Privacy Policy and Personal Data Protection

Please read this Privacy Policy and Personal Data Protection carefully to understand our policies and practices regarding your Personal Data and how We will handle it. This Policy applies to individuals who interact with CRISDU Group services as consumers (“you”). This Policy explains how your Personal Data is collected, used, and disclosed by the CRISDU GROUP (referred to in this policy as “CRISDU GROUP”, “We”, “Us”). It also tells you how you can access and update your Personal Data and make certain decisions about how your Personal Data is used.

This Policy covers our online and offline data collection activities, covering the Personal Data We collect through our various channels, including – but not limited to – Web Sites, Applications, Third Party Social Networks, Consumer Service Care, Points of Sale, Searches and Events. Please note that We may aggregate combined Personal Data from different sources (for example, our Website and offline events). As part of this, We combine the Personal Data that was originally collected by different CRISDU Group entities or CRISDU Group partners. You can refer to the “about your Personal Data Rights” section for more information on how to object this.

In some specific cases, if you decide not to provide us with your Personal Data as required (We will indicate when this is the case, for example by explicitly placing this information on our registration forms), We may not be able to provide you with our products and/or services.

PERSONAL DATA SOURCES

We collect your Personal Data from the following sources:

CRISDU Group Websites: All our sites can be used to collect Personal Data. This includes both Websites that We operate directly through our IP addresses and domains, and sites or pages that We establish on third party services such as Facebook, LinkedIn, and other third-parties that offer this type of service.

E-mail and instant messaging systems: Services used to maintain electronic communications between you and the CRISDU Group, including those made available directly by Us, or third party services such as WhatsApp, Telegram, or SMS.

CRISDU Group Mobile Applications: Mobile applications provided directly by the CRISDU Group or through third party services such as Google or Apple.

Customer Care Service and Sales Center: Communications with you through our call and sales centers.

Online ads, advertisements, and online forms: Interactions with any type of advertising, advertisements, and online forms from the CRISDU Group.

Offline Records: Records filled offline, distributed during events, and other interactions with the CRISDU Group.

Data received from third-parties: Including, but not limited to, social media and third party sites such as Facebook, Instagram, LinkedIn, And similar, data aggregator services, CRISDU Group partners, public sources, and data received during acquisition of other companies.

WHAT ARE YOUR PERSONAL DATA WE COLLECT AND HOW IT IS COLLECTED

During your interaction with the CRISDU Group, using one of the previously mentioned collection sources, We may collect various types of Personal Data about you, as follows:

Contact Information: Includes any type of information that may facilitate our contact with you, including your physical mailing address, telephone numbers, e-mail addresses, websites and social media profiles.

Login Information: Includes information for identifying and authenticating with services provided by the CRISDU Group, including your registration name (login), password in irrecoverable (encrypted) format, and security questions.

Demographic information and your interests: Any information that may describe your demographic data, habits, or behavioral characteristics, including items such as your birthday, date of birth, age or age group, gender, geographic location, favorite products, hobbies, and amusement, other family interests and information or about your lifestyle.

Technical information about your computing equipment or mobile devices: Details about your computer or other portable device that has been used to access one of our sites, services or applications, including the registration of the IP address used to connect your computer or device to the Internet, including its geographic location, the type and version of the operating system and the type and version of the Web browser. If you access a CRISDU Group Website or application using a mobile device, such as a smart phone or tablet, the information collected will also include, where permitted, your phone's unique device ID, advertising ID, geographic location, and other similar mobile device data.

Information on how you use our sites and services. During your interaction with our sites and services, We use automated data collection technologies to capture information about the actions you have taken. This can include details such as which links you click, which pages or content you view, and how long, and other similar information and statistics about your interactions, such as content response times, download errors, and duration of visits to certain pages. This information is captured through automated technologies such as cookies (browser cookies, Flash cookies and similar cookies) and Web beacons, as well as through third party tracking. You have complete freedom to object to the use of such technologies, so please refer to the details in the “About your Personal Data Rights” section.

Market research and consumer feedback: This is information that you voluntarily share with the CRISDU Group about your experience of using our products and services.

