THE PARTIES identified below:

PROCESSOR COMPANIES, headquartered at Av. Severo Dullius, nº 410, Bairro São João, Porto Alegre – RS, hereby designated as the “CONTRACTOR”;

The individual and/or legal entity that enters into an agreement with Grupo Processor, duly identified in the Commercial Proposal or Ancillary Agreement completed and duly signed by the Parties, which forms an integral part of this contract and is hereinafter referred to as the “CLIENT”;

Enter into this DATA PROTECTION AGREEMENT, which shall be governed by the clauses described below:

SCOPE OF SERVICES:

The purpose of this agreement is to establish the understanding between the Parties regarding data protection in accordance with the guidelines of the LGPD (Law No. 13,709/2018). The Parties, their representatives, employees and third parties involved at their direction in providing the contracted services undertake to act in strict compliance with data protection legislation and to fully comply with the rules established herein.

COMMITMENT OF THE PARTIES:

The Parties irrevocably and unconditionally undertake to:

I. Act in such a way as to protect and ensure the proper processing of the data to which they have access during and as a result of the contractual relationship, with each Party being exclusively and individually responsible for fulfilling its obligations under the LGPD, as well as for any sanction imposed on it by data protection law in the event of a violation of legal provisions;

II. Adopt reasonable measures to ensure that the use of data to which they have access as a result of the contractual relationship occurs within the limits established by the LGPD, exclusively for the specific purposes set forth in the service agreement entered into between the Parties or for the purposes indicated in the CONTRACTED PARTY's privacy policy, available at  https://www.processor.com.br/politica-de-privacidade;

III. Keep confidential all personal data, information, or documents of a confidential nature to which they gain access as a result of providing the services, being, as provided by law, responsible for the consequences of their improper disclosure or incorrect use;

IV. Not alter, delete, add to, or manipulate the other Party's systems and/or information and/or data except for the purposes set forth in the agreement or the purposes indicated in the privacy policy available at https://www.processor.com.br/politica-de-privacidade, with each Party being responsible for control and monitoring as provided by law;

V. Take reasonable measures to ensure that the data provided to the other Party was obtained in accordance with the rules set out in the LGPD, where applicable;

VI. In accordance with Article 6, item VII, of the LGPD, adopt security, technical and administrative measures capable of protecting personal data from unauthorized access and accidental or unlawful destruction, loss, alteration, communication or dissemination, taking into account the nature of the data processed and the contracted service;

VII. Keep the personal data and confidential information to which they gain access as a result of the relationship between the Parties under security programs (including the adoption and application of internal policies and procedures) designed to protect personal data against accidental or unlawful loss, access, or disclosure, identify likely and reasonable risks, and prevent unauthorized access to their infrastructure.

VIII. Take reasonable measures to ensure the reliability of employees and/or service providers who may have access to personal data or confidential information arising from the existing agreement between the Parties, as necessary for the purposes of the contractual relationship, ensuring that such individuals are subject to confidentiality obligations;

IX. Notify the other Party, within a reasonable and duly justified period:

(a) if it becomes aware of or suspects that personal data and/or confidential information related to the contract has been compromised, disclosed to unauthorized persons or used without authorization;

(b) if complaints have been made regarding data processing practices related to the contract/provision of services;

(c) if there has been a significant or substantial breach of the requirements contained in this document;

(d) unless legally required by law or compelled by a subpoena, court order, or similar document issued by a court or supervisory authority, the Parties agree not to disclose the Security Incident to third parties without first reaching a prior written agreement.

X. Track and monitor compliance of your practices with the personal data protection obligations set forth in this instrument.

CUSTOMER RESPONSIBILITIES:

In relationships where the CUSTOMER acts as Controller, the CUSTOMER shall be responsible for obtaining and managing the authorizations and/or consents required from data subjects. Accordingly, it is acknowledged that:

I. The CUSTOMER, as Controller, is responsible for obtaining the prior consent of the data subject whose data is submitted for processing, in writing or by another means that demonstrates the data subject’s expression of intent, pursuant to Articles 7, item I, and 8 of the LGPD;

II. It is the CLIENT’s responsibility, as Controller, to obtain the data subject’s specific consent where communication or sharing of personal data with other controllers is required, as provided for in Paragraph 5 of Article 7 of the LGPD;

III. Under Article 8, § 2, of the LGPD, the CLIENT is responsible for providing proof, when necessary, that the consent given by the data subject complies with the LGPD.

IV. THE CLIENT, as the Data Controller, shall maintain a data protection impact assessment report describing personal data processing activities that may pose risks, indicating the respective measures, safeguards and mitigation mechanisms, as provided for in Article 5, item XVII, of the LGPD.

