Privacy Policy

1. PURPOSE

This Policy aims to provide information and clarify how your Personal Data is processed by Vitru ("Vitru" or the "Group", its controlled companies and subsidiaries, affiliates, and maintained institutions whose higher education sponsors they represent — referred to in this Policy as “We” or “Us”).

This Policy is part of a broader set of elements that comprise the Governance structure of Vitru and its controlled companies and must be read and interpreted in conjunction with the documents that make up this structure.

2. APPLICABILITY

This Policy applies to all individuals (natural persons) who interact with Vitru’s services through its controlled companies, including: applicants, students, former students, partners, suppliers, service providers, employees, third parties, and others (referred to in this Policy as “You”).

3. DEFINITIONS

Brazilian National Data Protection Authority (“ANPD”): The Brazilian National Data Protection Authority is the public administration body responsible for safeguarding, implementing, and overseeing compliance with the Brazilian General Data Protection Law throughout the national territory.

Consent: A freely given, informed, and unambiguous indication by which the data subject agrees to the processing of their personal data for a specified purpose.

Employee(s): All employees, interns, third parties, and service providers, regardless of the position or role performed at Vitru.

Controller: A natural or legal person, under public or private law, responsible for decisions regarding the processing of personal data.

Personal Data: Information relating to an identified or identifiable natural person.

Sensitive Personal Data: Personal data concerning racial or ethnic origin, religious belief, political opinion, trade union membership or membership in a religious, philosophical, or political organization, data concerning health or sex life, genetic or biometric data, when linked to a natural person.

Data Protection Officer or DPO: A person appointed by the controller and processor to act as a communication channel between the controller, data subjects, and the Brazilian National Data Protection Authority.

GRC: Governance, Risk, and Compliance department.

Data Inventory: Record of data processing operations carried out by the institution.

LGPD: Brazilian General Data Protection Law, Law No. 13,709/18 – enacted on 08/14/2018, effective as of 09/18/2020, with administrative sanctions effective as of 08/01/2021.

Processor: A natural or legal person, under public or private law, who processes personal data on behalf of the controller.

Interested Parties: Executive leadership, management, involved employees and/or regulatory authorities.

LGPD compliance verification plan: Action plan, managed by the Information Security department, for conducting verifications related to LGPD compliance activities.

Data Protection Impact Assessment (“DPIA”): Documentation prepared by the controller containing a description of personal data processing operations that may create risks to civil liberties and fundamental rights, as well as the measures, safeguards, and mechanisms implemented to mitigate such risks.

Data Subject: A natural person to whom the personal data being processed relates.

Processing: Any operation performed on personal data, including collection, production, receipt, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, deletion, evaluation or control of information, modification, communication, transfer, dissemination, or extraction.

4. SUPPORTING DOCUMENTS

• Brazilian General Data Protection Law, Law No. 13,709/18

• CD/ANPD Statement No. 1/2023 – Processing of Personal Data of Children and Adolescents

• CD/ANPD Resolution No. 4/2023 – Regulation on Calculation and Application of Penalties

• PO 0102 – Personal Data Breach Guidelines Policy

• PRO 0023 – LGPD Communication Procedure

• PRO 0024 – LGPD Compliance Procedure

• PRO 0025 – Procedure for Responding to Data Subject Rights

• All other institutional documents related to the LGPD, available in Sydle.

• PO 0154 – Data Governance Policy

• PO 0160 – Data Security Policy

5. SOURCES OF PERSONAL DATA

Personal Data is collected through the following sources:

Vitru Web Pages: All of our official websites and portals may be used to collect personal data. This includes websites operated directly through our domains and IP addresses, as well as websites or pages established through third-party services such as Facebook, Instagram, LinkedIn, and other third parties offering similar services.

Email and instant messaging systems: Services used to maintain electronic communications between You and Vitru, including those provided directly by Us or third-party services such as WhatsApp, Telegram, SMS (Short Message Service), and similar services.

Vitru mobile applications: Mobile applications provided directly by Vitru or through third-party services such as Google, Apple, and others.

Customer Service Center, Contact Center, and Sales Areas: Communications made with You or by You through our service centers and relationship channels for students, applicants, and/or former students.

Advertisements, marketing materials, and online forms: Interactions with any type of Vitru advertisement, marketing material, or online form, or those of strategic partners.

