Privacy Notice - CPFL Energia | Investor Relations

We have been working intensively for more than 100 years to generate, negotiate and distribute energy and, therefore, we know how important your trust is.

We have a non-negotiable commitment to safety, one of our values, and among our guidelines is our commitment to transparency, ethics, integrity and responsibility.

When carrying out activities to achieve the social objectives of the companies that make up the CPFL Energia Group, we deal with information that may contain personal data.

The CPFL Energia Group, as a Data Controller, will carry out all the processing of information and personal data about you is done with responsibility, and with the care you deserve, which includes observing the laws and regulations that govern the privacy and protection of personal data, especially the General Personal Data Protection Law – LGPD (Law n.º 13.709/2018).

You should read this Privacy Notice carefully, so that you understand: (i) how personal data is collected, shared and handled by CPFL Energia Group (see the companies listed in the Glossary); and (ii) how to exercise the rights regarding your personal data according to LGPD.

In the Glossary (item 13 of this document) we explain some terms of this notice that may not be very familiar to you.

Your comments, doubts and suggestions for improvement on this Privacy Notice are welcome, so feel free to contact us through the channel available to answer the LGPD's rights in order to clarify doubts, inform about non-compliance with the rules of this notice or ask for some correction. We will always evaluate the points made by you, answer your questions whenever necessary, and if there is a need for correction or clarification of any point in this Privacy Notice, our Data Protection Manager will take the necessary steps to update the document.

Enjoy your reading!

Index:

This notice is for any individual who (i) is or was our customer or consumer; (ii) has had any relationship with us, including participating in events and research promoted by the CPFL Group; (iii) visited our physical facilities or interacted with us on our social networks, such as YouTube, Facebook, Twitter, Instagram and LinkedIn; (iv) is a candidate for job openings at the CPFL Group; (v) is a representative, attorney, employee or partner of any customer, supplier, company or entity with which we have a relationship or had any relationship in the past; (vi) carried out any transaction with us; (vii) is an investor in the CPFL Group; and/or (viii) is a potential customer.

In order to facilitate the understanding of the data we process and our purpose, we have made a division by category of data subjects.

See which category of data subject you fit in and know the data about you that may use, where and how they are collected from and their respective purposes.

CPFL Group, in general, does not process personal data of people under 18 years of age, however, when treatment will be necessary, we will also apply the rules contained in item “2.1. Data treatment of people under 18 (eighteen) years of age”.

We process the personal data of our clients and consumers in general to initiate and provide the necessary services, maintaining a business relationship.

Costumers: individuals who use our products or services.Data we can handle

Consumers: potential users or ex-users of our products and services.Data we can handle

Below the list of data that we can handle:

Category	Data we can handle	Most common collection sources	Purpose
Registration data	Personally identifiable information, such as name, date of birth, e-mail, home address, telephone, profession, occupation, marital status, among others. Information from documents issued by official public bodies (RG, CPF, CNH, CTPS, among others).	Data subject.	Personal identification and authentication when formalizing contracts. Representation of legal entities. Offer and use of our products, services and service channels. Registation for requestments and demands in the service channels. Registration for social benefit (ex. Social Tariff). Sending invoices, consumption history, reports, newsletters and news
Business data	Information related to your workplace, such as phone and professional email, work address, activity and function.	Data subject.
Financial/transactional data	Data related to meter reading, payments, bank and income data.	Data subject. Company, public or private database, financial institutions (eg payment confirmation) or even generated by the CPFL Group itself (payment history - energy bill).	Registration for automatic debit. Payment history. Energy Consumption history ((reading of the consumption unit).) Credit recovery ,including protest and negativity in case of unpaid debts Assessment of irregularities in consumer units Accounting activities
Third party data	Registration data and business data of representatives, counterparts, attorneys, employees, partners or beneficiaries of products and services.	Data subject or or individual represented.	For third parties to represent the data owner in some way or to perform some activity on their own account and order (corporate or civil representation).
Service history	Telephone recordings, e-mail content, text messages and other information shared with us through customer service channels.	Data subject.	Resolution of demands and response to the data subject.
Health data	Report, sick notes, ICD of disease, treatment periods, doctor CRM, medical appointment (eg medical report).	Energy bill holder (who may or may not be the data subject).	Exclusively for energy consuming units with medical equipment essential to human survival under the terms of Aneel Resolution 414/2016 (ex. distribution of energy to holders with a home ICU).

When we hold events, we process the personal data of the participants in these events.

