EXAL PRIVACY POLICY AND CLARIFICATION STATEMENT

CLARIFICATION STATEMENT | Law No. 13,709/2018, the Brazilian General Data Protection Law (LGPD)

EXAL protects the confidentiality of personal data and sensitive data entrusted to it by the data subject.

To this end, it has been implementing technical and administrative security measures capable of protecting personal data against unauthorized access, accidental situations, or any form of improper processing, as required for compliance with the General Data Protection Law (Law No. 13,709/2018).

Good practices and governance rules ensure that the processing of personal and sensitive data is lawful, fair, transparent, and limited to the authorized purposes for which it is intended.

The collection of personal and sensitive data for processing is carried out by EXAL based on measures necessary to ensure accuracy, integrity, confidentiality, and anonymization, as well as to guarantee respect for freedom, privacy, inviolability of privacy, image rights, and all rights of data subjects, including the right to request access to, correction of, and deletion of personal and sensitive data stored in EXAL’s databases and digital systems.

EXAL PRIVACY POLICY

EXAL ADM. DE RESTAURANTES EMPRESARIAIS E FACILITIES LTDA.

1. General Information

This Privacy Policy contains information regarding the manner in which we process, either partially or entirely, automatically or otherwise, the personal data of users who access our website. Its purpose is to inform interested parties about the types of data collected, the reasons for such collection, and how users may update, manage, or delete this information.

This Privacy Policy was prepared in accordance with Federal Law No. 12,965 of April 23, 2014 (Brazilian Civil Rights Framework for the Internet), and Federal Law No. 13,709 of August 14, 2018 (Personal Data Protection Law), sanctioned on September 18, 2020.

This Privacy Policy may be updated as a result of regulatory changes. Users are therefore encouraged to consult this section periodically.

2. User Rights

The website undertakes to comply with the rules established by the LGPD, in accordance with the following principles:

  • The user’s personal data shall be processed lawfully, fairly, and transparently (lawfulness, fairness, and transparency);
  • The user’s personal data shall be collected only for specific, explicit, and legitimate purposes and shall not subsequently be processed in a manner incompatible with those purposes (purpose limitation);
  • The user’s personal data shall be collected in an adequate, relevant, and limited manner according to the needs of the purposes for which they are processed (data minimization);
  • The user’s personal data shall be accurate and kept up to date whenever necessary, so that inaccurate data may be erased or corrected whenever possible (accuracy);
  • The user’s personal data shall be retained in a manner that allows identification of the data subjects only for as long as necessary for the purposes for which they are processed (storage limitation);
  • The user’s personal data shall be processed securely, protected against unauthorized or unlawful processing and against accidental loss, destruction, or damage, through appropriate technical or organizational measures (integrity and confidentiality).

The website user has the following rights, granted under the Personal Data Protection Law and the LGPD:

  • Right to confirmation and access: the user’s right to obtain confirmation from the website as to whether or not personal data concerning them are being processed and, where applicable, to access such personal data;
  • Right to rectification: the user’s right to obtain, without undue delay, the rectification of inaccurate personal data concerning them;
  • Right to erasure of data (right to be forgotten): the user’s right to have their data deleted from the website;
  • Right to restriction of data processing: the user’s right to restrict the processing of their personal data, which may be exercised when the accuracy of the data is contested, when processing is unlawful, when the website no longer needs the data for the proposed purposes, when the user has objected to processing, or in cases involving unnecessary data;
  • Right to object: the user’s right, at any time and for reasons relating to their particular situation, to object to the processing of their personal data, including the right to object to the use of their data for marketing profiling;
  • Right to data portability: the user’s right to receive personal data concerning them that they have provided to the website in a structured, commonly used, and machine-readable format, as well as the right to transmit such data to another website;
  • Right not to be subject to automated decision-making: the user’s right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

The user may exercise their rights by sending a written communication to the website with the subject line “LGPD – www.hon.com.br”, specifying:

  • Full name or corporate name, CPF (Individual Taxpayer Registration) number or CNPJ (National Register of Legal Entities) number issued by the Brazilian Federal Revenue Service, and the user’s email address and, where applicable, that of their representative;
  • The right they wish to exercise with the website;
  • Date of the request and the user’s signature;
  • Any document that may demonstrate or justify the exercise of the relevant right.

The request must be sent by email to dpo@exal.com.br, or by mail to:

Osmar Ramos
Av. Batel, 1920 – Batel – Curitiba – PR – ZIP Code 80.420-090

The user shall be informed in the event of rectification or deletion of their data.

