Privacy Notice.

We know that understanding the provisions of this Privacy Notice may not be easy for every reader, so we have separated some terms to define their meaning and make the guidelines in this document easier to follow.

• LGPD: abbreviation for the Brazilian General Data Protection Law, Federal Law No. 13,709/2018, which sets out the rules for processing personal data, who the processing agents are, and the penalties for non-compliance with the law.
• Processing Agents: the LGPD provides for the role of the Controller and the Operator in the processing of personal data. The Controller is the one who holds decision-making power over the personal data. It is the Controller who determines the format for collecting the data, for which purposes the data will be processed and the retention period for the personal data. The Operator, in turn, only carries out processing of personal data on the Controller's instructions, as defined by the Controller.
• Data Subject: the natural person to whom the personal data refers.
• Processing of personal data: any operation carried out with personal data, which includes collection, viewing, storage, processing and deletion of personal data.
• Personal Data: information that identifies or may identify a natural person, as set forth in Art. 5, item I, of the LGPD.
• Sensitive Personal Data: information linked to a natural person concerning racial or ethnic origin, religious belief, political opinion, membership in a union or organization of a religious, philosophical or political nature, data concerning health or sexual life, genetic or biometric data, as set forth in Art. 5, item II, of the LGPD.
• Anonymized Data: data relating to a data subject that cannot be identified.
• Pseudonymized Data: information that cannot be directly linked to a person without the use of additional data.
• IoT: abbreviation for Internet of Things. This classification is used to refer to physical objects that collect data. IoT can be applied for various purposes, including, but not limited to, sensors for smart homes, sensors for security monitoring or industrial applications, telemetry and connectivity, and data processing.
• GLO Devices: equipment designed and manufactured by GLO for specific purposes, including, but not limited to, consumption data telemetry, for example.
• BLE: abbreviation for Bluetooth Low Energy, a wireless personal area communication technology designed and applied for various purposes, such as, for example, internet of things, security, industry and home applications. BLE was designed to consume minimal energy and enable communication between devices.
• Technical data: structured information about the characteristics, components and parameters of a service, GLO Device or devices with the SDK. Technical data includes, but is not limited to, data on signal strength (Wi-Fi and BLE), device model, manufacturer and operating system version.
• Collaborative Network or One Protocol: the BLE-based communication protocol owned by GL that enables communication between GLO Devices ("hardware") and devices running GLO's SDK, even without an Internet connection at the time of capture.
• SDK: abbreviation for Software Development Kit. It is the tool that enables the sending of and communication between the devices that make up GLO's Collaborative Network.
• Advertising Identifiers: the mobile device's advertising identifier, which can be reset by the user.
• Device Identifier: permanent device identifier, which cannot be reset by the user.
• Commercial Partners or Clients: the Companies that use the infrastructure, GLO Devices and Collaborative Network for a specific purpose set forth contractually.
• LIA: abbreviation for Legitimate Interest Assessment or Balancing Test. It involves carrying out a weighing that takes into account the legitimacy of the interest, the necessity of the processing, the impacts on the rights of the data subjects and their legitimate expectations compared with the interests involved.
• DPIA (RIPD): abbreviation for Data Protection Impact Assessment. Document required by Art. 38 of the LGPD for processing of personal data that meets the general and specific criteria indicated by ANPD.
• ANPD: abbreviation for the National Data Protection Authority, the authority responsible for regulating, supervising and applying the penalties set forth in the LGPD.
• DPO or Data Protection Officer: the person responsible for data processing activities at an institution, who acts as the communication channel between the company, the data subjects and the ANPD.

The GL One® Network is a collaborative network for industrial data collection and telemetry. It combines two classes of nodes: physical sensors, embedded in field equipment (water meters, energy meters, remote-reading equipment), which operate via BLE radio broadcast, and logical nodes, which run through an SDK embedded in GLO's own mobile apps and partners' apps, which, through their technology, identify the physical environment around the user's device, process the result and deliver it to GLO's infrastructure, which, in turn, makes it available to Commercial Partners.

