We, at Dersalis, value the privacy of our customers and users and created this Privacy Notice, in accordance with Law no. 13,709/2018 – General Data Protection Law and other laws on the subject, to demonstrate our commitment to protecting the privacy and personal data of all natural persons with whom we interact in some way, as well as describing how your data are processed and protected by Dersalis when collecting, processing and storing personal information. By using or accessing our Services in any matter, you agree to the practices and policies described in this Privacy Notice, so please read it carefully as it explains how we collect your data, how we use it and with whom we disclose it. This Notice incorporates the Cookies Policy, and the documents must be read together.

1. Glossary

For the purposes of reading and interpreting this document, the terms listed will have the following meanings:

• Processing agents: the controller and the operator;
• Anonymization: use of reasonable technical means available at the time of processing, through which data loses the possibility of association, directly or indirectly, with an individual;
• National Data Protection Authority (ANPD): public administration body responsible for ensuring, implementing and monitoring compliance with this Law throughout the national territory.
• Database: structured set of personal data, established in one or more locations, in electronic or physical format;
• Consent: free, informed and unequivocal expression by which the holder agrees to the processing of their personal data for a specific purpose;
• Controller: natural or legal person, governed by public or private law, who is responsible for decisions regarding the processing of personal data;
• Cookies: Cookies are small files created by visited websites and which are saved on the user's computer through the browser. These files contain information that serves to identify the visitor, either to personalize the page according to their profile or to facilitate the transport of data between pages on the same website.
• Anonymized data: data relating to the holder who cannot be identified, considering the use of reasonable technical means available at the time of processing;
• Personal data: information related to the identified or identifiable natural person;
• Sensitive personal data: personal data on racial or ethnic origin, religious conviction, political opinion, membership of a trade union or organization of a religious, philosophical or political nature, data relating to health or sexual life, genetic or biometric data , when linked to a natural person;
• Elimination: deletion of data or set of data stored in a database, regardless of the procedure used;
• In Charge (or Data Protection Officer): person appointed by the controller and operator to act as a communication channel between the controller, data subjects and the National Data Protection Authority (ANPD);
• Operator: natural or legal person, governed by public or private law, who processes personal data on behalf of the controller;
• Holder: natural person to whom the personal data that is subject to processing refers;
• Processing: any operation carried out with personal data, such as those relating to collection, production, reception, classification, use, reproduction, transmission, distribution, elimination, modification, communication, transfer, dissemination, extraction, evaluation or control of information, access, processing, archiving or storage.
• International data transfer: transfer of personal data to a foreign country or international organization of which the country is a member;
• Shared use of data: communication, dissemination, international transfer, interconnection of personal data or shared processing of personal databases by public bodies and entities in compliance with their legal powers, or between them and private entities, reciprocally, with specific authorization, for one or more treatment modalities permitted by these public entities, or between private entities.

2. Data collected, method of collection and purpose

When you interact electronically or physically with Dersalis, we may need to receive or collect information about you. We collect as little data as possible to achieve our objectives and only use data for the purposes for which it was collected. In general, we collect, use, store and process your personal data to make the delivery of our services possible, as well as to maintain and improve our activities. The purpose of the treatment may be changed according to the desired service. On our website, Personal Data may be collected in two ways: active and automatic:

Active collection

The active collection of personal data occurs when the Holder himself enters his information in the following situations:

Automatic collection

Automatic data collection occurs through the use of Cookies. Data is captured when you access services on the website and the network on which you access it, such as navigation data and identification of the commercial establishment used. Find out more by accessing our Cookie Policy.

3. Sharing

We inform you and make it clear that we only share your information with companies, organizations or third parties in cases where you consent to the sharing; where there is a need to carry out the business; if established in applicable laws and regulations; or when we can improve your experience with our products and services. Therefore, we may share your information in the following situations:

• Internally among our employees: so that it is possible to efficiently provide the service for which it was contracted, as well as making it possible to identify other needs of the data subject;
• Service Providers: To help with our business operations and provide better Services, we may share your information with companies providing services, for example, but not limited to: cloud storage and database, email mail, accounting, call center, information technology, among others;
• Marketing: for technical service providers to help us with marketing, advertising and communication, providing customers with personalized content;
• Other companies, organizations or third parties external to Dersalis, with your consent: we may share personal information outside of Dersalis when we have your consent. Remembering that we will always ask for your explicit consent to share any sensitive personal information.
• For legal reasons: We will share personal information if we believe, in good faith, that access, use, retention or disclosure of the information is reasonably necessary to:
  • Comply with any legislation, regulation, court order or request from a governmental or administrative authority competent for the request;
  • Respond to actual or potential complaints or lawsuits;
  • Comply with applicable Terms of Service, including investigation of possible violations;
  • Detect, prevent or otherwise deal with fraud, technical or security problems;
  • When necessary for the legitimate interest of the company, or of third parties, in matters of national security, protection of the safety of any person, or to prevent death or imminent physical harm, provided that such interest does not prevail over the interests or rights and fundamental freedoms of the holder that require the protection of their personal data;
  • When necessary to protect our rights, interests and/or property (including, without limitation, to ensure compliance with our contracts), the rights, interests and/or property of our agents, independent subcontractors, customers and others. In the event of sharing Personal Data with third parties, all subjects mentioned above must use the Personal Data shared in a consistent manner and in accordance with the purposes for which they were collected (or to which the Holder has previously consented) and in accordance with the which is determined by this Privacy Notice, other website or country privacy statements, and all applicable privacy and data protection laws. We also undertake not to sell, rent or pass on your information to companies, organizations or third parties.

