Raymond James Privacy Notice – Brazil Residents

This Brazil Residents Privacy Notice (the “Notice”) is provided to meet transparency requirements under Brazil’s Lei Geral de Proteção de Dados Pessoais (Law No. 13.709/2018) (“LGPD”).

Our Commitment to Privacy

At Raymond James Ltd. (“Raymond James”), we recognize how important personal privacy is to you. This Privacy Notice confirms our commitment that we will collect, use and share your personal data responsibly and safely and only for the purposes and in the manner set out in this Notice. Raymond James is committed to protecting your personal data and maintaining high standards of confidentiality through the implementation of appropriate administrative, technical, and operational safeguards and security measures. We strive to be open and transparent with you as to our personal data practices. The purpose of this Notice is to help you understand what personal data we collect, how we use, share and protect it, and how long we retain it. We will also explain how you can find out what personal data we hold about you and how you can manage your information in a way that best suits you, including your rights of access, correction and deletion. We encourage you to read this Privacy Notice so that you have a good understanding of our personal data practices. By providing your personal data to us, you are consenting to the collection, use and sharing of your personal data as set out in this Privacy Notice and as otherwise permitted or required by law. We may update this Privacy Notice from time to time without prior notice, and we will post the revised Notice on our website. Notice changes will apply to the information collected from the date of posting to the website, as well as to existing information in our records.

Accountability

To ensure we meet our commitment to you, Raymond James has a Chief Privacy Officer who is responsible for overseeing our privacy practices and our efforts to comply with applicable privacy law and manage and mitigate privacy risk. Accountability for privacy protection extends across all of Raymond James as each of our employees is responsible for respecting and protecting the personal data to which the employee has access. We have a comprehensive Privacy Framework for the secure and respectful treatment of personal data under the custody and control of Raymond James. Our Privacy Framework includes policies and procedures setting out our privacy obligations and how we deal with your personal data in compliance with applicable laws, as well as programs for monitoring privacy regulatory changes, communication, awareness and training, monitoring and testing, and reporting to senior management, the Board and regulators. You can contact our Privacy Office using the contact information at the end of this Notice.

What Personal Data Do We Collect?

Raymond James collects your personal data in order to provide products and services to you.

“Personal Data” means information relating to an identified or identifiable natural person. Personal Data does not include anonymized data.

“Sensitive personal data” means personal data concerning racial or ethnic origin, religious belief, political opinion, affiliation to trade unions or to a religious, philosophical or political organization, data regarding health or sex life, and genetic or biometric data, when related to a natural person.

The personal data we collect can be sorted into four broad categories:

Identification and Contact Information

• The personal data in this category is used to communicate with you, identify and authenticate you, open and administer accounts, and provide requested services.
• Examples include your name, address, email, telephone numbers, date of birth, gender, marital status, and government-issued identification numbers.

Financial and Transactional Information

• The personal data in this category is used to assess suitability and eligibility for products and services, execute transactions, and provide reporting and client service.
• Examples include your investment knowledge and objectives, risk tolerance, income, financial assets, employment and salary, account balances, and transaction history.

Information to Manage our Risks and Interests

• The personal data in this category is used to meet anti-money laundering, tax reporting and other regulatory obligations, and to detect and prevent fraud and other wrongdoing.
• Examples include your citizenship, place of birth, tax residency and tax identification numbers, and transaction due diligence information.

Information About Our Interactions with You

• The personal data in this category is used to retain records, provide support, perform quality assurance and training, and improve our services and digital experiences.
• Examples include records of calls and meetings, correspondence, website and portal usage information, preferences, and service feedback.

Depending on the context, we may also process additional types of personal data such as geolocation information, audio or visual information, and profiling/inferences, where permitted by law and consistent with the purposes described in this Notice.

How Do We Collect Personal Data About You?

We collect most of our personal data directly from you, primarily through our product and service opening forms which you complete with your Advisor.

Depending on the product or service you have requested, we may also collect personal data about you from third parties such as lenders or credit reporting agencies to give us information on your credit history. We may also contact employers or other personal references to verify information provided by you.

The personal data that we collect is gathered in a number of ways throughout your relationship and dealing with us as a client. We offer various methods of communication with us, including by mail, email, phone, and through our website.

