Code of Ethics and Conduct

MISSION

Optimize sanitation management with artificial intelligence, reducing water losses, improving operational efficiency, and ensuring continuous monitoring of supply sectors.

VISION

To be an international benchmark in data-driven water efficiency by 2030.

VALUES

• Ethic;
• Team work;
• Innovation;
• Respect;
• Transparency.

Company B

Making ethical decisions

When faced with a situation that raises doubts, ask yourself three questions:

1. Is this in accordance with current legislation?
2. Is this consistent with this Code and with Stattus4's internal policies?
3. Does this align with Stattus4's values?

If the answer to any of these questions is 'no', the conduct in question is not appropriate. If you have genuine doubt about the answer, consult leadership or the Whistleblowing Channel before taking action.

2. SCOPE AND RESPONSIBILITIES

This Code applies to all persons who have a relationship with Stattus4, regardless of the type of relationship or location:

• Employees with a CLT (Consolidation of Labor Laws) contract, in any position or hierarchical level;
• Self-employed professionals, consultants, and service providers operating under a PJ (legal entity) regime;
• Interns and young apprentices;
• Suppliers, business partners and representatives;
• Clients, within the scope of their contractual relationship with Stattus4.

The scope is national and international — it applies to all locations where Stattus4 operates or will operate.

General responsibilities of everyone

Regardless of their position or role, every person affiliated with Stattus4 must:

• To act with dignity, honesty, and integrity in all professional relationships;
• To know and comply with the provisions of this Code;
• Immediately report any situation that represents an ethical or legal violation, using the channels indicated in Chapter 9;
• Maintain confidentiality regarding all confidential information of the company and its clients;
• To support a safe, healthy and respectful work environment;
• Refuse personal benefits that could compromise your independence or create a conflict of interest.

Additional responsibilities of leaders

Managers, coordinators, and directors have expanded responsibilities:

• To exemplify expected conduct — leadership behavior is the primary ethical benchmark for the team;
• To create a safe environment where people can raise concerns without fear of retaliation;
• To proactively identify and address ethical risks in their respective areas;
• Ensure that new team members are familiar with this Code and sign it. Terms of Agreement;
• Never guide, pressure, or approve conduct that violates this Code, even if it benefits short-term results.

3. PROFESSIONAL CONDUCT

Expected standard of conduct

At Stattus4, professionalism isn't about rigidity—it's about consistency. It's about showing up committed, delivering quality, treating people with respect, and representing the company with integrity wherever you are.

These are the expected behaviors of everyone:

• To act efficiently, clearly, and with focus, contributing to the company's objectives;
• Maintain professional relationships based on respect, collaboration, and good faith;
• Comply with established safety standards and operational procedures;
• Seek guidance from leadership when you have doubts about appropriate conduct;
• To contribute to maintaining an organized, safe, and pleasant work environment.

Prohibited conduct

• The following conduct is expressly prohibited and subject to disciplinary action:
• Making false or defamatory statements, or statements that harm the image of Stattus4, its clients, partners, or colleagues;
• Using the influence of external third parties to obtain benefits within the company;
• Possessing, using, or distributing illicit drugs or alcoholic beverages on company premises or during professional activities;
• Reporting to work under the influence of alcohol or narcotics;
• Carrying any type of weapon on Stattus4 premises;
• Engaging in gambling in the workplace;
• Accessing pornographic content on company premises, even through personal devices;
• Disregarding usage restrictions established in company spaces;
• Conducting sales, raffles, money laundering schemes, or pyramid schemes during work hours;
• Using the name, brand, logos, or visual identity of Stattus4 without formal authorization;
• Making political or ideological statements on digital channels that could be associated with the company.