Offline records: Records completed offline and distributed during events and other interactions with Vitru and its partners.

Data received from third parties: Including social networks and third-party websites such as Facebook, Instagram, LinkedIn, and similar services, data aggregators, Vitru partners, public sources, and data received during merger and acquisition processes involving other companies.

6. WHAT PERSONAL DATA WE COLLECT AND HOW IT IS COLLECTED

During your interaction with Vitru, using one of the collection sources previously mentioned, We may collect various types of personal data about You, including partially provided information, as described below:

Contact Information: Any information that may facilitate contact with You, including your physical mailing address, telephone numbers, email addresses, websites, and social media profiles.

Login Information: Information used to identify and authenticate You in services provided by Vitru, including your registered username (login), password in an unrecoverable format (encrypted), and security questions.

Demographic Information and Interests: Any information that may describe your demographic data, habits, or behavioral characteristics, including date of birth, age or age range, gender, geographic location, favorite products, hobbies and leisure activities, other interests, and family or lifestyle information, for the purpose of offering services tailored to your profile and region.

Technical Information about your computer equipment or mobile devices: Details about your computer or other portable device used to access one of our websites, services, or applications, including the IP address used to connect your computer or device to the internet, your geographic location, operating system type and version, and web browser type and version. If You access a Vitru website or application through a mobile device, such as a smartphone or tablet, the information collected may also include, when permitted, your device’s unique identifier, geographic location, and other similar mobile device data.

Information about how You use our websites and services: During your interaction with our websites and services, We use automated data collection technologies to capture information about the actions You take. This may include details such as which links You click, which pages or content You view and for how long, as well as similar information and statistics concerning your interactions, such as content response times, download errors, and duration of visits to specific pages.

This information is collected through automated technologies such as cookies (browser cookies, flash cookies, and similar technologies). See the section “Use of Cookies, Log Files, and Similar Technologies” in this Policy.

Market Research and Consumer Feedback: Information You voluntarily share with Vitru or other online platforms regarding your experience using our services.

Consumer-Generated Content: Any content You create and share with Vitru on third-party social networks or upload to one of our websites, applications, or other online and offline services, including the use of third-party social networking applications such as Facebook, Instagram, LinkedIn, and similar platforms. Such data may include text, comments, articles, photos, videos, personal stories, or other similar content and media.

Third-Party Social Network Information: Any data You publicly share on a third-party social network or information contained in your profile on a third-party social network (such as Facebook, Instagram, LinkedIn, and similar platforms) that You allow the third-party social network to share with Us or make publicly available.

This data may include basic account details such as name, email address, gender, date of birth, current city, profile picture, user ID, friends list, and similar information, as well as any other information or activity You allow the third-party social network to share with Us or make publicly available.

We receive your third-party social network profile information, or portions thereof, whenever You download an item or interact with a Vitru application or web service on a third-party social network, use a social networking feature integrated into a Vitru website, or otherwise interact with Us through a third-party social network.

To learn more about how your information from a third-party social network is obtained by Vitru, or to choose not to share such information, please visit the website of the applicable third-party social network.

Financial and Payment Information: Any data Vitru requires to provide its services or that You use to make a payment, such as debit or credit card information (cardholder name, card number, expiration date, and other information) or other payment methods used.

Vitru or our payment processing service providers handle your financial and payment information in accordance with applicable laws, regulations, and security standards.

Contacts with our Student Service Center, Higher Education Institutions, and Contact Center: Your WhatsApp interactions may be stored and reviewed to meet Vitru’s operational needs or comply with applicable law.

Sensitive Personal Data: Vitru collects Personal Data considered sensitive under applicable law. We rely on the following legal bases: (i) crime detection and/or prevention; and (ii) compliance with applicable law.

7. PERSONAL DATA OF CHILDREN AND ADOLESCENTS

Personal data of children and adolescents may be collected, provided that their best interests are observed and that the collection complies with the legal bases established under applicable law.

When Vitru services are contracted, We may collect personal data of children and adolescents directly from their parents or legal guardians, in accordance with applicable legal requirements.

8. USE OF COOKIES, LOG FILES, AND SIMILAR TECHNOLOGIES

A cookie is a small data file with a unique identification tag that websites request users’ browsers to store on a computer or mobile device.

The primary purpose of cookies is to allow the user’s browser to record actions and/or preferences for greater speed, efficiency, and customization, eliminating the need to repeatedly enter the same information.

