Privacy Policy

This Personal Data Privacy Policy ('Policy' or 'Privacy Policy') is intended to establish standards and guidelines on the treatment of personal data collected by Tractian Technologies Inc ('TRACTIAN'), according to applicable regulations.

By consenting to this Privacy Policy, the subject agrees to the terms described therein and to the processing of personal data for the purposes described herein.

This Policy is applicable to activities involving the processing of personal data and covers all TRACTIAN websites, portals, applications and forms.

For the understanding of this policy we must consider the definitions and terminologies as detailed below:

• Processing agents: the controller and the operator.
• Anonymization: the use of reasonable and available technical means at the time of processing, through which data loses the possibility of association, directly or indirectly, with an individual.
• Federal Trade Commission (FTC): agency of the United States government responsible for the enforcement of US's antitrust law and the promotion of consumer protection. The Agency is also enforcing US's legislative framework for the protection of personal data.
• Database: a structured set of data, established in one or several locations, in electronic or physical support.
• Blocking: temporary suspension of any processing operation by means of guarding the personal data or database.
• Collaborators: people hired to integrate TRACTIAN's staff.
• Consent: free, informed and unequivocal manifestation by which the holder agrees with the treatment of his personal data for a determined purpose.
• Controller: a natural or legal person, governed by public or private law, who is responsible for decisions concerning the processing of personal data.
• Cookies: files containing small pieces of data that are shared between a technological device and a web server in order to make browsing more user-friendly and improve user experience.
• Anonymized Data: Data relating to the holder that cannot be identified, considering the use of anonymization at the time of its processing.
• Personal Data: Information related to an identified or identifiable natural person.
• Sensitive Personal Data: personal data concerning racial or ethnic origin, religious conviction, political opinion, membership of a trade union or of a religious, philosophical or political organization, data concerning health or sex life, genetic or biometric data when linked to a natural person.
• Deletion: Deletion of data or of a set of data stored in a database, regardless of the procedure used.
• DPO (Data Protection Officer): person appointed by the controller and operator to act as a communications channel between the controller, the data subjects, and the Federal Trade Commission (FTC).
• Purpose: reason for which the personal data of the data subject is being processed.
• US's legislative framework for the protection of personal data: provides for the processing of personal data of natural persons, regardless of the medium, by natural persons or by legal entities of public or private law, in order to protect the fundamental rights of freedom and privacy and the free development of the personality of the natural person.
• Operator: a natural or legal person, governed by public or private law, who processes personal data on behalf of the controller.
• Opt-In: manifestation of the holder to express, previously and explicitly, his/her consent to receive specific communication or authorization for the processing of personal data.
• Opt-Out: The opposite of opt-in, that is, the revocation of a previously given consent.
• Research Organization: organ or entity of the direct or indirect public administration, or private non-profit legal entity legally constituted under US laws, with headquarters and jurisdiction in the country, which includes in its institutional mission or social or statutory objective basic or applied research of historical, scientific, technological, or statistical character.
• Personal Data Protection Impact Report (PDPIR): documentation from the controller that contains the description of personal data processes that may generate risks to civil liberties and fundamental rights, as well as risk mitigation measures, safeguards, and mechanisms.
• Site / Website: virtual address of a natural or legal person, composed of a set of electronic pages.
• Holder / User: natural person to whom the personal data that are the object of processing refer to.
• International Data Transfer: Transfer of personal data to a foreign country or international organization of which the country is a member.
• Processing: any operation performed with personal data, such as those related to the collection, production, reception, classification, use, access, reproduction, transmission, distribution, treatment, filing, storage, elimination, evaluation or control of the information, modification, communication, transfer, diffusion or extraction.
• Shared Use of Data: communication, dissemination, international transfer, interconnection of personal data or shared processing of personal banks by public bodies and entities in the fulfillment of their legal powers, or between private entities, reciprocally, with specific authorization, for one or more processing modalities allowed by these public entities, or between private entities.

The personal data processed by TRACTIAN is intended to meet various purposes, depending on the relationship of the holder with TRACTIAN. Thus, we present below, in a non-exhaustive way, the main hypotheses in which we will process the personal information of the holder:

• For the fulfillment of legal obligation: when arising from legal and/or regulatory determination imposed on TRACTIAN;
• In the necessity for contractual execution: fulfillment of specific contracts by TRACTIAN with several companies (suppliers and/or service providers);
• For the regular exercise of rights in judicial, administrative or arbitral proceedings;
• By means of authorization granted by the holder ('Consent').