Confidentiality and secrecy

• The information generated and shared within the context of Stattus4 — regarding clients, projects, technology, strategy, partners, and financial results — constitutes company assets and should be treated as such.
• Each employee commits to:
• Do not disclose confidential information to third parties without express authorization from the Board of Directors;
• Do not use privileged information for your own benefit or the benefit of others;
• Adopt best practices for information security when handling company and customer data;
• Maintaining the commitment to confidentiality even after the termination of the relationship with Stattus4.
• Violation of confidentiality may give rise to disciplinary, civil, and criminal liability.

Intellectual property

• All knowledge, products, methods, or technologies developed in the context of work at Stattus4 are the exclusive property of the company. This includes source code, algorithms, methodologies, project data, and technical documentation.
• It is forbidden to use the knowledge acquired at Stattus4 to create side businesses, provide services to competitors, or obtain personal gain, during or after your affiliation with the company.

Social networks and digital communication

• Each employee's digital presence reflects — directly or indirectly — the image of Stattus4. It is expected that:
• Social media interactions should respect company values and the Code of Ethics;
• Confidential information, customer data, or project results should never be shared on digital channels without authorization.;
• Messages of a derogatory, offensive, pornographic, or discriminatory nature should not be published on any channel, even personal ones, when they could be associated with Stattus4;
• Emojis and stickers should be used with balance and common sense in professional communications — they are welcome, but in excess they harm the message;
• Refrain from publicly declaring support for candidates, parties, or political-partisan positions on social media or any other digital channel that could be associated with your work at Stattus4. The company serves clients across the political spectrum and maintains strict political-partisan neutrality. Your political opinion is yours—what we preserve is the separation between it and the institutional image of Stattus4.

Use and maintenance of equipment

• The equipment provided by Stattus4 — computers, cell phones, tablets, field devices, and any other technological assets — are work tools and should be treated as such.
• The employee's responsibilities include:
• To ensure the conservation and proper use of the equipment under their care;
• Use the equipment exclusively for professional purposes related to Stattus4's activities;
• Immediately notify the technical department of any damage, loss, theft, or malfunction;
• Do not install unauthorized software, games, or personal applications on these devices;
• Return the equipment in good condition upon termination of the employment relationship, regardless of the reason for termination.
• Using company equipment for illegal or unethical activities, or activities that violate this Code, is a serious offense and may give rise to civil liability for the damage caused.

4. USE OF WHATSAPP

Usage Hours

Sending professional messages via WhatsApp — from any number, corporate or personal — must occur exclusively within Stattus4's business hours.

Monday to Friday, from 8 am to 5 pm.

Saturdays, Sundays and holidays: no professional messages.

The habitual sending of messages outside of working hours may constitute unpaid overtime, creating legal risks for both the company and the employee. This applies even when the message is sent on the employee's own initiative, without a request from the manager.

⚠️ Exception — EmergenciesIn genuine customer emergencies—such as critical system failures that compromise supply—employees may provide assistance outside of business hours, provided they immediately inform their direct supervisor of the incident. Emergencies do not include questions, routine updates, or requests that can wait until the next business day.

Automated away message — WhatsApp Business

Employees who use WhatsApp Business — whether corporate or personal for professional use — should set up an automatic out-of-office message outside of business hours. Suggested texts are below:

Out-of-office message (outside of business hours):Hello! Our support hours are Monday to Friday, from 8 AM to 5 PM. Your message has been received and we will get back to you soon. In case of a critical system emergency, please contact us at suporte@stattus4.com. Thank you!

Greeting message (first contact):Hello! Thank you for contacting Stattus4. How can I help you?

Usage by area and number type

Sales Team and Customer Success

Employees on these teams have a corporate phone number provided by Stattus4. The number belongs to the company—not the employee—and will be reclaimed upon termination of the employment relationship. Its use must be exclusively for professional purposes, within business hours, and in accordance with this policy.

Support and Administrative Team

Customer service is provided via a shared number integrated with HubSpot. All conversations are recorded on the platform, ensuring traceability and continuity of service regardless of the employee responsible. The number belongs to Stattus4 and should not be accessed outside of the management system.