Cookies are therefore used, among other purposes, to identify users, store and remember customized preferences, and help users complete tasks without having to re-enter information when moving from one website to another or when returning to the platform.

Vitru websites and compatible services may also use other tracking technologies similar to cookies, which may collect information such as IP addresses, log files, web beacons, and other information. This data is also used to help Us tailor Vitru websites and compatible services to your individual needs.

Further details are provided below:

IP Addresses: An IP address is a number used on the internet or a network to identify your computer. Each time You connect to the internet, your computer receives an IP address assigned by your internet service provider. We may record IP addresses for the following purposes:

• Troubleshooting technical issues;

• Maintaining the security and protection of our websites and other online services;

• Gaining a better understanding of how our websites and other online services are used; and

• Adapting our content to your needs based on your geographic location.

Log Files: Vitru or a third party working on our behalf may collect information in the form of log files that record website activity and gather statistics regarding user browsing habits. These records are generally generated anonymously and help Us understand details such as:

• The type of browser and operating system used by users of our websites or online services;

• Details about the user session, including the originating URL, date, time, pages visited on our websites and compatible services, and how long the user remained on them; and

• Other browsing or click-counting details, including website traffic reports, unique visitor counts, and similar data.

Web Beacons: We may use web beacons (or transparent GIFs) on Vitru websites. Web beacons, also known as web bugs or webbeacons, are small sequences of code that enable a graphic image to be delivered on a web page for the purpose of transmitting data back to Us.

We use information from web beacons for various purposes, including:

• Understanding how a user responds to email campaigns;

• Traffic reporting for our websites and compatible services; and

• Counting unique visitors, auditing, advertising and email reporting, and customization of our websites and other compatible services.

9. LINKS TO EXTERNAL WEBSITES

Our websites may contain links directing You to external websites operated by entities, organizations, or other sources.

When redirected, We encourage You to review the privacy policies of those websites. We are not responsible for privacy or information security practices adopted by external websites that are not maintained by Vitru.

10. USE OF YOUR PERSONAL DATA

In order to provide quality services, We collect data used in various institutional processes. Some data is required in order to comply with rules established by regulatory authorities and is therefore mandatory.

The following describes the different types of Personal Data We collect, including category, description, legal basis, and retention period. Not all uses described below will be relevant to every individual, and each applies only to the situations described.

Student Monitoring and Development

Description: Monitoring students’ academic progress to promote success and reduce dropout rates, including psychological support.

Legal Basis: Performance of a contract or pre-contractual measures.

Retention Period: Maximum 9 years.

Clinics and Other Practical Academic Activities

Description: Serving the needs of internal and external communities and commercialization of products and services.

Legal Basis: Studies by research bodies; physical safety of the data subject or a third party; protection of life.

Retention Period: Maximum 20 years.

Academic Records and Controls

Description: Management and administration of student and guardian registration data, transmission of data to government authorities, documentation of academic records (enrollment, internships, grades, and attendance), and preparation of official documents (diplomas, certificates, declarations, transcripts).

Legal Basis: Compliance with a legal or regulatory obligation.

Retention Period: Indefinite.

Campus Services

Description: Facilitating the loan of institutional property to students and the external community. Measures to maintain internal security, including CCTV, access control, and incident records.

Legal Basis: Legitimate interests of the controller or third parties.

Retention Period: Maximum 3 years.

Marketing and Commercial Campaigns

Description: Distribution of commercial campaigns and institutional communications from Vitru, its controlled companies, and partners.

Legal Basis: Legitimate interests of the controller or third parties.

Retention Period: Maximum 10 years.

Purchasing

Description: Contact with suppliers and service providers for requests, quotations, and negotiations.

Legal Basis: Performance of a contract or pre-contractual measures; legitimate interests of the controller or third parties.

Retention Period: Indefinite.

Financial Matters

Description: Administration and control of financial transactions, including payments, debt negotiations, credit analysis, credit reporting, relationships with suppliers and third parties, and analysis of documentation for scholarships and financing.

Legal Basis: Compliance with a legal or regulatory obligation; performance of a contract or pre-contractual measures.

Retention Period: Indefinite.

Human Resources

Description: Management and administration of employee and dependent registration data, transmission of data to government authorities, recruitment and selection, administration of benefits and agreements, preparation and retention of documents, and workplace health and safety activities.

