Privacy and Personal Data Security Policy

This Privacy and Personal Data Security Policy (“Privacy Policy”), drafted in accordance with Law No. 13,709 of 2018 — Brazil’s General Data Protection Law (“LGPD”) — sets out the commitment of ShopCom1 Intermediação e Agenciamento de Serviços S.A., a closely held corporation registered under CNPJ No. 45.106.699/0001-07, headquartered at Rua Olimpíadas, No. 205, 4th floor, Vila Olímpia, São Paulo/SP — ZIP 04551-000 (“ShopTour”), to the privacy and protection of personal data of users of ShopTour’s platforms (“Users”), especially the ShopTour mobile application, the “App”.

The Privacy Policy establishes rules for the processing of User data provided to ShopTour during registration and use of the App, in compliance with applicable legal parameters. This Policy may be amended at any time at ShopTour’s discretion. ShopTour may aggregate Users’ personal data collected from different sources (websites, apps, third-party social networks, commercial partners, Customer Service, and other forms of electronic or offline contact). This Policy applies to ShopTour employees, partners, collaborators and associates who directly or indirectly process or come into contact with users’ personal data.

I — Definitions

(a) "User"

The natural or legal person to whom the personal data that will be subject to processing refers.

(b) "Processing"

Any operation involving access, collection, reception, processing, use, classification, reproduction, transmission, distribution, archiving, storage, deletion, transfer, modification, evaluation, dissemination, extraction or control of personal data, as provided by the LGPD.

(c) "Personal Data"

Any information relating to an identified or identifiable natural person, for example: an individual taxpayer registration number (CPF).

(d) "Anonymized Data"

Any data relating to a User that cannot be identified, considering the use of reasonable and available technical means at the time of Processing.

(e) "Sensitive Data"

Any Personal Data concerning racial or ethnic origin, religious or political belief, trade union or religious, philosophical or political organization membership, health or sex life data, or genetic or biometric data linked to a User.

(f) "Collected Data"

Any User data collected by ShopTour under this Privacy Policy.

(g) "Affiliates"

Any person, natural or legal, that is controlled by, exercises control over, or is under common control with ShopTour.

(h) "Controller"

The party responsible for decisions regarding Personal Data.

(i) "Processor"

The party that carries out the Processing of Personal Data on behalf of the Controller.

(j) "Data Protection Officer (DPO)"

The natural or legal person appointed by the Controller or Processor to act as a communication channel between the Controller, the User and the National Data Protection Authority (ANPD).

(k) "ANPD"

Brazil's National Data Protection Authority, the public body responsible for overseeing the protection of Personal Data and compliance with the LGPD.

(l) "Connection Platforms"

Websites, apps, third-party social networks, commercial partners, Customer Service, and other forms of electronic or offline contact between the User and ShopTour, especially the App.

II — Collection and Purpose of Collected Data

2.1. Personal Data will be collected by ShopTour including, but not limited to: (i) when any User voluntarily provides it during the registration process through the App or any other Connection Platform; or (ii) when a User logs in to the ShopTour App or any Connection Platform, thereby providing browsing data, date, time, access location and device model.

2.2. Collected Data during registration or access may include, among others:

2.3. ShopTour’s services depend directly on the data that may be collected during registration. If the User chooses not to provide any of this data, the provision of ShopTour’s services may be wholly or partially prevented.

2.4. After User registration on the Connection Platforms, ShopTour, partner companies or Users may send communications regarding updates, promotions and account management.

2.5. Digital identification data may be recorded through browsing tracking tools including Cookies or other tracking technologies. These may be disabled or blocked directly through the User’s browser of choice. Disabling Cookies may prevent the User from visiting ShopTour’s Connection Platforms or accessing information available in the App.

III — Processing of Collected Data

3.1. Processing of Personal Data will be carried out by ShopTour in compliance with the terms of this Privacy Policy and the LGPD.

3.2. Processing of Collected Data will take place after the User’s consent to the Privacy Policy through use or registration in the App or through consent and access to any Connection Platform.

3.3. The Collected Data subject to Processing will serve the general purposes of providing intermediary services to ShopTour App Users and creating a database and connecting App Users with ShopTour Affiliates.

3.4. All Collected Data will be processed by ShopTour as Controller and Processor of Personal Data, exclusively for the purposes for which they are intended, under the terms of this Privacy Policy and the LGPD.

3.5. The Processing of Personal Data of incapable persons or minors under 18 years of age will require consent from their legal guardian.

