The DBB DISTRIBUIDORA DE PRODUTOS DE BELEZA LTDA, or simply, Vizcaya Cosméticos, duly registered under CNPJ n° 07.687.836/0001-55, headquartered at Avenida Cem – Terminal Intermodal da Serra, Serra – ES, 29.161-384, hereinafter referred to as the “CONTROLLER”, presents this “PRIVACY POLICY” to demonstrate its commitment to the security and confidentiality of the information accessed through the interaction of (“USER”) on our website (https://grupovizcaya.com.br/). This document establishes the guidelines for the proper processing of your personal data, emphasizing Vizcaya Cosméticos’ concern with adhering to the best practices of security, transparency, and clarity, while respecting applicable laws. All personal information collected is used to make your visit to our website more productive and enjoyable.

By accessing and using our website, you expressly agree to the terms and conditions of this Privacy Policy and to the processing of your personal data as described herein. The processing of your personal data will be carried out based on your explicit consent.

All personal information related to members, subscribers, customers, or visitors who access our website will be treated in compliance with the Personal Data Protection Law (Law No. 13.709/2018).

INTRODUCTION

Since our founding, we have been committed to the security of our customers, participants, users, students, and stakeholders.

In this regard, this Privacy Policy (“Policy”) clearly and accessibly explains how your information and data will be collected, used, shared, and stored through our systems.

1 – DEFINITIONS AND TERMINOLOGY

1.1 PERSONAL DATA AND SENSITIVE PERSONAL DATA

Personal data refers to any information related to an identified or identifiable natural person. Examples: name, address, identification numbers (RG, CPF, etc.), location data, electronic identifiers (email, login, IP address, geolocation, etc.).

Sensitive personal data refers to data about racial or ethnic origin, religious beliefs, political opinions, membership in a union or religious, philosophical, or political organization, health or sexual life, genetic or biometric data, linked to a natural person.

1.2 WHO ARE THE SUBJECTS AND ROLES UNDER THE LGPD?

“Data subject” is the natural person to whom the personal data subject to processing refers.

“Controller” is the natural or legal person, public or private, responsible for decisions regarding the processing of personal data.

“Processor” is the natural or legal person, public or private, that processes personal data on behalf of the controller.

“ANPD” refers to the National Data Protection Authority.

1.3 WHAT DATA DOES THIS COMPANY COLLECT FROM YOU? HOW TO KNOW?

We have a Data Subject Rights Service Channel that can be accessed and checked in the “summary table” of this Policy, and by contacting us, our team and officer will analyze your request and respond as soon as possible. However, even with the existence of this channel, it is important to note that during your interaction with our website, the following data may be collected to ensure the proper functioning of the services offered:

• Name;
• Email;
• Phone number;
• Address;
• Date of birth.

1.4 HOW TO UPDATE YOUR PERSONAL DATA?

If any of your data is outdated, please contact our Data Subject Rights Service Channel and inform us of the data that needs to be updated (as per the “summary table” of this Policy).

1.5 WHAT ARE THE RIGHTS OF DATA SUBJECTS?

The LGPD grants certain rights to individuals, Brazilian or otherwise, who are in Brazil, as specified in Article 18 of the LGPD:

(i) Confirmation of the existence of data processing; (ii) Access to personal data; (iii) Correction of personal data when incomplete, inaccurate, or outdated; (iv) Deletion of unnecessary, excessive, or unlawfully processed personal data (except where the processing is legal even without the data subject’s consent); (v) Data portability to another service or product provider (respecting commercial and industrial secrets); (vi) Information about the sharing of data with public and private entities, when applicable; (vii) Information about the lack of consent (the option to not authorize processing and the consequences of refusal); (viii) Withdrawal of consent; (ix) Complaints against the data controller before the national authority; (x) Objection to processing without consent, when deemed irregular.

1.6 WHY IS CONSENT NEEDED?

Consent allows the data subject to access the data and information pertinent to the processing of their personal data. The response must be clear and specific and then made available to the data subject in an appropriate manner.

1.7 HOW TO WITHDRAW CONSENT FOR DATA PROCESSING?

At any time, you may contact the Data Subject Rights Service Channel and request the withdrawal of consent (as per the “summary table” of this Policy).

1.8 ADVERTISING

Like other websites, we collect and use information contained in advertisements. The information in advertisements includes your IP address (Internet Protocol), the browser used when visiting our website (such as Internet Explorer or Firefox), the time of your visit, and which pages you visited on our website.

