PRIVACY STATEMENT FOR CONSUMER DATA

Last updated: February 06, 2020

1. INTRODUCTION

This Privacy Statement is applicable to the processing by Chama Technologies B.V, based at Egelantiersgracht 390, 1015 RR, Amsterdam, The Netherlands and Chama Tecnologia Brasil Ltda., based at Joaquim Floriano street, 940, 1st and 5th floors, Itaim Bibi, Brazil (hereafter referred to as “Our Company”, we or us) of all personal data (data related to identified or identifiable natural persons) belonging to end consumers in the Chama application (“Consumer”). This Privacy Statement is not applicable to business related data and/or data on companies. Except as expressly set forth in this Privacy Statement, this Privacy Statement is not applicable to your relationship with third parties, and your provision of personal data to third parties will be subject to the policies and practices of the respective third party.

Our Company is the controller for the processing of Consumer’s personal data. In this statement we describe who we are, how and for which purposes we process your personal data and all other information that may be relevant to you. In case you have any additional questions you can contact us via the contact details provided in the application's FAQ.

This Privacy Statement applies since 23/05/2018. The last modifications were made on 23/05/2018, 27/12/2018 and 06/02/20. This statement may change over time and the most up-to-date version is published on our website. If significant changes are being made, we will actively inform you.

2. FOR WHICH PURPOSES DO WE PROCESS YOUR PERSONAL DATA?

Our Company will process your personal data when you use our website or application or when you interact with us.

A. For answering your questions

If you get in touch with us, we will use your personal data in order to reply and answer your question(s). When you call us, we may record the conversation for training and evaluation purposes.

For this purpose:

  • we process your personal data on the basis of your consent when you provide us with your personal data or on the basis of our legitimate interest to train and evaluate our staff so that they can better help our customers.
  • we process your name, contact details, location data, logging of internet usage, your correspondence with us your question and all other personal data which are necessary to answer your question.

B. For the development and improvement of products and/or services

We process your personal data in order to assess, analyse and improve our products and (customer) services. We use aggregated personal data to analyse customer behaviour and to adjust our products and services accordingly. When you use our website or the application, enter or search data through the website or the application, we also process your personal data to compile analytics reports. This means that we analyse how often you read our newsletters, how often you visit our website or application, which pages you click on and what goods you purchase through our website or application. We may purchase supplementary data from public sources to complement our database for the above purposes.

For this purpose:

  • we process your information based on your consent, in light of our legitimate interest to develop and improve our products and services.
  • we process your contact details such as your address and email address, personal details such as your name and date of birth, payment and credit information, and correspondence with us. In addition, we process the personal data you entered into the application or a website or that were generated by the functionalities you used in the application or a website and the technical data from your device such as its IP-address, location, your actions in our application, the pages you visited on our website, your click- and surf behaviour and the length of your session.
  • If you choose to participate in our surveys or interviews, we may ask you to provide us with personal data, such as name, age and other personal data to correctly processes the surveys or interviews. We may also use the personal data that you have provided in the survey or interview for this purpose.

Our Company may use third-party service providers to monitor and analyze the use of our website and our application. This includes google analytics, a web analytics service offered by google that tracks and reports website traffic. Google uses the data collected to track and monitor the use of our service. This data is shared with other google services. Google may use the collected data to contextualize and personalize the ads of its own advertising network.
For more information on the privacy practices of Google, please visit the Google privacy & terms web page: http://www.google.com/intl/en/policies/privacy/.
Our Company also use Hotjar as an analytics product. By combining both analytics tools and visual heatmap representations, Hotjar helps us understand how to improve your user experience. Heatmap’s tracking codes automatically collect and store information based on your activity on our site. This information includes: mouse and touch activity (but no keyboard activity); screen activity (areas of our website or application that you clicked); use of scroll bar; wrong clicks (clicks on items that are not buttons). To review Hotjar’s privacy policy, go to https://www.hotjar.com/legal/policies/privacy/.

C. For the conclusion and execution of agreement

When you order a product with one of the dealers active on our platform, we process your personal data for administrative purposes such as to administer your orders or services. Our Company will process your personal data in order to further enable the dealer to execute the agreement, including for the delivery of customer services, and, if you opt to pay through a credit card within the application, to process your payment.

For this purpose:

  • we process personal data based on your consent because this is necessary for the conclusion of a contract between you and the dealer. Our Company cannot facilitate the transaction without obtaining the required information.
  • we process your contact details such as your address, location and email address, personal details such as your name, phone number and date of birth, payment and credit information and details of your correspondence with us.
  • if you opt to pay through a credit card within the application, we may share certain information with third parties for the purposes of payment processing, including your name, payment and credit card information, as detailed in Section 4 of this Privacy Statement.

You agree that we may send you messages related to the product and the delivery requested by you via SMS , MMS and e-mail or via communications apps such as WhatsApp to the telephone number or e-mail address provided by you when registering with us. You can choose not to receive Whatsapp messages at any time through our application, on the tab profile > menu > preferences. You can also choose not to receive any messages at any time through our application, on from the support menu > refuse terms of service > yes, in which case all your data will be erased from our application. You can also choose not to receive product and delivery related messages by sending an email to [email protected], stating the e-mail and phone number you use and pointing out that you no longer wish to receive these messages. You acknowledge that your use of our services may be impacted if you choose not to receive product and delivery related text messages.

