Petrobras handles the processing of personal information in several situations: When we welcome visitors to our buildings, on social networks, and on the company’s website; at Company events, and in promotional actions. Our goal is to make sure that the processing of our audiences’ personal information is limited to that which is minimally necessary to attain its purposes, using relevant, proportional, and non-excessive data relative to the purpose of such processing.

For visitors, officers, parties with credentials, candidates for management positions, and other holders that do not fit into the other groups, we may process a set of personal data that may include registration, documentary, contact, and location information.

On specific occasions, such as during visits to Petrobras facilities, clothing measurements may be requested for Personal Protective Equipment (PPE). Photographs, voice recordings, videos, or images may be collected during Company events.

When accessing Petrobras’ social networks and website, data such as browser preferences and online identifiers may be collected to allow cookies and similar technologies.

Petrobras processes sensitive personal data only when necessary and for specific purposes, in accordance with current legislation.

Pursuant to the best privacy practices, Petrobras uses personal data only for legitimate and specific purposes, including, but not limited to:

• Managing visitor access and registration.
• Meeting requests and resources provided for under the Access to Information Law and other regulations.
• Ascertaining and handling demands.
• Managing Safety, Environment, and Health.
• Monitoring traffic on Petrobras’ Social Networks, Website, and on the Petrobras Agency.
• Evaluating the Internal Control environment.
• Monitoring compliance risks.

Petrobras may process personal data based on a few of the assumptions provided for in the General Personal Data Protection Law, such as:

• Petrobras’ legitimate interest, as in the evaluation of candidates for management positions.
• Upon consent, for the management of HR resources and Company events.
• Execution or Drafting of Contracts: In the preparation of labor contracts.
• To comply with a legal or regulatory obligation, in compliance with the Company's internal regulations, with corporate acts, and with other regulations.
• To exercise ordinary rights in lawsuits, administrative, or arbitration proceedings.

Personal data are only shared for specific purposes and with a legal base.

Petrobras may share personal data with other Petrobras Equity Holdings and/or third party service providers, in compliance with corporate governance rules and contractual clauses related to information privacy and security.

The Company may also share personal data with government and control bodies that are subject to the same domestic legislation regarding the privacy of the holders’ personal data.

Petrobras has operations outside of the Brazilian territory and may transfer personal data internationally to its units, and agencies, or to government entities in the jurisdictions where it operates.

In these cases, the necessary technical, organizational, contractual, and legal measures are observed to ensure that personal data is processed in accordance with the legislation of the countries involved.

All personal data collected will be incorporated into the Petrobras database for the time necessary to comply with the existing legal deadlines, including to protect the rights of Petrobras and/or its holders.

At the request of the holder, personal data may be deleted or anonymized if there is no longer a legal base or legitimate purpose to keep it.

The holder of personal data or his or her legal representative may request his or her personal data at any time, subject to trade and industrial secrets, based on the General Personal Data Protection Law.

Additionally, Petrobras allows full access to the holders’ personal data, allowing updates, when applicable, upon proof. The holder or his or her legal representative is responsible for updating the personal data.

Petrobras reserves the right to deny requests that (I) do not adequately fill in the fields on the forms; (II) do not reasonably allow it, at its discretion, to confirm the applicant’s identification; (III) generic requests; (IV) similar or duplicate requests within a period of 30 consecutive days.

If Petrobras deems that the request made by the holder of the Personal Data may be more adequately answered by another company in the Petrobras Group, he or she will be advised to contact the relevant company.

Click here to request your personal data and in the “PROFILE” field of the form, choose the desired audience, as the request will be reviewed based on this information. If necessary, you can fill in more than one form, generating more than one request.

It will soon also be possible to make requests in person, at Petrobras’ service counters. In such case, you will need your taxpayer’s ID (CPF) and identification document numbers and your contact e-mail.

Petrobras has security policies in place that aim at protecting your personal data against unauthorized access and misuse, as well as at preserving the integrity of the data. Protective measures include access, authentication, and encryption controls, and other technologies, as needed.

The party responsible for processing personal data is Petróleo Brasileiro S/A - Petrobras, a Brazilian company, Corporate Taxpayer’s ID (CNPJ) 33.000.167/0001-01, with a registered office at Avenida República do Chile, 65, Centro, Rio de Janeiro/RJ , CEP 20031-912.

Our person in charge of monitoring Law 13,709/2018 (General Personal Data Protection Law - LGPD) is Petrobras’ Privacy General Manager, Viviane do Nascimento Pereira Sá, whose contact for this topic is privacidade@petrobras.com.br.

This e-mail is not the dedicated channel Petrobras created to meet possible requests based on the LGPD. The guidelines featured in section 7 are to be used for this purpose.

We review the privacy rules frequently, and, if a change is made, the revision date at the top of this page will be changed and the effects will apply from that date. Therefore, we encourage you to periodically read these rules.