1. Introduction

This privacy and data protection policy must be read carefully as it explains the policies and practices of the Curimbaba Group in the collection and processing of personal data.

To facilitate the understanding of this policy, we use the terms "we" or "our" to refer to the controller of personal data, ie, the companies in the Curimbaba Group or simply the Curimbaba Group. We use the terms "user", "you", "your" to refer to you, the owner of the personal data: customers, associates, employees, service providers or individuals who interact with our services or our platforms.

2. Purpose

This policy describes our personal data collection activities both online and offline, how we collect data, how and where we store them, and with whom we share them. It also defines how data subjects can exercise their rights.

3. What personal data do we collect from you

• Identification: full name; the number in documents issued by official bodies such as Taxpayer; Identity Card; Driver's License; Passport; Employment Record; Social Integration Program; Voters Certificate; Military Certificate; Birth Certificate; Marriage Certificate or Declaration of Public Stable Union.
• Personal details and demographics: date of birth, place of birth, nationality, age or age group, gender, height, weight, marital status, number of children, dependents, education, photography and parentage.
• Contact details: residential and mailing address, personal landline and mobile phone numbers, personal email, websites and profiles on social networks.
• Professional details: position, function, area, business address, business phone, business email, union membership, health monitoring data, medical exams and certificates, Birth Certificate and Vaccination Card for children and stepchildren, Enrollment Certificate and Attendance for children and stepchildren, Proof of Retirement and legal information.
• Financial details: income, bank (bank, branch and account) and credit score.
• Authentication: username and authentication to access the services provided by the Curimbaba Group including login, password in an irretrievable format (encrypted), and security questions.
• Preferences: information that may describe your habits or behavioral characteristics, including items such as favorite products, hobbies, pastimes, other interests, and family or lifestyle information.
• Equipment: details of the computer or mobile device that was used to access one of our websites, services or applications such as IP address record; geographic location; operating system type and version; web browser type and version, and where allowed, unique device ID and other mobile device information.
• Use of websites and services: information about your actions while interacting with our websites and services through automatic data collection technologies, including details such as which links you click, which pages or content you view and for how long , and other similar information and statistics about your interactions, such as content response times, download errors and duration of visits to certain pages. This information is captured through automated technologies such as cookies (browser cookies, Flash cookies and the like), web beacons, and via third-party tracking. See "Use of Cookies".
• Market research and consumer feedback: information voluntarily shared with the Curimbaba Group about your experience while using our products and services.
• Shared content: content created and shared with the Curimbaba Group on third-party social networks or by uploading content to one of our websites, apps and other online and offline services, including the use of third-party social networking applications such as Facebook, Instagram, LinkedIn and the like. These data include texts, comments, articles, photos, videos, personal stories or other similar content and media involving the dissemination of Curimbaba Group products and services, contests, awards and other promotions, website community features, consumer engagement and thirty-party social media.
• Third-party social networks: data shared publicly on a third-party social network or information that is part of your profile on a third-party social network (such as Facebook, Instagram, Linkedin and the like) and that you allow the third-party social network to share with us. These data may include details such as your basic account information (name; email; gender; date of birth; current city; profile picture; user ID; friends list and similar information) and any other additional information or activities that you allow the third-party social network to share with us. We receive your third-party social network profile information (or parts of it) whenever you download an item or interact with a Curimbaba Group app or web service on a third-party social network, or use a social network feature that is integrated into a Curimbaba Group website or interact with us through a third-party social network.
• Contacts with our Customer Service and Commercial Area: your interactions with our Customer Service and Commercial Area may be recorded or listened to, in accordance with applicable laws, for the operational needs of the Curimbaba Group. Financial and payment details are not recorded. When required by law, you will be informed of such recording at the beginning of your call.
• Sensitive personal data: The Curimbaba Group does not intend to collect personal data considered sensitive, such as: racial or ethnic origin; religious conviction; political opinion; affiliation to a religious, philosophical or political organization; sexual orientation and genetic or biometric data. When there is a legitimate interest or if it is necessary to process your sensitive personal data for any reason, we will obtain your prior, express and formal consent to any processing that is voluntary (e.g.: for marketing purposes). If we process your sensitive personal data for other purposes, we rely on the following legal bases:
  (i) crime detection and prevention;
  (ii) compliance with applicable law.