1.9 CORRESPONDENCE AND INFORMATION EXCHANGES WITH THIRD-PARTY SITES

The CONTROLLER provides links to other sites that we believe may contain useful information/tools for our visitors. Our Privacy Policy does not apply to third-party sites, so if you visit another site from ours, you should read its privacy policy. We are not responsible for the privacy policy or content of those sites.

1.10 FACEBOOK ADS

Facebook Ads is Facebook’s media tool. Read more at: https://www.facebook.com/policy/cookies/

1.11 GOOGLE ADS

Google Ads is Google’s media tool. Read more at: https://policies.google.com/technologies/ads?hl=en

1.12 GOOGLE OPTIMIZE

Google Optimize is Google’s tool for conducting A/B user navigation tests. Read more at: https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage

1.13 LINKEDIN ADS

LinkedIn Ads is LinkedIn’s media tool. Read more at: https://www.linkedin.com/legal/privacy-policy

2 – WHAT INFORMATION CAN THE CONTROLLER COLLECT

The collection of the following types of information may occur:

2.1 Information you provide to us.

This includes:

• Registration data. When you register with the CONTROLLER, you provide us with information such as name, date of birth, gender, phone number, email.

2.2 Information generated when you use our services.

We collect the following generated information:

• Access logs. The CONTROLLER automatically collects access logs to the application, which include the IP address, with the date and time, used to access the CONTROLLER. This data collection is mandatory, according to Law 12.965/2014, but it will only be provided to third parties with your express authorization or through a judicial demand.

• Communications with the CONTROLLER. When you communicate with the CONTROLLER, we collect information about your communication, including metadata such as date, IP, and time of communications, and all of its content, as well as any information you choose to provide.

3 – HOW THE CONTROLLER USES THE COLLECTED INFORMATION

We care deeply about your privacy.

Therefore, all data and information about you are treated as confidential, and we will only use them for the purposes described here and authorized by you, mainly so that you can fully use the CONTROLLER, always aiming to improve your experience as a user.

3.1 Authorized uses

In this way, we may use your data to:

• Allow you to access and use all the features of the CONTROLLER;

• Send you messages regarding support, services, news, videos, articles, notices, and similar content, as well as alerts, notifications, and updates;

• Communicate with you about topics, content, products, services, promotions, news, updates, events, and other matters that you may be interested in;

• Personalize the service to better suit your preferences and interests;

• Create new services, products, and features;

• Detect and prevent fraud, spam, and security incidents;

• Verify or authenticate the information you provide, including comparing it with data collected from other sources;

For any purpose you authorize at the time of data collection;

• Comply with legal obligations.

Occasionally, we may use data for purposes not provided for in this privacy policy, but these will be within your legitimate expectations.

The eventual use of your data for purposes that do not meet this prerogative will be carried out with your prior authorization.

3.2 Data deletion

All data collected will be deleted from our servers when you request it, through a free and facilitated process, or when it is no longer necessary or relevant for us to provide you with our services, except if there is any other reason for its retention, such as a legal obligation to retain data or the need to preserve them to protect the rights of the CONTROLLER.

In cases where you request the deletion of your data, it will be done promptly, as far as possible.

Exceptions to the above rule: Data that is indispensable due to an existing and ongoing legal relationship will not be deleted; data that has a legal provision for its retention; data to which the LGPD does not apply; data that falls within the prescribed time limits for the retention of such data; data that is retained in accordance with regulations approved by the ANPD (National Data Protection Authority).

Communication channel listed in the “summary chart” of this Policy.

3.3 User deletion

The CONTROLLER reserves the right to delete any user, regardless of type, if this Policy or the Terms of Use are not respected.

Since we value a good relationship with users, we recognize that they have the right to seek to understand the reasons and even contest them, which can be done through the email listed in the “summary chart” of this Policy.

4 – HOW AND WITH WHOM THE CONTROLLER SHARES YOUR INFORMATION

4.1 The CONTROLLER may share the information it collects with Service Providers, located both in Brazil and abroad.

4.2 The sharing of information will be done anonymously whenever possible, in order to protect your privacy.

4.3 By means of this document, you expressly authorize such sharing.

4.4 All data, information, and content about you may be considered assets in negotiations in which the CONTROLLER is involved. Therefore, we reserve the right, for example, to include your data among the company’s assets in the event it is sold, acquired, or merged with another. By means of this Policy, you agree and are aware of this possibility.

