Privacy Policy

This Privacy Policy aims to demonstrate the commitment of Certisign Digital Certification S/A ("CERTISIGN"), a private legal entity, enrolled with the CNPJ/ME under No. 01.554.285/0001-75, headquartered in this City of São Paulo, State of São Paulo, at Rua Bela Cintra, nº 904, 11th floor, Cerqueira César, CEP 01415-002, with the protection of personal data that identify the USER individually ("Personal Data") and other data provided, describing the practices by CERTISIGN in relation to personal data processed by through CERTISIGN websites, blogs and apps, hereinafter jointly and indistinctly referred to as the "Site", in accordance with the laws in force, in particular Law No. 13,709/2018 and its amendments (“General Data Protection Law” or “LGPD”).

To make a purchase on the Site, the USER will need provide some financial information that may be stored in CERTISIGN servers.

As a condition for accessing and using the exclusive features of the Site, the USER declares to be over 18 (eighteen) years of age or, if is a minor, the USER declares that he obtains, in this act, the express consent of their legal guardians, as well as made the complete and careful reading of the rules of this Privacy Policy, thereby conferring your free, informed and unequivocal assent to the terms stipulated here.

IF YOU DO NOT AGREE WITH THE RULES OF THIS PRIVACY POLICY, YOU SHOULD DISCONTINUE YOUR ACCESS TO THE SITE.

1. WHAT IS THE PURPOSE OF THIS POLICY?

This Personal Data Privacy Policy aims to establish rules and guidelines on the processing of personal data collected by CERTISIGN on their websites, blogs and applications.

This document was prepared in order to clarify how personal data are handled by CERTISIGN in compliance with the General Law of Data Protection.

By accepting this Privacy Policy, the USER agree to the terms described therein and to the processing of personal data, for the purposes described below.

The acceptance of the USER it's voluntary. However, if the USER not provide your acceptance, a CERTISIGN will not be able to offer its services in full or partially for the USER.

2. TERMS AND DEFINITIONS

For the understanding of this policy we must consider the descriptions of the settings as detailed below:

Anonymization – use of reasonable technical means and available at the time of processing, whereby data loses its possibility of direct or indirect association with an individual;

National Authority / National Data Protection Authority (ANPD) – public administration body responsible for overseeing, implementing and monitor compliance with the LGPD throughout the national territory;

Database – structured set of personal data, established in one or several places, electronically or physically;

Block – temporary suspension of any operation of treatment, through the custody of personal data or the database;

Contributors – Persons hired to integrate the staff at CERTISIGN;

Consent – free, informed and unequivocal statement by which the holder agrees with the processing of his data personal data for a specific purpose;

Controller – natural or legal person, of right public or private, who are responsible for decisions regarding the treatment of personal data;

Cookies - These are data obtained from Internet files that temporarily store what the USER is visiting on the network, and can be obtained by websites and applications by CERTISIGN and that allow a CERTISIGN track the sections visited, the frequency and duration of visits, as well as providing automatic logins, personalization, for example.

Personal Data – information related to natural person identified or identifiable;

Sensitive Personal Data – personal data on racial origin or ethnicity, religious belief, political opinion, trade union membership or the organization of a religious, philosophical or political nature, data referring to health or sex life, genetic or biometric data, when linked to a natural person;

Deletion – data or data set deletion stored in a database, regardless of the procedure employee;

Purpose – reason why treatment is carried out holder's personal data;

Privacy Incident – any accidental situations or unlawful acts that result in the destruction, loss, alteration, improper access, Unlawful or inappropriate processing of Personal Data;

General Law for the Protection of Personal Data (LGPD) – Law No. 13,709/2018 and its subsequent amendments, which provides for the treatment of personal data of natural persons, regardless of the means, per person natural or by a legal entity governed by public or private law, with the objective of protecting the fundamental rights of liberty and privacy and the free development of the personality of the natural person.

Operator – natural or legal person, governed by public law or private, which processes personal data on behalf of the controller;

Website – websites, blogs and apps CERTISIGN;

Portal – the Certisign Signature Portal, also known as iziSign, is a solution for managing, as well as, digital and electronic signature of documents with legal validity.

Owner / USER – natural person to whom the personal data that are subject to treatment;

Holder/SIGNATORY – natural person to whom the personal data that are subject to treatment, which includes USER and the third party that accesses the Portal to sign documents in compliance with a request from another USER;

Treatment – any operation carried out with personal data, such as those referring to collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, disposal, evaluation or control of the information, modification, communication, transfer, dissemination or extraction;

International Transfer of Personal Data – transfer of personal data to a foreign country or body international organization of which the country is a member;

Shared Use of Personal Data – Communication, dissemination, international transfer, interconnection of personal data or shared treatment of personal databases by bodies and public entities in the fulfillment of their legal competences, or between these and private entities, reciprocally, with specific authorization, to one or more treatment modalities allowed by these public entities, or between private entities.