Technical and Financial Team — occasional use

For employees on the Technical (Hardware, Systems, and Product) and Finance teams, occasional use of personal WhatsApp to contact clients, suppliers, or partners is permitted, with the following restrictions:

• Contact should only occur during business hours;
• Confidential information, customer data, access credentials, project results, and technical system data should not be shared via WhatsApp, regardless of the number used.;
• Passwords, tokens, and access keys should never be sent via WhatsApp — under any circumstances.;
• Conversations relevant to projects or contracts should be recorded in HubSpot to ensure traceability.;
• The personal number cannot be disclosed as an official Stattus4 customer service channel.

📋 Guidance for customers who contact us outside of business hours.The employee should not respond to professional messages outside of business hours. Ideally, an automated message should be configured informing the employee of their business hours. If the client insists on direct contact outside of business hours, the employee should wait until the next business day to respond—except in emergency situations described in Section 1.

Conduct and content

Any professional communication via WhatsApp — whether from a corporate or personal number — must adhere to the same standards of conduct required in the Stattus4 Code of Ethics and Conduct. The following are expressly prohibited:

• Sharing confidential company, client, or project information;
• Sending or forwarding political, ideological, religious, or partisan content;
• Offensive, discriminatory, pornographic content or content that violates the dignity of any person;
• Using aggressive language, profanity, or disrespectful expressions towards colleagues, clients, or partners;
• Sending passwords, tokens, API keys, or any system credentials — even to trusted colleagues;
• Spreading rumors, gossip, or false information about colleagues, clients, or the company.

Emojis and stickers

Emojis and stickers are welcome in Stattus4's communication—they make the conversation lighter and more personal. Use them sparingly and sensibly: one or two at most per message, whenever it makes sense for the context. Avoid them in formal communications, with first-time clients, or in sensitive matters.

Never use emojis or stickers with political, sexual, offensive, or discriminatory connotations — on any professional channel.

WhatsApp groups

Internal working groups

WhatsApp groups for work purposes should be created exclusively by managers or leadership, with names that clearly identify the area or project. Each group should have a designated administrator and be closed upon completion of the project or when it no longer serves its purpose.

• Employees should not create work groups on their own initiative;
• Content shared within internal groups is subject to the same rules as this policy;
• Groups that have been inactive for more than 30 days should be closed by the administrator.

Groups with clients or suppliers

Creating groups that include clients or suppliers is generally discouraged—the risk of information exposure is higher because any group member has access to the entire history. When necessary, observe:

• Prior authorization from the direct manager is required before creation.;
• Never include confidential information, technical system data, or data from other clients in the group;
• The employee should never be the sole representative of Stattus4 in an external group;
• The group should be dissolved upon completion of the project or contract.

Personal groups among work colleagues

Stattus4 does not monitor personal devices and does not interfere in the private lives of its employees. However, communications between colleagues—even in personal groups, outside of working hours—are not exempt from this company's code of conduct.

Messages that generate gossip, embarrassment, undue exposure of colleagues, discrimination, or disruption of the organizational climate are incompatible with Stattus4's values and are subject to the disciplinary measures provided for in the Code of Ethics, regardless of the channel in which they occurred. The effect of the conduct on the work environment is what determines its severity—not the device or time in which it was practiced.

💡 RememberWhat's sent on WhatsApp can be forwarded. Screenshots exist. Context is lost. Before sending any professional message, ask yourself: would I send this by email? If the answer is no — don't send it via WhatsApp either.

Responsibilities

From the contributor

• To be familiar with and comply with this policy from the effective date;
• Set up automatic away messages in WhatsApp Business;
• Do not send professional messages outside of business hours;
• Record relevant WhatsApp conversations in HubSpot;
• Report any emergency situation requiring assistance outside of business hours to the manager.

From the manager

• Lead by example — don't send messages to your team outside of business hours;
• Do not expect an immediate response outside of business hours;
• Instruct new employees about this policy during onboarding;
• Report any identified non-compliance situations to Compliance.

