; labour, social-security and tax obligations; CVM and ANBIMA requirements (certifications); performance management; access control; and internal communication;
• Candidates: running selection processes; assessing qualifications; contact for interviews and feedback; and building a talent pool (with consent);
• Clients: registration and identification; suitability analysis; processing subscriptions, redemptions and transactions; regulatory obligations before the CVM, ANBIMA and the Federal Revenue Service; anti-money-laundering (AML/CTF); communication about the funds and delivery of mandatory documents; and handling requests;
• Service providers: formalising and managing contracts; processing payments; tax obligations and withholdings; verifying qualifications and regulatory requirements; and communication about the delivery of services; and
• Site visitors (cookies): improving the browsing experience; traffic and performance analysis; responding to contact requests; and information security and fraud prevention.

M8 Partners may share personal data with the following categories of recipient, as needed for the purposes described in this Policy:

• Government and regulatory bodies: CVM; ANBIMA; the Federal Revenue Service; INSS and Caixa Econômica Federal (FGTS); the Ministry of Labour (eSocial); COAF; the ANPD; and the Judiciary and Public Prosecutor's Office, where required by law;
• Fund administrator, custodian and distributors: shareholder data, as needed for the administration, distribution and custody of the funds;
• M8 Partners's service providers: accounting and payroll firms; benefits administrators; technology and management-system providers; legal and compliance advisers; and recruitment firms; and
• Financial institutions: banks for payment processing.

Personal data is shared only to the extent necessary to fulfil the purposes described in this Policy, and third parties are required, through specific contractual clauses, to apply the same level of protection and confidentiality M8 Partners adopts.

Personal data may be transferred outside Brazil in the following situations. M8 Partners uses Microsoft Azure cloud services to host corporate email and directories; Microsoft's servers may be located in different countries, including the United States and countries of the European Union.

The purpose of the transfer is the secure storage of corporate email and documents, data backup and recovery, identity and access management, and the use of productivity and collaboration tools. Transfers are carried out in compliance with the LGPD, with standard contractual clauses ensuring an adequate level of protection and the suppliers' commitment to applicable data-protection laws. M8 Partners's site (www.m8partners.com.br) is hosted on servers located in Brazil.

Personal data is retained for as long as necessary to fulfil the purposes for which it was collected, according to the following criteria:

• Staff: data kept during the contract; after termination, labour and social-security data for at least 5 (five) years, extendable per limitation periods; FGTS for 30 (thirty) years; and ANBIMA certification for 5 (five) years after departure;
• Candidates: not hired, up to 2 (two) years for possible re-contact, unless deletion is requested; hired, data moved to the Staff records;
• Clients (fund shareholders): data kept while the client is a shareholder; after full redemption, for at least 5 (five) years for regulatory obligations; and AML/CTF data for 10 (ten) years;
• Service providers: data kept during the contract and, after it ends, for at least 5 (five) years for tax obligations and possible legal claims; and
• Site visitors: browsing data and cookies per the specific policy; and contact-form data for as long as needed to handle the request.

Once the retention periods end, personal data will be securely deleted, unless another legal basis justifies keeping it.

Under the LGPD, you have several rights regarding the personal data we process. These rights include, but are not limited to:

• Confirmation that processing exists;
• Access to the data we process about you;
• Correction of incomplete, inaccurate or outdated data;
• Anonymisation, blocking or deletion of unnecessary or excessive data, or data processed in breach of the LGPD;
• Portability to another provider, upon express request;
• Deletion of data processed with the data subject's consent;
• Information on the entities with which we share your data;
• Information on the option not to consent and the consequences of refusal;
• Withdrawal of consent at any time; and
• Petition before the National Data Protection Authority (ANPD).

There are legal circumstances that may prevent the exercise of some of the rights above, particularly where processing is necessary for the controller to comply with a legal or regulatory obligation. You may exercise your rights by contacting the Data Protection Officer at the email above. M8 Partners will respond within 15 (fifteen) days, as provided by the LGPD, and may request additional information to verify the requester's identity and legitimacy.

M8 Partners's site (www.m8partners.com.br), hosted in Brazil, uses cookies to improve the browsing experience. Cookies are small text files stored on the user's device when they access a website, widely used to make sites work more efficiently and to provide information to site owners.

• Strictly necessary cookies: essential to the site's operation and cannot be disabled; they include those enabling basic navigation and access to secure areas;
• Performance cookies: collect information on how visitors use the site, used only to improve how it works; and
• Functionality cookies: let the site remember the user's choices and provide enhanced, personalised features.

You can manage and/or disable cookies in your browser settings. Disabling some cookies, however, may affect the site's functionality. When you access our site, you will be informed about the use of cookies and can express your consent or preferences through the options provided.

M8 Partners maintains a Cybersecurity and Information Security Policy setting out the technical and administrative measures suited to protecting personal data against unauthorised access and against accidental or unlawful destruction, loss, alteration, disclosure or any inappropriate or unlawful processing. The measures adopted include:

• Physical and logical access control to premises and systems;
• Encryption of data in transit and at rest;
• Firewalls and intrusion-detection systems;
• Strong-password policies and multi-factor authentication;
• Staff training and awareness;
• Regular backups and disaster-recovery plans; and
• Periodic review and updating of the security measures.

In the event of a security incident that may pose a relevant risk or harm to data subjects, M8 Partners will notify the ANPD and the affected data subjects, as required by the LGPD.