Privacy Policy

1. OBJECTIVE:

This Privacy Policy has the goal of explaining OBJECTIVELY, CLEARLY and SIMPLY how ADITEK processes your Personal Data, as Controller or Operator, in reference to the General Personal Data Protection Law (LGPD) (13.709/18) and other applicable norms to the Sector of activity.

2. DESCRIPTION:

2.1 Vocabulary and Abbreviations:

According to the stipulations of the General Personal Data Protection Law (LGPD) (13.709/18) and of the terminology we will use, terms are defined as follows:

• Agents: Controller and Operator (5th art., IX, of the LGPD).

• Legal Basis: establishes the authorization of the Controller and, consequently, of the Operator to handle Personal Data from Users ( 7th, 11 and 14 of LGPD/GRPD) in accordance to the Law.

• Candidate or Interested party: that who sends their resumé searching for a job opportunity, internship, apprenticeship and related positions.

• Client: are the private persons and legal persons, related to the orthodontic sector, who request our services and/or purchase our products — clinics, Dentists and associated parties.

• Collaborator: all of those who, in a wide sense, interact with ADITEK, by means of a work contract, partnership, third-party service provision, autonomous professional or associated persons who do not conform to the condition of Client. The category is divided in two sub-categories: Employed Collaborator: every private person who maintains an employment relation to ADITEK; and, External Collaborator: private person or legal person who does not have a direct employment relation to us, but who acts in our name or under our orientation.
• Consent: it is the FREE, INFORMED and UNEQUIVOCAL manifestation to which the User who generates Personal Data agrees with the treatment of their Personal Data for a certain purpose. In case the situation involves Sensitive Data, that should moreover be SPECIFIED and HIGHLIGHTED ( 5th, XII and 11, I of LGPD/GRPD). Furthermore, it is only one of the Legal Basis which justifies the handling of Personal Data by Controllers.
• Controller: private person or legal person, of public or private law, which determines how the Personal Data who generates Users must be handled in conformity to the LGPD/GRPD ( 5th, VI) and further Norms of the Sector.
• Personal Data: whichever information related to the private person who can identify it or make it identifiable. They are divided into common [that which does not raise the risk of prejudice or discrimination — for example: ID, CPF, and E-mail. ( 5th, I, from the LGPD/GRPD)]; and, sensitive [whichever information related to the natural person which discloses their racial or ethnic origin, religious conviction, political opinion, syndicate or religious organization affiliation, philosophical or political beliefs, related to the health history or sexual life, genetic or biometric data, or which, in any way may generate unwanted discrimination (5th art., II, from the LGPD/GRPD)].
• Data Handler or DPO: private person or legal person designated by ADITEK to aid in the adequate treatment of Personal Data and which also functions as a communication channel for the Users and the Data Protection National Authority – ANPD ( 5th, VIII, from the LGPD/GRPD) in order to resolve questions.
• LGPD/GRPD: abbreviation of the General Personal Data Protection Law (LGPD) (709/18).
• Operator: private person or legal person, of public or private law, which realizes the treatment of Personal Data in the name of or order from the Controller ( 5th, VII, from the LGPD/GRPD).
• Contact Person: private person indicated by a legal person to be their communication channel.
• User: private person to which it is referred the Personal Data ( 5th, V, from the LGPD/GRPD).
• Handling: every operation realized to Personal Data, as to which are associated the collection, production, reception, classification, utilization, access, reproduction, transmission, distribution, processing, archive, storage, deletion, evaluation or information control, modification, communication, transference, dissemination or extraction ( 5th, X, from the LGPD/GRPD).
• User: whichever person that browses our websites (aditek.com.br / www.aditekshop.com.br / www.cleartek.com.br) or who utilizes any of the Platforms we provide.

2.2 Our History:

 The company ADITEK originated from the union of ideas from 02 (two) Orthodontists in 1990. Initially, the focus activity was importing products from North America to Brazil, since in that moment, the goods that were commercialized in the country were scarce and expensive.

Always seeking to be ahead of its time, ADITEK decided to develop its own products in accordance to the best and most complete expected technical expertise. After 03 (three) years of studies and research, ADITEK was able to introduce to the Brazilian market products of high quality with similar costs established by other players from the Sector. This factor conferred to ADITEK a prominent place in the orthodontic products sector.

Currently, ADITEK provides a complete line of orthodontic products which are prized for excellence in quality.

