Privacy Policy

Definitions

• National Data Protection Authority (Agência Nacional de Proteção de Dados): the public administration body responsible for overseeing, implementing, and enforcing compliance with the LGPD throughout the national territory;
• Personal data: any information relating to an identified or identifiable natural person.
• Sensitive personal data: any personal data concerning racial or ethnic origin, religious belief, political opinion, membership of a trade union or organization of a religious, philosophical, or political nature, data relating to health or sexual life, genetic or biometric data, when linked to a natural person;
• Data processing: any operation performed on personal data, including collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, deletion, evaluation or control of information, modification, communication, transfer, dissemination, or extraction;
• Personal data controller: the natural or legal person responsible for making decisions regarding the processing of personal data;
• Joint controller: two or more entities that jointly determine the purposes and means of personal data processing;
• Personal data processor: a natural or legal person, under public or private law, that carries out personal data processing on behalf of the controller;
• Sub-processor of personal data: a personal data processor engaged by the processor to assist in fulfilling the purposes set out in this Policy. Sub-processors may include third parties or partners of the processor, excluding all employees of the processor who are considered its representatives and act as the Processor;
• National Data Protection Authority – ANPD: the body of the Office of the Presidency of the Republic responsible for overseeing compliance with the LGPD;
• Platform or Niuco: virtual platform hosted under the Niuco domain, available at the URL https://app.niuco.com.br
• "Clients, and individually Client": refers to the contracting legal entity that engages the Niuco Platform for integration, monitoring, and management of its active software licenses used in its internal operations;
• "Client Representatives, and individually Client Representative": refers to the natural persons who represent the contracting legal entity.
• "Manager Users, and individually Manager User": means the employees, contractors, and end users, as applicable, authorized by the Client, or on behalf of the Client, to use the services, in accordance with our Terms of Use and Privacy Policy.
• "Client Employees, and individually Client Employee": refers to the current or former employees and contractors engaged by the Client (including employees acting as Manager Users) whose personal data is collected by Niuco through the SaaS tools used by the Client.
• "Data Subjects, and individually Data Subject": refers to the natural persons whose personal data is processed by Niuco during the provision of its services to the Client. For the purposes of this Policy, "Data Subjects" are Manager Users and Client Employees, collectively.
• Free Trial Period: refers to the free trial phase allowing the Client and User to explore our services, corresponding to a period of 15 (fifteen) days, which may be extended by an additional 10 (ten) days, or as set out in Niuco's commercial policy in effect at the time.
• Contracted Period: in parallel with the above, Niuco will contact the Client to send and obtain acceptance of the commercial proposal. Upon the Client's approval, the Contracted Period will commence.
• DPO (Data Protection Officer): The Data Protection Officer (DPO) is the professional responsible for ensuring that Niuco complies with the obligations set out in the General Data Protection Law (LGPD), advising the company on the proper processing of personal data and respect for data subjects' rights. The DPO is also responsible for serving as a communication channel between Niuco, data subjects, and the National Data Protection Authority (ANPD).

1. General

Niuco respects your privacy and wants Clients, Manager Users, and Client Employees to understand how their information ("Information") is used and shared. Niuco thanks you for your trust and guarantees that your data will be handled in a transparent and diligent manner, in compliance with Law No. 13,709/2018 ("General Personal Data Protection Law" – LGPD), Law No. 12,965/2014 ("Brazilian Internet Civil Framework"), and other applicable laws.

This Privacy Policy has been drafted to be clear and objective, enabling Data Subjects to understand in simple terms how Niuco operates and how their personal data will be processed.

This Privacy Policy describes how and when Niuco collects, records, manages, discloses, stores, uses, and shares your information, and applies to any person who has access to the services offered by Niuco.

By accessing or using the Software, from the Free Trial Period onward, the Client and Users will be bound by this Privacy Policy and our Terms of Use, and will be deemed to have agreed to their provisions.

If you do not agree with this Privacy Policy, you must refrain from contracting/using the services offered by Niuco's Software.

This Privacy Policy and the Terms of Use for the use of the Software constitute binding and legally enforceable agreements between the Clients, Data Subjects, and Niuco. Should the Client or Data Subjects have any questions, we are available to hear from them — please contact us through our support channels: chat, email care@niuco.com.br, or by submitting a request through the Software. Your feedback is very important to Niuco!

