We, at Digiteam, are committed to the privacy and protection of your personal data and, therefore, we present our Privacy Notice (Notice), in accordance with the General Law for the Protection of Personal Data (LGPD).

Through this Notice, we inform you how we collect, use, process and disclose your personal information and data, in conjunction with your access to and use of the Platform.

Before accessing and using the features of the Platform, we ask you to read and understand this Notice.

We are available to clarify your doubts, receive feedback or complaints through the following email: privacidade@digiteam.cloud.

What information you will find in this notice

1. IMPORTANT CONCEPTS FOR THIS NOTICE

2. TO WHOM DOES THIS NOTICE APPLY?

3. WHO IS RESPONSIBLE FOR THE PROCESSING OF PERSONAL DATA?

4. HOW DO WE PROCESS YOUR PERSONAL DATA?

4.1. Data collected for registration

4.2. Data collected from the Field Agent

4.3. Data collected indirectly

4.5. Veracity of the data

5. HOW WE SHARE YOUR DATA

5.1. Business Sharing with Digiteam

5.2. International Data Transfer

6. LINKING TO THIRD-PARTY WEBSITES/PLATFORMS

7. HOW WE PROTECT YOUR DATA

8. KNOW YOUR RIGHTS AND HOW TO EXERCISE THEM

9. HOW LONG DO WE STORE YOUR DATA?

10. GENERAL PROVISIONS

11. DATA OFFICER

1. Important concepts for this notice

• Field Agent: An individual, an employee of the Company, which is managed through the Platform’s integrated mobile application.
• Anonymization: Process by which the personal data collected becomes files stored by the Controller in which it is impossible to identify to whom such data belongs.
• ANPD: National Data Protection Authority, a public administration body responsible for ensuring, implementing, and supervising compliance with the LGPD throughout the national territory.
• Controller: The person responsible for decisions regarding data processing.
• Personal Data: Information that identifies a natural person, such as: e-mail, CPF, telephone and address.
• Sensitive Personal Data: Personal data about racial or ethnic origin, religious conviction, opinion, membership in a union or organization of a religious, philosophical or political nature, data related to health or sex life, genetic or biometric data.
• Demands: Services distributed and monitored by the Platform for Field Agents.
• Company: Legal entity that hires the Digiteam Platform for the management of its external teams.
• IP: The IP address is the code assigned to a terminal of a network to allow its identification, defined according to international parameters.
• LGPD: General Law for the Protection of Personal Data, Law No. 13,709/2018, which governs the processing and protection of data.
• Operator: Who performs the data processing according to the Controller’s guidelines.
• Data Processing: Any operation carried out with personal data, such as those referring to the collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, elimination, evaluation or control of information, modification, communication, transfer, dissemination or extraction.
• Platform, ‘Type’ or ‘Type-On Platform’: Software as a Service that is licensed, by contract, for use by the Company.
• Users: Those who represent the Company, called ‘Administrators’ of the Platform.
• Software as a Service (SaaS): The modality of distribution and commercialization of software.

2. To whom does this notice apply?

Below, we describe to whom you are subject to the rules of this Notice.

This Privacy Notice (Notice) applies to Users who access, administer and manage the functionalities of the Platform.

3. Who is responsible for the processing of personal data?

DIGITEAM TECNOLOGIA LTDA. (DIGITEAM) , registered with the CNPJ under No. 07.821.585/0001-50, headquartered at St Bancario Sul Quadra 02 Bloco E, número 12, Complemento Salas 402 à 406, Asa Sul, Brasília – DF, Cep: 70.070-12, owner of this Platform, assumes the role of Controller of personal data only in relation to the personal data of the Company’s representatives, necessary for the contractual relationship and provision of services.

Digiteam is the Operator of the processing in relation to the data of third parties, entered into the Platform by its Administrators. In this sense, the processing will be carried out based on the decisions of the Company, Controller of the data of their respective employees, suppliers and/or service providers who use the Platform.

4. How do we process your personal data?

Below, we describe how we process your data, detailing the purposes and legal bases that justify this processing.

4.1 Data collected for registration

For the registration of Users on the Platform , their name, e-mail and CPF (optional) will be collected.

4.2 Data collected indirectly

Digiteam may collect data indirectly during the User’s navigation, such as IP address, session, date and time stamps of actions, device/browser, activities on the Platform.

In addition, access logs, a set of information regarding the date and time of use of a given internet application from a given IP address, are collected, under the terms of Law No. 12,965/2014 (Civil Rights Framework for the Internet), and article 7, II, of Law No. 13,709/2018.

4.3 Purposes and legal bases of the processing of personal data

The personal data processed by Digiteam will only be used to meet the following purposes:

Data collected	Purpose of processing of data	Legal basis
Full name Email	For registration and identification of the Administrator User on the Platform.	– Contract execution and preliminary procedures (art. 7, V, LGPD)
IP address, User session, timestamps of actions, device/browser, the User’s activities on the website.	Collect information to identify and protect Users, as well as to comply with legal obligations.	– Legal or regulatory obligation of the Controller (art. 7, II, LGPD) – Comply with the Civil Rights Framework for the Internet (art. 15); – Legitimate interest of the Controller (art. 10, LGPD

4.4 Veracity of the data

The User is responsible for the veracity or inaccuracy of the same in relation to his/her personal data and the personal data of his/her dependents.