The database formed by means of the collection and storage of the holder's personal data is the property and responsibility of TRACTIAN, and its use, access and sharing, when necessary, will be carried out within the limits and purposes of its business, and may, in this sense, be made available for consultation, shared and assigned to suppliers and authorities, as long as the provisions of this Privacy Policy and the applicable regulations are complied with.

No document, information, and/or personal data will be disclosed and/or shared under any circumstances, except when expressly authorized by the user, for purposes of compliance with the contracted services or by court order or legal determination.

It may be necessary for the subject's personal data to be transmitted to another TRACTIAN entity, a partner or external service provider. TRACTIAN requires its service providers to process such data only in accordance with this Privacy Policy and applicable regulations.

Internally, the user data is accessed only by duly authorized collaborators, respecting the principles of purpose, adequacy, necessity and other principles inherent to the treatment of personal data, always for TRACTIAN's purposes, besides the commitment of confidentiality and preservation of privacy in the terms of this Privacy Policy.

Holders of personal data processed by TRACTIAN are categorized as follows:

• Client;
• Employee;
• Collaborator;
• Applicant;
• Partner;
• Legal Representative;
• Lead;

In order for TRACTIAN to fulfill its social purpose, it is essential to collect some information about the holder. In this way, personal data provided directly by the holder, his/her legal guardians (by means of specific consent authorizing the treatment of children's personal data), companies, by third parties or automatically may be collected. See below the forms of collection of personal data:

• Personal data provided directly by the holder: All personal data entered or forwarded when accessing one of our TRACTIAN channels (portals or App) will be collected.
• Personal data provided by companies: solely for the purpose of complying with legal obligations or when necessary for the execution of contracts and/or preliminary procedures in which the data subject is a party.
• Personal data provided by third parties: TRACTIAN may receive personal data by means of third parties that have some relationship with the holder. It is also possible that TRACTIAN collects data from public bases, made available by authorities (such as the Internal Revenue Service, for example) or by third parties, or even data made public by the holder on websites or social networks, always respecting privacy.
• Automatically collected personal data: TRACTIAN can also collect a series of information in an automatic way using market technologies (cookies for example), with the purpose of improving the user navigation experience in portals and TRACTIAN App, according to his/her habits and preferences.

For all personal data collection, the following essential rules will always be respected:
•Only essential information will be collected;

•If necessary, we will ask for authorization or advise the holder to collect new data, accompanied by the appropriate justification;

•Os dados pessoais coletados somente serão utilizados para cumprir com as finalidades informadas ao titular.

The processing of personal data of children and adolescents will be carried out only with the specific and separate consent of a parent or legal guardian.

The data handled by TRACTIAN will be stored for the time necessary to fulfill the purposes for which they were collected or, further, to comply with legal and regulatory requirements. Upon expiration of the data retention period or when requested by the holder, TRACTIAN will delete them in a secure manner.

The personal data processed by TRACTIAN may be accessed by third parties as defined below.

• For our purposes: TRACTIAN may share data with third parties for its own purposes. TRACTIAN will share strictly necessary personal data to provide or otherwise fulfill its corporate purpose.
• For strategic reasons: TRACTIAN may share all of the data categories listed in item 6 with partners and other entities that provide TRACTIAN with certain services or assist with internal functions, such as analyzing data, maintaining the security of internal systems, or ensuring compliance with legal provisions.
  
  For example, TRACTIAN may share information with auditing firms, law firms for legal assistance, accounting firms, or other professionals. Other entities that may receive personal data for such purposes include information security service providers, data analysis companies, quality assurance evaluators, and others.
• For legal and regulatory reasons: TRACTIAN may share all categories of personal data reported in item 6 with partners, service providers and other entities when necessary to comply with legal or regulatory obligations, including compliance with any applicable law, judicial or administrative process.
  
  TRACTIAN may also share information to protect and defend the rights of the company, personal data subjects, or any other person, to protect against fraudulent or malicious activity, to enforce TRACTIAN's Terms and Conditions, or to cooperate with law enforcement agencies.
• When the holder consents to disclosure: TRACTIAN may share certain information with partners or other entities when the data subject instructs or otherwise consents to the sharing of such information, any consent expressed by the data subject must be prior and express.

In accordance with the applicable regulations, TRACTIAN guarantees the following rights to the holder:

• The confirmation of the existence of processing;
• Access to your data;
• The correction of incomplete, inaccurate or outdated data;
• The anonymization, blocking or deletion of unnecessary, excessive data or data treated in violation of applicable regulations;
• The portability of data to another service or product provider upon express request in accordance with Federal Trade Commission (FTC) regulations;
• The erasure of personal data processed with the consent of the data holder, with exceptions provided for in applicable regulations;
• The information of the public and private entities with which TRACTIAN has shared data;
• The information about the possibility of not providing consent and the consequences of refusal;
• The revocation of consent, under the terms of the applicable regulations;
• The revision of automated decisions.

