Complaints and Communications Policy

Whistleblowing and Communications Policy 4kst Tecnologia da Informação Ltda.

 

1. Introduction 

This Policy sets forth the manner in which the 4kst Reporting and Communication Channel (the "Channel") is made available and operates, as well as the security of the records and data received by the Channel. The Channel is an essential tool to support the Company's commitment to business integrity and the protection of its employees. With the aim of ensuring compliance with the 4kst Code of Conduct and its other internal rules, it acts as a mechanism accessible to internal and external audiences so that unhealthy interpersonal relationships and unethical or illegal acts do not materialize as practice within the Company. 

In addition to being a tool that assists the Company's senior management in caring for and ensuring the well-being of its employees, the Channel allows for monitoring of the compliance of 4kst's actions wherever it conducts its business, ultimately serving as an additional mechanism for protecting society. 

 

2. Outsourced Tool 

The Channel is operated by a specialized, outsourced platform provided by a duly contracted technology company. This contract guarantees the independence, impartiality, and security of the Channel. All reports and communications submitted to the Channel are recorded and stored in their entirety in the environment of the platform provider, which acts as a data operator. 

As the data controller, 4kst has restricted access to the communications received, but has no technical control over the supplier's platform or over the deletion of data, which reinforces the independence of the Channel, as detailed below:

(i) Unalterable record: 100% of reports are recorded and stored exclusively in the supplier's environment; 

(ii) exclusion control: the removal of personal data records from the platform can only be formally requested in writing by 4kst to the supplier company, which proceeds with the definitive and irreversible deletion of the data from its systems, as detailed in the Data Processing Agreement; and 

(iii) restricted access: access to reports and document management is provided by 4kst exclusively through the Customer Panel, a restricted area for the exclusive use of members of the Channel Treatment Group. 

The supplier company contractually undertakes to apply the appropriate technical and organizational measures to ensure the security and privacy of the data processed, strictly complying with the General Data Protection Law (LGPD). 

 

3. Treatment Group

The Treatment Group is the deliberative body responsible for receiving, analyzing, conducting investigations, and appropriately forwarding communications and complaints registered on the Channel. 

3.1. Composition and Term of Office 

The Treatment Group consists of three (3) full members and two (2) alternates, all formally appointed at a 4kst Board Meeting. The term of office for members is three (3) years, with the possibility of reappointment for an equal period. In the event of a vacancy (departure of a member or alternate), the Board of Directors, at a meeting formalized in the minutes, shall appoint a new member or new alternate within a maximum period of thirty (30) days to restore the structure of the Treatment Group.

3.2. Operation and Prevention of Conflicts of Interest

4kst establishes a rigorous automated protocol to ensure impartiality and independence in the handling of reports submitted to the Channel, preventing any member of the Treatment Group from analyzing a case in which a conflict of interest may arise: 

(i) identification of those involved: when registering a complaint or report in the tool, the Channel user will have the option to indicate 4kst employee(s) and/or area(s) involved or suspected of involvement in the reported matter; 

(ii) alert and automatic routing: once the report is complete, the Channel tool will send an alert email to the members of the Treatment Group or to the substitute(s), if applicable; 

(iii) refrain from sending alerts: the Channel tool will not send an email message with the report alert to any member who has been indicated in the report (either as a person involved or because they belong to the area involved). This ensures that the person involved in the report or belonging to the area covered will not be informed about the complaint or communication, bringing impartiality and fairness in the handling of 100% of reports; and 

(iv) limited access to reports: a full or alternate member may only access report information in the Channel tool when they are part of the team handling the report. 

 

4. Scope and Types of Reports 

The Channel is available to 4kst's internal audience (including employees, managers, and representatives) and to the general external audience (such as customers, suppliers, business partners, legal entities in the private and/or public sector, and citizens in general). Reports involving, but not limited to, the following should be brought to the Channel but not limited tothe following matters:

(i) reports of violations or breaches of the 4kst Code of Conduct and other internal Company rules, regardless of the hierarchical level of the person involved; 

(ii) reports of non-compliance with applicable laws and/or regulations in any jurisdiction or location where 4kst conducts its business; 

(iii) any reasonable suspicion of violations or non-compliance with the rules mentioned in items "i" and "ii" above; 

(iv) any questions related to the compliance of actions by managers, representatives, and other employees of 4kst in conducting business and representing the Company and in their relationships with third parties; and 

(v) situations in which there is a potential or actual conflict of interest, whether arising from internal or external actions, personal relationships, or any other circumstances that may compromise objectivity and integrity. 

Users who submit a report to the Channel are not required to hold or attach any type of evidence or document to prove the reported fact or suspicion. The Channel is available for the registration of information in good faith. Upon receipt of the report, the 4kst Treatment Group is responsible for conducting the necessary analysis and investigation to verify the accuracy of the reported facts and define the appropriate measures. Any and all complaints and/or communications submitted to the Channel will be analyzed by the Handling Group, which, before closing the report, must register a response to the user on the platform.

 

5. Secrecy and Confidentiality

4kst guarantees absolute secrecy and confidentiality for all information and data received and processed through the Channel, as well as the identity of its user(s)/reporter(s).

5.1. Anonymity and Monitoring  

Users who submit a report have the option to identify themselves or remain anonymous. 

In the case of an anonymous report, the user will receive a protocol number. This number is the only way to access the platform so that the user can monitor the handling and status of their report, as well as to respond to any additional questions that may be requested by the Handling Group. 

As the Channel tool is an outsourced service, 4kst and/or the Treatment Group has no means of tracking the identity of anonymous users. 

5.2. Sole Custody and Restricted Access  

The principle of confidentiality is ensured by strictly restricting access to information and observing the following premises: 

(i) all documentation comprising the subject matter of the report, as well as the documents produced by the Treatment Group during the analysis and investigation, shall remain under the exclusive and protected custody of the members of the Treatment Group; and 

(ii) No 4kst employee outside the Channel Handling Group, regardless of their hierarchical level, may have access to information and documents related to any report. 

(iii) On an exceptional basis and when strictly necessary, the Treatment Group, by decision of all its members appointed to handle a particular report, may share the information reported with 4kst managers or third parties (e.g., police authorities or the Judiciary). Such sharing may only occur when there is an essential need to resolve the case, to continue the investigation, or to apply appropriate disciplinary measures and/or penalties.

 

6. Access to the Channel 

The The 4kst Whistleblowing and Communications Channel is available on an ongoing basis, with easy access for internal and external audiences in general via the website at: https://4kst.ai/ 

Exclusively for 4kst employees, access to the Channel is also available on your Intranet.

 

Whistleblowing and Communications Policy – version 1.0
Published on January 23, 2026