Code of Conduct for Customers, Suppliers, and Business Partners

Public Information
This document is the property of Pipefy and contains information that is proprietary, confidential, or restricted from disclosure.
If you are not authorized to receive it, please return this document to the above-mentioned owner. Disclosure, distribution
reproduction, or full or partial use of this document by any third party other than the intended recipient without prior written
consent from Pipefy is strictly prohibited.
Confidentiality Notice: This document is confidential and contains proprietary information and intellectual property of Pipefy, Inc.

SUMMARY

1. OBJETIVO 3
2. ABRANGÊNCIA 3
3. PAPÉIS E RESPONSABILIDADES 3
4. DIRETRIZES 3
   4.1. NORMAS GERAIS DE TRABALHO E DIREITOS HUMANOS 3
   4.2. DIVERSIDADE, INCLUSÃO E PERTENCIMENTO 3
   4.2.1. ELIMINAÇÃO DA DISCRIMINAÇÃO 4
   4.3. INFORMAÇÕES 4
   4.3.1. CONFIDENCIALIDADE DE INFORMAÇÕES PRIVILEGIADAS 4
   4.3.2. PRIVACIDADE DE DADOS 5
   4.4. SEGURANÇA DAS INFORMAÇÕES 6
   4.4.1. SEGURANÇA FÍSICA 7
   4.4.2. CONFERÊNCIAS VIRTUAIS CORPORATIVAS 7
   4.4.3. SISTEMAS DE INFORMAÇÃO, E-MAILS E INTERNET 7
   4.5. MEIO-AMBIENTE E SUSTENTABILIDADE 7
   4.5.1. GERAL 7
   4.6. PRÁTICAS JUSTAS DE NEGÓCIO 7
   4.6.1. CONFLITOS DE INTERESSE 7
   4.6.2. BRINDES, PRESENTES E HOSPITALIDADES 8
   4.6.3. RELAÇÃO COM CLIENTES 8
   4.6.4. RELAÇÃO COM PARCEIROS E FORNECEDORES DE BENS OU PRESTADORES DE SERVIÇO 8
   4.6.5. RELAÇÃO COM AUTORIDADES E ÓRGÃOS GOVERNAMENTAIS 9
   4.6.6. ATIVIDADES POLÍTICO-PARTIDÁRIAS 9
   4.7. DESVIOS ÉTICOS 9
   4.7.1. CANAL DE DENÚNCIAS 9
5. DISPOSIÇÕES FINAIS 10
6. HISTÓRICO DE REVISÕES 10
7. ENGLISH VERSION OF THE POLICY 11
   Confidentiality Notice: This document is confidential and contains proprietary information and intellectual property of Pipefy, Inc.
   2
8. OBJECTIVE
   Establishing guidelines regarding relationships with suppliers, service providers, business partners, and
   customers.
9. APPLICABILITY
   Applies to all service providers, suppliers, customers, and business partners (‘External parties’).
10. ROLES AND RESPONSIBILITIES
    It is the responsibility of the Procure to Pay and Legal & Compliance departments to clarify any doubts
    related to this Policy, establish the necessary procedures for its implementation, verify compliance and any
    violations of this Policy, disseminate the guidelines of this document, guide continuous improvement
    procedures, and provide support to other areas involved in processes related to this Policy.
11. GUIDELINES
    4.1. GENERAL LABOR STANDARDS AND HUMAN RIGHTS
    Pipefy respects the Universal Declaration of Human Rights, the American Convention on Human Rights,
    and the Declaration of the International Labour Organization. Child labor and any form of work analogous to
    slavery are strictly prohibited. We will not engage in any commercial agreements with companies that use,
    exploit, or employ child labor or individuals under the age of 18 without compliance with legal requirements.
    4.2. DIVERSITY, INCLUSION, AND BELONGING
    Pipefy is a global company that celebrates and values diversity in cultures, ethnicities, race and color,
    religion, backgrounds, and nationalities, age, gender identity, sexual orientation, disabilities, and all forms of
    unique identity and expression of multiple identities. Additionally, Pipefy encourages External parties to promote
    diversity and heterogeneity among individuals in society, regarding race, religion, disability, sexual orientation,
    gender, among others.