2. Our Role in B2B Service Delivery

In the course of providing our B2B services, we process personal data of Manager Users, Client Representatives, and Client Employees, and depending on the nature of the processing, Niuco may act as either Controller or Processor of such data.

2.1 Our Role as Processor

Our B2B Services are directed at legal entities. Therefore, when we process personal data of Data Subjects on behalf of our Clients, the personal data controller will be the Client itself, as in these cases the Client is responsible for making decisions regarding the processing of personal data. In this context, Niuco will act solely as a Processor of such personal data, carrying out processing in accordance with the instructions provided by the Client. Even so, even when acting as a Processor, we guarantee the same level of care and security we would apply as a Controller.

2.2 Our Role as Controller

We may act as controllers or joint controllers of personal data collected for the execution of B2B services when we have significant management authority and decision-making power over the processing of Data Subjects' personal data. This is the case, for example, when we process Client Representatives' data for commercial outreach, to facilitate the sending of marketing materials, or to formalize the provision of services to the Client.

3. Personal Data Collected

Niuco collects personal information voluntarily provided by Manager Users (at the time of registration) and Client Representatives (at the time of contracting our services) and during use of the Platform. In addition, to enable service delivery, the Client will grant Niuco access to the personal data of Client Employees through the SaaS tools used by the Client. Regardless of the method of collection, we will always observe the principles of good faith, purpose limitation, adequacy, necessity, free access, data quality, transparency, security, prevention, and non-discrimination, as detailed below.

When accessing and browsing the Platform, Niuco may also automatically collect information made available by internet browsers, such as information about the device used (mobile or desktop), IP addresses, pages visited, date and time of connection, among others, as detailed below.

3.1 Information Collected

To use our Software services as a Manager User, it is necessary to join a corporate account. Upon registration on the Platform, Niuco collects the information voluntarily provided by Manager Users themselves or by the Client Representative. The Manager User receives their account login credentials for the Platform via their registered corporate email address, transmitted securely and privately.

From the start of the Free Trial Period, Niuco may collect the following personal data, provided by the Client Representative or Manager User when completing the "Contact Form" to use the services made available through our software:

• Name;
• Phone number; and
• Email address;

Niuco also collects personal data of Client Employees and Partners through the SaaS tools integrated with the Platform. The data collected includes:

Identification:

• Name;
• Corporate email address;
• Personal email address;
• Identification number (ID);
• Employee registration number

Organizational Affiliation:

• Job title;
• Team;
• Department;
• Cost center;
• Work location

Employment Status:

• Employment status (active, partner, terminated, absent, on leave, or on furlough)
• Hire date
• Termination date
• Leave start and return dates,
• Absences or other leave periods
• Work shift or schedule.

Activity in Integrated SaaS Tools:

• Login dates and records;
• Activities performed;
• IP address used;
• Usage status (active or inactive).

Communication Contact:

• Personal email address
• Personal phone number

We emphasize that the volume and scope of data required derives from the service provided by Niuco, namely the integration and management of the Client's active software licenses, with the sole and exclusive objective of enabling the management and monitoring of licensing information.

For Niuco to function and access the integrated software within the system, Niuco will receive an access token for the Client's software and an identification number ("ID"), which will be generated automatically by the integrated software when the Client authorizes Niuco's access, either directly by the Client, or generated manually by the Client and passed on to Niuco through its platform. Niuco clarifies that it adopts all necessary measures to ensure the confidentiality of the information accessed, as well as that shared with Niuco's employees, which will be used solely and exclusively to enable the functionalities of the Niuco Software, or to provide Client support.

The Client and Data Subjects are aware of and agree that, upon request by the Manager User themselves, access information of users and employees integrated into Niuco will be collected as described above, for the generation of reports and indicator dashboards, which may be downloaded by the Client and will be generated with the sole and exclusive objective of enabling management and monitoring of the software licensed and integrated into Niuco.

In this regard, the Client, in its capacity as Controller, declares and warrants to Niuco that it has constituted its database in a lawful manner in compliance with applicable legislation and that, where applicable, it has obtained authorization from or has informed Data Subjects regarding the sharing of data with Niuco, depending on the legal basis authorizing the data processing carried out by the Client. The Client therefore warrants that it holds an appropriate legal basis for the collection of Personal Data and its transfer to Niuco, and that it has provided all necessary information and notices to Personal Data subjects regarding the relevant characteristics of the processing and its potential sharing with Niuco.

