BrazilWells Fargo International Privacy Notice
Effective: 12 December 2023

Part 1. Introduction
What is this document and why should you read it?
Wells Fargo provides this privacy notice ("Notice"), as data controller, to describe our practices regarding the collection,
storage, use, disclosure and other processing of Personal Data (defined below) pertaining to Brazilian data subjects. Wells
Fargo may collect and process your Personal Data in a variety of situations, including when you or your organization havea relationship with a Wells Fargo entity. This Notice is intended to provide you with information regarding: 1) the types ofpersonal data we collect and process; 2) the specific purpose of our processing activities; 3) the type and duration of theprocessing; 4) our role as a data controller and contact information; 5) how and why we may share data; 6) responsibilitiesof our processors and service providers; and 7) your data subject rights.
This privacy notice is in addition to other privacy notices that may apply to your or your organization’s relationship with aWells Fargo entity outside of Brazil. Privacy notices for those Wells Fargo entities and jurisdictions are available atwww.wellsfargo.com/privacy-security.
Who are we?
Wells Fargo is one of the largest financial institutions in the world, and we operate globally.
Name of group parent: Wells Fargo & Company
Headquarters location: 420 Montgomery Street; San Francisco, CA 94104 USA
Contact information for our Latin America Privacy Officer is listed below.
What types of Personal Data do we collect?
Wells Fargo collects different types of Personal Data. In order to provide financial products and services, we may collectinformation about both our consumer customers ("Customers") as well as other identifiable persons, including thoserelated to or otherwise connected to our commercial customers (collectively, "Individuals"). The information wecollect/process may include:© 2023 Wells Fargo Bank, N.A. All rights reserved.
IPN BRZ2311 (Rev 12/12/23)

•
•
•
•

•
•
•

Personal Identifiers: personal unique identifiers, such as full name and government-issued identification
numbers.
Contact Information: address, phone number, mobile phone number, email address, and online contactdetails.
Employment Information: employer, title, position held, and length of employment.
Authentication data: passport or national identification card, driver’s license, other governmental
identification information, home address and telephone number, documents that verify address, date ofbirth, country of domicile, and documents that verify employment, and signature authorization.
Internet or Online Information: Internet or online information such as browsing history, and information
regarding interaction with our websites, applications, or advertisements.
Financial data: salary and other income, sources of wealth, assets, financial relationships, and financialtransactions.
Background or credit check data: credit check information, background check information including credit andcriminal checks and screening, but only to the extent required or permitted by local law.

Collectively, the above categories of data constitute "Personal Data." We may collect, to the extent permitted by applicablelaw, Personal Data directly from Individuals, Customers, private lists, and publicly available sources. Failure to provide thisinformation may result in Wells Fargo being unable to provide or continue to provide the requested services.

Part 2. Our handling of Personal Data
Why do we collect and use Personal Data?
Wells Fargo collects and processes Personal Data for a number of purposes. A primary purpose is to ensure we can provide
Customers with the products and services we offer and which they have requested. As described below, we also need to use
Personal Data for purposes of carrying out our business operations, including confirming a person's authority as arepresentative or agent of a Customer, undertaking internal investigations and audits, handling legal claims, responding torequests from supervisory authorities, and complying with applicable laws and regulations on a global basis.
We collect, process, and use Personal Data:

2•

To provide products and services. We collect and process Personal Data to perform obligations under ouragreements, carry out related business functions, process data and transactions, perform banking services (includingdeposit taking and account management), conduct credit checks and due diligence, market products and services,
provide investment banking and financial services, and manage Customer relationships and inquires, including when
we need to contact Individuals with important information or for other administrative purposes.

•To comply with legal obligations and regulations. We collect and process Personal Data to comply with laws,
regulations, and legal obligations applicable to Wells Fargo and its Affiliated Entities (defined below) in the UnitedStates and/or in other countries, including "know your customer" obligations based on applicable anti-money
laundering and anti- terrorism requirements, financial crime and fraud prevention, suspicious activity reporting,responding to requests from public authorities, complying with economic and trade sanction requirements,performing Customer and Individual due diligence, performing audit and risk assessments, conducting foreign

IPN BRZ2311 (Rev 12/12/23)

exchange and international trade, preparing tax reports, complying with whistleblowing requirements, and handlinglegal claims.
•To confirm a person’s authority as a representative or agent of a Customer. We collect and process Personal Datato confirm a person’s authority as a representative or agent of a Customer with which Wells Fargo or its AffiliatedEntities have entered or intend to enter into various arrangements, including deposit contracts, loan contracts,contracts for foreign exchange transactions, contracts involving derivative transactions, letters of credit, loanservices, account management, commercial banking, commercial real estate, structured lending, corporate andinvestment banking services, credit card issuance and processing, financial services, and investment management.