D. For relationship management and marketing

We use the information stored in our customer database to send you suitable offers and newsletters, send push notifications as well as to provide customer services, perform account management and communicate in case of any issues. We also use your personal data for the development, execution and analysis of market surveys and marketing strategies.

For this purpose:

  • when sending you newsletters and/or other relationship management and marketing communications, we process personal data based on your consent.
  • we process your name, e-mail, identifying data (such as client or employee number IP address, pseudonym, phone ID, etc), logging of internet / system usage.

You agree that we may send you marketing, promotional or advertising text messages (SMS , MMS and e-mail) to the telephone number or e- mail address provided by you when you register with us. You can choose not to receive these promotional messages (SMS, MMS or e-mail) at any time through our application, from the profile tab > menu > preferences, where you can choose which means you prefer to use to communicate with Our Company. You can also choose not to receive promotional messages by sending an email to [email protected], stating the e-mail and phone number you use and pointing out that you no longer wish to receive these messages. You acknowledge that your use of our services may be impacted if you choose not to receive text messages.

E. For business process execution and internal management

We process your personal data in the performance and organization of our business. This includes general management, order management and management of our assets. Our Company also processes your personal data for its internal management. We provide central processing facilities in order to work more efficiently. We conduct audits and investigations, implement business controls, and manage and use customer, supplier and business partner directories. Also, we process your personal data for finance and accounting, archiving and insurance purposes, legal and business consulting and in the context of dispute resolution.

For this purpose:

  • we process personal data based on your consent in light of our legitimate interest to maintain and improve sound business operations.
  • we process your name, e-mail, identifying data (such as client or employee number IP address, pseudonym, phone ID, etc), logging of internet / system usage, phone number, financial data, order history, correspondence with Our Company and data generated during the performance of the agreement between you and the dealer.

F. For organizational analysis and development, management reporting and acquisition and divestitures

At Our Company, we process your personal data in the preparation and performance of management reporting and analysis. We use aggregated/anonymized personal data to create management reports and to analyze our business. We conduct consumer surveys to learn more about your views and opinions in preparation of our management reporting. We also process your personal data for management reporting purposes in the context of mergers, acquisitions and divestitures and in order to manage such transactions.

For this purpose:

  • we process personal data based on your consent in light of our legitimate interest to maintain and improve sound business operations.
  • we process your name, e-mail, identifying data (such as client or employee number IP address, pseudonym, phone ID, etc), logging of internet / system usage, phone number, financial data, order history, correspondence with Our Company and data generated during the performance of the agreement between you and the dealer.

G. When you use our website or application

If you use our website or our application, we process technical data to offer you our website’s or our application’s functionalities and to allow our website's or our application’s administrators to manage and improve our website's or our application’s performance as well as secure our website or our application’s and underlying IT-systems and network. If you enter data in our website or on our application, such as a product preference or your location to receive relevant information or functionalities, Our Company processes this data to provide you with the requested information or functionalities. Further, we process your personal data to allow you to save your data (such as preferences and products) to your saved items and to allow you to share these with others using the sharing options you have configured on your device. We also register if we have obtained any consents from you for our compliance with laws.

For this purpose:

  • we process personal data based on our legitimate interest to offer technically adequately working website or application and to improve our website's or our application's performance.
  • we process the personal data you have entered into our website or our application or that is generated by the functionalities you have used in our website or application and the technical data from your device such as its IP address, phone ID, device and internet browser you use, the pages you have visited on our website or application, your click- and surf behaviour and the length of your session.

H. Interaction via social media

Our Company is active on social media platforms like Facebook, Twitter, LinkedIn and YouTube. When you contact Our Company via social media, we process your personal data in order to answer your questions and to respond to your messages. In addition, when you visit a 'Connect with us' screen on one of our website or application, you can contact us through a variety of communication channels. We provide you with our email address, for you to send us your feedback and suggested improvements, as well as our website, trade website, Twitter, Facebook and YouTube details. When you click one of the corresponding icons, we will refer you to the website or application of the applicable third party, whether this is your email provider or a social media platform. When you click on a Facebook ‘Like’ button, your personal data may be processed by Our Company and Facebook, in accordance with the applicable terms between you and Facebook. For more information on the privacy practices of Facebook, please visit the Facebook Privacy Policy page: https://www.facebook.com/policy.php.

For this purpose:

  • we process personal data based on our legitimate interest to adequately respond to your questions and correctly refer you to our social media pages.
  • we process the communication channel you have chosen to use to connect with us and the personal data you supply to Our Company. This includes your (user) name, address, email address and the personal data you have included in your message. In addition, when you click one of the buttons displayed, the relevant third party might place cookies on your device.

We also use social media to display advertisements. This is either based on the information the social media platform has collected from you or the information our Company has collected from you, such as when you subscribe to our newsletters (see above).

  • In case the social media platform has collected the information, Our Company does not get access to that information. As a result, we have no say in how the platform stores and uses the information. We recommend reading the conditions and privacy statements of your social media provider. They also often provide you with account settings or some other means to change your privacy settings.
  • In case we share your personal information, like your email address or phone number, the social media platform uses your information to include or exclude you from seeing a particular advertisement. Your information will be encrypted (hashed) when transferred to the social media platform. If you do not have a profile on a particular platform, that platform will not be able to decrypt the information and find out who you are.

