PRIVACY POLICY

This is a translation of the original Portuguese text. In case of any discrepancy, the Portuguese version prevails.

1. INFORMATION

AMIGO SECRETO is committed to caring for the privacy of its users and to acting in strict accordance with the legislation in force and, in particular, where privacy is concerned, to giving full observance and compliance to Brazil's General Data Protection Law (LGPD, Law No. 13,709 of August 14, 2018),

In this context, it has created this policy, with a view to informing the user about how their data is processed, respecting the principles of good faith, purpose, adequacy, necessity, free access, data quality, transparency, security, prevention, non-discrimination and accountability.

BY USING THE PLATFORM, THE USER DECLARES THAT THEY HAVE FULL CAPACITY FOR THE ACTS OF CIVIL LIFE, UNDER THE LEGISLATION IN FORCE, AND AGREES TO THE COLLECTION AND USE OF THEIR PERSONAL DATA AND OTHER INFORMATION BY AMIGO SECRETO, AS DESCRIBED IN THIS PRIVACY POLICY.

2. DEFINITIONS

USER: all natural persons who are the subjects of the personal data and information provided to AMIGO SECRETO through the PLATFORM, as well as those who will visit and/or use said PLATFORM, who are fully capable of performing the acts of civil life, considered as such those over 18 (eighteen) years of age or emancipated and who are able to express their will freely and consciously; and all natural persons under 18 (eighteen) years of age or adults lacking legal capacity, provided that they are duly represented by their parents or legal guardians.

PERSONAL DATA: all information provided by the user and collected by AMIGO SECRETO that identifies or may identify the user and from which the identification or contact information of a natural person may be derived. Personal data may be in any medium or format, including electronic or computerized records, as well as paper-based files. Personal data, however, does not include business telephone, business cell phone number, business address or business email.

PURPOSE: legitimate purposes for processing the user's data, which are specific, explicit, disclosed to the user and consented to by the user.

NECESSITY: limitation of data processing to the minimum necessary to achieve the purpose, covering only data that is relevant, proportionate and not excessive.

LEGAL BASIS: legislation that makes the processing of personal data legitimate, as well as contracts, terms and policies, for a given purpose.

CONSENT: express and unequivocal authorization given by the USER to AMIGO SECRETO, after reading and fully understanding the terms to be authorized, such authorization to be given by clicking the respective boxes, expressly indicated on the PLATFORM, for the purpose of authorizing the processing of personal data and achieving the purpose.

PLATFORM: the AMIGO SECRETO Website and Application, through which personal data and other information are provided, collected and processed.

3. COLLECTION AND USE OF PERSONAL DATA

The USER is aware that they provide personal data knowingly and voluntarily, by filling out the registration form available on the PLATFORM, it being certain that said data will be kept confidential and will be used only for the purpose that motivated the registration, namely, the exchange of messages between groups for the "Secret Santa game," as well as for purposes of advertising by the advertisers and sponsors of the AMIGO SECRETO PLATFORM.

4. SECURITY OF PERSONAL DATA

Personal data will be stored in the AMIGO SECRETO database, it being certain that AMIGO SECRETO uses various security and integrity procedures for personal data, with a view to protecting it and thereby avoiding any damage resulting from the processing of such data.

Notwithstanding the use of security and monitoring measures by AMIGO SECRETO to check for possible vulnerabilities and attacks and to protect personal data against unauthorized disclosure, misuse or alteration, the USER understands and agrees that there is no guarantee that the information cannot be accessed, disclosed, altered or destroyed through a breach of any of the physical, technical or administrative safeguards.

5. DATA RETENTION

AMIGO SECRETO retains all data provided, including personal data, for as long as the USER's registration remains active and as necessary to carry out its services.

AMIGO SECRETO will retain personal data and other information and will keep them stored until the USER requests their deletion.

AMIGO SECRETO may keep personal data after receiving the USER's deletion request, if necessary to comply with legal obligations, resolve disputes, maintain security, prevent fraud and abuse, and ensure compliance with contracts.

6. LEGAL BASIS

AMIGO SECRETO processes personal data exclusively in situations in which it is legally authorized, upon the express and unequivocal consent of the USER.

AMIGO SECRETO, under the legislation in force and with the USER's consent, is permitted to collect, produce, receive, classify, use, access, reproduce, transmit, distribute, process, archive, store, delete, evaluate or control the information, modify, communicate, transfer, disseminate or extract data about the USER.

The legal basis also includes contracts and preliminary contractual procedures (where processing is necessary to enter into the contract with the USER) and legitimate interests, provided that such processing does not violate their rights and freedoms.

