Term: 2026–2028

Publicado: 07 de abril de 2026.

1. Presentation

Cocam Cia de Café Solúvel e Derivados maintains an unwavering commitment to the privacy, security, and protection of the personal data of everyone it interacts with: employees, job candidates, customers, suppliers, website visitors, and other stakeholders.

The Personal Data Protection and Privacy Program transparently establishes how Cocam collects, uses, stores, shares, and protects personal data, in strict compliance with the General Data Protection Law (Law No. 13,709/2018 – LGPD) and other applicable regulations.

It is an integral part of Cocam's Integrity Program and aligns with the values of Ethics, Compliance, and Good Faith that guide all our operations.

2. Scope of Application

This Program applies to all personal data processing activities carried out by Cocam as a Controller, including:

• Data collected through the institutional website (www.cocam.com.br) and its subpages.
• Data of employees and job candidates.
• Data of customers, suppliers, and service providers.
• Data of visitors to Cocam’s physical facilities.
• Data received through contracts, forms, emails, and other relationship channels.

Cocam acts as a Processor when processing data on behalf of third parties, in which case specific contractual obligations prevail as applicable.

3. Definitions

In accordance with the LGPD, the following definitions are adopted:

4. Legal Basis for Processing

All data processing at Cocam is grounded in at least one of the hypotheses provided by the LGPD:

5. Collected Data and Purposes

Cocam collects only the data strictly necessary for declared purposes, following the principle of data minimization of data previewed at the LGPD.

5.1 Institutional Website and Cookies

When browsing the website www.cocam.com.br, Cocam automatically collects browsing data through cookies and similar technologies:

5.2 Contact Channels

Data provided voluntarily (name, email, phone, company, message) via the website is collected exclusively to address the request. Processing is carried out by the responsible internal departments (Commercial, Labor Relations, Quality Assurance, Purchasing or Human Resources, depending on the channel through which the data was collected).

This data is handled by the relevant internal areas and is not shared with third parties except as noted in Section 8. Communication can be canceled at any time within 72 business hours.

5.3 Recruitment and Candidates

When applying for a position at Cocam, the data contained in the résumé and recruitment process (full name, identification document, CPF, email, phone number, education, professional experience, and other information provided) are processed for the following purposes:

• Evaluation of the application and management of the recruitment process.
• Verification of professional references, when applicable.
• Communication with the candidate regarding the progress of the process.
• Creation of a talent pool for future opportunities (subject to specific consent).

Candidates’ data are stored in the Human Resources database and are not used for discriminatory, unlawful, or abusive purposes. The candidate may withdraw consent at any time by requesting the deletion of their data.

5.4 Employees and Former Employees

The personal data of employees and former employees are processed for purposes related to the management of the employment relationship, compliance with legal and regulatory obligations (labor, social security, and tax), administration of benefits, control of access to facilities and systems, and the regular exercise of rights in judicial and administrative proceedings.

Processed for employment management, legal obligations (labor/tax), benefits administration, and access control. Retention periods vary from 5 to 30 years based on legal requirements.

5.5 Customers and Suppliers

Representative data is processed for contract management, invoicing, commercial communication, and due diligence. Data is kept for the contract duration plus legal limitation periods.

5.6 Visitors to the physical facilities

Identification and time of entry/exit are collected for access control and site security. CCTV images are also stored.

6. Sensitive Personal Data

Cocam collects sensitive data from employees strictly for:

• Occupational health management (ASO, PCMSO).
• Legal benefits and social security obligations and leaves.
• Diversity and inclusion programs (with specific consent).
• Biometric access control (with consent).

7. Guiding Principles

All personal data processing carried out by Cocam complies with the principles set forth in Art. 6 of the LGPD:

8. Data Sharing

Cocam does not sell, rent, or lease personal data to third parties for commercial purposes. Data sharing only and exclusively occurs in the following scenarios:

9. Information Security

Cocam adopts appropriate technical and organizational measures to protect personal data against unauthorized access, destruction, loss, alteration, or any form of irregular processing:

Technical Measures

• Role-Based Access Control (RBAC) in internal systems.
• Data encryption in transit (TLS/HTTPS) and at rest, where applicable.
• Continuous monitoring of threats and vulnerabilities in IT environments.
• Regular backup with periodic recovery tests.

Organizational Measures

• Mandatory data protection training for employees.
• Confidentiality and data protection clauses in contracts with processors and third parties.

10. Rights of Data Subjects

In compliance with Arts. 17 to 22 of the LGPD, Cocam guarantees the data subject the exercise of the following rights, free of charge and in a free and accessible manner:

11. How to Exercise Rights – Contacting the DPO

Cocam has formally designated a Data Protection Officer (DPO) in accordance with Art. 41 of the LGPD, with the following duties:

• Accept complaints and communications from data subjects, provide clarifications, and take action.
• Receive communications from the ANPD and take administrative and judicial measures.
• Guide Cocam’s employees and contractors regarding the practices to be adopted in relation to the protection of personal data.
• Perform other duties as determined by the controller or established in supplementary regulations.

The data subject who wishes to exercise any of the rights listed should send a request to the Data Protection Officer (DPO) via the following channels:

The message must necessarily contain:

1.    Identification: Whether employee, candidate, customer, supplier, visitor, or another stakeholder.

2.    Type of request: Information, access, update, deletion, revocation of consent, or other rights foreseen by the LGPD.

3.    Identification for response: Full name, email, phone (including WhatsApp, if preferred) and relevant details of the request. In the case of an anonymous request, the response will be provided in a general manner.

4.    Attachments: When necessary, limited to 1 MB per message.

12. Links to Third-Party Sites

Cocam’s institutional website may contain links to third-party sites not under our control. Cocam is not responsible for the privacy practices or content of these sites.

Users are advised to review the privacy policies of any website visited prior to providing personal data.

13. Updates to this Program

This Program will be reviewed and updated whenever:

• There is a relevant change in data protection legislation.
• New types of data processing are introduced.
• A significant change occurs in Cocam's systems, processes, or organizational structure.
• At the end of each biennial term.

The date of the latest update will always be indicated at the beginning of the document. We recommend to periodically review this Program to stay informed of any changes.

14. Final Provisions

By accessing the website, using our services, or providing data to Cocam, the subject acknowledges having read and understood this Program.

This Program does not create legal obligations beyond those already established in the LGPD. In case of conflict, legal provisions shall prevail.

For questions, complaints, or requests related to the processing of personal data by Cocam, the data subject may contact the DPO through the channels indicated in Section 11.

DPO: dadospessoais@cocam.com.br | 55 (17) 3531-5518 | Catanduva – SP | www.cocam.com.br