Data Subject Rights Policy

1. INTRODUCTION

We, Concessionária Aeroporto Rio De Janeiro S.A ("RIOgaleão"), a private legal entity registered with the CNPJ under No. 19.726.111/0001-08, headquartered in the City of Rio de Janeiro, State of Rio de Janeiro, at Av. Vinte de Janeiro, s/nº, Antonio Carlos Jobim International Airport, Galeão, prioritizing the protection of your personal data and your privacy, make available to our passenger or user of any of the services we offer ("You") this Personal Data Subject Rights Policy ("Rights Policy").

In this document you will find all the information about your rights and how to exercise them.

2. DEFINITIONS

In order to make the document easier to read, we break down some of the concepts that you should know:

3. WHAT ARE THE RIGHTS THAT YOU CAN EXERCISE?

As a data subject, You have different rights in relation to your personal data. Your rights are as follows:

a) Obtain confirmation of the existence of processing: data subjects may contact us to confirm if any of their personal data is processed by RIOgaleão.

b) Request access to data: it is the right of the holders to request access to their personal and/or sensitive data stored and processed by RIOgaleão.

c) Correct incomplete, inaccurate or outdated data: data subjects may request RIOgaleão to change their personal and/or sensitive data at any time, such as updating their name, changing their telephone number and address. Some updates will depend on the presentation of proof, as required.

d) Request anonymization, blocking, or deletion of unnecessary, excessive, or processed data in violation of the LGPD: the request for blocking and deletion of personal and/or sensitive data may be made by the data subject. In certain situations, requests cannot be fulfilled, for example, when personal and/or sensitive data are necessary to comply with a legal/regulatory obligation or when there is an open request or complaint. In these cases, the holder will be informed of the reason for the non-deletion or blocking of their data.

e) Carry out the portability of data to another service or product provider, upon express request, in accordance with the regulations of the National Data Protection Authority (ANPD), observing commercial and industrial secrets. The portability of personal and/or sensitive data does not include data that has already been anonymized by RIOgaleão.

f) Request the deletion of personal and/or sensitive data processed with the consent of the data subject: the personal and/or sensitive data of the data subjects will be deleted, except in certain cases:

• compliance with legal or regulatory obligations by RIOgaleão;
• transfer to a third party, provided that the data processing requirements set forth in the LGPD are respected; or
• exclusive use of RIOgaleão, its access by third parties is prohibited, and provided that the data is anonymized or respecting the proper legal bases.

g) Request information from the public and private entities with which the controller shared the use of data: it is the holder's right to request access to personal and/or sensitive data that is forwarded to public and private entities, except in situations prohibited by law.

h) Obtain information on the possibility of not providing consent and on the consequences of refusal: RIOgaleão is available to answer and assist, in a transparent manner, any doubts that may exist due to the processing of the personal and/or sensitive data of the holders. RIOgaleão is also available to inform what are the possible negative impacts if the data subject revokes his/her consent to the use of their data, when the legal basis for processing the data is the consent of the data subject.

i) Revoke consent: the consent provided by the holders of personal and/or sensitive data may be revoked at any time, by means of a formal request to RIOgaleão.

4. HOW WILL YOUR REQUEST BE EVALUATED?

Upon receiving your request, we seek to carry out the safest and most effective process to respond to the requirements. Therefore, we will review your request and respond by informing: (i) that your request is legitimate, and therefore we will comply; (ii) that we will not comply with your request, substantiating the reasons why we do not consider it legitimate.

Upon receipt of the request, we may require information and/or official identification documents to verify your identity. This practice aims to generate greater protection for data subjects.

In the event that your request is accepted, we will send the information by electronic means - secure and suitable for this purpose - or printed. RIOgaleão will use the communication channel informed by you to receive information about the request.

Likewise, if your request is not accepted, we will send you electronically - secure and suitable for this purpose - or in print, information about the reason we were unable to do so. Below we exemplify some of these hypotheses:

• preservation of business secrets and intellectual property of RIOgaleão;
• violation of the rights and freedoms of third parties;
• the information is anonymized and therefore is not Personal Data;
• obstruction of law and justice;
• legitimate interests of RIOgaleão that override those of the Data Subject;
• repetitive, repeated, or excessive requests were made.

We emphasize that the entire process will always be free of charge, with no costs linked to the service, as determined by the General Data Protection Law.

5. HOW SOON WILL WE RESPOND TO YOUR REQUEST?

In case of any request made by You regarding the rights provided for by the LGPD, we will respond within the following deadlines:

6. INFORMATION ACQUIRED DURING THE PROCESS AND ITS STORAGE

Based on the regular exercise of RIOgaleão's right, we will store some information from your request, for the period provided for by law or necessary for the fulfillment of our obligations (operational, legal, and contractual), which are:

• Copies of the correspondence exchanged between RIOgaleão and You and between other parties eventually involved;
• Records of any related telephone conversations;
• Records of the decisions made and their rationales; e
• Copies of the information actually sent to You.

7. HOW TO EXERCISE YOUR RIGHTS?

To exercise your rights provided for in this Rights Policy, you can contact us through the following communication channel: dpo@riogaleao.com