Such interests include protecting the USER from threats, complying with applicable legislation, the regular exercise of rights in judicial, administrative or arbitration proceedings, understanding and improving the business and relationships with USERS, as well as enabling them to find economic opportunities.

The USER has the right to refuse or withdraw the consent given to AMIGO SECRETO, in which case AMIGO SECRETO may stop providing its services to the USER should such a request occur.

If the USER has questions about the legal basis for the collection, processing and storage of their personal data, they may contact AMIGO SECRETO through the person it has designated, called the DATA PROTECTION OFFICER (in the Portuguese original, ENCARREGADA), at the email: suporte@amigosecreto.com.br.

7. USER'S RIGHT OF ACCESS TO AND CONTROL OF PERSONAL DATA

AMIGO SECRETO provides the USER with options to delete and/or correct their personal data. The USER may:

I. Delete Data: the USER may request the deletion of some of their personal data (for example, if it is no longer necessary to provide the services to them).

II. Change or correct data: the USER may edit or request the editing of some of their personal data. The USER may also request updates, changes or corrections to their data in certain cases, especially if it is incorrect.

The USER may make the requests listed above through the PLATFORM, and these requests will be considered in accordance with applicable laws.

8. DATA POLICY

This policy describes the information processed by AMIGO SECRETO to enable its operation through the PLATFORM, with a view to enabling and facilitating the "Secret Santa game" for users.

What types of information do we collect on Social?

To provide the AMIGO SECRETO Services, we need to process information about the USER. The types of information we collect depend on how the USER uses our Services, and the initial registration requires the following data: full name, email, telephone, date of birth, sex, address and CPF (Brazilian tax ID).

9. THINGS THE USER AND OTHER PEOPLE DO AND PROVIDE.

Information for access to the system: the email provided at registration is collected and stored in order to locate the USER's personalized information at each new access.

Information and content the USER provides: We collect the content, communications and other information the USER provides when using our Services, including when the USER registers to create an account, creates or shares content, sends messages or communicates with other people. This may include information present in or about the content the USER provides (such as metadata), such as the location of a photo or the date a file was created. This may also include what the USER sees through features we provide, such as our camera, so that we can do things like suggest masks and filters the USER might like, or give tips on using camera formats. Our systems automatically process content and communications that the USER and other people provide in order to analyze the context and the content included in these items for the purposes described below.

Data with special protections: it is possible to choose to provide information in the PLATFORM's profile fields about the USER's choices, interests and preferences.

Networks and connections: We collect information about the people, Pages, accounts, hashtags and groups the USER connects with and about how the USER interacts with them across our Services, for example, the people the USER communicates with most or the groups the USER is part of. We also collect contact information if the USER chooses to upload, sync or import it from a device (such as an address book, call log or SMS history), which we use for things like helping the USER and other people find people they may know and for the other purposes listed below.

Your usage: We collect information about how the USER uses our Services, such as the type of content the USER views or engages with; the features the USER uses; the actions the USER takes; the people or accounts the USER interacts with; and the time, frequency and duration of their activities. For example, we log when the USER is using and last used our Services, and which posts, videos and other content the USER has viewed on our Services. We also collect information about how the USER uses features such as our camera.

What others do and information they provide about the USER: We also receive and analyze content, communications and information that other people provide when they use our Services. This may include information about the USER, such as when other people interact with them through the PLATFORM.

10. DEVICE INFORMATION

As described below, we collect information from and about the computers, phones, connected TVs and other web-connected devices the USER uses that integrate with our Services, and we combine this information across the different devices the USER uses. For example, we use information collected about the USER's use of our Services on their phone to better personalize the content (including ads) or features the USER sees when using our Services on another device, such as their laptop or tablet, or to assess whether the USER, in response to an ad we showed on their phone, took an action on a different device.

11. INFORMATION FROM PARTNERS

Advertisers, app developers and publishers can send AMIGO SECRETO information through the Business Tools they use, including our social plugins, Login, our APIs and SDKs. These partners provide information about the USER's activities off AMIGO SECRETO, including information about their device, the websites they visit, the purchases they make, the ads they see and how they use the partners' services, whether or not they have an account or are logged in to AMIGO SECRETO.

Such partners receive the USER's data when the USER accesses or uses their services or through third parties they work with. We require each of these partners to have legal authorization to collect, use and share the USER's data before providing it to us.

12. HOW DO WE USE THIS INFORMATION?

We use the information we have (in accordance with the choices made by the USER) as described below and to provide and enable the operation of AMIGO SECRETO.

