📖LGPD Privacy Policy

LGPD - Data privacy policy

1. Introduction

Please read this Privacy Policy ("Policy") carefully to understand our personal data processing practices.

CODE TECH prioritizes values such as transparency, respect and ethics in its activities. Our Policy aims to reaffirm our commitment to the privacy, confidentiality and security of all personal data of customers, potential customers, partners, suppliers, job applicants and visitors to our Sites, Social Networks and Applications (together defined as "User").

2. Basic concepts to understand this Policy

Personal data

Is all the information that allows you to identify the User. For example: name, social security number, e-mail address, telephone number, etc.

Sensitive Personal Data

Are personal data relating to racial or ethnic origin, religious conviction, political opinion, membership of a trade union or religious, philosophical or political organization, data relating to health or sex life, genetic or biometric data, when linked to the natural person.

Treatment or Treating

Means any operation for the collection, storage, consultation, use, sharing, classification, reproduction, processing and evaluation of Personal Data.

Legal bases

are the legal hypotheses that authorize Code to process Personal Data. Any processing of Personal Data can only be considered valid if it has a legal basis.

Data Subject or Owner

Is the person to whom the Personal Data relates. In the context of this Policy, it can be any User.

Services

Code offers Users various services, such as mere information, educational content, the opportunity to take part in a selection process or even deposit account services, investment in funds, shares, government bonds and securities in general, transfers, PIX, foreign exchange, credit, banking services in general, among others.

3. Why does Code process Personal Data?

CODE TECH is committed to offering quality Services and works daily to improve its security measures and guarantee the preservation of Users' Personal Data. Data protection involves respect for and commitment to the security of the User's Personal Data and respect for their privacy.

When interacting with Code's Services, the User may transfer information containing their Personal Data through the functionalities available on Code's websites, social networks, applications and apps ("Platforms"), third-party social networks (such as Instagram and Facebook), e-mail, telephone, among other sources.

This Privacy Policy describes what User Personal Data is collected and how it is processed by Code.

4. What Personal Data is Collected?

In order for us to provide our services, it is essential to collect certain information about the User. Code may collect personal data provided directly by the User, by third parties or collected automatically, depending on the service provided.

Personal data provided directly by the User: Code will collect the personal data entered or forwarded when accessing our channels (websites, social networks or applications) or when contracting products and/or services provided by Code Tech companies.

Personal data provided by third parties: Code may receive personal data through third parties, whether partners or service providers, who have a relationship with the User. It is also possible that Code collects data from public databases, made available by authorities (such as the Internal Revenue Service, for example) or by third parties, or even data made public on websites or social networks, always respecting privacy.

Personal data collected automatically: Code may also collect certain information automatically and to this end uses some market technologies, such as cookies, in order to improve your browsing experience on our services, according to your habits and preferences.

The data collected may be of various types, depending on the User's interaction (through the Platforms, e-mail, telephone, third-party social networks, among others), as described below:

Personal contact information: This includes any information about the User that allows us to contact them or verify their registration, such as full name, CPF, date of birth, gender, postal address, e-mail address, social network details, telephone number, proof of residence, biometric data, copy of identification document, among other data necessary for contact or registration with Code.

Website/communication usage information: As the User browses and interacts on the Platforms or Websites or social networks, Code may collect information about their actions, such as which links were accessed, which pages or content were viewed, for how long, which products the User subscribed to, geolocation data, provider and browser data, among other similar information and statistics about their interactions.

Technical information about the computer/mobile device: Any information about the computer system or other device that the User uses to access the Platforms, Sites or social networks, such as the IP address, the type of operating system and the type and version of the web browser.

Financial information: This includes information on transactions carried out, the User's risk profile, their positions and statements, among others.

Credit information: Includes any of the User's credit information, such as income tax returns, scores generated by credit bureaus, payslips, etc.

Human Resources Information: This includes information about the User when applying for vacancies at Code, including any educational information, CVs, professional experience, etc.

Public information: Includes information about the User that is publicly available or has been made public by the User, related to mentions and/or interactions with Code on profiles, websites and social networks, among others.

Code Tech, for security reasons, may request additional data in order to prevent fraud attempts.

5. Purpose of processing Personal Data

Code processes Personal Data mainly to enable the commercial relationship with the User, to fulfill contractual obligations, and may, in specific cases, collect data for specific purposes, as shown below:

• Service: Code uses Personal Data to serve Users through its service channels and respond to their queries, complaints and requests. This normally requires the use of your Personal Contact Data and registration information, as well as information about the Services and products purchased.