The Network carries encrypted operational data between these endpoints and makes measurements, events and context available to Commercial Partners.

As a rule, GLO collects only the technical data necessary for its application to function. GLO does not identify or re-identify data subjects and does not associate pseudonymized identifiers with civil registration data.

In any case, Commercial Partners, under their sole responsibility, may cross-reference technical data provided by GL and identify a personal data subject from the technical information sent.

GLO collects technical data from three distinct sources, detailed below: (i) GL Devices; (ii) devices with the SDK; and (iii) third-party BLE devices captured by the Collaborative Network.

3.1. Technical Data Collected by GL Devices GLO Devices collect and send, in a secure and encrypted manner, the following categories of information to devices with the embedded SDK:

3.2. Technical Data Collected by the SDK GLO does not collect, process or store, on its infrastructure, registration data such as name, Tax ID, ID, e-mail or phone number. The personal data subject is not identified by GLO. The SDK embedded in GLO's own apps or in Commercial Partners' apps collects and sends, in a secure and encrypted manner, the following categories of information to GLO's Collaborative Network:

3.2.1. Impact on mobile data consumption and device resources GLO's SDK transmits the technical data described above to GLO's infrastructure through your device's data connection (Wi-Fi or mobile data). This means that a minimal portion of your data allowance may be used for this transmission.

The volume of data transmitted is designed to be minimal and not to interfere with the consumption of your telecommunications service plan. Transmission prioritizes a Wi-Fi connection when available, minimizing the impact on mobile data as much as possible. GLO contractually requires its Commercial Partners to ensure that the SDK's transmission volume does not exceed the reasonable limits expected for the type of app it is embedded in.

The SDK is also designed for minimal battery and processing consumption, with no perceptible impact on the device's performance or battery life.

To monitor the data consumption of the app that uses the GLO SDK:

• Android devices: Settings → Apps → [app name] → Data usage.
• iOS devices: Settings → [app name] → Mobile Data.

3.3. Technical Data Collected from BLE Devices The Collaborative Network's mesh also captures signals from third-party Bluetooth devices that pass through the coverage area, such as trackers, headphones and other equipment with BLE functionality, even if such device does not have GLO's SDK:

The processing of personal data carried out by GLO within the scope of the Collaborative Network is legally based on GLO's legitimate interest (Art. 7, item IX, of the LGPD), for the following purposes:

• Operating, maintaining and expanding the BLE Collaborative Network infrastructure;
• Ensuring the integrity, availability and security of the Collaborative Network; and
• Developing and improving low-power location and connectivity technologies.

The legitimate interest was assessed through a Balancing Test (LIA), whose results are documented in the Data Protection Impact Assessment ("DPIA").

The balancing test concluded that the risks to data subjects are mitigated through robust technical measures such as pseudonymization, geographic aggregation, per-client data isolation and other technical security measures.

The processing of pseudonymized data carried out by GLO is not intended for individual commercial profiling. You may object to this processing at any time, in accordance with the instructions available in item 7.

GLO shares data only for the purposes necessary for the operation of the Collaborative Network. The table below summarizes the recipients and the safeguards applied:

5.1. Commercial Partners' obligations to the end user: GLO contractually requires all Commercial Partners that embed the SDK in their apps to:

• i: include, in their own privacy policy, express mention of the data collection carried out by the GL SDK, describing the categories of data collected and the purposes, as well as the limited use of the user's data package, in language accessible to the user;
• ii: make available to the user an accessible opt-out mechanism, preferably in the app's own privacy settings, with an effect equivalent to the revocation of permission described in item 8 of this Notice; and
• iii: use the technical data provided by GLO exclusively for the purposes set forth contractually.