We use the information we have to deliver our Services, including to personalize features and content and to make suggestions to the USER (such as groups or events the USER may be interested in or topics the USER may want to follow) on and off our Services. To create personalized Services that are unique and relevant to the USER, we use their connections, preferences, activities and interests based on the data we collect and learn through the USER and from other people; how the USER uses and interacts with our Services; and the people, things or places the USER is connected to and interested in, on and off our Services.

Information across AMIGO SECRETO Services and devices: We connect information about the USER's activities across the different AMIGO SECRETO Services and devices to provide a more personalized and consistent experience across all the Services the USER uses, wherever they are used. We may also make the USER's experience more seamless, for example, by automatically filling in their registration information (such as their phone number) from one AMIGO SECRETO Product when the USER signs up to create an account on a different Product.

Location-related information: We will use location-related information, such as the USER's current location and history, in order to improve the PLATFORM.

Research and development of services: We use the information we have to develop, test and improve our Services, including by conducting surveys and research, and by testing and troubleshooting new services and features.

Ads and other sponsored content: We use the information we have about the USER, including information about their interests, actions and connections, to select and personalize ads, offers and other sponsored content that we show to the USER.

13. PROVIDE MEASUREMENT, ANALYTICS AND OTHER BUSINESS SERVICES.

We use the information we have to help advertisers and other partners measure the effectiveness and distribution of their ads and services, and also to understand the types of people who use those services and how they interact with their websites, apps and services.

14. PROMOTE SAFETY AND INTEGRITY.

We use the information we have to verify accounts and activity, combat harmful conduct, detect and prevent spam and other negative experiences, maintain the integrity of our Services, and promote safety on and off the AMIGO SECRETO Services.

15. COMMUNICATE WITH THE USER.

We use the information we have to send the USER marketing communications, to communicate with the USER about our Services and to inform the USER about our policies and terms. We also use the USER's information to respond when the USER contacts us.

16. RESEARCH AND INNOVATE FOR SOCIAL GOOD.

We use the information we have (including from research partners we collaborate with) to conduct and support research and innovation on topics related to general social welfare, technological advancement, public interest, health and well-being.

17. YOUR INFORMATION IS SHARED WITH OTHERS IN THE FOLLOWING WAYS.

People and accounts the USER shares and communicates with: When the USER shares and communicates using our Services, the USER chooses the audience for what they share.

Public information can be seen by anyone, on or off our Services, including if that person does not have an account.

18. CONTENT OTHERS SHARE OR RESHARE ABOUT THE USER.

The USER should consider who they choose to share with, because people who can see their activity on our Services can choose to share it with others on and off our Services, including people and businesses outside the audience the USER shared with.

19. INFORMATION ABOUT YOUR ACTIVE STATUS OR PRESENCE ON OUR SERVICES.

People in the USER's networks can see signals telling them whether the USER is active on our Services, or when the USER last used our Services.

20. APPS, WEBSITES AND THIRD-PARTY INTEGRATIONS ON OR USING OUR SERVICES.

When the USER chooses to use third-party apps, websites or other services that use or are integrated with our Services, they can receive information about what the USER posts or shares. Information collected by these third-party services is subject to their own terms and policies, not this Policy.

21. SHARING WITH THIRD-PARTY PARTNERS

We work with third-party partners who help us provide and improve our Services in order to grow the business, which makes it possible to operate our companies and provide free services to people around the world. We do not sell any of the USER's information to anyone, and we never will. We also impose strict restrictions on how our partners can use and disclose the data we provide.

22. PARTNERS WHO USE OUR ANALYTICS SERVICES.

We provide aggregated statistics and insights that help people and businesses understand how users are engaging with their posts, listings, Pages, videos and other content on and off the AMIGO SECRETO Services.

23. ADVERTISERS.

We provide advertisers with reports about the kinds of people who saw their ads and how those ads performed, but we do not share information that personally identifies the USER (information such as their name or email address that could by itself be used to contact or identify the USER), unless the USER gives us permission to do so.

24. MEASUREMENT PARTNERS

We share information about the USER with companies that aggregate it to provide analytics and measurement reports to our partners.

25. PARTNERS OFFERING GOODS AND SERVICES ON OUR SERVICES.

When the USER subscribes to receive premium content, or buys something from a seller on our Services, the content creator or seller may receive the USER's public information and other information the USER shares with them, as well as information needed to complete the transaction, such as shipping and contact details.

26. VENDORS AND SERVICE PROVIDERS.

We provide information and content to vendors and service providers who support the operation of our business, whether by providing technical infrastructure services, analyzing how our Services are used, providing customer service, facilitating payments or conducting research.

27. LAW ENFORCEMENT OR LEGAL REQUESTS.

We share information with law enforcement authorities or in response to legal requests in the circumstances described below.

