Everything about financial market in one place.

Version 1.0 | Effective date: September 24, 2026.

These Terms govern access to and use of the Home Broker TROM made available by SITA Sociedade Corretora de Câmbio e Valores Mobiliários S/A, CNPJ 17.315.359/0001-50, headquartered at Rua Rio Grande do Norte, 988, Funcionários, Belo Horizonte/MG, CEP 30130-135, hereinafter SITA or the Brokerage Firm.

1 Purpose and limits of the service

The Home Broker allows the enabled client to transmit buy and sell orders and to consult information on the B3 cash market assets actually made available by SITA. The universe of authorized assets. Displaying a quote does not mean authorization to trade the respective instrument.

SITA's platform does not offer derivatives transactions, including options, futures, mini contracts, swaps and forward transactions, nor transactions in the BM&F segment. The reference to the former Bovespa segment does not broaden this scope. Generic features of the provider do not authorize transactions in markets not contracted and enabled by SITA.

These Terms supplement the intermediation agreement, the Rules and Operating Parameters, the fee schedule and the specific documents of the contracted services, which must remain accessible on the brokerage firm's website. They do not replace them nor set aside the legislation, the rules of the CVM and the Central Bank or the applicable regulations and self-regulatory rules of B3 and BSM.

2 Registration and enablement

Operational access depends on approved registration, identification and qualification of the client, validation of the powers of representatives, contracting of the services and compliance with legal and regulatory requirements. The client must provide truthful information and report relevant changes to their registration data.

SITA may request documents and clarifications needed to update the registration, verify the source of funds and prevent unlawful acts. Insufficient or inconsistent information may prevent enablement or justify proportionate restrictions until regularized, in accordance with the applicable rules.

The procedures for registration, identification of the ultimate beneficial owner, verification of the source of funds and monitoring of transactions also meet the obligations to prevent money laundering, terrorist financing and the proliferation of weapons of mass destruction, including under Law No. 9,613/1998 and CVM Resolution No. 50/2021, without prejudice to other applicable rules.

3 Investor profile and investment decision

SITA verifies the suitability of products, services and transactions to the client's profile in the cases required by regulation, including under CVM Resolution No. 30/2021 and its applicable amendments. The client must answer the questionnaire with correct information and update it when necessary. An order incompatible with the profile, or without a valid profile, may only proceed in the permitted situations, after the specific warnings and declarations required.

Accepting these Terms does not replace the profile assessment nor the specific declaration of unsuitability. Making quotes, charts and tools available does not constitute a promise of return or an individualized recommendation. Recommendations, when provided, are subject to their own rules and to the Brokerage Firm's obligations.

4 Credentials and access security

The client must keep their credentials confidential, use the required authentication factors, protect their devices, keep software up to date and log out when finished. The client must not share passwords, tokens or verification codes, nor allow remote access by unknown persons.

SITA may require multi-factor authentication and other security mechanisms compatible with the risk and with regulatory requirements. The client must immediately report loss, theft, suspected compromise of credentials or unrecognized access, so that the appropriate preventive measures can be taken.

Representatives and attorneys-in-fact may only operate after identification and validation of their powers by SITA, through authorized means. The existence of a power of attorney does not authorize informal sharing of the account holder's personal credentials.

If the client suspects that access has been compromised, they must immediately notify SITA for analysis and adoption of the appropriate measures. The use of credentials is an element of investigation, but not absolute and incontestable proof of authorship. SITA's duties of security, investigation and customer service remain.

5 Sending and tracking orders

Before confirming an order, the client must check the asset, buy or sell, quantity, price, type and validity. SITA will make available the order types and conditions actually accepted, in accordance with its Rules and Operating Parameters and with B3's trading rules.

Sending a request does not mean execution. Orders may be received, rejected, partially or fully executed, cancelled or may expire. Execution depends, among other factors, on price, liquidity, priority, limits, availability of funds or assets and market conditions. SITA must provide information that allows the order status to be tracked.

Requests to modify or cancel depend on confirmation and do not automatically undo trades already executed. Closing the browser, logging out or losing the connection does not cancel open orders. Before resending a request after a failure or delay, the client must check its status or contact the trading desk to avoid duplication.

If orders with triggers are offered, including stop orders, their triggering does not guarantee execution or the final price. Auctions, interruptions and lack of a counterparty may prevent or change the expected result. The client must consult the description of the feature before using it.

6 Operational limits and controls

SITA may apply balance, position, risk and compliance controls, refuse orders or restrict access when there are contractual, regulatory or security grounds, including suspected fraud, irregular registration, insufficient funds or an order from an authority. The measures must be proportionate and communicated when appropriate, subject to legal secrecy.