4. How and where we collect your personal data

• Provided by the data subject: data provided by you to start a commercial and/or contractual relationship.
• Curimbaba Group Websites: all of our websites can be used to collect personal data. This includes both websites that we operate directly through our domains and IP addresses, as well as websites or pages that we set on third-party services, such as Facebook, LinkedIn, and other third parties that offer this type of service.
• Electronic mail and instant messaging systems: services used to maintain electronic communications between you and the Curimbaba Group, including those provided directly by us, or third-party services such as WhatsApp, Telegram, SMS (short message service) and similar services.
• Curimbaba Group Mobile Applications: mobile applications provided directly by the Curimbaba Group or via third-party services such as Google or Apple.
• Customer service and commercial area: communications with you via our service and sales centers.
• Advertisements, publicity and online forms: interactions with any type of Curimbaba Group advertisements, publicity and online forms.
• Offline records: records completed offline, distributed during events and other interactions with the Curimbaba Group.
• Data received from third parties: including, but not limited to, social networks and third-party websites such as, for example, Facebook, Instagram, Linkedin, and the like, data aggregator services, Curimbaba Group partners, public sources and data received in connection with the acquisition of other companies.

5. How we use your personal data

• Legal grounds: your personal data are used in compliance with applicable legal and regulatory obligations in order to comply with provisions such as: keeping records for tax purposes or providing information to a public agency or law enforcement agency; compliance with labor and social security obligations; fulfillment of obligations to combat corruption, money laundering, fraud and irregular conduct in contracts for the provision of services.
• Consumer services: your personal data is used for the purpose of providing services to the consumer such as responding to doubts, inquiries and suggestions. This usually requires certain personal contact information and information about the reason for your inquiry, doubt or suggestion such as what was your order, whether there is a technical issue, product issues or complains and other general inquiries.
• Carrying out marketing actions: with your consent (when necessary according to current legislation), the Curimbaba Group uses your personal data to provide information about products or services such as marketing communications, advertising campaigns or promotions. This can be done through various means of communication, including email, advertisements, SMS messages, phone calls and postal mail (as permitted by current legislation), in addition to our own websites and/or social media sites and third-part networks. The use of your personal data in these circumstances is completely voluntary, which means that you can object to it or even withdraw your consent at any time for the processing of your personal data for these purposes.
• Social networks and third-party websites: we use your personal data when you interact with social network functions and third-party websites by clicking "like" to roll out advertisements and interact with you on third-party networks. You can learn about how these interactions work, the profile data that the Curimbaba Group obtains about you, and how to cancel them by reviewing the privacy policies directly on the respective social networks and third-party websites.
• Fulfillment of your orders: we use your personal data to process and ship your orders, as well as to inform you about the status of your orders, correct addresses, verify identity and to carry out other activities to prevent fraud. This involves the use of certain personal data and, in certain situations, payment information.
• Legal reasons or merger/acquisition: if the Curimbaba Group or its assets are acquired by, or merged with, another company, including due to bankruptcy, we will share your personal data with our legal successors, respecting the requirements of the current legislation. We will also disclose your personal data to third parties:
  (i) when required by applicable law;
  (ii) in response to legal proceedings;
  (iii) in response to an order by the competent legal authority;
  (iv) to protect our rights, privacy, safety or property;
  (v) to enforce the terms of any agreement or the terms of our website, products and services, pursuant to the applicable law.

• Employment contract: your personal data are used for the purpose of the admission procedure and performance of the employment contract, including after its termination, regular exercise of rights in judicial, administrative or arbitration proceedings, hiring transport voucher services, food vouchers, provision of health and dental plans, life insurance, private pension plan, among others.
• Other general purposes and circumstances: according to the current legislation, the Curimbaba Group will use your personal data for other general business purposes such as maintaining your account, conducting internal or market research and measuring the effectiveness of advertising campaigns. We also use your personal data for the management and operation of our communications, IT and data security and protection systems.

