Kyly Group's Privacy And Personal Data Policy

The objective of this Policy is to clarify how we use and protect personal data, establishing the guidelines, principles, responsibilities and instructions related to personal data processed by the Kyly Group.

This Policy applies to all customers, suppliers, business partners and other third parties who work with the Kyly Group in any way. Processes and rules related to collaborators are established in the Collaborator Privacy and Data Protection Policy.

• Law no. 13.709/2018: General Data Protection Regulation (“LGPD”)
• Guide to Preparing Terms of Use and Privacy Policy – Digital Government
• Guide to Good LGPD Practices - CENTRAL DATA GOVERNANCE COMMITTEE - CCGD

The following concepts are considered for this policy:

•  Personal Data: personal data is information that identifies an individual, for example: e-mail, CPF [individual taxpayer´s ID], telephone and address;
• Sensitive Personal Data: when Personal Data is about racial or ethnic origin, religious conviction, political opinion, union membership or organization of a religious, philosophical or political nature, data related to health or sexual life, genetic or biometric data, when linked to an individual are considered Sensitive Personal Data and need to be processed with even more caution by companies.
• Processing: any operation carried out with personal data, such as those referring to the collection, production, receiving, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, deletion, assessment or control of information, modification, communication, transfer, dissemination or extraction;
•  Personal Data Subject: individual to whom the personal data that are subject to processing refer;
• Consent: free, informed and unequivocal manifestation by which the data subject agrees to the processing of his/her personal data for a determined purpose;
• Data Controller: individual or legal entity, under public or private law, who is responsible for decisions regarding personal data processing;
• Data Operator: individual or legal entity, under public or private law, who processes personal data on behalf of the data controller;
• Person in charge of Personal Data Processing (DPO): person appointed by the Kyly Group to act as a communication channel between the data controller, data subjects and the National Data Protection Authority (ANPD).

5.1. GENERAL ASPECTS AND SECURITY MEASURES

• The Kyly Group maintains standards of good privacy governance practices, in accordance with the legislation and regulations that guide its activities to promote security of the data processed;
•   We maintain a Privacy Governance Program applicable to all personal data under our control, which aims to ensure compliance with our policies and procedures aimed at personal data protection, with risk assessment, incident response plan and constant monitoring, being fully aligned with the principles that govern the activities of personal data processing:

1. Purpose  – To only process data for legitimate, specific and informed purposes to the data subjects;
2. Necessity – Limit the processing to what is necessary to execute the purposes;
3.  Free access – Ensure the data subject free and practical access to the form and duration of the processing of all their personal data under the care of the Kyly Group;
4. Data quality – Ensure to the data subjects that their stored data is correct and current to adequately comply with the purposes for which they are intended;
5. Transparency – Provide clear and accurate information about the processing carried out and the data controllers and data operators, respecting commercial and industrial secrets;
6. Security – Adopt the technical and administrative measures capable of protecting personal data from unauthorized access and accidental or unlawful situations of loss or improper disclosure of them, within reasonable technical limits and within the scope of their responsibilities;
7. Prevention – Adopt preventive measures to reduce the occurrence of damage to the personal data processed;
8. Non-discrimination – Absolutely refuse to process personal data for discriminatory, unlawful or abusive purposes;
9. Responsibility and accountability – Demonstrate the adoption of effective measures for data protection to prove compliance with personal data protection laws.

5.2. CONTACT

• Below are our communication channels so that data subjects and other interested parties can request information:
• E-mail of our Data Protection Officer (“DPO”): dpo@grupokyly.com.br;
• Kyly Group's online contact platform, and must select the Privacy and Personal Data category: http://grupokyly.com.br/pt_BR/contato.

