Privacy Policy - Canvas Capital

1. Purpose of this Privacy Policy

Canvas Capital S.A., enrolled at CNPJ/MF under No. 15.377.863/0001-50 (“Canvas”), by itself and by its parent company and its subsidiary(ies) (“Canvas Group”), through this Privacy Policy (“Policy”), demonstrates its concern with the privacy, protection, security and transparency of its Holders and their Personal Data, in strict compliance with the provisions and principles established by the LGPD, ANPD and other regulations related, and ratifies its commitment to the principles of ethics, transparency, security regarding the relation with the Holders.

This Policy applies to all users who access our Site.

Consequently, throughout this Policy, Canvas Group describes how it collects, stores, uses, and shares Personal Data.

2. Glossary

Throughout this Policy, capitalized terms below shall have the meaning ascribed to them below:

“ANPD”: National Data Protection Authority;
“BACEN”: Central Bank of Brazil;
“Personal Data”: Information relating to the identified or identifiable natural person;
“Consent”: free, informed and unequivocal manifestation by which the Holder agrees to the Processing of his/her Personal Data for a specific purpose;
“Controller”: natural or legal person, under public or private law, who is responsible for decisions regarding the Processing of Personal Data;
“CVM”: Securities and Exchange Commission;
“DPO/u>”: person appointed by the Controller and Processor to act as a communication channel between the Controller, the Holder and the ANPD;
“LGPD”: Law 13,709, of August 14, 2018, as amended;
“Processor”: natural or legal person, governed by public or private law, who carries out the Processing of Personal Data on behalf of the Controller;
“Procon”: Consumer Protection and Defense Foundation;
“Site”: www.canvascapital.com.br, except for links to third-party websites, which are not operated or monitored by the Canvas Group and, therefore, the Canvas Group is not responsible for the content or policies they apply to the processing of personal data from such third-party websites;
“Processing”: any operation carried out with Personal Data, such as those related to the collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, elimination, evaluation or control of information, modification, communication, transfer, dissemination or extraction; and
“Holder””: natural person to whom the Personal Data that is the object of Processing refers.

3. Personal Data Collected and Purposes of Processing

In the exercise of its activities, Canvas Group may collect and process the following types of Personal Data, for the purposes indicated below, in accordance with the provisions of article 10 of the LGPD:

(i) Name, ID, address, telephone number, marital status and affiliation; for the purpose of managing a whistleblowing channel.
(ii) Name, ID, income and assets for the purpose of monitoring financial transactions and providing information to the competent authorities, under the terms of the applicable regulations.
(iii) Name, ID and certifications for the purpose of registering clients with stock exchange and over-the-counter market entities.
(iv) Name, ID and bank account (of the holder and his/her spouse) for the purpose of registering buyers of real estate units.
(v) Full name, gender, date of birth, place of birth, nationality; marital status, affiliation, image, name of spouse or partner, name of the issuing agency and date of dispatch, ID, full address, telephone number, e-mail, professional occupation and entity for which you work for the purpose of registering clients on Canvas Group platforms and complying with the rules of BACEN, CVM, stock exchange and over-the-counter market entities.
(vi) Data inserted in resumes or informed in job applications, such as name, address, e-mail, image, academic background and professional experiences for the purpose of recruitment and selection.
(vii) Voice and personal data that may be disclosed in telephone calls for the purpose of recording certain telephone calls, under the terms of the applicable regulations.
(viii) Cookies for the purpose of improving the experience on the Website.
(ix) Purchase data for the purpose of offering other products based on the profile.
(x) Anonymized data for statistical and research purposes, as well as to map preferences and recommend content and offers.

Canvas Group will retain the Personal Data collected until: (i) the purpose is exhausted; (ii) the treatment period ends; (iii) the data is no longer necessary or adequate to achieve the specific purpose informed to the Holder; (iv) until the consent of the respective holder is revoked; and/or (iii) there is a judicial or ANPD determination to the contrary.

4. Collection of Personal Data

Canvas Group collects your data in the following ways:

(i) through the data entered by you to register on the Site, via e-mail and/or other service channels; and
(ii) through cookie technology and similar mechanisms.

You are responsible for the accuracy and truthfulness of the data provided to the Canvas Group and are aware that its inaccuracy may imply civil or criminal liability, according to the causes and consequences to be ascertained.

