Privacy Policy

4. Responsibilities

4.1 MANAGERS, EMPLOYEES AND THIRD PARTIES:

Observe and ensure compliance with this Policy and, when necessary, contact the Data Protection Officer (DPO) for advice on situations that conflict with this Policy or when situations described in it occur.

4.2 DATA PROTECTION OFFICER (DPO):

• Keeping this Policy up to date in order to ensure that any regulatory/legal changes to the guidelines and general rules established herein are observed.

• Clarify doubts regarding this Policy and its application.

• Accept complaints and communications from data subjects, provide clarification and adopt measures.

• Receive communications from the National Data Protection Authority ("ANPD") and take action.

• Provide guidance to Dengine - SCORB Product employees on the practices to be adopted in relation to the protection of personal data; and

• Adopt initiatives to share information about incidents containing personal data with the ANPD and data subjects, when necessary.

4.3 SCORB DATA PROTECTION COMMITTEE (CPDS)

SCORB's Data Protection Committee has a multidisciplinary organizational structure made up of committed, qualified professionals who know the organization's values, purpose and mission. Its objective is to promote and strengthen the personal data protection culture, ensuring the appropriate processing of information regarding directors, employees, service providers, customers and partners, in compliance with applicable legislation and internal guidelines.

In addition to the ongoing training that it will have to implement, this Committee has various other responsibilities, such as:

• Monitoring the Privacy Programme's indicators and action plans.

• Discuss and make decisions on new personal data processing activities.

• Levelling up knowledge about privacy with stakeholders.

• Ensuring the commitment of employees and institutional partners to the Privacy Programme.

• Evaluate existing data processing and protection mechanisms and propose policies, strategies and targets for compliance.

• Formulating principles and guidelines for personal data management.

4.4 LEGAL DEPARTMENT:

• Clarify doubts regarding the relevant legislation and regulations.

6. Personal Information Collected and PURPOSE

Personal information about you or your company is gathered and processed for the delivery of services and other business-related activities, as detailed below:

6.1 PERSONAL INFORMATION ARISING FROM THE PROVISION OF SERVICES:

personal data may be gathered while providing services to our customer to fulfil any contract. Although we provide our products and services primarily to companies, Dengine - Product SCORB may gather any information it reasonably deems necessary to prepare, enter into and fulfil contractual agreements. The way we use personal data in relation to our services may also vary. For example, our SCORB product may use personal data about a customer's employees to help with Headcount budget control. When your personal data is provided to us by our client, we take steps to ensure that the client has complied with privacy and data protection laws and regulations.

6.2 PERSONAL INFORMATION ARISING FROM OTHER ACTIVITIES THAT ARE PART OF OUR BUSINESS OPERATIONS:

personal data may also be used for or in connection with:

• Applicable legal or regulatory requirements;

• Requests and communications from competent authorities;

• Registration of customer users and other administrative purposes;

• Support service. When we receive support-related contact, we gather your contact information, the description of the problem and possible resolutions. We record the information that is provided to handle the support enquiry for administrative purposes, to promote our relationship with you, for staff training and for quality assurance purposes;.

• Financial accounting, invoicing and risk analysis;

• Customer relationship purposes, which may involve: (i) sending content about our products and services; (ii) contacting customers through their representatives to receive feedback on the services provided; and (iii) contact for other market or research purposes;

• To improve business operations, systems and processes. For example, we may use information to carry out, maintain, audit and optimize our operations, protect our assets and employees for the development or improvement of a product;.

• Services we receive from our professional advisers, such as lawyers, accountants and financial advisers;

• For the purposes of due diligence checks relating to services;

• Protection of our rights and those of our clients;

• Where there are legitimate interests of Dengine - Product SCORB in offering and delivering our services to you or our customer, as well as for the effective and lawful operation of our business, provided that such interests are not overridden by your interests, fundamental rights and freedoms.

• Compliance with applicable legal and regulatory obligations that may require the collection, storage and sharing of your personal data in order to comply with legal and regulatory provisions, such as:

• maintenance of records for tax purposes or providing information to a public body or law enforcement agency; (ii) compliance with labor and social security obligations; (iii) compliance with obligations to combat corruption, money laundering, fraud and irregular conduct.

Recruitment and selection:

Dengine – SCORB Product processes personal data in the context of selection processes for acquiring new talent. In this scope, candidates are directed to the specific Consent Term and Privacy Notice, where detailed information about the processing of their personal data is made available. To enable the recruitment and selection processes, Dengine may use tools from specialized suppliers responsible for collecting and storing candidates' personal data, acting as data processors under the terms of the General Data Protection Law. Such suppliers are contractually obliged to observe the privacy, information security, and data protection guidelines adopted by Dengine.

