PRIVACY, COOKIES AND COMMUNICATIONS NOTICE

1. Introduction

METADAX CONSULTORIA LTDA (“METADAX”, “we” or “the company”) respects privacy and the protection of personal data. This Notice explains, clearly and accessibly, how we process personal data when someone visits our websites, contacts us, requests a proposal, contracts services, uses an application, takes part in a campaign, registers as a supplier or partner, reports a vulnerability or interacts with us through other channels.

This Notice is a transparency document. Browsing our websites does not, in itself, mean acceptance of this Notice, the General Terms or any other policy. Where the law or the engagement requires a specific expression of consent, we will present the corresponding document, notice, checkbox or consent mechanism.

Personal data is processed in accordance with Law No. 13,709/2018 — the Brazilian General Data Protection Law (“LGPD”), the Brazilian Internet Civil Framework (Marco Civil da Internet), the Consumer Protection Code where applicable, regulations of the Brazilian National Data Protection Authority (“ANPD”) and other relevant rules.

2. Who we are and how we operate

METADAX may carry out activities in information technology, software development and licensing, SaaS, hosting, data processing, consulting, marketing, advertising, sales promotion, content production and editing, product sales, education, agency services and other services consistent with its corporate purpose, contracts, authorizations and applicable qualifications.

The mere existence of an economic activity code (“CNAE”) does not mean that every service is permanently available, that every regulated activity is authorized in every location or that anyone associated with METADAX may provide regulated professional services. The scope of each engagement, including educational, health, integrative practice, agency or retail services, will be defined in the applicable contract, proposal, service order or rules.

2.1 Controller and processor

METADAX acts as controller when it decides the purposes and means of processing for its own activities, such as sales management, its own marketing, billing, security, customer service, supplier selection and management of its products.

METADAX may act as processor when it processes personal data solely on behalf of a client, in accordance with documented instructions and to perform a contracted service, such as hosting, SaaS, data processing, or developing or maintaining an application. In that case, the client may be the controller and the contract may include a Data Processing Agreement or a specific privacy clause.

METADAX's role will be defined according to the processing actually carried out, each party's decision-making autonomy, the purpose of the processing and the applicable contract.

3. Who this Notice applies to

This Notice may apply to visitors, users of websites and applications, individual or corporate clients, client representatives and employees, leads, event participants, subscribers to communications, security researchers, partners, suppliers, service providers and other people whose data is processed by METADAX.

When METADAX processes data solely on behalf of a client, data subjects may also need to consult the client's own privacy notice, as the client is responsible for disclosing the main purposes of the processing.

4. Personal data we may process

We only process data that is adequate, relevant and necessary for legitimate, specific and disclosed purposes. The categories below are examples and do not mean that all data will be collected in every service.

We do not request sensitive personal data for ordinary browsing, marketing or contracting activities when it is not necessary. If a given activity involves health, biometric data, racial or ethnic origin, religious belief, political opinion, trade union membership, sex life or other sensitive data, it will only be processed when necessary and with an appropriate legal basis, with additional protective measures.

5. Purposes and legal bases

METADAX does not use a single legal basis for all processing. The legal basis is chosen according to the context, purpose, necessity, relationship with the data subject and applicable law.

When we rely on legitimate interest, we will consider the legitimate purpose, necessity, the data subject's reasonable expectations, the impacts and the applicable safeguards. We will keep internal records and assessments when necessary.

When we rely on consent, it will be requested in a free, informed, unambiguous, specific and prominent manner. Refusing consent will not be used to prevent access to a service that does not depend on that processing, unless the information is necessary to provide the requested service and this has been disclosed in advance.

6. Data obtained from third parties and public sources

We may receive data from clients, representatives, partners, suppliers, authentication platforms, payment processors and other sources. In B2B commercial activities, we may also consult information that is public or legitimately made available, such as corporate contact details, company registries and professional sources.

The fact that information is publicly accessible does not authorize any use whatsoever. We will consider the purpose of the publication, good faith, necessity, compatibility of use and the data subject's rights. We do not acquire or use databases indiscriminately for purposes incompatible with their origin or with the law.