3. WHAT PERSONAL DATA IS PROCESSED?

So that CERTISIGN carry out data processing provided for in this Policy, it is essential to collect some information about USER. In this way, they may Personal Data provided directly by the USER, by third parties or collected automatically, according to the purpose of treatment. See below for collection methods. Personal Data:

Personal Data provided directly by the USER: The data is collected when voluntarily entered or submitted by USER when, for example, you buy a digital certificate through the Site or register in our other platforms, such as Clube do Contador, Support and Talk to Us.

The information we collect directly from the USER they are, but not limited to: Name, email, CPF, biometric data, profession and Contact phone. The data below may also be collected.

• Registration Data – These are mandatory personal data for use of services or contracting of products;
• Professional data – It is personal data related candidate's professional profile in order to identify prerequisites required for vacancies available at CERTISIGN, as well such as class identity data, such as, for example, OAB number and CRM, institutional registration number, and PIS number;
• Cookies – as defined in item 2 of this Policy;
• IP – These are data that make it possible to identify USER and that allow a CERTISIGN track the sections visited, the frequency and duration of visits.
• Location - This data is used for authentication. USER in the electronic signature process;

Personal Data provided by third parties: A CERTISIGN may receive Personal Data through third parties that have a relationship with you and that it is necessary for the use of our services, for example, information obtained from ICP-Brasil.

Specifically in the Portal process, the USER will transfer to CERTISIGN you following personal data of SIGNATORY: name, CPF and email. In addition, USERNAME will submit to the Portal documents that may contain personal data of the SIGNATORY and/or third parties. In this sense, the USER takes responsibility as the controller of the data and/or sensitive personal data of SIGNATORY and of the Documents, and must adopt all preventive measures and security, pursuant to Law No. 13.709/18 ("General Law for the Protection of Data” or “LGPD”).

The processing of personal data of children and adolescents will be carried out only with the specific and outstanding consent of one of the parents or the Legal guardian.

The data processed by CERTISIGN will be stored by time necessary to fulfill the purposes for which they were collected or even to comply with legal requirements and regulatory requirements, fulfillment of contractual obligations, so that the CERTISIGN can exercise their rights in proceedings administrative, arbitral and/or judicial proceedings, or even for compliance of the other hypotheses provided for in the LGPD. End of storage period of the data, CERTISIGN will safely dispose of them.

The credit or debit card numbers provided by the USER are only used in the processing of payments for services provided, not being stored in a bank data.

IT'S UP TO USER THE DUTY TO PROVIDE INFORMATION, INCLUDING PERSONAL DATA, CORRECT AND UPDATED. The CERTISIGN IT IS NOT RESPONSIBLE FOR THE ACCURACY, TRUE OR LACK OF THE INFORMATION PROVIDED BY THE USER, MAY, AT ITS EXCLUSIVE DISCRETION, SUSPEND AND/OR CANCEL THE REGISTRATION OF THE USER, AT ANY TIME IF ANY INACCURACY IS DETECTED.

4. WHAT IS THE PURPOSE OF PROCESSING PERSONAL DATA?

The personal data processed by Certisign are intended to meet the following purposes:

• Contact with potential customers, if there is prior consent;
• Promotion of the services offered, if there is prior consent;
• Registration for access to the platforms of CERTISIGN;
• Contracting services or products from CERTISIGN, including functionalities necessary for the full use of the service or contracted products;
• Service and support provided to customers, employees, suppliers and service providers of CERTISIGN;
• To send emails and communications about product expiration CERTISIGN, including through third parties that holder has used to contract the products of the CERTISIGN, pursuant to current regulations;
• Videoconferencing to obtain products by CERTISIGN, under the terms of the current regulation;
• Conducting research and development of new products or services, as long as authorized by the holder and with the guarantee of anonymization of the information;
• Improvement of services on the Site;
• Improvement of the informed content;
• Provide the USERa good and easy experience of Site navigation;
• Defense of interests in administrative, arbitration and judicial;
• Compliance with a legal or regulatory obligation, or court order, or administrative requirement;
• To operate, evaluate and improve the business from CERTISIGN, including the analysis and revision of the database customers and services of CERTISIGN; data analysis and market research; and performing accounting, auditing and other built-in functions;
• For internal record keeping;
• Implement and maintain technical and organizational security measures, internal audits and investigations, checks for conflicts of interests;
• To respond to the demands of the USER;
• To communicate USERabout changes to the Privacy Policy Privacy or Terms of Use, if necessary; and
• To protect, identify and prevent fraud or other activities illicit.

