Global Privacy Policy

1. OBJECTIVE

SoftExpert Software SA (“SoftExpert” or “organization”) was founded on February 1, 1995, and is currently a leading company in the information technology sector, with the main objective of offering its clients software and services aimed at the continuous improvement and optimization of their business processes, transforming operational excellence into a true competitive advantage.

SoftExpert's business is the sale of products and services to legal entities. However, in the performance of its functions, the organization may carry out activities characterized as the processing of personal data. During the execution of these operations, SoftExpert undertakes to observe the basic security and privacy requirements defined by the General Data Protection Law (“LGPD”).

The privacy and security of the personal data that SoftExpert collects is of paramount importance. For this reason, SoftExpert seeks, through this document, to demonstrate its commitment to the protection and privacy of personal data, covering topics such as the rights of data subjects, the forms of use and types of data collected, the legal bases that legitimize the processing, the means of contact for exercising rights, and communication with SoftExpert.

2. SCOPE

This document applies to all holders of personal data processed by SoftExpert, including employees, customers, suppliers, business partners, and any other parties involved, in accordance with applicable data protection laws.

3. REFERENCES

The following are the standards that this document adopts:

• a) LGPD – General Law for the Protection of Personal Data.
• b) NBR ISO 27001 – Information security management systems - Requirements.

4. TERMS

For the purposes of this document, the following terms and definitions are adopted:

4.1 Data subject

Natural person/individual to whom the personal data being processed refers.

4.2 Controller

This refers to the individual or legal entity, whether public or private, responsible for decisions regarding the processing of personal data. In other words, they are responsible for making decisions about the activity to be carried out with personal data.

4.3 Operator

It is the natural or legal person, governed by public or private law, who processes personal data on behalf of the controller and in accordance with the purpose determined by the controller.

4.4 Personal data

All information or combination of information that can unequivocally identify a data subject, that is, without leaving any doubt.

4.5 Sensitive personal data

Personal data relating to racial or ethnic origin, religious beliefs, political opinions, membership in a trade union or religious, philosophical, or political organization, data concerning health or sex life, genetic or biometric data.

4.6 Data Protection Officer/DPO

This person is responsible for acting as a communication channel between the Controller, data subjects, and the National Data Protection Agency when the matter involves personal data.

4.7 Treatment

Any activity that uses personal data in its execution, including, but not limited to, collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, elimination, evaluation.

5. About the current policy

The purpose of this Policy is to:

1. To ensure that individuals from whom SoftExpert collects information understand what personal data SoftExpert processes, the reasons why it processes and uses it, and whether their information is shared.
2. Explain how SoftExpert uses the aforementioned personal data.
3. To explain the respective rights and options that individuals have regarding the personal data that SoftExpert collects and processes, and how SoftExpert will protect this data.

SoftExpert hopes that this policy will help in understanding its commitment to the privacy of its clients and third parties from whom SoftExpert collects information.

6. Individual rights and preferences: SoftExpert provides users with choice and control.

As provided for under applicable law and unless limited thereto, the rights granted to individuals are as follows:

1. Right of confirmation and access: the data subject has the right to verify whether a given organization processes their personal data. If so, they also have the right to access their own information.
2. Right to correct incomplete, inaccurate, or outdated data: This is the right to request that SoftExpert change or update personal data whenever it is incorrect or incomplete.
3. Right to erase information, when possible: the data subject has the right to request the erasure of their data, provided there is no legal basis justifying the retention of their information in the database.
4. Right to object: (i) the right to object, at any time, to the processing of your personal data for reasons relating to your situation; (ii) the right to object to your personal data being processed for direct marketing purposes.
5. Right to data portability: this consists of the right to request a copy of your personal data in electronic format and the right to transmit this personal data for use in third-party services.
6. Right to revoke consent, when the legal basis is consent: this consists of the right to request the revocation of all consent previously given that authorized the processing of your personal data.
7. Right to obtain information about the possibility of not providing consent and about the consequences of refusal: depending on the specific case, the legal basis used may be consent. Therefore, if this occurs, the data subject has the right to obtain clear information about what will be done with their personal data, as well as what may happen if they do not authorize its processing.