Niuco may use the data to identify and monitor software with active licenses, in order to ensure the execution of services on the Niuco management platform and to prevent fraud and protect the Data Subject's security, which are essential for the use of the services provided by Niuco.

THE CLIENT WARRANTS THAT IT HAS LAWFULLY COLLECTED ITS EMPLOYEES' DATA AND IS AUTHORIZED TO SHARE IT WITH NIUCO.

Should any data subject whose personal data is being processed make a request to Niuco in the exercise of their rights under applicable data protection laws, Niuco will refer the matter to the CLIENT and will cooperate to fulfil the data subject's request, to the extent considered reasonable and lawful.

3.2 Collection of Sensitive Personal Data

We do not intentionally collect sensitive personal data. However, you may choose to voluntarily provide sensitive personal data. The voluntary provision of sensitive personal data implies acknowledgment of the terms and conditions set out in this Policy, and constitutes your free and unambiguous consent to the processing of your personal data for the purposes specified herein.

3.3 Collection of Data from Children and Adolescents

We do not knowingly or intentionally collect personal data from individuals under the age of 18 (eighteen), as Niuco's services are not intended for or directed at persons under 18 (eighteen) years of age. Accordingly, it shall be the Client's responsibility, in the event of sharing data relating to minors, to obtain the appropriate authorization from their legal guardian.

3.4 Cookies, Pixel Tags, Log Files, Web Beacons, and Others

Niuco may use cookies and pixel tags, which enable the collection of information related to your browsing history, access date and time, facilitate Manager Users' login (by storing username and password), assist these users in interacting with available services, align their general interests, and adjust Manager User demographics to improve Software performance and provide a better experience for its Users.

Cookies. Cookies are small text files that are transferred via a server to your device (personal computer, hard drive, tablet, mobile phone, etc.). Niuco may use both session cookies and persistent cookies to better understand how Manager Users interact with the Software and the services made available by Niuco, as well as to monitor aggregate usage by Manager Users and web traffic redirection, and to improve and personalize our services, manage sessions, navigation, access, and Manager Users' registrations, and to identify their preferences. By deleting our cookies or disabling future cookies, Manager Users acknowledge that they may not be able to access certain areas or features offered by the Software.

Log File. Niuco may maintain log files that record activities related to Software usage, such as access to other websites, the type and quality of the internet connection, hardware and/or software, and the features of a particular service that has been used. These log files may be used to monitor traffic on the Website and Application and to resolve technical issues.

Web Beacons. Niuco may also use web beacons (or pixels) that transmit information from your device to a server, similar to cookies. Web beacons may be embedded in online content, videos, and emails, and are used to anonymously track online usage patterns of Manager Users, such as which emails are opened and which links are clicked by their recipients. The information collected may identify popular websites, services, features, and products, and will be used to personalize the services offered by Niuco.

We receive information when the Manager User interacts with the Software or services, even if they have not created an account ("Pre-Sale"). For example, when the Manager User accesses the website or interacts with our email notifications, we may receive information about the Manager User. This Log Data may include their IP address, browser type, operating system, referring webpage, pages visited, location, mobile carrier, device information, search terms, or cookie information. Log Data may be used to draw inferences about topics that may be of interest to the Manager User, in order to personalize content, among other purposes.

When a visitor accesses any page of our services, our servers automatically obtain their domain name and IP address, for example. Niuco uses this information in the administration of its website to examine aggregate traffic, investigate abuse related to the Website or its users, and/or ensure compliance with applicable law. Niuco does not make this information available to third parties, except in cases provided for by law, such as disclosure of data pursuant to a court order.

Among the information obtained in this way, the following may be noted:

• Details about queries made within the Software;
• Content searched, even if not directly related to the desired operation within the Software;
• Technical data that may include the URL, IP address, unique device ID, network and computer performance, browser type, language, and identification information, as well as transactional information enabling digital rights management — all of which relate exclusively to the Manager User;
• Access location information.

In addition, Niuco may make available a browser extension — an application authorized by the browser's developer to interact with browser features and collect information the browser holds. In this regard, the Client, where applicable, may install Niuco's extension in Data Subjects' browsers, enabling Niuco, through monitoring of browsed URLs, to identify only the software tools and online services that Data Subjects use and access via their corporate email address, within that browser.