We may also communicate with you on social media, by e-mails, SMS or MMS (Letter D of this same Section) or via communications apps such as WhatsApp if you are connected to us, if you use social media or a communication app or if you post a photo or video linked to Our Company or our products. You agree that we can send you messages on the WhatsApp account linked to the phone number provided by you when using our website and our application. You can opt out at any time from sharing your information with social media platforms for advertising by sending an email to [email protected]

I. To monitor and investigate compliance

We monitor our processes to check compliance with our policies and regulations. During monitoring activities, your personal data may be accessed and viewed.

For this purpose:

  • we may process your personal data based on your consent and our legitimate interest to monitor our internal processes and in order to comply with the law.
  • any personal data that is stored in our systems may be accessed and viewed for compliance purposes. The personal data that are accessed and viewed will not be stored for compliance purposes, unless we need them to further investigate potential non-compliant behaviour.
  • we do not retain your personal data for this purpose, unless they are linked to non-compliant behaviour. We will then retain the relevant personal data until the investigation or proceedings have been concluded.

J. To comply with the law

In some cases, we process your personal data to comply with laws and regulations. This could be, for example, the case where tax or business conduct related obligations apply. In order to comply with relevant laws and regulations, we may need to disclose your personal data to government institutions or supervisory authorities without specific further notice to you.

For this purpose:

  • we process your personal data in order to comply with the law.
  • we process your contact details such as your address and email address, personal details such as your name and date of birth, payment information, payment and order history.

K. When you participate in events or promotions

We send you emails, SMS and MMS with promotions and invitations to participate in events. If you choose to participate in one of these activities, we need your personal data to be able to announce and organize these. In addition, if you participate in any of these activities, we need your personal data to measure the response to events or promotions.

For this purpose:

  • we process personal data based on your consent. You can withdraw your consent at any time, without this affecting the lawfulness of processing based on consent before withdrawal.
  • we process your name, address, email address and your entries in the relevant event.

3. HOW LONG DO WE RETAIN YOUR PERSONAL DATA?

Our Company generally shall retain your personal data only for the period required to serve the applicable business purpose as described above, to the extent reasonably necessary to comply with an applicable legal requirement or as advisable in light of an applicable statute of limitations.

Promptly after the applicable storage period has ended, the personal data shall be:

(i) securely deleted or destroyed; or

(ii) anonymized;

4. WHO HAS ACCESS TO YOUR PERSONAL DATA?

Access to your personal data within Our Company

As a global organization, data we collect may be transferred internationally throughout Our Company’s worldwide organisation. Your personal data may be exchanged with the group that Our Company belongs to, shareholders and associated companies, following the group’s internal policies. We exchange your data for administrative purposes and so that we can have a complete overview of your contacts and contracts with the group that Our Company belongs to. We may also exchange your data in order to offer you a complete package of services and products, in compliance with the applicable laws. Our Company’s employees are authorized to access personal data only to the extent necessary to serve the applicable purpose and to perform their jobs. In some cases, your personal data may be transferred to a country that does not provide an adequate level of protection of personal data. However, Our Company has taken measures to ensure that your personal data is adequately protected as Binding Corporate Rules are applicable throughout the group that Our Company belongs to.

Access to your personal data by third parties

The following third parties may have access to your personal data where relevant for the provisioning of their products or services to Our Company: banks, insurance companies, IT and software suppliers, social media companies, accountants, forensic specialists, consultants, lawyers. When third parties are given access to your personal data, Our Company will take the required contractual, technical and organizational measures to ensure that your personal data are only processed to the extent that such processing is necessary. The third parties will only process your personal data in accordance with applicable law and under the terms of this privacy policy. If personal data is transferred to a third party in a country that does not provide an adequate level of protection of personal data, we will take measures to ensure that your personal data is adequately protected as set forth by Law, such as entering into Standard Contractual Clauses with these recipients. Your personal data will not be supplied to third parties, except when required by law or in relation to payment processors as detailed below.

Access to your personal data by payment processors

If you opt to pay through a credit card within the application, we may provide your personal data to a payment processor. Currently we use Adyen for this matter. When payment processors are given access to your personal data, Our Company will take the required contractual, technical and organizational measures to ensure that your personal data are only processed to the extent that such processing is necessary. The third parties will only process your personal data in accordance with applicable law and under the terms of this privacy policy. For more information on the privacy practices of Adyen, please visit the Adyen’s Privacy Policy page: https://www.adyen.com/pt_BR/politicas-e-termo-de-responsabilidade/privacy-policy. If personal data is transferred to a third party in a country that does not provide an adequate level of protection of personal data, we will take measures to ensure that your personal data is adequately protected as set forth by Law, such as entering into Standard Contractual Clauses with these recipients.

5. HOW ARE YOUR PERSONAL DATA SECURED

We have taken adequate safeguards to ensure the confidentiality and security of your personal data. We have implemented appropriate technical, physical and organisational measures to protect personal data against accidental or unlawful destruction or accidental loss, damage, alteration, unauthorised disclosure or access, and against all other forms of unlawful processing (including, but not limited to unnecessary collection) or further processing.

