Privacy Policy

INOVAWAY ("we", "our" or "company"), a legal entity registered and operating in Brazil, with digital presence at inovaway.org, is committed to protecting the privacy and personal data of its users, customers and visitors.

This Privacy Policy describes how we collect, use, store, share and protect your personal information, in accordance with the General Data Protection Law (LGPD — Law No. 13.709/2018) and other applicable legislation.

By using our services, you agree to the practices described in this Policy. We recommend reading it in full before providing any personal data.

We collect personal data in the following situations:

2.1 Data provided directly by you: - Full name and identification data - Email address - Phone number / WhatsApp - Company name and business segment - Messages and content sent via contact forms

2.2 Data collected automatically: - IP address and approximate geolocation data - Browser type and version and operating system - Pages visited, time spent and access origin - Cookie data and similar technologies (see Section 7)

2.3 Data from contracted services usage: - Interaction history with our platforms (UpBro, HNBCRM, GMBAssist) - Automation and integration configuration data - Access and activity logs in tools

We do not collect sensitive data (health, racial origin, religious conviction, biometric data, etc.) without explicit consent and legal justification.

We process your personal data for the following purposes:

3.1 Contract execution: - Provide contracted services (websites, automations, marketing, consulting) - Maintain and improve platforms and tools - Process payments and issue invoices

3.2 Communication and support: - Respond to requests, questions and messages - Send updates about ongoing projects - Notify about changes to services or this Policy

3.3 Marketing (with consent): - Send newsletters and informational materials - Present news, success stories and relevant offers - You can cancel this consent at any time

3.4 Legitimate interest and security: - Prevent fraud and ensure platform security - Comply with legal and regulatory obligations - Improve user experience based on aggregated analysis

We process your data based on the following legal hypotheses provided in Art. 7 of the LGPD:

- Consent (Art. 7, I): for sending marketing communications - Contract execution (Art. 7, V): for providing contracted services - Legitimate interest (Art. 7, IX): for service improvement and security - Compliance with legal obligation (Art. 7, II): to meet tax, accounting and regulatory requirements

When processing is based on consent, you may revoke it at any time without prejudice to processing carried out previously.

Your personal data may be shared with:

5.1 Technology partners and suppliers: - Cloud hosting and infrastructure platforms - Analytics and performance monitoring tools - Marketing automation and CRM systems - Payment processors

These partners process data strictly according to our instructions and are contractually obligated to maintain confidentiality.

5.2 Authorities and legal obligations: We may share data with governmental, judicial or regulatory authorities when required by law, court order or for defense of INOVAWAY's legal rights.

We do not sell, rent or commercialize personal data of customers and users to third parties. Never.

Your data is stored on secure servers, preferably located in Brazil or in countries that guarantee adequate level of protection as per LGPD.

Retention periods: - Active customer data: during entire contract term + 5 years (tax/legal obligation) - Lead and contact data: up to 2 years after last contact or until consent revocation - Access logs: 6 months (per Internet Civil Framework — Law 12.965/2014) - Marketing communication data: until consent revocation

After the retention period, data is securely deleted or anonymized.

We use cookies and similar technologies for:

7.1 Essential cookies (necessary): Ensure basic website functionality. Cannot be disabled.

7.2 Performance and analytics cookies: We collect data about how the site is used (pages visited, session time, origin) to improve experience. We use tools like Google Analytics.

7.3 Marketing cookies (optional): Used to personalize ads and measure campaign effectiveness. Only activated with your consent.

Cookie management: You can configure your browser to block or delete cookies. Note that disabling some cookies may affect site functionality.

For more information about specific cookies used, contact our DPO (Section 9).

Per LGPD (Arts. 17 to 22), you have the following rights:

- Confirmation: know if we process your data - Access: obtain a copy of data we have about you - Correction: request correction of incomplete, inaccurate or outdated data - Anonymization / Blocking / Deletion: of unnecessary data or processed non-compliantly - Portability: receive your data in structured format for transfer to another provider - Deletion: request deletion of data processed based on consent - Information: know with whom we share your data - Consent revocation: cancel processing authorization at any time - Opposition: oppose processing carried out based on legitimate interest

How to exercise your rights: Send your request to contato@inovaway.org with subject "LGPD — [Requested Right]". We will respond within 15 business days, as established by LGPD.

INOVAWAY has designated a Data Protection Officer (DPO), responsible for:

- Being the communication channel between data subjects, the company and ANPD - Guiding employees on data protection practices - Receiving and responding to complaints and requests from data subjects

DPO Contact: Email: contato@inovaway.org Subject: "DPO / Data Privacy"

ANPD (National Data Protection Authority) can be contacted at: www.gov.br/anpd

We adopt adequate technical and organizational measures to protect your personal data against unauthorized access, loss, alteration, disclosure or destruction, including:

- Data encryption in transit (HTTPS/TLS) - Role-based access control (RBAC) - Continuous security monitoring - Regular backups and redundancy - Periodic security reviews

In case of a security incident that may affect your data, we will notify affected data subjects and ANPD within legal timeframes.

This Policy may be updated periodically to reflect changes in our services, practices or legal requirements.

When there are relevant changes, we will notify by email (if we have your contact) or by prominent notice on the site. The date of the last update will always be indicated at the bottom of this page.

We recommend reviewing this Policy periodically.

This Policy is governed by the laws of the Federative Republic of Brazil, especially the LGPD (Law No. 13.709/2018) and the Consumer Protection Code (Law No. 8.078/1990).

To resolve any disputes, the jurisdiction of the data subject's domicile district is elected, pursuant to Art. 22 of the LGPD.