Please read this Privacy and Personal Data Protection Policy carefully to understand the policies and practices adopted regarding all personal data processing activities. This Policy applies to natural persons who interact with the services of COLONY SOCIAL BRANDING PUBLICIDADE LTDA. as Data Subjects. It defines how the Personal Data of Data Subjects (users) is collected, processed, stored, and, eventually, shared by COLONY SOCIAL BRANDING PUBLICIDADE LTDA. This policy also informs how data subjects can access and update their Personal Data and make decisions about how their data will be used.

This Policy covers online data collection activities through our website. You may consult the section “Regarding the rights of data subjects over their Personal Data” for more information on how to object.

By accessing and/or using the services of COLONY SOCIAL BRANDING PUBLICIDADE LTDA., the user authorizes the collection, sharing, use, and storage of personal data as described in this Policy.

1 – LEGAL DEFINITIONS:
The following legal definitions and concepts apply alongside other defined terms used by the Parties, and are in accordance with the Brazilian General Data Protection Law (Law No. 13,709/18):
“COLONY SOCIAL BRANDING PUBLICIDADE LTDA.” or “COLONY”: a private legal entity, duly registered with the CNPJ/MF under No. 112.551.721/0001-79;
“Personal Data”: information related to an identified or identifiable natural person;
“Sensitive Personal Data”: personal data concerning racial or ethnic origin, religious belief, political opinion, union membership or membership in a religious, philosophical, or political organization, data relating to health or sex life, genetic or biometric data when linked to a natural person;
“Data Subject” or “User”: a natural person to whom the personal data being processed refers;
“Processing”: any operation carried out with personal data, such as collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, elimination, evaluation or control of information, modification, communication, transfer, dissemination, or extraction;
“Data Sharing”: communication, dissemination, international transfer, interconnection of personal data or shared processing of personal data banks between public agencies and entities in the exercise of their legal competencies, or between them and private entities, reciprocally, with specific authorization, for one or more permitted processing activities;
“Anonymization”: use of reasonable and available technical means at the time of processing, whereby data loses the possibility of being associated, directly or indirectly, with an individual;
“National Data Protection Authority” or “ANPD”: public administration body responsible for overseeing, implementing, and enforcing this Law throughout the national territory.

2 – SOURCES OF PERSONAL DATA, WHAT PERSONAL DATA WE COLLECT, AND HOW WE COLLECT IT:
We collect Data Subjects’ Personal Data through the following sources:

2.1 – COLONY’S WEBSITE
COLONY’s website may collect users’ Personal Data through the contact form, voluntarily filled out by the Data Subject.

2.2 – COOKIES
Cookies are small text files that may be placed on your computer or portable device by websites or online services you use. They ensure the proper functioning of websites and other online services. COLONY’s website uses only strictly necessary cookies that make the site usable by enabling basic functions such as page navigation and access to secure areas of the site. The site cannot function properly without these cookies. COLONY’s website cookies do not collect any type of Personal Data from its users.

3 – SENSITIVE PERSONAL DATA
COLONY does not collect any Sensitive Personal Data as defined by the Brazilian General Data Protection Law (LGPD). Therefore, we do not intend to collect or process such data in the normal course of your interaction with the website.

4 – USE OF PERSONAL DATA
The following items describe the purposes for which COLONY processes the Personal Data it may collect, and the types of Personal Data collected for each purpose.
Contact: Users’ Personal Data is used for the purpose of establishing contact between the data subject and COLONY, as well as to respond to questions, inquiries, and suggestions.
Legal reasons or merger/acquisition: If COLONY or its assets are acquired by or merged with another company, including due to bankruptcy, we will share your Personal Data with our legal successors, respecting the requirements of current legislation. We may also disclose Personal Data to third parties (i) when required by applicable law; (ii) in response to legal proceedings; (iii) in response to a request from a competent legal authority; (iv) to protect our rights, privacy, safety, or property; or (v) to enforce the terms of any agreement or the terms of our website, products, and services, in accordance with applicable laws.

5 – SHARING OF PERSONAL DATA
COLONY does not share any Personal Data collected through its website with third parties.

6 – RETENTION AND TERMINATION OF PERSONAL DATA PROCESSING
In compliance with the General Data Protection Law (Law No. 13,709/18) and other applicable legislation, COLONY will retain Personal Data for as long as necessary to fulfill the purposes for which it was collected, as described in this Policy, or to comply with legal obligations.
The request for deletion of Personal Data after the conclusion of its processing will depend on technical feasibility and limitations. Once the processing of Personal Data ends, the data may still be retained for compliance with legal or regulatory obligations and for the regular exercise of rights in judicial, administrative, or arbitration proceedings involving COLONY.
You can obtain more information about the retention of Personal Data through the contact channels detailed in this policy.

7 – SHARING, STORAGE, AND TRANSFER OF PERSONAL DATA
COLONY adopts appropriate measures to ensure all Personal Data is kept confidential and secure. However, these protections do not apply to information you choose to share in public areas, such as third-party social networks.
Authorized personnel access: All Personal Data will only be processed by our employees or authorized agents who require access depending on the specific purposes for which the Personal Data was collected.
Operational environment measures: All Personal Data is stored in operational environments that use reasonable technical and administrative security measures to prevent unauthorized access. We follow satisfactory protocols to protect Personal Data.

8 – RIGHTS OF DATA SUBJECTS REGARDING THEIR PERSONAL DATA
The data subject has the right to confirm the existence of processing, access, review, modify, and/or request an electronic copy of their Personal Data processed by COLONY.
They may also request details about the origin of their Personal Data or its sharing with third parties.
At any time, the data subject may limit the use and disclosure of their data or revoke consent to any of COLONY’s data processing activities, except in cases provided by law.
These rights may be exercised through the communication channels detailed in this policy.
COLONY will make every effort to ensure proper handling of all user concerns regarding the processing of their Personal Data.
Additionally, users have the right to file complaints with the competent data protection authorities.

9 – APPLICABLE LAW AND COMPETENT JURISDICTION
Any conflicts arising from the use of the application will be resolved in accordance with the data protection laws and jurisdiction where the data was collected and processed. In the absence or omission of such laws, the parties agree to submit to the legislation of COLONY’s headquarters.

10 – CHANGES TO OUR PRIVACY POLICY
Whenever COLONY decides to change how it processes Personal Data, this Policy will be updated. We reserve the right to make changes to our practices and this Policy at any time, provided it remains in compliance with applicable laws.
We recommend that users regularly check this policy or consult it whenever they have questions, to stay informed about updates or changes.

11 – HOW TO CONTACT US
The Data Subject may use the following contact channels to:
· Ask questions or make comments about this Policy and our privacy and data protection practices;
· File a complaint;
· Confirm the existence of Personal Data processing;
· Request information on how to access Personal Data;
· Request correction of incomplete, inaccurate, or outdated Personal Data;
· Request deletion of Personal Data processed with their consent, except as required by law;
· Request details of public or private entities with whom we share Personal Data;
· Exercise other rights as provided by the Brazilian General Data Protection Law (Law No. 13,709/18).

To do so, please contact us at:
Data Protection Officer: oi@colony.com.br

COLONY will receive, review, and respond within a reasonable timeframe to any request or complaint regarding the processing of Personal Data, including those related to violations of the rights of data subjects under applicable privacy and data protection laws.