6. HOW CAN YOU EXERCISE YOUR PRIVACY RIGHTS?

You have the right to request access or an overview of your personal data, and under certain conditions, rectification and/or erasure of personal data. In addition, you may also have the right of restriction of processing concerning your personal data, the right to object to processing as well as the right to data portability. To invoke your privacy rights, please refer to the FAQ section in the application. Keep in mind that we may ask for additional information to verify your identity.

7. CAN YOU WITHDRAW YOUR CONSENT?

Once given, you may always withdraw your consent. Please keep in mind that withdrawal does not have retrospective effect. Please refer to the terms of service section within the application.

You can choose to revoke your consent and erase all your personal data that we process at any time through our application, on the tabs support > refuse terms of service > yes. You can also ask for your data erasure by sending an email to [email protected], stating the e-mail and phone number that you registered with us and that you no longer wish Our Company to process your personal data.

If you withdraw consent and end your relationship with Our Company, we will take the steps described in Section 3 to delete or anonymize your data. In this case it will be no longer possible for you to make use of our services.

8. HOW TO FILE A COMPLAINT?

If you have a complaint about the use of your personal data by Our Company, you can file a complaint via the customer service in the application. Besides filing a complaint with Our Company, you are also able to file a complaint with your local data protection supervisory authority.

9. HOW CAN YOU CONTACT US

If you have any questions about the way we process your personal data, please read this statement first. For additional questions, remarks, compliments or complaints, please contact our customer service in the application.



PRIVACY STATEMENT FOR BUSINESS PARTNER DATA

Last updated: March 30, 2020

1. INTRODUCTION

This Privacy Statement is applicable to the processing by Chama Technologies B.V and Chama Tecnologia Brasil Ltda., based at Egelantiersgracht 390, 1015 RR, Amsterdam, The Netherlands (hereafter referred to as “Our Company”, we or us) of all personal data belonging to customer, suppliers and business partner data (“Business Partner”). This Privacy Statement is not applicable to business related data and/or data on companies.

Our Company is the controller for the processing of Business Partner’s personal data. In this statement we describe who we are, how and for which purposes we process your personal data and all other information that may be relevant to you. In case you have any additional questions you can contact us via the contact details provided at the bottom of this statement.

This Privacy Statement applies since 23/05/2018. The last modifications were made on 31/03/2020. This statement may change over time and the most up-to-date version is published on our website. If significant changes are being made, we will actively inform you.

2. FOR WHICH PURPOSES DO WE PROCESS YOUR PERSONAL DATA?

Our Company will process your personal data when you do business with us, when you use our website or application or when you interact with us.

A. For answering your questions

If you get in touch with us, we will use your personal data in order to reply and answer your question(s).

For this purpose

  • we process your personal data for this purpose on the basis of your consent when you provide us with your personal data.
  • we process your name, contact details, location data, logging of internet usage, your correspondence with us your question and all other personal data which are necessary to answer your question.

B. For the development and improvement of products and/or services

We process your personal data in order to assess, analyse and improve our products and (customer) services. We use aggregated personal data to analyse customer behaviour and to adjust our products and services accordingly. When you use a website or the application, enter or search data through this website or the application; we also process your personal data to compile analytics reports. We use aggregated personal data to analyse customer behaviour and to adjust our products and services accordingly, to ensure that it is relevant to our customers. This means that we analyse how often you read our newsletters, how often you visit our website or application, which pages you click on and what goods you purchase through our website or application. We may purchase supplementary data from public sources to complement our database for the above purposes.

For this purpose

  • we process your information based on your consent, in light of our legitimate interest to develop and improve our products and services.
  • we process your contact details such as your address and email address, personal details such as your name and date of birth, payment and credit information, and correspondence with us. In addition, we process the personal data you entered into a website or that were generated by the functionalities you used in a website and the technical data from your device such as its IP-address, the pages you visited on our website, your click- and surf behaviour and the length of your session.
  • If you choose to participate in our surveys or interviews, we may ask you to provide us with personal data, such as name, age and other personal data to correctly processes the surveys or interviews. We may also use the personal data that you have provided in the survey for this purpose.

C. For the assessment and acceptance of a customer, supplier or business partner

When you get in contact with us, we will process your personal data for assessment and acceptance purposes, for example in order to confirm and verify your identity. Our Company will further process your personal data for other administrative purposes such as due diligence and screening against publicly available government and/or law enforcement agency sanctions lists.

For this purpose

  • we process personal data based on your consent because this is necessary for the conclusion of a contract between you and us. Our Company cannot enter into contracts without obtaining the required information.
  • we process your contact details such as your address, location and email address, personal details such as your name, phone number and date of birth, payment and credit information and details of your correspondence with us.

Our Company also use Hotjar as an analytics product. By combining both analytics tools and visual heatmap representations, Hotjar helps us understand how to improve your user experience. Heatmap’s tracking codes automatically collect and store information based on your activity on our site. This information includes: mouse and touch activity (but no keyboard activity); screen activity (areas of our website or application that you clicked); use of scroll bar; wrong clicks (clicks on items that are not buttons). To review Hotjar’s privacy policy, go to https://www.hotjar.com/legal/policies/privacy/.