In the application flow, personal data may be collected, such as: full name, email, mobile phone number, date of birth, salary expectations, and information contained in the professional resume. These data are processed with the purpose of enabling the candidate's participation in the selection processes, as well as for professional profile evaluation and eventual hiring.

The personal data processed in this context will be used in compliance with applicable legislation, based on legitimate interest, and with good data protection governance practices, adopting appropriate technical and organizational measures to guarantee their security and confidentiality. Additionally, for the purposes of executing the employment contract and complying with legal and regulatory obligations, Dengine may process personal data of its employees during the term of the employment relationship. After the termination of the contract, certain data may be retained for the period necessary to comply with legal, regulatory, or contractual obligations, or for the regular exercise of rights in administrative, judicial, or arbitration proceedings.

I. Use of Data for Advertising and Marketing:

Dengine - SCORB Product may use users’ personal data, including email addresses, to carry out targeted advertising campaigns aimed at both existing customers and leads (potential customers). These campaigns may be conducted through platforms such as Google Ads, among others. When collecting personal data for such purposes, the company may use technologies like “Lookalike Audiences,” which help identify users with profiles similar to those who have already interacted with our brand. We clarify that the processing of personal data for advertising and marketing purposes will be carried out in accordance with data protection regulations, including the LGPD, and that the data subject’s consent will be obtained, when necessary, to ensure that such activities are in compliance with current legislation.

Further information on how we use cookies and other tracking technologies, as well as how you can control them, can be found in the PO18 - Cookies Policy .

II. Use of Sensitive Personal Data:

The insertion of sensitive personal data into the SCORB platform is not recommended. However, should the customer (in the capacity of data controller) choose to make such an insertion, they must ensure that the processing occurs in compliance with applicable legislation, especially the General Data Protection Law, being their responsibility to define the appropriate legal basis and observe data protection principles.

In these cases, Dengine – SCORB Product will act as the data processor of the personal data, performing the processing according to the controller's lawful instructions and adopting technical and administrative measures capable of protecting the personal data.

Likewise, your sensitive personal data may be processed in the following cases:

• By providing your specific and detached consent for the processing of your data.

• When necessary for compliance with applicable legal or regulatory obligations that may require the collection, storage and sharing of your personal data in order to comply with legal and regulatory provisions, such as (i) keeping records for tax purposes or providing information to a public body or law enforcement agency; (ii) complying with labor and social security obligations; (iii) complying with obligations to combat corruption, money laundering, fraud and irregular conduct.

III. Use of Children and Adolescents' Data:

We understand the importance of providing exceptional protection to the privacy and personal data of children and adolescents. Our services and our website are not designed or intentionally targeted at children and adolescents. It is not part of our policy to intentionally collect or store information about this type of audience; however, in situations where the collection and use of these types of personal data eventually become necessary, such as in the provision of services involving the analysis of personal data of underage dependents, the processing will occur in the best interest of the child and/or adolescent, under the terms of current legislation. In these cases, the processing of personal data of a child and/or adolescent will be carried out through specific and highlighted consent from at least one of the parents or legal guardian, except in legal hypotheses that waive consent, under the terms of articles 7 and 11, item II, of the LGPD, always observing the principle of the best interest of the child and adolescent.

9. User Rights

Users have the following rights, conferred by the General Data Protection Law (LGPD) and GDPR:

• Right of confirmation and access: the user's right to obtain confirmation from the company that personal data concerning them is or is not being processed and, if this is the case, the right to access their personal data;

• Right to rectification: the user's right to obtain, without undue delay, the rectification of inaccurate personal data concerning them;

• Right to erasure of data (right to be forgotten): this is the user's right to have their data erased from the organization's records;

• Right to restriction of data processing: this is the user's right to restrict the processing of their personal data, which they can obtain when they dispute the accuracy of the data, when the processing is unlawful, when the organization no longer needs the data for the purposes proposed and when they have objected to the processing of the data and in the event of unnecessary data processing;

• Right to object: this is the user's right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them, and to object to the use of their personal data for profiling purposes;

• Right to data portability: this is the user's right to receive the personal data concerning them that they have provided, in a structured, commonly used and machine-readable format, and the right to transmit this data to another company;

• Right not to be subject to automated decisions: the user's right not to be subject to any decision taken solely because of automated processing, including profiling, which produces effects in their legal sphere or significantly affects them in a similar way.

Users can exercise their rights by sending a written communication by e-mail ([email protected]) with the subject "LGPD", specifying:

• Full name or company name, CPF (Individual Taxpayer Registry of the Federal Revenue of Brazil) or CNPJ (National Corporate Taxpayer Registry of the Federal Revenue of Brazil) number, and the user's email address and, if applicable, their representative's;

• The right you wish to exercise with the company;

• Date of the request and the user's signature;

• Any document that can demonstrate or justify the exercise of your right;.