We may monitor and/or record your telephone discussions with our representatives for our mutual protection, to enhance customer service, and confirm our discussions with you.

We may also collect information about you, and track your behavior, when you are visiting our website through the internet or your mobile device. For more information, refer to our Internet Privacy Policy at: Internet Privacy Policy.

Personal data collected through each of these methods will be protected through the administrative, technical, and operational safeguards and security we have implemented as described in this Notice. Please see How Do We Protect Your Personal Data below for further information.

How Do We Use Personal Data?

Raymond James processes your personal data for the purposes described in this Notice, and for any other purpose the law may permit or require. Our goal is to be transparent, and this Notice explains how we process and protect your personal data.

We included a summary of the key purposes for our processing of your personal data in our Privacy Consent, and for ease of reference, we summarize them again as follows:

(a) Providing and managing products and services you have requested

We process your personal data within RJL to establish and maintain our relationship with you and to provide you with the products and services you have requested. This includes typical account management activities such as verifying your identity, recording account information, executing transactions, and providing reporting and communications to you. If you request certain credit products (such as a margin account), this may also include sharing personal data with lenders or credit reporting agencies to obtain credit checks and assess your creditworthiness, as permitted by law.

(b) Sharing with agents and third-party service providers for support services

RJL may share your personal data with our agents and third-party service providers that perform services on our behalf in order to support our operations and provide products and services to you. This includes activities such as processing or delivering transaction confirmations, account statements, or other reporting documents, and providing customer service or other related support services for one or more of our products or services. Some of these service providers may be located (or may have servers) outside of Brazil and Canada, including in the United States. In such situations, your personal data may be transferred to, stored in, or accessed from other jurisdictions and may be subject to the laws of those jurisdictions, including lawful access by courts, government authorities, regulators, or law enforcement, in accordance with applicable law.

(c) Meeting our contractual, legal and regulatory obligations

We process your personal data to meet our contractual, legal, and regulatory obligations, and as may be permitted or required by law. This includes meeting obligations under applicable anti-money laundering and counter-terrorist financing requirements and protecting against fraud, crime, and other risks. It may also include sharing your personal data with regulators, self-regulatory organizations, tax authorities, auditors, and other professional service providers, where necessary and permitted or required by law.

To fully understand the ways that we process personal data, you should read this Notice in its entirety.

When Do We Share Personal Data?

RJL does not sell, trade, or rent clients’ personal data to third parties for their own use. We will not provide personal data to any third parties for their own marketing or other purposes unless we have your express permission to do so. We never sell client data for marketing purposes.

However, there are times when sharing your personal data with third parties is necessary.

We may share information with:

• Our suppliers and partners with whom we work to serve you
• Other third parties to help complete a transaction initiated by you
• Regulators, government and law enforcement agencies
• Other business areas within our organization or
• If the disclosure is otherwise lawfully permitted or required

a. Service Providers and Partner

To provide products and services to you, we may require the assistance of third-party service providers and partners and need to share your personal data with them from time to time for purposes consistent with this Notice and applicable lawful bases under the LGPD. This would include, for example, third-party service providers that we hire to undertake activities such as:

• data processing or preparation (e.g., account statements)
• providing other services related to processing, authorizing and authenticating your transactions
• conducting analytics or
• providing customer service or other support or services for one or more of our products or services

We may also disclose your personal data to other legal entities within the Raymond James group of companies, including affiliates in the United States, where they are effectively operating as service providers to assist us in providing operational, administrative and support services and performing analytics on our behalf.

Only the personal data that is required for the relevant purpose will be disclosed. We require appropriate contractual and other safeguards from service providers and third parties to protect personal data, consistent with the sensitivity of the information and the services being provided.

b. Other third parties to help complete a transaction initiated by you

We may share your personal data with lenders or credit reporting agencies to conduct a credit check for account opening or margin purposes, where permitted by law and consistent with this Notice.