An operational limit does not constitute an automatic grant of credit. The client must make funds and assets available to meet their obligations. Transactions that depend on additional contracting are not authorized by the mere acceptance of these Terms. Any compulsory liquidation depends on a contractual provision and the applicable conditions, without unrestricted authorization by this clause.

7 Costs and settlement

Transactions may involve brokerage fees, exchange fees, B3 charges, taxes and other costs previously disclosed and contracted. SITA will itemize the amounts in the relevant operational documents and will observe the duties of transparency regarding compensation and conflicts of interest.

The client must observe the settlement periods informed for each transaction, check brokerage notes, statements and positions and report discrepancies through the official channels. Tax obligations are fulfilled by each party according to its legal responsibility. Changes to costs will observe the applicable notice and contractual conditions.

8 Investment risks

Equity investments are subject to losses, including total loss of the amount invested, due to price fluctuations, lack of liquidity, issuer events and economic or market conditions. Cash market trading does not eliminate these risks. Past performance does not guarantee future results.

Auctions, trading halts, circuit breakers, update delays and communication failures may affect the sending and execution of orders. Loss control tools do not eliminate these risks. Shares are not covered by the Brazilian Credit Guarantee Fund (FGC).

9 Unavailability and contingency

The service depends on the systems of SITA, of providers, of telecommunications and of the market infrastructure. Unavailability and maintenance may occur. SITA must maintain continuity and recovery measures compatible with its obligations and report relevant occurrences in accordance with regulations.

If unable to access the platform or transmit orders, the client must use the trading desk's alternative channel: (31) 3261-4899 / 3303-4899 / (31) 99899-7638, Monday to Friday from 10 a.m. to 6 p.m., Brasília time. The accepted means of transmission, identification and confirmation must be set out in the Rules and Operating Parameters. Contact through an unauthorized channel does not amount to receipt of an order.

A failure in the Home Broker does not imply cancellation of trades or of orders already accepted. Unavailability also does not automatically exclude the liability of SITA or of the provider: each occurrence will be investigated according to the facts, the contract and the law.

10 Records and disputes

SITA will keep the required records of access, authentication, origin and processing of orders, communications and acceptances, with the applicable integrity and retention controls. These elements may be used to evidence transactions, for customer service, audit and supervision, within legal limits.

Unrecognized orders or discrepancies must be reported as soon as identified, preferably with the date, time and identification of the transaction. SITA must record the request, investigate the facts and respond through the customer service channels. The absence of an immediate complaint does not imply automatic waiver of the client's rights or legal time limits.

11 Prohibited conduct and intellectual property

It is prohibited to use the service for fraud, market manipulation, insider trading, simulated transactions, spoofing, layering, wash trades, money laundering or other unlawful practices. It is also prohibited to circumvent access controls, exploit vulnerabilities without authorization, interfere with the systems or use unauthorized automation and integrations.

Access grants only the right to use the contracted features. Trademarks, software and market data remain subject to the rights of their respective owners and to the applicable licenses. Commercial redistribution of quotes or content requires the relevant authorization, without prejudice to the client's right to keep their own operational documents.

12 Responsibilities and data protection

The client is responsible for their acts and obligations to the extent provided by law. SITA is responsible for fulfilling the duties of intermediation, diligence, security, information and other obligations assigned to it. The participation of technology providers does not transfer the risks of the service entirely to the client nor exclude legally established responsibilities.

These Terms do not exclude rights to compensation for failures attributable to those responsible, nor do they establish a general exemption for fraud, incidents or acts of third parties. Liability will be determined according to the law and the circumstances of the case.

13 Customer service and investor protection

Customer service: atendimento@sita.com.br and https://sita.com.br/sita/contato/. Ombudsman: https://sita.com.br/sita/ouvidoria/ . Privacy requests must be sent to the data protection officer identified in the Privacy Policy.

The client may turn to the CVM, the Central Bank, BSM and other competent bodies, depending on the matter. The Loss Compensation Mechanism (MRP), administered by BSM and maintained by B3, may be invoked in the cases and within the limits of its rules. It is not a guarantee of return or coverage of losses inherent to the market.

14 Changes, suspension and termination

Updated versions will be made available with identification and effective date. Relevant changes will be communicated in advance when appropriate, and a new acceptance will be requested when necessary. Changes will not retroactively impair acquired rights nor waive obligations already incurred.

Access may be suspended or terminated in the contractual and legal cases, including at the client's request. SITA must provide guidance on pending orders, completion of transactions, access to documents and transfer of assets, when applicable. Termination does not waive settlements due, nor authorize the undue retention of assets or the deletion of mandatory records.