6. To whom we disclose your personal data

• Service Providers: these include external companies that are used by the Curimbaba Group to help operate our business and technology companies responsible for the cloud data storage service. Service providers and their selected associates are authorized to access your personal data on behalf of the Curimbaba Group solely for specific tasks that are required of them based on our direct instructions. Our service providers are contractually obliged to keep your personal data confidential and secure, and in cases of breach they are jointly and severally liable in accordance with the current legislation.
• Credit rating, debt collection and financial services agencies: as permitted by the applicable law, credit rating and/or debt collection agencies are external companies that the Curimbaba Group can use to help us verify your credit status or to collect overdue payments.
• Third-party companies that use personal data for their own marketing purposes: except where you have given your specific consent, Curimbaba Group does not license or sell your personal data to third-party companies for their own marketing purposes. If this type of sharing is needed, the identity of these third party companies will be revealed prior to obtaining your consent.
• Third parties who use your personal data for legal reasons or due to merger/acquisition: we will disclose your personal data to third parties for legal reasons or in the context of a merger or acquisition in the Curimbaba Group.
• Regulatory bodies and judicial and governmental authorities: we must provide your personal data in response to a court order, requests from administrative authorities, legal or regulatory obligations, as well as to act collaboratively with government authorities, generally in investigations involving illegal acts.

7. How we protect your personal data

The Information Security Policy of the Curimbaba Group also provides adequate measures to ensure that your personal data is kept confidential and secure. These protections, however, do not apply to information you have chosen to share in public areas such as third-party social networks.

• Persons who can access your personal data: your personal data will be processed by our employees or authorized agents, as long as they need to have access to such information, depending on the specific purposes for which your personal data has been collected. The Curimbaba Group maintains administrative and technical controls to restrict access to personal data, subject to the need for such knowledge. All our employees and associates are instructed to be aware of our privacy and data protection obligations when dealing with personal data.
• Measures taken in operational environments: we store your personal data in operational environments that use reasonable security measures, both technically and administratively, to prevent any type of unauthorized access. We follow reasonable protocols to protect personal data, including firewalls, antivirus software, and physical access control to the datacenter.
• Measures taken in the event of security incidents: in the event of a security incident that may cause relevant risk or damage to the data subject, the Curimbaba Group undertakes to report it, within a reasonable period, to the National Data Protection Authority (ANPD) and to the data owner including details about the nature of the affected personal data and the measures that have been or will be taken to reverse or mitigate the effects of the damage.
• Transfer of your personal data: given the nature of our business, we may have to transfer your personal data stored by the Curimbaba Group to third parties, for example, when we use cloud computing services for data processing or storage, located inside and outside Brazil, in accordance with the purposes established in this Privacy Policy. For this reason, we may transfer your personal data to other countries, as long as they have laws and regulations compatible with those in force in Brazil.

8. How long do we keep your personal data

• We will keep your personal data in our systems for the duration of the contractual relationship between the Curimbaba Group and you, observing the longer of the following periods:
  • As long as necessary for the relevant activity or services;
  • Any retention period required by law;
  • End of the period in which disputes or investigations regarding the services may arise;
  • While your consent is valid, in the applicable cases; and
  • According to the provisions of the current legislation.
• Once the purpose of the processing of personal data is fulfilled, the information will be deleted or anonymized, following the policies of the Curimbaba Group related to the safe disposal of data.

9. What are your rights

You can exercise your rights in relation to your personal data at any time free of charge upon a request to the Personal Data Processing Officer (DPO) using our communication channels. Your rights consist of:

• Obtaining confirmation that we are processing your personal data and requesting a copy of the personal data we hold about you;
• Requesting us to update the personal data we hold about you or to correct data that you believe is incorrect or incomplete;
• Withdrawing your consent granted for the processing of your personal data, as well as requesting its deletion (to the extent that such processing is based on consent);
• Requesting the portability of the personal data we hold about you to another supplier of products or services, provided that commercial and industrial secrets are respected, as well as any applicable confidentiality;
• Obtaining information about who we share your data with;
• Requesting that your personal data that you understand as unnecessary, excessive or treated in disagreement with the LGPD be anonymized, blocked or deleted;
• Requesting a review of decisions made solely on the basis of automated processing of personal data.

