PRIVACY NOTICE OF SERHS BRAZIL TOURIST ENTERPRISES

Last Updated: January 30, 2025

Hello! Welcome to the electronic portal of SERHS Brazil Tourist Enterprises!

First of all, we thank you very much for your visit! Please know that when you enter our portal, you entrust us with your personal data and information. Therefore, we are committed to maintaining that trust.

Our Privacy Notice will explain to you, in a clear and accessible manner, what personal data will be collected, with whom it will be shared, and where it will be stored.

DPOnet, registered under CNPJ No. 36.487.128/0001-79, has been appointed as our Data Protection Officer (DPO). Thus, they are qualified to perform all the functions and responsibilities of the position, as provided for in the Brazilian General Data Protection Law (LGPD).

If you wish to exercise any of your rights under the LGPD, simply click on the 'LGPD Communication Channel' seal on our website and fill out the 'Data Subject Request Form'.

By accessing and browsing our portal, you accept our Notice, being aware of and in full agreement with how we will use your personal information.

To facilitate your understanding, please note that our Privacy Notice is organized as follows:

1. Information Collected
2. How We Use Your Data
3. Data Sharing
4. Data Subject Rights
5. Protection of Your Information
6. Updates to Our Notice
7. Applicable Legislation

1. INFORMATION COLLECTED:

In the table below, we present the main activities involving the collection of your personal information, according to the main purposes, affected data subjects, legal bases, and categories of personal data collected for you to interact with us:

1. Information provided by you:

• Registration data: When you register on our website, you provide us with the following information: name, phone number, and email.
• Authentication information: To provide a secure browsing environment, we may request the following identification and authentication information: email and phone number.

1. Automatically generated information:

• Access logs: The organization automatically collects access logs to the application, which may include the IP address used to access our website, along with the date and time. This data is mandatory, as determined by Law No. 12.295/2014, also known as the Brazilian Civil Rights Framework for the Internet, but will only be provided to third parties with your express consent or due to a court order.
• Communication with the organization: When you communicate with the organization, we collect information about your communication, including metadata such as IP address, date, time, and content of communications, as well as any information you choose to provide.
• Website management: For this purpose, we use cookies, which are text files generated and stored in your browser or device by websites, applications, and online ads, as explained in item 3.

2. WHY AND HOW DO WE USE YOUR DATA?

We highly value your privacy, which is why all data and information about you are treated with the utmost confidentiality, being used only for the purposes described here and known and authorized by you:

We may occasionally use data for purposes other than those described in this Privacy Notice, but all such uses will be within your legitimate expectations. Any use of your data for purposes that do not meet this requirement will be done only with your prior authorization.

1. Storage of personal data:
   We store your personal data securely, in accordance with applicable security standards, and in a manner that facilitates the exercise of your rights under the LGPD.
2. Deletion of personal data:
   All personal data collected will be deleted from our servers upon your request, through a free and facilitated procedure, or when it is no longer necessary or relevant for the provision of our services, unless there is another reason for its retention, such as a legal obligation or the need to preserve the data to safeguard the organization's rights under Articles 15 and 16 of the LGPD.
3. WHY AND HOW DO WE USE COOKIES ON OUR WEBSITE?

To improve your experience on our website and provide personalized services, we use cookies.

• We use necessary cookies, based on the legal basis of legitimate interest, which cannot be disabled in our systems. These cookies allow essential functionalities for the provision of services, such as security, identity verification, and network management. Although they are necessary, you can block these cookies directly in your browser, but this may compromise your experience and impair the functioning of the website.
• We also use analytical or performance cookies, which allow us to collect data and information about how users use our site, which pages they visit most frequently, the occurrence of errors, or information about the site's performance.
• We collect functionality cookies, which allow us to remember your preferences and choices (such as your username or language).
• We also collect advertising cookies, which direct ads based on your interests and limit the number of times an ad is shown.