    Confidentiality Notice: This document is confidential and contains proprietary information and intellectual property of Pipefy, Inc.
    3
    4.2.1. ELIMINATION OF DISCRIMINATION
    Any form of harassment (moral or sexual) is not tolerated under any circumstances at Pipefy. Moral
    harassment involves exposing individuals to humiliating and embarrassing situations in the workplace and in
    their interactions with External parties, repeatedly and over a prolonged period, in the course of their activities.
    This form of violence can occur through direct actions (accusations, insults, yelling, public humiliation) and
    indirect actions (spreading rumors, isolation, refusal to communicate, gossip, and social exclusion).
    Sexual harassment occurs when someone feels pressured by another seeking sexual advantage or
    favoritism. It involves inappropriate sexual advances, indecent comments, or obscene remarks. This includes
    special treatment in exchange for sexual favors.
    Such behaviors, once investigated, may even lead to civil and criminal liability if they fall within the
    definitions of crimes against honor, racism, among others. External parties who experience or witness any
    behavior that constitutes moral or sexual harassment are encouraged to report it through the reporting channel.
    4.3. INFORMATIONS
    4.3.1. CONFIDENTIALITY OF PRIVILEGED INFORMATION
    Privileged Information must be kept under the responsibility and confidentiality of the External party, as
    they constitute a valuable, special, and exclusive asset used by Pipefy in its business to gain a competitive
    advantage over our competitors. Privileged Information includes any technical, financial, and/or commercial
    information, as well as third-party information, such as creations, revenues, formulas, patented or unpatented
    products and processes, raw materials, samples, marketing plans, methods, production costs, financial and
    statistical data, Pipefy-related businesses or transactions, information about customers, employees, contractors,
    and the industry generally not known to the public; strategies, records, documents, equipment, plans, and
    strategies for expansion or acquisitions, budgets, research, methodologies, evaluations, opinions, and
    interpretations of information and data, names and brands of potential customers, grids and maps, electronic
    databases, models, specifications, internal business records, contracts benefiting or obligating Pipefy,
    technologies and methods, training methods and processes, organizational structure, and all other information
    related to Pipefy’s production chain, whether confidential or patented.
    Only when expressly authorized by Pipefy can the External party access any Privileged Information
    through the explicit signing of a confidentiality agreement, NDA (Non-Disclosure Agreement), between the
    parties involved, with the signature of a Pipefy representative.
    Confidentiality Notice: This document is confidential and contains proprietary information and intellectual property of Pipefy, Inc.
    4
    4.3.2.DATA PRIVACY
    Partners/suppliers who engage in any form of processing of personal data from Pipefy or its
    customers, acting as joint controllers or data processors, must agree to the following requirements:
    ● Ensure assistance with Pipefy’s obligations to comply with privacy laws, supporting inquiries made by
    Pipefy, or allowing for a previously scheduled audit regarding the treatment performed, whenever
    necessary.
    ● Ensure that personal data processed on behalf of Pipefy is only treated for the purpose expressly
    stated in documented instructions or contracts.
    ● Ensure that personal data processed under a specific contract will not be used for marketing or
    advertising purposes.
    ● Inform Pipefy if, in your opinion, a treatment instruction violates applicable regulations and/or
    legislation.
    ● Determine and maintain the necessary records to support the demonstration of compliance with your
    obligations for data processing performed on behalf of Pipefy, such as records of technical and
    organizational information security measures and records of international transfers.
    ● Provide Pipefy with the means to comply with its obligations regarding data subjects.
    ● Ensure that temporary files created as a result of data processing are disposed of according to
    documented procedures, within a specified and documented period.
    ● Have the ability to securely return, transfer, and/or dispose of personal data. It is also advisable that
    your policy be available to Pipefy.
    ● Ensure that personal data transmitted over a data transmission network have appropriate controls to
    ensure that the data reaches its intended destinations.
    ● Inform Pipefy in a timely manner about the bases for transferring personal data between jurisdictions
    and of any intended changes in this matter, so that Pipefy has the ability to contest these changes or
    terminate the contract.