In this regard, any Client wishing to contract this specific service must contact Niuco directly. It should be noted that: (i) access to software and online tools made via an email address other than the corporate one is, under no circumstances, collected or retained in Niuco's databases and servers; (ii) URL monitoring serves the sole purpose of mapping the software tools and online services used and the frequency of their use.

The information collected under this section will be used to improve the services offered by Niuco, and may also be used to provide and serve personalized advertising, monitor service effectiveness through analysis of visitor numbers, traffic, usage and demographic patterns, and to address technology issues.

4. Use of Personal Data

The collection and use of personal data, including professional information, of Data Subjects by Niuco is carried out in a limited manner, observing strict necessity and purpose requirements.

4.1 Processing of Personal Data

The processing of Data Subjects' personal data is carried out by Niuco to improve and provide the services available through the Software. Niuco will store, process, and transmit Data Subjects' data, files, and the information contained therein. By agreeing to this Privacy Policy, Data Subjects or Clients, as Controllers of Data Subjects' Data, expressly consent to the processing of their personal data by Niuco, which is essential for the use of the Software and the provision of services by Niuco.

The use of collected and stored information requires data processing, which may be carried out by Niuco itself or by engaged third parties. The Data Subject or the Client, as Controller of Data Subjects' data, expressly consents to the transfer of such data to other market agents, which will be necessary solely and exclusively for the delivery of services through the Software.

Niuco is authorized to use the information provided by Manager Users for the following specified purposes:

• Create the account, profile, and registrations necessary to enable Manager Users to interact;
• Provide the Client with Niuco's services in an adequate and efficient manner (management of active software licenses, report generation, development of indicator dashboards, and all features available in the Software);
• Ensure proper identification, qualification, and authentication of Manager Users;
• Analyze statistics and usage data in order to improve Manager Users' experience, including through anonymous studies of certain software tools used, assisting in the management and improvement of results and enabling the negotiation of better commercial terms;
• Personalize the Manager Users' experience: enable Manager Users to have an experience tailored to their needs;
• Improve our support: your information helps us respond more effectively to your Data Subject support requests and to service needs;
• Record access information so that the Manager User does not need to re-enter it each time they log into the Software;
• Improve, test, and monitor the efficiency of Niuco's Software;
• Develop and test new products and tools that may be added to the services provided by Niuco;
• Diagnose and correct any issues or imperfections in the Software and update it automatically;
• Offer promotions and discounts; and,
• Send information about new products and/or services, offers, institutional news, and information related to the products and/or services purchased, by email.

4.2 Sharing and Confidentiality of Personal Data

Niuco does not make available the Personal Data of Manager Users and Client Employees, except in the cases set out in this Policy.

4.2.1. Sharing with authorities

The personal data we collect and the activities we record, as well as processing records, may be shared with competent judicial or administrative authorities whenever required by law, requested by an administrative authority, or ordered by a court.

4.2.2. International transfer

Any data sharing will always be carried out within the limits and purposes of the processing described in this Policy. International data transfers are possible when software and/or servers belonging to providers that store data outside the country are used. In such cases, where personal data is transferred outside Brazil, all necessary measures and precautions will be taken to protect your personal data, in compliance with the provisions of Chapter V of the LGPD.

As safeguards for the protection of internationally transferred data, Niuco may use the following mechanisms:

• Standard Contractual Clauses (SCCs) approved by the ANPD, executed with international processors and sub-processors;
• Verification of adequacy decisions by the ANPD or recognized authorities, such as the European Commission, in cases where data is transferred to countries considered to have an adequate level of protection;
• Technical and organizational security measures, such as data encryption, access controls, identity management, network segmentation, and continuous monitoring;
• Periodic audits and data protection impact assessments, where applicable;
• Risk analysis and implementation of supplementary protective measures in cases where transfer is made to countries without an adequacy decision and requiring additional safeguards to protect data subjects' rights.

Niuco is committed to ensuring that any international data transfer is carried out with maximum security, transparency, and in compliance with the principles of Brazilian legislation and the ANPD's International Personal Data Transfer Regulation (Resolution CD/ANPD No. 15, dated February 24, 2024).

4.2.3. Sharing with third parties

For the proper execution of the services provided through the Platform, Niuco may share personal data with third parties, always within the limits of the purposes stated in this Policy and in compliance with applicable legislation, in particular Law No. 13,709/2018 (General Personal Data Protection Law – LGPD).