Except for necessary cookies, which are essential for the functioning of the site, the installation of other types of cookies is subject to your consent! Therefore, you can review your permissions, accepting, modifying, or canceling them at any time.

Our site does not automatically collect cookies. However, you are not required to authorize the use of all of them. Please note that our site may not function properly if all cookies are disabled. For this reason, if you wish to have a complete experience on our online platform, we suggest that you authorize the collection of all cookies.

4. SHARING OF INFORMATION:

All information we store about you may be considered assets in the event of negotiations involving the organization. In this sense, we reserve the right to, for example, include your data among the company's assets if it is sold, acquired, or merged with another. Through this Privacy Notice, you are aware of this possibility.

The organization must provide your data and information if required by a court order.

We may share your personal data with public or private organizations, respecting the provisions of the LGPD, especially the principle of necessity, and always in a manner compatible with the purpose(s) for which they were collected.

When sharing your personal data with data processors, we will require that your data be treated in accordance with our instructions, including secure storage, retention only for the instructed period, and no subsequent sharing with other organizations without our prior and express authorization.

5. DATA SUBJECT RIGHTS:

The LGPD establishes that the data subject has the right to obtain from the controller, in relation to their personal information, at any time and upon request:

• Confirmation of the existence of processing;
• Access to the data;
• Correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or deletion of unnecessary or unlawfully processed data;
• Data portability;
• Deletion of personal data processed with your consent;
• Information about public and private entities with which the controller has shared data;
• Information about the possibility of not providing consent and the consequences of refusal;
• Revocation of consent.

If the data subject wishes to exercise any of their rights under the LGPD or has questions regarding this document, they can click on the 'LGPD Communication Channel' seal on our website and fill out the 'Data Subject Request Form'.

Through the seal, any interested party is directed to the Privacy&You Portal and can verify the authenticity of the company's compliance with the LGPD, including the last review of its control mechanisms, the display of the date and time of the review, the company's privacy policies, the means of contacting data subjects, and the means of contacting the ANPD (Brazilian Data Protection Authority).

6. INFORMATION SECURITY:

All your data is confidential, and only authorized persons will have access to it. We employ all reasonable market efforts to ensure the security of our systems and your data. Our servers are located in different locations to ensure stability and security and can only be accessed through previously authorized communication channels.

All your information will, whenever possible, be encrypted, unless it makes its use by the platform unfeasible. At any time, you may request a copy of your data stored in our systems. We will retain the data and information only as long as they are necessary or relevant for the purposes described in this Privacy Notice, or for periods predetermined by law, or as long as they are necessary to maintain the legitimate interests of the organization.

It is important to clarify that we cannot guarantee that all your data on our platform will be free from unauthorized access, especially if there is improper sharing of the credentials necessary to access our application.

Therefore, we recommend that you keep your access password in a secure place and avoid sharing it with third parties. You agree to notify the organization immediately, through a secure means, of any unauthorized use of your account, as well as unauthorized access by third parties.

7. UPDATES TO OUR PRIVACY NOTICE:

We reserve the right to update our Privacy Notice as often as necessary to provide you with more secure information and improve your experience.

8. APPLICABLE LEGISLATION:

This document is governed by and must be interpreted in accordance with the laws and normative acts that make up the Brazilian legal system. The jurisdiction of the city of Natal, RN, is elected as competent to resolve any issues arising from this document, with express waiver of any other.

9. CONTACT THE DATA PROTECTION OFFICER:

DPOnet, registered under CNPJ No. 36.487.128/0001-79, has been appointed as the Data Protection Officer (DPO) of SERHS Brazil Tourist Enterprises and is qualified to perform all the functions and responsibilities of the position as provided for in the LGPD.

Address: Via Costeira Senador Dinarte Medeiros Mariz, Ponta Negra, 6045, Natal, RN
Phone: (84) 99128-2199
Contact: PRIVACY&YOU