Data Subject Rights Policy

Hello, Data Subject! Below we clarify some points that we consider important regarding your rights related to your personal data. If you have any questions about any points discussed or not in this document, or if you want to make suggestions or report problems, please do not hesitate to contact us at [email protected].

The Platform is the responsibility of and operated by LEGITIMUZ TECNOLOGIA LTDA., a limited liability company registered with the CNPJ under nº 52.178.446/0001-04, headquartered in Barueri/SP, at Alameda Rio Negro, nº 500 – 5th floor – Tower B – room 501 to 508, CEP 06.454-000, (“Legitimuz” or “We”).

We are committed to ensuring transparency in the information (“Personal Data”) we process and, for this reason, we provide the user (“You”) with this Data Subject Rights Policy (“Rights Policy”), which should be read in conjunction with our Privacy Notice.

Brazilian privacy and personal data protection laws ensure You, as the data subject, a series of guarantees (“Data Subject Rights” or “Rights”) that put you in control of the information You provide to us. To inform You about Your Rights and how to exercise them, we present below everything that applies to You:

1. How to exercise your Rights?

LEGITIMUZ has trained professionals to address your questions and requests. To exercise your Rights, you can request them via email at [email protected].

2. What are your Rights?

Confirmation of the existence of processing - This Right allows You to request and receive confirmation about the existence of collection, storage, sharing, or any type of Processing of your Personal Data.

Access to data - This Right allows You to request access to your Personal Data and obtain a copy of it. Correction of incomplete, inaccurate, or outdated data This Right allows You to request the correction of your Personal Data if it is incomplete, inaccurate, or outdated.

Anonymization, blocking, or deletion of unnecessary or excessive data or data processed in non-compliance with the law - This Right allows You to request the anonymization, blocking, or deletion of unnecessary or excessive data or data processed in non-compliance with the law.

Portability of data to another service or product provider - This Right allows You to request the transfer of your Personal Data to another service or product provider.

Deletion of data processed with consent - This Right allows You to request the deletion of Personal Data processed based on your consent. Information about public and private entities with which the controller shared data This Right allows You to request information about public and private entities with which the controller has shared your Personal Data.

Information about the possibility of not providing consent and the consequences of denial - This Right allows You to request information about the possibility of not providing consent and the consequences of denial. Revocation of consent This Right allows You to revoke your consent at any time.

3. What is the format of the responses?

The responses to your requests will be made in a clear and concise format, suitable to your needs and the way you contacted us. For example, if you contacted us via email, we will respond to you by email.

4. What are the deadlines for responses?

Type of request Deadline for response Confirmation of the existence of processing Within 15 calendar days from receipt of the request Access to data Within 15 calendar days from receipt of the request Correction of data Within 15 calendar days from receipt of the request Anonymization, blocking, or deletion of data Within 15 calendar days from receipt of the request Data portability Within 15 calendar days from receipt of the request Information about data sharing Within 15 calendar days from receipt of the request Information about consent and its consequences Within 15 calendar days from receipt of the request Deletion of data processed with consent Within 15 calendar days from receipt of the request

If further clarification or information about your request is needed, we may send you some questions to adequately respond to your request. The deadlines will be suspended from the time we send our questions until we receive your response.

5. In which situations can we deny your Right?

Your Rights are not unlimited, and therefore, we present below some situations that may lead to a total or partial denial of them:

• preservation of LEGITIMUZ business secrets and intellectual property;
• violation of third-party rights and freedoms;
• the information is anonymized and, therefore, not Personal Data;
• obstruction to law and justice;
• LEGITIMUZ legitimate interests override the data subject's interests;
• the data subject made repetitive, reiterated, or excessive requests.

In any case, we will respond to requests in a timely manner and will inform you clearly about the reasons that led to the possible denial of your request.

6. How to contact LEGITIMUZ?

If you have any questions, comments, or suggestions related to this Policy, you can contact the LEGITIMUZ privacy team through the following means:

Contact email: [email protected]

7. Changes to the Rights Policy

As LEGITIMUZ is always seeking to improve its services, this Rights Policy may undergo updates. Therefore, we recommend that you visit this page periodically to be aware of any modifications. If significant changes are made that require new consent, we will publish this update and request new consent from you.