2.3 Our Role (Controller and/or Operator) and Our Data Handler — Contact Information:

In accordance to what we demonstrate along this Privacy Policy, we will act in certain situations as Controller and others as Operator.

Simplifying, in regard to the Personal Data from Users which we collect directly or which are collected under our order and which the legal basis of treatment pertains to ADITEK to define, we assume the condition of Controller, in the terms stated on the General Personal Data Puthority - arts. 5°, VI; 9°, III; and, 41 of LGPD/GRPD. In accordance to this, it follows the contact information both from ADITEK and from its Personal Data Handler with the addition that such channels are fully at the disposal of Users, Collaborators and from the ANPD in order to answer any questions or doubts about how we handle Personal Data.

ADITEK DO BRASIL LTDA. – CNPJ nº 64.602.097/0001-95

Rua Cesário Motta, nº 14, Centro, Cravinhos/SP – CEP 14.140-000

E-mail: aditek@aditek.com.br

Telephone: 0800-015-9520

PERSONAL DATA HANDLER - contact e-mail: dpo@aditek.com.br.

In turn, when we provide services or supply products where our Clients share Personal Data from their patients so that we can fulfill their requests (for example: treatment virtualization and, subsequent material production), we will act as Operator. In this situation, we will follow the orientations requested by our Clients since they are the effective Controllers (art. 39 of LGPD/GRPD)] if, evidently, they are in agreement with the applicable Legislation.

We know that the decision of disclosing client information to ADITEK is for our Clients, Collaborators, Users and so on to decide, therefore, we reiterate our commitment to respecting the rights from the Users or Controllers, in accordance to the legal parameters.

2.4 Collection and Treatment of Personal Data in Conformity to the LGPD:

An ADITEK collects, as Controller, a range of Personal Data in order to enable, in a SUSTAINABLE and RESPONSIBLE manner, the maintenance of its activities and the QUALITY of its services and products. We set the parameters out:

 2.4.1 National Market Clients in General:

2.4.1.1 HOW AND WHAT WE COLLECT

We collect Personal Data from our National Clients through: E-MAIL, PHONE, WHATSAPP, LEADS (GoogleAds and FaceAds), SOCIAL MEDIA, VISITS FROM OUR SALES PROMOTERS, SITES and through TREATMENT VIRTUALIZATION PLATFORMS (.ddo).

A - By E-MAIL, TELEPHONE, WHATSAPP, SOCIAL MEDIA, VISITS FROM OUR SALES PROMOTERS, generally, we request:

1. Private Person Clients: NAME, ADDRESS, ID, CPF, E-MAIL, PHONE contact, REGIONAL COUNSELOR REGISTRATION NUMBER IN DENTISTRY, DATE OF BIRTH, GEOLOCATION, PIX and BANK DETAILS.
2. Legal Person Clients: NAME, PHONE corporate and the professional E-MAIL from the private citizen designated to be the point of contact with ADITEK.

IMPORTANT: depending on the stage of the negotiation, the list collected may vary slightly, as we will not request all the Personal Data mentioned above if, perhaps, there is no need or if the negotiation does not go ahead. We will only ask for what is necessary and to the extent that it is necessary.

B- Through the LEADS (GoogleAds and FaceAds) we collect: NAME, ADDRESS, E-MAIL and the contact PHONE of the Holder who authorized us to do this in advance when accepting our leads.

We emphasize that LEADS are contacts of potential customers who, CONSENT freely to provide their information in exchange for any interest related to ADITEK, such as, for example, to learn more about our products and services. Therefore, by voluntarily subscribing to our LEADS, the Holder will begin to receive offers of products and services (advertising) until they request their exclusion.

 IMPORTANT: the rules of collection designed by the SITES and by the TREATMENT VIRTUALIZATION PLATFORMS (.ddo) will be treated in topics present in this document (Itens 2.4.5 and 2.4.6, respectively) and will have Terms specified in the links accessed by the User and Dentists in reason of its peculiarities and in order to obtain maximum transparency.