It should also be clarified that the data subject may exercise their rights through written communication, describing which right they wish to exercise, and may also request clarification of any doubts regarding the processing. To do so, they should send an email to dpo@softexpert.com. SoftExpert will respond to requests within the legal deadline of 15 days, reserving the right to extend this deadline, provided it is duly justified.

7. How SoftExpert collects personal data

SoftExpert collects personal data in the following ways:

1. By filling out forms on the SoftExpert website: SoftExpert receives and stores all information provided through contact forms on its website, whether for contracting SoftExpert products and services or expressing interest in promotional and marketing materials.
2. Third parties: SoftExpert receives certain information from third parties, including, but not limited to, partners with whom it works.
3. Client employee data: SoftExpert receives and stores personal data of designated Client employees to centralize the opening of support tickets for SoftExpert's support service.
4. Contract Signatory Data: SoftExpert receives personal data from legal representatives and witnesses designated as signatories of Contracts and Addendums signed with clients, service providers, and suppliers.
5. Cookies: SoftExpert collects data to improve the user browsing experience while using the organization's website.
6. Events: SoftExpert collects data through events it participates in or organizes for clients, partners, or the community in general. This data is collected to contact participants when there is interest in maintaining contact.
7. Recruitment Platform and Employee Data: During the selection process for filling job vacancies, SoftExpert uses third-party software to host information and conduct all candidate prospecting, interviews, and hiring. After this process is completed, the candidate will be asked to submit the necessary documentation and information for registration.

Whenever possible, SoftExpert uses anonymized and aggregated information for purposes including testing its IT systems, research, data analysis, creating marketing and promotional models, improving its software and services, and developing new features and functionalities.

8. Personal data processed by SoftExpert

In the course of SoftExpert's business activities, the company may process personal data relating to individuals who are, have been, or will be related to the organization, directly or indirectly, as well as personal data specifically relating to clients, business partners, service providers, employees, and shareholders. Such personal data may be expanded depending on the specific case; however, SoftExpert primarily processes:

1. Contact and Identification Data: information that can minimally identify a data subject, such as name, email, telephone number, job title, and the company they work for. This data may also be used by SoftExpert to provide services to clients;
2. Professional data: In addition to the previous data, data relating to the holder's professional context, such as history and experiences, may also be processed;
3. Cookies: Cookies are information related to how you use the SoftExpert website, such as the content and links you access, and the time you spend viewing the information. The owner can find more information in SoftExpert's Cookie Guideline.

SoftExpert may, in certain situations, process personal data of children or adolescents, always linking this processing to the legal basis that makes it legitimate, in accordance with the LGPD (Brazilian General Data Protection Law).

Eventually, SoftExpert may process sensitive personal data. In cases where SoftExpert is the data controller, it will comply with Article 11 of the LGPD (Brazilian General Data Protection Law), which mandates obtaining the data subject's consent or, in the absence of consent, when processing is indispensable for compliance with a legal or regulatory obligation, the regular exercise of rights, including in contracts and in judicial, administrative, and arbitration proceedings, protection of the life or physical integrity of the data subject or third parties, protection of health, exclusively in procedures carried out by health professionals, health services, or health authorities; or guaranteeing the prevention of fraud and the security of the data subject in identification and authentication processes for registration in electronic systems, safeguarding the rights mentioned in Article 9 of the LGPD, except in cases where the fundamental rights and freedoms of the data subject prevail and require the protection of personal data. The types of personal data processed vary according to the purposes of use and the activities performed.

In cases where SoftExpert acts as a data processor, the processing of personal data will be limited to the execution of the service itself, with the data controller being responsible for correctly linking the legal basis or even obtaining the appropriate consent form, depending on the case.

However, SoftExpert only processes the minimum amount of personal data necessary for each process.

9. SoftExpert's role as a controller and/or processor of personal data

Depending on the formalized legal relationship, SoftExpert may occupy the position of Data Controller or Data Processor, according to the concepts indicated in this document and in accordance with the LGPD (Brazilian General Data Protection Law).

Therefore, when it is up to SoftExpert to determine the purposes, means, and decision-making regarding data processing, the organization will be considered the Controller, as is the case with the personal data of its employees, for example.

However, when SoftExpert processes data on behalf of a Controller, it will be considered a Processor, as in cases where SoftExpert provides cloud environment management services to the client. Additionally, service providers, consultants, and partners may also act as Data Processors when they perform any data processing operation on behalf of SoftExpert clients.