The rights of the holders provided for in the applicable regulations and in this Policy may be exercised upon express request by the holder or the legal representative and may be done through the relationship channel available on the privacy portal or in the privacy notice.

The user is hereby aware that any request for exclusion of essential information for the management of his/her registration with TRACTIAN, when applicable, will result in the termination of his/her contractual/business relationship.

TRACTIAN will make every reasonable effort to fulfill the requests made by the holder in the shortest time possible. However, justifiable factors may delay or impede its rapid fulfillment, being certain that, in case of delay, the holder will be presented with the proper reasons.

It is the holder's duty to provide correct and updated information. TRACTIAN is not responsible for the accuracy, veracity or lack thereof of the information provided, and may at its discretion suspend and/or cancel the registration of the user at any time, if any inaccuracy is identified.

It is the holder's duty to provide correct and updated information. TRACTIAN is not responsible for the accuracy, veracity or lack thereof of the information provided, and may at its discretion suspend and/or cancel the registration of the user at any time, if any inaccuracy is identified.

Any personal data held by TRACTIAN will be stored according to the strictest security standards adopted by the market, which includes the adoption of measures such as:

• Protection against unauthorized access;
• Restricted access to the place where personal information is stored;
• Adoption of procedures for employees, collaborators, service providers and suppliers who handle personal data in order to commit to maintaining absolute secrecy of the information, adopting the best practices for handling this data, as determined in the corporate policies and procedures.

In addition to technical efforts, TRACTIAN also adopts institutional measures aimed at protecting personal data, so that it maintains a governance and privacy program applied to its activities and governance structure, constantly updated.

In any case, in the unlikely event of an incident of this nature, TRACTIAN guarantees a full effort to remedy the consequences of the event, always ensuring due transparency to the holder.s

TRACTIAN may make available links to other sites considered pertinent, corporate agreements or due to regulatory, judicial or administrative imposition.

It is worth mentioning that TRACTIAN is not responsible for the privacy policy practiced by these websites. The third parties have their own policy for the collection, use, sharing and any kind of data treatment related to the services and it will be up to these third parties to properly maintain the data. TRACTIAN recommends the reading of the policies of these third parties.

Cookies are files that may be stored on a user's device, containing small pieces of data that are shared when a device visits or uses TRACTIAN's online services.

The information collected, usually the name of the site that originated it, its lifetime and a randomly generated value, is interpreted and processed by TRACTIAN portals or applications, which enables user recognition and future identification of their interests and needs.

At any time, the user may revoke their consent to the use of cookies by accessing the settings of their preferred browser. However, we warn you that, depending on the settings made, certain functionalities of our services may not work optimally, as well as information security aspects.

By registering to receive e-mail marketing from TRACTIAN, the user declares to consent that TRACTIAN performs a personalized compilation of news and offers, as well as evaluates platform usage patterns, in order to send personalized communication that meets the user's needs and interests.

If the user wishes to stop receiving this type of communication, he or she may unsubscribe at any time. To do so, the user may click on the opt-out link present in the e-mails received to be directed to the cancellation process or may use one of the means of communication mentioned in this Privacy Policy.

This document was prepared based on the applicable regulations on information security, privacy, and data protection, based on international guidelines for these issues.

This policy is linked to the Terms of Use, available on the privacy portal or in the privacy notice, and shall be interpreted in accordance with the US's legislative framework for the protection of personal data.

In the event that any provision of this Privacy Policy is determined by a public authority to be illegal or unlawful, the remaining provisions shall remain in full force and effect.

The user recognizes that all communication made by e-mail (to the addresses informed by him/her), text message, instant communication applications or any other digital and virtual form are also valid as documentary evidence, being effective and sufficient for the disclosure of any subject that refers to the services rendered by TRACTIAN, as well as the conditions of its provision, except for the expressly diverse provisions foreseen in this Privacy Policy.

Should the data subject have any further questions, please contact us through the channels available on the privacy portal or in the privacy notice or, if you prefer, directly with the DPO for personal data processing at [email protected]

The TRACTIAN Privacy Policy, made available in the channels mentioned in the privacy portal or in the privacy notice, is the most updated version of the document. TRACTIAN may, however, at any time and at its sole discretion, update the Policy in order to improve security, improve our services or to meet legal, regulatory or administrative obligations.

TRACTIAN encourages you to periodically review this Privacy Policy to stay up to date on how your data is being treated.

If the user does not accept and agree to this Privacy Policy, including any changes, the user should not access or use TRACTIAN's platforms, services and products.