We may also be required to permit access to or share your personal data with another investment dealer if your account is transferred to another investment dealer for any reason.

c. Regulators, Government and Law Enforcement Agencies

We may share your personal data to comply with legal, compliance, and regulatory obligations. This includes responding to subpoenas, warrants, judicial or administrative orders, or valid demands or requests from governments, regulators, courts and law enforcement authorities in Canada or other jurisdictions or countries, as required or permitted by law, and where necessary to detect and prevent fraud, identity theft, money laundering and other illegal acts. For example, this may include requests from regulators to which we are subject or from professional advisors (e.g., auditors) for audit or investigation purposes relating to specific accounts or our business generally. In such cases, we will release only the personal data that is required and only after confirming that the appropriate legal authority to require such information is in place.

d. Other business areas within our organization

In addition to the services you have requested from RJL, you may wish to request other products or services from other members of the Raymond James Canada group of companies. These companies offer a full suite of wealth management services, including financial planning, insurance, investment services, trusts and estates, tax consulting and preparation, U.S. services, and charitable foundation services and activities.

Where you have requested such services (or are referred for related services), we may share the appropriate personal data with the relevant member of the Raymond James Canada group to provide those services.

Where Do We Store and Process Personal Data?

Depending on the nature of the information, your personal data may be stored in RJL offices, in our systems or record storage facilities, or in the systems or record storage facilities of our affiliates or third-party service providers.

Personal data may be stored and processed in any country where we have affiliates or service providers. Our service providers and other third parties, including our affiliates with whom we share personal data under this Notice, may perform activities outside of Brazil and Canada. As a result, your personal data may be used, stored or accessed in other countries and subject to the laws of those countries. For example, personal data may be required to be disclosed in response to valid demands or requests from government authorities, courts, regulators, and law enforcement officials in those countries, in accordance with applicable law. Where cross-border transfers occur, we take steps to ensure an appropriate level of protection and that the transfer is carried out using mechanisms permitted by the LGPD, as applicable.

No matter where we store or process your personal data, we seek to ensure it has an appropriate level of protection. We have standards and safeguards designed to protect personal data in our custody or control against theft, loss and unauthorized access, use, and disclosure. Please see How Do We Protect Personal Data below for further information.

How Long Do We Retain Personal Data?

We retain personal data only as long as it is required for the purposes for which it was collected, as required by law or regulation, or as necessary to manage risk and resolve disputes.

The length of time we retain personal data varies depending on the products or services and the nature of the information. This period may extend beyond the end of your relationship with us, but only for so long as it is required by regulation or necessary for us to respond to issues that may arise at a later date.

When personal data is no longer needed, we have procedures to securely destroy, delete, erase, or anonymize it.

How Do We Protect Personal Data?

There are several ways we strive to protect personal data.

We maintain administrative, technical and operational safeguards and security measures designed to help prevent unauthorized access, use, disclosure, loss, alteration or theft of personal data in our custody or control. We update and regularly test our security standards and procedures to improve protection and help ensure the integrity of personal data.

We have procedures that restrict employee access to personal data to those who have a legitimate business need to know. We educate our employees about confidentiality and privacy obligations and take appropriate measures to enforce these responsibilities.

Our technological systems are monitored for signs of tampering or unauthorized activity. We use security controls such as encryption and other protective technologies and practices appropriate to the sensitivity of the information and the services being provided.

Our information technology professionals continuously evaluate and enhance security controls. We may also use independent reviews or audits to help assess the effectiveness of our security measures.

Our service providers and agents are required by contract to protect personal data, maintain confidentiality, and use personal data only for authorized purposes consistent with the services they provide to us.

What Are Your Rights to Manage Your Personal Data?

Under the LGPD, you have certain rights in relation to your personal data, subject to legal and regulatory limitations. These rights may include requesting confirmation of processing, access, correction, anonymization, blocking or deletion, portability (where applicable), information about sharing, withdrawal of consent (where consent is the legal basis), and review of decisions made solely on automated processing that affect your interests.

To protect your privacy and security, we must verify your identity before responding to a request. We will respond within the timeframes required by the LGPD and other applicable laws, and we may refuse or limit a request where permitted by law (for example, where retention is required to meet legal or regulatory obligations).

1. Keeping Your Personal Data Accurate

We attempt to keep our records as accurate and complete as possible. You can help us maintain the accuracy of your personal data by notifying your Advisor or our Privacy Office of any changes. If you find any errors in our records, let us know and we will make corrections as appropriate. Where permitted and applicable, we may also record that information remains in dispute.

