Privacy Policy and Data Protection (LGPD)

1. Introduction

In compliance with the Brazilian General Data Protection Law (LGPD, Law No. 13,709/2018) and other applicable regulations, this Policy explains how we handle personal information, what measures we take to protect it, and what rights are guaranteed to data subjects. We are committed to transparency and to the security of every operation involving personal data.

2. Key definitions

To make this document easier to read, we list below some key terms and their meanings:

• ANPD (National Data Protection Authority): the body responsible for overseeing and regulating the LGPD.
• Controller: the entity that makes decisions about the processing of personal data.
• Data subject: the natural person to whom the personal data refers.
• Cookies: small files stored on the user's device that help personalize content and features.
• Data Protection Officer (DPO): the person responsible for acting as the communication channel between data subjects, the company and the ANPD.
• Anonymized data: information that cannot identify an individual, even when combined with other databases.
• Personal data: any information that can identify a person, directly or indirectly.
• Sensitive data: data concerning racial origin, religious beliefs, political opinions, health, sex life, genetic or biometric data.
• Purpose: the objective for which personal data is processed.
• Processor: the party that processes data on behalf of the controller.
• Data processing: any action performed with personal data, such as collection, storage, use, sharing or deletion.

3. How we process personal data

This Policy applies to the data processing activities carried out by HAAIFY. Acting predominantly as a Data Processor, HAAIFY processes personal information in accordance with the instructions and purposes defined by its clients, the Controllers. All processing is based on the principles of good faith, necessity, transparency and information security.

4. Sharing with third parties

When necessary to provide our services, HAAIFY may share data with suppliers, technical partners and service providers. Such sharing is always limited to the minimum necessary and takes place under contractual instruments that ensure confidentiality and compliance with the applicable legislation, in particular the LGPD. Contracted third parties must process the data only according to HAAIFY's specific instructions and exclusively for the agreed purposes.

5. Data subjects' rights

In cases where HAAIFY is the Data Controller, data subjects have the right to:

• Confirm whether we process their data;
• Access the data we hold about them;
• Request the correction of inaccurate, incomplete or outdated information;
• Request the anonymization, blocking or deletion of improper data;
• Request data portability, where applicable;
• Withdraw consent, in cases where it is the legal basis for processing;
• Object to processing carried out in breach of the law.

Requests can be made via email: [email protected].

6. Data security

Protecting personal data is a priority. HAAIFY adopts advanced technical and administrative controls to preserve the integrity, confidentiality and availability of information. Among the security measures applied, we highlight:

• Use of firewalls and anti-spam filters;
• Access control policy and secure passwords;
• Frequent backup routines;
• Access monitoring;
• Constant updating of security systems and software;
• Data protection awareness and training programs for all employees.

These practices are reviewed periodically and adjusted in line with technological developments and legal requirements.

7. Storage and retention

Personal data is kept only for as long as necessary to fulfill the stated purposes or as required by legal and contractual obligations. We may retain data for additional periods to:

• Meet legal or regulatory requirements;
• Comply with contractual clauses;
• Ensure the exercise of rights in administrative or judicial proceedings.

The storage period will be defined based on the nature and sensitivity of the data, as well as the applicable legislation.

8. Terms of use

The use of the services provided by HAAIFY implies agreement with the collection and storage of information required for the proper operation of the systems, including traffic data and interactions carried out through chatbots and developed integrations. This data is used for performance monitoring, fault diagnosis, continuous improvements, and preventive or corrective maintenance of the contracted solutions. HAAIFY may also act as an intermediary in communication with third-party platforms and services, always ensuring that information sharing occurs securely, limited to what is strictly necessary and in compliance with current contracts and applicable legislation, especially the LGPD.

9. Changes to this Policy

This Policy may be modified at any time to continuously improve our security practices and legal compliance. We recommend that users review this document regularly. For more information, contact our Data Protection Officer at: [email protected].