H.I.G. Capital, LLC Privacy Policy

Posting Date: February 6, 2025
Effective Date: February 6, 2025

H.I.G. Capital, LLC (“We”, “Us” or “H.I.G.”) respects your privacy and the security of your personal information.

This Privacy Policy (“Privacy Policy”) describes our information and privacy practices with regard to the websites owned by us or operated on our behalf, and to which this Privacy Policy is linked to directly from such websites (collectively, the “Sites”).

This Privacy Policy does not apply to information collected offline or otherwise outside of the Sites. This Privacy Policy does not address our privacy practices concerning any nonpublic personal information we collect from our investors, potential investors, or employees (including prospective employees or contractors) through sources other than the this Site;, which are addressed in separate notices.

Except as otherwise set forth in this Privacy Policy, by browsing or using services on our Sites, you are accepting the practices described in this Privacy Policy. If you do not agree to this Privacy Policy, please do not provide us your personal information.

Geographical Transfers of Personal Information

H.I.G. provides commercial services from its offices in the United States. If you are visiting the Sites from outside the United States and provide us with personal information, please note that your personal information will be transferred, stored and processed within the United States. Such transfers will be made in accordance with applicable law.

Regarding Brazil, see the related Annex.

Personal Information We Collect

You can visit the Site without providing us with information that identifies you. The Site may provide you with the opportunity to request information by providing us with your contact information, including your name, email address, phone number, and company information.

Regarding Brazil, see the related Annex.

Collection through Automated Collection Technologies

We gather certain information automatically through cookies and other industry standard collection mechanisms. This information may include Internet protocol (IP) addresses, browser type, Internet service provider (ISP), referring/exit pages, the files viewed on our Sites (e.g., HTML pages, graphics, etc.), your operating system, date/time stamp, the country or state from which you accessed our Sites, and/or clickstream data to analyze trends in the aggregate and administer the Sites.

This Site uses cookies to improve your experience while you navigate through the Site. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the Site. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience. Details on our use of cookies is available on our Cookie Policy.

At this time, we do not respond to “Do Not Track” browser settings or signals.

Regarding Brazil, see the related Annex.

How We Use Personal Information Collected

We may use personal information collected from you through the Site for the following purposes:

Purpose	Legal Basis
Respond to your specific request (e.g., provide you information regarding our products and services).	Contractual necessity
Administration and other business operation purposes.	Legitimate interest
Record your relationship with us.	Contractual necessity Legitimate interest
Identity verification purposes.	Legitimate interest
Fraud, abuse and prevention of other illegal activity.	Legal obligation
Comply with law.	Legal obligation

Regarding Brazil, see the related Annex.

Sharing and Disclosure of Personal Information

We may share your personal information with our affiliates and our service providers as necessary to fulfill the purposes set forth above. We also reserve the right to share your information in connection with a business transaction where some or all of our assets are sold or transferred or used as security. If necessary, we may disclose specific information without your consent and without notice to you as required to comply with laws and regulations, or to comply with court orders, subpoenas, or lawful discovery requests. Information collected from you may also be used to investigate security breaches or otherwise cooperate with legal authorities.

Regarding Brazil, see the related Annex.

Security

We have implemented reasonable physical, technical, and organizational safeguards to help protect your personal information from unauthorized access, acquisition, or disclosure, alteration, or destruction. Although we strive to keep your personal information secure, no safeguards can be guaranteed to be completely secure, so you should exercise caution when transferring personal and other sensitive information over the Internet.

Regarding Brazil, see the related Annex.

Links to Third Party Websites

Our Sites may include links to other websites whose privacy practices may differ from ours. If you visit or submit personal information to any of those websites, your information is governed by their privacy policies. We encourage you to carefully read the privacy policy of any websites you visit.

Regarding Brazil, see the related Annex.

Personal Information of Children

H.I.G. provides a service for commercial entities. We do not knowingly collect or retain personal information for children under the age of thirteen (13). Any information received from a child under the age of 13 will be removed from our system once we learn that it has been submitted to us. Please email us at the email address in the Contact Information section below if you believe we have personal information of a child under the age of 13.

Regarding Brazil, see the related Annex.