D. For the conclusion and execution of agreement

When you have purchased a product or service from us as a customer, or when you work together with us as a supplier or business partner, we process your personal data for administrative purposes such as sending invoices and making payments. We also use your personal data in order to deliver or receive and administer our or your products or services. Our Company will process your personal data in order to further execute our agreement, including for the delivery of customer services. When you require access to Our Company’s premises, we process your personal data for screening purposes.

For this purpose

  • we process personal data based on your consent because this is necessary for the conclusion of a contract between you and us. Our Company cannot enter into contracts without obtaining the required information.
  • we process your contact details such as your address, location and email address, personal details such as your name, phone number and date of birth, payment and credit information and details of your correspondence with us.

E. For relationship management and marketing

We use the information stored in our customer database to send you suitable offers and newsletters, as well as to provide customer services, perform account management and communicate recalls. We also use your personal data for the development, execution and analysis of market surveys and marketing strategies.

For this purpose

  • when sending you newsletters and/or other relationship management and marketing communications, we process personal data based on your consent.In addition, we process personal data based on our legitimate interest to improve our marketing strategies.
  • we process your contact details such as your address, location and email address, personal details such as your name, phone number and date of birth, payment and credit information and details of your correspondence with us.

F. For business process execution and internal management

We process your personal data in the performance and organisation of our business. This includes general management, order management and management of our assets. Our Company also processes your personal data for its internal management. We provide central processing facilities in order to work more efficiently. We conduct audits and investigations, implement business controls, and manage and use customer, supplier and business partner directories. Also, we process your personal data for finance and accounting, archiving and insurance purposes, legal and business consulting and in the context of dispute resolution.

For this purpose

  • we process personal data based on your consent in light of our legitimate interest to maintain and improve sound business operations.
  • we process your contact details such as your address and email address, personal details such as your name, payment and credit information, payment and order history, correspondence with Our Company and data generated during the performance of the agreement between you and Our Company.

G. For organizational analysis and development, management reporting and acquisition and divestitures

At Our Company, we process your personal data in the preparation and performance of management reporting and analysis. We use aggregated/anonymised personal data to create management reports and to analyse our business. We conduct customer, supplier and business partner surveys to learn more about your views and opinions in preparation of our management reporting. We also process your personal data for management reporting purposes in the context of mergers, acquisitions and divestitures and in order to manage such transactions.

For this purpose

  • we process personal data based on your consent in light of our legitimate interest to maintain and improve sound business operations.
  • we process your contact details such as address and email address, personal details such as your name and date of birth, payment and order history, correspondence with us and the information you provide when responding to our surveys or phone calls.

H. When you use our website or application

If you use our website, we process technical data to offer you our website functionalities and to allow our website's administrators to manage and improve our website's performance as well as secure our Website and underlying IT-systems and network. If you enter data in our website, such as a product preference or your location to receive relevant information or functionalities, Our Company processes this data to provide you with the requested information or functionalities. Further, we process your personal data to allow you to save your data (such as preferences and products) to your saved items and to allow you to share these with others using the sharing options you have configured on your device. We also register if we have obtained any consents from you for our compliance with laws.

For this purpose

  • we process personal data based on your consent in light of our legitimate interest to offer technically adequately working website and to improve our website's performance.
  • we process the personal data you have entered into our website or that is generated by the functionalities you have used in our website and the technical data from your device such as its IP address, the internet browser you use, the pages you have visited on our website, your click- and surf behaviour and the length of your session.

I. Interaction via social media

Our Company is active on social media platforms like Facebook, Twitter, LinkedIn and YouTube. When you contact Our Company via social media, we process your personal data in order to answer your questions and to respond to your messages. In addition, when you visit a 'Connect with us' screen on one of our website or application, you can contact us through a variety of communication channels. We provide you with our email address, for you to send us your feedback and suggested improvements, as well as our website, trade website, Twitter, Facebook and YouTube] details. When you click one of the corresponding icons we will refer you to the website or app of the applicable third party, whether this is your email provider or a social media platform.

In addition, when you visit a 'Connect with us' screen on one of our Websites or Apps, you can contact us through a variety of communication channels. We provide you with our email address, for you to send us your feedback and suggested improvements, as well as our Website, trade website, Twitter, Facebook and YouTube details. When you click one of the corresponding icons we will refer you to the website or app of the applicable third party, whether this is your email provider or a social media platform. When you click on a Facebook ‘Like’ button, your personal data will be processed by Our Company and Facebook jointly.

For this purpose

  • we process personal data based on your consent in light of our legitimate interest to adequately respond to your questions and correctly refer you to our social media pages.
  • we process the communication channel you have chosen to use to connect with us and the personal data you supply to Our Company. This includes your (user) name, address, email address and the personal data you have included in your message. In addition, when you click one of the buttons displayed, the relevant third party might place cookies on your device.

We also use social media to display advertisements. This is either based on the information the social media platform has collected from you or the information our Company has collected from you, such as when you subscribe to our newsletters (see above).

  • In case the social media platform has collected the information, Our Company does not get access to that information. As a result, we have no say in how the platform stores and uses the information. We recommend reading the conditions and privacy statements of your social media provider. They also often provide you with account settings or some other means to change your privacy settings.
  • In case we share your personal information, like your email address or phone number, the social media platform uses your information to include or exclude you from seeing a particular advertisement. Your information will be encrypted (hashed) when transferred to the social media platform. If you do not have a profile on a particular platform, that platform will not be able to decrypt the information and find out who you are.