3.6. ShopTour may delete, cancel, suppress or otherwise prevent access to information and files voluntarily transmitted by the User through the Chat. ShopTour is not responsible for information and files copied to external platforms and devices.

3.7. ShopTour may disclose Users’ Collected and Personal Data to third parties and Affiliates, subject to legal limitations, when necessary or appropriate for: (i) the provision of ShopTour’s services; (ii) administrative and corporate purposes; (iii) in the event of disposal, merger, liquidation or dissolution of ShopTour; and (iv) compliance with a legal obligation, competent authority order or court ruling.

IV — Security of Collected Data

4.1. Personal Data will be stored in ShopTour’s database or in databases maintained by third parties contracted by ShopTour, including cloud storage environments, and may be transmitted, processed, stored and subjected to any measures necessary for the Processing of Collected Data in Brazil or abroad.

4.2. The User is responsible for the confidentiality of their Personal Data, and acknowledges by consenting to this Privacy Policy that sharing login credentials compromises the security of their Collected Data and violates this Policy.

4.3. By consenting to the Processing of Collected Data and using ShopTour’s services, the User acknowledges that ShopTour bears no liability for unauthorized access to its storage systems, or for the disclosure, alteration, destruction or any other acts by third parties in violation of this Privacy Policy or applicable law.

4.4. ShopTour will notify the ANPD and the User, via the User’s registered email address, of any incident that may cause relevant harm to the User, indicating (i) the nature of the Personal Data affected, (ii) information about the Users involved, (iii) the technical and security measures used for Personal Data protection, (iv) the risks related to the incident, and (v) the measures taken or to be taken to reverse or mitigate the effects of the harm.

V — Storage of Collected Data

5.1. ShopTour will retain Collected Data provided by Users for as long as the respective accounts are active and as necessary for the provision of its services or fulfillment of legal obligations. Personal Data collected during User registration may be stored for up to 5 (five) years after the end of the relationship, and data collected for the purpose of digital identification may be stored for up to 6 (six) months.

5.2. Collected Data may be deleted, in whole or in part, upon total or partial revocation of consent by the User through the contact channel.

5.3. ShopTour reserves the right to retain Users’ Collected Data if necessary to comply with legal or regulatory obligations, as well as for its exclusive use through data anonymization.

VI — Biometric Data

6.1. Biometric Data, including fingerprints, facial recognition, voice recognition, retina patterns, hand geometry, signature patterns or others to be defined in the Platforms, are considered Sensitive Personal Data and will be processed in accordance with this Privacy Policy and applicable law.

6.2. The User acknowledges and expressly agrees that ShopTour may capture Biometric Data to use in User certification, access and navigation on the Platforms, and to provide an additional layer of security for the User, ShopTour and other users.

6.3. The User acknowledges and agrees that, while the collection and use of Biometric Data offers a significant additional layer of security, it is not completely invulnerable, and failures may occur due to technical problems, poor lighting in facial recognition, or technological incapacity of the User’s devices.

6.4. Storage duration, type of processing and other security forms, collection and purpose will be in accordance with Sections II to V of this Privacy Policy.

VII — User Rights

7.1. Users may request ShopTour to confirm Processing, update, amend, correct or delete their Personal Data. Users may request a full or partial copy of the Collected Data subject to Processing, which will be sent via the email registered in the App.

7.2. ShopTour appoints Leila de Souza Castro as Data Protection Officer (“DPO”), responsible for all communications between Users and the ANPD. Users may contact the DPO at suporte@shoptourapp.com.br.

VIII — Publication and Review

8.1. This Policy enters into force on the date of its publication and may be revised at any time by ShopTour, at its sole discretion, always in compliance with applicable law.

8.2. After revisions or updates that require new consent collection, the User will be notified via their registered email address or upon first access to the Connection Platforms after the revision or amendment.

IX — Final Provisions

9.1. The full text of the Privacy Policy may be accessed by ShopTour staff and all Users or interested parties through the App or at www.shoptourapp.com.br. Questions regarding the Privacy Policy should be directed to the DPO as described above.

9.2. Should any provision of this Privacy Policy be deemed unenforceable by a judicial authority or the ANPD, the remaining terms and conditions shall remain unchanged, in full force and effect.

9.3. This Privacy Policy shall be governed by the Laws of the Federative Republic of Brazil, with the courts of the City of São Paulo having exclusive jurisdiction to resolve any disputes arising from this Privacy Policy.