Legal Basis: Compliance with a legal or regulatory obligation; performance of a contract or pre-contractual measures; legitimate interests of the controller or third parties.

Retention Period: Indefinite.

Communication Channels

Description: Communication channel between parents, students, the external community, and the institution for resolving issues and receiving reports, complaints, and suggestions.

Legal Basis: Consent; legitimate interests of the controller or third parties.

Retention Period: Maximum 10 years.

Technical Support

Description: Access management, system maintenance, and database administration.

Legal Basis: Performance of a contract or pre-contractual measures.

Retention Period: Indefinite.

11. SHARING OF YOUR PERSONAL DATA

In addition to the entities that form part of Vitru, We may share your Personal Data with the following types of third-party organizations:

Service Providers: External companies used by Vitru to assist in operating our business. Service providers and their selected employees are only authorized to access your Personal Data on Vitru’s behalf for specific tasks requested from them based on our direct instructions.

Governmental and Private Entities Offering Student Benefits: This includes government benefits such as ProUni, FIES, UNIEDU (for Santa Catarina), among others, as well as private companies that have agreements with Higher Education Institutions maintained by Vitru.

In these cases, only Personal Data necessary and relevant to carrying out activities required to establish or maintain eligibility for benefits will be shared.

The granting of any such benefit is exclusively linked to the student’s interest in being a beneficiary. Accordingly, Vitru will only share information concerning students who are beneficiaries or are seeking eligibility for such benefits.

Credit Analysis Agencies, Debt Collection Agencies, and Financial Services: As permitted by applicable law, credit analysis and/or debt collection agencies are external companies Vitru may use to help verify your credit status or collect information relating to overdue payments.

Third-Party Companies Using Personal Data for Their Own Marketing Purposes: Vitru does not license or sell your Personal Data to third-party companies for their own marketing purposes.

Data may be made available to service providers, partners, or regulatory authorities in accordance with previously communicated purposes or pursuant to a court order.

12. RETENTION AND TERMINATION OF PROCESSING OF YOUR PERSONAL DATA

Personal data is stored for the period required by law or for as long as necessary to fulfill the purposes for which it was collected, as described in this Policy, or to comply with applicable legal requirements.

The applicable retention period varies according to the nature of the information and the business area to which it relates. Detailed information is available in Section 10.

Personal Data used to provide You with a personalized experience will be retained only for the period permitted under applicable legislation establishing principles, guarantees, rights, and obligations regarding the use of the Internet in Brazil.

Data collected based on consent and on the legitimate interests of the controller or third parties may be deleted at any time upon request by the data subject or responsible party.

13. STORAGE OR TRANSFER OF YOUR PERSONAL DATA

Vitru adopts appropriate measures to ensure that your Personal Data is kept confidential and secure. However, these controls do not apply to information that You choose to share in public areas, such as third-party social networks.

Persons who may access your Personal Data: Your Personal Data will be processed by our employees or authorized agents only when they need access to such information, depending on the specific purposes for which your Personal Data was collected.

Measures adopted in operational environments: We store your Personal Data in operational environments with appropriate technical and administrative security measures to prevent unauthorized access or security incidents.

Measures Vitru expects You to take: It is also important that You remain committed to keeping your Personal Data secure. When creating an online account, We recommend that You choose a strong password, with an appropriate level of complexity, to prevent unauthorized parties from identifying it.

We recommend that You never disclose or share your password with others. You are solely responsible for keeping your password confidential and for any action carried out through its use in your account on Vitru websites and compatible services.

If You use a shared or public computer, never select an option to remember your username, email address, or password, and make sure You log out of your account whenever You leave the computer.

We also recommend using any privacy settings or controls made available by Vitru on our websites, services, or applications, including optional settings.

Transfer of your Personal Data: Due to the nature of our business, We may need to transfer your Personal Data stored within Vitru to third parties in accordance with the purposes established in this Privacy Policy.

For this reason, We may transfer your Personal Data to other countries, provided that such countries have laws and regulations compatible with those in force in Brazil.

14. PROCESSING OF PERSONAL DATA FOR ACADEMIC PURPOSES

The LGPD does not apply to the processing of personal data carried out exclusively for academic purposes, as these circumstances are considered related to the exercise of academic freedom.