    ● Specify the countries and international organizations to which personal data may possibly be
    transferred.
    ● Record the disclosure of personal data to third parties, including which personal data was disclosed, to
    whom, and when.
    ● Notify Pipefy of any legally required requests for the disclosure of personal data.
    ● Reject any requests for the disclosure of personal data that are not legally required, and inform Pipefy
    before making any disclosures of personal data.
    ● Inform Pipefy of any use of subcontractors to process personal data, before use.
    Confidentiality Notice: This document is confidential and contains proprietary information and intellectual property of Pipefy, Inc.
    5
    ● Contract a subcontractor to process personal data only based on Pipefy’s contract.
    ● Inform Pipefy of any intended changes regarding the addition or replacement of subcontractors to
    process personal data, thus giving Pipefy the opportunity to oppose these changes.
    4.4. INFORMATION SECURITY
    The supplier must comply with all the requirements below regarding Pipefy’s information security and
    ensure compliance by its employees and/or subcontractors.
    ● All information from Pipefy, including personal data, must be treated as confidential information.
    ● Understand and comply with all internal security standards of Pipefy, both existing and newly created
    ones, and previously communicated to the SUPPLIER.
    ● Understand and comply with all applicable regulations and legislation related to the activities provided
    or materials supplied under the contract between the parties, especially legislation related to
    intellectual property rights and copyrights.
    ● Implement necessary controls to ensure the security of Pipefy’s information, including access control,
    performance review, monitoring, reporting, and audits, and the supplier’s obligations to comply with the
    organization’s information security requirements.
    ● Implement necessary controls to ensure business continuity, aiming to maintain the provision of
    services to Pipefy.
    ● Maintain requirements and incident management procedures (especially notification and collaboration
    during incident remediation) related to the provision of services to Pipefy.
    4.4.1. PHYSICAL SECURITY
    Pipefy is committed to ensuring that, even when faced with critical or particularly challenging
    scenarios, the usual course of business can continue safely. To achieve this, Pipefy prioritizes the development
    of risk contingency plans and crisis response routes. It is the responsibility of all – partners, suppliers, and
    clients of Pipefy – to access, read, and strictly follow all provided health, safety, and security guidelines.
    4.4.2.VIRTUAL CORPORATE CONFERENCES
    It is strictly prohibited to record, disclose, or share sounds or images of any of the participants in these
    virtual conferences without the express authorization of Pipefy.
    Confidentiality Notice: This document is confidential and contains proprietary information and intellectual property of Pipefy, Inc.
    6
    4.4.3.INFORMATION SYSTEMS, EMAILS, AND INTERNET
    It is strictly prohibited to use the Pipefy system for sending email marketing, spam, phishing, or any
    type of social engineering, among other practices. Reported incidents will be investigated, and measures may
    be taken in accordance with Pipefy’s Terms of Use and Conditions
    (https://www.pipefy.com/pt-br/termos-e-condicoes/).
    Questions and requests related to this policy can be clarified via email at [email protected].
    4.5. ENVIRONMENT AND SUSTAINABILITY
    4.5.1. GENERAL
    Pipefy encourages External parties to make rational and sustainable use of renewable and
    non-renewable natural resources (such as water, electricity, etc.), avoiding waste. Additionally, Pipefy expects
    organizations to identify and manage environmental impacts so that together, we can build and reinforce the
    trust of our communities.
    4.6. FAIR BUSINESS PRACTICES
    4.6.1. CONFLICTS OF INTEREST
    Pipefy expects External parties to use common sense and adhere to the highest ethical standards in
    their professional activities. In this regard, they should not make decisions, influence, or allow themselves to be
    influenced in negotiations with the aim of benefiting themselves, a family member, a financial dependent, or a
    person with whom they have an emotional relationship.
    4.6.2.GIFTS, PRESENTS, AND HOSPITALITY
    Pipefy encourages the building of good relationships with various external stakeholders, understanding
    that throughout functional activities, we may receive or offer courtesies with the aim of fostering relationships.