Changes to This Privacy Policy

H.I.G. may update this Privacy Policy from time to time. When we do make updates, we will also revise the “last updated” date at the top of this page. To the extent H.I.G. makes any material change to this Privacy Policy, a message will be posted on the Sites prior to the change becoming effective. We encourage you to periodically review this page for the latest information on our privacy practices.

Contact Information

If you have any questions or comments concerning our Privacy Policy, please let us know by contacting us as indicated on the “Contact Us” area of the Site or at privacy@hig.com.

Regarding Brazil, see the related Annex.

Rights of California Residents

If you are a California resident, this section provides you with additional information, describes your rights and explains how to exercise those rights. To exercise these rights, please contact us using the contact details in the Contact Information section of this Privacy Policy.

Right to Access. Subject to certain limits, you may ask us to provide the following information for the 12-month period preceding your request:
- categories of personal information we collected about you;
- categories of sources from which the personal information was collected;
- business or commercial purpose for collecting the personal information;
- categories of third parties with whom we shared the personal information;
- if we disclosed personal information for a business purpose, a list of the disclosures including the personal information categories that each category of recipient received; and
Right to Delete. You also have the right to ask us to delete any personal information that we have collected about you, subject to certain limitations as set forth under CCPA. We may deny your deletion request if the information is necessary to comply with a legal obligation.
Right to Correct. You have the right to correct any inaccurate personal information that we may have collected about you.
Right to Opt-Out. We do not offer a right to opt-out of selling your personal information to third parties because we do not sell your personal information to third parties.
Right to Nondiscrimination. We will not discriminate against you if you exercise your privacy rights under California law.

We may need to request specific information from you to help us confirm your identity and ensure your rights set forth above. This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Rights of Individuals in the European Economic Area (EEA)

If you are located in the EEA, you have certain rights to access and control the personal information that we hold about you, as detailed below. To exercise these rights, please contact us using the contact details in the Contact Information section of this Privacy Policy.

Right of Access. You have the right to request a copy of the personal information that we hold about you free of charge, however we may charge a “reasonable fee” if the cost is administratively burdensome.
Right to Correct. If there are any inaccuracies in the personal information we hold about you, we will correct them upon request and inform you about the corrections.
Right to Delete. You have the right to request that we delete any personal information that we hold about you. If you think that we should not be processing your personal information any more, you may request that we delete it. However, we may retain your personal information in order to comply with legal obligations or in connection with a legal claim. We will inform you upon deletion or if an exemption applies.
Restrictions on Use. You have the right to request that we restrict our processing of your personal information, if: (i) you contest the accuracy of it (unless the accuracy is verified); (ii) you believe the processing is against applicable law; (iii) you believe that we no longer need your personal information for the purposes for which it was collected, but you still need your data to establish, exercise or defend a legal claim; or (iv) you have objected to the processing while we are verifying whether our legitimate grounds to process your personal information override your own rights. In such circumstances, we will only process such personal information based on your consent (including not deleting it). However, we may override your request in order to comply with legal obligations or in connection with a legal claim. We will inform you where such exemption applies or where the restriction is no longer available.
Right to Object. You have the right to object to our processing of your personal information where we are relying on a legitimate interest and you believe that it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal information for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your personal information which override your rights and freedoms or in connection with a legal claim.
Request to Transfer. You may request that we transfer your personal information to another organization, subject to certain conditions. We will send such personal information directly if we have the technical means. Please note that this right only applies to automated personal information which you initially provided consent for us to use or where we used the personal information to perform a contract with you.
Withdrawal of Consent. If you previously gave us your consent to allow us to process your personal information for a particular purpose, but you no longer wish to consent to us doing so, you can contact us to let us know that you withdraw that consent. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

We may need to request specific information from you to help us confirm your identity and ensure your rights set forth above. This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

You also have the right to make a complaint at any time to the competent data protection supervisory authority in your jurisdiction if you do not agree with the manner in which we have processed your personal information or responded to your requests in relation to your personal information. Details on National Data Protection Authorities are available at https://ec.europa.eu/newsroom/article29/items/612080/en.

Rights of Individuals in Brazil

If you are located in Brazil or if your personal data is processed in connection with activities in Brazil, this section provides you with additional information, describes your rights, and explains how to exercise those rights under the Brazilian General Data Protection Law (LGPD). To exercise these rights, please contact us using the contact details listed in the ‘How You Can Protect Your Rights’ section included below.”

