The Governance Secretariat autonomously and impartially provides direct support to the governance system across the board by managing the flow of information and integrating deliberative (general assembly and advisory board), executive (president and other directors), supervision (fiscal board, audit committee, audits), and advisory (committees) instances.

The fact that Dexco’s advisors participate in other companies’ boards may raise the issue of overboarding. We believe this factor is not relevant within the organization’s corporate governance, as we adhere to the highest governance standards in our procedures, with statutory advisory committees to the Board. Additionally, we ensure through the diversity of knowledge present in its technical team that Dexco’s Board members exhibit strong attendance at meetings, demonstrating that they are adequately qualified and prepared for the company’s strategic decisions.

It is also important to highlight that the advisors’ participation in forums and the monitoring of individual performances aim to ensure strategic alignment and the optimization of the holding company’s resources with its subsidiaries. These efforts are essential to ensuring long-term success and value creation for all stakeholders.

Secretariat of the Advisory Committees of the Board of Directors

• Audit and Risk Management Committee
  • Secretary: Paula de Araújo Lima – Executive Manager of Internal Audit, Risk, and Compliance

• People, Governance and Nomination Committee
  • Secretary: Glizia Maria do Prado – Director of People

• Sustainability Committee
  • Secretary: Guilherme Setubal Souza e Silva – Director of Investor Relations, Institutional Relations, and ESG

• Related-Party Committee
  • Secretary: Francisco Augusto Semeraro Neto – Director of Administration and Finance

• Strategy and Digital Transformation Committee
  • Secretary: Elisa Megumi Shimao – IT Director

• Finance Committee
  • Secretary: Roberta Mira – Executive Manager of Treasury

The Company carried out its first Materiality study in 2019, when its first Integrated Report was published. The study conducted focused on communication with stakeholders, with the aim of guiding a clear and objective presentation of the value creation strategy in the short, medium, and long terms. The study was conducted using institutional documents – such as guidelines from the Business Divisions and corporate strategies – and sectoral ones, identifying central themes to be considered for prioritization. Also, in-depth interviews were conducted with strategic audiences, seeking perceptions of how we manage issues related to socio-environmental aspects and Corporate Governance. Priority topics were also presented to the Executive Board and Board of Directors, so that they could be validated, considering the maturity of our management instruments, the sectoral context in which we operate and other elements of the company’s strategic planning.

The result of this first analysis defined the following material topics: Adequate business environment; People who transform; Responsible processes and Sustainable solutions. Within each of the pillars, themes were determined according to priority levels, such as high, medium, and low.

• High Priority: Ethics and Compliance, Health and Safety; Supply chain; Professional training and Environmental performance;
• Medium Priority: Innovation and digitization; Cash generation and funding; Forest Management and Environmental Solutions;
• Low Priority: Diversification of the business portfolio; Diversity; Local Development; Environmental education; Climate change and eco-efficient solutions.

In 2022, understanding it to be a good practice, Dexco revisited its materiality matrix, so that the material was more aligned with the current reality of the Company, which has undergone important changes in recent years. The Company underwent a name change (from Duratex to Dexco), approved its 2025 Sustainability Strategy, launched its second season of culture, and established its Social Responsibility Guidelines. Faced with so many structuring actions, revisiting Materiality was seen as essential for directing the Company’s actions for the coming years.

In this process, in addition to new documental and sectoral analyses, interviews, conversation circles and online consultations were carried out with stakeholders, totaling more than 700 interactions to be considered. As a result of all this effort, 7 material and priority themes were selected that cover a series of relevant sub-themes. This new matrix was approved by the Executive Board in January 2023 and based on it, the Company’s action plans for the coming years will be guided.

Below is a list of Material themes and themes considered Priorities for Dexco:

Dexco, committed to compliance with applicable laws, including the Brazilian Law nº 13,709/2018 (“Personal Data Protection General Law“ – “LGPD“), has formally appointed the person who acts as Data Protection Officer within its Privacy Governance Structure.

The Data Protection Officer (“DPO“) is an designated individual to serve as a communication channel between the Controller (Dexco), Data Subjects (natural persons whose personal data are processed), and the Data Protection National Authority (“ANPD“ – a government agency responsible for overseeing, implementing, and enforcing compliance with the LGPD throughout the national territory).

According to the LGPD, Dexco must appoint a Data Protection Officer who performs the following activities:

I – to accept complaints and communications from data subjects, provide clarifications, and take appropriate actions;

II – to receive communications from the national authority and take appropriate actions;

III – to provide guidance to employees and entity’s third party suppliers regarding practices to be taken in relation to the protection of personal data; and

IV – to perform other duties determined by the controller or established in complementary regulations.

It is important to note that the DPO is supported by the Data Privacy Governance Structure and the Data Protection and Privacy Commission in carrying out their activities, with reporting to the necessary instances.

To contact Dexco’s Data Protection Officer, please reach out via the email channel dpo@dex.co.

Information security is one of the fundamental pillars of Dexco’s digital journey, contributing to the protection of our assets, data privacy, and the resilience of our business in the face of cyber risks. We believe that protecting critical data and information is essential to building trust-based relationships and ensuring the continuity of our operations.

In this context, the oversight of information security issues is carried out at the executive level by leaders who are also responsible for our technology and data protection agenda:

CISO (Chief Information Security Officer) – a role performed by our Infrastructure and Operations Manager, Bruno Roberto de Souza Leão. He is responsible for establishing and maintaining the company’s information security vision, strategy, and program, ensuring the protection of Dexco’s assets and technologies.

CIO (Chief Information Officer) – a role held by our Information Technology Director, Elisa Megumi Shimao. She is responsible for managing Dexco’s information systems and technology infrastructure. While in some companies this role may also encompass information security, at Dexco it operates in a complementary manner to the CISO’s responsibilities.

Dexco’s information security program is based on its Information Security Policy and the implementation of its guidelines in daily activities and projects. Dexco has an internal audit program with periodic independent evaluations that assess the effectiveness of business processes.

For Information Security — which includes a Cybersecurity Internal Audit — we conduct an annual audit of IT and security processes and controls, performed by a certified independent audit firm. Their methodology tests not only the design and implementation of controls, but also the operational effectiveness of our key security measures.

For any findings, the auditor assesses the level of risk associated with each identified issue, and the responsible area must develop action plans to address them. These action plans are monitored by our internal audit team, which tests their implementation at the end of the established deadlines.

Additionally, Dexco has an Artificial Intelligence Governance Standard that establishes guidelines for the responsible, secure, and ethical use of AI-based solutions within the corporate environment. This standard contributes to mitigating risks associated with the use of such technologies, aligning with the company’s governance, information security, and compliance practices.