2.4.1.2 PURPOSES OF THESE COLLECTIONS ( An to B)

Carry out the REGISTER of Clients and potential Clients on our contact platforms; OFFER SERVICES and PRODUCTS – advertising; ENABLE the formalization of a COMMERCIAL RELATIONSHIP under the terms of the Legislation to which we are bound; VERIFY if the Customer can relate to ADITEK, since we only work with the dental market (orthodontists, dentists, companies that seek to acquire orthodontic products and the like) and with professionals and clinics in this specific area; ENABLE the fulfillment of rights and obligations assumed by the Parties and the performance of financial transactions (payments and receipts); CONGRATULATE and, many times, GIFT our Clients and potential Clients on their birthdays; VERIFY VERIFY that the Customer is of required age to register in our systems; provide SUSTAINABILITY to our business; SOLVE doubts and possible questions; DELIVER the SERVICES and PRODUCTS contracted; PERFORM satisfaction surveys; CHECK the validity of Return Letters; get in touch for possible RECALL of products and services, as well as to offer new opportunities; VERIFY regions that have the most Customers.

2.4.1.3 LEGAL BASIS

The foundations of the LGPD/GRPD grounds that authorize the above collections are, as a rule 7th art., itens I (...consent...); II (...compliance with a legal or regulatory obligation...); and, V (...when necessary for the execution of a contract or preliminary procedures related to a contract to which the holder is a party...).

• The CONSENT justifies collections made for the exclusive purpose OFFERS of products and services to Customers and potential customers who are Individuals and also for the CELEBRATION of their birthdays;
• The FULFILLING LEGAL or REGULATORY OBLIGATIONS arises from the fact that we have to request some information to, for example, issue invoices and accounting documents, as well as to know if the Client can relate to us;
• An EXECUTION OF CONTRACT is related to the provision of services and delivery of products negotiated in the exact terms agreed between the Parties.

2.4.1.4 WE MAY SHARE WITH

• Financial Institutions in order to, for example, issue bank slips and make payments possible;
• Carriers/Post Office (Shipping) in case of shipment of products;
• If necessary, with Consulting Bodies, to find out if the Client is in compliance with its financial obligations;
• As we store information in the Cloud and, in the case of WhatsApp, in Browser, we will share the Personal Data collected with companies that are providing such datacenter services to ADITEK;
• Collections related to LEADS will be shared with Google and Facebook Facebook for storage and with the marketing company hired by ADITEK to assist in forwarding offers of our services and products to the interested party – advertising;
• As we conduct satisfaction surveys and may use third-party platforms to do so, we may need to share some information with these companies that assist us in this regard;
• We have to share some Personal Data collected with Control Bodies to fulfill, for example, legal, tax, judicial and similar obligations;
• In certain situations, to protect the regular exercise of ADITEK, we may have to share Personal Data of a Client, from time to time, with our external legal department or with any Control Body;
• To forward advertising to Clients and potential clients, we share some information with agencies hired for this purpose.
• In order to forward publicity to Clients and potential clients, we may share some information, with hired services for this purpose.

2.4.1.5 CONSEQUENCES OF NON-DISCLOSURE

If the Personal Data we request is not forwarded, the commercial relationship may not be formalized (we need to know if you can relate to us); in turn, if there is no CONSENT to send advertising and for the celebration of the User, we will not do so.

2.4.2 Export customers:

As we export, our products to Legal Entities located in several countries and, as they relate to ADITEK through an individual representative, we have the following situation linked to our External Market area:

2.4.2.1 HOW AND WHAT WE COLLECT

We collect a few Personal Data from the individual representative of our Clients to facilitate the negotiation between legal entities.

We usually carry out this act by: E-MAIL, PHONE, WHATSAPP, CONTACT OUR SALES PROMOTERS and SITES.

As a rule, we ask for the following: NAME, CPF or INTERNATIONAL IDENTIFICATION, PHONE professional, POSITION, DATE OF BIRTH and the E-MAIL of the legal entity's representative and/or point of contact.

IMPORTANT: we note that, depending on the type of export process required, the Fiscal Documentation may vary slightly to comply with the legislation applicable to the countries involved.

2.4.2.2 PURPOSES OF COLLECTION

Perform the REGISTRATION on our contact platforms; ENABLE the formalization of a BUSINESS RELATIONSHIP under the terms of the Legislation to which they are subject and the fulfillment of rights and obligations assumed by the Parties ; ENABLE the performance of financial transactions (payments and receipts) arising from the relationships entered into; CONGRATULATIONS to the Customer's representative or point of contact on his/her birthday (if desired); provide SUSTAINABILITY to our business; in certain situations, carry out LEGALIZATION and VALIDATION of necessary documents with the Embassies of the countries involved; ENABLE the contracting of FREIGHT and/or delivery by MAIL ; the issuance of the DU-E (Single Export Declaration); CARRY OUT satisfaction surveys; CHECK the validity of Return Letters; CONTACT us for any RECALL of products.

