Legal document · LGPD

Privacy Policy and Data Protection

International Version (English). Based on the Brazilian Data Protection Law (LGPD, Law No. 13,709/2018), with cookies, legal grounds and international-transfer provisions.

Version 1.0 · effective as of June 29, 2026

Note on language and governing framework. NW Energy operates from Brazil and processes personal data in Brazil. Therefore this Policy is governed by the Brazilian LGPD. This English version is provided for the convenience of international clients and partners; it does not replace the Brazilian-Portuguese version, which prevails in case of divergence.

Contents 1. Introduction and legal basis 2. Controllers and DPO 3. Personal data processed 4. Legal bases 5. Sharing and processors 6. International data transfers 7. Data subject rights 8. Retention and security 9. Cookie Policy 10. Changes and contact

1. Introduction and legal basis

NW Energy respects the privacy and data protection of its users, clients and visitors. This Policy describes how personal data is collected, used, shared, stored and protected, and what rights data subjects have.

1.1. Laws underpinning this Policy

Law	Subject	Role in this Policy
Law No. 13,709/2018 (LGPD)	Personal data protection in Brazil	Backbone: principles, legal bases, rights
Law No. 12,965/2014	Brazilian Civil Rights Framework for the Internet	Internet use, access logs, cookies
Decree No. 8,771/2016	Regulates the Civil Rights Framework	Security standards and log retention
Law No. 8,078/1990 (CDC)	Consumer protection	Clear and adequate information to consumers
Laws No. 9,613/1998 & 14,478/2022	AML-CFT and virtual assets	Legal obligation justifying KYC data processing

LGPD principles applied (art. 6). This Policy observes, among others, the principles of purpose, adequacy, necessity (minimization), free access, data quality, transparency, security, prevention, non-discrimination, and accountability. In particular, minimization guides collecting only what is necessary at each stage — sensitive identification data only at the KYC/contract stage.

2. Controllers and Data Protection Officer (DPO)

This Policy is adopted under joint controllership (art. 5, IX, LGPD) by the following New Winds ecosystem entities:

Operational controller: NW ENERGY SPE ANÁPOLIS-GO LTDA, enrolled with the Brazilian taxpayer registry (CNPJ) No. 58.374.962/0001-90, with registered office at Área Rural, S/N, KM 13, Área Rural de Anápolis, Anápolis-GO, Brazil, ZIP 75149-899.

Controller (holding): NEW WINDS SUSTAINABLE GROUP S/A, CNPJ No. 26.589.817/0001-30, with registered office at Rua dos Ipês, 51, Suite 01, Alphaville, Barueri-SP, Brazil, ZIP 06453-025.

Data Protection Officer (DPO), under art. 41 LGPD: Dr. Paulo Armando Garcia da Cruz (OAB/GO-29,717), contact: contato@nwenergy.com.br.

Data subject channel. Data subjects may contact the DPO at the e-mail above to exercise their rights, clarify questions or file complaints regarding the processing of their data.

3. Personal data processed

NW Energy processes the following categories of data, according to the stage of the relationship:

Category	Examples	When collected
Registration/contact	Name, e-mail, phone/WhatsApp	Simulation, proposal, support
Identification (KYC)	Tax ID, official document, selfie, proof of address	Contract formalization
Source of funds	Declaration and supporting documents	Above threshold or upon red flag
Transactional	Plan contracted, payment, wallet/account indicated	Contract execution
Navigation	IP, identifiers, cookies, pages viewed	Website access (security and metrics)

Sensitive personal data and blockchain (non-negotiable technical principle). Personal data and sensitive documents are NEVER recorded on a public blockchain or IPFS. The blockchain and IPFS store only technical integrity (hashes, timestamps, technical proofs of the AriesEye system). Rationale: an immutable record of personal data is incompatible with data subject rights — in particular the right to erasure (art. 18, VI, LGPD). Separating proof of integrity (on-chain) from personal data (off-chain, in a controlled database) is what makes the ecosystem LGPD-compliant.

4. Legal bases for processing (art. 7 LGPD)

Each purpose relies on a specific legal basis:

4.1. Performance of a contract and preliminary procedures (art. 7, V)

Processing necessary to fulfill the data subject’s request, generate a proposal, formalize and perform the computing-capacity lease agreement, and provide support.

4.2. Compliance with a legal/regulatory obligation (art. 7, II)

Processing of KYC and source-of-funds data to comply with AML-CFT requirements (Law 9,613/1998; Law 14,478/2022) and record-keeping obligations.

