PRIVACY NOTICE

The use of the CITTUA Platform implies acceptance of this Privacy Notice, which must be read in conjunction with the Platform’s Terms and Conditions of Use, since, by accessing and/or using our Services, you automatically declare that you are fully aware of the terms set forth herein.

1. Who Are We?
The CITTUA Platform is owned and managed by Cittua Tecnologia, Consultoria e Treinamento LTDA, a company registered with the CNPJ (Brazilian Corporate Taxpayer Registry) under No. 49.168.242/0001-88, headquartered at Avenida Presidente Vargas, 3131, Cidade Nova, Rio de Janeiro/RJ, Zip Code 20210-030. CITTUA is committed to respecting the privacy and protecting the security of data subjects, as well as ensuring the lawfulness and transparency of processing activities. Therefore, CITTUA presents this Privacy Notice (“Notice”) to describe, in a clear and accessible manner, how personal data will be used, shared, and stored, in compliance with applicable Brazilian laws, in particular, Federal Law No. 13,709/2018 (“General Data Protection Law” or “LGPD”).

2. The purpose of the Privacy Notice
The Privacy Notice described here seeks to strengthen CITTUA’s commitment to its corporate values, which include good relationships with Users and transparency in its processes, in addition to explaining how it processes Users’ personal data, what the rights of data subjects are and how they may be exercised, in line with the provisions of the LGPD and other applicable laws in force.

3. Important Definitions
Below are some important concepts to help the User easily understand the terms of this Privacy Notice:

a) “User”: a natural person who uses the Platform, browsing using a login and password;
b) “LGPD”: means “General Data Protection Law.” This is Federal Law No. 13,709/2018;
c) “Personal data”: any information related to a natural person that identifies them, or that, when used in combination with other processed information, identifies an individual. Also, any information through which the identification or contact information of a natural person is possible.
d) “Sensitive personal data”: personal data regarding racial or ethnic origin, religious beliefs, political opinions, membership in a trade union or organization of a religious, philosophical, or political nature, data relating to health or sexual life, genetic or biometric data, when linked to a natural person.
e) “Anonymized Data”: data relating to the holder that cannot be identified, considering the use of reasonable and available technical means at the time of processing;
f) “Database”: a structured set of personal data, stored in one or more locations, in electronic or physical form.
g) “Data Subject”: a natural person to whom the personal data being processed refers.
h) “Personal data processing”: personal data processing is considered to be the collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, deletion, evaluation, or control of information, modification, communication, transfer, dissemination, or extraction of data of natural persons.
i) “Anonymization”: the use of reasonable technical means available at the time of processing, by which data is no longer associated, directly or indirectly, with an individual;
j) “Controller”: a natural or legal entity, governed by public or private law, responsible for decisions regarding the processing of personal data;
k) “Operator”: a natural or legal entity, governed by public or private law, that processes personal data on behalf of the controller;
l) “Purpose”: what CITTUA aims to achieve by processing personal data;
m) “Necessity”: the reason why the processing of personal data is justified to achieve the intended purpose. The processing of personal data, however, must be limited to the minimum necessary to achieve the intended purpose, that is, it must be relevant, proportionate, and not excessive;
n) “Consent”: free, informed, and unequivocal (without leaving any doubt) authorization by which the User agrees to the processing of their personal data for a previously stipulated purpose.
o) “Erase”: deletion of data or a set of data stored in a database, regardless of the procedure used.
p) “Data sharing”: communication, dissemination, international transfer, interconnection of personal data, or shared processing of personal databases by public agencies and entities in compliance with their legal responsibilities, or between these and private entities, reciprocally, with specific authorization, for one or more processing modalities permitted by these public entities, or between private entities;
q) “IP Address”: An IP address is a number assigned to a computer or network when accessing the Internet. It is usually associated with the Internet entry point, such as an Internet service provider;
r) “Aggregated Format”: anonymous versions of User information, aggregated data, or data that does not identify a particular individual;
s) “Cookies”: small text files stored on the User’s device that allow us to recognize their preferences, for example, to adapt the website to their browsing experience and specific needs;
t) “Logs”: records of access to Internet applications that gather information regarding the date and time of use of the application, considering a specific IP address.

4. To whom does this Privacy Notice apply?
This Privacy Notice is intended for Users who interact with the CITTUA platform, as well as those whose personal data is processed by CITTUA in any way. This Privacy Notice does not apply to anonymized or aggregated personal information.

5. Source of Personal Data
Personal data is processed in accordance with the guidelines of the General Data Protection Law in force and in accordance with ethical principles and best practices required by the market.