5. Cookies

Canvas Group may use cookies to confirm your identity, personalize your access and track the use of our websites in order to improve your navigation and functionality. Cookies are small text files stored on the Owner’s computer or mobile devices and store information related to internet browsing.

Cookies do many different jobs such as enabling efficient navigation between pages, remembering your preferences and generally improving the Owner’s experience. They can also help ensure that the advertisements you see online are more relevant to you and your interests. You can find more information about cookies at: www.allaboutcookies.org.

6. Rights of the Holder

As a Holder of Personal Data processed by Canvas Group, you have the following rights:

(i) Right to obtain clear information about the Processing of your Personal Data, including (a) the specific purpose of the Processing; (b) the form and duration of the Processing; (c) the identification of the Controller and his/her contact information; (d) information about the Controller’s shared use of Personal Data and the purpose; (e) the responsibilities of the agents who will carry out the Processing; (f) information about the possibility of not providing Consent in cases where it is required – and the consequences of refusal; and (g) clear and adequate information regarding the criteria and procedures used for decision-making based on automated Processing of Personal Data;
(ii) Right to confirm the existence of Processing and, consequently, to access all Personal Data held by you that is being collected and processed;
(iii) Right to correct incomplete, inaccurate or outdated data;
(iv) Right to request that your Personal Data be anonymized, blocked or deleted if processed in violation of the LGPD;
(v) Right to receive all your Personal Data provided in order to have it transmitted to another service or product provider;
(vi) Right to revoke, at any time, the Consent and request the deletion of the data whose Consent is withdrawn;
(vii) Right to object to any Processing that is not in compliance with the LGPD;
(viii) Right not to have your Personal Data used for unlawful or abusive discriminatory purposes;
(ix) Right to request a review of decisions made solely on the basis of automated processing of Personal Data that affect your interests;
(x) Right to be notified of any security incident that may cause a relevant risk or damage to your personality; and
(xi) Right to petition the ANPD if they understand that the practices adopted by the Canvas Group violate their rights.

7. Access and Sharing of Personal Data

Personal Data will only be accessed by members of the Canvas Group and third parties directly involved with the execution of the services and to the strict extent necessary, if applicable, in relation to which Canvas Group elects and hires reputable companies that respect the rules of privacy and data protection, in addition to requiring them to comply with data processing rules established by the Canvas Group.

Canvas Group reserves the right to access, read, preserve, and disclose any Personal Data that it believes is necessary to comply with a legal/regulatory obligation or court order; enforce this Policy, and other agreements; or protect the rights, property, or safety of Canvas Capital, its employees, users, or others, so that Personal Data may also be shared in cases of judicial requests, requests from administrative authorities, such as, but not limited to: Procon, CVM, BACEN, etc.; police investigations and anti-fraud investigations.

Canvas Group may transfer, store and process your Personal Data with service providers located in other countries.

8. Security of Personal Data

Canvas Group has procedures and security measures, both technical and organizational, in place to ensure the protection of your Personal Data, such as encryption, monitoring of the environment, and use of secure protocols, including encryption and passwords, in an effort to protect Personal Data from unauthorized access and disclosure and to prevent any type of nuisance communication (spam). You can also validate the security of your connection from the connection information on the page, this information is present in the lock icon presented by your browser.

The Holder, when communicating with the Canvas Group, should be aware that such communications may be recorded and/or stored.

However, you should be aware that no company, including Canvas Group, can fully eliminate the security risks associated with the processing of Personal Data.

In the event of any security incident, Canvas Capital will notify the Holder immediately upon becoming aware of the fact that occurred, informing the Personal Data directly affected, as well as any additional information requested by the Holder involving the security incidents, and the ANPD in accordance with applicable law.

9. Questions and Clarifications

If you have any questions about how your Personal Data is used by Canvas Group or would like to exercise any of your rights mentioned above, please contact the DPO. Ms. Victoria Secco via e-mail (victoria.secco@canvascapital.com.br).

10. Changes to the Privacy Policy

Canvas Group may change this Policy at any time, without the need for any notice to the Holder. Any change and/or update of this Policy will be effective as of the date of its publication and must be fully complied with by the Holders.

11. Legislation and Jurisdiction

This Policy is governed in accordance with Brazilian law and any disputes or controversies arising from any acts performed within the scope of its application will be settled by the competent court of the Capital of the State of São Paulo.

Last update: 07 of October of 2024