Academic freedom means freedom of expression and manifestation of thought, commonly exercised by faculty members, students, researchers from research organizations, or educational institutions in environments dedicated to debate, presentation of ideas, and dissemination of knowledge.

In scientific studies conducted at our Higher Education Institutions (“HEIs”), We prioritize respect for the privacy of volunteers. Accordingly, Vitru and its controlled companies apply security measures to prevent the exposure of data and prioritize anonymization whenever possible.

Participation begins only after execution of the Acknowledgment and Responsibility Form, which contains detailed explanations regarding the purpose and nature of the study.

15. INFORMATION SHARING AND PROTECTION

All information registered in Vitru’s systems is confidential. We rely on security techniques and practices that We consider appropriate to protect your data from improper access.

Such information is stored in data centers located in Brazil or abroad, in compliance with the LGPD and other applicable regulations, with the purpose of ensuring security and privacy for data subjects.

We adopt appropriate procedures to protect personal data against unauthorized access, destruction, loss, alteration, or any type of processing that deviates from the purpose for which it was collected.

However, no platform is completely secure. If You have any concerns or suspect that data may be at risk, please contact Us through our Privacy Portal.

16. YOUR RIGHTS REGARDING PERSONAL DATA

You have the right to confirm the existence of processing and to access, review, and modify your Personal Data processed by Vitru.

You also have the right to request details regarding the source of your Personal Data or its sharing with third parties.

At any time, You may also limit the use and disclosure of your Personal Data or withdraw consent for any of our Personal Data processing activities, except in circumstances permitted by applicable law.

Whenever a request is submitted without the evidence required to establish the legitimacy of the data subject, the request will be automatically rejected.

Any identification information provided to Vitru will only be processed in accordance with, and to the extent permitted by, applicable laws.

Certain circumstances require the retention of your Personal Data in order to satisfy legal or contractual obligations of the Company. In such cases, We will not be able to delete your Personal Data.

Vitru requires validation of your identity, using, for example, a password-protected login system or similar functionality, before allowing access to or modification of your Personal Data, thereby helping prevent unauthorized access to your account and associated personal data.

The initial password for access to Company tools is automatically generated by the system. Upon first login, the data subject must create a new password, which is personal and non-transferable.

16.1 YOUR CHOICES REGARDING HOW WE USE AND DISCLOSE YOUR PERSONAL DATA

Vitru seeks to ensure that You have freedom of choice and control over the Personal Data You provide to Us. The following mechanisms allow You to control the processing of your Personal Data:

Cookies/Similar Technologies: You may manage your consent by using your browser settings to reject some or all cookies and similar technologies or to notify You when they are being used.

Advertising, Marketing, and Promotions: You may consent to Vitru’s use of your Personal Data to promote our services. If You later decide that You no longer wish to receive such communications, You may unsubscribe from marketing communications by following the instructions provided through the applicable channels.

To unsubscribe from marketing communications sent through any channel, including third-party platforms, You may opt out at any time using the unsubscribe links available in our communications or through partner platforms.

Even if You unsubscribe from our marketing communications, You will continue to receive administrative, academic, and extracurricular communications from Vitru, as well as transaction confirmation requests, notifications regarding account activity on our websites and compatible services, and other important announcements unrelated to marketing campaigns.

Targeted Advertising: Vitru partners with advertising networks and other advertising service providers that display advertisements and other promotional content on our behalf or on behalf of companies not affiliated with Vitru.

Some advertisements may be tailored to your interests based on information collected on Vitru websites and compatible services or on websites operated by organizations not affiliated with Vitru.

17. CHANGES TO OUR PRIVACY POLICY

We recommend that You review our Privacy Policy regularly so that You may clarify any questions and remain informed about potential changes.

Whenever applicable, whether due to organizational needs or to ensure compliance with applicable law, Vitru will improve its practices, procedures, and policies related to the management of personal data of the data subjects associated with it.

18. HOW TO CONTACT US

If You have questions, requests for clarification, or complaints concerning the management of your personal data, please submit a request using the form below:

Access the request form

Vitru will receive the request, gather the necessary information, and respond within a reasonable period to any inquiry regarding how We process your Personal Data.

Our goal is to ensure your rights and maintain compliance with applicable privacy and Personal Data protection laws.

19. DATA PROTECTION OFFICER (DPO)

João Carlos Silveira Carvalho