•To conduct recordkeeping. We collect and process Personal Data to facilitate managing our records in a systematicmanner so they can be retrieved when required for legal, regulatory or operational reasons.

•Information discussed during telephonic or electronic conversations. Wells Fargo records calls when required bylaw or to create records of legally-required meetings.

You expressly waive the bank secrecy or confidentiality laws and obligations, if any, of the country or countries where you
and any Customer accounts are located but only to the extent permitted by applicable law. To the extent that is required byapplicable law, Wells Fargo will obtain your consent directly and thus providing Personal Data to the Wells Fargo Group orauthorizing our Customer to provide such information to us shall not be considered as a consent duly given from you. Anychange in the purposes or in the circumstances that have legitimated the data subject’s consent will be informed to you.
You may revoke consent at any time by notifying us at the address provided below. Prior uses and disclosures will not beaffected (unless you directly request the deletion of personal data processed under your consent or when required byapplicable law), and we may otherwise continue to process Personal Data as permitted or required by law.
Do we transfer Personal Data to different countries?
Wells Fargo operates across the globe, and we may transfer Personal Data to Wells Fargo entities located in countries
other than the country where a Customer opened their account or maintains their relationship with us. This can also
happen when we engage third parties to assist us with certain operations and activities, as they also may be established indifferent countries, including countries located outside Brazil.
We have put in place measures to enable the transfer of Personal Data to another country in accordance with applicablelaw regardless of the global location of our entities. These measures enable us to transfer and use Personal Data in a securemanner anywhere in the world where we have an establishment, or where we have contracted third parties to provide us
with services. We may also transfer Personal Data to other countries where our third party service providers are located.
To whom do we disclose Personal Data?
We may disclose Personal Data, to the extent necessary and on a need-to-know basis, as follows:

3

IPN BRZ2311 (Rev 12/12/23)

•Affiliated Entities. Wells Fargo has affiliated entities and subsidiaries operating in the United States and around theworld, including the group parent in the United States, Wells Fargo & Company, and Wells Fargo Bank, N.A. We may
disclose Personal Data to our Affiliated Entities on a worldwide basis and our affiliates may use the data for thepurposes described above to the extent permitted by applicable law.

•Beneficiaries, counterparties, and other parties related to a transaction; credit reference agencies. Wells Fargo
may disclose Personal Data to beneficiaries, counterparties, or other parties related to a transaction on a worldwide
basis to provide the services requested by our Customers and to comply with legal obligations and regulations. Wemay provide Personal Data to credit reference agencies where allowed by law.

•Service providers. Wells Fargo may disclose Personal Data to service providers around the world that act on ourbehalf and under our instructions regarding the processing of such data (“Data Processors”). All Data Processors weretain are subject to contractual obligations to implement appropriate legal, administrative, physical, and technicalmeasures to safeguard Personal Data.

•Legal requirements. Wells Fargo may disclose Personal Data if required or permitted by applicable law or regulation,
including laws and regulations of the United States and other countries, or in the good faith belief that such action
is necessary to: (a) comply with a legal obligation or in response to a request from law enforcement or other publicauthorities wherever Wells Fargo may do business; (b) protect and defend the rights or property of any Wells Fargo
entity; (c) act in urgent circumstances to protect the personal safety of Individuals, Customers, andcontractors/employees of any Wells Fargo entity or others; or (d) protect against any legal liability. In addition, Wells
Fargo may share Personal Data with U.S. regulators, and other self-regulatory bodies to which we are subject,
wherever Wells Fargo may do business.

•Business transfers, combinations and related activities. As we develop our business, Wells Fargo might sell, buy,
restructure, or reorganize businesses or assets. In the event of any actual or proposed sale, merger, reorganization,restructuring, dissolution or any similar event involving our business or assets, Personal Data may be shared withthe relevant entity or may be part of the transferred assets and will be subject to any necessary contractual
obligations to ensure the protection of such Personal Data.

The recipients of Personal Data identified above may be located in the United States or in other countries whose laws may
not provide the same level of data protection as Brazil’s data protection law. As needed, we will establish appropriate datatransfer agreements with such recipients with respect to Personal Data transferred from Brazil to a third country, orotherwise provide appropriate safeguards regarding transfers of Personal Data to other countries. All of our employees andthird party vendors will only use personal data for the purposes set forth in this notice. Under the Brazilian General Data
Protection Law (LGPD), we will transfer your Personal Data from Brazil to any foreign country under one the legal bases
expressly stated by Article 33 of the LGPD (for the performance of a contract or based on your consent, for instance), until
other appropriate steps are available.
How do we keep your Personal Data safe?
Personal Data will be safely stored in Wells Fargo databases and will be held and maintained by Wells Fargo or on behalf of4

IPN BRZ2311 (Rev 12/12/23)