Consumer-generated content: Including any content you create and share with the CRISDU Group on third party social networks or by uploading to one of our websites, applications, and other online and offline services, including the use of third party social networking applications, like Facebook, Instagram, LinkedIn and similar. This data includes text, comments, articles, photos, videos, personal stories or other content and similar media. Where permitted, We collect and publish consumer-generated content in connection with a variety of activities, including the dissemination of CRISDU Group products and services, contests, awards and other promotions, community resources of the site, consumer engagement and third party social networks.

Third party social network information: This is any data that you publicly share on a third party social network or information that is part of your profile on a third party social network (such as Facebook, Instagram, LinkedIn, and similar) and that you allow the third party social network to share with Us. This data may include details such as your basic account information (name, email address, gender, date of birth, current city, profile photo, User ID, friends list, etc.) and any additional information or activities that you may allow the third party social network to share with Us. We receive your social network profile information from third-parties (or parts thereof) whenever you download an item or interact with a CRISDU Group Web application or service on a third party social network, whenever you use a social networking feature that is integrated with a CRISDU Group site or whenever you interact with Us through a third party social network. To learn more about how your information from a third party social network is obtained by the CRISDU Group or to choose not to share this social network information, visit the specific third party social network site.

Financial and Payment Information: Any data that the CRISDU Group needs to fulfill an order, or that you Use to make a purchase, such as your debit or credit card data (cardholder name, card number, expiration date, and so on) or other forms of payment used. The CRISDU Group or our payment processing service providers handle your financial and payment information in accordance with applicable laws, standards, and security standards, such as the PCI DSS (“Payment Card Industry Security Standards Council”).
Contacts with our Customer Care Service and Sales Center: Your interactions with our Customer Care Service and Sales Center can be recorded or heard, in accordance with applicable laws, for the operational needs of the CRISDU Group. Details of financial information and payments are not recorded. When required by law, you will be informed of such recording at the beginning of your call.

Sensitive Personal Data: The CRISDU Group does not normally deal with Personal Data considered sensitive under current legislation, so We do not intend to collect or process sensitive Personal Data in the normal course of your interactions with our products or services. When there is legitimate interest or it is necessary to process your sensitive Personal Data, for any reason, We will obtain your prior, express and formal consent for any processing that is voluntary (for example, for marketing purposes). If We process your sensitive Personal Data for other purposes, We rely on the following legal bases: (i) detection and prevention of crime; and (ii) compliance with applicable law.

ABOUT CHILDREN AND ADOLESCENTS PERSONAL DATA

The CRISDU Group does not knowingly request, collect, process, store, or share, Personal Data of children and adolescents. If We discover any kind of unintended handling of the data, We will promptly remove the Personal Data of that child or adolescent from our records. However, the CRISDU Group may collect Personal Data from children and adolescents directly from their parents or legal guardians, and with explicit consent, and in accordance with the rules of the current legislation.

ABOUT THE USE OF COOKIES, REGISTRY FILES (LOG) AND SIMILAR FILES

Cookies are small text files that can be placed on your computer or handheld by Websites or Web services you use. They are used to ensure the proper functioning of Websites and other online services, as well as to provide information to website owners or online service.

Cookies are used to improve the use and functionality of the CRISDU Group's supported websites and services and to better understand how our visitors use our online sites and services as well as the tools and services they offer. Cookies make it easy for us to tailor the CRISDU Group sites to your personal needs, making it easier to use them, to receive feedback from our consumers' satisfaction.

The CRISDU Group uses the following types of Cookies on its supported sites and services:

Session cookies: These are temporary use Cookies, which are deleted at the time you close your browser. When you restart your browser and return to the site that created the cookie, that site treats you as a new visitor.
Persistent cookies: These are cookies that remain in your browser until you delete them manually or until your browser deletes them according to the length of time set by the cookie. These Cookies will recognize your return as a visitor to a CRISDU Group site or service.

Cookies required: These are Cookies strictly necessary for the operation of a CRISDU Group compliant website or service. They allow you to browse the site and use our resources.

Cookies that send us information about you: We place such Cookies on a CRISDU Group compliant website or service and this type of Cookie can only be read by our compatible sites and services.

