Privacy & Information Security Policy — GLED.AI

Controller: GLED ESCOLA INTERNACIONAL LTDA (trade name: GLED GLOBAL EDUCATION)

CNPJ: 34.961.684/0001-00

Address: Av. São Gabriel, 149, 9th Floor, Suite 903, Room 02, Jardim Paulista — São Paulo/SP — ZIP 01435-001

Phone: (11) 2130-7777 • Institutional e-mail: contato@gled.ai

Data Protection Officer (DPO): Valdir M. — dpo@gled.ai

Effective date: Jan 1, 2024 • Last updated: Nov 8, 2025 • Version: 2.3

1. Scope and Purpose

This Policy regulates the processing of personal data and sensitive personal data carried out by GLED GLOBAL EDUCATION (the "Controller") through the GLED.AI platform, the gled.ai website, applications, APIs, integrations and other related services (the "Services"). It applies to all data subjects ("Data Subjects") who use the Services, such as students, parents or guardians, teachers, employees, clients, partners, visitors and legal representatives. The document covers the collection, use, storage, sharing, transfer and protection of personal and sensitive data, in accordance with Brazilian Law No. 13.709/2018 (General Data Protection Law — LGPD), the Statute of the Child and Adolescent (Law No. 8.069/1990 — ECA) and, when applicable, Regulation (EU) 2016/679 (GDPR), the California Consumer Privacy Act (CCPA)/California Privacy Rights Act (CPRA) and the United States Children's Online Privacy Protection Act (COPPA).

GLED is committed to data privacy and security, ensuring ethical and transparent processing, and declares that it has legitimacy to process, anonymize and use aggregated and anonymized data for service improvement, educational reporting and market intelligence, respecting legal limits. By using the Services, the Data Subject acknowledges and agrees to this Policy. GLED may update this Policy periodically and will publish the latest version on its official portal.

2. Definitions

Personal data: information related to an identified or identifiable natural person (Art. 5, I, LGPD).
Sensitive personal data: data on racial or ethnic origin, religious conviction, political opinion, union membership, health, sexual life, genetic or biometric data (Art. 5, II, LGPD).
Data Subject: the natural person to whom the personal data relates.
Controller: legal entity that decides on the purposes and means of processing personal data.
Processor: legal entity that processes data on behalf of the Controller.
Processing: any operation performed with personal data, including collection, use, access, storage and deletion.
Anonymization: the process by which data loses the ability to identify the Data Subject irreversibly.