CONSENT FOR DATA PROCESSING: FACIAL BIOMETRICS REGISTRATION Dear fan, In order to complete the ticket purchase and access the stadium, FLAMENGO collects your personal data, especially your facial biometrics, linking the fan to the ticket for the purposes of ensuring the integrity of the purchase process, minimizing attempts of fraud, theft, robbery and other unlawful acts (ticket cloning, irregular resale by scalpers, etc.), promoting convenience, speed and safety for the fan experience when accessing the stadium, and ensuring the correct correlation between buyer/holder, payment and stadium access, which results in the integrity of the process. All fans who acquire tickets sold by FLAMENGO – including those covered by free-admission programs – must have their facial biometrics registered for the same purposes described above, and the data processing is based on the following legal grounds, under Law No. 13.709/2018 – General Data Protection Law (LGPD): • Legal or regulatory obligation for individuals aged 16 (sixteen) or older, under the LGPD, as described in its Article 7, item II, in order to comply with Article 148 of Law No. 14.597/2023 (General Sports Law). • Consent of the legal guardian in the case of minors under 16 (sixteen) years old (Article 7, item I of the LGPD). Notes: • Data processing may exceptionally occur even without the data subject’s consent, in cases where it is indispensable to comply with a legal or regulatory obligation attributed to FLAMENGO or to FLAFLU Serviços, administrator of MARACANÃ, or upon request from a legitimized Public Administration body, for the execution, by the public administration, of public policies provided for in laws or regulations (Article 11, item II, points “a” and “b” of the LGPD and the General Sports Law). • Two of the implicit benefits of linking facial biometrics to the ticket are the improved quality of fan support operations at the stadium (for example, in occasional or fortuitous cases where a fan’s access to the stadium is not released, the support team can – significantly faster – confirm the validity of the ticket and its link to the fan; consequently, minimizing dissatisfaction in the fan experience during events) and faster operational readiness in adverse and/or more extreme situations that generate unwanted risks – especially to minors; that is, the quicker and easier identification of a given fan – naturally, by an authorized person – can make a difference if the fan is exposed to danger, especially in the case of children and adolescents (for example, minors who get separated from their guardians or fans who suffer accidents inside the stadium). How it works: Facial biometrics registration is carried out through our commercial partner BE PASS, which provides a platform dedicated to the collection and storage of biometrics. FLAMENGO fan members (sócio torcedor) already have a data registration managed by our commercial partner FENG; all others create a registration to enable the ticket purchase, which is managed by our commercial partner FUTEBOL CARD; thus, through this registration, anyone whose facial biometrics have not yet been collected is directed to the biometrics registration platform, managed by our partner BE PASS, where collection and storage take place. For each collection, a secure access code (hash code) is generated and automatically linked to the CPF of the holder of the ticket purchased on the FUTEBOL CARD platform. This registration database is sent to the turnstile access system of the stadium where the sporting event will be held, through system-to-system sharing, close to the event date. The commercial partner responsible for managing the turnstile access systems at MARACANÃ is TI CONSULTING, which operates under the management of the stadium’s administrator group, FLAFLU Serviços – under the terms of the concession signed between the State government and the football clubs Flamengo and Fluminense. When the fan arrives at the turnstile, the system releases access upon confirmation of the fan’s identity, the validity of the ticket and the correct “ticket-holding fan x ticket” link. FLAMENGO keeps the registered data in its databases for different periods, depending on the personal data: identification data of fan members – including the facial biometrics of those who have purchased tickets after the implementation of the collection – remain in the databases as long as the individual’s bond with FLAMENGO as a fan member exists, and for additional months if the bond is terminated, considering their consent for possible campaigns to win back former fan members. Fans who purchase tickets but do not qualify as fan members have their data stored in our databases for a period of 12 (twelve) months from the last ticket acquisition – paid or free – except for data that may be required for accountability purposes provided for by laws or regulations, such as labor and tax demands, etc., when such periods are established (employees who purchase tickets, for example, will have their data kept in FLAMENGO’s databases due to labor regulatory demands). By law, you have the right, at any time, to: • Obtain information about which of your data we collect; • Change and correct your data; • Deny or revoke consent previously given for the processing of your data. Please note that this measure may make it impossible to offer some of the services we currently provide to you, depending on the request. • Request anonymization, blocking or deletion of data if you do not want your personal data to be exposed in any way. This will be possible as long as there is no law or regulation preventing us from doing so. In addition, deletion