In accordance with the provisions of Title V of the Sole Circular of the Superintendence of Industry and Commerce, the Data Controllers must update the National Registry of Databases as follows:

1. Annually, between January 2 and March 31, starting in 2021.
2. Within the first fifteen (15) business days of the months of February and August of each year, from their registration, the information on the claims submitted by the Holders must be updated.
3. Within the first ten (10) business days of each month, from the registration of the database, when substantial changes are made to the registered information.

To carry out the update process, we recommend promptly reviewing the following aspects:

• Have any changes been made to the recorded information regarding numbers of records per database and number of databases?
• Have changes been made to the data processing policy, security manuals, authorization text, and internal information management manual?
• Have any changes been made with respect to the Data Processors initially registered?
• Have new contracts been made with old Managers?
• Have contracts been signed with new Managers?
• Are you currently sending data abroad?
• Have there been any queries or complaints regarding the handling of personal data by the Company?

We are at your complete disposal to answer any questions related to these procedures.