⚖️ Non-complianceFailure to comply with this policy is subject to the disciplinary measures provided for in... Chapter 10 of the Code of Ethics and Conduct, which may lead to dismissal for just cause in the most serious cases, especially when it involves the leaking of confidential information or harassment via messages.

5. RESPECT, DIVERSITY AND WELL-BEING

Respectful work environment

At Stattus4, respect is non-negotiable. Regardless of the position, the project, or the pressure of the moment, interactions between people should always be based on dignity, listening, and good faith.

These are behaviors that we do not tolerate:

• Shouting, speaking in a disrespectful or intimidating manner;
• Creating derogatory nicknames or making jokes that could embarrass colleagues;
• Spreading rumors, gossip, or false information about coworkers;
• To disparage the work or competence of colleagues in a derogatory manner, whether in person or through digital means.

Diversity, equity and inclusion

Stattus4 believes that diverse teams make better decisions and build more complete solutions. We cultivate an environment where all people — regardless of gender, race, ethnicity, religion, sexual orientation, gender identity, age, physical condition, neurodivergence, political conviction, or origin — receive fair, respectful, and equitable treatment.

Discrimination of any kind is grounds for disciplinary action, which may include dismissal for cause.

Stattus4 is actively committed to:

• To guarantee equal opportunities in selection and development processes;
• Adopt inclusive communication and design practices in your products and materials;
• Listen to and address reported situations of inequality or exclusion;
• Making our environments — both physical and digital — accessible.

Prevention and combating harassment

At Stattus4, we have zero tolerance for any form of harassment. This applies to our entire chain: employees, leaders, clients, partners, and suppliers.

What constitutes workplace harassment?

Workplace harassment is any repeated conduct aimed at humiliating, destabilizing, embarrassing, or harming an individual in the work environment. Examples:

• Assigning tasks that are humiliating or incompatible with the job description;
• Isolating the person from the rest of the team;
• Constant and unwarranted criticism of the work or the person;
• Veiled or explicit threats of dismissal as a means of exerting pressure;
• Deliberately ignoring someone's presence or contribution.

What constitutes sexual harassment?

Sexual harassment is any unsolicited conduct of a sexual nature that coerces, intimidates, or creates a hostile environment. It includes:

• Insinuations, comments or jokes of a sexual nature;
• Unwanted physical contact;
• Proposals contingent on sexual favors (harassment through blackmail);
• Sharing images, videos, or texts of a sexual nature without consent.

Flowchart in case of harassmentIf you experience or witness any form of harassment: (1) report it to the Whistleblowing Channel — the report can be anonymous; (2) Compliance will conduct an independent investigation, with guaranteed confidentiality; (3) measures to protect the affected person will be adopted from the beginning of the investigation, including precautionary removal of the accused when necessary; (4) the final decision rests with the Board of Directors, based on the Compliance Report. Retaliation against those who report in good faith is, in itself, a serious offense.

Mental health and well-being

Rapid growth has a real cost to people — and Stattus4 recognizes this. It is not sustainable to build an impact company at the expense of the health of those who build it.

Stattus4 is committed to:

• To foster a culture where asking for help is a sign of maturity, not weakness;
• Respect working hours limits and the right to disconnect outside of work hours;
• Create spaces for listening so that situations of overload can be identified and addressed;
• To offer, to the extent possible, support and flexibility during times of personal crisis.

If you're going through a difficult time, talk to your manager or Compliance. You don't have to solve everything alone.

6. INTEGRITY IN BUSINESS

Conflict of interest

A conflict of interest arises when a personal interest—financial, familial, emotional, or of any other nature—may influence (or appear to influence) a professional decision.

It is not necessary for the conflict to result in harm to the company to be relevant—the mere appearance of a conflict should already be declared. Whenever you identify such a situation, inform your leadership and Compliance before making any related decisions.