4.3. Legitimate interest (art. 7, IX)

Processing for information security, fraud prevention and service improvement, always balanced against the rights and freedoms of the data subject, with safeguards and the possibility to object.

4.4. Consent (art. 7, I)

Where applicable — for example, for marketing communications — consent is collected in a highlighted manner and may be withdrawn at any time, without prejudice to the lawfulness of prior processing.

5. Sharing and processors

Data may be shared, to the extent necessary, with:

Recipient / Processor	Purpose	Safeguard
Payment provider (InfinitePay)	Process Pix payments	Contract with data protection clauses
Hosting / cloud (e.g., Cloudflare)	Operate the website and infrastructure	Data clauses; technical security
KYC / verification tools	Identify and validate the Client	Processing limited to purpose
Mining pool (ViaBTC, where applicable)	Receipt flow by the Client	BTC is paid to the Client; no custody
Competent authorities	Compliance with law/order	Only when required by law

5.1. NW Energy does not sell personal data.

5.2. Processors handle data on behalf of NW Energy, under instructions and contract, with security and confidentiality obligations (arts. 39 and 37 LGPD).

6. International data transfers

Because clients and partners may be located outside Brazil, and some providers operate abroad, personal data may be transferred internationally. Such transfers follow Chapter V of the LGPD (arts. 33 to 36).

6.1. Bases for international transfer

Transfer necessary for the performance of a contract to which the data subject is a party, or for preliminary procedures at the data subject’s request (art. 33, VI).
Transfer to countries or international organizations that provide an adequate level of protection, or based on specific safeguards (standard contractual clauses, specific contractual clauses, global corporate rules) (art. 33, I and II).
Transfer with the specific and highlighted consent of the data subject, where applicable (art. 33, VIII).

Practical meaning for international clients and partners. If you contract or act as a partner from outside Brazil, the data you provide is processed in Brazil under the LGPD, and any transfer abroad (for example, to a cloud provider or to a commercial representative located in another country) is carried out under the legal bases above, with contractual safeguards. Your rights as a data subject (Section 7) remain available regardless of where you are located.

7. Data subject rights (art. 18 LGPD)

Upon request to the DPO, the data subject may exercise the following rights:

Confirmation of the existence of processing and access to the data.
Correction of incomplete, inaccurate or outdated data.
Anonymization, blocking or erasure of unnecessary, excessive or non-compliant data.
Portability to another provider, subject to commercial and industrial secrecy.
Erasure of data processed with consent, except for legal retention.
Information about sharing and about the possibility of not granting consent and its consequences.
Withdrawal of consent.

Limit of rights against legal obligations. Certain data (e.g., KYC and AML-CFT) must be retained for a legal period even after an erasure request, because their retention is required by law (art. 16, I, LGPD). In such cases, NW Energy informs the data subject of the basis and retention period, erasing or anonymizing the data at the end.

Response time and channel: requests are answered within a reasonable period; the channel is the DPO’s e-mail (Section 2). The data subject may also petition the Brazilian National Data Protection Authority (ANPD).

8. Retention and security

8.1. Retention

Data is retained for the period necessary for the purposes and legal obligations (including tax and AML-CFT retention — minimum of 5 years from completion of the transaction or termination of the relationship, under art. 9, §2, of Law 9,613/1998), then erased or anonymized.

8.2. Security measures

Technical and administrative controls proportionate to risk (art. 46 LGPD).
Access restricted on a need-to-know basis; access logs and audit trails.
Encryption and segregation of sensitive KYC documents.
Separation between on-chain integrity proof and off-chain personal data.

8.3. Security incidents

In case of an incident that may cause relevant risk or harm, NW Energy takes appropriate measures and notifies the ANPD and data subjects where required (art. 48 LGPD), within a reasonable period.

9. Cookie Policy

The website uses cookies and similar technologies for functioning, security, metrics and experience improvement. Management occurs via a consent banner and browser settings.

Type	Purpose	Can disable?
Essential	Core functions and site security	No (breaks the site)
Performance / Analytics	Aggregated usage metrics	Yes
Preferences	Remember user choices	Yes

Non-essential cookies depend on consent (art. 7, I, LGPD; Civil Rights Framework). Consent can be adjusted at any time via the banner.

10. Changes and contact

NW Energy may update this Policy, publishing the current version on the website with the date of update. Questions and requests should be directed to the DPO (Section 2).

Last updated: June 29, 2026.