5.2. Consequences of non-compliance by the Commercial Partner: Non-compliance by the Commercial Partner with the privacy obligations contractually assumed with GLO, including, but not limited to, the obligations described in item 5.1 of this Notice, subjects the Partner to the penalties set forth in the respective contract.

In the event that the Partner's non-compliance results in damage to GLO, including damage arising from fines, administrative sanctions, court judgments or expenses incurred as a result of data subjects' claims, GLO shall be entitled to full reimbursement and coverage of all damages and costs incurred, under the terms of the contract executed with the Partner and applicable law, including the right of recourse under Arts. 42 et seq. of the LGPD.

GLO uses private cloud infrastructure to process the technical data necessary for the operation of the Collaborative Network.

The technical data processed by GLO within the scope of the Network is retained for the following periods:

After the retention period has elapsed, the data is deleted securely and irreversibly.

Under Art. 18 of the LGPD, the personal data subject has the following rights:

• Confirmation: to be aware of whether GLO processes personal data belonging to you.
• Access: to access the personal data that GLO processes about you.
• Correction: to have any incorrect or untrue data that GLO processes about you corrected.
• Deletion: to have your personal data deleted, when permitted by law.
• Objection (opt-out): to object to the processing carried out.
• Information about sharing: to be aware of which entities GL shares data belonging to you with.
• Review of automated decisions: to have the possibility of review of decisions taken exclusively based on automated processing.

As GLO does not hold direct registration data, such as, for example, name, ID, Tax ID, date of birth, the right to portability does not apply within the scope of the Network.

Due to the pseudonymized nature of the Collaborative Network, GLO does not hold registration data that would allow it to individually identify the data subject from a generic request.

To exercise the rights of access, correction or deletion, the data subject must provide the advertising identifier of their device by e-mail to dpo@grouplinkone.com.

If you want to identify or reset your device's advertising identifier:

• Android devices: go to Google Play Store → profile picture → Settings → General → Ads.
• iOS devices: go to Settings → Privacy & Security → Tracking.

The right to object to the processing (opt-out) may be exercised at any time by revoking location and Bluetooth permissions in the device's operating system settings, which immediately ends data collection by the SDK.

Immediate opt-out: revoke the Bluetooth and/or location permissions for the app in question in the operating system settings:

• Android devices: Settings → Apps → [app] → Permissions.
• iOS devices: Settings → [app] → Location / Bluetooth.

Opt-out through the app: when the partner app provides privacy settings, opt-out can be done directly there.

Formal requests to object to the use of the data subject's device: web form available at https://www.grouplinkone.com/esquecer-dispositivo. The opt-out is accepted immediately and processed within up to 5 (five) business days, the time needed for operationalization and updating, so that the request is fully propagated across all systems and infrastructure of the Collaborative Network.

GLO adopts technical and organizational measures to protect technical data against unauthorized access, loss, alteration or destruction. Among the main ones:

• Structural pseudonymization: advertising identifiers are pseudonymized.
• Geographic aggregation: geographic coordinates undergo geographic aggregation to reduce resolution to 0.74 km² (non-precise location).
• Encryption in transit and at rest: technical data transmitted between GLO Devices, devices with the SDK and GLO's infrastructure travels and is stored in encrypted form, using industry-standard encryption protocols and algorithms.
• Access control based on the principle of least privilege: only previously authorized and necessary people and applications have access to the technical data.
• Data isolation per client: each partner exclusively accesses data relating to its own users.

In the event of a security incident that may generate a relevant risk or damage, GLO will notify the ANPD and the affected data subjects within the timeframes and forms required by law, unless legally and/or contractually prevented from doing so.

If you have questions, comments or suggestions related to the provisions of this Notice, please contact our Data Protection Officer.

• Data Protection Officer: Vinicius Massao Souza Hiraga
• Contact e-mail: dpo@grouplinkone.com

This document was last reviewed on September 14, 2026. GLO may change the provisions of this document based on its technical and operational reality. The version in force is the one available on our website (www.grouplinkone.com).