2.4.2.3 LEGAL BASIS

The foundations of the LGPD/GRPD that authorize the collections reported above are 7th art., itens I (...consent...); II (...compliance with a legal or regulatory obligation...); and, V (...when necessary for the execution of a contract or preliminary procedures related to a contract to which the holder is a party...).

• CONSENT justifies collections made for the exclusive purpose of CELEBRATING the birthday of representatives or point of contact of our Customers;
• FULFILLING LEGAL or REGULATORY OBLIGATIONS arises from the fact that we have to request some information to, for example, issue invoices and proceed with procedures related to the shipment of products outside Brazilian territory;
• the EXECUTION OF CONTRACT is related to the impossibility of legal entities to relate without the support of an individual representing them.

2.4.2.4 WE MAY SHARE IN THE SAME WAY MENTIONED IN ITEM 2.4.1.4 AND FURTHER:

• In the case of export, we commonly share the Personal Data of the Customer’s representative with Customs Brokers, Government Agencies Involved and Notaries for Authentification.

2.4.2.5 CONSEQUENCES OF NON-DISCLOSURE

If there is no forwarding of the Personal Data that we request for the formalization of the business relationship, the contract cannot be signed between the Parties and, logically, the shipment of the products or the legal transaction will not occur. As for the failure to provide consent to celebrate the anniversary, we will not send any communication to that effect.

2.4.3 External suppliers and employees:

To keep our activities within the promised level of excellence, we count on the collaboration of some Suppliers and External Employees. Although they are, as a rule, legal persons, we collect some Personal Data from their legal representatives and, sometimes, from the individual indicated by them as the channel of contact with ADITEK.

2.4.3.1 HOW AND WHAT WE COLLECT

We carry out this act, generally, by: E-MAIL, PHONE, WHATSAPP, CONTACT OUR SALES PROMOTERS and SITES.

As a rule, we ask for the following: NAME, CPF, PHONE and corporate E-MAIL of the representative of that legal entity. If the supplier or employee is a private person , we will ask for the same information and, sometimes, the document that proves their technical capacity

2.4.3.1 PURPOSES OF COLLECTION

Carry out the REGISTER on our External Suppliers and Collaborators platforms; ENABLE the formalization of a COMMERCIAL RELATIONSHIP or PARTNERSHIP under the terms of the Legislations that are submitted and the fulfillment of rights and obligations assumed by the Parties; provide SUSTAINABILITY to our business.

2.4.3.2 LEGAL BASIS

The foundations of the LGPD/GRPD that authorize the collections reported above are 7th art., itens I (...consent...); II (...compliance with a legal or regulatory obligation...); and, V (...when necessary for the execution of a contract or preliminary procedures related to a contract to which the holder is a party...).

• CONSENT justifies the collections made when the intention is limited, only, to the registration of possible suppliers or individual partners in our internal system. Once the list is formalized, this basis will be replaced by the following: FULFILLING LEGAL or REGULATORY OBLIGATIONS and EXECUTION OF CONTRACT.

2.4.3.4 WE MAY SHARE IN THE SAME WAY MENTIONED IN ITEM 2.4.1.4.

2.4.3.5 CONSEQUENCES OF NON-DISCLOSURE

If there is no forwarding of the Personal Data that we request based only on CONSENT, there will be no way to register the supplier or partner in our internal system for future negotiations; in addition, without forwarding the Personal Data that we request, already in the NEGOTIATION PHASE, we will not be able to comply with what the Laws determine or how to formalize the contract between the Parties.

2.4.4 Talent and Resume Bank:

We are a company in constant evolution, so we can collect Personal Data from people who are interested in being part of our Team and who fulfill the profile we need.

2.4.141 HOW AND WHAT WE COLLECT

We carry out such collection, generally, by: E-MAIL, PUBLIC SOCIAL NETWORKS and, sometimes, by contracting REPLACEMENT companies and/or HEADHUNTERS.