Below a list of data we can handle:

Category	Data we can handle	Most common collection sources	Purpose
Registration data	Personally identifiable information, such as name, date of birth, e-mail, home address, telephone, profession, occupation, marital status, among others. Information from documents issued by official public bodies (RG, CPF, CNH, CTPS, among others).	Data subject.	Identification and authentication of the participant To provide more security To conduct satisfaction surveys To send news, reports, newsletters and materials about the event, among others
Images and videos	Photos and recording of the event.	CPFL Group	Usually, we record events as proof of their occurrence and also to publicize them on our materials and corporate channels. In the event of recording the event, participants are always notified in advance. Depending on the event, CPFL shares the recording and photos with the participants.

Category

Data we can handle

Most common collection sources

Purpose

Registration data

Personally identifiable information, such as name, date of birth, e-mail, home address, telephone, profession, occupation, marital status, among others.

Information from documents issued by official public bodies (RG, CPF, CNH, CTPS, among others).

Data subject.

Identification and authentication of the participant

To provide more security

To conduct satisfaction surveys

To send news, reports, newsletters and materials about the event, among others

Images and videos

Photos and recording of the event.

CPFL Group

Usually, we record events as proof of their occurrence and also to publicize them on our materials and corporate channels.

In the event of recording the event, participants are always notified in advance.

Depending on the event, CPFL shares the recording and photos with the participants.

The CPFL Group as a member of the Research and Technological Development Programs in energy efficiency of the electric sector regulated by Law 9,991 of July 24, 2000 and by resolutions of the National Electric Energy Agency (ANEEL), can process the personal data of managers of Institutions of Teaching, teachers and students participating in research projects.

Below the list of data that we can handle:

Category	Data we can handle	Most common collection sources	Purpose
Registration data	Personally identifiable information, such as name, date of birth, e-mail, home address, telephone, profession, , marital status, among others. Information from documents issued by official public bodies (RG, CPF, CNH, CTPS, among others).	Data subject.	Identification and authentication of project participants among others (eg, rectors, principals, teachers, students, ...).
Images and videos	Photos and videos.	CPFL due to the event.	Monitoring, dissemination and presentation of project results.

Category

Data we can handle

Most common collection sources

Purpose

Registration data

Personally identifiable information, such as name, date of birth, e-mail, home address, telephone, profession, , marital status, among others.

Information from documents issued by official public bodies (RG, CPF, CNH, CTPS, among others).

Data subject.

Identification and authentication of project participants among others (eg, rectors, principals, teachers, students, ...).

Images and videos

Photos and videos.

CPFL due to the event.

Monitoring, dissemination and presentation of project results.

We process personal data from private individuals who visit our physical facilities or who interact with us on our social networks, for example, YouTube, Facebook, Twitter, Instagram and LinkedIn.

Category	Data we can handle	Most common collection sources	Purpose
Registration on data (personal visits)	Name, identification document data issued by official bodies (RG, CPF, CNH, CTPS, among others ...).	Data subject.	Visitor identification for access control and security during personal visits.
Business data	Information related to the visitor's workplace, such as the company's corporate name / name, professional phone and email, professional address, activity and function.	Data subject.
Social media data	Name, e-mail, name of the data subject's account on the chosen social network and telephone.	CPFL official electronic channels and social networks.	Address and respond to requests and demands created on channels.

This notice informs how we process personal data of individuals from the process of identifying CVs, for participation in a selection process (which includes direct registration of individuals in CPFL or third-party CV banks), through the pre-selection, selection process and acceptance of the job offer.

When the candidate becomes an employee, the data processing rules are informed directly in the directly in the CPFL Group's internal documents.

Below the list of data that we can handle:<

Category	Data we can handle	Most common collection sources	Purpose
Registration data	Personally identifiable information, such as name, email, phone and home address.	Data subject. Recruitment and selection companies	Presentation of the candidate.
Registration data	Information from documents issued by official public bodies (RG, CPF, CNH, CTPS, PIS, SUS Card, ...), photo, among others.	Data subject (approved for hiring in a selection process).	Preparation for formalization of the employment contract.
Education, qualification and training data	Educational background, professional training, qualification and certifications.	Data subject.	Determine eligibility and qualifications for the role.
Professional data	History of past and current jobs.	Data subject.	Determine eligibility and qualifications for the role.
Financial data	Information regarding fixed and variable compensation and benefits.	Data subject.	Understand the current moment and the candidate's remuneration and benefits expectations to assess whether the candidate is eligible considering the approved financial profile for the position.
Information bank data (public or private)	Confirmation of Personal Data Criminal background (only as required by law, nature of office or special degree of trust in the position)	Third-party database.	Identify and authenticate candidate. Check qualifications for the role. Ensure the safety of other employees, third parties and the Organization itself.
Health data	ASO (Occupational Health Certificate). Identification of possible deficiency.	Occupational doctor. Occupational medicine company. Data subject.	Certify if the employee is able or not to perform the professional functions of the indicated position. Compliance with the law for hiring quotas for people with disabilities. Provide suitable accommodation appropriate to the execution of the activities.