5.3. PROCESSING, CATEGORIES AND PURPOSES OF PERSONAL DATA

• The Personal data processing is a condition for using the services, resources or websites of the Kyly Group, and it is not possible to offer our services, promotions and access to content without having access to personal data;
•  Kyly Group collects information when:
• A customer signs up on our platforms: When a customer creates a user profile on our platforms he/she voluntarily shares his/her e-mail, CPF [individual taxpayer´s ID], cell phone, full address, date of birth, credit card details and login and password. In addition, we ask if you would like to include your photo to customize your customer area, but this item is not mandatory;
• By browsing our platforms: When someone browses our platform, fills out forms, participates in promotions and events and other possible interactions on our services. Also when accessed by different devices such as: notebook, computer, cell phone or other access device. The Data we collect in this case are: approximate location (latitude and longitude), IP address, access device information (type of operating system, device model), information from your internet connection and the pages and content you access on our Services;
• Through third parties: We may also use some of the personal data through publicly available sources, commercial representatives, service providers and our partners;
• Through cookies: Through the use of cookies, we identify your internet browsing habits, your preferences and ad delivery;
• Due to commercial operations: due to the very nature of the activity, our processing involves the security and registration of operations, when we need to separate and deliver a product, for example;
• The information collected by the Kyly Group is intended to carry out our activities, using the following categories of data necessary to fulfill our purposes:
• Identification data, such as name, date of birth, nationality, gender, address, telephone, e-mail, contact, CPF [individual taxpayer´s ID], RG [ID] and/or CNH [driver´s license] numbers;
•  Financial data, referring to the services provided;
• Data related to image and sound recording;
• The activities carried out by the Kyly Group are constantly developing, so the legal basis and purpose of the personal data processing are constant. Even so, we summarize the following main purposes:
•  To enable us to comply with legal and regulatory judicial or administrative obligations;
• So that we can deliver products, process payments and deliver services of interest to you. The data helps us create a personalized experience according to the interests of our customers;
• To improve our services, through analytical intelligence improving our technical and operational service by responding to requests as soon as possible, when our customers contact us;
• For physical and information security, as well as ensuring the prevention of fraud and the security of our customers;
•  Some data is also processed to prevent illegal and suspicious activity.

5.4. DATA OF CHILDREN AND ADOLESCENTS

• Data of children and adolescents processed by the Kyly Group is subject to the consent of a parent or legal guardian.

5.5. DATA SHARING

•  We share data with some of our partners who help us perform our services: marketplaces, payment providers and integrators, credit card companies, marketing and advertising service providers, judicial, law enforcement or government authorities, platform maintenance service providers, data analytics for personalization and improvement of the services;
•  All service providers are bound by secrecy, as well as to abide by applicable law and the terms of our Policies.

5.6. INTERNATIONAL DATA TRANSFER

• To offer our services, some personal data may be transferred to other countries, this transfer will occur when we use cloud services for data processing or storage, located outside Brazil. In these situations, we will also be meeting all the requirements established in the current Law and in this Policy, in addition to adopting the best market practices to ensure the protection and privacy of your Data.

5.7. COOKIES

• We use cookies and other tracking technologies to identify the data subject and their interests, remember preferences and track use of our platform. We also use cookies and other tracking technologies to control access to certain content on our platform, protect it and process any requests the data subject makes;
•  Types of Cookies used:
•   Strictly necessary/technical: Necessary for the operation of the platform, without them it becomes impossible to perform certain features of the platform. It is not possible to refuse these cookies if you wish to browse our platforms;
• Analytics/Performance: They collect information anonymously, i.e., the results we receive from this analysis are provided in aggregate form and do not allow the direct or indirect identification of the Data Subject. For example, these cookies track the pages that are most frequently visited and the location of our visitors. These cookies include, for example, Google Analytics cookies;
• Functionality: Cookies of this category allow the Kyly Group to operate the platform with the choices you make. They allow us to “remember” your previous visits to the platform. For example, we will recognize your username and remember how you personalized your content within the Platform, enabling us to offer you, whenever you return to the Platform, the same customizations you previously made;
• Advertising and targeting: These cookies collect information about your activities on the Platform and other websites to provide you with targeted advertising. We may also allow our third party service providers to use cookies on the Platform for the same purposes identified above. The third party service providers that generate these cookies, such as: Google, Facebook, among others, have their own privacy policies and may use their cookies to target advertising to you on other websites based on your visit to our platform.
•  The data subject can change the cookie settings through their browser, there are several ways to manage cookies, blocking cookies will affect your experience on our platforms, as it will not be possible to identify your preferences on the platform nor recommend relevant content and advertising;
• See the respective settings in the main browsers for: Internet Explorer, Edge, Chrome, Safari, Firefox and Opera;
•   The details of Cookies from our platforms can be accessed through our Cookie Notice, according to Annex I of this Policy.