Controller’s Information

H.I.G. Brazil Investment Advisory Ltda (“[H.I.G]”)
Headquarters: Av. Ataulfo de Paiva, 1251, 9th floor, Leblon, Rio de Janeiro – RJ. CEP: 22440-034 Brazil
CNPJ: 15.085.374/0001-24.

Special Notice for Children, Adolescents, Legal Representatives and Seniors

SPECIAL NOTICE FOR CHILDREN, ADOLESCENTS, AND LEGAL REPRESENTATIVES

H.I.G. provides services to commercial entities. If you are under 16 years old, you should not register in our environment.
Although we do not allow the registration of children and adolescents under the age of 16, parents or legal representatives must supervise the online activities of their minors.
The activities of adolescents aged 16 to 18 must be monitored by their parents or legal representatives.

SPECIAL NOTE FOR SENIORS

If you are over 60 years old, please note that we are aware of the risks involved in processing your Personal Data and are committed to taking all appropriate measures to protect it. Furthermore, we pledge to handle your Data in a manner that is:

Clear;
Simple;
Accessible; and
Suitable for your understanding.

About the Data we Process

How We Process Data. The Data may be processed when you Interact with Our Environments.

What do we process?	For what purpose do we process?
Registration Data
– Full name – E-mail – Contact phone numbers	i) To fulfill obligations arising from the use of the Site’s functionalities. ii) To comply with legal and regulatory obligations.
Digital Identification Data
– IP Address and Logical Port Origin – Device (operating system version) – Geolocation – Date and time records of each action you take – Which screens you accessed	i) To comply with legal obligations regarding records established by the Civil Rights Framework for the Internet – Law 12,965/2014. ii) To comply with legal and regulatory obligations.

Update and Accuracy of Data: You are solely responsible for the accuracy, truthfulness, or updating of the Data you provide to us. We are not obligated to process your Data if there are reasons to believe that such Processing could lead to a violation of any applicable law, or if you are using our environments for any illegal or unlawful purposes.

Database: The database created through the collection of Data is our property and under our responsibility, with its use, access, and sharing being conducted within the limits and purposes described in this Policy, when necessary.

Technologies Used: We use Cookies on Our Website. If you do not wish to keep them, you should configure your internet browser to block them. However, we highlight that if they are disabled, some functionalities of Our Website may become unavailable.

We do not use any type of automated decision-making that affects your interests.

How we Share your Data

Data Sharing Scenarios: The processed Data and recorded activities (logs) may be shared:

i) With judicial, administrative, or governmental authorities, whenever required by law, request, requisition, or order in this sense;

ii) With the companies that are part of the Economic Group to which H.I.G. belongs, always in compliance with the guidelines of this Policy;

iii) With service providers or partner companies, to facilitate, provide, or carry out activities related to Our Environments;

iv) With marketing and advertising companies, to deliver promotions and information suitable for your profile; and

v) Automatically, in case of corporate transactions, such as mergers, acquisitions, or incorporation of H.I.G.

If you have any questions about with whom we share your Data, please contact us through the Contact Channels provided at the end of this Annex.

Data Anonymization: For the purposes of market intelligence research, press releases, and advertising, the Data will be shared in an anonymized manner, in a way that prevents its identification.

Processing by Third Parties under Our Guidance: We carefully assess our partners and service providers and enter contractual obligations with them regarding confidentiality, information security, and Data protection, with the aim of safeguarding your Data.

How we Store your Data and Activity Logs

Storage Location: We store your Personal Data and activity logs onto our own servers or on carefully selected partner servers. To protect your privacy, we implement strict security measures, both technical and administrative, to ensure that your Data remains secure, accessible only by authorized individuals, and protected against unauthorized alterations. Our commitment is to preserve the confidentiality, integrity, and availability of your Data throughout the entire period that it is under our responsibility.

In case your Personal Data is stored on servers located outside Brazil, this may involve an international data transfer. In such cases, the provisions outlined in the INTERNATIONAL DATA TRANSFER section will apply.

Storage Period: We store the Data only for as long as necessary to fulfill the purposes for which it was processed or to comply with any legal, regulatory obligations, or to preserve rights.

Data Disposal: Once the retention period has expired and the legal requirements have been met, the Data will be deleted using secure disposal methods or anonymized for statistical purposes.