The personal data processed by Niuco may be shared with:

• Partner institutions and suppliers that support the delivery of services offered to Clients;
• Professional service providers, such as law firms, accounting firms, consultancies, and independent auditors;
• Technology infrastructure providers responsible for cloud hosting, institutional website management, social media, information security, and other technical functions essential to the Platform's operation.

Google API Services Niuco uses the following Google API services for the purposes indicated:

Service	Purpose
Admin SDK API	Identity management for Google Workspace domain (1)
Enterprise License Manager API	Supplementary to identity management for Google Workspace domain (1)
Google Analytics Admin API	Identity management for the Google Analytics account user directory (1)
BigQuery API	Custom integration for employee payroll management (2)
Cloud Logging API	Shadow IT access monitoring (2)
Cloud Resource Manager API	Spend management for resources contracted on the GCP platform (2)

1. Subject to the level of access granted by the client

2. Read-only and subject to access being granted by the client

The use and any transfer of information received through these APIs will fully comply with the Google API Services User Data Policy, including the Limited Use requirements.

Niuco's engagement of sub-processors is subject to prior verification of their compliance with applicable legal, contractual, and regulatory requirements. To this end, the following measures are adopted:

• Compliance due diligence: prior to engagement, Niuco assesses the sub-processor's ability to comply with the LGPD's requirements, including the adoption of adequate technical and organizational controls for the protection of personal data;
• Specific contractual instruments: sub-processors typically execute a Data Processing Agreement (DPA) containing clauses consistent with the legal and contractual commitments made by Niuco to its Clients and Users, or contracts incorporating data protection provisions;
• Ongoing monitoring: Niuco commits to periodically monitoring and reviewing engaged sub-processors, including through audits or contractual reassessments, with the aim of ensuring that the required level of compliance is maintained.

The updated list of engaged sub-processors, indicating the services provided and, where applicable, the location of the respective servers, is available for consultation on the Niuco sub-processors page. This list is updated whenever a material change occurs, ensuring transparency in personal data processing.

5. Legal Bases for Personal Data Processing

We process the personal data of Data Subjects and Client Representatives in accordance with the following legal bases:

• a) performance of a contract or pre-contractual procedures to which the data subject is a party (art. 7, V, of the LGPD), in the case of personal data of Client Representatives;
• b) legitimate interest of the controller or third parties (art. 7, IX, and art. 10, II, of the LGPD), in the case of commercial communications, promotion of our activities, and improvement of the services provided by Niuco;
• c) exercise of legal rights in judicial, administrative, or arbitration proceedings (art. 7, VI, of the LGPD);
• d) compliance with a legal or regulatory obligation (art. 7, II, of the LGPD), in the case of retention of information required under the Brazilian Internet Civil Framework;
• e) protection of credit, including in accordance with applicable legislation (art. 7, X, of the LGPD), in cases of data processing for security and service improvement purposes, including protection against fraud in the use of Niuco.

It should be noted that it will be our Client's responsibility to establish the legal bases for the processing of personal data of its employees, as the Client is the Controller of such personal data.

6. Change of Corporate Control

Should Niuco decide to sell or transfer control or assets related to the Software to third parties, the Personal Information of Data Subjects, such as name, email address, phone number, and other information entered into or made available through the Software, may be among the assets transferred to third parties, without any compensation or payment to Data Subjects. Nonetheless, Niuco will endeavour to ensure that the acquiring third party implements a Privacy Policy similar to this one, and commits to notifying its clients in advance of any change in corporate control.

7. Rights of Personal Data Subjects

We respect your rights as a personal data subject as set out in art. 18 of the LGPD and guarantee that you may request, at any time, in accordance with our role as controller or processor of your personal data, as applicable:

Niuco acting as Data Controller:

• I. Confirmation of processing: confirmation of the existence of processing of your personal data;
• II. Access to data: access to your personal data processed by us;
• III. Correction of data: correction of your incomplete, inaccurate, or outdated personal data;
• IV. Anonymization, blocking, and deletion of data: anonymization, blocking, or deletion of your personal data deemed unnecessary, excessive, or processed in non-compliance with the LGPD;
• V. Data portability: portability of personal data to another service or product provider, upon express request, in accordance with the national authority's regulations, subject to trade and industrial secrets;
• VI. Right to object to data processing: the suspension of processing and deletion of your personal data processed with your consent, should you object to the processing, its purpose, or the manner in which it is being carried out. Processing will be suspended and data deleted, except where processing was carried out on a legal basis other than consent;
• VII. Information on data sharing: information regarding which public and private entities we engage in shared use of data with;
• VIII. Information on consent: information regarding the possibility of withholding certain consents and the consequences of doing so;
• IX. Withdrawal of consent: withdrawal of consent in cases where consent is the legal basis used to legitimize the processing.