    However, Pipefy does not permit the offering or acceptance of any type of gifts, presents, and hospitality that
    may unethically or inappropriately influence business or strategic decisions, and/or result in advantages or
    conflicts of interest for any of the parties involved.
    Gifts (such as pens, diaries, backpacks, caps, etc., bearing the company logo), presents (items with
    commercial value not considered as gifts), and hospitality (expenses for meals, travel, accommodations) that
    Confidentiality Notice: This document is confidential and contains proprietary information and intellectual property of Pipefy, Inc.
    7
    may be offered should adhere to a maximum ceiling value of US $50 (fifty dollars). Any offers or items received
    above this value will be declined and returned.
    Furthermore, the offering, solicitation, delivery, and receipt of monetary values are strictly prohibited.
    4.6.3. CUSTOMER RELATIONS
    Customers are an important link for Pipefy, which is why we always strive for satisfaction by offering
    quality and reliable services, adhering to established agreements, and maintaining transparent and ongoing
    dialogue. Privileged information obtained as a result of business transactions will be kept strictly confidential, as
    outlined in Section 4 of this Manual.
    We reinforce all points already stated, aiming to avoid any conduct that may be considered illegal under
    applicable laws and regulations against bribery and corruption, including Brazilian Law No. 12,846/2013, the
    U.S. Foreign Corrupt Practices Act (FCPA), and other relevant legislations.
    4.6.4.RELATIONSHIP WITH PARTNERS AND SUPPLIERS OF GOODS OR
    SERVICE PROVIDERS
    The selection of partners and suppliers will be based on technical, commercial, strategic, quality, HSE
    (Health, Safety, and Environment), sustainability, and integrity criteria, ensuring fair conditions for all proposers.
    We expect our partners and suppliers to comply with the laws and regulations applicable to business
    conducted with Pipefy, and also to adopt the principles of this code or equivalent principles.
    4.6.5. RELATIONSHIP WITH AUTHORITIES AND GOVERNMENT
    AGENCIES
    Customers and other partners commit, ethically and in compliance with applicable legal principles, not
    to offer, pay, promise, or authorize the payment, directly or indirectly, of any sum of money or any other thing of
    value to government authorities, consultants, representatives, partners, or any third party, with the aim of
    influencing any governmental act or decision, or to obtain any undue advantage.
    4.6.6. POLITICAL-PARTISAN ACTIVITIES
    Pipefy opts for neutrality regarding political-party ideology. Our partners should not provide any
    support to political parties with the aim of influencing business with Pipefy.
    Confidentiality Notice: This document is confidential and contains proprietary information and intellectual property of Pipefy, Inc.
    8
    4.7. ETHICAL DEVIATIONS
    4.7.1. REPORTING CHANNEL
    The Reporting Channel is an external system provided by an independent and impartial company,
    where Pipefy employees and partners can report any irregularities related to compliance: whether deviations
    from the Code of Conduct, commission of illegal acts (such as, but not limited to, fraud, harassment, breach of
    confidentiality, among others), or non-compliance with internal and external rules, so that the company can
    conduct an evaluation, investigation, and take necessary measures.
    The Reporting Channel should not be used for questions, suggestions, or criticisms related to Pipefy’s
    products and/or services. In such cases, you should contact Pipefy’s customer service.
    It is worth noting that reports can be made anonymously by the whistleblower. However, the right to
    anonymity should not be a reason for presenting false accusations. Such behavior constitutes misuse of this
    channel and detracts attention from issues that are truly important, such as bullying, sexual harassment, all
    forms of violence, disrespectful behavior, among others.
    The investigation of the facts presented will be conducted in a confidential and ethical manner by an
    Ethics Committee. If the reported deviations are proven, appropriate measures will be taken, considering the
    type of violation and its severity.
    Pipefy prohibits and will not tolerate any retaliation or threat of retaliation against anyone who reports a
    possible violation through the Ethics Channel.
    The Reporting Channel can be accessed through the link: https://ethicschannel.pipefy.com/.
12. FINAL PROVISIONS
    This policy will come into effect from the date of its publication.
13. HISTÓRICO DE REVISÕES