Personal Data will be stored for operational purposes and will comply with to strict standards of confidentiality and security. No document, information and/or personal data will be disclosed and/or shared in any case, unless expressly authorized by the USER, for the purpose of fulfilling the services hired, by judicial/administrative order, by determination legal/regulatory, for the exercise of rights of the CERTISIGN in administrative, arbitration and/or lawsuits, or other hypotheses provided for in this Policy or in the legislation applicable. Personal data collected and activities recorded are also may be shared with judicial, administrative or competent government agencies, whenever there is an application, requisition or court order.

The database formed through the collection of personal data on the Site is property and responsibility of CERTISIGN, and its use, access and sharing, when necessary, will be carried out within the limits and purposes of its business, and may, in this sense, be made available for consultation and transferred to suppliers and authorities, provided that the provisions of this Privacy Policy are complied with. Privacy and the LGPD.

Internally, the personal data of the USER are accessed only by duly authorized employees, respecting the principles of purpose, adequacy, necessity, minimum retention and other principles inherent in the processing of personal data, always for objectives of CERTISIGN, in addition to the commitment to confidentiality and preservation of privacy under the terms of this Policy of Privacy.

Attention: In relation to the Portal, third parties may use CERTISIGN in your name. In this case, the USER should carefully review the Privacy and Terms of Use of these third parties before using the respective services. CERTISIGN not responsible for the processing of personal data that is carried out by these third parties when use the Services.

5. WHAT IS THE LEGAL BASIS FOR PROCESSING PERSONAL DATA?

The processing of the USER's personal data may be accomplished:

• With free, informed and unambiguous consent USER, only when legally required or allowed. If CERTISIGNuses consent from USER as a legal basis for processing your Personal Data, the USER you can withdraw your consent at any time;
• To comply with a legal or regulatory obligation;
• For the regular exercise of rights in legal proceedings, administrative or arbitration;
• To establish a contractual relationship between the USER and the CERTISIGN and comply with our obligations assumed under a contract;
• In order to respond to requests from USER;
• To protect anyone's vital interests;
• Backed by any other legal basis permitted by the LGPD;
• When necessary to meet legitimate interests from CERTISIGN, including with the following objectives:

• The collection of personal data to support and promote activities by CERTISIGN;
• Ensure our networks and information are secure;
• Administer and conduct business within the CERTISIGN;
• Prevent or investigate suspected or actual violations of the law, breaches of contract or other policies by CERTISIGN;
• Optimize or broaden our commercial reach and relevance of communication.

6. DATA SHARING WITH THIRD PARTIES

The Personal Data processed by CERTISIGN may be shared with and accessed by third parties as defined below.

For our business purposes

A CERTISIGN may share personal data with third parties for their own business purposes. The CERTISIGN will share personal data strictly necessary to provide or otherwise enable the provision of customer services, as well as for various internal purposes, such as provide services to the consumer, ensure the security of services by CERTISIGN, improve the quality of the services that a CERTISIGN provides, and analyze personal data that are collected.

To provide services and products

A CERTISIGN may share personal data with its partners, who help CERTISIGN to provide products and services to the USER. The CERTISIGN need to share personal data with these partners in order to process the holder's requests, comply with their requests, provide customer support, or provide other services and functions such as displaying geolocation information on platforms by CERTISIGN. The CERTISIGN you can also share personal data with other companies in its Group to better serve the USER or keep business by CERTISIGN.

For other internal reasons

A CERTISIGN may share personal data with partners and other entities that provide à CERTISIGN certain services or that assist with functions internal regulations or compliance with legal/regulatory provisions, such as data analysis, maintaining the security of internal systems, security of information, auditing companies, law firms, companies of data analysis (data analytics), assurance evaluators of quality, among others.

For legal reasons

A CERTISIGN may share Personal Data with partners and other entities when necessary to fulfill obligations legal, including compliance with any applicable law or regulation, judicial, arbitration or administrative proceedings. The CERTISIGN may also share information to protect and defend the rights of CERTISIGN, owners of personal data, or anyone else, to protect against fraudulent or malicious activities, to enforce the terms of this Privacy Policy, or to cooperate with law enforcement agencies law.

Regarding corporate transactions

If CERTISIGN, directly or indirectly, enters the business transaction process such as mergers, acquisitions by another company, or sale of all or part of its assets, a CERTISIGN may share all Personal Data to the successor or potential successor company, as well as to its employees during the transaction and with auditing firms and lawyers who are assisting in the operation.