• Provision of Services: Code uses Personal Data to enable and manage operations, product purchases and Services requested by the User.

• Credit Assessment: Code uses Personal Data to analyze the User's financial capacity, monthly income and payment capacity, in order to possibly grant credit.

• Compliance Processes: Code uses User Personal Data to conduct its internal compliance processes, including, by way of example, the "Know Your Customer", "Know Your Partner" and "Know Your Employee" processes.

• Complaints Channel: Code uses Personal Data to attend to User reports and complaints and verify their identity.

• Control and Monitoring: Code uses Personal Data to monitor and manage User orders and interactions on the Platforms. In addition, Personal Data is used to prevent money laundering and to improve Code's Platforms.

• Opening an account and maintaining a registration: Code uses Personal Data to enable the User to open an account and maintain a registration.

• Applying for jobs: Code uses Personal Data to make it possible for Users to apply for the jobs on offer.

• Compliance with Regulatory Obligations: Code uses Personal Data to comply with legal or regulatory obligations.

• Fraud and Financial Crime Investigation: Code uses Personal Data for investigations and measures to prevent and combat illicit activities, fraud, financial crime and to guarantee the security of Code's clients and the financial system.

• Marketing: Code uses Personal Data for prospecting, market research, opinion polls and promotion of our products and services.

• Compliance with a court order: Code uses Personal Data to comply with a court order, order from a competent authority or supervisory body.

6. Cookies

Cookies are small text files stored in the User's browser or device. Cookies make it possible to recognize the User's preferences in order, for example, to adapt the Platforms to their specific needs.

Code uses Cookies to improve the use and functionality of its Platforms and to better understand how the User uses the tools and services offered there. Cookies help us adapt the Platforms to the User's needs, making them increasingly easier to use.

How does Code use Cookies?

Code may use the following types of cookies on its Platforms:

(i) cookies that are strictly necessary for Code's platforms to function correctly, for example by authenticating logins. It is not possible to refuse these cookies if the User wishes to use Code's services;

(ii) analysis cookies, to improve the content of the platforms, providing information on how it is being used, analysis cookies automatically collect certain personal data from the internet browser used by the User, including IP address and pages visited; and

(iii) functionality cookies, to record the data previously provided to, for example, record the User's login information, in order to allow them to be identified the next time they visit the site.

The use of cookies for these purposes is based on Code's legitimate interest. If the User wishes to refuse the installation of these cookies on their device and/or opt out of cookies, they can do so by configuring their browser.

For further explanations on how to proceed, simply access the links below. To find information on other browsers, visit the browser developer's website.

• Firefox

• Microsoft Edge

• Chrome

• Safari

• Internet Explorer

  It is important to clarify that Code is not responsible for the use of cookies by third parties. Users should be aware that cookies placed by third parties may continue to monitor their online activities even after they have left Code's Platforms, Websites and social networks, and it is recommended that they manage the cookies installed regularly.

7. Sharing Personal Data

Given Code's line of business, there are a number of mandatory sharing obligations with regulators and self-regulators. In addition, Code works in partnership with a number of other companies to enable its activities and offer its services. As such, personal data may be shared with other companies, suppliers and regulatory and self-regulatory authorities. Below are some of the situations in which Code shares personal data:

Suppliers, Service Providers and Business Partners: Code hires other companies to carry out certain activities, such as payroll processing, working hours control, data hosting services, auditing, benefits management and specialized consulting, independent investment agents, managers, trustees, custodians, securities distributors, among others. These activities may, in the context of providing the services, receive personal data from Employees.

companies to carry out certain activities, such as payroll processing, working hours control, data hosting services, auditing, benefits management and specialized consultancy, independent investment agents, managers, fiduciary administrators, custodians, distributors of securities, among others. These activities may, in the context of providing the services, receive personal data from Employees.

Code includes in its contracts with such third parties clear provisions to protect the privacy of Employees' personal data and acts to manage such provisions. However, Code is not responsible for ensuring the correct handling of personal data by third parties.

Credit bureaus: Code can share user data with companies that carry out personal profile analysis in relation to the risk of granting credit, in order to provide greater security to operations and prevent possible fraud or crimes against the national financial system.

Public Authorities: For the purposes of complying with legal obligations, Code may share users' Personal Data with government authorities such as, for example, the Central Bank of Brazil (BACEN), the Securities and Exchange Commission (CVM) and other public regulatory and self-regulatory agencies and entities.