28. HOW CAN I CONTROL OR DELETE INFORMATION ABOUT ME?

We give the USER the ability to access, rectify, port and erase their data.

We store data until it is no longer necessary to provide the AMIGO SECRETO services, or until the USER's account is deleted, whichever comes first. This is a case-by-case determination that depends on factors such as the nature of the data, why it is collected and processed, and relevant operational or legal retention needs.

When the USER deletes their account, we delete the content the USER has posted, such as photos and status updates, and it will not be possible to recover this information. Information that other people have shared about the USER is not part of their account and will not be deleted. If the USER does not want to delete their account but wants to stop using the Services temporarily, they can deactivate the account.

29. WE ACCESS, PRESERVE AND SHARE YOUR INFORMATION WITH REGULATORS, AUTHORITIES OR OTHERS.

We share the USER's information in response to a court order (such as a search warrant or subpoena), if we believe in good faith that the law requires us to do so. This may include responding to legal requests from jurisdictions outside Brazil when we believe in good faith that the response is required by law in that jurisdiction, affects users in that jurisdiction and is consistent with internationally recognized standards.

When we believe in good faith that they are necessary to: detect, prevent and address fraud, unauthorized use of the Services, violations of our terms or policies, or other illegal or harmful activity; to protect ourselves (and protect our rights, property or Services), the USER or others, including as part of investigations or regulatory inquiries, or to prevent death or imminent bodily harm.

Information we receive about the USER may be accessed and preserved for a longer period when it is the subject of a legal request or obligation, government investigation, investigations of possible violations of our terms or policies, or otherwise to prevent harm. We also retain information from accounts disabled for violating our terms for at least one year, in order to prevent repeat abuse or other violations of the terms.

30. HOW DO WE OPERATE AND TRANSFER DATA AS PART OF OUR GLOBAL SERVICES?

We share information globally, both internally within the AMIGO SECRETO services and externally with our partners and with those the USER connects and shares with around the world, in accordance with this policy. The USER's information may, for example, be transferred or transmitted to, or stored and processed in, Brazil or other countries outside of where the USER lives, for the purposes described in this policy. These data transfers are necessary to provide the services set forth in the Terms of all of AMIGO SECRETO, as well as to operate globally and provide our Services to the USER.

31. CHANGES TO THIS PRIVACY POLICY.

If AMIGO SECRETO makes significant changes to this policy, the USER will be notified here, by email, or by a notice on the PLATFORM before the change takes effect.

32. RESIDENTS OF THE EUROPEAN ECONOMIC AREA (GDPR).

This section applies to the USER who is in the European Economic Area (EEA) and supplements the other sections of this policy, under the European Union General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR").

Controller: AMIGO SECRETO TECNOLOGIA LTDA., registered with the CNPJ/MF under No. 58.727.686/0001-05, headquartered in the city of São Paulo, State of São Paulo, at Rua Américo Brasiliense, No. 1501, Chácara Santo Antônio, CEP: 04715-005, Brazil. Contact for privacy matters: suporte@amigosecreto.com.br.

Legal bases: AMIGO SECRETO processes the USER's personal data (a) to perform the service the USER requested, such as creating the group, running the draw, sending invitations and messages and maintaining the wish list; (b) with the USER's consent, for cookies and tools that are not essential to the operation of the PLATFORM, such as browsing analytics and ads from advertising partners, and for sending promotional communications; (c) to comply with legal obligations; and (d) on the basis of AMIGO SECRETO's legitimate interest in keeping the PLATFORM secure, preventing fraud and measuring, in aggregate form, the use of the website and of the advertising spaces.

Rights: the USER may request access to their personal data, rectification, erasure, restriction of processing and data portability; may object to processing based on legitimate interest; and may withdraw consent at any time, without affecting processing already carried out. Requests are made by email to suporte@amigosecreto.com.br and answered within 30 (thirty) days. The USER may also delete their account themselves, on the My profile page.

Cookies: for the USER in the EEA (identified by the time zone set on the device), non-essential cookies and tools, including ads from advertising partners, are only activated after consent is given in the PLATFORM's cookie notice; without it, the USER uses the PLATFORM normally. The USER may change this choice at any time through the "Cookies" link in the website footer; when consent is withdrawn, the PLATFORM deletes the cookies and records it has itself stored on the device. The advertising shown to this USER is not personalized.

International transfer: personal data is processed by AMIGO SECRETO, a company headquartered in Brazil, and by the infrastructure and service providers mentioned in this policy, which may be located outside the EEA. These transfers are carried out with the safeguards required by applicable law.

Complaint: the USER has the right to lodge a complaint with the data protection authority of the EEA country in which they live or work.

In case of any discrepancy between this policy and its translations, the Portuguese text prevails.