When the USER consents to disclosure

A CERTISIGN may share certain information with partners or other entities when the USER consent with the sharing of this personal data, in terms of consent specific, formalized prior to data sharing personal.

When the USER uses the integration services with the Google

The USER that is not using the Portal for through third parties, you can take advantage of integration services with the Google. Thus, CERTISIGN, through the Portal will make the integration with the Google platform and will share personal data from the USUÁRIO, in order to provide the following functionalities:

• Use of Google credentials: The Portal uses Google credentials in order to use the email address and full name. These information (email address and full name) are only used to fill in the registration automatically and to guarantee authenticity and information integrity. In this case, the Portal is able to perform the USER in the system in a simple way and without the need to go through email address validation process. At no time is the Google password accessed or manipulated by CERTISIGN. The Oauth 2.0 protocol – the mechanism in which User authentication is done directly by the authentication service of Google without any involvement and influence from CERTISIGN – ensures this security.
• File transfer to the Portal via Google Drive: The Portal provides USER transfer documents directly from Google Drive to the Portal, through a tool made available by Google. This functionality does not store any data. personal and is solely intended to enhance the customer experience. USER during the document submission flow for signature. Only files selected and authorized by the USER are transferred to the Portal.

7. INTERNATIONAL TRANSFER OF PERSONAL DATA

A CERTISIGN has companies and suppliers headquartered in abroad and, therefore, may transfer Personal Data from USER for operators based in other countries. The CERTISIGN may transfer Personal Data from USER for the purposes set forth in this Policy, relating to this Privacy Policy and applicable laws. You must be aware that personal data protection laws in many countries may not offer the same level of protection as the LGPD does.

The international transfers of personal data carried out by CERTISIGN are made in line with the provisions of the General Law Data Protection.

8. WHAT ARE THE USER RIGHTS?

In accordance with the LGPD, CERTISIGN guarantees the following rights to the USER:

• Confirmation of the existence of processing of personal data;
• Access to your personal data;
• The correction of incomplete, inaccurate or outdatad personal data;
• The anonymization, blocking or deletion of unnecessary personal data, excessive or treated in violation of the LGPD;
• The portability of personal data to another service provider or product, upon express request, in accordance with the regulations of the ANPD;
• The deletion of personal data processed with the consent of the holder, with exceptions provided for in the LGPD;
• The information of the public and private entities with which CERTISIGNcarried out shared use of data personal;
• Information about the possibility of not providing consent and about the consequences of the denial;
• The revocation of consent, under the terms of the LGPD;
• Automated decision review.

The rights of the USER provided for in the LGPD and in this Policy may be exercised at the express request of the from USER or your legal representative à CERTISIGN and can be done through the service channel established by CERTISIGN – Contact Us.

A CERTISIGN will use all reasonable efforts to fulfill the requests made by USER, in the least time possible, and in compliance with legal requirements. Nonetheless, justifiable factors, may delay or prevent your rapid service, being certain that, in case of delay, they will be presented to the USER due reasons.

The USER You should be aware that your request may be legally rejected, either for formal reasons (such as your inability to prove your identity) or legal (such as the request exclusion of personal data whose maintenance is a free exercise of rights by CERTISIGN), provided that, in the event of impossibility of meeting these requests, will be presented to the USER reasonable justifications.

9. LINKS TO THIRD PARTY SITES

The Privacy Policy adopted by CERTISIGN It is relevant only to the Site and not applicable to any other site than the it is associated with or otherwise related through of "links" or other forms of disclosure and access.

The Site contains access to links to external sites whose contents and Privacy Policies are not the responsibility by CERTISIGN. Thus, it is recommended to the USER that, when redirected to external websites, always consult the respective Privacy Policies before providing your data or information.

10. ABOUT COOKIES

This information is used to understand the way in which the USER interacts with the content contained in the portals by CERTISIGN, facilitating subsequent visits through automatic logins, customization features, and in some cases to marketing actions.