We may also communicate with you on social media or via communications apps such as WhatsApp if you are connected to us, if you use social media or a communication app or if you post a photo or video linked to Our Company or our products.

You can opt out at any time from sharing your information with social media platforms for advertising by sending an email to [email protected]

J. To monitor and investigate compliance

We monitor our processes to check compliance with our policies and regulations. During monitoring activities, your personal data may be accessed and viewed.

For this purpose

  • we may process your personal data based on your consent and our legitimate interest to monitor our internal processes and in order to comply with the law.
  • any personal data that is stored in our systems may be accessed and viewed for compliance purposes. The personal data that are accessed and viewed will not be stored for compliance purposes, unless we need them to further investigate potential non-compliant behaviour.
  • we do not retain your personal data for this purpose, unless they are linked to non-compliant behaviour. We will then retain the relevant personal data until the investigation or proceedings have been concluded.

K. To protect health, safety, security and to ensure integrity

At Our Company, we value your health, safety, security and integrity highly. We process your personal data in order to safeguard our employees, customers, suppliers and business partners. As such, we authenticate your access rights to our premises and may screen your personal data against publicly available government and/or law enforcement agency sanctions lists. We also process your personal data to protect Our Company and employee and customer assets.

For this purpose

  • we may process your personal data based on your consent in light of our legitimate interest to monitor our internal processes and in order to comply with the law.
  • we process your contact details such as your address and email address, personal details such as your name and date of birth, payment and order history, and your visiting history to our premises.

L. To comply with the law

In some cases, we process your personal data to comply with laws and regulations. This could, for example, be the case where tax or business conduct related obligations apply. In order to comply with relevant laws and regulations, we may need to disclose your personal data to government institutions or supervisory authorities without specific further notice to you.

For this purpose

  • we process your personal data in order to comply with the law.
  • we process your contact details such as your address and email address, personal details such as your name and date of birth, payment information, payment and order history, and your chamber of commerce and VAT details and tax details.

M. When you participate in events or promotions

We send you emails with promotions and invitations to participate in events. If you choose to participate in one of these activities, we need your personal data to be able to announce and organise these. In addition, if you participate in any of these activities, we need your personal data to measure the response to events and/or promotions.

For this purpose

  • we process personal data based on your consent. You can withdraw your consent at any time, without this affecting the lawfulness of processing based on consent before withdrawal.
  • we process your name, address, email address and your entries in the relevant event.

3. HOW LONG DO WE RETAIN YOUR PERSONAL DATA?

Our Company generally shall retain Business Partner Data only for the period required to serve the applicable Business Purpose, to the extent reasonably necessary to comply with an applicable legal requirement or as advisable in light of an applicable statute of limitations.

Promptly after the applicable storage period has ended, the Data shall be:

(i) securely deleted or destroyed;

(ii) anonymized;

4. WHO HAS ACCESS TO YOUR PERSONAL DATA?

Access to your personal data within Our Company

As a global organisation, data we collect may be transferred internationally throughout Our Company’s worldwide organisation. Your personal data may be exchanged with the group that Our Company belongs to (controlling or controlled companies, or companies under common control), shareholders and associated companies, following the group’s internal policies. We exchange your data for administrative purposes and so that we can have a complete overview of your contacts and contracts with the group that Our Company belongs to. We may also exchange your data in order to offer you a complete package of services and products, in compliance with the applicable laws.

Our Company’s employees are authorised to access personal data only to the extent necessary to serve the applicable purpose and to perform their jobs.

In some cases, your personal data may be transferred to a country that does not provide an adequate level of protection of personal data. However, Our Company has taken measures to ensure that your personal data is adequately protected as Binding Corporate Rules are applicable throughout the group that Our Company belongs to.

Access to your personal data by third parties

The following third parties may have access to your personal data where relevant for the provisioning of their products or services to Our Company: banks, insurance companies, IT suppliers, accountants, forensic specialists, consultants, lawyers.

When third parties are given access to your personal data, Our Company will take the required contractual, technical and organisational measures to ensure that your personal data are only processed to the extent that such processing is necessary. The third parties will only process your personal data in accordance with applicable law.

If personal data is transferred to a third party in a country that does not provide an adequate level of protection of personal data, we will take measures to ensure that your personal data is adequately protected, such as entering into EU Standard Contractual Clauses with these recipients.

In other cases, your personal data will not be supplied to third parties, except when required by law.

5. HOW ARE YOUR PERSONAL DATA SECURED

We have taken adequate safeguards to ensure the confidentiality and security of your personal data. We have implemented appropriate technical, physical and organisational measures to protect personal data against accidental or unlawful destruction or accidental loss, damage, alteration, unauthorised disclosure or access, and against all other forms of unlawful processing (including, but not limited to unnecessary collection) or further processing.

6. HOW CAN YOU EXERCISE YOUR PRIVACY RIGHTS?

You have the right to request access or an overview of your personal data, and under certain conditions, rectification and/or erasure of personal data. In addition, you may also have the right of restriction of processing concerning your personal data, the right to object to processing as well as the right to data portability. To invoke your privacy rights, please contact us by using the contact details at the bottom of this Privacy Statement. Keep in mind that we may ask for additional information to verify your identity.