Cookies in CRISDU Group advertisements: We place Cookies in advertisements and commercials that are displayed on compatible third party sites and services. We obtain information through these Cookies when you click or interact with advertising or advertising. In this case, the CRISDU Group is placing a “third party” cookie. We may use this data obtained by third Party Cookies to send you other advertisements we believe to be relevant or of your interest based on your previous behavior.

Cookies that share your information to third-parties: Cookies are placed on a CRISDU Group site by our partner companies, such as online advertising services. They may use the data collected by these Cookies to anonymously send you targeted advertisements from other sites, based on your visit to compatible CRISDU Group sites or services.

CRISDU Group supported sites and services may also use other tracking technologies similar to Cookies, which may collect information such as IP addresses, log files, and Web beacons, among others. This data is also used to help us tailor the CRISDU Group's compatible sites and services to your personal needs.

See more details below:

IP Addresses: An IP address is a number used on the Internet or on a network to identify your computer. Every time you connect to the Internet your computer receives an IP assigned by your Internet service provider. We may register IP addresses for the following purposes:
- Technical problem handling;
- Maintaining the safety and security of our websites and other online services;
- Gain a better understanding of how our websites and other online services are used;
- Adapt our content to your needs, depending on your geographic location.

Log files: The CRISDU Group or a third party working on our behalf can collect information in the form of log files that detail the website's activities and collect statistics about user navigation habits. These records are typically generated anonymously and help us understand details such as:
- The type of browser and system used by users of our online websites or services;
- Details about the user's session, including the source URL, date, time, and which pages the user visited on our supported sites and services, and how long the user spent using them;
- Other navigation or click count details including website traffic reports, unique visitor count, and similar data.

Web beacons: We may use Web beacons (or transparent GIFs) on the CRISDU Group sites. Web beacons (also known as Webbugs or Web beacons) are small sequences of code that allow the delivery of a graphic image to a Web page for the purpose of transferring data back to us. We use the information from Web beacons for a variety of purposes, including:
- Understand how a user responds to email campaigns;
- Traffic reports from our compatible sites and services;
- Perform unique visitor counting, advertising and e-mail auditing and reporting, and personalization on our websites and other compatible services.

It is important to remember that it is up to you to ensure that your computer or portable device settings reflect whether you consent to accept Cookies or not.

Most browsers allow you to establish rules to warn you before accepting Cookies or simply to refuse them. You do not need to have Cookies enabled to use or browse most of the CRISDU Group's online sites and services, however in this case We cannot ensure that you will be able to access all of your resources. We recommend that you look under the "help" button on your browser to see how to do this type of configuration.

Remember that if you use different browsers, or even different computers and/or handheld devices in different locations, you will need to ensure that each device and browser is adjusted to your personal Cookies preferences.

Because our Web beacons may be part of a Web page, it is not possible to exclude ("opt-out") of such a feature, but you can make it completely non-functional by activating the "opt-out" feature for Cookies placed by that beacon.

ABOUT USE OF YOUR PERSONAL DATA

The following items describe the purposes for which CRISDU Group collects your Personal Data, and the different types of Personal Data we collect for each purpose. Please note that not all of the uses below will be relevant to all individuals and may apply only to specific situations.

Customer Care Service: Your Personal Data is used for the purpose of providing customer service, including responding to your inquiries, questions and suggestions. This usually requires certain personal contact information and information about the reason for your inquiry, question or suggestion, for example, what your order was, whether there is a technical problem, product issue or complaint, general inquiry.
- Reason for using your personal data in this situation:
  - To fulfill contractual obligations;
  - To fulfill legal obligations;
  - Our legitimate interests.
- Our legitimate interests in this situation:
  - Continuously improving CRISDU Group products and services;
  - Continuously improving the effectiveness of our customer service.