15 Governing law and acceptance

Brazilian law applies, including the LGPD (Law No. 13,709/2018), the Brazilian Internet Civil Rights Framework (Law No. 12,965/2014), the Consumer Protection Code where applicable, and the rules of the CVM, the Central Bank of Brazil, B3 and BSM relevant to the activities actually performed by SITA. Any disputes will be brought before the competent court under the law, preserving the jurisdiction of the consumer's domicile where applicable. These Terms do not impose mandatory arbitration nor restrict access to supervisory bodies or the Judiciary.

Declaration of acceptance of the Terms of Use: “I have read and accept SITA’s Home Broker TROM Terms of Use, and I am aware of the scope of the services and of the risks disclosed.”

Separate declaration of acknowledgment of the Policy: “I have had access to SITA’s Privacy Policy, version 1.0, effective as of September 24, 2026, and I am aware of the information on the processing of personal data and the channels for exercising my rights.”

Version 1.0 | Effective date: September 24, 2026.

This Policy explains how SITA processes personal data in its relationship with its clients and in making available the Home Broker TROM, intended for transactions in the B3 cash market enabled by the Brokerage Firm, with no derivatives transactions or transactions in the BM&F segment. It also applies to representatives and attorneys-in-fact who use the services.

1 Who is responsible for the data

SITA Sociedade Corretora de Câmbio e Valores Mobiliários S/A, registered with the CNPJ (Brazilian corporate taxpayer registry) under No. 17.315.359/0001-50, headquartered at Rua Rio Grande do Norte, 988, Funcionários, Belo Horizonte/MG, CEP 30130-135, is the controller of the personal data processed to provide its brokerage services and to meet the obligations arising from this activity.

Technology providers act as processors when they process data on behalf of and according to the instructions of SITA. The classification of each participant depends on its actual activities. B3, authorities and other institutions may act as independent controllers in the activities under their responsibility.

For the purposes of this Policy, the definitions of Law No. 13,709/2018 (LGPD, the Brazilian General Data Protection Law) apply, including data subject, personal data, sensitive personal data, controller, processor, data protection officer, processing, anonymization and consent. Processing will observe the principles of good faith, purpose, adequacy, necessity, free access, data quality, transparency, security, prevention, non-discrimination, and accountability.

2 What data is processed and where it comes from

Depending on the service used, we process: identification and contact data, such as name, CPF (Brazilian individual taxpayer ID), identity document, address, telephone and e-mail; data on representatives and ultimate beneficial owners; registration, professional, financial and asset information; tax residence; data needed to assess the investor profile and to prevent unlawful acts; bank data, balances, positions, orders, trades, settlements and operational documents.

Access and authentication logs, IP address, date and time, session identifiers, technical information on the device and browser, security events, the version of the documents presented and acceptance records are also processed. Customer service interactions, communications and conversations about orders and transactions may be logged or recorded on the channels subject to this obligation, with notice to the user.

Data is provided by the data subject or representative, generated by the use of the services, or obtained from legitimate sources, such as B3, institutions involved in the transactions, registration validation providers and public or legally accessible databases. Only the data necessary for the respective purposes is used.

To comply with the obligations to prevent money laundering, terrorist financing and the proliferation of weapons of mass destruction, data and documents relating to the source of funds and assets, the ultimate beneficial owner, classification as a Politically Exposed Person (PEP) and monitoring records may be processed, within the limits of the applicable laws and regulations, including Law No. 9,613/1998 and CVM Resolution No. 50/2021.

Biometric data, if used in a feature actually made available, is sensitive personal data. Its collection must be preceded by specific information on the purpose, provider, retention and the legal basis under art. 11 of the LGPD, including fraud prevention and security in identification, where applicable. This Policy does not authorize the indiscriminate collection of biometrics.

3 Purposes and legal bases of processing

Registration and provision of services: client identification, account maintenance, platform access, order transmission, inquiries, customer service and settlement of transactions. The legal bases are the performance of the contract and of preliminary procedures requested by the data subject, in addition to the relevant legal and regulatory obligations.

Compliance with obligations: assessment of the suitability of investments to the client's profile, under the applicable regulations, including CVM Resolution No. 30/2021, record keeping, prevention of money laundering and of terrorist financing and the proliferation of weapons of mass destruction, supervision and mandatory reporting. This processing arises from a legal or regulatory obligation and does not depend on consent.

Security and fraud prevention: protection of accounts, investigation of suspicious access and preservation of the integrity of the services. We use the legal bases applicable to the activity, including regulatory obligation and legitimate interest, subject to an assessment of necessity, proportionality and the rights of the data subject. For sensitive data, only the specific legal bases apply.

