• What (description of the irregularity)
• Who (people reported, victims, witnesses, people involved)
• When (or since when) it happened or has been happening
• Where (property, refinery, platform, building)
• Why (motivation, cause – if known)
• How much (where applicable)
• Evidence (if any)

All information is received by Contato Seguro, an external, independent company specialized in receiving reports.

After the report is received, Contato Seguro will forward the information, with a guarantee of anonymity, to Petrobras Ombudsman's Office for treatment and forwarding to the areas responsible for the investigation.

Anonymity is guaranteed both online and by telephone, since there is no sharing of the IPs of the whistleblower's computers or tracking of calls.

If you choose to remain anonymous, do not provide details in the report that could reveal your identity.

1. The report is received by Contato Seguro, always with guarantee of anonymity, and forwarded to the Ombudsman Office;
2. The Ombudsman Office analyzes the report and requests additional information from the whistleblower, if necessary for the investigation, always preserving anonymity;
3. The Ombudsman Office forwards the report to the area responsible for investigating the type of report in question (fraud/corruption, violence at work, environment, etc.)
4. The area investigates the report and forwards the result to the Ombudsman Office ;
5. The Ombudsman Office analyzes the result and responds to the complainant;
6. In case of confirmation of irregularities, corrective actions are applied.

Reports that do not fall under the “report” category are reclassified (as Complaints, Suggestions, Praises, or Requests) and are also dealt with.

When the defendant is an employee of a service contractor, a situation in which there is no direct contractual relationship between Petrobras and him, the facts are verified by the contracting company of the accused person. In these cases, the Ombudsman's Office reports the facts to the contractor, through its contract manager or inspector, and it is up to that company to verify the truth of the report.

Reports involving incidents of interaction between people (physical, sexual, and psychological violence) can only be investigated when the report makes clear who are the people involved (agent of the aggression, target of the aggression).

Reports that require, in order to be dealt with, the identification of the person mentioned in the report as a victim will be dealt with the authorization of the victim. However, when there is no authorization, but the person indicated in the report as the victim has already been identified, the Ombudsman, in accordance with article 32 of Ordinance 581 of the CGU, will forward the complaint for a pseudonymized investigation. If necessary, the field responsible for the investigation may request from the Ombudsman the identification elements of the whistleblower or the victim, which will be immediately available.

Anonymous reports from third parties will be accepted as long as the name of the person who was the target of the attack and their contact details are indicated in the report, since the Ombudsman will contact that person, indicated as the victim, in search for information and the confirmation of the narrated facts

Reporting irregularities is a duty of Petrobras employees. Acts that threaten or cause harm to the whistleblower will be treated as non-compliance.

If the whistleblower believes that they are suffering retaliation, they must file a new report describing this situation.

The legal basis for the processing of Personal Data collected in the reports is compliance with the legal obligations to which Petrobras is subject;

Your personal data, including the facts reported in the exchange of communications with Petrobras, will be used by the company exclusively for the investigation of the report and may, when necessary, be known to the parties related to the report (the person reported, witnesses, investigation team, managers, and professionals directly linked to the process of dealing with the report and its possible consequences).

Since it is subject to control by the supervisory bodies, such as the Federal Court of Accounts and the Office of the Comptroller General, as well as to the Access to Information Act and the needs arising from the processing of lawsuits, Petrobras may be required to share the information contained in the reports, including Personal Data and Sensitive Personal Data. Whenever possible, mechanisms will be adopted to anonymize and pseudonymize this data, in order to preserve the privacy of those involved in the report as much as possible.