At first, we will only ask, for what is strictly necessary to assess whether the candidate is able to compete for the available vacancy, for example: NAME, CPF, ID, AGE, SEX, ADDRESS, E-MAIL, PHONE, TRAINING, PROFESSIONAL EXPERIENCE and AVAILABILITY. Subsequently, depending on the position and type of selection process, we may change the ROL initially informed to meet the specifics of the specific situation. In the meantime, we clarify from now on that all this will be duly and previously clarified, when the selection process is opened, so that the User can make the decision to participate or not in a very conscious way.

2.4.4.2 PURPOSES OF COLLECTION

Form a Talent Bank and analyze whether the Candidate is able to compete for a vacancy made available by ADITEK.

2.4.4.3 LEGAL BASIS

With the EXCEPTION of the collection made by PUBLIC SOCIAL NETWORKS (7th art., §§ 3rd and 4th of LGPD/GRPD), the basis of the LGPD/GRPD that authorizes the other collections mentioned above is 7th art., item Ithat is, the Candidate's CONSENT to want to participate in our selection processes and send their resume to be stored in our Talent Bank.

Remember that, if the Candidate becomes part of our Team, this Legal Basis will change – a situation that will be presented in detail to the interested party, when the time is right, by our Responsible Sector.

2.4.4.4 SHARING

As we store information in the Cloud, we share the Personal Data collected with companies that are providing such datacenter services datacenter services to ADITEK.

2.4.4.5 CONSEQUENCES OF NON-DISCLOSURE

If there is no forwarding of Personal Data, we will not be able to register them in our Talent Bank and we will not even know if you are interested in being part of our Team.

IMPORTANT: we already advance that, by default, we will keep the Personal Data provided to our Talent Bank for up to 06 (six) months months from the last update carried out by the User.

 2.4.5 Websites:

Through our websites (www.aditek.com.br / www.aditekshop.com.br / www.cleartek.com.br), we collect the following Personal Data:

1. www.aditek.com.br: we may collect the following information from our Users/Customers: NAME, E-MAIL, PHONE and CITY — when filling in the "ENTER INTO CONTACT" or "CONTACT” channel are filled in.
2. www.aditekshop.com.br: we collect the following Information, in case Users choose to REGISTER with us: NAME, ADDRESS, REGIONAL DENTISTRY COUNSELOR REGISTRATION NUMBER, E-MAIL, DATE OF BIRTH, PHONE, CPF, ID and SEX.
   If the Users wish to, simply, SPEAK to ADITEK, we will collect, only, NAME, E-MAIL and PHONE.
3. www.cleartek.com.br: we may collect the following information:

• Users/Patients: NAME, E-MAIL and PHONE (through the SCHEDULING DATA form);
• Users/Orthodontists: NAME, E-MAIL and PHONE (via WANT TO BE CREDENTIALED form in the Orthodontist's section); NAME, E-MAIL, PHONE and CRO (via CREDENTIAL FORM or REGISTER);
• Users/Credentialed Dentist: LOGIN; (via the CONTACT channel);
• All the Users: NAME, E-MAIL and PHONE (via the CONTACT channel).

IMPORTANT: the detailed rules that establish how we handle the Personal Data collected through the websites from the internet specified above will be detailed in our Terms of Use which is why we reiterate the importance of its previous reading for the supply of any Personal Data by the User together with those means of communication. Furthermore, since we utilize cookies, we also ask to read also our Cookies Policy, previous to the supply of any information, in order to get to know how it functions in our websites.

2.4.5.1 WE MAY SHARE IN THE SAME WAY MENTIONED IN ITEM 2.4.1.4., depending on the type of contact realized and, in case that the website of aditekshop, there will be information sharing with the company denominated Integrated Store Platform (Integrated Store - Privacy), since this is the managing platform that enables the commercialization of our products via this communication channel.

2.4.6 Treatment Virtualization Platforms

2.4.6.1 WHAT WE COLLECT

In the capacity of Controller, we collect, as a rule, the NAME, PHONE and the E-MAIL of the requesting Surgeon-Dentists that register on our Platforms. Furthermore, depending on the forwarded documents we may collect REGIONAL DENTISTRY COUNSELOR REGISTRATION NUMBER and ADDRESS of the requesting Surgeon-Dentists.

2.4.6.2 PURPOSE OF THE DATA COLLECTION

TO REGISTER the dental professional enters the information to our Platform DDO in order to enable their IDENTIFICATION, their LOGIN and the utilization of its FUNCTIONALITIES (prescribed treatment VIRTUALIZATION requested by the Surgeon-Dentist and, afterwards, manufacture of the necessary PRODUCTS); to make possible the CONTACT of the responsible sector from ADITEK, to enable the payment of products and services provided and shipment to recipient.

