PRIVACY POLICY We collect, store, and use some personal data belonging to those who use our website. In doing so, we act as the controller of this data, and we do so in accordance with the provisions of the General Data Protection Law (Federal Law No. 13.709/2018). The data collected is essential for us to provide you with Mabu's excellent services and guarantee the best hosting experience! This Privacy Policy contains information about the collection, use, storage, processing, and protection of the personal data of users and visitors of the application or website, and clarifies the types of data that are collected, the reasons for the collection, and how users can manage or delete their personal information. We care about protecting your personal data. Therefore, we provide this privacy policy, which contains important information about the data collected, the purpose of this collection, and your rights as the data subject of the data we collect. 1. DATA WE COLLECT AND WHY WE COLLECT IT Our website or application collects and uses some personal data from our users, in accordance with the provisions of this section. 1.1. Personal data expressly provided by the user: We collect the following personal data that our users expressly provide to us when using our website or application:

• Full name, personal document numbers, date of birth, marital status, profession, phone numbers, email, addresses, photograph, bank details, credit card brand, number, expiration date and security code;
• Data from third parties registered as accompanying the account holder during lodging, such as: full name, personal document numbers, profession, date of birth, marital status, telephone numbers, email, addresses, photograph, and relationship to the account holder.
• This data is collected during:
• Access to customer service platforms;
• Registering an account on the website or app;
• browsing and using the website or app.

The data provided by our users is collected for the following purposes:

• User registration;
• purchase of products and services available on the website or app;
• scheduling of weeks of use;
• Completion of the National Guest Registration Form (FNRH).

1.2. Personal data obtained from other sources In addition to data provided by the user, we collect the following personal data:

• IP address, geolocation, browsing history.

This data is collected at the following times:

• when the user logs in or logs out of our websites or applications;
• when the user browses our website or uses the application;
• when the user makes a reservation or purchases a product or service.

This data is collected for the following purposes:

• to guarantee the authenticity and security of transactions;
• to protect users' personal data.

There will also be the collection of images, video, and audio through security cameras located in public areas, such as corridors and entrances, in our establishment, or cameras carried by employees whose role is to prevent incidents. 1.3. Sensitive Data We will not collect sensitive data from our users. Sensitive data is considered to be that indicated in Article 5, II of the Personal Data Protection Law. 1.4. Data from Children and Adolescents We collect the following data from children and adolescents:

• Full name, age, ID number, CPF (Brazilian tax identification number), parentage, address, and phone number.

Data collection from children and adolescents takes place at the following times:

• when the user fills in their family's information;
• when the user provides the details of their companions when making the reservation.

The data we collect from children and adolescents is used for the following purposes:

• verify the child's or adolescent's kinship with the user or third parties registered as accompanying persons in the reservation;
• Filling out the FNRH form;
• To enable the enjoyment of lodging services, in accordance with applicable legislation.

The processing of personal data of children and adolescents will be carried out in their best interest. 1.5. Cookies Cookies are small text files that are automatically downloaded to your device when you access and browse a website. These files contain information used to identify the visitor, either to personalize the page according to their profile or to facilitate the transfer of data between pages of the same website. We use cookies to ensure a better experience while you browse our website or use our application. These files do not allow any file or information to be extracted from the user's hard drive. They also do not allow access to the user's personal information, beyond that which has been provided by the user themselves, or collected in accordance with item 1.2 above. The user may object to the registration of cookies by the website, and should disable this option in their own browser. However, some tools or functionalities of the website or application may be compromised if cookies are removed. 2. SHARING OF PERSONAL DATA WITH THIRD PARTIES The Mabu Hotel Company values the confidentiality and preservation of your personal data and for this reason we work with partners who are duly compliant with the General Data Protection Law. In this sense, we share some of your data with companies that work with the same seriousness in protecting the personal data of our clients, such as:

• Partner stores located in Blue Parque where you can purchase food and drinks;
• payment by card;
• situations in which it is necessary to provide data without the consent of the data subject, as provided for in Article 11, II, of Law No. 13.709/2018.

It is also possible that we may share data with third parties for:

• to comply with some legal or regulatory requirement;
• to comply with an order issued by a public authority.

In any case, the sharing of personal data will comply with all applicable laws and regulations, always seeking to guarantee the security of the data.

our users, observing the technical standards employed in the market.

We also inform you that the following data will be shared with the companies listed below:

• data provided during user registration;
• reservation records;
• lodging history.

The data will be shared with the following legal entities and for the following purposes: a) Blue Park Aquático S/A (CNPJ nº 26.038.751/0001-90):

• Log of accesses and consumption history at Blue Park;
• Sending information and billing related to Blue Park.

b) Strategic partners, such as accommodation booking websites, including but not limited to:

• Booking
• Trivago
• TripAdvisor
• Hoteis.com
• other means through which we provide our hosting services.

3. HOW LONG WILL YOUR PERSONAL DATA BE STORED? The personal data collected by the website is stored and used for the period necessary to achieve the purposes listed in this document.

document and consider:

• the rights of their holders;
• the rights of the website controller;
• the applicable legal or regulatory provisions.

Once the storage periods for personal data have expired, they are removed from our databases or anonymized, except in cases where storage is possible or necessary due to legal or regulatory provisions. 4. LEGAL BASES FOR THE PROCESSING OF PERSONAL DATA The personal data collected will always be processed based on a legal basis, a hypothesis provided for by law that authorizes the processing. The personal data collected will be processed based on the following legal bases:

• with the consent of the holder of personal data;
• for the fulfillment of a legal or regulatory obligation by the controller;
• for the regular exercise of rights in judicial, administrative or arbitration proceedings;
• for the execution of a contract or preliminary procedures related to a contract to which the holder is a party, always at the holder's request;
• when necessary to meet the legitimate interests of the controller or a third party;
• for credit protection.

The processing of data from children and adolescents will always be done with the consent of at least one of their parents or guardians, and will occur in the cases described above. 5. CONSENT Certain personal data processing operations carried out on our website or application will depend on the prior agreement of the user, who must express it freely, informedly and unequivocally. The user may revoke their consent at any time. The user may also disagree with any personal data processing operation based on consent. In these cases, however, it is possible that they may not be able to use some website functionality that depends on that operation. 6. USER RIGHTS The website user has the following rights:

• confirmation of the existence of treatment;
• access to the collected data;
• Correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed data;
• Data portability to another service or product provider, upon express request;
• deletion of personal data processed with the consent of the data subject, except in cases provided for by law;
• Information from public and private entities with which the controller has shared data;
• Information about the possibility of not providing consent and about the consequences of refusal;
• revocation of consent.

To exercise your rights, you may contact us through the channels indicated in Chapter 8 below. To ensure that the user intending to exercise their rights is, in fact, the holder of the personal data subject to the request, we may request documents or other information that may assist in their correct identification. 7. CHANGES TO THIS PRIVACY POLICY This version of this Privacy Policy was last updated on January 5, 2022. We reserve the right to modify these rules at any time, especially to:

• Adapt them to any changes made to our website;
• Making new features available;
• suppression or modification of existing functionalities;
• Adaptation to new legal requirements.

The changes and clarifications will take effect immediately upon their publication on the platform. Users will be notified when changes are made. By using the service or providing personal information after any modifications, the user and visitor demonstrate their agreement with the new rules. 8. HOW TO CONTACT US To clarify any doubts about this Privacy Policy or about the personal data we process, please contact our Data Protection Officer through one of the channels mentioned below: Email: lgpd@valimdias.com.br