Last revised on October 6, 2023.

This Privacy and Personal Data Protection Statement applies only to the specific pages of the website www.dondesenvolvimento.com.br designated as DON Desenvolvimento in the upper right corner, which are referred to below as "this website".

This Privacy and Personal Data Protection Statement expresses our commitment to processing your personal data responsibly, ethically, in line with our principles and values ​​and, especially, in accordance with the rules of Law No. 13,709/2018 (General Personal Data Protection Law - “LGPD”) and other applicable legislation in force.

By using this website, you agree to the use of your information as described in this Privacy and Personal Data Protection Statement.

This Privacy and Personal Data Protection Statement informs you what personal data we collect about you, what we use it for, how and where we store it and with whom we share it. It also sets out your rights in relation to your personal data and who you can contact for further information or clarification on this topic. Please see the sections of this statement below:

What types of personal data we collect

How we collect your personal data

How we use your personal data

What legal bases we use to process your personal data

Who we disclose your personal data to

How we protect your personal data

How long we keep your personal data

What rights you have

Changes to this Privacy and Personal Data Protection Statement

What types of personal data we collect

The personal data we collect may include: your name; age; date of birth; gender; email address; home address; country of residence; lifestyle and social circumstances (e.g. your hobbies); family circumstances (e.g. your marital status and dependents); employment and education details (e.g. the organisation you work for, your job title and educational details); financial and tax information (e.g. your income and tax residence); your posts on blogs, forums, wikis and any other social media applications and services we provide; your IP address; your browser type and language; your access times; details of your complaint; details of how you use our products and services; details of how you like to interact with us and other similar information.

The personal data we collect may also include sensitive personal data, which is defined by law as personal data about racial or ethnic origin, religious belief, political opinion, membership of a trade union or organisation of a religious, philosophical or political nature, data concerning health or sex life, genetic or biometric data where linked to a natural person.

The types of personal data and special categories of personal data we collect may vary depending on the nature of the services we provide to you or our client, or how you use our website. In some rare circumstances, we may also collect other special categories of personal data about you, either because you provide such data to us or because we are required to collect it as a result of legal requirements imposed on us.

How do we collect your personal data?

We collect and process personal data about you or your company in order to provide you with services.

We may collect personal data in the course of providing services to you or our client.

We may collect or obtain such data because you provide it to us or because it is publicly available.

We may collect data from your interaction with DON: We may also collect or obtain your personal data because we observe or infer such data about you from the way you interact with our website, to provide you with information that we believe may be of interest to you.

We may collect data from our clients: When your personal data is provided to us by our client, we take steps to ensure that the client has complied with privacy and data protection laws and regulations.

We understand the importance of protecting the privacy and personal data of children and adolescents. Our website and services are not designed or intentionally directed to children and adolescents. It is not our policy to intentionally collect or store information about this type of audience, however, in situations where the collection and use of these types of personal data are necessary, such as in the provision of services that involve analysis of personal data of minor dependents, the processing will occur in the best interests of the child and/or adolescent, in accordance with current legislation.

How we use your personal data

We will use your personal data to provide services to you or our client. As part of this, we may use your personal data in the course of correspondence relating to the services. Such correspondence may be with you, our client, other DON members, our service providers or competent authorities. We may also use your personal data to carry out due diligence checks relating to the services.

As we provide a wide range of services to our clients, the way in which we use personal data in relation to our services will also vary.

We may also use your personal data for or in connection with:

Applicable legal or regulatory requirements;

Requests and communications from competent authorities;

Client account opening and other administrative purposes;

Financial accounting, billing and risk analysis;

Customer relationship purposes, which may involve: (i) sending you relevant content or details about our products and services which we believe may be of interest to you; (ii) contacting you to obtain feedback on the services; and (iii) to contact you for other marketing or research purposes;

Recruitment and business development purposes;

Services we receive from our professional advisors, such as lawyers, accountants and consultants;

Protection of our rights and those of our clients.

In addition to the purposes related to the operation of our business above, we may also use your personal data through our website to:

Manage and improve our website;

Adapting the content of our website, based on monitoring access to the content made available, to provide you with a more personalized experience and to draw your attention to information about our products and services that may be of interest to you;

Managing and responding to any requests you submit through our website.

What legal bases we use to process your personal data

We are required by law to establish in this document the legal bases for processing your personal data, mainly related to the legal hypotheses defined by the LGPD.

As a result, your personal data will be processed in the following cases:

(a) upon providing your consent for the processing of your data, such as to grant you access to a platform maintained by DON or to make available some marketing material. If you do not wish to continue receiving any marketing material from us, simply click on the unsubscribe function contained in the communication or email received.

(b) when there are legitimate interests of DON in offering and delivering our services to you or our client, as well as for the effective and lawful operation of our business, provided that such interests are not outweighed by your interests, rights and fundamental freedoms.

(c) compliance with applicable legal and regulatory obligations that may require the collection, storage and sharing of your personal data in order to comply with legal and regulatory provisions, such as (i) maintaining records for tax purposes or providing information to a public body or law enforcement agency; (ii) compliance with labor and social security obligations; (iii) compliance with obligations to combat corruption, money laundering, fraud and irregular conduct.

