Privacy policy and data processing

Last Update: January 22, 2025

1. Objective

Indicium , a private law legal entity registered with the CNPJ under no. 28.385.126/0001-40 , headquartered in Florianópolis/SC , understands as sensitive and relevant the electronic records and personal data left by you (“User”) when using Indicium's websites and services (“Pages”), with this Privacy Policy (“Policy”) serving to regulate, in a simple, transparent and objective manner, which data and information will be obtained, as well as when they may be used.

The purpose of this policy is to ensure the protection of personal data collected by Indicium, informing users about what data is obtained, how it is used and with whom it is shared. The policy ensures compliance with the General Data Protection Law (LGPD) and other legislation, promoting transparency in data processing. In addition, it provides guidance on users' rights and the measures adopted for information security.

This policy applies to data collection and processing activities carried out through the website https://www.indicium.tech/pt-br and other platforms managed by Indicium . Below, we detail the main aspects of our policy to ensure clear and objective understanding by users.

This policy refers solely and exclusively to data processed by Indicium. For policies applicable to your personal data processed by third parties, we suggest that you visit their respective websites.

2. What Personal Data Does Indicium Collect?

Indicium may collect information actively entered by the User at the time of registration and also information collected automatically when using the pages and the network, such as, for example, identification of the commercial establishment used, IP with date and time of connection, among others.

There are, therefore, two types of personal data being processed:

2.1. User Provided Information

Indicium collects all information actively entered by the User on the Pages, such as full name, email, gender, date of birth, telephone number, city and state, when the User fills out forms on the Pages. Indicium will use this information to promote the dissemination of advertising material, promotions and events.

2.2 Automatically Collected Data

Indicium also automatically collects a series of information, such as: characteristics of the access device, browser, IP (with date and time), IP origin, information about clicks, pages accessed, subsequent pages accessed after leaving the Pages, or any search term entered on the websites or in reference to them, among others. For this collection, Indicium will use some standard technologies, such as cookies, pixel tags, beacons and local shared objects, which are used for the purpose of improving the User's browsing experience on the Pages, according to their habits and preferences.

The information collected may be shared by Indicium with:

• Other partner companies, when necessary for the adequate provision of the services that are the object of their activities;
• To protect Indicium’s interests in any type of conflict;
• By court order or request from the competent authority.

Furthermore, we clarify that your information may also be shared with companies that provide the technological and operational infrastructure necessary for Indicium's activities, such as payment intermediaries and information storage service providers.

2.3 Explicit Consent and Cookie Control

According to the LGPD, explicit consent is required for the use of cookies and automatic data collection technologies, except when they are strictly necessary for the functioning of the website. The Indicium platform provides a cookie consent banner, which allows the user to opt for specific categories of cookies, such as:

• Necessary cookies;
• Performance cookies;
• Functionality cookies;
• Marketing cookies.

Additionally, the user has the option to change their cookie preferences directly in the website settings at any time. If the user wishes to disable all cookies via their browser, they can do so, although this may impact certain features of the website, as previously mentioned.

3. Managing Cookie Preferences

Indicium uses cookies and similar technologies to improve the user experience on its pages, adapting content and advertisements based on your preferences. To ensure total transparency and control to the user, we provide a specific tool for managing cookie consent.

At Indicium, we respect your preferences regarding the collection of cookies. You can configure your cookie preferences in several ways:

3.1 Site Settings

When you first visit our website, a banner will appear informing you about the use of cookies. In this banner, you can choose to accept all cookies, customize your preferences or reject non-essential cookies.

When choosing the personalization option, you will be able to select which categories of cookies you want to allow. The categories include:

• Necessary Cookies: Essential for the website to function.
• Performance Cookies: Used to analyze website performance and improve user experience.
• Functional Cookies: Allow for customization and additional functionality.
• Advertising Cookies: Used to deliver relevant advertisements and measure the effectiveness of advertising campaigns.

3.2 Browser Settings

You can manage cookies through your browser settings. Below are instructions for disabling cookies in some of the most popular browsers:

• Google Chrome: Go to "Settings" > "Privacy and Security" > "Cookies and other site data" and adjust your preferences.
• Safari: Go to "Preferences" > "Privacy" and select "Manage Website Data" to adjust your settings.

3.3 Opt-Out of Cookies

Additionally, at any time, the user may opt-out of Indicium's advertising campaigns and newsletters by accessing their communication preferences in the website settings area, or requesting to unsubscribe by emailing privacy @indicium.tech .

Reinforcing again that, when adjusting your settings, you should be aware that disabling cookies may affect the functionality of the website and the user experience.

4. How Indicium Uses Collected Information

The information collected by Indicium is intended to establish a contractual relationship or to manage, administer, provide, expand and improve the Pages to the User, adapting them to their preferences and tastes, as well as to create new services and products to be offered to Users.

Additionally, the information collected may be used for advertising purposes, such as sending information about Indicium brands, products, promotions, as well as the dissemination of events or the carrying out of purchase satisfaction surveys, subject to the consent of the holder to do so. If the User no longer wishes to receive advertising information from Indicium, the User may, at any time, contact Indicium via the email privacy @indicium.tech .