Digiteam is not obliged to process or process any data provided by the User if there are reasons to believe that the processing may cause a violation of any applicable law or that the User is using the Platform for purposes that are illegal, unlawful or contrary to the Notice.

5. How we share your data

Digiteam shares only the data necessary for the provision of the services offered by the Platform to be possible.

In this sense, Digiteam may share data with contracted companies so that the functionalities are available, which may process personal data as processing Operators.

Thus, they may have access to the personal data of Users:

• Comtele, for sending SMS online;
• Zendesk, for internal organization;
• AWS, for cloud storage;
• Azure, for single sign-on protection and cloud storage.

In addition to the companies mentioned above, Digiteam may share personal data, such as legal advice, employees, specific service providers, in order to enable the good performance of the Services.

Digiteam’s contracts value the secure treatment of the User’s information.

In addition, from the moment these third parties have access to the shared data, they will be responsible for the processing and security of this data, and cannot carry out its processing for any other purpose, as well as to comply with the applicable Law and under the terms of this Notice.

5.1 Business Sharing with Digiteam

Companies will be able to share with Digiteam personal data of their customers and employees. In this case, Digiteam acts as the Data Operator, while the Company will be the controller, therefore, it must define the purpose and legal basis for the processing of this data.

Thus, the responsibility for making essential decisions about the processing of data and compliance with the rights of the holders (employees and customers) is the Company’s duty, since it provides the data to Digiteam.

5.2 International Data Transfer

Digiteam may, up to the limit allowed by the LGPD, share the data outside Brazil.

This international transfer occurs when we use cloud services for data processing or storage, so that we can perform our services in the best way, in a secure environment.

In doing so, Digiteam will take all appropriate measures to ensure that your data is treated and shared securely and in accordance with current legislation and this Privacy Notice.

6. Links to Third-Party Websites/Platforms

The Platform may, from time to time, contain links to third-party websites/platforms, such as partners, advertisers, and affiliates. When following a link, it is important to note that these websites/platforms have their own privacy notices and policies and that Digiteam is not responsible for these documents.

Digiteam recommends checking these notices and policies before submitting any personal data to these websites.

7. How we protect your data

Digiteam is committed to the security of all its Users and, therefore, adopts physical, electronic and administrative procedures that ensure the privacy and security of your data, with technical measures compatible with international standards and the use of good practices, according to the measures suggested by the National Data Protection Authority (ANPD).

To ensure that the data is stored in a secure environment, Amazon Web Services (AWS) servers are used, which implies an international transfer of personal data to the country where this server is based, in the United States of America.

Whenever possible, your data will be treated anonymously, that is, it will not be possible to identify it in the set of data we are processing.

All technologies used and employed by Digiteam will always comply with current legislation and the terms of this Privacy Notice.

8. Know your rights and how to exercise them

Access and confirmation of treatment. You can request Digiteam to access the complete list of data collected and processed, as well as confirmation of the processing of your personal data.

Correction of personal data. You can request Digiteam to correct data that is incomplete, inaccurate, or outdated.

Anonymization, blocking, or deletion. All data collected and processed by Digiteam is for the purpose of providing services and the good performance of the Platform.

If you believe that any of your data is being processed unnecessarily, in excess or the processing is not in compliance with the LGPD, you may request anonymization, blocking or elimination, if you prove that there was excess, unnecessity or non-compliance with the LGPD.

Information about sharing. You can ask Digiteam for information about our partners and suppliers with whom we share the data.

We have already verified and all our partners are also concerned about your security, and take appropriate measures to protect your data.

Automated decisions. You may request the review of decisions made solely on the basis of automated data processing and the criteria used in these decisions, always observing Digiteam’s commercial and industrial secrets.

Data portability. You may request the portability of your personal data to another provider of the services provided by Digiteam, in compliance with the provisions of the LGPD.

To exercise any of your rights as a Data Subject, please contact Digiteam via email privacidade@digiteam.cloud.

9. How long we store your data

The data provided by the User on the Platform will be stored and processed for a retention period of up to 2 (two) years from the end of the contract, according to Digiteam’s Security Management Plan.

If the User wishes, he can request the deletion of his account and his personal data, through the e-mail suporte@digiteam.cloud.

In the event of a request for deletion or termination of the purpose of processing, the User will have all his/her data permanently deleted, except for data whose maintenance is mandatory by law or regulation, or necessary for the regular exercise of rights in judicial, administrative or arbitration proceedings.

10. General provisions

Digiteam informs that, at any time, unilaterally, it may modify/update this Notice. If this happens, the User will be notified and the updated version will be valid from its publication.

The User’s continued access or use, after the update is disclosed, will confirm the validity of the new Privacy Notice by the Users.

In addition to this Privacy Notice, Digiteam has its Terms and Conditions of Use, which define the conditions of use that will govern the use of the Platform. These terms are inseparably part of this Privacy Notice.

11. Data Officer

Digiteam has a person in charge of processing personal data, under the terms of article 41 of the LGPD, who is responsible for accepting complaints and communications from the holders and the National Data Protection Authority, providing clarifications and adopting measures.

If you have any questions, complaints, or concerns about any matter of this Notice, please contact our person in charge:

Barbara Barbosa

Person in charge of the processing of personal data at Digiteam

barbara@digiteam.cloud

We are also available to clarify your doubts, receive feedback or complaints through the following email: privacidade@digiteam.cloud