(d) to execute any contract, as well as to provide our services to you or our client.

(e) to regularly exercise our rights, such as to exercise our right of defense in any judicial or administrative proceeding.

(f) protection of your life or physical safety or that of a third party;

(g) protection of your health.

Likewise, your sensitive personal data will be processed in the following cases:

(a) upon providing your specific and highlighted consent for the processing of your data;

(b) when necessary to comply with applicable legal or regulatory obligations that may require the collection, storage and sharing of your personal data in order to comply with legal and regulatory provisions, such as (i) maintaining records for tax purposes or providing information to a public body or law enforcement agency; (ii) compliance with labor and social security obligations; (iii) compliance with obligations to combat corruption, money laundering, fraud and irregular conduct.

(c) protection of your life or physical safety or that of a third party.

(d) health protection.

(e) to regularly exercise our rights, such as, for example, to exercise our right to defense in any judicial or administrative proceeding.

(f) guarantee of fraud prevention and your security, in the identification and authentication processes of registration in electronic systems.

Who we disclose your personal data to

In connection with one or more of the purposes set out in the “How we use your personal data” section above, we may disclose details about you to: other DON members; third parties who provide services to us and/or DON; competent authorities; technology companies responsible for storing and processing your data securely; your employer and/or its advisers; your advisors; credit reference agencies; or other organisations who help us make credit decisions and reduce the incidence of fraud; and other third parties who reasonably require access to personal data relating to you for one or more of the purposes set out in the “How we use your personal data” section above.

Our website may host blogs, forums, wikis and other social media applications or services that allow you to share content with other users (collectively, “Social Media Applications”). It is important to note that any personal information you contribute to these Social Media Applications may be read, collected and used by other users of the application. We have little or no control over these other users and therefore cannot guarantee that any information you provide with any social media application will be treated in accordance with this Privacy and Personal Data Protection Statement.

We may also need to disclose your personal data if required to do so by law, regulator or in the course of legal proceedings.

We may share non-personal, de-identified and aggregated information with third parties for a variety of purposes, including data analysis, research, feedback, feature content and promotional purposes.

How we protect your personal data

We may use a range of physical, electronic and managerial measures to ensure that your personal data remains secure, accurate and up to date. These measures include:

Education and training of responsible staff so that they are aware of our privacy and data protection obligations when handling personal data;

Administrative and technical controls to restrict access to personal data on a need-to-know basis;

Technological security measures, including firewalls, encryption and anti-virus software;

Physical security measures, such as employee security passes to access our premises.

Although we use appropriate security measures, once we receive your personal data, the transmission of data over the internet (including by email) is never completely secure. We strive to protect your personal data, but we cannot guarantee the security of data transmitted to or by us.

In order to properly protect and process your personal data in accordance with the LGPD, in addition to other applicable laws, we undertake to:

Adopt technical and administrative security measures to protect personal data from unauthorized access and accidental or unlawful destruction, loss, alteration, communication or any form of inappropriate or unlawful processing;

Keep a record of personal data processing operations carried out, especially when based on legitimate interest;

Communicate, within a reasonable period of time, to the National Data Protection Authority and to the data subject the occurrence of a security incident that may entail significant risk or damage to the data subjects;

Use systems structured to process personal data that meet security requirements, good practice and governance standards, and the general principles set forth in the LGPD;

Delete personal data after the end of its processing, within the scope and technical limits of the activities, authorized for storage for the purposes provided for by law; and

Observe the guidelines, standards, and regulations issued by the National Data Protection Authority (ANPD).

How long will we keep your information?

We will keep your personal data in our systems for the longest of the following periods: (i) as long as necessary for the relevant activity or services; (ii) any retention period required by law; (iii) end of the period in which disputes or investigations in relation to the services may arise; (iv) while your consent is valid, in applicable cases; (v) under the terms of current legislation.

What are your rights?

You have several rights in relation to your personal data, which can be exercised at any time, free of charge, by registering a request through our contact channels. In particular, you have the right to:

Obtain confirmation that we are processing your personal data and request a copy of the personal data we hold about you;

Request that we update the personal data we hold about you or correct data you believe is inaccurate or incomplete;

Retirar o consentimento concedido para o processamento de seus dados pessoais, bem como solicitar sua eliminação (na medida em que tal processamento tenha como base o consentimento);

Withdraw consent granted for the processing of your personal data, as well as request its deletion (to the extent that such processing is based on consent);

Request the portability of the personal data we have about you to another supplier of products or services, provided that commercial and industrial secrets, as well as applicable confidentiality, are respected;

Obtain information about who we share your data with;

Request that your personal data that you understand to be unnecessary, excessive or processed in non-compliance with the LGPD, be anonymized, blocked or deleted;

Request the review of decisions made solely based on automated processing of personal data.

9. Changes to this Privacy and Personal Data Protection Statement

We may modify or amend this Privacy and Personal Data Protection Statement from time to time.

To inform you when we make changes to this Privacy and Personal Data Protection Statement, we will change the revision date at the top of this page. The new, modified or amended Privacy and Personal Data Protection Statement will apply as of such revision date. We therefore encourage you to periodically review this Statement to be informed of how we are protecting your information.

By providing information through this website, you consent to the disclosures described above.