Running contests, promotions, and other marketing actions: With your consent (when required under current legislation), CRISDU Group uses your Personal Data to provide you with information about products or services, such as marketing communications, advertising campaigns, or promotions. This may be done through various means of communication, including e-mail, advertisements, SMS messaging, telephone calls, and postal mail (as permitted by current legislation), as well as through our own websites and/or the websites and social networks of third-parties. In this situation, the use of your Personal Data is completely voluntary, which means that you may object, or even withdraw your consent at any time, to the processing of your Personal Data for these purposes. For more details about how to change your preferences about marketing communications, please see the "About your rights relating to Personal Data" section of this policy. For more information about our contests and other Promotions, please see the rules or details posted about each contest/promotion.
- Reason for Using Your Personal Data in this situation:
  - To fulfill contractual obligations;
  - Our legitimate interests;
  - We have obtained your consent (where necessary).
- Our legitimate interests in this situation:
  - Understanding which of our products and services may be of interest to you and providing information about them;
  - Targeting customers for new products or services.

Social Networking and Third Party Sites: We use your Personal Data when you interact with social networking functions and third party sites such as "likes", to serve you advertisements, and to interact with you on third party social networks. How these interactions work, the profile data that CRISDU Group obtains about you, and how to opt-out can be understood by reviewing the privacy policies directly on the respective social networks and third party sites.
- Reason for using your Personal Data in this situation:
  - Our legitimate interests;
  - We have obtained your consent (where necessary).
- Our legitimate interests in this situation:
  - Understanding which of our products and services may interest you and providing you with information about them;
  - Defining customers for new products or services.

Personalization (offline and online): Based on your consent (where required under current legislation), CRISDU Group uses your Personal Data (i) to understand your preferences and habits, (ii) to anticipate your needs, based on our understanding of your profile, (iii) to improve and personalize your experience on our websites and applications; (iv) to ensure that content on our websites and applications is optimized for you and for your computer or device; (v) to send you targeted advertising and content, and (vi) to allow you to participate in interactive functions, where you choose to do so. In this situation, the use of your Personal Data is completely voluntary, which means that you may object, or even withdraw your consent at any time, to the processing of your Personal Data for these purposes. For further details, see the section "About your rights regarding Personal Data" in this policy.
- Reason for us to use your Personal Data in this situation:
  - Our legitimate interests;
  - We have obtained your consent (where necessary).
- Our legitimate interests in this situation:
  - To understand which of our products and services may be of interest to you and to provide you with information about them;
  - Defining customers for new products or services.

Fulfilling your orders: We use your Personal Data to process and ship your orders, inform you of the status of your orders, correct addresses, and conduct identity verification and other fraud screening activities. This involves the use of certain Personal Data and, in certain situations, payment information.
- Reason for using your personal data in this situation:
  - To fulfill contractual obligations;
  - Legal obligations;
  - Our legitimate interests;
  - We have obtained your consent (where necessary).
- Our legitimate interests in this situation:
  - Improving and developing new products and services;
  - Being more efficient in fulfilling your requests;
  - Protecting our systems, networks and employees;
  - Complying in full with legal obligations.

Legal reasons or merger/acquisition: If the CRISDU Group or its assets are acquired by or merged with another company, including bankruptcy, we will share your Personal Data with our legal successors in accordance with applicable law requirements. We will also disclose your Personal Data to third-parties (i) as required by applicable law; (ii) in response to legal process; (iii) in response to a request from a competent legal authority; (iv) to protect our rights, privacy, safety or property; or (v) to enforce the terms of any agreement or the terms of our website, products and services, as required by applicable law.
- Reason for using your Personal Data in this situation:
  - Legal obligations;
  - Our legitimate interests;
- Our legitimate interests in this situation:
  - To fully comply with legal obligations;
  - Protecting our systems, assets and employees.

Other purposes and situations in general: In accordance with applicable law, CRISDU Group uses your Personal Data for other general business purposes, such as maintaining your account, conducting internal or market research, and measuring the effectiveness of our advertising campaigns. We reserve the right, if you have CRISDU Group accounts, to integrate these accounts into a single account. We also use your Personal Data for the management and operation of our communications, IT, and data protection and security systems.
- Reason for using your Personal Data in this situation:
  - To fulfill contractual obligations;
  - Legal obligations;
  - Our legitimate interests;
  - We have obtained your consent (where necessary).
- Our legitimate interests in this situation:
  - Improving and developing new products and services;
  - Being more efficient in fulfilling your requests;
  - Protecting our systems, networks and employees;
  - Complying in full with legal obligations.