The Certisign Site may use some types of cookies to improve USER's browsing experience as below described:

TYPE OF COOKIES	WHAT THEY DO	CAN THEY BE DISABLED?
Strictly necessary cookies	These cookies are necessary for the website to function and do not may be turned off in our systems. Usually they are just configured in response to actions you take that correspond to a request for services, such as setting the your privacy preferences, log in or fill out forms. You can configure your browser to block or alert you to these cookies, but some parts of the website they won't work. These cookies do not store any information personally identifiable.	No
Performance Cookies	These cookies allow us to count visits and traffic sources, so that we can measure and improve the performance of our website. They help us to know which pages are more and less popular and see how visitors move around the website. All information collected by these cookies is aggregated and, therefore anonymous. If you do not allow these cookies, we will know when you have visited our site.	Yes
Functionality Cookies	These cookies allow the website to provide functionality and Improved personalization. They can be established by us or by external providers whose services we have added to our pages. If you do not allow these cookies, some of these functionalities, or even all, may not work correctly.	Yes
Advertising cookies	These cookies can be set through our website by our advertising partners. These can be used by companies to build a profile about their interests and show you relevant advertisements on other websites. They do not directly store personal information, but are based on the unique identification of your browser and device Internet. If you do not allow these cookies, you will receive less advertising directed.	Yes

On your first visit to the Site, USER can configure cookies in the cookie preferences setting bar that appears at the bottom of the Site's home page. However, in case the USER want to reset your cookie preferences on the Site, you must log into your browser and clear your cookie history.

For more information on how to manage cookies, go directly to the directions in your preferred browser.

11. COMMUNICATIONS AND MARKETING

If you have signed up to receive marketing from the Site the USER receive news, and personalized advertising about our products and services.

By registering to receive marketing from CERTISIGN, the USER declares to agree that a CERTISIGN perform a custom build of news and offers, as well as evaluate your patterns of use of the Site, for the sending e-mail marketing, electronic messages, phone calls and other personalized forms of communication that meet the needs and interests of the USER.

If the USER no longer wish to receive communications or marketing by CERTISIGN, you may cancel your registration at anytime. For this, the USER you can click on opt-out present in all newsletters to be forwarded to the cancellation process or you can use one of the means of communication mentioned in this Privacy Policy. However, it is It is important that USER be aware that you have the right to withdraw consent to receive this information via electronically, but if you do, CERTISIGN you can cancel the contracted services and products, if such consent is essential for the provision of services by CERTISIGN.

12. HOW IS PERSONAL DATA STORED?

Personal data and activity logs collected will be stored in a safe and controlled environment, for a minimum period of 6 (six) months, in terms of Law No. 12.965/14 ("Civil Framework for the Internet"), subject to the state of the available technique. However, considering that no security is foolproof, CERTISIGN disclaims any liability for any damages and/or losses resulting from failures, viruses or invasions of our database, except in cases where has intent or fault.

Personal data may be deleted before this deadline, if there is request from the USER.

However, based on the conditions for processing personal data provided for in this Privacy Policy and the LGPD, including for reasons of law, regulation and/or judicial determination, audit, security, fraud control and preservation of rights, registration data may be kept for a longer period, after which they will be deleted with of secure disposal methods.

13. INFORMATION SECURITY

A CERTISIGN adopts technical and organizational measures adequate and in line with the current market standard to protect the Data Personal Protection Incidents. THE CERTISIGN frequently updates technical measures and organizational arrangements, provided, however, that such modifications do not diminish the overall level of security.

Under the terms of the General Law for the Protection of Personal Data and in accordance with its internal rules on the protection of personal data, the CERTISIGN will notify USERS at hypothesis of Privacy Incidents that may entail risk or damage relevant to USERS.

14. GENERAL PROVISIONS

This is the most up-to-date version of the Privacy Policy. The CERTISIGN may change the content of this Privacy Policy Privacy at any time, according to purpose or need, such as which for suitability and legal compliance of provision of law or rule that have equivalent legal force, to the USER check it every time you access the Website.

If there is any doubt about the conditions established in this Privacy Policy Privacy policy or any CERTISIGN document, please get in touch through the service channels by CERTISIGN.

If any provision of this Privacy Policy is considered illegal or illegitimate by the authority of the locality where the our USERNAME reside or your Internet connection, the remaining conditions will remain in full force and effect.

The USER acknowledges that all communication made by e-mail (to the addresses informed by him), SMS, communication applications instant, videoconferencing or any other digital, virtual and digital are also valid as documentary evidence, being effective and sufficient for the disclosure of any matter relating to the services provided by CERTISIGN, as well as the conditions of its provision, subject to expressly different provisions provided for in this Privacy Policy.

15. APPLICABLE LAW AND JURISDICTION

This Privacy Policy and the relationship arising from actions here understood, and any dispute arising out of this will be regulated exclusively by Brazilian law.

The Central Jurisdiction of the Judicial District of the Capital of the State of São Paulo is elected to resolve any issue involving this document, waiving the parties to any other, however privileged it may be or become.

16. QUESTIONS ABOUT THIS POLICY

If you have any questions or would like to provide feedback about our Privacy Policy, please write to dpo@certisign.com.br.

Last update: 11/17/2022