We processing of data necessary to comply with legal or regulatory obligations relating to the completed employment contract. The data processing rules are informed directly in the directly in the CPFL Group's internal documents.

Specific retention period. In the event that its selection process is unsuccessful or you be a ex employees, the CPFL Group may retain the personal data contained in the table above for a period of 02 (two) years from the selection process for the purposes of auditing and defending the rights of the Group CPFL. In order to keep your personal data in our database so that you can be contacted in future job opportunities appropriate to your profile, it is necessary to provide your consent when completing the registration on the CPFL – Work with us page.

In the case of a former employee, at the end of the employment contract, the processing of personal data will continue to be carried out for the time determined by law, for the purpose of complying with legal obligations, labor or not (e.g. retirement, proof of payment of FGTS and IRPF , PPRA.), for the regular exercise of rights in legal proceedings (defence of the CPFL Group's rights in court) or in the exercise of the legitimate interest of the company or third parties.

If your selection process is successful, all personal information collected so far they will be preserved, even after the end of your employment contract to fulfill a legal or regulatory obligation (for exempla: retirement, proof of payment of FGTS, PPRA, among others) and defense of the CPFL Group's rights, observing the legal prescription rules in force.

The suppliers and service providers (mostly duly constituted companies) that the CPFL Group relates to in order to carry out its business activities, are always the Controllers of personal data of its legal representatives, partners and employees.

In some situations the CPFL Group needs to process the personal information of the individuals mentioned, which it does only in the context of the legal relationship established with the service provider, suppliers and partners.

For this individuals we can treat the following data:

Category	Data we can handle	Most common collection sources	Purpose
Registration data	Personally identifiable information, such as name, e-mail, address, telephone, profession, occupation, photography, academic training, marital status and others. Information from documents issued by official public bodies (RG, CPF, CNH, CTPS, among others).	Public documents delivered by the supplier, service provider or partner such as social contract, board election minutes, power of attorney.	Registration and verification of powers of representation.
Business data	Information related to your workplace, such as company, professional phone and email, professional address, activity and function.	They are usually a supplier or service provider.	Registration and confirmation of powers to sign legal instruments Validation and payment of invoices.

Category

Data we can handle

Most common collection sources

Purpose

Registration data

Personally identifiable information, such as name, e-mail, address, telephone, profession, occupation, photography, academic training, marital status and others.

Information from documents issued by official public bodies (RG, CPF, CNH, CTPS, among others).

Public documents delivered by the supplier, service provider or partner such as social contract, board election minutes, power of attorney.

Registration and verification of powers of representation.

Business data

Information related to your workplace, such as company, professional phone and email, professional address, activity and function.

They are usually a supplier or service provider.

Registration and confirmation of powers to sign legal instruments

Validation and payment of invoices.

For this individuals we can treat the following data:

Category	Data we can handle	Most common collection sources	Purpose
Registration data	Personally identifiable information, such as name, e-mail, address, telephone, profession, occupation, marital status and others. Information from documents issued by official public bodies (RG, CPF, CNH, CTPS, among others).	Contracted supplier or service provider. Data subject.	Identification of the holder who will perform the service Safety and prevention. Release of access to the CPFL Group's physical, remote facilities, systems, tools and information bases. Prevention of labor and tax risks of outsourcing Service contract management
Business data	Information related to your workplace, such as company, professional phone and email, professional address, activity, function and registration number.	They are usually provided by the supplier or service provider or by the data subject.
Electronic records	CPFL Group equipment or tools: messages exchanged by official means of communication (e-mail, electronic messages on Skype, Teams, among others), registration of access to websites, applications and tools (always in the context of the activity and in the use of equipment and tools of the CPFL Group).	CPFL Group	Monitoring, control and security activities by internal policies (auditing, internal controls, information security, labor relations, among others).
Labor, social security and tax data	Employment contract. Journey control. Benefits. Dependent on the income tax. Proof of delivery of uniforms and PPE (personal protective equipment). Proof of training conducted. Vacation receipt and payment. Termination term and respective proof of payment of severance and tax amounts. ASO - Certificate of Occupational Health. Salary information (fixed and variable remuneration).	Suppliers and Service Providers.	Monitor the payment of labor, tax and social security funds to meet legal and regulatory obligations (outsourcing risk management).
Biometric data	Digital	Data subject.	Exclusive for workers who have access to the CPFL Group data center, meeting security requirements based on international frameworks such as NIST and ISO.