When Niuco acts as a Data Processor: When Niuco acts as a personal data processor on behalf of our Clients (the controllers), the above rights must be requested directly from the data controller, as Niuco carries out processing on their behalf, following their instructions. In this case, Niuco will cooperate with the controller in fulfilling data subjects' rights, in accordance with the data processing agreement or other contractual instruments in place.

Requesting Changes to Personal Data: We ask that you inform us of any changes to your personal data so that we can ensure it is updated and correctly stored, when we act as controller. When Niuco acts as processor, such changes must be requested from the controller, who is responsible for managing that information.

How to request the deletion of personal data: When Niuco acts as controller, the data subject may request the deletion of their personal data at any time, free of charge, by sending an email to the Data Protection Officer (DPO) at privacidade@niuco.com.br, with the subject “Personal data deletion request”. To speed up handling, the request should include:

• the data subject's full name;
• the email used on the Platform or the corporate email linked to the Client;
• the name of the company (Client) the data subject is linked to, if any;
• an indication of the data to be deleted or, if applicable, that the deletion of all of their personal data is requested.

Once received, the request will go through the following steps:

• Identity confirmation: Niuco may request additional information to confirm that the request was made by the data subject or their legal representative, preventing data from being deleted at the request of unauthorized third parties;
• Deletion: once identity is confirmed, the personal data will be deleted from the Platform's active environments or anonymized. Backup copies that may contain such data are deleted in the regular retention cycle and, until then, remain protected and are not used for any other purpose;
• Response to the data subject: within up to 15 (fifteen) days, Niuco will inform the data subject that the deletion has been completed or, if any data must be retained, which data was kept and the factual or legal reasons that justify its retention, pursuant to arts. 16 and 18, §4, of the LGPD.

Data processed by Niuco as processor: the deletion of personal data of the Client's Employees and Partners collected through the SaaS integrated into the Platform must be requested directly from the Client, who is the controller of such data. The Client may request this deletion from Niuco by email at privacidade@niuco.com.br. If a data subject's request reaches Niuco directly, it will be forwarded to the Client, and Niuco will cooperate with the Client in handling it.

Data received through Google APIs: the Client may, at any time, revoke Niuco's access to its Google account, through the Google Workspace admin console or the Google Account permissions page (https://myaccount.google.com/permissions). Revocation stops the collection of new data. For data already received to also be deleted, the Client must send the request to privacidade@niuco.com.br, which will follow the steps described above.

Impact of Deleting Personal Data: We note that certain personal data is essential for the use of the software, and its deletion may render it impossible to maintain your registration and prevent you from contracting the services offered by Niuco. Furthermore, we may at times be unable to delete personal data in order to comply with legal or regulatory obligations or to demonstrate compliance with contractual obligations.

In the event that it is not immediately possible to take the above measures, we will send a response explaining the factual or legal reasons that prevent their immediate adoption, as required by art. 18, §4, of the LGPD.

8. Storage of Personal Data

The personal data collected and controlled by Niuco is stored within the Platform itself, through the AWS cloud storage service. Upon expiry of the retention period established by Niuco and any legal requirement, personal data will be deleted using secure disposal methods, or will undergo an anonymization process.

Should a Data Subject request deletion when Niuco acts as controller, or the Client Controller request deletion when Niuco acts as processor, the data may be deleted prior to the internal retention period established for a given purpose. However, data may need to be retained in the database or further processed for purposes such as the exercise of legal rights, statutory requirement, court order, fraud prevention, credit protection, and other legitimate interests — and if this is the case, you will be informed that the deletion you requested will not be carried out.

Finally, it is important to note that to the extent permitted or required by law, we may delete your personal information at any time based on our own non-compliance criteria, and we are under no obligation to retain it.

9. Communication Policy

When any Manager User registers with Niuco, they will receive emails to confirm specific actions and requests. They will also receive notifications regarding important milestones in their relationship with Niuco. These transactional notifications do not have opt-out options, as they are sent by Niuco for security purposes.