ABOUT THE DISCLOSURE OF YOUR PERSONAL DATA

In addition to the entities that are part of the CRISDU Group, we may share your Personal Data with the following types of third party organizations:

Service Providers: These include external companies that are used by CRISDU Group to help operate our business. Service providers and their selected employees are only authorized to access your Personal Data on behalf of CRISDU Group for the specific tasks they are required to perform based on our direct instructions. Our service providers are contractually obligated to keep your Personal Data confidential and secure, and are jointly and severally liable in the event of a breach under applicable law.

Credit bureaus, debt collection and financial services: As permitted by applicable law, credit bureaus and/or debt collection agencies are outside companies that CRISDU Group may use to assist us in checking your credit status or to collect past due payments.

Third party Companies using Personal Data for their own marketing purposes: Except in situations where you have given your specific consent, CRISDU Group does not license or sell your Personal Data to third party companies for their own marketing purposes. In cases where such sharing occurs, the identity of these third parties will be disclosed before your consent is obtained.

Third-Parties using your Personal Data for legal or merger/acquisition purposes: We will disclose your Personal Data to third-parties for legal reasons or in the context of a merger or acquisition within the CRISDU Group.

ABOUT THE RETENTION AND TERMINATION OF THE PROCESSING OF YOUR PERSONAL DATA

In accordance with applicable law, CRISDU Group uses your Personal Data for as long as necessary to fulfill the purposes for which your Personal Data was collected, as described in this policy, or to comply with applicable legal requirements.

Personal Data used to provide you with a personalized experience will be kept only as long as permitted by applicable law. You can obtain further details about the retention of your Personal Data through the communication channels detailed in this policy.

Upon termination of the processing of your Personal Data, they will be eliminated within the scope and technical limits of the activities, and conservation will be authorized in the situations foreseen in the legislation in force.

ABOUT THE DISCLOSURE, STORAGE, OR TRANSFER OF YOUR PERSONAL DATA

CRISDU Group takes appropriate measures to ensure that your Personal Data is kept confidential and secure. However, these protections do not apply to information you have chosen to share in public areas, such as third party social networks.

Persons who may access your Personal Data: Your Personal Data will be processed by our employees or authorized agents, provided that they need access to such information, depending on the specific purposes for which your Personal Data is collected.

Operating environment measures: We store your Personal Data in operating environments that use reasonable security measures, both technical and administrative, to prevent unauthorized access. We follow reasonable protocols to protect Personal Data.

Steps that CRISDU Group expects you to take: It is important that you also play a role in keeping your Personal Data secure. When you create an online account, please be sure to choose a password that is strong enough to prevent unauthorized parties from guessing it. We recommend that you never reveal or share your password with others. You are solely responsible for keeping this password confidential and for any actions taken through your account on CRISDU Group Web sites and compatible services.
If you use a shared or public computer, never choose the option to remember your login name, e-mail address, or password, and make sure that you log out of your account whenever you leave the computer. You should also use any privacy settings or controls that CRISDU Group provides on our Web site, services, or applications, including those that are deemed optional.

Transfer of your Personal Data: Given the nature of our business, we may have to transfer your Personal Data stored within CRISDU Group to third parties for the purposes set out in this Privacy Policy. For this reason, we may transfer your Personal Data to other countries, provided that their laws and regulations are compatible with those of Brazil.

ABOUT YOUR RIGHTS CONCERNING PERSONAL DATA

You have the right to confirm the existence of, access, review, modify and/or request an electronic copy of the information of your Personal Data that is processed by CRISDU Group.

You also have the right to request details about the origin of your Personal Data or the sharing of such data with third parties.

At any time, you may also limit the use and disclosure of, or withdraw consent to any of our processing activities of your Personal Data, except in situations provided for under applicable law.

These rights can be exercised through the communication channels detailed in this policy, being necessary to validate your identity by providing a copy of your ID or equivalent means of identification, in accordance with the legislation in force.

Whenever a request is submitted without the provision of the evidence required to prove the legitimacy of the data subject, the request will be automatically rejected. Please note that any identifying information provided to CRISDU Group will only be processed in accordance with, and to the extent permitted by, applicable laws.