5.8. PERSONAL DATA OPERATORS

• Third parties that carry out personal data processing activities controlled by the Kyly Group undertake to make their best efforts in compliance with good privacy governance practices, preserving the personal data processed to ensure:
•  Compliance with the principles and requirements for processing personal data provided for in the LGPD, in addition to any orders that may change it;
• Responsibility for the acts of its collaborators, partners and contracted third parties, in any capacity, related to the processing carried out by them on the personal data controlled by the Kyly Group, from or as a result, directly or indirectly, of the Contract;
• The record of the personal data processing operations that it carries out, including for possible identification of the origin of a security incident;
•  That all personal data controlled by the Kyly Group will be used exclusively for the purposes provided for in the Contract, and any unforeseen use is prohibited, except if expressly and unequivocally authorized.

5.9. OFFICER

• For the Kyly Group, the person responsible for acting as a communication channel between the data controller, data subjects, the National Data Protection Authority (ANPD), government agencies and other interested parties is data officer Gabriel Henrique de Oliveira Morais, Compliance and Risk Management Coordinator of the Kyly Group. For matters relating to the LGPD and personal data in general, interested parties should send an e-mail to dpo@grupokyly.com.br.

5.10. RIGHTS OF DATA SUBJECTS

• At any time the data subject can decide on the updates and processing that we can do to their Data. However, in some situations, even after the termination of our relations, we will have to keep some personal data in our bases, according to periods established by legislation or to constitute evidence in the defense of our rights, in administrative, judicial or arbitration proceedings;
•    As provided for in the legislation and subject to any trade secrets, the personal data subject is entitled to obtain from the Kyly Group, upon request:
• Confirmation of the existence of data processing concerning you;
• What data data is processed by Kyly Group;
• Correction of incomplete, inaccurate or outdated data;
• Anonymization, blocking or deletion of unnecessary or excessive data, observing the situations provided for by current legislation;
•  Portability of personal data, in accordance with the regulations of the controlling body;
•   Information of public and private entities with which the data controller shares personal data;
• Information about the possibility of not providing consent for the processing of any data that needs this legal basis and about the consequences of the refusal; and
• Revocation of the consent for processing your data processed under such circumstances, subject to the conditions set forth in this document;
• Requests must be made by the data subject through the channels provided in item 5.2 of this Policy.

• The Kyly Group may make changes to the information contained in this Policy to reflect changes in current legislation or in our practices and services. In this sense, it is up to the data subject to check this document whenever they access the Kyly Group platforms and use our services to make sure they are aware of the latest updates and in accordance with the terms. In the event of relevant changes in data processing, the Kyly Group will notify the data subjects.

The summary of the activities and persons responsible can be found in the table below:

8.1. USE OF COOKIES AND TRACKING TECHNOLOGIES:

• We use cookies and other tracking technologies to identify the data subject and their interests, remember preferences and track use of our platform. Also, to control access to certain content on our platform, protect it and process any requests the data subject makes.

8.2. TYPES OF COOKIES USED:

• Strictly necessary/technical: Necessary for the operation of the platform, without them it becomes impossible to perform certain features of the platform. It is not possible to refuse these cookies if you wish to browse our platforms;
• Analytics/Performance: They collect information anonymously, i.e., the results we receive from this analysis are provided in aggregate form and do not allow the direct or indirect identification of the Data Subject. For example, these cookies track the pages that are most frequently visited and the location of our visitors. These cookies include, for example, Google Analytics cookies;
• Functionality: Cookies of this category allow the Kyly Group to operate the platform with the choices you make. They allow us to “remember” your previous visits to the platform. For example, we will recognize your username and remember how you personalized your content within the Platform, enabling us to offer you, whenever you return to the Platform, the same customizations you previously made;
•  Advertising and targeting: These cookies collect information about your activities on the Platform and other websites to provide you with targeted advertising. We may also allow our third party service providers to use cookies on the Platform for the same purposes identified above. The third party service providers that generate these cookies, such as: Google, Facebook, among others, have their own privacy policies and may use their cookies to target advertising to you on other websites based on your visit to our platform.

8.3. WHAT COOKIES WE USE

8.4. COOKIE MANAGEMENT

• Data subjects can change the cookie settings in their browser. There are several ways to manage cookies, however blocking cookies will affect your experience on our platforms, as it will not be possible to identify your preferences on the platform nor recommend relevant content and advertising;
• See the respective settings in the main browsers for: Internet Explorer, Edge, Chrome, Safari, Firefox and Opera.

Code and Name

N/A - Kyly Group's Code of Conduct

NTK - 086 - Kyly Group's Privacy Governance Program Policy

Date and Details

12/17/2020 - Policy Creation

03/08/2023 - Policy Update