may make it impossible to provide the service, depending on the request. • Request portability of your data to another Club. We never expect you to change teams. But if that ever happens, we will do our part! • Be informed of the partners and third parties with whom FLAMENGO shares your data. Fulfilling all your rights is our commitment at FLAMENGO and under the LGPD. As part of this commitment, we provide below the communication channel FLAMENGO offers to its data subjects: the DATA SUBJECT PORTAL (PORTAL DO TITULAR). Through the PORTAL, you can open requests and exercise any of the rights listed above, in direct contact with the Club’s Personal Data Officer, so that they can respond to your requests: • Through Flamengo’s main website: https://flamengo.com.br/privacidade, click on Portal do Titular. • Through the Sócio Torcedor (fan membership) website: https://nacao.flamengo.com.br/aviso-de-privacidade, click on Portal do Titular. • We also provide a QR Code for immediate access from your mobile device. Personal data is generally provided by data subjects who become Club members, fan members, affiliates, customers of the stores or of our TV, employees, suppliers, service providers, journalists or visitors to the Club’s headquarters or the Museum. In general, we hold name, CPF/RG/foreigner identification, date of birth, gender, telephone, e-mail, address, bank or credit card data – for payment processing, signature – where applicable, photo, ID photo and facial biometrics, when confirmation of ownership is required to provide services to the data subject, sell tickets securely to the buyer and enable access to the Maracanã stadium or to the Club, Training Center or other FLAMENGO facilities, or in the case of ticket purchases for Maracanã – when the sale is carried out by FLAMENGO. In the case of employees and third parties allocated at FLAMENGO facilities, in addition to the data already described above, we also collect the work record card, PIS/PASEP, dependents’ data, pre-employment, periodic and dismissal medical exams, medical certificates, and we may also request medical reports (persons with disabilities, workplace accidents, etc.). In the acquisition of goods and services, we occasionally request contact or asset data of partners of bidding companies, in addition to commonly obtaining contact data of representatives in bidding processes (name, telephone, position and e-mail), standard practice in Purchasing transactions. Due to the nature of Flamengo’s activities, the purposes of personal data processing are diverse. The main ones, primarily necessary to enable FLAMENGO’s operation as an organization, are described below: • Employees: hiring, periodic exams, transfers, promotion, salary payment, technical/legal verification, accountability to the Public Administration. Applicable legal basis: compliance with a legal or regulatory obligation (CLT, PCD, NRs, PCMSO, e-Social, Civil Code, etc.); • Third parties allocated at the facilities: registration of allocated third parties for the management and control of contracts and outsourced labor, security and facility access control, compliance with technical and operational standards and compliance with labor regulations. Applicable legal bases: performance of a contract or preliminary procedures and/or compliance with a legal or regulatory obligation (CLT, PCMSO, various NRs, Civil Code, etc.). • Club members / fan members: admission of the membership contract, member registration for card issuance, payment and billing control, invoicing, controllership, frequency of access to facilities or sporting events, management of space rentals, granting of member benefits and confirmation of the ownership of applicants or ticket buyers. Applicable legal bases: performance of a contract or preliminary procedures. Compliance with a legal or regulatory obligation (General Sports Law, in the case of matches at the Maracanã stadium). • Visiting public – Club headquarters, Training Center, Museum, etc.: control of people entering and leaving the facilities who attend occasionally for professional or recreational activities, occasional registration for receiving purchased products or services, offers or news – if of interest to the visitor – and confirmation of the ownership of applicants or ticket buyers. Applicable legal bases: performance of a contract or preliminary procedures, protection of life (emergency access by healthcare professionals), consent (summer camps, visiting schools, etc.) and/or compliance with a legal or regulatory obligation (court officers, legal protocol, etc.). We do not rent, sell or share personal data without the knowledge and prior authorization of the data subject. If you have questions about any authorization you may have given, access the DATA SUBJECT PORTAL and request clarification. In general, personal data sharing occurs with the various commercial partners that sponsor, are licensees of FLAMENGO and/or provide services in FLAMENGO’s operations, whether at the HEADQUARTERS, Training Centers or the Maracanã stadium. As these partners change regularly – and within a few months, given that the terms of these contracts do not coincide – we mention some examples and remind you that, through the DATA SUBJECT PORTAL, you can find out who our current partners are: just open a request! • Tickets: FLAMENGO hires the services of a ticketing company that sells tickets for FLAMENGO. In 2025, we started a partnership with FUTEBOL CARD. Thus, ticket buyers’ data is shared with this partner, including that of fan members; • Facial Biometrics: the registration and safekeeping of the facial biometrics used for ticket purchases