Please note that in certain cases, we may not be able to delete your Personal Data without also deleting your User account. In addition, some situations require us to retain your Personal Data after you request its deletion in order to satisfy legal or contractual obligations.

Where available, our websites, applications and online services may have a dedicated function where you can review and edit your Personal Data. Please note that CRISDU Group requires that you validate your identity using, for example, a login system with a password or similar feature before granting access to or modifying your Personal Data, thereby ensuring that there is no unauthorized access to your account and associated Personal Data.

CRISDU Group makes every reasonable effort to address any concerns you may have about the manner in which we process your Personal Data. However, if you have unresolved concerns, you have the right to complain to the relevant data protection authorities.

WHAT CHOICES YOU HAVE ABOUT HOW WE USE AND DISCLOSE YOUR PERSONAL DATA

CRISDU Group does its utmost to give you freedom of choice about the Personal Data you provide to us. The following mechanisms give you control over the processing of your Personal Data:

Cookies/Similar Technologies: You can manage your consent using:
- Our consent management solutions;
- Your browser settings to refuse some or all Cookies and similar technologies, or to alert you when they are being used.

Advertising, marketing and promotions: You may consent to have your Personal Data used by CRISDU Group to promote our products or services by checking boxes located on registration forms or by answering questions submitted by our representatives.

If you decide that you no longer wish to receive such communications, you may unsubscribe from receiving marketing-related communications at any time by following the instructions provided in such communications.

To unsubscribe from marketing communications sent via any medium, including third party social networks, you may opt-out at any time by unsubscribing through links available in our communications, by logging on to our websites, applications, compatible online services or third party social networks, and adjusting your user preferences or by calling our customer service department directly.

It is important to remember that even with your unsubscription to our marketing communications, you will continue to receive administrative communications from CRISDU Group, such as orders, transaction confirmations, and notifications about your account activity on our websites and compatible services, and other important non-marketing related announcements.

Personalization (offline and online): Where permitted by law, if you want your Personal Data to be used by CRISDU Group to provide you with a personalized experience or targeted advertising and content, you can indicate that by checking the relevant boxes located on the registration form or by answering questions posed by our representatives.

If you decide that you no longer want to benefit from this personalization, you can opt out at any time by logging into our supported websites, apps and services, and selecting User preferences in your account profile or by calling our customer service directly.

Targeted Advertising: CRISDU Group may partner with ad networks and other ad or service providers who present advertisements and other announcements on our behalf or on behalf of other companies not affiliated with CRISDU Group. Some of these advertisements may be tailored to your interests based on information gathered from CRISDU Group websites and other compatible services or websites of organizations not affiliated with CRISDU Group.

You may contact us using the communications channels detailed in this policy for more information about how to manage or opt-out of your participation in targeted advertising.

CHANGES TO OUR PRIVACY POLICY

Whenever CRISDU Group decides to change the way we treat your Personal Data, this Policy will be updated. We reserve the right to make changes to our practices and this Policy at any time, provided that we remain in compliance with applicable law.

We encourage you to check back frequently, or whenever you have questions, to see any updates or changes to our Privacy Policy.

CONTACT

You may contact us to:

Ask questions or make comments about this Policy and our privacy practices and protection of Personal Data;
Make a complaint;
Confirm the existence of processing of your Personal Data;
Obtain information about how to access your Personal Data;
To correct incomplete, inaccurate or outdated personal data;
Obtain information on the anonymization, blocking or deletion of unnecessary, excessive data or data processed in breach of the provisions of the legislation in force;
Obtain information about the portability of your personal data to another service or product provider, upon express request, in accordance with current legislation;
To request the deletion of personal data processed with your consent, except in the cases provided for in the legislation in force;
Request details of the public and private entities with which we share your Personal Data;
Obtain information about the possibility of not giving consent and the consequences of this refusal;
To revoke consent for the processing of your Personal Data, except in the cases provided for in the legislation in force;
Other rights of the holder of the personal data, according to the legislation in force.
To do so, we request that you contact us using the following channels:
Sending an email to privacidade@CRISDU.com.br

Contact

Fill in your personal data and we will be pleased to contact you!

I have read and accepted the Terms of Authorization.