4. Data storage and deletion

Your personal data will be stored for as long as necessary to fulfill the purposes for which they were collected. Therefore, when they reach their purpose, they can be eliminated. You may also request the deletion of your data, except in cases where it is necessary to comply with a legal or regulatory obligation and to exercise rights in judicial, extrajudicial or administrative proceedings.

5. International transfer

Dersalis guarantees that it does not carry out any international transfer of collected and stored data.

6. Third-party links

Our website may include links to third-party websites whose privacy practices may differ from ours. Thus, when you access our website, you may be redirected to one of our social media pages (Linkedin, Instagram and YouTube), as well as pages such as Pipefy, so that candidates for our vacancies can participate in the selection process. Your use of these sites is governed by their privacy policies and not by this Privacy Notice. You should carefully review the privacy policy of any website you visit. We will consider your decision to use such third-party products and services with our Products and Services as a statement to us that you have consented to the third party's terms and practices.

7. Security measures

We treat the security of your personal data with the utmost care. We have a team responsible for ensuring that Dersalis adopts the best security practices, always aiming to improve and perfect our protection services. To this end, we adopt several precautions, in compliance with the guidelines on safety standards established in legislation, such as:

• It has protection against unauthorized access to your systems;
• Only authorizes access by specific people to the location where their personal information is stored, as long as this access is essential to the development of the intended activity;
  • Ensures that those agents, internal employees or external partners who process personal data must commit to maintaining the absolute confidentiality of the information accessed, as well as adopting the best practices for handling this information, as determined in the policies and procedures;
• Access to the information collected is restricted to employees and authorized people. Those who misuse this information, in violation of this Privacy Policy, will be subject to applicable disciplinary and legal sanctions.
  • In addition to technical efforts, we also adopt institutional measures aimed at protecting personal data, so that the privacy program applied to its activities is constantly updated.

Attention! Although we make every effort to preserve your privacy and protect your personal data, no transmission of information is completely secure, so it is impossible to fully guarantee that all information you receive and/or sends are not the target of unauthorized access perpetrated through methods designed to obtain information improperly, such as technical failures, viruses or invasions of the website's database. In any case, in the remote event of episodes of this nature, we guarantee full efforts to remedy such consequences.

8. Your rights

We are committed to complying with the standards set out in the General Data Protection Law (LGPD), respecting the principles and rights of holders of personal data, especially the principles of lawfulness, loyalty, transparency, purpose limitation, data minimization, accuracy , limitation of conservation, integrity and confidentiality. Furthermore, holders of personal data are guaranteed the rights listed below, under the terms of the LGPD:

• Right of confirmation and access: is the right of the holder of personal data to obtain from Dersalis confirmation that the personal data concerning him or her are being processed or not and, if this is the case, the right to access your personal data upon request on the website or by email contato@dersalis.com.
• Right of rectification: is the right of the holder of personal data to obtain from Dersalis, without undue delay, the rectification of inaccurate personal data concerning him or her.
• Right to erasure of data: is the right of the holder of personal data to have their data erased from Dersalis systems as long as this request is supported by the LGPD, or there is no legal reason justifying its maintenance, even if anonymized.
• Right to block data: is the right of the holder of personal data to block the use of their personal data that is unnecessary, excessive or processed in non-compliance with the LGPD.
• Right to anonymization or blocking of data: is the right of the holder of personal data to have it directly or indirectly dissociated from him or her, through the use of reasonable technical means available at the time of processing.
• Right to limit data processing: this is the right of the holder of personal data to limit the processing of their personal data, which can be obtained when they dispute the accuracy of the data, when the processing is unlawful, when the institution education no longer needs the data for the proposed purposes and when you have objected to the processing of the data and in the case of processing unnecessary data.
• Right not to be subjected to automated decisions: is the right of the holder of personal data not to be subject to any decision taken exclusively based on automated processing, including profiling, which produces effects on the your legal sphere or that significantly affects you in a similar way. The holder of personal data will be informed in the event of rectification or deletion of their data.

These rights are guaranteed and may be exercised as provided for in the LGPD, exclusively by the holder of personal data or by their legal representative, if applicable, by email to be sent to contato@dersalis.com, with the following information:

• Full name of the data subject;
• ID or CPF number of the data subject;
• What is the status of legal representative, if applicable;
• Description of the request;
• Other information or attachment of documents to fulfill the request.

Our team will be ready to respond to any requests!

9. Change to Privacy Notice

Whenever we decide to change the way we treat personal data, this Privacy Notice will be updated. We reserve the right to make changes to our practices and the Privacy Notice at any time, as long as we maintain compliance with current legislation. But rest assured, we value transparency: every time a relevant change is made, we will publish it on our website. Therefore, we advise customers and partners to access this Notice frequently or whenever they have questions. In the event that changes to this Privacy Notice result in changes in personal data processing practices that depend on your consent, we will request your consent to the new terms of the Privacy Notice in relation to the data processing and purposes indicated. By continuing to use Dersalis services after a change in the Privacy Notice, you will be agreeing to the new conditions – but you can always express your disagreement through our service channels, if applicable.

10. Adherence to legislation

This Policy was prepared to comply with and comply with Federal Law No. 13,709/2018 (General Personal Data Protection Law), Federal Law No. 12,965/2014 (Marco Civil da Internet) and Federal Law No. 8,078/1990 (Defense Code of the Consumer), without prejudice to compliance with other legislation applicable to Dersalis.

11. Contact

For more information about this Privacy Notice, the User may contact Dersalis' Person in Charge of Personal Data Processing (DPO), via the email address: contato@dersalis.com.

In effect since: October 2022.