7. CAN YOU WITHDRAW YOUR CONSENT?

Once given, you may always withdraw your consent. Please keep in mind that withdrawal does not have retrospective effect. Please refer to the terms of service section within the application. You can choose to revoke your consent and erase all your personal data that we process at any time through our application, on the tabs support>refuse terms of service>yes. You can also ask for your data erasure by sending an email to [email protected], stating the e-mail and phone number that you registered with us and that you no longer wish Our Company to process your personal data. If you withdraw consent and end your relationship with Our Company, we will take the steps described in Section 3 to delete or anonymize your data. In this case it will be no longer possible for you to make use of our services.

8. HOW TO FILE A COMPLAINT?

If you have a complaint about the use of your personal data by Our Company, you can file a complaint via the contact details at the bottom of this statement. Besides filing a complaint with Our Company, you are also able to file a complaint with your local data protection supervisory authority.

9. HOW CAN YOU CONTACT US?

If you have any questions about the way we process your personal data, please read this statement first. For additional questions, remarks, compliments or complaints, please contact the Chama privacy officer: [email protected]



PRIVACY STATEMENT FOR APPLICANT DATA

Last updated: January 10, 2020

1. INTRODUCTION

This Privacy Statement is applicable to the processing by Chama Technologies B.V and Chama Tecnologia Brasil Ltda, based at Egelantiersgracht 390, 1015 RR, Amsterdam, The Netherlands and R. Joaquim Floriano, 940,1oandar, CEP 04534,Itaim Bibi, São Paulo,SP, Brazilrespectively(hereafter referred to as “Our Company”, we or us) of all personal data of individuals in the field of recruitment (“Applicants”)

Our Companyisthe controller for the processing of Applicant’s personal data. In this statement we describe who we are, how and for which purposes we process your personal data and all other information that may be relevant to you. In case you have any additional questions you can contact us via the contact details provided at the bottom of this statement.

This Privacy Statement applies since 01/05/2018. The last modifications were made on 10/01/2020. This statement may change over time and the most up-to-date versionis published on our website.If significant changes are being made during your application, we will actively inform you.

2. FOR WHICH PURPOSES DO WE PROCESS YOUR PERSONAL DATA?

We collect and process personal data of Applicants for the purposes of the recruitment and selection procedure and to ensure its efficient and effective functioning:

A. To communicate with you regarding your employment or job application

If you have shown interest in a position within Our Company, we store your personal data in our relevant recruitment systems. We use the data in ou systems to communicate with you and to determine whether your qualifications and profile meet the requirements of aspecific vacancy.

For this purpose

  • we process your personal data on the basis of your consent when you provide us with your personal data
  • we process your contact details, recruitment information (such as your resume, employment history, education history, etc.) and correspondence with us with regard to job applications (including references)

B. To answer your questions

If you get in touch with us, we will use your personal data in order to reply and answer your question(s).

For this purpose

  • we process your personal data on the basis of your consent
  • we process your name, contact details, your correspondence with us with regard to your question and all other personal data, which are necessary to answer your question(s)

C. To assess and evaluate you during the recruitment procedure

During the recruitment procedure, screening (for example in the form of a skills assessment) may be part of the procedure.

For this purpose

  • we process your personal data on the basis of your consent, in light of our legitimate interest. It is in our interest to select applicants which qualifications and profile meets the requirements of a specific vacancy with Our Company, and it is in your interest to participate in the application process.
  • we process your name, contact details, assessment scores, interview case assessment, minutes of the assessment meeting, availability.

D. To enter into an employment contract with you

If we offer you a position at Our Company, we will process your personal data to prepare and process an employment agreement. We will then also store your personal data in our HR systems.

For this purpose

  • we process your personal data because it is necessary for entering into an employment contract with you.
  • we process your contact details, date of birth, gender, civil status, nationality, citizen service number, ID card or passport details, declaration of employment status, chamber of commerce and VAT details, recruitment information (such as employment history, education history details), job and position data, work permit details, availability, terms of employment, tax details, payment details, insurance details and location and organizations

E. Social networks, such as LinkedIn, and other publicly available websites

We may collect your personal data from public profiles on LinkedIn or other social networks and other publicly available websites only if you reacted to Our Company recruitment initiatives on such social networks and websites, or signed up via integrated functionality of such social networks, recruitment websites or our own websites. We also may collect your personal data from such sources when you provided a link to your profile on any such site as part of your job application or curriculum vitae submitted with your job application.

We may also obtain your contact details from publicly available sources, including content that you have made public on LinkedIn or other social network sites or similar sites for professional purposes to make an initial contact with you for recruitment purposes. We will contact you if you have made your contact details available to Our Company to contact you for recruitment purposes and will provide you with clear option to ask us stop contacting you for career opportunities and remove your personal data from our systems.

For this purpose

We may also communicate with you on social media or via communications apps such as WhatsApp if you are connected to us, if you use social media or a communication app or if you post a photo or video linked to Our Company or our products.

  • we process your personal data based on your consent, in light of our legitimate interest and we process your personal data to find suitable candidates for vacancies at Our Company
  • we process the personal data you have made public through your public profiles on LinkedIn or other social networks and any correspondence between you and our recruiters. This includes your name, contact details if made available, current and past job titles, employment history, educational information, skills, recommendations, and curriculum vitae if you made it available

We will not seek to collect personal data known as sensitive data which related to racial or ethnic origin, political opinions, religious or other similar beliefs, trade union membership, physical or mental health or sexual life.

