Overview - Renner

1. How does Lojas Renner S.A. address data security issues?]

Data security is one of the pillars of Lojas Renner S.A. and part of the fundamental commitments in the Code of Conduct. The Company has a strong focus on mitigating cyber risks and protecting confidential and personal data. In this context, Renner has a formal Data Security Policy, a formal and disclosed Privacy and Personal Data Protection Policy, two structured areas focused on Cyber Security in the Company, the technique Information Security Area, from the IT board, and the Information Security Risks and Compliance Area, from the Risk board, a multidisciplinary Cyber Risk and Fraud Committee, and the Corporate Compliance area that has a vertical focus on Privacy and Personal Data Protection.

These teams prepare periodic reports for the Audit and Risk Management Committee, all of its members being independent directors.

2. How does Lojas Renner S.A. protect itself from cyber attacks?

One of the risks that has challenged companies most is that of attacks and intrusion by hackers (or crackers).

Renner has several processes for defending itself and involving three principal macro operational structures supported by specialized partner companies: (i) SOC – Security Operation Center focused on the protection at the Internet perimeter level, event correlation and incident response; (ii) Ethical Hacking with repeated penetration testing in the corporate environment; and (iii) Brand Protection, that monitors Lojas Renner S.A.’s leading brands on the Internet.

The Company has a cybernetic risks and technological vulnerabilities management structure as well as having a cybernetic security insurance policy in place since 2020.

3. How does Lojas Renner S.A. protect customer data?

The risk of data leakage is undoubtedly a relevant challenge faced by companies, especially large retailers.

Lojas Renner S.A. places a strong focus on protecting customer data. Since 2012, the Company has recertified annually with the PCI DSS (Payment Card Industry Data Security Standard), a data security standard for organizations that handle branded credit and debit cards (Visa, Master and others) . Renner has also been using data protection techniques for databases and active DLP (Data Loss Prevention) tools to monitor and prevent the leakage of confidential and personal data.

4. How does Lojas Renner S.A. protect the privacy and personal data of its customers?

Lojas Renner S.A. maintains a structured and continuously evolving Privacy Governance Program, aligned with applicable data protection laws and market best practices, including certification under the ISO/IEC 27701 standard, which reinforces the Company’s commitment to the systematic management of privacy and information security.

Since the enactment of the Brazilian General Data Protection Law (LGPD), the Company has implemented a broad initiative to enhance and adapt its personal data processing operations, consolidating a consistent and business-integrated approach. This initiative resulted in the establishment of a dedicated structure within the Legal Department, responsible for defining guidelines, supporting business areas, and ensuring the continuous management of privacy compliance.

The Data Protection team operates within a broader governance framework that encompasses practices such as data inventories, risk assessments, continuous monitoring, incident management, data subject rights management, and partner due diligence, ensuring a structured, preventive, and risk-oriented approach.

As part of this framework, the Company adopts the Privacy by Design concept, which establishes that privacy and data protection must be considered from the conception of any system, process, product, or initiative and throughout its entire lifecycle. This approach ensures that decisions related to the use of personal data are made in a preventive, secure, and purpose-driven manner.

In addition, Lojas Renner S.A. continuously invests in promoting a culture of privacy through training programs, communications, and internal initiatives. In this context, the Company maintains a network of Privacy Champions across several areas of the organization, who act as focal points to support the implementation of privacy guidelines, strengthen awareness, and ensure that privacy is embedded in day-to-day activities and decision-making processes.

This set of initiatives reinforces the Company’s commitment to processing personal data in an ethical, transparent, and secure manner, fostering trust in its relationships with customers and other stakeholders.

5. How does Lojas Renner S.A. manage identities and accesses?

Another challenge is Identity and Access Management (IAM), also known as the “Triple A” of data security: authentication, authorization, and accounting. Risks related to weaknesses in internal controls in this respect are commonly detected by internal and external audits in organizations of all sizes.

Lojas Renner S.A. and partner companies have an employee identity and access management platform covering the most relevant systems and the access accounts. The platform is based on RBAC (Role-Based Access Control) concepts, Single Sign-On, and complementary processes.

6. How does Lojas Renner S.A. address the “security awareness” of people?

Market research indicates that most security incidents are caused by internal staff or third parties who have authorized access to confidential and personal data.

Lojas Renner S.A. believes that its employees and staff from partner companies form the most important link in our ecosystem’s information protection network. Our People corporate value (“hiring, developing and retaining the best people”) underscores this point. In this context, we have a corporate program run jointly with the Human Resources department and focused on education and security awareness, that counts on:

Information security Plan: the program has information security lectures at integration for new employees held monthly; a week dedicated to information security awareness, called Cyber Week, held annually; an Information Security Program made available online at Renner University (degreed) that employees expect to perform annually; as well as education campaigns on topics such as cyber risks, phishing, care with passwords, information classification, security by design, among others.
Personal data protection and privacy program: we also have a plan developed with the main points to be observed due to privacy and data protection (LGPD) online at Renner University (degreed). It contains several contents related to the theme and the following tracks:
the LGPD
the Advanced LGPD
the Personal Data Life Cycle
Privacy by Design

The Company, its shareholders, management, members of the Fiscal Council (effective members and alternates), undertake to resolve through arbitration by the Market Arbitration Panel, in accordance with its regulations, any disputes which may arise among them, related with or originating from their position as issuer, shareholders, management and members of the Fiscal Council, particularly in the light of the provisions of Law 6.385/76, Law 6.404/76, these Corporate Bylaws, the rules published by the National Monetary Council, by the Central Bank of Brazil and by the CVM as well as other rules governing the securities market in general in addition to those of the Novo Mercado Listing Regulations, of other rules established by the B3 and the Novo Mercado Participation Agreement.

The arbitration chamber shall be made up of 3 (three) arbitrators, appointed pursuant to the Arbitration Regulation of the Arbitration Chamber of Mercado.

Arbitration shall be conducted in the municipality of São Paulo, state of São Paulo, Brazil. The language of the arbitration process shall be Portuguese. The arbitration shall be conducted and adjudicated according to Brazilian Law.

Without in anyway limiting the validity of this arbitration clause, petitioning for writs of prevention and urgency by the parties, prior to the constitution of the arbitration tribunal, may be submitted to the Law Courts. Once the arbitration tribunal has been constituted, all petitioning for writs of prevention or urgency shall be submitted to the said arbitration tribunal, the latter being from then on authorized to maintain, revoke or modify writs of prevention and petitioning for urgency previously solicited to the Law Courts.