Indicium is committed to respecting the principles established by the Brazilian Internet Civil Rights Framework (Law No. 12,965/2014) , which regulates the use of the Internet in Brazil. We guarantee net neutrality, ensuring that users’ data traffic will not suffer discrimination or interference, promoting a fair and equitable digital environment. In addition, the company is dedicated to ensuring equal access to online services, adopting best data protection practices and respecting users’ digital rights.

Legal Basis : In these cases, data processing is authorized by section I of article 7 of Law No. 13,709/2018, the General Data Protection Law (“General Data Protection Law – LGPD”).

5. How, When and With Whom Indicium Shares Your Information

We share personal data with third parties to expand our communication capabilities with you and our partners, as well as to comply with applicable laws and regulations, to protect our rights, and to comply with court orders. We may also obtain publicly available personal data from Indicium partners, including social networks. Indicium will comply with the limitations of consent granted by data subjects to their partners.

Indicium may share the personal data collected with third parties, always respecting the purposes stated in this Privacy Policy and based on the permissions granted by the data subject. Data may be shared in the following situations:

• Business Partners: Indicium works in partnership with several companies to provide services and enhance your user experience. These companies include, but are not limited to:

• Data hosting and storage service providers: Responsible for ensuring the security and availability of information in cloud environments.
• Data analysis companies: For reporting purposes and to improve the services offered.
• Payment intermediaries: When payment processing is necessary.

• Marketing and advertising purposes: Data may be shared with partners who assist in the execution of marketing campaigns, and these companies are responsible for following the LGPD guidelines regarding the use of data for such purposes.

• Legal and government authorities: Indicium may share data with public, judicial or government authorities to:

• Comply with court orders or official requests;
• Ensure compliance with current laws;
• Protect your rights in cases of legal disputes or conflicts involving the company.

• Security audits and consultancies: In order to ensure compliance with security and data protection standards, Indicium may share information with companies specializing in cybersecurity and data protection audits. This ensures continued compliance with market best practices and regulations such as ISO 27001.

• Corporate transfers: In the event of mergers, acquisitions or other corporate restructuring processes, user information may be transferred to Indicium's legal successors, ensuring the continuity of the service and maintaining the data protection practices informed in this Policy.

Indicium is committed to ensuring that all third parties with whom it shares personal data maintain the same level of protection and confidentiality required by the LGPD and other applicable legislation.

6. International Data Transfer

Indicium may, in exceptional circumstances, transfer personal data to other countries when necessary for the provision of services, fulfillment of contractual obligations or for other legitimate reasons. Although this is a possibility, the company does not frequently carry out international data transfers.

If such a transfer occurs, it will be done in compliance with applicable data protection regulations, using appropriate safeguards, such as standard contractual clauses, to ensure that personal data is treated in accordance with legal standards. Any and all international data transfers will be duly documented and recorded, as required by internal policies and applicable legislation.

Information on possible international data transfers will be available in this Privacy Policy, and customers may request details on the countries to which their data may be transferred, as well as the protection mechanisms adopted.

7. How Indicium Protects Your Information

Indicium will store the information collected on its pages on its own servers or on servers contracted by it. Our company adopts a series of technical and organizational measures to ensure the protection of its users' personal data, in accordance with best cybersecurity practices and the requirements of LGPD and ISO 2700, in compliance with the guidelines on security standards established in Decree No. 8,771/2016. The main measures implemented are:

• Data encryption: Use of industry-standard methods to encrypt and anonymize collected data. All data collected by Indicium is stored on secure servers, and sensitive information such as passwords and financial data is protected by advanced encryption both in transit and at rest.
• Access control: Implementation of protection against unauthorized access to your systems. Authorization of restricted access, only to previously established people, to the location where the collected information is stored. Access to personal data is restricted to authorized employees and service providers, and only for specific purposes related to their functions. Such access is monitored and audited regularly.
• Confidentiality of Information: Commitment of all employees and service providers to maintain absolute confidentiality regarding the information accessed, with provision for civil liability in the event of breach of confidentiality, in accordance with Brazilian legislation.
• Regular Audits: Indicium conducts periodic security audits to identify vulnerabilities and ensure that its security practices comply with international standards, including ISO 27001. These audits are conducted by specialized internal and external teams.
• Security Incident Monitoring: We implement a continuous monitoring system to detect and respond quickly to cyber threats and unauthorized access attempts. This includes the use of intrusion detection technologies and next-generation firewalls.
• Security awareness programs: All Indicium employees undergo periodic information security training, which covers everything from safe system usage practices to awareness of cyber threats such as phishing and social engineering.
• Incident response plans: In the event of a security incident, Indicium has a well-defined incident response plan, which includes notification of affected data subjects, as well as communication with competent authorities, as required by law.

Additionally, we review our security practices regularly to ensure they are always up to date with new threats and emerging technologies in the information security field.