Regardless of the role played by SoftExpert during the execution of its activities, SoftExpert declares, through this document, that it has good data governance practices, taking into account the nature, scope, purpose, probability and severity of the risks and benefits arising from the processing of the data subject's data.

10. Legal basis for processing personal data

Article 7 of the LGPD (Brazilian General Data Protection Law) establishes the legal bases that legitimize the processing of personal data; that is, it lists the circumstances that authorize the execution of activities considered data processing. The Law establishes that each process involving data processing must be based on at least one legal basis that authorizes the operation.

SoftExpert may process personal data based on the following situations:

1. when the data subject authorizes and provides their consent to the processing of their data.
2. to comply with a legal or regulatory obligation imposed by law or by a competent authority.
3. to execute contracts or preliminary procedures related to a contract to which the data subject is a party.
4. for the regular exercise of rights in judicial, administrative or arbitration proceedings.
5. for the protection of the life or physical safety of the holder or third parties.
6. to meet the legitimate interests of SoftExpert or third parties, except where the fundamental rights and freedoms of the data subject prevail and require protection of personal data.
7. for the protection of credit, including as provided for in the relevant legislation.

Additionally, SoftExpert invests in, adopts, and makes significant efforts to implement technical and organizational measures aimed at protecting personal data from improper and unauthorized access. These measures and solutions consider the nature, context, risks, purposes, and costs incurred in their application.

11. International data transfers

SoftExpert processes personal information both domestically and in countries with similar or equivalent legislation. In this regard, when SoftExpert processes cross-border data, it safeguards the rights of data subjects and adopts technical and organizational measures capable of protecting the personal data of data subjects.

Furthermore, SoftExpert may share personal data to contribute to investigations and fraud prevention, in cases where there are requests from the relevant authorities, if they are consistent with legal requirements, regulations or applicable legal process.

12. Data storage and disposal

SoftExpert may retain the personal data it collects for as long as necessary to provide the services it offers to its customers and for legitimate and essential business purposes, such as maintaining the performance of its software, making data-driven business decisions about features and offers, complying with its legal obligations, and resolving disputes.

Once the purpose for which it was intended has been fulfilled, such information may be discarded, unless there is another legal basis that justifies retaining it.

13. Personal data security

SoftExpert is committed to adopting the necessary technical and organizational measures to protect the personal data it processes, ensuring that it is safeguarded against unauthorized access, destruction, loss, alteration, improper communication, or unauthorized disclosure. While we strive to maintain a high level of security, it is important to note that no system is entirely immune to risks.

To ensure adequate protection, SoftExpert uses solutions that follow the best technical practices available on the market, considering implementation costs, the nature and context of data processing, its specific purposes, and the risks associated with the rights and freedoms of data subjects.

SoftExpert also holds the ISO 27001:2022 certification, which attests to the existence of an Information Security Management System (ISMS). This system includes policies, procedures, and processes that guide the protection of confidentiality, integrity, and availability of information. As part of this commitment, internal and external audits are conducted periodically by certification bodies, ensuring continuous improvement and compliance with high security standards.

Furthermore, SoftExpert undertakes to promptly notify data subjects in the event of a security incident that may cause significant risks or harm to their rights and freedoms, taking all necessary corrective measures.

It is important to remember that, according to the General Data Protection Law (LGPD), SoftExpert cannot be held responsible for events caused exclusively by third parties or by the data subject themselves.

Finally, SoftExpert ensures that the personal data under its management is processed based on the principles of confidentiality, integrity, and availability, in accordance with legal requirements and information security standards.

14. Data Protection Officer (DPO)

The Data Protection Officer (DPO) is the person appointed by the Controller to act as a communication channel between the Controller, data subjects, and the ANPD (Brazilian National Data Protection Authority).

The Data Protection Officer (DPO) for SoftExpert is Daniele da Silva Novais, who can be contacted by email at dpo@softexpert.com.

15. How to contact us

If you have any questions about this document or how personal data is handled by the organization, you can contact us through the following means:

1. Controller/Operator: SoftExpert Software SA
2. Telephone: +55 (47) 2101-9900
3. DPO/Data Protection Officer: dpo@softexpert.com