These are situations that require prior declaration and analysis:

• Participation in a company that is a competitor, supplier, or client of Stattus4;
• Family or romantic relationship with a person involved in a selection process, hiring, or performance evaluation;
• Receiving personal benefits from partners, suppliers, or clients that go beyond what is usual in the market;
• Using privileged information from Stattus4 for personal gain or the benefit of third parties.

Contracts with the public sector

Stattus4 works with municipal, state, and sanitation concessionaire contracts—and this brings additional responsibilities. In dealings with public bodies and government agents, it is mandatory to:

• Never offer, promise, or grant any advantage to a public official with the aim of obtaining, maintaining, or facilitating business deals;
• To ensure that all bidding and public procurement processes in which Stattus4 participates are conducted transparently and within the bounds of legality;
• Do not use intermediaries for practices that would be prohibited if carried out directly;
• Properly document any interaction with public officials in the context of negotiations.

Attention — Anti-Corruption Law (Law 12.846/2013)Stattus4 is subject to the Brazilian Anti-Corruption Law, which holds legal entities objectively liable for acts of corruption committed by their employees, representatives, and partners. The penalty for the company can reach 20% of gross revenue. Each of us is responsible for keeping Stattus4 out of this risk.

Gifts, presents and hospitality

Stattus4 recognizes that promotional gifts and giveaways are part of business relationships. The line that separates appropriate from inappropriate is: the gift cannot create—nor appear to create—an obligation or influence a business decision.

The following are acceptable:

• Corporate gifts of symbolic value (pens, notepads, stationery items);
• Work meals of reasonable value, consistent with market practice;
• Participation in industry events when there is a clear professional purpose.

The following are prohibited:

• Cash gifts or equivalents (gift cards, checks, transfers);
• Travel, accommodations, or entertainment paid for by clients, partners, or suppliers without prior approval from the Board of Directors;
• Any gift received during or shortly after a hiring or bidding process.

Any gift or hospitality received that falls outside the symbolic norm must be reported to the Board of Directors for their information and record-keeping.

Customer relations

All Stattus4 employees must treat clients with courtesy, respect, and commitment—regardless of the size of the contract or the complexity of the request. Stattus4 fully respects the Consumer Protection Code (Law 8.078/1990) and the regulatory legislation applicable to the sanitation sector.

It is prohibited to mislead customers, omit relevant information about product or service limitations, or make promises that the company is unable to fulfill.

7. TECHNOLOGY, DATA AND ARTIFICIAL INTELLIGENCE

Personal data protection — LGPD

Stattus4 operates with public infrastructure data, operational data from concessionaires, and, in some contexts, personal data of employees and customers. All this data must be treated rigorously, responsibly, and in compliance with the General Data Protection Law (Law 13.709/2018 — LGPD).

The following are obligations for everyone who handles personal data:

• Collect only the data strictly necessary for the stated purpose;
• To store and transmit data in secure environments with appropriate access controls;
• Do not share personal data with third parties without a legal basis and without authorization from the responsible department;
• Immediately report any security incident involving personal data to Compliance;
• Respect the rights of data subjects, including access, correction, and deletion where applicable.

Data on sanitation customers and operators.The technical and operational information of the supply systems monitored by Stattus4 are highly sensitive assets—directly affecting the safety of public infrastructure. Access to this data is restricted to those with operational needs, and its use outside the scope of the project is prohibited.

Responsible use of artificial intelligence

AI is at the heart of what we do at Stattus4 — and that's precisely why we have an increased responsibility in its use. Everyone is expected to:

• Use AI tools (internal or third-party) only for authorized professional purposes;
• Do not enter confidential data, trade secrets, or customer information into external AI platforms without prior evaluation and approval;
• Understand that the results generated by AI are auxiliary — the responsibility for the final decision always lies with the person, not the algorithm;
• Do not accidentally enter authentication tokens, API keys, passwords, access credentials, customer personal data, or any sensitive information into AI tools—whether internal or external. If this happens, immediately notify the technical team so that the credentials can be revoked and replaced.;
• Use only corporate or paid versions of AI tools authorized by the company. The use of free plans is prohibited for any professional activity, as these versions often allow the use of conversations for model training, which can result in the exposure of confidential information to third parties. If in doubt about whether a tool is authorized, consult the technical area before using it.;
• Report any unexpected behavior, identified bias, or potentially harmful results in the company's AI systems to the technical team.