IMPORTANT 01: when utilizing this means of communication, the requesting Surgeon-Dentist will have to, in the condition of Controller, share some Personal Data from their patients to ADITEK (Operator), in order to enable the VIRTUALIZATION of prescribed treatment and, afterwards, the manufacture of material necessary for its realization. In this sense, in order to utilize the platform, the requesting Surgeon-Dentists MUST from READ, previous to the first access or when registering, the document denominated Term of Use and Limitation of Liability in order to verify if they are in agreement with its content. BEING IN AGREEMENT, we will register that fact and the access will be authorized for said professional to utilize all that is offered there on behalf of their patients.

IMPORTANT 02: in case of the alteration of the Term mentioned above to adjust to a new guideline or update, we will request a NEW AGREEMENT from the requesting Surgeon-Dentist in order to verify if they are in agreement with the new document, before they continue to utilize one of the Platforms and, also, so that they can be updated on the way the Personal Data collected will be handled by ADITEK and partners.

2.4.6.3 LEGAL BASIS

In the 7th art., V (...contract execution and preliminary procedures related to the contract to which the user is part of...). An EXECUTION OF CONTRACT is related to the service provision of VIRTUALIZATION of Orthodontic Treatment prescribed by the requesting Surgeon-Dentist and to the MANUFACTURE of products/materials linked to that procedure.

2.4.6.4 DATA SHARING

Since the Platform DDO stores the received data on the Cloud, there will be sharing of what is sent by the Surgeon-Dentists, in general, with the companies that provide such services of datacenter to ADITEK, for this purpose only. It is also established that ADITEK will also shared the informations sent to the Platform with the company Digital Design Orthodontics Ltda. – CNPJ nº 37.913.284/0001-17 which realizes the VIRTUALIZATION of treatments prescribred by the requesting Surgeon-Dentists and, if necessary, with any other company which might aid in the same way.

At last, we remind the user that, once FORMALIZED the business relation, there may be sharing of Personal Data from the requesting Surgeon-Dentists in the way mentioned in item 2.4.1.4 of this Privacy Policy for the same reasons expounded there and due to the user being, from then on, our Clients.

2.4.6.5 CONSEQUENCES OF NON-DISCLOSURE

If there is no disclosure of the requested Personal Data to the Platform, the VIRTUALIZATION of the Orthodontic Treatment prescribed by the Surgeon-Dentist will be deemed INVALID and, logically, ADITEK will not be able to manufacture any PRODUCT.

2.4.7 Collaborating Employees:

All the necessary clarifications about the way we treat Personal Data of our Employees, in full compliance with the LGPD/GRPD, are duly exposed in the Internal Privacy Notice, Term of Authorization for the Use of Image and Voice of ADITEK and in other Internal Documents related to the matter, which we constantly make available to those from before hiring until the end of the relationship with us.

2.4.8 Filming in Corporate Environments:

2.4.8.1 WHAT WE COLLECT

The facilities of ADITEK are monitored by security cameras. Therefore, we collect the IMAGES of those who enter our establishments.

We ask that you pay attention to our NOTICES placed in the places where this occurs, as they will detail everything you need to know about such collection in a very CLEAR and OBJECTIVE way.

The security footage of ADITEK environment is STORED for a maximum period of up to 30 thirty days, UNLESS there is any reason that justifies the maintenance of the footage for a longer period.

2.4.8.2 PURPOSE OF THE DATA COLLECTION

To ensure higher security in the corporate environment and seek to safeguard the physical and moral integrity of all those that enter and work there.

2.4.8.3 LEGAL BASIS

The foundations of the LGPD/GRPD which authorize this collection are the 11th art., itens I and II, letter "and", that is to say, the CONSENT from the visitors who voluntarily opt to enter our facilities knowing they will be filmed; and; also; the LIFE PROTECTION or PHYSICAL WELL-BEING from the User or Third Party, after all, security is a relevant factor for all the individuals involved.

2.4.8.4 DATA SHARING

The images collected by the security cameras of ADITEK will not be shared, UNLESS an extraordinary occurrence provides a motive that justifies the realization of such act in accordance to Control Bodies, Fiscal, Judicial or equivalent.

2.4.1.5 CONSEQUENCES OF NON-PARTICIPATION

No possibility of entering our facilities.