4.5 The CONTROLLER reserves the right to provide your data and information about you, including your interactions, if legally required to do so, as an act necessary for the company to comply with national laws, or if you expressly authorize it.

5 – HOW THE CONTROLLER PROTECTS YOUR INFORMATION

5.1 All your data is confidential, and only individuals with the proper authorizations will have access to it.

5.2 Any use of this data will be in accordance with this Policy. The CONTROLLER will undertake all reasonable efforts to ensure the security of our systems and your data.

5.3 Our servers are located in different locations to ensure stability and security, and can only be accessed through previously authorized communication channels.

5.4 All your information will, whenever possible, be encrypted, unless such encryption makes its use by the platform unfeasible. You may request a copy of your data stored in our systems at any time.

5.5 We will retain the data and information only as long as they are necessary or relevant to the purposes described in this Policy, or in the case of legally predefined periods, or as long as they are necessary for the maintenance of the CONTROLLER’s legitimate interests.

5.6 The CONTROLLER considers your privacy extremely important and will do everything in its power to protect it. However, we cannot guarantee that all the data and information about you on our platform will be free from unauthorized access, especially in the event of improper sharing of the credentials required to access our application. Therefore, you are solely responsible for keeping your access password in a secure place, and it is prohibited to share it with third parties. You agree to notify us immediately, through the communication channel specified in the “summary table” of this Policy, of any unauthorized use of your account, as well as unauthorized access by third parties to it.

6 – UPDATES TO THIS PRIVACY POLICY

Vizcaya Cosméticos reserves the right to modify this Privacy Policy whenever necessary to ensure compliance with applicable laws and better meet users’ needs. All changes will be duly updated on this page, and users are encouraged to periodically review this Policy to stay informed about personal data handling practices. In the event of significant changes that may affect data subjects’ rights, Vizcaya Cosméticos may notify users through direct communications or highlighted notices on the website or application. If significant changes occur that require new authorizations from you, a new privacy policy will be published, subject to your consent.

For any questions or concerns regarding this Privacy Policy or its updates, users may contact us through the channels provided in the “summary section” of this document.

7 – APPLICABLE LAW

7.1 This document is governed by and should be interpreted in accordance with the laws of the Federative Republic of Brazil, especially Law 13.709/18, General Data Protection Law.

7.2 The court jurisdiction specified in the “summary section” is elected as competent to resolve any issues arising from this document, with express waiver of any other, even if more privileged.

8 – CHANNEL FOR EXERCISING DATA SUBJECT RIGHTS

8.1 The Data Subject Rights Channel aims to demonstrate the CONTROLLER’s commitment to access personal data, whether from customers, suppliers, employees, former employees, visitors, among others.

8.2 The data subject may, at any time, request the CONTROLLER for information about the processing of their personal data and the correction or deletion thereof, provided it complies with current legislation. In cases of data deletion, the CONTROLLER will not use any service that requires the use of your personal data. This reflects the CONTROLLER’s commitment to complying with the LGPD, adopting the best security measures for data privacy.

8.3 Response times: as detailed in the “summary section” of this Policy.

8.4 If you have any questions about these matters and how you can exercise these rights, please feel free to contact us via email as per the communication channel provided in the “summary section” of this Policy.

SUMMARY

DPO AND COMMUNICATION CHANNEL:

✔ DPO LGPD: Figueiredo Filho Sociedade I. de Advocacia

✔ Contact link with the DPO: https://forms.gle/oQ7XB4ze5LTTPyxP7

DEFINITIONS

DBB DISTRIBUIDORA DE PRODUTOS DE BELEZA LTDA. – CNPJ 07.687.836/0001-55 – Av. Cem, s/n quadra 01 Lote M04-M05 e M06 Sala 01 TIMS, Serra – ES, for the purposes of this document, collectively or individually referred to as CONTROLLER.

RESPONSE TIMES: We aim to respond to all legitimate requests within 10 business days from the next business day after receiving the request. Occasionally, it may take more than 10 business days if your request is particularly complex or if you have made multiple requests. In such cases, we will inform you and keep you updated on the status of your request. As a precaution, if you do not receive a response within the above timeframe, please resend your request.

JURISDICTION

Serra/ES

Last Updated: July 12, 2024.

COOKIE POLICY: Click here