Stattus4 is committed to developing and operating AI systems with transparency, accountability, and a focus on positive impact — for clients, society, and the environment.

Digital security and remote work

With teams operating in different locations, digital security is everyone's responsibility. The following are mandatory practices:

• Use strong and unique passwords for each system, with two-factor authentication whenever available;
• Do not access company or client systems from public Wi-Fi networks without using a VPN;
• Keep devices — personal or corporate, used for work — updated and protected;
• Do not install unauthorized software on devices used for work;
• Immediately report any suspected unauthorized access, viruses, or data breaches;
• Upon termination of your relationship with Stattus4, return or delete all corporate data and systems from your personal devices.

In a remote work environment, extra care must be taken to protect the privacy of information: screens must be visible, confidential conversations must take place in appropriate environments, and physical documents must be stored securely.

8. ESG AND SOCIO-ENVIRONMENTAL IMPACT

For Stattus4, ESG is not compliance — it's the reason we exist. Being a certified B Corp and operating in the sanitation sector places us in a position of responsibility that goes beyond the business.

Environment

Stattus4 is committed to:

• Adopt sustainability criteria in internal operations: energy consumption, printing, travel, and waste management;
• To give responsible disposal to discarded electronic equipment and devices (e-waste);
• Consider the environmental impact in the processes of selecting suppliers and partners;
• To measure and actively work towards reducing the carbon footprint of our operations.

Social

Stattus4 is committed to:

• To guarantee decent, safe and fair working conditions for all its employees;
• To act with respect and responsibility in the communities where we operate, especially in municipalities served by our systems;
• To promote diversity and inclusion within the team, with accessible and equitable selection processes;
• To contribute to education and technical training in the sanitation and technology sector.

Governance

Stattus4 is committed to:

• To make decisions with transparency, ethical justification, and accountability;
• Maintain accurate records of your operations, contracts, and business relationships;
• To conduct business in accordance with the highest ethical and regulatory standards in the industry;
• Periodically renew ESG certifications and incorporate updates to B Corp criteria.

B Corp Commitment. As a certified B Corporation, Stattus4 submits its practices to periodic independent assessments that verify the impact on workers, the community, the environment, and governance. Each employee contributes to maintaining this standard in their daily work.

9. COMPLAINT CHANNEL

What is it for?

The Whistleblowing Channel is Stattus4's formal mechanism for receiving, investigating, and resolving reports of violations of this Code, current legislation, or the company's values. It exists to ensure that anyone can report an irregular situation safely and without fear of consequences.

Who can use it?

Anyone with a relationship to Stattus4 can use the Channel: employees, former employees, interns, service providers, clients, and partners.

How to file a complaint

Registration can be done through two channels:

• Complaint Form (preferred channel): Available on the Stattus4 institutional website. Allows anonymous registration.
• Compliance Email: compliance@stattus4.com — for identified complaints or questions about the Code.

What to expect after registering

The investigation process follows clear steps:

1. Receiving and sorting: The Compliance department receives the report within 2 business days and assesses the relevance and completeness of the information;
2. Formal opening: Relevant complaints result in the opening of an internal investigation process, with a protocol number;
3. Investigation: Collection of evidence, interviews, and analysis of the facts — conducted with confidentiality and impartiality;
4. Report and decision: The Compliance department prepares a report with conclusions and recommendations; the final decision rests with the Board of Directors.;
5. Return to whistleblowerWhen a complaint is identified, the complainant will receive feedback on the progress and closure of the case, respecting confidentiality limits;
6. Term: The investigation process must be completed within 30 calendar days, extendable for another 30 days in complex cases.