• The user will be informed in the event of rectification or deletion of their data.

When you submit a request asserting your rights as a data subject, you provide SCORB with personal information, including your name and contact details, which will be used to respond to your request. In some circumstances, in order to verify your identity and ensure that personal information has been disclosed to the correct individual, SCORB may also request a copy of your photo ID, which is deleted immediately after identity verification. Upon your request, your personal information is processed for the handling and fulfillment of your request, in accordance with SCORB's legal obligations and commitments. The data relevant to your request are retained for a minimum of three years from the date of your last communication with SCORB to address any requests you may have regarding this and for SCORB's compliance and record-keeping purposes.

10. Data Disclosure

Dengine - Product SCORB may share your personal information internally or externally with suppliers or consultants for legitimate SCORB business purposes, to technology companies responsible for storing and ensuring the security of the processing of your data and only if it is strictly necessary in connection with one or more of the purposes described in section 5. We may also need to disclose your personal data if required to do so by law, regulator or during legal proceedings. We may share non-personal, de-identified and aggregated information with third parties for various purposes, including data analysis, research, contributions, eminence content and promotional purposes. Some of our clients may be located in countries outside Brazil or outside the European Union, whose laws may not provide the same level of data protection. In these cases, we will ensure that we take all possible measures to protect your personal data in compliance with our legal obligations. We also provide more details about the transfers described above and the appropriate safeguards used by SCORB with respect to such transfers via the email: [email protected].

11. Security in the processing of the user's personal data

Dengine - Product SCORB undertakes to apply technical and organizational measures to protect personal data from unauthorized access and from situations of destruction, loss, alteration, communication or dissemination of such data. To guarantee security, solutions will be adopted that consider: the appropriate techniques; the costs of implementation; the nature, scope, context and purposes of the processing; and the risks to the rights and freedoms of the user. However, Dengine - Product SCORB disclaims liability for the sole fault of the user, such as when the user transfers their data to a third party. Dengine - Product SCORB also undertakes to notify the user within an appropriate period of time in the event of any breach of the security of their personal data that may cause a high risk to their personal rights and freedoms. A personal data breach is a breach of security that causes the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed. Finally, Dengine - Product SCORB undertakes to treat the user's personal data confidentially, within the limits of the law.

12. Personal data retention period

We will keep your personal data in our systems for the longer of the following periods:

• as long as it is necessary for the relevant activity or services;

• any retention period required by law;

• the end of the period in which disputes or investigations in relation to the services may arise;

• as long as your consent is valid, in the applicable cases;

• in accordance with current legislation.

The personal data of users who visit our site for commercial purposes will be kept for a maximum of one (1) year.

For our regular customers, we adopt the retention period for as long as the service contract is in force plus 30 days. If this contract is terminated, the personal data shared by the client will be manually deleted.

13. Management of Consequences

Employees, suppliers or other stakeholders/publics of interest who observe any deviations from the guidelines of this Policy may report the fact to our Data Officer (DPO), by e-mail: [email protected], and may or may not identify themselves. Internally, failure to comply with the guidelines of this Policy will result in the application of measures to hold agents accountable for non-compliance, depending on the seriousness of the breach.

14. Complementary Documentation

• Article 5 of the Brazilian Federal Constitution of 1988;

• Code of Ethical Conduct of Dengine - SCORB Product;

• Cookies Policy;

• Brazilian Law No. 13.709/2018;

• Internal rules and procedures that are constantly improved, approved by the competent authorities and made available to all employees.

15. Contact

SCORB's Data Protection Officer (DPO) is Mrs. Evelyn M. C. Gama. The Data Protection Officer's contact and channel for objections, questions, complaints and comments about this Policy and our privacy practices is the email [email protected]. We will receive and investigate any complaints about the way we manage Personal Data (including complaints about failure to respect your rights under applicable privacy laws). This Policy takes effect on the date of its approval by the Board of Directors of Dengine - Product SCORB and revokes any documents to the contrary.

16. Updates

This Privacy and Data Protection Policy is subject to annual review and may receive incremental updates, according to the purpose or need for adaptation and compliance with legal provisions, or whenever Dengine - SCORB Product deems it necessary. Changes will be disclosed through the website https://scorb.com.br/

The continued use of Dengine - SCORB Product services or the provision of services to Dengine - SCORB Product, as the case may be, after the disclosure of changes will be considered acceptance by the customer and third parties of the new terms and conditions. Therefore, we encourage you to periodically review this Policy to be informed of how we are protecting your information.