We may process personal data of individuals who hold securities of the CPFL Energia Group.

Category	Data we can handle	Most common collection sources	Purpose
Registration data	Informações de identificação pessoal, tais como nome, data de nascimento, e-mail, endereço residencial, tele Personally identifiable information, such as name, e-mail, address, telephone, profession, occupation, marital status and others. Information from documents issued by official public bodies (RG, CPF, CNH, CTPS, among others). Investor identifier.	Data subject. Financial institutions hired by the data subject.	Asset management Service through the channels made available by the CPFL Group Investor Relations Registration for external events.
Business data	Information related to your workplace, such as company, professional phone and email, professional address, activity and function.	They are usually provided by the data subject.
Financial/transactional data	History of stock movement. Bank data. Investment data.	Data subject. Financial institutions.	Asset management Accounting

Category

Data we can handle

Most common collection sources

Purpose

Registration data

Informações de identificação pessoal, tais como nome, data de nascimento, e-mail, endereço residencial, tele

Personally identifiable information, such as name, e-mail, address, telephone, profession, occupation, marital status and others.

Information from documents issued by official public bodies (RG, CPF, CNH, CTPS, among others).

Investor identifier.

Data subject.

Financial institutions hired by the data subject.

Asset management

Service through the channels made available by the CPFL Group

Investor Relations

Registration for external events.

Business data

Information related to your workplace, such as company, professional phone and email, professional address, activity and function.

They are usually provided by the data subject.

Financial/transactional data

History of stock movement.

Bank data.

Investment data.

Data subject.

Financial institutions.

Asset management

Accounting

We can process the data of family members of CPFL Group employees to collect information that is required by specific law or regulation, even in the context of CPFL Group endomarketing actions or events aimed at the internal public.

Below a list of data we can hadle:

Category	Data we can handle	Most common collection sources	Purpose
Registration data	Personally identifiable information, such as name, e-mail, address, telephone, profession, occupation, marital status and others. Information from documents issued by official public bodies (RG, CPF, CNH, among others).	Employee or data subject	Manage extended benefits to family members. Mandatory information that an employer must provide about its employees Registration for events. Institutional activities of the CPFL Group.
Images and videos	Photos and videos.	EEmployee or data subject.	Registration of the event as proof of its realization, for dissemination on our corporate channels and for use in our institutional materials.
Health data	HIdentification of possible deficiency.	Data subject or employee	Provide Special Assistance to Employees

Category

Data we can handle

Most common collection sources

Purpose

Registration data

Personally identifiable information, such as name, e-mail, address, telephone, profession, occupation, marital status and others.

Information from documents issued by official public bodies (RG, CPF, CNH, among others).

Employee or data subject

Manage extended benefits to family members.

Mandatory information that an employer must provide about its employees

Registration for events.

Institutional activities of the CPFL Group.

Images and videos

Photos and videos.

EEmployee or data subject.

Registration of the event as proof of its realization, for dissemination on our corporate channels and for use in our institutional materials.

Health data

HIdentification of possible deficiency.

Data subject or employee

Provide Special Assistance to Employees

The CPFL Group does not extract biometrics (face points and/or fingerprints) from the photos of the official documents it collects from the data subjects, nor even from the voice in the event of recordings in the service channels and in the events that it carries out.

Usually, we do not process personal data of children and/or adolescents (considered under the terms of the Childrem and Adolescent Statute - ECA), unless in the context of compliance with legal or regulatory obligations (eg registration in the Social Electricity Tariff, Consumer Unit with Medical Equipment essential to human survival, compliance with a judicial decision in maintenance proceedings) this is necessary, such as participation in educational or research projects promoted or supported by the CPFL Group, to exercise rights in administrative or judicial proceedings, participation in any internal event, hiring a minor apprentice, among others.

When we carry out this type of data processing, we do in order the principle of necessity of the LGPD, always so with the minimum of personal data appropriate to a specific purpose, in the best interest of the childrem and respecting the legal requirements for the treatment of this personal data, including the express consent of those responsible, when necessary or required by law, in terms of § 1, Art. 14.

Find out below the list of rights guaranteed to data subjects by LGPD, which you can request from the CPFL Group.