7. Sharing of personal data

We do not sell personal data. We may share personal data when necessary for the stated purposes, to comply with the law or to perform a contract, always limiting sharing to what is necessary.

Categories of recipients may include:

When a third party processes data on METADAX's behalf, we will seek to establish a contract, instructions, confidentiality and security measures appropriate to the operation. When another controller receives data for its own purposes, we will explain the context and obtain consent when required. All communications from METADAX will be made through official channels, which are published on the company's website.

8. International transfers

Some technology, cloud, communication, analytics or support providers may process data outside Brazil. Before using an international transfer, METADAX will assess the purpose, necessity, recipient country or organization, the provider, safeguards and the rules of the LGPD and the ANPD.

Transfers may be based on an adequacy decision, approved clauses or guarantees, binding corporate rules, a specific legal ground or another measure permitted by regulation. An up-to-date list of relevant providers, countries and safeguards may be made available on request or in specific material, taking into account trade secrets and security.

9. Retention and deletion

We keep personal data for as long as necessary to fulfill the purpose, perform the contract, meet legal obligations, preserve rights, prevent fraud, resolve disputes or comply with orders from authorities. After that, we will delete, anonymize or block the data, unless there is a legitimate reason for retention.

Deletion may be limited when the data is needed to comply with a legal obligation, exercise a right, protect security, prevent fraud or perform a contract. In such cases, we will restrict use to the purpose that justifies retention.

10. Information security

We adopt technical and administrative measures appropriate to the nature of the data, the purpose of the processing, the risks to data subjects, the company's structure and the contracted service. Measures may include access control, authentication, credential management, updates, backups, event logging, encryption where appropriate, supplier management, training and response procedures.

No system is completely immune to failures. Security also depends on the cooperation of users, who must protect their credentials, use official channels and report suspicious activity.

The Information Security, Incident and Vulnerability Management Policy sets out additional public commitments and reporting channels.

11. Security incidents

METADAX maintains a process to receive, classify, contain, investigate, remediate and record security events. A vulnerability or attempted attack is not automatically a personal data incident.

When there is a confirmed incident that may result in relevant risk or harm, we will assess the notifications required to the ANPD, data subjects, controller clients and other necessary parties.

Notifications will be made in accordance with the LGPD and ANPD regulations, in plain language, with appropriate information and mitigation measures, preserving trade secrets where permitted.

12. Data subject rights

In accordance with the LGPD and applicable regulations, data subjects may request:

1. confirmation that processing takes place;

2. access to the data processed;

3. correction of incomplete, inaccurate or outdated data;

4. anonymization, blocking or deletion of unnecessary or excessive data, or data processed unlawfully;

5. portability, subject to regulations and commercial and industrial secrets;

6. deletion of data processed on the basis of consent, except where retention is required by law;

7. information about the public and private entities with which we share data;

8. information about the possibility of not giving consent and its consequences;

9. withdrawal of consent;

10. objection to processing based on legitimate interest or another ground, where applicable;

11. review of decisions made solely on the basis of automated processing, where applicable; and

12. to lodge a complaint with the ANPD or consumer protection bodies.

Requests may require identity verification and enough information to locate the processing.

We will respond within the time limits and in the formats set out in applicable law, taking into account the nature of the request, third-party rights, trade secrets, legal obligations and METADAX's regulatory classification.

12.1 Privacy channel and Data Protection Officer

The preferred channel is:

Privacy: [email protected]

Data Protection Officer (DPO): [email protected]

Information Security and Cybersecurity Officer: [email protected]

Mailing address: Avenida Getúlio Vargas, 671, Sala 500, Parte 1364, Savassi, Belo Horizonte/MG, CEP 30112-021, Brazil.

METADAX will maintain a free and simple procedure for exercising rights. The name of the Data Protection Officer or designated person may be disclosed on the corresponding official channel, in accordance with applicable regulations.

