Privacy and Data Protection

Privacy

All Tax makes its best efforts to protect the privacy of our customers. Please read the following information to learn more about our Privacy and Data Protection Policy.

Personal Data

At All Tax PLATFORM – SOLUÇÕES TRIBUTARIAS S.A., your privacy is important, and we are committed to protecting your personal and business data. For the purposes of this Privacy Policy, the term "personal data" means data such as: name; ID, CPF, bank accounts, address; email address; internet service provider; phone; or other personal information that may be provided by you or collected about you in accordance with applicable local laws.

Use of Personal Data

All Tax does not share personal information within the Joint Venture companies (All Tax Platform, Agile Solutions, and Lex Corporate). Any use of this information by All Tax will be strictly in accordance with this policy. As we are committed to protecting your privacy, All Tax does not engage in activities of selling or exchanging personal data with other companies for promotional purposes. The use of personal data is based on the necessity and purpose described in the General Data Protection Law (LGPD) No. 13.709/2018. Other important definitions:

• Data processing: any operation performed on personal data, such as collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, elimination, evaluation, or control of information, modification, communication, transfer, dissemination, or extraction;
• Sharing of personal data: communication, dissemination, transfer, interconnection of personal data, or shared processing of personal data databases by public bodies and entities in compliance with their legal competencies.
• Third party: a natural or legal person, public authority, service, or any other body that, not being the data subject, data controller, subcontractor, or another person under the direct authority of the data controller or subcontractor, is authorized to process the data;

Cookies

Cookies are small information files that a website transfers to an individual's computer hard drive for the purpose of maintaining browsing and consumption records. They allow the website to "remember" important information that makes its use more convenient. Like most websites, All Tax uses cookies to enhance your online experience. For example, we may store your language settings so you always read the site's content in your preferred language. No "sensitive information" (security, confidential, or secret data) is stored in cookies for user security.

Browser

Use your internet browser options if you do not want to receive a cookie or if you want your browser to notify you when you receive one.

Security

All Tax takes commercially reasonable measures to prevent unauthorized access and misuse of the data sent to us. In the case of online transactions, recognized market security practices will be used to protect the confidentiality and integrity of these operations. These measures ensure that personal information transmitted during these transactions is protected from interception by third parties. Although there are inherent risks in providing personal data, whether in person, by phone, over the Internet, or through other technologies, and despite no system being completely immune to breaches or cyberattacks, All Tax takes precautions appropriate to the sensitivity of the information to minimize these risks. In the event of data processing interruption, suspected security breach, or personal data loss, All Tax will inform its users without undue delay.

Links to Other Websites (If the Policy is accessed via All Tax's website)

This site may contain links to other sites. It is important to note that All Tax is not responsible for the privacy practices or content of any other sites. We recommend reading the Privacy and Data Protection Policies of these sites.

Data Retention

In general, All Tax will retain Personal Data for the time required by applicable law or as necessary for the purposes for which they were collected. For example, the data will be kept for the period you are authorized to use this website, including any All Tax tools accessible through this site. At the time this authorization is revoked, your Personal Data related to the use of this website will be removed.

Data Protection

In addition to addressing privacy, this policy aims to ensure adequate protection of all data processed by All Tax, complying with applicable data protection laws and regulations. Law No. 13.709/2018, known as the General Data Protection Law (LGPD), requires organizations to adopt security, technical, and administrative measures capable of protecting personal data from unauthorized access and accidental or unlawful situations of destruction, loss, alteration, communication, or any form of inappropriate or unlawful processing.

Information Security

Security, technical, and administrative measures for personal data protection must be observed from the product or service design phase through execution, a concept called Privacy by Design.

Guidelines

Personal data protection practices must cover all processes and individuals who in any way handle such data, across all organizational units of the Company, as well as any individuals or legal entities with whom All Tax interacts.

• Processing must be limited to the minimum personal data necessary for the Company's activities;
• Processing must be solely for specific, explicit, and legitimate purposes;
• Protection of personal data must be effective in both physical and digital environments;
• Transparency and free consultation must be provided to data subjects about the processing;
• Sharing of personal data must occur only in situations of justified necessity;
• All services and products must be structured ("Privacy by Design") to meet security and governance requirements;
• The termination of personal data processing must occur with verification that the purpose has been achieved.

Rights of the Data Subject

The data subject has:

• The right to be informed about relevant aspects of the processing.
• The right of access to their data.
• The right to rectification of their data.
• The right to restriction of processing of their data.
• The right to erasure/deletion of data.
• The right to data portability (where technically possible).
• The right to object to processing.
• The right to information about the possibility of not providing consent, as well as to be informed about the consequences in case of refusal.
• The right to withdraw consent, when applicable.
• The data subject also has the right to withdraw consent through an express request.

Transfer of Data to Third Parties

Personal data may only be transferred to third parties with the specific and explicit consent of the data subject, or in cases where the transfer is necessary for the execution of a contract or pre-contractual procedures to which the data subject is a party, by legal obligation, for the protection of life or physical safety of the data subject or third parties, or to serve the legitimate interests of All Tax or third parties, always respecting the fundamental rights and freedoms of the data subject.

Processing must be limited to the minimum personal data necessary for the Company's activities, with identification of data subjects occurring only for the necessary period. Processing must be solely for specific, explicit, and legitimate purposes, and may not be subsequently processed in a manner incompatible with previously defined purposes or inconsistent with the scenarios provided by the LGPD.

Protection of personal data must be effective in both physical and digital environments, and data must be handled securely, protected from unauthorized or unlawful processing, accidental loss or destruction, through the adoption of appropriate technical or organizational measures.

Transparency and free consultation must be provided to data subjects regarding the processing, purpose, form, content, integrity, duration, sharing, and accuracy of their personal data, as well as the possibility to update and correct personal data and to withdraw consent by data subjects, when applicable.

Sharing of personal data must occur only in situations of justified necessity, with clearly specified purpose and processing, and with all necessary measures strictly applied for the registration, control, protection, synchronization, deletion, anonymization, and blocking of shared personal data.

Security

All Tax ensures adequate levels of security and protection of personal data of data subjects. To this end, it adopts various technical and organizational security measures to protect personal data against loss, dissemination, alteration, unauthorized processing or access, as well as against any other form of unlawful processing.

Data Breach

All Tax will take all necessary measures to reduce the impact of incidents involving personal data. In cases where there is any probability that a data breach will result in imminent risk to the rights and freedoms of the data subject, the DPO will contact the National Data Protection Authority – ANPD or any other Regulatory Body as necessary.

Security Incidents

At All Tax, we are committed to protecting the personal data of our users. In the event of an incident, we will take the necessary actions to minimize possible impacts and notify the relevant authorities and affected data subjects. For more information or to exercise your rights, contact us at itsecurity@alltaxplatform.com.