Canais para requisições dos titulares
Clients and costumers in general	0800 010 10 10 - CPFL Paulista 0800 010 25 70 - CPFL Piratininga 0800 772 21 96 - CPFL Santa Cruz 0800 970 0900 - RGE Service Agency Website
Participants in events	Website
Participants in ducational and research projects	Website
Visitor	Website
Legal representatives of suppliers and service provides	Website
Investitors	Site RI
Candidates and ex employees	Website
Family of employees	Website

Rights of Data Subject
What you can request	For what purpose
Confirmation of data processing	Confirm whether or not we have personal data about you in our database.
Data Access - Complete declaration of personal data	To know all the information we have about you in the CPFL Group, its collection source and purpose of use.
Data Update	Correct incomplete, inaccurate or outdated data. In this case, depending on the type of data being corrected, the CPFL Group may ask you for supporting documentation for security and fraud prevention reasons
Anonymizing, blocking or deleting personal data	To interrupt the processing of personal data that may be carried out in an excessive, unnecessary or non-compliance with the LGPD. Elimination / anonymization are rights that will only be enforced when there is no longer the purpose of treatment in law or specific regulation that justifies their maintenance in the CPFL Group.
Opposition to data processing	In order to you disagree the processing if your personal data and present the reasons why you believe that your data should not be processed. Your objective here is that data processed without a legal basis is eliminated This right is applicable when the Controller processes your data based on assumptions of the law other than consent (for that reason we have the next specific right). If your data has been processed based on a legal hypothesis other than consent, there is no problem, just that you exercise your right stating that you do not agree with the treatment of your data, present the reasons for your disagreement, that we will make the assessment and we will return with you.
Revocation and suspension of consent	When the processing of your data takes place with your authorization (Consent) you can withdraw (revoke) or suspend your authorization at any time.
Elimination of the processing of data collected without consent	When the basis for the processing of your data is consent, if it has not been requested in accordance with the provisions of the LGPD, you can request that your data be excluded from the CPFL Group's database. To understand more about consent, read the item 13th of Glossary in topic "Legal permission for processing Personal Data".
Automated decision review	When decisions are made by the CPFL Group solely on the basis of electronic analysis of personal data, you may ask for a review of the decision made.
Right to Explanation about Automated Decision	Require information regarding the criteria and procedures used for the automated decision, except for business secret information.
Doubts/ Explanation	It serves to register doubts, suggest improvements and requires clarification regarding the provisions of this notice or the treatment of your data in light of the obligations established in the LGPD. Importantly, only requests related to the LGPD and this Privacy Notice will be answered. Any other topic will not be answered, the holder must pay attention to the service channels provided by the CPFL Group.
Data Portability	Forwarding of personal data, at the request of the data subject, to another supplier. We await ANPD regulation so that the exercise of this right is possible.

Security in the delivery of the rights of the holders. We know that malicious people can use this type of request to impersonate you and obtain your data. Thus, to fulfill your request we will use procedures to confirm that the request is being made by you, and may even require sending other information and / or documents to answer your request.

Deadline for reply. Once your identity is confirmed, your request will be answered within 15 (fifteen) days, preferably by e-mail, except in the event of exercising the Data processing confirmation right (answer will always be “yes” or “no”) when this information will be provided whenever possible immediately.

We follow the provisions of laws and regulations that govern privacy and pesonal data protection in Brazil, in particular the General Personal Data Protection Law (Federal Law 13.709 / 2018 – “LGPD”). Below we list the criteria used in the processing of personal data:

existence of a legal provision that allows such activity (find out the hypotheses that the LGPD foresees for processing data in the Glossary “Legal permission for processing personal data”);
when defining the purpose of the data processing, we aim to ensure that it is legitimate and specific, and that the data subject is given proper transparency and information about what is done with his personal data;
we use minimal data, necessary and compatible with the treatment context;
we adopt adequate security measures that are within our reach to protect personal data against unauthorized access by unauthorized third parties, from accidental or illegal situations, and always making the sensitivity, volume, form and treatment methods compatible;
if necessary, we request authorization (consent) from the data subject to comply with the purpose previously informed (it may be in a contract, term of use or in a separate document), including the consequences if authorization is not given for data processing. We also provide a channel for the data subject to suspend or withdraw his authorization at any time (see item 3rd What are the arising rights from the processing of data guaranteed by the LGPD and what is the contact channel for me to exercise these rights?);
when processing data based on the legitimate interest of the CPFL Group or third parties, our focus will always be on the minor impact on the privacy of the data subject, striking a balance between the interests of the CPFL Group or third parties, the data subject's expectation in relation to the treatment of data his personal data and assessing whether there will be any negative impact on your fundamental rights and guarantees. We also provide an easy way for the data subject to exercise his right of opposition to the processing of personal data, that is, he requires that his data is no longer treated based on legitimate interest (see item 3rd What are the arising rights from the processing of data guaranteed by the LGPD and what is the contact channel for me to exercise these rights?);
we provide a channel for the data subject to exercise their rights related to the personal data we treat about them and to answer questions related to LGPD (see item 3rd What are the arising rights from the processing of data guaranteed by the LGPD and what is the contact channel for me to exercise these rights?)