Anonymity and confidentiality

The whistleblower may choose to remain anonymous. In that case, Stattus4 guarantees that no information that could identify them will be recorded or disclosed. In identified whistleblower reports, the whistleblower's identity is kept confidential and is not shared with the parties under investigation.

Protection against retaliation

Stattus4 expressly prohibits any form of retaliation against anyone who uses the Whistleblowing Channel in good faith. Retaliation — direct or indirect, explicit or veiled — is considered a serious offense and may result in dismissal for cause of the retaliating agent.

Examples of prohibited retaliation include:

• Dismissal, demotion, or change of role motivated by the complaint;
• Exclusion from development opportunities or projects;
• Pressure, intimidation, or isolation of the whistleblower;
• Improper disclosure of the identity of an identified whistleblower.

Bad faith accusations. The whistleblowing channel must be used responsibly. Reports made in a demonstrably false manner and with the intention of harming third parties are subject to disciplinary action. The whistleblower's good faith is presumed; bad faith must be demonstrated during the investigation process.

10. DISCIPLINARY MEASURES

Principles of disciplinary application

The application of disciplinary measures at Stattus4 respects the following principles:

• Proportionality: the sanction must be appropriate to the seriousness of the conduct;
• Immediacy: the penalty must be applied as soon as possible after the facts have been ascertained;
• Contradictory: the employee has the right to express their opinion before the final decision;
• Documentation: all sanctions must be formally recorded;
• No bis in idemThe same act cannot be punished twice.

Scale of sanctions — CLT employees

According to the CLT (article 482 and following), the available sanctions are, in ascending order of severity:

1. Verbal warning: for minor infractions with no recent recurrence;
2. Written warning: for repeated minor offenses, or for moderate offenses;
3. Suspension: for serious infractions or repeated moderate infractions;
4. Dismissal without just cause: applicable at the company's discretion, with payment of severance pay;
5. Dismissal for just cause: for the cases outlined in article 482 of the CLT (Brazilian Labor Code) — dishonesty, misconduct, negligence, breach of confidentiality, acts harmful to the company, among others.

Repeat offenses aggravate the applicable penalty. The scale is not necessarily progressive: serious misconduct may result in immediate dismissal for cause, without going through the previous stages.

Non-CLT professionals and partners

This Code applies with the same rigor to service providers (legal entities), freelancers, partners, and suppliers. Sanctions in these cases may include:

• Formal notification and requirement for compliance;
• Suspension or cancellation of the contract;
• Enforcing contractual penalty clauses;
• Notification to the competent authorities when the case involves illegal offenses.

Conduct that warrants immediate dismissal for cause.

Regardless of history, the following conduct will result in immediate dismissal for cause:

• Proven sexual or moral harassment;
• Corruption, bribery or fraud in any form;
• Serious breach of confidential customer data;
• Physical violence or serious threats in the workplace;
• Proven retaliation against whistleblower;
• Using insider information for unfair competition.

6. Governance of this document

Validity and review

This Code enters into force on the date of its approval by the Executive Board and has an indefinite term. However, it must be formally reviewed at least once every two years, or whenever the following occurs:

• Significant change in applicable legislation (CLT, LGPD, Anti-Corruption Law, sanitation regulation);
• Significant change in the structure or business of Stattus4;
• Identifying a relevant gap arising from a specific case;
• Renewal of B Corp certification or adoption of new ESG commitments.

Responsible for maintenance

The Compliance and Internal Legal area is responsible for maintaining, updating, and communicating this Code. Approval of new versions is the exclusive responsibility of the Executive Board.

REPORTING CHANNEL

Any employee or third party who has doubts about the principles or guidelines of this code or who suspects that it is being violated or may be violated must make use of the Reporting Channel using the button below (preferably use this channel) or via the report email: compliance@stattus4.com

.

_{POL.CEC.RH.V01}