2. Managing Your Consent Options

We only collect the personal data that is necessary to provide or improve the products or services requested by you and to comply with applicable laws.

It is always your choice whether or not to provide your personal data or to consent to our obtaining personal data about you from third parties. You may refuse to provide or withdraw your consent at any time. However, if you choose not to provide requested personal data or consents, or withdraw your consent, we may not be able to open or continue to service your account or provide you with all of the products and services you are requesting. For example, we cannot open or maintain an investment account without certain personal information as we would be in breach of our legal and regulatory obligations.

To clarify any questions you may have about your consent options, please feel free to contact your Advisor or the Raymond James Privacy Office (Encarregado) using the contact information below. We will be pleased to explain your options and any consequences of refusing or withdrawing your consent.

3. Obtaining Access to Your Personal Data

Most information about your products and services is available through the reporting and communications you receive. If you want to request access to additional personal data we may hold about you, and information about our use and disclosure of that data, you may contact the RJL Privacy Office (Encarregado) as provided at the end of this Notice.

We may require your request to be submitted in writing and to include sufficient detail to help us understand the scope of the request and locate the relevant personal data. We must verify your identity before searching for, or providing access to personal data. We will respond within the timeframes required by the LGPD and other applicable laws.

If you have a sensory disability, you may request your information in an alternative format. Where reasonable and consistent with applicable law, we will provide or convert the information into the requested format to enable access.

Please note that we may not be able to provide certain information if it contains references to other persons that cannot be separated, is subject to legal privilege, contains information proprietary to RJL, relates to an investigation of a breach of an agreement or law, or cannot be disclosed for other legal reasons.

On request and where legally permitted, we may provide information about public and private entities with which we share personal data.

4. Requesting Deletion of Personal Data

Subject to legal and regulatory limitations, you may request deletion of personal data in circumstances permitted by the LGPD (for example, where data is processed based on consent and you withdraw consent, or where data is unnecessary, excessive, or unlawfully processed). We may be required to retain certain personal data to meet legal or regulatory obligations or to establish, exercise, or defend legal rights.

If you want to request deletion of personal data we may hold about you, you may contact the RJL Privacy Office (Encarregado) using the contact information below. We may require your request to be in writing and to include sufficient detail to help us understand your request and locate the relevant personal data.

Privacy on the Internet

RJL is committed to respecting and protecting the privacy of visitors who visit our website. We use cookies and other tracking technologies to collect information about visitors’ interactions with our website for purposes such as providing or enhancing digital functionality, security (including fraud prevention), and internal analysis and reporting. For more information about our web and cookie practices, please refer to our Internet Privacy Policy.

Our website may contain links to other websites. When you click on one of those links, you are accessing another website for which RJL has no responsibility or control.

Our Internet Privacy Policy explains how we collect, use, share and protect personal data when visiting our website and options to limit certain collection. For more information, refer to our Internet Privacy Policy at: Internet Privacy Policy.

Resolving Privacy Issues

If you have any questions about privacy or confidentiality, or any concerns or complaints about the way a request relating to personal data was handled, please contact the RJL Privacy Office (Encarregado) using the contact information below.

Email: privacyofficer@raymondjames.ca

Mail: 5300-40 King Street West, Scotia Plaza, P.O. Box 415, Toronto, ON, Canada M5H 3Y2

If you have a concern that we have not addressed to your satisfaction, you may contact Brazil’s data protection authority, the Autoridade Nacional de Proteção de Dados (ANPD).

ANPD’s primary channel for complaints, requests, suggestions, and access-to-information submissions is the federal government platform Fala.BR (Plataforma Integrada de Ouvidoria e Acesso à Informação) which can be accessed here - https://falabr.cgu.gov.br

Address: Setor Comercial Norte (SCN), Quadra 6, Conjunto “A”, Edifício Venâncio 3000, Bloco “A”, 9º andar, CEP 70.716-900, Brasília – DF, Brazil.

Telephone: +55 (61) 2017-3338 / +55 (61) 2017-3339

ANPD “Encarregado” (DPO) contact: encarregado@anpd.gov.br.