The CPFL Group's personal data are generally stored in Brazil, however to ensure greater efficiency and better performance of its activities, sometimes personal data may be transferred to foreign countries. In this case, the CPFL Group will continue to be responsible for personal information and will assure data subjects, target audience of this notice, that even with the processing of data in a foreign country, the rights and obligations established to the subjects in this document will be observed, in the laws and regulations that govern the protection of personal data and also in the information security and data protection policies and guidelines of the CPFL Group.

We will keep personal data subject to the following criteria:

(i) for the time necessary to achieve the purpose for which they were collected, observing item II below, as for example while the energy account holder uses the energy distribution services that is done by the CPFL Group companies. For cases of legal representative of a corporate entity's energy bill, while registered as a representative of a legal entity with a relationship with the CPFL Group;

(ii) for the defense of rights in administrative, judicial or arbitration actions or proceedings, such as, for example, after the termination of its energy supply contract, CPFL may, by law, keep your personal and contract data for a period of up to 10 years after the end of the business relationship; and

(iii) when there is a specific law or regulation that requires you to keep personal information for a certain period.

In the accesses made through the Internet, either to our website or application, the history of access records of the data subjects when collected will be stored for a period of up to 06 (six) months as provided for in the Marco Civil da Internet (Law 12.965 / 2014) and respective regulatory decree. If, at the CPFL Group's discretion, the aforementioned record is necessary to defend your rights in a judicial or administrative proceeding, this period may be extended to 10 (ten) years as allowed by the Brazilian Civil Code.

Your personal data will be securely removed or made unidentifiable (anonymization) when there is no longer the purpose of treatment in law or specific regulation that justifies their maintenance in the CPFL Group.

Firstly, the CPFL Group does not sell your personal data to third parties under any circumstances.

In the performance of its activities, CPFL Group may share its personal data with third parties who support its business activities to deliver its services in an appropriate manner, for defense of their rights, to comply with legal or regulatory obligations, for the evaluation of topics by consultants, for the use of services and products accessed through the internet, among others.

The sharing of personal data between the companies that make up the CPFL Energia Group will comply with the current legislation and sectoral rules (for example Aneel regulation), including the express consent of those responsible when necessary or required by law (for example sharing of personal data for commercial purposes between Distributors and other CPFL Group companies).

Personal data sharing will always observe the laws and regulations that govern data protection, internal procedures and policies related to personal data protection and information security.

All third parties hired by the CPFL Group and who process personal data of data subjects are obliged to (i) comply with the obligations and rights established in the laws and regulations governing the protection of personal data, including the LGPD; (ii) carry out data processing operations with confidentiality and only to achieve the purpose established in the contract; (iii) adopt personal data protection and security measures consistent with the applicable sensitivity, volume, format and treatment methods; (iv) ensure in the performance of its activities guarantees similar or better than those established in this Privacy Notice, in the CPFL Group's information security policy and procedures and also in a contract and/or other specific legal document that establishes the rules for handling personal data on that contract, and (v) ensure that its partners, representatives, employees and third parties treat personal data with confidentiality and comply with the obligations set out in the documents informed in the previous item.

For what purposes and recipients we share your personal data:

Recipients	Why we share:
Partners and suppliers	To develop, maintain and supply our products and services such as reading energy consumption, executing specific works and services, document keeping companies.
Service providers	They are usually technology companies that provide business support services such as website and application development, hosting, maintenance, backup, storage, virtual infrastructure, payment processing.
Specialized professionals	To provide services such as compliance, legal, insurance, accounting, audits, finance, collection, HR consultancy, among others.
Administrative, judicial and governmental authorities	To comply with specific law or regulation (eg Money Laundering Prevention, Fatca), subpoenas or court order, self-regulatory audits of agencies to which we are subject, for the safety of anyone, investigation of possible crimes and criminal offenses (fraud, loss, theft, etc.), to protect our rights, interests and interests of others; in the educational research projects identified in item 2, letter “c”; public policies and management of concessions in the energy sector (eg Energy Bulletin of the State of São Paulo, Energy Bulletin of the State of Rio Grande do Sul).
Publicity and advertisers companies	Serving ads to data subjects in online advertising on their own or third-party websites, sending electronic messages, phone calls or even direct mail by post to promote our services, products and features.
Researchers	To improve our products, services, digital platforms, services, initiatives, among others.
Information banks (public or private)	For identification and authentication of data subjects in the hiring and use of digital services, for the prevention of money laundering, identification of politically exposed persons or FATCA, registration update, fraud prevention, socio-environmental crimes, among others.
Controlling companies	For the parent company so that they can carry out control and management activities of the CPFL Group under the terms of the laws that regulate business activities. except for the limitations imposed by the regulation of the electricity sector.
Acquisition of companies or assignment of credits	In case of corporate movements, such as merger, acquisition or incorporation, or even in the event of assignment of rights.