5.1. CITTUA collects your personal data through the following sources:
Service Provision
The personal data collected and used in the provision of services is provided directly by Users (“User Registration”). Therefore, such personal data is used strictly within the scope of the provision of services, which may include:

a) Registration data: Name, ID, and CPF;
b) Contact information: email, postal address, telephone number, etc.;
c) Sensitive data: Gender and ethnicity;
d) Other personal data necessary for the provision of our Services, such as geolocation.

5.2. Website / Platform
When using the Platform, we collect personal data in two ways:

5.2.1. When provided by the Data Subject
CITTUA collects the information that the User provides, such as:

a) Database records of any files or information uploaded to Our Platform by data subjects;
b) Access details to Cittua and the resources accessed by the data subject;
c) Information about the access device used, including, for example, hardware model, operating system and version, file names and versions, preferred language, unique device identifier, advertising identifiers, serial number, information regarding device movement, and network information;
d) Server log information, which may include information such as the device’s IP address;
e) Mapping of browser clicks, navigation data, statistics, demographics, among others;
f) Mapping of clicks in applications and browsing data;
g) “User Registration,” which may be associated with personal data when using the service, etc.;
h) Financial data: credit card number and/or information about the payment method used;

Personal data may also be used to detect and prevent fraud, violations of our terms or policies, and/or other harmful or illegal activities.

5.2.2. Automatically, through Cookies and similar technologies.
CITTUA may collect and store information whenever the User interacts with the Platform.

5.3. What is a Cookie?
“Cookies” are small files installed on the User’s device that allow the collection of certain information, including personal data, allowing us, among other functions, to recognize your preferences and, for example, adapt the website to your browsing experience and your specific needs.

There are different types of Cookies. On our website, CITTUA may use the following Cookies:

(i) Necessary: ​​These cookies are essential for the website to function properly and for the User to be able to navigate the website and use the applications. They are necessary, for example, to balance the website server load, verify its functionality, or to access secure areas of the website through a login. These cookies do not identify the User, and without them, the website may not function properly.
(ii) Functional cookies: These store information about your preferences, such as your language and region, allowing for a better browsing experience on the website.
(iii) Performance cookies: These analyze how the User interacts with the Platform, collecting information such as most visited areas, time spent on the website, number of visitors, and most popular pages. These cookies do not identify the User and are used for analysis and statistics, aggregating information anonymously.

5.3.1. Why are Cookies used?
The Platform uses Cookies to store your preferences, always with the goal of facilitating use and adapting the Platform to the interests and needs of Users, in addition to providing a better and more efficient experience when accessing the Platform.

Through Cookies, we also store information about browser activity, including IP address and the page accessed. These activity logs will be used only for statistical purposes and to measure the services provided.

5.3.2. Information Retention Period

(i) Persistent Cookies: These are cookies that are stored in the internet browser and on access devices for a period defined by the controller.
(ii) Session Cookies: These are temporary. They remain in your browser and access devices while the User is logged in. They can be used to simplify some User actions and link them to others during a browser session. The session begins when a new browser window is opened and ends when that window is closed.

5.3.3. How to remove or block Cookies?
The Owner has the option to accept or reject the use of Cookies on their device using their preferred browser settings. However, if you do not accept some Cookies, certain services and features of our website may not function optimally.

You will find further explanations on how to proceed by clicking on the links below. When accessing the respective websites, the User will be subject to the Privacy Notices of third parties and should ensure that they read the specific Privacy Notice of each website visited.

How to remove cookies in Internet Explorer (Windows)
How to remove cookies in Microsoft Edge
How to remove cookies in Firefox
How to remove cookies in Google Chrome
How to remove cookies in Safari (MAC)

6. Purpose of processing and legal basis adopted
The purposes and legal basis assigned by CITTUA depend on how and why the Data Subject engages with the company. For example, the purposes and legal basis adopted will be different depending on whether the User is a Customer or Partner using CITTUA services or a Platform User.

Below, we list some situations in which CITTUA may process the personal data of CITTUA Users:

In general, the processing of personal data will be based on compliance with a legal or regulatory obligation, the execution of a contract or preliminary contractual procedure, the regular exercise of rights in a legal proceeding, legitimate interest, or consent, as provided for in items I, II, V, VI, and IX of article 7 of the LGPD. The processing of personal data undertaken by CITTUA will always be based on a specific legal basis set forth in articles 7 and 11 of the LGPD, even if it has not been listed in the table above.

7. Regarding Personal Data of Children and Adolescents
CITTUA does not knowingly request, collect, process, store, or share personal data of children and adolescents. If we discover any unintentional handling of such data, we will immediately remove that child’s or adolescent’s personal data from our records. However, CITTUA may collect personal data of children and adolescents directly from their parents or legal guardians, with explicit consent and in accordance with the rules of current personal data protection legislation.