F. To inform you and communicate with you about other vacancies

Sometimes, we just do not have the right role available foryou yet. If you choose and give us consent, we will keep information about you in our systems and contact you if we have a new vacancy that may be of interest to you. We may also invite you for recruitment activities or communicate with you about job opportunities.

For this purpose

  • we will process your personal data based on your consent when you choose to keep your information in our systems
  • we process your contact details (such as your address and email address), the information you submitted to us in the course of previous job applications (for example, your resume) and a summary of how you performed during previous job applications with us

G. To comply with the law

In some cases, Our Company processes your personal data to comply with the laws and regulations in the country where you applied. For example,human resources related obligations,employment laws, anti-discrimination laws or regulations related to subsidies. Following laws and regulations, we may need to disclose your personal data to government institutions or supervisory authorities.

For this purpose

  • we process your personal data to comply with the law and we will only process your personal data if there is a legal obligation for us to do so
  • we process your name, address, contact details (phone, email), ID number, CPF number, work history (CV), social security number, bank account details

H. To protect health, safety, security and to ensure integrity

At Our Company, we value your health, safety, security and integrity highly. When you visit us, we process your personal data in order to safeguard our employees, customers, suppliers and business partners. As such, we authenticate your access rights to our premises. We also process your personal data to protect Our Company and employee and customer assets. More specifically, we protect our premises by using fingerprint registry when you enterin our property.

For this purpose

  • we may process your personal data based on our legitimate interest to monitor our internal processes and the protection of society and our habitat as well as our property and in order to comply with the law (transport, environmental and health and safety laws and regulations)
  • we process your contact details, relevant personnel file details, insurance details, location and organizations and the relevant health data that you provided to usand fingerprint data.

3. HOW LONG DO WE RETAIN YOUR PERSONAL DATA?

Our Company generally shall retain Applicant Data only for the period required to serve the applicable Business Purposeas described above, to the extent reasonably necessary to comply with an applicable legal requirement or as advisable in light of an applicable statute of limitations.

Promptly after the applicable storage period has ended, the Data shall be:

(i) securely deleted or destroyed;

(ii) anonymized;

4. WHO HAS ACCESS TO YOUR PERSONAL DATA?

Access to your personal data within Our Company

The employees involved in the relevant recruitment procedure may have access to your personal data, be it only to the extent necessary to fulfil their respective tasks. These employees are for example our recruiters, HR employees and the relevant manager.

Your personal data may be accessed by other relevant departments within Our Company such as IT, Legal and Compliance,to the extent necessary to fulfil their respective tasks.

In some cases, your personal data maybe transferred to a country that does not provide an adequate level of protection of personal data. However, Our Company has taken measures to ensure that your personal data is adequately protected as Binding Corporate Rules are applicable throughout the group that Our Company belongs to.

Access to your personal data by third parties

The following third parties may have access to your personal data where relevant for the provisioning of their products or services to Our Company: Recruitment Agencies, Assessment Centres. IT Suppliers, Payrolling service providers.

When third parties are given access to your personal data, Our Company will take the required contractual, technical and organisational measures to ensure that your personal data are only processed to the extent that such processing is necessary. The third parties will only process your personal data in accordance with applicable law and under the terms of this Privacy Statement.

If personal data is transferred to a third party in a country that does not provide an adequate level of protection of personal data, we will take measures to ensure that your personal data is adequately protected, such as entering into EU Standard Contractual Clauses with these recipients.

In other cases, your personal data will not be supplied to third parties, except when required by law.

5. HOW ARE YOUR PERSONAL DATA SECURED

We have taken adequate safeguards to ensure the confidentiality and security of your personal data. We have implemented appropriate technical, physical and organisational measures to protect personal data against accidental or unlawful destruction or accidental loss, damage, alteration, unauthorised disclosure or access, and against all other forms of unlawful processing (including, but not limited to unnecessary collection) or further processing.

6. HOW CAN YOU EXERCISE YOUR PRIVACY RIGHTS?

You have the right to request access to ran overview of your personal data, and under certain conditions, rectification and/or erasure of personal data. In addition, you may also have the right of restriction of processing concerning your personal data, the right to object to processing as well as the right to data portability.

To invoke your privacy rights,please contact us by using the contact details at the bottom of this Privacy Statement. Keep in mind that we may ask for additional information to verify your identity.

7. CAN YOU WITHDRAW YOUR CONSENT?

Once given, you may always withdraw your consent. Please keep in mind that withdrawal does not have retrospective effect. Please contact us to withdraw your consent by using the contact details at the bottom of this Privacy Statement. If you withdraw consent and end your relationship with Our Company, we will take the steps described in Section 3 do delete or anonymize your data.

8. HOW TO LODGE A COMPLAINT?

If you have a complaint about the use of your personal data by Our Company, you can lodge a complaint via the contact details at the bottom of this statement. Besides lodging a complaint with Our Company, you are also able to lodge a complaint with your local data protection supervisory authority.

9. HOW CAN YOU CONTACT US?

If you have any questions about the way we process your personal data, please read this statement first. For additional questions, remarks,compliments or complaints, please contact Chama’s privacy officer at [email protected]