The CPFL Group adopts security, technical and administrative measures proportional to the sensitivity, volume, format and treatment methods used based on the best market practices aimed at protecting personal data from unauthorized or unauthorized access and situations of destruction, loss, alteration, communication or dissemination.

The data processed by the CPFL Group is stored in a safe environment, with internal security rules and procedures being observed, including information security and cyber. The security measures adopted are periodically tested to ensure the privacy and protection of the personal data of the data subjects.

People who, for the exercise of their activities in the CPFL Group, are trained and authorized to carry out the processing of personal data are committed to confidentiality and preservation of the privacy of the data subjects.

A personal data incident occurs when there is improper disclosure or unauthorized access by third parties to personal data.

Important: No security system is foolproof, inside or outside the internet (how many houses, with locks on the windows, monitoring camera, security have already been victims of a robbery?). Thus, the CPFL Group may also be the victim of fraud, crime or improper access. Thus, the CPFL Group is also not immune to malicious invasion attempts, and may be the victim of fraud, crime or improper access. Anyway, we are prepared to deal with these types of situations.

In the event of exposure of personal data, the CPFL Group will take all necessary measures to eliminate or reduce the impacts on its private life, which includes the application of its incident response plan that has analysis procedures and techniques, including the legal forensic analise, which help areas to identify, monitor, report, categorize their criticality and resolve data breach incidents.

In the event that the data incident entails risks or damages that are relevant to the privacy of the data subject, the CPFL Group will communicate both the data subject impacted on the incident and the ANPD, informing about the event, its impacts and what was and is being done to reduce risks, all as provided for in the LGPD, in the regulations of the National Data Protection Authority and possibly other regulatory bodies in the sector (when applicable).

To communicate to the data subject, the CPFL Group will use the service channels available at the time to contact the data subject, which may be done by telephone, e-mail or letter, at the discretion of the CPFL Group.

In the case of active customers (with contracts in progress), the email address registered in the CPFL Group Database will be used preferably, so do not forget to keep your data always up to date.

Cookies are files that contain an identifier (a sequence of letters and numbers) that is stored by your browser when you access websites and applications using the internet.

In general, the browser you use has a list of identifiers for internet users and when you access a website or an application, the identifier of your equipment (smartphone, notebook, computer, tablet, etc.) is activated and your browser locates this number in the list of identifiers it has and automatically informs the CPFL Group website or application that that code is browsing our website or application. We emphasize that if you are not in a logged area of our website or application (which you have accessed with a login and password) it will be difficult to identify you.

The CPFL Group collects cookies necessary for the functioning of the website or application (that is, to enable the use of the website/application functionalities), with functional analytics objectives to facilitate navigation, for better understanding and optimization of the website's performance session/functionalities of the website or application, evaluate the most viewed pages, bounce rate and also for delivery of content more suitable for those who browse through the internet on our websites and applications.

You can configure your browser to block the use of cookies during your browsing, but depending on the cookies that will be disabled, some features of the website or application may not work correctly. To find out how to disable your cookies, please consult your browser.

The DPO is the natural person appointed by the Controller or Operator to be the contact between them and the ANPD and the data subject. To exercise the function of Data Protection Officer to Mrs. Denise Ramos de Lima who is supported by the cell of attendance to the rights of the data subjects to register and address issues related to the fulfillment of the rights guaranteed by the LGPD, observing flows and procedures to provide and deliver the information to you with greater safety and quality.

The DPO is not authorized to answer questions from channels other than the one officially defined in this privacy notice.

We remind you that our employees' social networks are private and cannot be used for purposes related to their work activities. Therefore, our DPO is not authorized to answer questions and meet requests made by a channel other than the one informed in item 3 above.

In order to keep it updated, we can change this Notice at any time, at which time the updated version will be made available on our institutional website.