3. Duty Not to Provide Third-Party Data

When using the website, in order to safeguard and protect the rights of third parties, the website user shall provide only their own personal data and not the personal data of third parties.

4. Information Collected

The collection of user data shall comply with this Privacy Policy and shall depend on the user’s consent, which shall only be waived in the circumstances provided for in Article 11, item II, of the Personal Data Protection Law.

4.1. Types of Data Collected

4.1.1. Data Provided Through the Contact Form

Any data provided by users who use the contact form available on the website, including the content of the message submitted, shall be collected and stored.

4.1.2. Sensitive Data

Sensitive data of users shall not be collected, as defined in Articles 9 and 10 of the LGPD and Articles 11 and subsequent provisions of the Personal Data Protection Law. Accordingly, among others, the following data shall not be collected:

  • Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership;
  • Genetic data;
  • Biometric data used to unequivocally identify an individual;
  • Data concerning the user’s health;
  • Data concerning sexual life or sexual orientation;
  • Data relating to criminal convictions, offenses, or related security measures.
4.1.3. Collection of Data Not Expressly Provided For

Other types of data not expressly provided for in this Privacy Policy may occasionally be collected, provided that they are supplied with the user’s consent or that such collection is permitted or required by law.

4.2. Legal Basis for the Processing of Personal Data

By using the website’s services, the user consents to this Privacy Policy.

The user has the right to withdraw their consent at any time, without affecting the lawfulness of the processing of their personal data carried out before the withdrawal. Consent may be withdrawn by email to dpo@exal.com.br, or by mail sent to:

Av. Batel, 1920 – Batel – Curitiba – PR – ZIP Code 80.420-090

Consent from relatively or absolutely incapacitated persons, particularly children under 16 (sixteen) years of age, may only be given when they are duly assisted or represented.

The processing of personal data without the user’s consent shall only take place on the basis of legitimate interest or under the circumstances provided for by law, including, among others, the following:

  • To comply with a legal or regulatory obligation imposed on the data controller;
  • For studies conducted by a research body, with anonymization of personal data whenever possible;
  • When necessary for the performance of a contract or preliminary procedures relating to a contract to which the user is a party, at the request of the data subject;
  • For the regular exercise of rights in judicial, administrative, or arbitration proceedings, the latter pursuant to Law No. 9,307 of September 23, 1996 (Arbitration Law);
  • For the protection of the life or physical safety of the data subject or third parties;
  • For the protection of health, in procedures carried out by healthcare professionals or health authorities;
  • When necessary to meet the legitimate interests of the data controller or third parties, except where the fundamental rights and freedoms of the data subject requiring protection of personal data prevail;
  • For credit protection, including matters governed by applicable legislation.

4.3. Purposes of Personal Data Processing

The personal data collected by the website are intended to facilitate, expedite, and fulfill commitments established with the user and to process requests submitted through forms.

Personal data may also be used for commercial purposes, to personalize the content offered to users, and to assist the website in improving the quality and operation of its services. The processing of personal data for purposes not provided for in this Privacy Policy shall only occur after prior notification to the user. In all cases, the rights and obligations established herein shall remain applicable.

4.4. Retention Period for Personal Data

The user’s personal data shall be retained for no longer than necessary to fulfill the purposes for which they are processed.

The retention period for data shall be determined according to the following criteria: data shall be stored for the time necessary to provide the services displayed on the Website.

Personal data may only be retained after the end of their processing in the following circumstances:

  • To comply with a legal or regulatory obligation imposed on the data controller;
  • For research by a research body, with anonymization of personal data whenever possible;
  • For transfer to a third party, provided that the data-processing requirements established by applicable legislation are observed;
  • For the exclusive use of the data controller, with access by third parties prohibited, provided that the data are anonymized.

4.5. Recipients and Transfer of Personal Data

EXAL does not transfer any type of Data.

5. Processing of Personal Data

5.1. Data Controller

The data controller responsible for processing the user’s personal data is the individual or legal entity, public authority, agency, or other body that, individually or jointly with others, determines the purposes and means of processing personal data.

On this website, the person responsible for processing the personal data collected is Osmar Ramos, who may be contacted by email at dpo@exal.com.br or in person at:

Av. Batel, 1920 – Batel – Curitiba – PR – ZIP Code 80.420-090

5.2. Data Protection Officer (DPO)

The Data Protection Officer is the professional responsible for informing, advising, and monitoring the data controller, as well as employees who process data, regarding the website’s obligations under the GDPR, the Personal Data Protection Law, and other data protection provisions established by national and international legislation, in cooperation with the competent supervisory authority.

