Privacy Policy

1. Identification of the Data Controller

MídiaTec MultiMídia Ltda - ME, registered under Brazilian corporate taxpayer identification number (CNPJ) 24.845.196/0001-83, with its address at Quadra 08, Comércio Local 23, Sala 304, Sobradinho, Brasília/DF, CEP 73006-060, is the controller of personal data processed in connection with the Amigos Nota 10 activities under its responsibility. This Policy describes the data processing practices relating to the services covered by this document.

2. Scope of This Policy

This Policy applies to browsing the Amigos Nota 10 institutional website and to personal data processing carried out by the controller in connection with the services described herein. Specific features of the virtual office may require additional information regarding their own registration, payment, and participation processes.

3. Personal Data Processed

When browsing the institutional website, technical data may be processed, such as IP addresses, dates and times of access, browser information, security logs, and session identifiers. In the virtual office, data relating to user registration may include names, usernames, email addresses, account identifiers, and protected authentication credentials. Information voluntarily provided during support interactions may also be processed to respond to requests received.

4. Data Related to Registration and Participation

Depending on the features used in the virtual office, data relating to participant identification, plans, cycles, and positions on the platform may be processed. In Pix payment transactions, transaction identifiers, amounts, payment statuses, dates, and records necessary to confirm and monitor transactions may be processed. The processing of this information will be related to the features actually made available and the purposes described in this Policy. The institutional website does not currently provide its own registration form.

5. Cookies and Session Technologies

The institutional website uses cookies and technical resources necessary for the operation of its pages and the security of browsing, including session identifiers and mechanisms to protect against unauthorized requests, such as XSRF-TOKEN. These resources help maintain sessions, ensure the integrity of operations, and protect the website. If additional cookies or technologies are used in the future, users must be informed in accordance with applicable law.

6. Purposes of Processing

Personal data may be used to provide pages and features, maintain system security, prevent misuse, respond to requests, manage relationships with users, and comply with applicable legal or regulatory obligations. Each processing activity must observe legitimate purposes, necessity, appropriateness, and transparency.

7. Legal Bases

The processing of personal data must be based on the legal grounds provided for in Brazilian Law No. 13,709/2018, according to the specific processing activity, including, where applicable, performance of a contract or preliminary procedures, compliance with a legal or regulatory obligation, the regular exercise of rights, legitimate interests, and consent. Consent shall not be presumed to constitute the legal basis for all processing activities.

8. Support via WhatsApp

The institutional website provides WhatsApp at (61) 98110-3929, accessible at https://wa.me/5561981103929, as its official general support channel. When using this channel, users may provide information directly during the conversation. WhatsApp has its own data processing practices, which should be reviewed in its privacy documentation. The content of communications received by the controller must be used for purposes related to providing support.

9. Data Sharing

Personal data may be shared with service providers necessary for hosting, infrastructure, security, and operation of the services, subject to the applicable purposes and legal bases. The virtual office is integrated with Efí for querying Pix payment requests and processing payment information. Sharing must be limited to the data necessary for the corresponding operations, in compliance with applicable legal and contractual obligations. Information may also be provided to competent authorities where there is a legal basis.

10. International Data Transfers

The use of certain technology services may involve processing or storing personal data outside Brazil. Whenever an international transfer of personal data occurs, the legal grounds and safeguards provided for under the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados Pessoais — LGPD) and the regulations of the Brazilian National Data Protection Authority (Autoridade Nacional de Proteção de Dados — ANPD) must be observed. Data subjects may request clarification regarding the processing of their data through the privacy contact channels provided in this Policy.

11. Information Security

The platform uses protection mechanisms identified in its infrastructure and application, including HTTPS connections for public addresses, security attributes on session cookies, cryptographic protection of passwords, and controls limiting authentication attempts. The controller must maintain technical and administrative measures appropriate to the risks of processing, seeking to prevent unauthorized access and accidental or unlawful situations involving the destruction, loss, alteration, disclosure, or improper processing of personal data. No digital environment is entirely free from risks; therefore, security measures must be continuously assessed and improved.

12. Data Storage and Retention

Personal data will be retained for as long as necessary for the purposes justifying its processing, subject to legal and regulatory obligations, the performance of contracts, and the regular exercise of rights. Retention periods must be determined by considering the nature of the data, its purpose, the risks involved, and the legal grounds authorizing its continued retention. Once processing is no longer necessary, the data must be deleted or anonymized, where applicable, except in situations where the law permits or requires its retention. Information about the retention criteria applicable to personal data may be requested from the controller through the privacy contact channel indicated in this Policy.

13. Data Subjects’ Rights

Under the Brazilian General Data Protection Law (LGPD), data subjects may request, subject to legal requirements and limitations, confirmation of the existence of processing, access to their data, correction, anonymization, blocking or deletion where applicable, data portability in accordance with applicable regulations, information about data sharing and the possibility of withholding consent, as well as withdrawal of consent and review of decisions based exclusively on automated processing in the circumstances provided for by law.

14. Privacy-Related Requests

To exercise the rights provided for under the Brazilian General Data Protection Law (LGPD), data subjects may contact MídiaTec MultiMídia Ltda - ME at privacidade@amigosnota10.com.br. Requests will be assessed in accordance with applicable law, and additional information strictly necessary to confirm the requester’s identity and protect personal data may be requested. Contact information for the person responsible for personal data protection, where applicable, will be provided in accordance with legal requirements.

15. Children and Adolescents

The processing of personal data belonging to children and adolescents, where applicable, shall observe their best interests and the provisions of Brazilian law, particularly the Brazilian General Data Protection Law (LGPD). Eligibility conditions for registration and participation in Amigos Nota 10 services will be established in the platform’s specific documents and procedures, in compliance with the relevant legal requirements.

16. Updates and Final Provisions

This Privacy Policy may be updated to reflect changes in the services, personal data processing practices, or applicable legislation. The current version will be made available through the official Amigos Nota 10 channels, indicating the date of the update. Where required by law, material changes will be communicated to data subjects through appropriate means.