13. Cookies and similar technologies

Cookies are files or identifiers stored on a device that may enable operation, security, preferences, audience measurement, personalization, advertising or other features. Similar technologies include pixels, tags, SDKs, local storage and advertising identifiers.

13.1 Categories

The specific list of cookies, names, providers, purposes, duration, first- or third-party nature and legal basis will be kept in the cookie inventory and reflected in the preference center.

13.2 Banner and preference center

The banner must present, clearly and with equal prominence:

•“Accept all”;

•“Reject non-essential cookies”; and

•“Manage cookies”.

Non-essential cookies based on consent will be disabled by default. The second layer will show categories, specific purposes, providers, duration and selection options. Data subjects may change or withdraw their choices through a dedicated mechanism accessible from the website, without relying solely on browser settings.

The preference center must record the choice, banner version, date and technical identifiers needed to demonstrate consent, without collecting more data than necessary for that purpose.

14. Marketing and communications

14.1 Transactional communications

We may send messages necessary to perform the contract, such as confirmations, invoices, security alerts, maintenance notices, support, account recovery, service changes and responses to requests. These messages are not stopped by unsubscribing from marketing when they are necessary for the service or a legal obligation.

14.2 Promotional communications

Promotional communications may include newsletters, offers, invitations, surveys, events, news and commercial content. We will use the legal basis appropriate to the context and keep records of the source, consent when used, channel, purpose, unsubscriptions and preferences.

Marketing consent will be separate from contract acceptance and will not be pre-checked. Messages will identify METADAX, explain why the recipient is receiving them and provide a simple unsubscribe mechanism. Unsubscribe requests will be processed within a reasonable time and free of charge.

14.3 Partners

We will not share contact lists with partners for their own marketing, unless there is an appropriate legal basis and, where necessary, specific consent. Joint campaigns must identify the parties responsible, the purposes, the channels and each participant's preferences.

15. Children, adolescents and sensitive data

As a general rule, our services are not directed at children. When an activity involves children or adolescents, METADAX will comply with the requirements of the LGPD, the Brazilian Child and Adolescent Statute and specific rules, including age-appropriate information and consent or authorization when required.

Educational, cultural, sports, event or health activities may have additional requirements. If processing involves health, biometric or other sensitive data, the purpose, legal basis, responsible professional or establishment, security and rights will be defined in the service and the specific agreement.

METADAX does not provide health diagnosis, prescription or treatment through this Notice. Health services or integrative practices will only be offered under a specific engagement, with a qualified professional, the appropriate structure and applicable regulatory compliance.

16. Third-party websites, platforms and services

Our websites and applications may contain links, integrations or services from third parties. Each third party may have its own notice, terms, cookies and security practices.

METADAX does not control processing carried out by a third party acting as an independent controller. The use of a third party's brand, content or service does not imply endorsement unless expressly stated.

17. Changes to this Notice

We may update this Notice to reflect changes in processing, services, laws, ANPD guidance or security measures. The version in force will be available on this page with its update date.

When a change is material and affects rights, purposes, legal bases or choices previously made, we will notify data subjects by appropriate means and, when required, ask for a new expression of consent.

18. General contact

Questions about this Notice, data subject requests, incident reports or cookie-related issues can be sent to METADAX's official channels:

•[email protected] — privacy and rights;

•[email protected] — officer responsible for privacy;

•[email protected] — officer responsible for information security and cybersecurity;

•the mailing address given in section 12.1.

19. Legal and regulatory references

This Notice must be read together with current Brazilian law, in particular:

• Law No. 13,709/2018 — Brazilian General Data Protection Law (LGPD).

• ANPD Board Resolution No. 2/2022 — small processing agents, together with subsequent ANPD regulations applicable to the case.

• ANPD Board Resolution No. 15/2024 — Security Incident Reporting.

• ANPD Guide on Cookies and Personal Data Protection.

• Law No. 12,965/2014 — Brazilian Internet Civil Framework (Marco Civil da Internet).

• Consumer Protection Code — Law No. 8,078/1990, where applicable.