Niuco may also respond to emails sent by Data Subjects, where applicable. From time to time, we may send surveys and other communications (directly or through partner companies) that we consider relevant to the Manager User, but such communications are optional and the Manager User may configure their account to stop receiving them (opt-out).

10. Marketing

Upon registering with Niuco, the Manager User will begin receiving information about new updates, products, and services periodically, by email. Marketing materials may be deactivated at any time — the Manager User simply needs to configure their account to stop receiving them (opt-out) or contact Niuco to request this action.

11. External Links

The Client and the Data Subject acknowledge and agree that Niuco has no control over external websites or resources accessed through links on its access page. Accordingly, Niuco does not endorse and takes no responsibility for any third-party content, advertisements, products, and services contained in third-party advertisements on its website.

Niuco also disclaims any liability for the terms of use and privacy policies of those websites or other materials contained or made available therein. It likewise does not share, endorse, monitor, validate, or accept the manner in which the websites or content storage tools referenced by links posted on its page collect, process, and transfer your personal information. In this regard, we recommend that Clients, Client Representatives, and Data Subjects review the terms of use, privacy policies, and other documents governing their access to third-party websites before providing any type of information.

12. Security

Niuco maintains physical, electronic, and procedural security resources that meet national and international legal standards for the protection of personal information, including access authentication mechanisms with dual-authentication systems ensuring individual accountability for processing records, detailed Software access logs, and the use of record management solutions based on techniques that guarantee the inviolability of data.

You hereby acknowledge that complete security on the internet is not possible, particularly with regard to criminal intrusions into secure data networks by hackers, among other security incident scenarios.

Nonetheless, we commit to taking reasonable measures to protect and prevent unauthorized access to your data. However, we cannot be held liable for the actions of those who may obtain unauthorized access to your data. We make no warranty, express or implied, that we will prevent unauthorized access to your data.

Should any security incident occur resulting in the exposure or unauthorized access to your personal data, we will take the necessary measures to mitigate the impact and, when required by the LGPD, will notify the ANPD within the regulatory deadline of 3 business days. In addition, we will publish an informational notice on the Platform and/or send you an email describing the circumstances of the incident. We will fulfill all legal obligations and those set out in the ANPD's regulations.

We have a structured internal process for responding to security incidents, which may be detailed upon request.

13. Changes to the Privacy Policy

Niuco reserves the right to amend this Privacy Policy at any time or periodically, as well as the content and features of the Software, in order to comply with applicable legislation or to accommodate changes to its business model.

In such cases, the updated version of the Privacy Policy will be published on the Website, bearing the "Last updated" date. We also commit to communicating updates to this policy to interested parties where there is a specific contractual obligation to do so. Should Clients and Manager Users continue to use the Software following amendments to this Privacy Policy, this will signify that Clients and Manager Users have agreed to such amendments and are legally bound by them. In the event that material amendments are made that require new consent from the Client and Manager User, Niuco will require the Client's and User's explicit acceptance in a prominent manner.

14. Automated Decisions and Data Subject Rights

Niuco may use automated decision-making in certain situations, such as the assessment of a risk score related to employees who have access to certain software and who have been terminated, for any reason. This automated assessment is based on the personal data of the Client's employees and aims to identify potential risks associated with system access, contributing to the security and integrity of our operations.

The risk score uses specific data, such as software activity records, access level, and usage history, to generate a score that may result in preventive or corrective actions, such as revoking access or temporary blocking.

Data Subject Rights Regarding Automated Decisions

Under articles 20 and 18 of the LGPD, a data subject whose personal data is subject to an exclusively automated decision is guaranteed the following rights:

Right to clear information about the automated process: The data subject may request clarification about the criteria used, the logic underlying the decision, and its potential impact on their interests. In the case of the "risk score," the logic applied is aimed at mitigating risks to system and data security through access blocking or permission revocation.

Right to request review of automated decisions: The data subject may request that a decision made exclusively through automated means be reviewed by a human responsible, ensuring the possibility of individual and non-discriminatory analysis. Such review will be conducted based on criteria of reasonableness, proportionality, and transparency.

Right to object: In cases where automated decisions materially affect the data subject's rights, the data subject may exercise their right to object to the processing, as provided under the LGPD.

Important: in cases where Niuco acts as a processor, the exercise of this right must be requested directly from the controller (Client).