Wells Fargo by Wells Fargo service providers. Appropriate measures are taken so that Personal Data can be kept accurate
and up-to- date, which will be in accordance with applicable security requirements. In an effort to prevent the loss, misuse,
unauthorized access, disclosure, alteration or destruction of Personal Data, we will take appropriate legal, administrative,physical, and technical measures to protect Personal Data and ensure it is accessed by our team members only on a needto-know basis.
While registering with our website, mobile applications, or social media features, we may provide you with a unique
identification and password for accessing our products and services. We encourage you to choose your password wisely suchthat no intruder or third party can obtain any unauthorized access. We also encourage you to keep your password confidential
and not have any written or other record of the password that can be accessible by an intruder or third party.
How long will we retain Personal Data?
We keep Personal Data no longer than necessary to (i) fulfill the purposes outlined in this Privacy Notice; (ii) comply with all
the applicable legal and regulatory obligations to which Wells Fargo is subject; or (iii) perform a contract duly establishedwith you; or (iv) take steps at your request prior to entering into a contract. We have implemented appropriate record
retention policies to retain your Personal Data only to the extent permitted by applicable laws.

Part 3. Your Rights in Relation to Personal Data
What are your rights?
This Notice provides you with details about your Personal Data rights. If you have questions about your Personal Data rights,
please contact the Latin America Privacy Officer using the contact information below.
You have the following rights in relation to your Personal Data:• Access: you can ask us for a description of the Personal Data we hold about you and our purposes for holding it;
you can also ask for a paper or electronic copy of this information.
• Confirmation of Processing: you can ask us to confirm the existence and scope of our processing of Personal Data.
• Correction: you can ask us to correct your Personal Data if you see that it is inaccurate, incomplete, or out-ofdate.
• Anonymization: you can ask us to anonymize, block, or erase unnecessary or excessive data or data processed innoncompliance with Brazil’s laws.
• Deletion: you can ask us to delete your Personal Data that we have processed on the basis of your consent, so longas deletion is allowed by law.
• Sharing: you can ask us to provide information about public and private entities with which we have shared personaldata.
• Consent: you may revoke previously-granted consent, as well as obtain information about the consequences ofrevoking consent.
• Automated Decision-Making: you can ask us for information related to automated decision-making and request
review by a natural person.
• Data portability: you have the right to receive Personal Data you have provided to us in a portable and readily

5IPN BRZ2311 (Rev 12/12/23)

usable format that can sent to another service or product provider.
In certain circumstances, we will need to use your Personal Data even though you may have asked us to delete it or restrict
our use of it, or when you objected to our use. If this is necessary, we will do so in a lawful, fair, and transparent manner.
All rights expressed herein will be exercised free of charge through a specific request from the Data Subject or his/her legal
representative, which must be sent in writing to the address listed below. Our deadline for fulfilling your request will varydepending on the request, which will be duly informed. After we have verified the Data Subject’s identity (and the authorityof his/her legal representative, if applicable), we will provide the information and take the other actions requested as
specified by local law. If permitted by law, we may charge an appropriate fee to cover the costs of responding to the request.
How can you revoke consent to use your Personal Data?
When personal data is processed on the basis of your consent, you may revoke that consent at any time by notifying theLatin America Privacy Officer listed below. Prior uses and disclosures will not be affected (unless required by applicable law),
and we may otherwise continue to process Personal Data as permitted or required by law. If you revoke consent, Wells Fargo
may be unable to provide or continue to provide the requested services to you. You can also request information about thepossibility of denying consent, when applicable, and the consequences of such rejection.
How can you stop Wells Fargo from sending marketing materials to you?
We will only send you marketing and sales materials where, to the extent required by applicable law, you have consented toreceive such materials. If you do not want to receive marketing and sales materials from Wells Fargo by direct mail, telephoneor email, please follow the unsubscribe or opt-out instructions provided in those communications or submit a written
request to the Latin America Privacy Officer using the address shown below. You can also contact the Latin America Privacy
Officer to exercise your right to object to the receipt of these communications. We will comply with any such request withina reasonable period of time after receiving it.
How can you exercise your rights?
At Wells Fargo, we have team members who are dedicated to responding to requests in relation to your Personal Data, andto help you with any other questions that you may have. Please contact the Latin America Privacy Officer using the contact
information below:
Regional Privacy Officer, Canada and Latin America
MAC O1038-230
22 Adelaide Street West, Suite 2200
Toronto, Ontario, Canada M5H 4E3
Privacy.latinamerica@wellsfargo.com

6IPN BRZ2311 (Rev 12/12/23)

Can we modify this Notice?
We will modify this Notice as a result of amendments to laws or regulations, or due to other reasons involving our operations.
In such case, an amended Notice will be posted on our website at www.wellsfargo.com/privacy_security/. The page providing
the Notice will indicate the date when it was last updated.
This notice was last updated 12 December 2023.

7IPN BRZ2311 (Rev 12/12/23)