Adolescent - natural person, between 12 (twelve) and 18 (eighteen) years of age, according to the Statute of Children and Adolescents (ECA);

Anonymization - use of technical means, whereby data loses the possibility of identifying the individual;

ANPD – National Data Protection Authority - Maximum data protection authority that will be responsible for ensuring compliance with the rules on the protection of personal data, editing rules and procedures as determined in the LGPD, consolidating the understanding of issues related to data protection, requesting information from companies regarding the treatment of data data, carry out records and follow-up of the data subjects' complaint, inspect and apply sanctions to controllers and data operators;

Database - a set of personal data, in one or several physical or electronic locations;

Biometrics - physical or behavioral characteristics of an individual, for example digital collected in transactions carried out through ATMs at your Financial Institution; unlocking the cell phone with digital identification or face points;

Childrem - natural person, under 12 (twelve) years of age, in accordance with the Childrem and Adolescent Statute ("ECA");

Sharing - transfer of personal data with internal areas or third parties;

Controller - It is the person who makes the decision about the processing of personal data;

Consent - free, informed and unambiguous expression of the data subject confirming their agreement with the treatment of their personal data;

Personal data - It is information related to a data subject that allows its identification. For example, your full name, an email address, your parents' name and your date of birth are all considered personal data;

Sensitive personal data - They are personal data about racial, ethnic origin, religious belief, political opinion, union membership, organization of a religious, philosophical or political nature, data relating to health or sexual life, genetic or biometric data. For the purposes of this privacy notice, whenever we are talking about personal data, we will be referring to both personal data and sensitive personal data;

Data center - Data processing center that hosts a multitude of servers and databases;

Data subject rights - the data subject has the right to obtain from CPFL: (i) confirmation of the existence of processing; (ii) access to data; (iii) correction of incomplete, inaccurate or outdated data; (iv) anonymization, blocking or deletion of unnecessary, excessive or processed data in violation of the General Law for the Protection of Personal Data - "LGPD"; (v) portability of data to another service or product provider, upon express request, in accordance with the regulations of the national authority, observing commercial and industrial secrets; (vi) deletion of personal data processed with the consent of the holder; (vii) information on public and private entities with which the controller shared data; (viii) information about the possibility of not providing consent and about the consequences of denial; and (ix) revocation of consent;

Deletion - deletion of a personal data or set of personal data stored in a database;

CPFL ENERGIA GROUP. All companies directly or indirectly controlled by the CPFL Group: (i) Electric energy distributors (regulated market) - CPFL Paulista, CPFL Piratininga, RGE, CPLF Santa Cruz; (ii) Electricity traders (free market) - CPFL Brasil, CPFL Meridicional, CPFL Sul Geradora, CPFL Cone Sul, CPFL Brasil Varejista, CPFL Planalto; (iii) Electricity generation: Jaguari, CPFL Transmissão Piracicaba, CPFL Transmissão Morro Agudo, CPFL Transmissão Maracanaú, CPFL Transmissão Sul I; CPFL Transmissão Sul II; (iv) CPFL Renováveis; (v) Service Companies: CPFL Serviços, CPFL Atende, CPFL Finanças, CPFL Infra, CPFL People, CPFL Supre, CPFL Eficiência, CPFL GD;

LGPD - General Data Protection Law. It establishes rules for third parties to use their personal data in commercial activities;

Legal permission for processing personal data. The law determines in which cases the Controller can process personal data: Here we will mention those that are most relevant for the purposes of treatment mentioned in this document, remembering that there is no legal basis more important than the other, there is the most adequate for the purpose of the treatment: (i) consent (when authorization is required); (ii) compliance with a legal or regulatory obligation (when there is a law, regulation or court decision that authorizes or determines the processing of data such as data on the energy bill); (iii) preliminary procedures for contracting or executing contracts (such as when the data subject requests a new electricity connection or changing the ownership of an existing connection); (iv) legitimate interest of the contractor or third parties (there must be a balance between the legitimate interest of the organization or third parties and the expectations and rights and freedoms the data subjects in this case, Sensitive Data cannot be used); (v) credit protection (only for Data that is NOT sensitive); (vi) regular exercise of the right in judicial, administrative or arbitration proceedings (to defend the rights of the Controlling Party or third parties); (vii) protection of the life or physical security of the data subject or third party; (viii) health protection, in a procedure carried out by health professionals, health services or by health entities; (ix) guarantee of fraud prevention of the data subject in the processes of identification and authentication of registrations in electronic systems (only for Sensitive Data).

Operator - It is the person who processes personal data on behalf of the controller;

Retention of personal data - period for which personal data remains stored;

Sub-operator/subcontractor - It is the person who processes personal data is outsourced by the operator;

Site and applications - Refer to the CPFL Group websites and applications;

Data subject -Is the identified or identifiable natural person, to whom the object of data processing refers. Therefore, to whom this privacy notice is addressed;

Treatment. Any and all operations carried out with personal data, which includes the collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, disposal, evaluation or control of information, modification, communication, transfer , diffusion or extraction. Thus, whenever we use the term "treatment" we are referring to any of these activities.

Would you like to exercise the rights arising from the LGPD? Click here