2.5 International Transfers:

Since we realize, for security purposes, backups in Cloud in various companies and in Browsers, there might be forwarding of information abroad.

However, ADITEK establishes the following caveat:

• Take the proper technical precautions in order to avoid that said companies cannot have access to the information content we send to their datacenter services and browsers for storage; and,
• Seeks to choose sites that provide adequate protection of Personal Data as stipulated by the LGPD/GRPD ( 33, I).

2.6 Commercialization:

An ADITEK will NOT commercialize any guarded Personal Data, being allowed, only, as covered elsewhere, to contact our Clients and Collaborators directly or through marketing company, in order to verify the progress in the provision of services and to ensure whether anything else is needed, as well as the forwarding of ads and publicity.

2.7 Time of Storage and Elimination:

The Personal Data is in control of ADITEK:

• By the REQUIRED TIME by LAW or by the NORMS of the Sector of activity;
• By the ESTABLISHED EXPIRY DATE by the Controller or by the DATE indicated on the Term of Use and Limitation of Liability, when assuming the position of Operator;
• By the date of TERMINATION of the Handling Cycle of Personal Data
• By the time that its maintanenca becomes EXCESSIVE or UNNECESSARY or detached from a stated PURPOSE. In case of any of these situations we will delete the personal data;
• Until it is strictly necessary to preserve our LEGITIMATE INTEREST or what is agreed upon by ADITEK and the User;
• Until there is a LEGITIMATE RIGHT of the User to REQUEST the handling TERMINATION and EXCLUSION of their Personal Data, and, so to REALIZE it;
• When there is LEGAL or JUDICIAL DETERMINATIONS to that effect;
• In regard to purely COMMERCIAL or CONTRACTUAL RELATIONS, in the FREELY AGREED PARAMETERS between the Parties or by request of the involved (when it is legally possible);
• Until there is no more maintenance of LEGAL OBLIGATION or INEXISTENCE of a LEGAL BASIS that justifies its maintenance.

The Personal Data EXCLUSION will abide by the PROPER PRACTICES and will observe the necessary SECURITY concerns.

2.8 User's Rights ( 17 to 22 of LGPD/GRPD):

In accordance with 6th, IV; and 17 the 21 of LGPD/GRPD, the ADITEK clarifies that the Personal Data Users , as long as they validate the identification to avoid fraud and unnecessary incidents, possess the below mentioned RIGHTS highlighted:

• ACCESS/RECEIPT – they may request information concerning their Personal Data which are stored, shared, retained (expiry date), purpose, and whatever else deemed necessary. All of this is performed CLEARLY and FREE for the better comprehension of the user.
• RECTIFICATION – they may request the correction/update of their Personal Data anytime, since it is of utmost importance to keep these updated.
• OPPOSITION — they may oppose to how their Personal Data is handled in specific circumstances or in case the informed or agreed terms are contradicted.
• PORTABILITY — when appropriate, they may require their Personal Data portability.
• REVIEW OF AUTOMATED DECISIONS – if any, you may request the review of automated decisions that may affect your legitimate interests and rights.
• REVIEW OF AUTOMATED DECISIONS — if existent, there can be a request for review of automated decisions that may affect their legitimate interests and rights.
• DELETION ( 15 the 17 of LGPD/GRPD) - you may request the deletion of your Personal Data, provided that ADITEK does not have the obligation to store them for a longer period of time.

2.9 Information Security:

We have Information Iecurity measures to protect the Personal Data that ADITEK from its receipt to the elimination of our databases (arts. 5°, X and 46 of LGPD/GRPD).

In the event of any INCIDENT involving Personal Data held or controlled by ADITEK, ADITEK will take all necessary measures to minimize any misfortune. If necessary, ADITEK will bring the case to the attention of AnNational Data Data Puthority - ANPD and also to the User (art. 48 of LGPD/GRPD).

2.10 Revisions and Final Provisions:

If there is alterations in this Privacy Policy, we will highlight what has been changed for the better understanding of the Users. We will keep previous versions archived in folders for eventual consultations by interested parties.

We will review this document, once a year, so that it is updated and compatible with the understanding that the ANPD will still give on the subject and with other guidelines from competent bodies that arise

3. RECORDS:

The records generated by the activities of this procedure are controlled by the TB43 Master Record Control List.

4. REVIEW HISTORY:

First edition.