RESPONSIBILITIES OF THE CONTRACTED PARTY:

I. In agreements entered into between the CLIENT and the CONTRACTED PARTY, due to the nature/type of the contractual relationship, the CONTRACTED PARTY does not process CLIENT data or data relating to third parties connected to the CLIENT, in which case the CLIENT hereby acknowledges and agrees that the CONTRACTED PARTY, pursuant to Article 43, item I, of the LGPD, shall be exempt from the obligation to provide compensation referred to in Article 42, caput, of the LGPD and shall therefore not be liable for damages of any kind arising from violations of data protection legislation. Such liability shall lie exclusively with the CLIENT and/or a related third party that may be responsible for processing the data;

II. Where the contractual relationship between the CUSTOMER and the CONTRACTOR concerns services related to “Mérito”, “Max Outsource (BPO)” or “LiveCloud e-biz”, and/or where the CONTRACTOR acts under the agreement as a service operator and has been explicitly entrusted with sensitive databases, such as CRM, ERP or BI, the CONTRACTOR’s responsibility for data processing and protection shall strictly comply with the LGPD guidelines. In this case, the following provisions shall apply:

(a) As provided in Article 39 of the LGPD, the CONTRACTED PARTY, acting as the Processor, will process data according to the instructions provided by the CLIENT, acting as the Controller, which will verify compliance with its own instructions and the applicable rules;

(b) In all cases, the instructions must be lawful, feasible and compatible with the purpose of the contractual relationship entered into between CLIENT and CONTRACTOR, must be provided in writing and addressed to a single representative of the CONTRACTOR previously designated by the Parties as the point of contact and person responsible for the contract, who must, in all cases, provide written consent to the instruction issued by the CLIENT as evidence that the CONTRACTOR has acknowledged the directive received;

(c) If implementation of the instruction provided by the CLIENT is not expressly specified in advance in the scope of the commercial proposal and included in the investment amount negotiated at the time of contracting, the costs of its implementation and operation shall be added to the contract amount, according to the tools required to meet these requirements, and the CONTRACTOR shall automatically be released from fulfilling the instruction if the CLIENT does not agree to and/or does not bear the corresponding financial impacts arising from its specific needs;

(d) If necessary for the proper performance of its contractual obligations, the CONTRACTOR may transfer data outside Brazilian territory, undertaking to observe and comply with the rules set forth in the LGPD, and to carry out the transfer only to countries that provide a reasonable level of data protection and/or upon entering into a data protection agreement with the partner, in accordance with the CONTRACTOR’s Privacy Policy, available at https://www.processor.com.br/politica-de-privacidade.

FINAL PROVISIONS:

I. The CLIENT agrees that the CONTRACTOR may collect the CLIENT’s data, such as registration data required for billing, data collected at events and through surveys, data required to maintain the existing business relationship between the Parties, as well as solution usage data, which will be used for the specific purposes of:

(a) improve the delivery and maintenance of the CONTRACTOR’s products and services;

(b) create and maintain the CLIENT's account with the CONTRACTOR;

(c) assess risk, credit, and payments;

(d) provide the CLIENT with services and information related to its account;

(e) assist the CUSTOMER with service and technical support issues or general questions;

(f) send marketing and promotional communications and targeted advertising with relevant offers, including the customization of content and marketing offers that may be of interest to the CLIENT;

(g) ensure the authenticity of the CUSTOMER’s access to its account;

(h) detect and prevent fraud;

(i) manage and protect the CONTRACTOR’s employees, facilities, communication networks, services, products, and clients;

(j) comply with the CONTRACTOR’s legal and regulatory obligations;

(k) conduct research related to the CONTRACTED PARTY's products and services;

(l) other practices set forth in the CONTRACTOR’s Privacy Policy, available at https://www.processor.com.br/politica-de-privacidade;

(m) for the situations indicated above, where the CONTRACTED PARTY retains CLIENT data, protection and confidentiality of such data shall be guaranteed in accordance with this instrument and applicable legislation;

II. The CUSTOMER understands and agrees that, when using cloud services, if it does not wish its data to be stored outside the national territory, it must notify the CONTRACTOR in advance, acknowledging that territorial restrictions will result in changes to the amounts negotiated for the engagement.

III. The parties declare that they are aware of and agree to indemnify each other, up to the limit of the contract’s annual value, excluding taxes and charges, for any damages demonstrably suffered as a result of the at-fault party’s sole negligence regarding the obligations assumed under this instrument and/or provided for in data protection legislation, the occurrence of which must be established by a final and non-appealable court decision.

IV. THE RULES SET OUT HEREIN SHALL APPLY TO ALL CONTRACTS ALREADY EXISTING OR ENTERED INTO IN THE FUTURE BETWEEN GRUPO PROCESSOR AND THE CLIENT and shall replace the data protection and processing guidelines previously agreed between the Parties insofar as they conflict with these rules.

TERM:

This instrument and its respective updates are registered with the Registry Office and available on the CONTRACTOR’s websites (www.processor.com.br and www.gotobiz.com.br). The framework established herein shall take effect upon the beginning of the commercial relationship between CLIENT and CONTRACTOR, following the enactment of the General Data Protection Law, through accession by signing an Ancillary Agreement and/or Commercial Proposal, and shall be accepted by the Parties as the guiding framework for the practices required of both Parties in connection with the LGPD. The provisions agreed herein shall remain in force throughout the term of the existing commercial relationship between the Parties, as well as after the services have ended, as required by applicable law.

JURISDICTION:

To settle any disputes arising from this Agreement that are not resolved between the Parties, the courts of the District of Porto Alegre are hereby elected, with express waiver of any other jurisdiction, however privileged it may be.

Term registered under number 112663, on folio 241f, in book B-367 of the Integral Registry of Titles and Documents, of the 1st Registry of Titles and Documents of Legal Entities of Porto Alegre.



Pursuant to Article 41, § 1, of Law No. 13,709 of 2018, we inform you that the Data Protection Officer of the Processor Companies (DPO) is: Ana Pochmann.