10. How to claim your rights

• If you are not satisfied with the way we treat your personal data or with any question or request related to your privacy, you can forward your complaint or request to our Personal Data Processing Officer (DPO) via the following channels:

• You have the right to contact the National Data Protection Authority Brazil, responsible for ensuring the observance of the rights of the owners of personal data in Brazil, by accessing their communication channels.

11. Use of Cookies

Cookies are small text files that can be placed in your computer or mobile device by websites or web services you use. They are used to ensure the proper functioning of websites and other online services, as well as to provide information to the owners of the website or online service.

Cookies are used to improve the use and functionality of the Curimbaba Group's websites and other compatible web services and to better understand how our visitors use our websites and online services, as well as the tools and services they offer. Cookies facilitate the process of adapting the Curimbaba Group's websites to your personal needs, facilitating their use whenever possible, receiving feedback on the satisfaction of our consumers.

The Curimbaba Group uses the following types of Cookies on its compatible websites and services:

• Session Cookies: These are cookies for temporary use, which are deleted when you close your browser. When you restart your browser and return to the website that created the cookie, that website treats you as a new visitor.
• Persistent Cookies: Cookies that remain on your browser until you delete them manually or until your browser deletes them according to the period set by the cookie. These Cookies will recognize your return as a visitor to a Curimbaba Group website or service.
• Performance Cookies: These are Cookies that collect data about the use of the website, such as the pages visited and any error messages; they do not collect personally identifiable information and the information obtained is aggregated anonymously. Performance cookies are used to improve the functioning of the website.
• Functionality Cookies: These are cookies that allow the website to memorize any information introduced by you in the website (such as language, region, changing text size, personalized pages) or enable services such as comments on a blog or to signal that a survey has been completed.

Curimbaba Group's compatible websites and services may also use other tracking technologies similar to Cookies, which may collect information such as IP addresses, log files and web beacons, among others. These data are also used to help us adapt the Curimbaba Group's websites and other compatible services to your personal needs.

• IP address: this is a number used on the internet or a network to identify your computer. Every time you connect to the internet your computer receives an IP assigned by your internet service provider. We may register IP addresses to handle technical problems, maintain the protection and security of our websites and other online services, gain a better understanding of how our websites and other online services are used, and adapt our content to your needs depending on your geographic location. .
• Log files: The Curimbaba Group or a third party working on our behalf may collect information in the form of log files that detail website activities and collect statistics about a user's browsing habits.
• Web beacons: we may use web beacons (or transparent GIFs) on the Curimbaba Group websites. Web beacons (also known as web bugs) are small sequences of codes that allow us to deliver a graphical image to a web page for the purpose of transferring data back to us. We use information from web beacons to understand how a user responds to email campaigns, to report traffic from our supported sites and services, and to perform unique visitor counts, email and advertising, auditing and reporting, to personalize our websites and for other compatible services.

It is important to remember that it is up to you to ensure that your computer or handheld device settings reflect whether or not you consent to accept Cookies.

Most browsers allow you to set rules to warn you before accepting Cookies or simply rejecting them. You do not need to have Cookies enabled to use or browse most of Curimbaba Group's websites and online services, however, in this case we cannot guarantee that you will be able to access all of its features. We recommend that you refer to the"help" icon in your browser to adjust these settings. Remember that if you use different browsers, or even different computers and/or handheld devices in different locations, you will need to ensure that each device and browser is set to your personal Cookies preferences.

As our web beacons can be part of a web page, it is not possible to opt-out of this type of feature, but you can make it completely non-functional by enabling "opt out" for the cookies placed by this beacon.

12. Policy Changes

This policy will be updated every time the Curimbaba Group makes changes in the way how your personal data are processed. We reserve the right to make changes to our practices and this policy at any time, as long as we maintain compliance with the current legislation.

We encourage you to visit our website frequently, or whenever you have questions, to be aware of any updates or changes made to our Privacy Policy.