and access to the Maracanã stadium are handled by another partner, a specialist in this type of service. As of March 2025, BE PASS is the partner responsible for this service for FLAMENGO. • Professional Football Sponsors: in August 2025, FLAMENGO announced Betano, which joined the group of sponsors: Adidas, Shoppe, BRB, Assist Card, Brahma, Zé Delivery, sócios.com, Texaco, Rede D’Or, Shell, Estácio, Vale, Ortobom, Betano, Wap, Axia Energia, Advanced Recovery and Hapvida. Depending on the type of sponsorship, the databases and commercial or business transactions involving campaigns, products and services covered by the agreements need to be shared, for purposes of contract performance, accountability, revenue accounting, among other reasons related to the sponsorship agreement. NOTE: FLAMENGO’s partner organizations are aware of and commit to the Club to respect, under the terms of this document and of our internal guidelines, the protection and privacy of your data, under the LGPD or other related laws, national or foreign, depending on their applicability. FLAMENGO uses cookies to facilitate navigation, adapt pages to your interests and needs and compile information about the use of our websites and services, to speed up users’ future activities and experiences on our pages and to indicate FLAMENGO’s pages on the websites the user has visited. FLAMENGO may share this information with third parties and commercial partners. You can (and should) choose which types of cookies may be used, among those not essential for navigation. See the difference between them: • Necessary (essential): help understand how visitors interact with FLAMENGO’s pages, providing information about the areas visited, the time spent on the website and any problems encountered, such as error messages. • Functional: allow FLAMENGO’s pages to remember your choices in order to provide a more personalized experience. They also allow users to watch videos and use social tools, comment fields, forums, among others. • Analytical and/or performance: provide statistical information about our website – they are used to measure and improve performance. This category is also known as Analytics. Activities such as page visit counts, page loading speed, bounce rate and technologies used to access our website are included in this category. NOTE: FLAMENGO stores a cookie on your device to remember your choice in the next session, and the user may revoke their consent regarding cookies whenever they deem appropriate. Warning: if the user does not accept some cookies from FLAMENGO’s pages, certain services may not work optimally. Third-party analytics are used to track and measure website usage, enabling the continued production of engaging content. These cookies may track items such as the time you spend on the website or the pages visited, which helps us understand how we can improve the websites for you. Periodically, new features are tested and subtle changes are made to the way the website is presented. These cookies may be used to ensure that you receive a consistent experience while browsing, while FLAMENGO learns which optimizations our users appreciate most. FLAMENGO adopts technical and administrative measures to prevent privacy incidents and requires the same practice from its partners. It has a dedicated area within its organization for this matter, invests in training and awareness, and invests in information security resources. Any information about a data subject will be collected and stored in accordance with the security standards recommended by the market and will not be made publicly available, provided or sold under any circumstances. Unless there is a legal or judicial determination or prior authorization from the data subject, personal data will not be transferred or used for purposes other than those FLAMENGO previously communicates to the data subject, obtaining their consent. The transfer of personal data to other countries may only be carried out by FLAMENGO if the procedure meets the requirements of Article 33 of the LGPD, in particular its first item, which states that the country or territory in question or the international organization concerned must ensure an adequate level of protection of the user’s data. Otherwise, when genuinely necessary, FLAMENGO will make every effort to protect the data with the utmost rigor, using contractual clauses, global standards or regularly issued seals, certificates and codes of conduct. We have some service providers, such as AWS, Google and Microsoft, that keep their Data Centers outside the country, but we strive to use them in countries that have privacy agreements with Brazil or that have specific legislation on privacy and data protection. The Data Protection Officer, or simply DPO, of Clube de Regatas do Flamengo is represented by the external law firm TERRA ROCHA ADVOGADOS, with Dr. WILLIAM LIMA ROCHA, registered with OAB/RJ under No. 75.214, appointed to the role. He can be reached by opening a request on the DATA SUBJECT PORTAL. His direct contact e-mail is [email protected]. However, please note that if your interest is to exercise the rights provided for by Law, the correct service channel is the Data Subject Portal (Portal do Titular). Through the direct e-mail, the DPO may respond to data subjects on matters directly related to the Law that do not involve the exercise of rights – those require opening a request on the Data Subject Portal. For the Club’s operations, such as registration, ticket purchases, payment slips, membership cards, etc., we ask the data subject to use the communication channel of the area that provides the service to the data subject.