Indicium strictly follows the Cybercrime Law (Law No. 12,737/2012) , which defines illegal conduct in the digital environment. Any attempted hacking, data breach or cybercriminal activity will be treated seriously and may result in legal sanctions. The company constantly monitors its systems and adopts robust security measures to prevent and report practices that may compromise the integrity of user information.

Although Indicium makes every effort to preserve the privacy of Users' data, it is important to emphasize that no website is completely secure and we cannot fully guarantee that all information transmitted on the Pages will not be subject to unauthorized access by methods developed to obtain information improperly. For this reason, we encourage Users to take appropriate measures to protect themselves, such as keeping all usernames and passwords confidential.

8. Document Classification and Labeling

Indicium adopts a document classification and labeling procedure to ensure that personal data and sensitive information are treated according to their level of confidentiality. The classifications are as follows:

• Public: Information that can be disclosed to the general public without risk to privacy or security. Examples include company data that is widely publicized.
• Internal: Data that is intended for Indicium's internal use and should not be shared externally without prior authorization. This includes information about internal policies, communications between departments, etc.
• Confidential: Information that requires a high level of protection and is restricted to a specific group of employees. This includes users' personal data, financial information, and any data that, if disclosed, could result in harm to Indicium or its users.
• Secret: Data whose unauthorized disclosure could cause significant harm to Indicium or third parties. This includes information about business strategies, sensitive contractual agreements, and high-risk personal data such as health information.

Each document and information stored at Indicium is classified according to this structure, and all employees are trained to understand and respect these categories, ensuring that information is handled and protected according to its level of sensitivity.

8. Your Rights

In compliance with applicable regulations, with regard to the processing of personal data, Indicium respects and guarantees the User the possibility of submitting requests based on the following rights:

• Confirmation of the existence of treatment;
• Access to data;
• Correction of incomplete, inaccurate or outdated data;
• Anonymization, blocking or deletion of unnecessary, excessive or non-compliant data;
• Portability of your data to another service or product provider, upon express request by the User;
• Deletion of data processed with the User's consent;
• Obtaining information about the public or private entities with which Indicium has shared your data;
• Information about the possibility of not providing your consent, as well as being informed about the consequences in case of refusal;
• Revocation of consent.

These rights may be exercised by sending a request for subsequent evaluation and adoption of further measures by Indicium.

If you need any assistance to exercise your rights, the User can contact Indicium, as per the guidelines in this Policy.

The User is aware that the exclusion of essential information for managing his/her account with Indicium will imply the termination of his/her registration, with consequent cancellation of the services then provided.

Indicium will make every effort to comply with such requests as quickly as possible. However, even in the event of a deletion request, the minimum storage period for information from Internet application users, as determined by Brazilian law, will be respected.

9. Disclosure of Personal Data

By providing your personal data, you express your consent for the company to collect, store, use and share this information as described in this Privacy Policy. Consent is provided freely, in an informed and unequivocal manner, and it is understood that the data subject has the right to revoke this consent at any time, in accordance with the provisions set forth in the General Data Protection Law (LGPD).

If there is any change in relation to the use or sharing of personal data that requires a new expression of consent, we will contact you to obtain the necessary authorization.

You can, at any time, request information about the personal data we hold, as well as exercise your rights related to data protection.

9.1. Contact for Questions Related to Personal Data

If you have any questions, requests or wish to exercise your rights in relation to your personal data, as provided for in applicable legislation, we provide the following contact channels:

• Email : privacy@indicium.tech
• Telephone : (48) 3371-7293
• Address : R. Patrício Farias, 131 - Rooms 401 and 402 - Itacorubi, Florianópolis - SC, 88034-132

Our Data Protection Officer (DPO) will be available to respond to your requests and clarify any questions regarding the processing of your personal data. In the event of the unavailability of the main DPO , we have a substitute DPO to ensure continuity of service and support. We recommend that communications be made with as much detail as possible to facilitate and speed up service.

9.2. Response Time and Procedure for Requests

We undertake to respond to requests related to the processing of your personal data within the maximum period stipulated by applicable legislation, currently up to 15 (fifteen) business days , except for specific provisions that determine different periods.

Upon receipt of your request, we will follow the following procedure:

1. We will confirm receipt of your message through one of the channels provided.
2. We will validate your identity to ensure that the request is made by the data subject or by a duly authorized legal representative.
3. We will analyze the nature of the request and take the necessary measures, informing you about the progress and outcome of the process.

If your request requires a longer period of time to be completed due to its complexity or volume of information, we will notify you with a clear justification and the new service forecast.

10. Updates to this Privacy Policy

Indicium reserves the right to change this Policy as many times as necessary, aiming to provide you with more security, convenience, and to continually improve your experience. That is why it is very important to access our Policy periodically. To make things easier, we indicate the date of the last update at the beginning of the document. If relevant changes are made that require new authorizations from you, we will publish a new privacy policy.

11. Legislation and Jurisdiction

This Policy will be governed, interpreted and executed in accordance with the Laws of the Federative Republic of Brazil, especially Law No. 13,709/2018, regardless of the Laws of other states or Countries, with the User's place of residence being competent to resolve any doubts arising from this document.

‍