6. Security in the Processing of User Personal Data

The website undertakes to implement technical and organizational measures capable of protecting personal data against unauthorized access and against destruction, loss, alteration, communication, or dissemination of such data.

To ensure security, solutions shall be adopted that take into consideration appropriate techniques, implementation costs, the nature, scope, context, and purposes of the processing, and the risks to the user’s rights and freedoms.

However, the website shall not be held liable for the exclusive fault of third parties, such as in the event of attacks by hackers or crackers, or for the exclusive fault of the user, such as when the user themselves transfers their data to a third party. The website further undertakes to notify the user within an appropriate period if a security breach occurs that may pose a high risk to their personal rights and freedoms.

A personal data breach is a security breach that causes, whether accidentally or unlawfully, the destruction, loss, alteration, disclosure, or unauthorized access to personal data transmitted, stored, or otherwise processed.

Finally, the website undertakes to process the user’s personal data confidentially, within the limits established by law.

7. Browsing Data (Cookies)

Cookies are small text files sent by the website to the user’s computer and stored there, containing information related to the user’s browsing activity.

Through cookies, small amounts of information are stored by the user’s browser so that our server may read them later. For example, information about the device used by the user, as well as the user’s location and time of access to the website, may be stored.

Cookies do not allow any file or information to be extracted from the user’s hard drive, nor is it possible to use them to access personal information that was not provided by the user or information concerning how the user uses the website’s resources.

It is important to note that not every cookie contains information that allows the user to be identified. Certain types of cookies may simply be used to ensure that the website loads correctly or that its functionalities operate as expected.

Information stored in cookies that may identify a user shall be considered personal data. Therefore, all rules established in this Privacy Policy shall also apply to such information.

7.1. Website Cookies

Website cookies are those sent to the user’s computer or device exclusively by the website and its administrator.

The EXAL Website does not collect information or data through cookies; cookies are used only to improve and personalize the user’s experience. Some cookies may, for example, be used to remember user preferences and choices, as well as to provide personalized content.

7.2. Social Media Cookies

The website uses social media plugins that allow users to access social networks from the website. Accordingly, the cookies used by those networks may be stored in the user’s browser.

Each social network has its own privacy and personal data protection policy, and the individuals or legal entities that operate those networks are responsible for the data they collect and the privacy practices they adopt.

Users may consult the social networks for information regarding how their personal data are processed. For informational purposes, the following links are provided, through which the privacy and cookie policies adopted by some of the principal social networks may be consulted:

  • Facebook: www.facebook.com/policies/cookies
  • Twitter: twitter.com/pt/privacy
  • Instagram: help.instagram.com
  • YouTube: policies.google.com/privacy
  • Google+: policies.google.com/technologies/cookies
  • Pinterest: policy.pinterest.com/pt-br/privacy-policy
  • LinkedIn: linkedin.com/legal/cookie-policy
7.3. Cookie Management and Browser Settings

The user may object to the registration of cookies by the website simply by disabling this option in their browser or device.

However, disabling cookies may affect the availability of certain tools and functionalities, compromising their proper and expected operation. Another possible consequence is the removal of user preferences that may have been saved, thereby negatively affecting the user’s experience.

The following links to help and support pages for commonly used browsers are provided for users who wish to obtain further information about cookie management:

  • Internet Explorer: support.microsoft.com/pt-br/help/17442/windows-internet-explorer-delete-manage-cookies
  • Safari: support.apple.com/pt-br/guide/safari/sfri11471/mac
  • Google Chrome: support.google.com/chrome/answer
  • Mozilla Firefox: support.mozilla.org/pt-BR/kb/ative-e-desative-os-cookies-que-os-sites-usam
  • Opera: www.opera.com/help/tutorials/security/privacy/

8. Complaints to a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, all data subjects have the right to file a complaint with a supervisory authority. The complaint may be submitted to the authority in the country where the website is headquartered, the user’s habitual residence, the user’s place of work, or the location where the alleged infringement was committed.

9. Amendments

The present version of this Privacy Policy was last updated on April 30, 2020.

The editor reserves the right to modify these website rules at any time, particularly to adapt them to developments involving the exal.com.br website, whether through the introduction of new functionalities or the removal or modification of existing ones.

The user shall be expressly notified in the event of changes to this policy.

By using the service after any modifications, the user demonstrates their agreement with the new rules. If the user disagrees with any of the modifications, they must immediately discontinue access to the website and, if they so wish, submit their objection to the customer service department.

10. Applicable Law and Jurisdiction

For the resolution of disputes arising from this instrument, Brazilian law shall apply in full. Any disputes shall be submitted to the court of the judicial district in which the data controller’s headquarters are located.