Code Tech Companies: Code shares Personal Data among the various companies belonging to Code Tech for the development of the Services and compliance with legal, regulatory and self-regulatory obligations.
Protection of rights: Code reserves the right to access, read, preserve and disclose any data necessary to comply with a legal, regulatory, self-regulatory obligation, court, administrative or regulatory order, or to protect the rights, property or safety of Code, customers and Employees.

This Policy is restricted to the Code Services and does not extend to any other system or electronic address that may be made available by Code for consultation and viewing by the User. Code is therefore not responsible for the privacy policy of the websites and electronic systems of other institutions that are available on its electronic systems through links or other forms of disclosure.

8. Social networks

Some information, content and tools made available on Code's electronic systems can be shared by the user via certain media and/or social networking tools. In this sense, the user can carry out certain sharing actions such as "sharing", "liking", or "commenting" on content, news, videos, investment products, tools, etc. In such cases, Code is not responsible for the processing of users' personal data by the media and/or social networking tools, which use, disclose and protect personal data in accordance with their respective privacy policies.

9. User rights

The User, as the holder of Personal Data, has the following rights in relation to their personal information:

• Request confirmation of the processing of your personal data;

• Request a copy of your Personal Data processed by Code;

• Request the anonymization, blocking or deletion of Personal Data from Code's database. database;

• Request the correction and/or rectification of your Personal Data, if you identify that any of incorrect;

• Request the portability of Personal Data to another provider of similar products or services. similar;

• Request the deletion of Personal Data collected and used on the basis of your consent;

• When the processing activity requires your consent, you may refuse to consent or revoke your consent. consent or revoke your consent; and Object to certain data processing.

• If you have any questions, comments or wish to exercise any of the rights listed above, please contact us at [e-mail]. In order to exercise these rights, Code may request additional information and documents in order to prevent fraud, as well as to follow the applicable legal provisions and guidelines of the National Data Protection Authority.

Code may fail to comply with a User's request to exercise the rights listed above if there are legitimate reasons for doing so. Examples of legitimate reasons are: (a) if the disclosure of information violates Code's or third parties' business secrets; (b) if the request to anonymize, block or delete data is contrary to a legal, regulatory or self-regulatory obligation applicable to Code or makes it impossible to defend Code's or third parties' rights fully and unrestrictedly, including in disputes of any kind.

Some requests may require a longer response time due to their complexity or impact.

10. Storage of Personal Data

Code complies with Personal Data storage practices in line with applicable legislation. Personal Data is stored only for the time necessary to fulfill the purposes for which it was collected, unless there is any other reason for keeping it, such as compliance with any legal, regulatory or contractual obligations, provided that they are based on a legal basis.

Periodically, Code technically analyzes the appropriate retention period for each type of Personal Data collected, considering its nature, the need for collection and the purpose for which it will be processed.

11. International Transfer of Personal Data

Code may transfer Personal Data collected in Brazil to third parties located in other countries, for example when it is stored by Code on cloud computing servers located outside Brazil, in order to achieve the purposes set out in this Policy.

Code has its headquarters in Brazil and the data collected is governed by Brazilian law. By registering on Code's platforms or signing a service agreement, the User agrees to the transfer of their data to other countries that may have different data protection laws and requirements from those that apply in Brazil.

12. Personal data security

All security standards considered necessary by Code to preserve the confidentiality and integrity of Personal Data are observed in storage processes. In line with the scope of this Policy, the general guidelines for the security of Personal Data are transcribed:

• Any and all User Personal Data in Code's domain or under the custody of any of its employees is governed by the "Information Security and Cybersecurity Policy".

• Personal Data will be processed by our employees, representatives or authorized partners, provided that they need access to such information, depending on the specific purposes for which your Personal Data has been collected;

• Personal Data is stored in operating environments that use reasonable security measures to prevent unauthorized access;

• Code follows reasonable protocols to protect Personal Data.

13. Communications

If there are any other questions, comments or suggestions relating to this Policy, or suspicion of improper use of their Personal Data, the User may contact Code through the service channels available on the website or the person in charge of processing personal data by e-mail: [e-mail].

14. Changes to this Privacy Policy

Code may change this Privacy Policy at any time. Whenever any material terms of this Privacy Policy are changed, those changes will be valid, effective and binding after the new version is posted on our website.