Review Process and Access to Automated Decisions: Should the data subject wish to obtain further information about how Niuco makes automated decisions, or wish to exercise their rights in relation to such decisions, they may contact Niuco's Data Protection Officer (DPO) at privacidade@niuco.com.br. Requests will be handled with the highest priority, respecting the deadlines and rights set out in the LGPD.

15. Contact Us

Should you need and/or wish to clarify any questions about this Policy, obtain further information about the processing of your personal data, or exercise any of your rights, you may contact the Data Protection Officer, Rafael Salomão dos Santos, by email at privacidade@niuco.com.br.

Additionally, should you wish to report a violation of this Policy or inappropriate personal data processing practices, you may use the complaints channel at denuncie@niuco.com.br to submit your complaint. All complaints will be handled seriously and in confidence, with the aim of ensuring compliance with the LGPD and resolving any potential incident.

Requests submitted will be reviewed and responded to within up to 15 (fifteen) days, as set out in the LGPD or any subsequent regulatory deadline.

16. Final Provisions

This Privacy Policy supersedes all previous versions made available by Niuco.

Niuco may assign or transfer, at any time, temporarily or permanently, the rights and services arising from this Privacy Policy to a third-party service provider, at its sole discretion and without the Client's or Data Subject's authorization. The Data Subject may not assign or transfer this Privacy Policy, in whole or in part, without Niuco's prior approval.

This Privacy Policy and its provisions do not create any employment, corporate, partnership, or associative relationship between Niuco and Clients, Data Subjects, or Client Representatives, and any presumption of joint liability between the parties in the performance of their obligations is expressly excluded. Each party shall bear its own tax and employment obligations in accordance with the legislation in force at the time.

Should any provision of this Privacy Policy be held to be illegal, invalid, or unenforceable, in whole or in part, under any applicable law, that provision or part thereof shall be deemed not to exist for the purposes of this Privacy Policy, but the legality, validity, and enforceability of the remaining provisions contained in these documents shall not be affected.

The failure of either party to exercise any right shall not be construed as a waiver of that right, and prior conduct may not be invoked as tacit novation.

All communications between Niuco and Manager Users or the Client shall be deemed effective from the time emails are sent to the addresses registered by Manager Users. Manager Users must keep their email address up to date at all times.

The parties acknowledge that the commitments and obligations undertaken herein are subject to specific performance, pursuant to articles 461, 632, and 638 of the Code of Civil Procedure, and this Agreement shall serve as an extrajudicial enforcement instrument, pursuant to article 585, II, of the Code of Civil Procedure.

This Privacy Policy shall be governed by and construed exclusively in accordance with Brazilian law, in particular the General Data Protection Law. Any claim, dispute, or controversy arising from or related to it shall be resolved in the courts of the city of São Paulo, in the state of São Paulo.

Thank you for reading our Privacy Policy.

Welcome to Niuco!

17. Version History

Version	Change	Date
1.0	Initial publication of the Privacy Policy on the Niuco website.	19/04/2023
1.1	General LGPD compliance review: addition of the definitions of ANPD, joint controller and Data Protection Officer (DPO); removal of a duplicated passage in item 2.2; update of the data collected and of the forwarding of data subject requests to the Client; safeguards for international transfers (standard contractual clauses, adequacy decisions, technical measures and CD/ANPD Resolution No. 15/2024); rewrite of the sharing with third parties, with criteria for engaging sub-processors (due diligence, DPA and monitoring) in place of the named list of suppliers; commitment to notify clients in advance of a change of corporate control; data subject rights split according to Niuco acting as controller or processor; update of security incident communication; publication of the current version on the Website and communication to stakeholders; new section 14 (Automated Decisions and Data Subject Rights); addition of the whistleblower channel and the 15-day response deadline to the Contact Us section.	10/12/2025
1.2	Restructuring, by category, of the data collected from the Client's Employees and Partners (identification, organizational relationship, contractual status, activity in integrated SaaS and contact); addition of the Google API Services subsection, with the APIs used, their purposes and compliance with the Google API Services User Data Policy (Limited Use); reference to the public sub-processors page; update of the Platform URL to app.niuco.com.br; wording fixes.	15/04/2026
1.3	Addition, in section 7, of the “How to request the deletion of personal data” procedure: request channel, required information, handling steps, response deadline, data processed by Niuco as processor and revocation of access to Google APIs.	25/09/2026