Company: SUZ
Filing Date: 2025-05-01
Form Type: F-3ASR
Source: 0001104659-25-042824
Chunk: 69

Company: Suzano S.A.
Filing Date: 2025-05-01
Form: F-3ASR
Chunk 69
---
 the debtor is suspended, including
action to enforce security over the assets of the debtor. Accordingly, during such stay a pledgee of claims may not collect nor notify
the debtors of such pledged claims of its rights of pledge.

<div align='center'>44

DATA PROTECTION PRIVACY NOTICE</div>

Data Protection in Austria

The General Data Protection Regulation (EU) 2016/679
(“GDPR”) regulates data protection and privacy for all individual citizens of the European Union (EU) and the European
Economic Area (EEA). It addresses the transfer of personal data outside the EU and EEA areas. The GDPR aims primarily to give control
to individuals over their personal data and to simplify the regulatory environment for international business within the EU. The regulation
contains provisions and requirements related to the processing of personal data of individuals (formally called “data subjects”
in the GDPR) inside the EEA, and applies to any enterprise established in the EEA or — regardless of its location and the data subjects'
citizenship — that is processing the personal information of data subjects inside the EEA.

In defined situations under this prospectus, Suzano
Austria may come into the position to collect data from holders, including EU residents. Before collecting such data, Suzano Austria shall
have put in place appropriate technical and organizational measures to implement the data protection principles. Business processes that
handle personal data must be designed and built with consideration of the principles and provide safeguards to protect data (for example,
using pseudonymization or full anonymization where appropriate), and use the highest-possible privacy settings by default, so that the
datasets are not publicly available without explicit, informed consent, and cannot be used to identify a subject without additional information
(which must be stored separately). No personal data may be processed unless this processing is done under a lawful basis specified by
the GDPR. Suzano Austria, in advance, shall clearly disclose the fact of any data collection, declare the lawful basis and purpose for
data processing, and state how long data is being retained and whether data is shared with third parties or outside of the EEA. Holders
will have the right to request a portable copy of the data collected by a Suzano Austria in a common format, and the right to have their
data erased under certain circumstances. Among others, Suzano Austria may be required to employ a data protection officer (DPO) who is
responsible for managing compliance with the GDPR.

<div align='center'>45