Defense of rights: preservation and presentation of records in judicial, administrative or arbitration proceedings, where applicable, based on the regular exercise of rights. Processing for credit protection will only occur in the cases permitted by law.

Marketing communications and optional features: when processing depends on consent, it will be requested specifically and separately, with the possibility of refusal or withdrawal. Access to the Home Broker will not be conditional on receiving advertising.

4 Data sharing

Strictly necessary data may be shared with B3 and institutions responsible for trading, clearing, settlement, deposit and custody; contracted platform, infrastructure, authentication, support and fraud prevention providers; auditors and advisors bound by confidentiality; and competent authorities or entities, such as the Central Bank of Brazil, CVM, BSM, ANPD, the Federal Revenue Service, Coaf and the Judiciary, within their powers and the cases provided by law.

Contracted providers must follow instructions, purpose restrictions, access controls and security and confidentiality duties compatible with the service. Contracting technology does not remove SITA's legal responsibilities. Sharing also observes the secrecy applicable to financial and operational information.

Through this Policy, SITA does not grant authorization for the sale of data or its unrestricted use by providers. The data subject may request information on the entities with which data has been shared, subject to legal restrictions.

5 Storage and possible international transfer

Data is stored in environments of SITA or of contracted providers. If storage, support or access from abroad constitutes an international transfer, SITA must adopt a valid mechanism provided for in the LGPD and in ANPD regulations, such as standard contractual clauses or an applicable adequacy decision, in addition to the relevant sector requirements.

6 How long data is kept

Retention depends on the purpose, the category of the record and the applicable rule. Documents, recordings and audit trails covered by CVM Resolution 35 are kept for at least five years, or for a longer period when required. For records covered by BCB Circular 3,978, the minimum periods of ten years and the respective starting points set out in that rule apply. Other categories follow their own periods.

Closing the account or withdrawing consent does not delete data subject to mandatory retention. Data may also be retained where necessary for the defense of rights or by order of an authority, with restricted access. Once the purposes and retention obligations have been fulfilled, the data will be securely deleted or anonymized, as appropriate.

7 Security and incidents

SITA must maintain technical and administrative measures proportionate to the risks, including access management, protection of communications, activity logs, vulnerability management, service continuity and incident response. The authentication mechanisms required on the platform must be used by the client, without sharing passwords or verification codes.

Security measures will observe, among others, the duties set out in arts. 46 to 49 of the LGPD and the regulatory requirements applicable to the Brokerage Firm's activity, with controls compatible with the risks, segregation of access and the principle of least privilege.

No electronic environment is immune to incidents. Should one occur, SITA will take containment, investigation and mitigation measures and will notify the ANPD, the data subjects and the competent bodies in the cases and within the time limits set by law and regulation. Suspected fraud or unauthorized access must be reported through the customer service channels listed below.

8 Cookies and similar technologies

The platform may use cookies and local storage necessary for authentication, security and session maintenance.

Optional advertising or measurement features subject to consent will only be enabled after the user's choice, and the user may refuse them or change their preference as easily as accepting them. Mere browsing will not be considered consent for these purposes.

9 Data subject rights

Under the conditions of the LGPD, the data subject may request confirmation of processing, access, correction, information on sharing, portability in accordance with regulations, anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed data, deletion of data processed with consent and withdrawal of that consent. The data subject may also object to processing carried out in breach of the law and file a petition with the ANPD.

The data subject may request a review of decisions made solely on the basis of automated processing that affect their interests, as well as information on the criteria and procedures used, subject to commercial and industrial secrecy.

Requests are free of charge. SITA may verify the identity and the powers of the representative to protect the data. The response will observe the applicable legal time limits. Any inability to fulfil a request will be explained, including when it results from a retention obligation or another legal restriction.

This Policy is governed by Brazilian law, especially Law No. 13,709/2018 (LGPD), Law No. 12,965/2014 (Brazilian Internet Civil Rights Framework), Law No. 8,078/1990 where applicable, and the rules of the CVM, the Central Bank of Brazil, B3, BSM and the ANPD relevant to the activities actually performed by SITA.

10 Contact and updates

Customer service and LGPD requests: sita@sita.com.br - SITA customer service: atendimento@sita.com.br and https://sita.com.br/sita/contato/. Ombudsman: https://sita.com.br/sita/ouvidoria/.

Updates will be identified by version and effective date and made available on the official channels. Relevant changes will be appropriately communicated. New processing that depends on consent will be subject to a specific request. Acknowledging this Policy does not imply a waiver of rights nor replace legally required consents.