Privacy Notice and
Data Protection

Serena values your privacy and the protection of your Personal Data. Therefore, it is our commitment to ensure that you, as a Data Subject and user of our services, know how we Process your Personal Data, with whom we may share it, how we protect it and keep it secure, always in accordance with applicable data protection legislation and under the terms of this Privacy Notice (“Notice”). This Notice is in compliance with applicable data protection legislation, in particular the General Data Protection Law (Law No. 13.709/2018) – LGPD, which regulates the processing of personal data in Brazil, guaranteeing the rights of data subjects and imposing duties on data controllers and operators. Read this Notice carefully, because, by interacting with us, you entrust us with your Personal Data and declare that you have carefully read the provisions of this Notice, declaring that you are aware of the terms indicated herein. If you have any questions, please do not hesitate to contact us at: dpo@srna.co.

SERENA ENERGIA S.A., registered with CNPJ/MF under nº 42.500.384/0001-51, is a private legal entity (“Serena”), responsible for the personal data you share with us. Whenever you find the terms “Serena”, “we”, “our” or “us”, it is to SERENA ENERGIA S.A. that we are referring.

Serena is guided, at all times, by the principles established in the Applicable Data Protection Legislation for the Processing of your Personal Data. These are the principles of purpose, adequacy, necessity, free access, data quality, transparency, security, non-discrimination, prevention and accountability.

In this Notice, Personal Data is any identified and/or identifiable information referring to you, our customer (“Data Subject”), which we process in our daily activities, especially to guarantee the provision of services. Any terms that appear in this Notice, which are written in capital letters, and were not defined above shall be interpreted according to the LGPD. This Notice is applicable to all consumers who interact and/or interacted, in some way, with Serena.

For the performance of our activities, we may process the following categories of Personal Data: • Registration and identification information: full name, ID, CPF, nationality, address, e-mail, date of birth, profession, marital status, signature and telephone number; • Authentication information: login and password for the energy distributor's portal; • Energy consumption information: energy bills, consumer unit number, protocols or service tickets (if applicable), consumption history, among others that may be necessary.

Acknowledgment and Consent By accessing our services or interacting with us, you declare that you are aware of the terms of this Privacy Notice. For purposes that require consent, it will be explicitly requested, ensuring that your expression is free, informed and unequivocal. You may revoke your consent at any time, as provided for in art. 8 of the LGPD. Generally, Serena collects your Personal Data directly from you, through the form filled out directly on Serena's website or through another communication channel. We will not process your personal data without having a legal basis for doing so, in compliance with applicable data protection laws. The legal basis for collecting and processing your personal data will depend on the Personal Data in question, as well as the purpose of the Processing.

We will store your Personal Data only for the period necessary to fulfill the Treatment purposes for which the Personal Data was collected, as indicated in this Notice. We may also keep your Personal Data for an additional period to comply with our legal or regulatory obligations, for the regular exercise of our rights in judicial, administrative or arbitration proceedings. Thus, unless we have a legal reason to keep your Personal Data in our systems, we will discard your Personal Data or carry out the anonymization procedure whenever (i) the purpose of the Treatment has been achieved or the Personal Data is no longer necessary; (ii) the Treatment comes to an end; and (iii) the ANPD determines, we will proceed with the deletion of Personal Data from our systems or carry out the anonymization procedure, within the scope and technical limits of the activities developed by Serena.

Serena preserves the privacy and protection of your Personal Data and undertakes not to share your Personal Data, unless (i) it is previously and expressly authorized by you; or (ii) in one of the following cases: • Corporate Operations: As a result of any corporate restructuring operations, mergers, acquisitions, incorporations and similar, Serena may share information, Personal Data with the natural or legal persons involved in the intended operation. Note that, in these cases, third parties will enter into confidentiality agreements with Serena through which they will undertake not to use or share the Personal Data for purposes other than those related to the intended operation. • Partners: Sometimes, we may need to share some Personal Data incidentally with trusted partners who assist and help us in providing services that are necessary for the provision of our services, such as our platform providers and data storage service providers. In addition, we may share your Personal Data with third parties for targeted media purposes (such as Google and Meta). These partners will be permitted to obtain only the strictly necessary information to provide the service properly and we require them to commit to the same level of protection and privacy that Serena would have if it were processing them directly. This includes the obligation not to use your Personal Data for any other purpose than that contracted by Serena, in addition to confidentiality obligations and security standards, among others. Whenever possible and compatible with the Processing activities and their respective purposes, the information will be provided to these third parties in an anonymized form. • Judicial Measures and Legal Obligations: Serena may disclose or share information, including Personal Data, if it believes, in good faith, that access, use, preservation or disclosure of the information is reasonably necessary to (i) comply with any law, regulation, court order or government request; (ii) investigate possible violations of rights; (iii) detect or prevent fraud, as well as resolve technical or security issues; (iv) ensure the safety of Data Subjects and third parties; (v) safeguard Serena's rights and prevent liability; (vi) investigate, prevent or take action regarding illegal, suspicious or actual activities, or to cooperate with public bodies; and (vii) comply with legal obligations or any other determination before government and judicial bodies. We will maintain this sharing only within the limits required for compliance with these obligations.

The security of your Personal Data is of utmost importance to us. Therefore, we are committed to adopting technical and administrative security measures capable of protecting your Personal Data from unauthorized access and accidental or unlawful situations of destruction, loss, alteration, communication or any form of inappropriate or unlawful processing, as well as all measures that are advisable given the state of technology, ensuring the integrity, security and confidentiality of the Processed Personal Data. However, be aware that no method of transmission or retention of electronic Personal Data is fully secure and may be subject to external attacks. With this in mind, we will not be responsible for losses resulting from acts of third parties who use improper, fraudulent or illegal means to access information stored on the servers or in the Personal Data databases used.

In any case, do not hesitate to contact us, through the channels below, before submitting any complaint to the ANPD, so that we can try to resolve your question or complaint immediately. Channel to exercise your rights: To exercise the rights listed above or clarify any doubts regarding the provisions of this Notice, simply send an e-mail to us at dpo@srna.co. Please note that, to process your request to exercise rights securely, we may eventually request proof of your identity and more information about the right you wish to exercise.

Any requests from data subjects may be sent to the e-mail below: dpo@srna.co Feel free to contact us by the DPO e-mail, as indicated above.

This Notice may be revised at any time, which is why we recommend that you consult it periodically to stay updated. However, don't worry! Whenever we make significant changes to the content of this Notice, you will be notified. In addition, if any of these changes imply the need for us to obtain your prior and express authorization, we will do so.