International Data Transfer

To enable and improve the execution of our activities, some of our resources and servers, as well as those of our partners and service providers, are located outside Brazil, thereby characterizing an international transfer of your Personal Data for the following purposes:

Purpose	Destination Countries
Cloud storage hosted abroad	United States of America

We take the necessary precautions to ensure that transfers comply with the guidelines set by current legislation and only transfer your Personal Data to partners who demonstrate compliance with applicable laws, maintaining a level of compliance that is similar to or more stringent than the requirements of Brazilian legislation.

We maintain contracts with these partners that require strict protection of your Personal Data and information security. These contracts ensure that your Personal Data is kept confidential and processed solely for the purposes outlined above.

How We Protect Your Data and How You Can Also Protect It

Security and Governance Practices: To safeguard your privacy and protect your Data, we have a governance program that includes best practices, internal policies, and procedures. These establish organizational conditions, training, educational actions, and mechanisms for supervision and risk mitigation related to the Processing of Personal Data.

Access to Data, Proportionality, and Relevance: Internally, the Data processed is accessed only by authorized professionals, respecting the principles of proportionality, necessity, and relevance to the objectives of our business, as well as the commitment to confidentiality and the preservation of your privacy under the terms of this Policy. In the event of individual leaks or unauthorized access to your Personal Data, we may provide direct reconciliation under the terms of Article 52, § 7 of the LGPD, if you agree and if such incidents cause you significant harm or risk.

Adoption of Best Practices: You are also responsible for the confidentiality of your Data and must always be aware that sharing passwords and access to Data violates this Policy and may compromise the security of your Data and Our Environments. If you identify or become aware of any compromise in the security of your Data, please contact our Data Protection Officer through the Contact Channels provided at the end of this Annex.

Rights of Individuals in Brazil

If you are located in Brazil, you have certain rights to access and control the personal information that we hold about you, as detailed below. To exercise these rights, please contact us using the contact details in the How can you Exercise your Rights section of this Annex.

Anonymization, Blocking, or Deletion. You may request the anonymization of your Data so it can no longer be linked to you, the blocking of your Data to temporarily suspend processing for certain purposes, or the deletion of your Data.
Confirmation and Access. You may request confirmation of whether your Data is being processed and access to your Data, including requesting copies of the records we have about you.
Correction. You may request the correction of your Data if it is incomplete, inaccurate, or outdated.
Portability. You may request that we provide your Data in a structured and interoperable format to facilitate its transfer to a third party, respecting our intellectual property or business secrets.
Information about Sharing: You may request information about third parties with whom your Data has been shared, limiting this disclosure to information that does not violate our intellectual property or business secrets.
Withdrawal of Consent. You may choose to withdraw your consent for any purpose you have previously consented to. This withdrawal will not affect the legality of any processing done prior to that. If you withdraw your consent for purposes essential to the regular operation of Our Environments and services, these may become unavailable to you.
Objection. You may object to the processing of your Data if you do not agree with a specific purpose.
Review. In case of decisions based solely on automated processing, you may request a review of the decision, providing details of how your interests may have been affected.

We may need to request specific information from you to help us confirm your identity and ensure your rights set forth above. This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Non-fulfillment of Requests: We may choose not to fulfill a request to exercise rights if responding violates our intellectual property or business secrets, or if there is a legal or regulatory obligation to retain the Data. Additionally, we may decline to fulfill your request if we need to retain the Data to defend ourselves or third parties in any disputes.

Responses to Requests: We are committed to responding to all requests within a reasonable timeframe and always in accordance with the applicable legislation.

How Can You Exercise your Rights

Contact Channels: If you have any questions regarding the provisions of this Annex, including exercising your rights, you may contact our Data Protection Officer (DPO) through the following contact details:

Data Protection Officer: Peck Advogados

Responsible Party appointed by Peck Advogados: Cecília Helena de Castro

Substitute Responsible Party appointed by Peck Advogados: Leandro Bissoli

Correspondence Address: Av. Brigadeiro Faria Lima, 3900, cj. 102, Itaim Bibi, São Paulo – SP. CEP: 04538-132 – Brazil

E-mail for contact: privacidade@higcapital.com.

Governing Law: This Annex will be interpreted in accordance with Brazilian legislation, in the Portuguese language.

©2025 H.I.G. Capital, LLC. All rights reserved.