8. Sharing Personal Data with Third Parties
In order to fulfill the purposes described in this Notice, CITTUA may share your personal data with customers and/or partner companies, aiming to improve the quality of service provided and the user experience on the Platform. This will be done in a justified manner, always maintaining the highest security standards, seeking to preserve your privacy to the maximum extent possible. Below are described some situations in which personal data may be shared and their respective purposes:

(i) Service Providers and Technology Suppliers. CITTUA works in partnership with other organizations to facilitate its activities, such as data hosting, asset security, authentication and registration validation services, among others. To minimize risks to Data Subjects, suppliers are regularly evaluated and commit to contractual obligations regarding information security and personal data protection.
(ii) Public Authorities. In order to comply with applicable legislation or at the request of public or government authorities;
(iii) Third-Party Links. The platform may include links to third-party websites, plug-ins, or applications. Clicking on these links or enabling such connections may allow third parties to collect or share Data Subjects’ personal data. CITTUA is not responsible for the Privacy Notices of these third-party websites.
(iv) Customers or Partners: For sending email content with the Data Subject’s consent.

9. Retention and Discarding of Personal Data
Personal data processed by CITTUA will be stored for the duration of the contract (Article 7, Section V, of the LGPD). After this period, the Data Subject’s information, including third-party personal data, will be stored in accordance with the statute of limitations of Brazilian law, unless the processing is legally based on the data subject’s consent or a legitimate interest justifying the storage, and if retention is authorized by applicable law.

After the statute of limitations, personal data processed by CITTUA will be deleted, except in cases where processing is necessary due to the circumstances set forth in the sections of Article 16 of the LGPD, highlighted below:

(i) Compliance with a legal or regulatory obligation by the controller;
(ii) Study by a research organization, ensuring, whenever possible, the anonymization of personal data;
(iii) Transfer to a third party, provided that the personal data processing requirements set forth in this Law are met; or
(iv) Exclusive use by the controller, prohibiting access by third parties, and provided that the personal data is anonymized.

In certain cases, we have legal obligations that require the retention of personal data for specific periods, such as IP address data, time and date of each access to our website, which must be retained for at least 6 months, in compliance with Article 15 of the Brazilian Internet Civil Rights Framework.

10. International Transfer of Personal Data
CITTUA may transfer personal data to other countries when providing services or features that utilize technological infrastructure established outside of Brazil, such as hosting servers and cloud services, or when we need to engage Partners located abroad. Currently, the database, websites, and servers that CITTUA uses are hosted in the United States. In the event of a server change and/or change of country and storage, data subjects will be notified, and contracts, where applicable, will be adjusted. In cases of international transfers, CITTUA ensures that the countries to which the Data will be transferred provide a level of data protection similar to that provided for in current Brazilian legislation.

11. Data Security
CITTUA’s responsibility is to protect personal data and use it only for the purposes described in this Notice. To ensure the privacy and protection of Users’ personal data, we have adopted appropriate administrative measures and technological resources to guarantee the security of all personal data processed by CITTUA. The security measures implemented include system access controls, backup policies, password vaults, installation of barriers against unauthorized access to databases (including firewalls), and other information security controls.

CITTUA strives to protect the privacy of its Users’ personal data, but unfortunately, due to force majeure, we cannot guarantee complete security. Unauthorized access and use by third parties of user information, hardware or software failures beyond the company’s control, and other external factors may compromise the security of personal data.

The User is responsible for the security of their account and encrypted wallet. Therefore, the User’s actions and attention are essential to maintaining a secure environment for everyone. If the User identifies or becomes aware of any factor that compromises the security of their data in their relationship with the Company, please contact CITTUA using the contact information provided below.

12. Data Subject Rights
Data subjects have the right to request information from CITTUA regarding the processing of their personal data, through the following requests:

(i) Confirmation of processing: Data subjects may contact CITTUA to confirm whether any of their personal data is being processed by CITTUA;
(ii) Access to data: Data subjects have the right to request access to existing personal data processed by CITTUA;
(iii) Correction of incomplete, inaccurate, or outdated data: Data subjects may request CITTUA, at any time, to change their personal data if it is incorrect, inaccurate, or outdated. Examples include updating their name, changing their telephone number, and changing their address. It is important that personal data be accurate and current, and the Data Subject is responsible for keeping CITTUA informed in cases where their personal data needs to be corrected;
(iv) Anonymization, blocking, or deletion of unnecessary, excessive, or data processed in non-compliance with the LGPD: Data subjects may request the blocking and deletion of their personal data. CITTUA will only deny such a request if the request cannot be fulfilled or if its storage is mandatory or permitted, in accordance with the circumstances listed in Article 7 of the LGPD and other applicable provisions. As anonymization prevents the identification of the individual, anonymized data is no longer considered personal data and, therefore, is outside the scope of the LGPD;
(v) Portability of personal data to another service or product provider, upon express request, in accordance with the regulations of the National Authority, observing commercial and industrial secrets – the portability of personal data does not include data already anonymized by CITTUA;
(vi) Deletion of personal data processed with the data subject’s consent: the data subject’s personal data will be deleted after the purpose has been fulfilled, except in certain cases:

a) compliance with a legal or regulatory obligation by CITTUA;
b) transfer to a third party, provided that the personal data processing requirements set forth in the LGPD are met; or
c) exclusive use by CITTUA, with third-party access prohibited, and provided that the personal data is anonymized.

(vii) Information about public and private entities with which the controller shared data: Data subjects have the right to request access to personal data sent to public and private entities.
(viii) Information about the possibility of not providing consent and the consequences of refusal: CITTUA is available to respond and assist, in a transparent manner, with any questions that may arise due to the processing of data subjects’ personal data, including the possible impacts arising from not providing consent.
(IX) Revocation of consent: Data subjects’ consent may be revoked at any time by written request to CITTUA through a free procedure when this is the legal basis for data processing.

Data subjects located in the European Economic Area or the United Kingdom are guaranteed rights under the General Data Protection Regulation (“GDPR”).
Including:

(i) Request access to and obtain a copy of your personal data;
(ii) Request rectification or erasure;
(iii) Object to or restrict the processing of your personal data;
(iv) Request portability of your personal data.

Furthermore, if CITTUA has collected and processed personal data with the User’s consent, the User may withdraw their consent at any time.
Data Subjects residing in California are guaranteed rights under the California Consumer Privacy Act (“CCPA”).
Including:

(i) Request for access, information, and a copy of the personal information we collect about you and/or shared with third parties;
(ii) Deletion of the personal information we collect about you; and
(iii) Right to opt-out of the sale of your personal information.

As defined in the CCPA, CITTUA informs you that it does not “sell” personal information.
If you wish to exercise your rights under the GDPR, CCPA, or other applicable Personal Data protection or privacy laws, please contact us using the channel provided in section 13 of this Notice.

DISCLAIMER
For your security, whenever you submit a request to exercise your rights, CITTUA may request additional information and/or documents so that we can verify your identity and prevent fraud. We do this to ensure everyone’s security and privacy.
In some cases, CITTUA may have legitimate reasons for failing to comply with a request to exercise rights. These situations include, for example, cases where the disclosure of specific information could violate the intellectual property rights or trade secrets of the Company or third parties, as well as cases where requests for data deletion cannot be fulfilled due to the Company’s obligation to retain data, whether to comply with legal or regulatory obligations or to enable the Company or third parties to defend themselves in disputes of any nature.
Furthermore, some requests may not be responded to immediately, but CITTUA is committed to responding to all requests within a reasonable timeframe and always in compliance with applicable law.
If you are a Platform User located outside of Brazil, by providing your personal data, you agree that this data may be processed for the purposes set forth in this Privacy Notice and in countries with laws that may be less restrictive than those in your country. By providing your personal data, you agree to these conditions.

Storage.
The personal data in your account and all platform information are stored and securely transmitted on Amazon Web Services (AWS) servers in the United States of America. Only authorized employees may access your personal information, and are subject to the obligations of confidentiality and strict respect for your privacy as set forth in this Policy.
If you have any questions about these matters or how to exercise your rights, please feel free to contact us through the channels provided at the end of this Notice.

13. How can I contact CITTUA about my personal data?
If you believe that your personal data has been processed in a manner incompatible with this Notice or your choices as the data subject, or if you have any questions, comments, or suggestions regarding this Notice and how we process your personal data, please contact us through the following channels:

Mailing Address: Victor Hugo Meirelles de Azevedo will be Cittua’s Data Protection Officer and can be contacted by email at [email protected], or at Rua Fonseca Teles, 121, São Cristóvão, Rio de Janeiro/RJ, CEP 20940-200

14. Modification of the Privacy Notice
CITTUA may modify this “Privacy Notice” and its “Terms of Use” at any time to reflect any necessary changes, aiming to improve and align with the services provided or to comply with legal, administrative, or court orders.
Updated versions will be published on the website. CITTUA will inform Users and customers of changes by any of the following means: email notices to registered Users, messages on the Platform, banners on the website or application, or any other means deemed appropriate for up to 30 (thirty) days after the change.
We also recommend that you periodically review this Notice to familiarize yourself with any changes.

Date of last revision: January 24, 2025.