1. OBJECTIVE

D4Sign values the privacy of its users and has created this Privacy Policy to demonstrate its commitment to protecting your privacy and personal data, in accordance with the General Data Protection Law and other relevant laws, as well as to describe how your privacy is protected by D4Sign when collecting, processing, and storing your personal information.

The defined rights of use are owned by the company D4S Serviços em Tecnologia LTDA - ME, a private legal entity, registered under CNPJ/MF no. 23.691.353/0001-80, with headquarters at Av. Paulista, no. 1439, Bela Vista neighborhood, São Paulo/SP, CEP: 01311-200, hereinafter referred to by its trade name D4Sign, and includes the domains d4sign.com.br and doc4sign.com.br.

Accepting the Privacy Policy Acceptance Term implies full acceptance of all conditions described below:

2. DESCRIPTION

Free account - Free-of-charge account type, which will remain open indefinitely and may be canceled at the user's request: (I) allows the user to electronically sign any document sent to them; (II) enables users to send up to 05 (five) documents, which must occur within 30 (thirty) days from the account registration. Upon expiration of the 30 (thirty) days, the right to the 05 (five) sends is forfeited without prior notice.

Paid account - Paid account type, intended for sending and receiving documents to be electronically signed: (I) The number of document sends per month is defined by the service package contracted by the user; (II) The number of sends is non-cumulative, unused sends will not be added to the sending balance of the subsequent month; (III) When vaults are shared with other users, sends made by these users will be deducted from the balance of the user who shared the account; (IV) Documents will be encrypted and stored with security and privacy; (V) In the event of non-payment, the financial penalties set forth in the contract will be applied, including fines and default interest; (VI) Upon termination of the contract, the CONTRACTING PARTY will lose access to the platform and the stored documents. During the contract term, it is the exclusive responsibility of the CONTRACTING PARTY to download and back up their documents.

• I - The paid account generates recurring charges;
• II - Your subscription (billed account) may be canceled at any time by the CONTRACTING PARTY.

User: all natural persons who will use or visit the Website(s) and/or Application(s), aged 18 (eighteen) or older or emancipated and fully capable of performing acts of civil life, or those absolutely or relatively incapable duly represented or assisted.

Personal Data: means any information collected by D4Sign, by any means, even if public, that: (I) identifies, or that, when used in combination with other processed information, identifies an individual;

Purpose: objective, the purpose that D4Sign wishes to achieve from each act of processing personal information.

Necessity: justification for why it is strictly necessary to collect personal data to achieve the purpose, avoiding excessive collection.

Legal bases: legal basis that legitimizes the processing of personal data for a specific prior purpose by D4Sign.

Consent: express and unequivocal authorization given by the User, owner of the personal data, for D4Sign to process their personal data for a previously described purpose, in which the legal basis necessary for the act requires the express authorization of the data subject.

3. APPLICATION

This policy generally applies to all Users and potential Users of the services offered by D4Sign, including Users of websites or other means operated by D4Sign.

D4Sign may collect, produce, receive, classify, use, access, reproduce, transmit, distribute, process, archive, store, delete, evaluate or control information, modify, communicate, transfer, disseminate or extract collected data, including personally identifiable information, in accordance with applicable legal bases and all current privacy and data protection laws.

By accessing and/or using the D4Sign website, the User declares to be at least 18 (eighteen) years old and to have full and express capacity to accept the terms and conditions of this Privacy Policy and the Consent Term for all legal purposes.

If the User does not fit the description above and/or does not agree, even in part, with the terms and conditions contained in this Privacy Policy, they should not access and/or use the services offered by D4Sign, as well as the websites and services operated by it.

4. GUIDELINES

4.1 Laws and Regulations

D4Sign, headquartered in São Paulo, operates in compliance with data privacy regulatory requirements, the General Data Protection Law (LGPD) (Law no. 13.709/18) and Law no. 12.965/14 (Brazilian Civil Rights Framework for the Internet).

4.2 Data Policy

Any data provided to D4Sign, through our cloud platform or website, is considered privileged information. Your data will never be sold or shared with third parties.

All personal data processing is carried out in accordance with privacy rights and regulations (LGPD). According to LGPD, Brazilian citizens and residents have the following rights:

• Right to access your personal data;
• Right to correct personal data we hold about you;
• Right to request the deletion of your personal data;
• Right to transfer your personal data to you or to third parties;
• Withdraw consent for the processing of your Personal Data.

If you wish to exercise any of the rights described above, please contact us at dpo@d4sign.com.br.

4.3 Data Collection

The User is aware that they provide information consciously and voluntarily through registrations, or through websites operated by D4Sign.

When the User registers and/or fills out forms offered by D4Sign, including on its operated websites, the requested data will be kept confidential and will be used only for the purpose that motivated the registration.

In order to ensure the security of the digital signature, the accuracy of the data provided during registration may be verified with the Federal Revenue Service. In the event of incorrect or false data, the system will display a message on the user's screen stating that the data is incorrect, making it impossible to proceed with the registration.

The user is responsible for correcting the information and acknowledges that no compensation or reimbursement of any kind will be granted in the event of incomplete or incorrect information.

Our prevailing policy is to collect the minimum possible information from the user, in order to ensure greater privacy and anonymization in the use of our services.

D4Sign's data collection is limited to the following activities:

• Account creation: Requested registration information such as name, email, CPF (tax ID), and date of birth.
• Account activity: Access date and time, IP address and device used, in addition to records of system operations such as queries, registrations, and edits are stored in internal logs.
• Document signature: User authentication will be carried out by email, password, access code, IP address, geolocation, on-screen signature, CPF, full name, date of birth, and/or other means previously defined by D4Sign, according to the options available on the platform, the principle of data minimization, and the purposes provided in current legislation. All information collected during the authentication process will be permanently registered and linked to the signed document.
• Communications with D4Sign: Your communications with sales and support requests, error reports, or feature requests will be saved by our team. Our customer support team operates through the Hubspot tool.
• Requests for proposals and similar: we store the information filled out and provided by the user themselves in the forms on our websites, then the information is sent to the Sales department for contact.
• Sending informative emails:We send email communications to clients and individuals interested in our services via the ActiveCampaign platform, where we store the email address, name, and phone number, if provided by the user. ActiveCampaign may have access to your data, which can be deleted by unsubscribing from our list.
• Website navigation: Number of visits, pages accessed, regional access location, time spent, among other information stored by the Google Analytics tool, all devoid of any means to identify their owner.

4.4 Data Usage

D4Sign does not have any type of advertising on its website. All collected data is used internally by D4Sign for the purpose of providing services within the contracted scope, including the analysis and improvement of our services, being previously devoid of any personal information that could identify its owner. Sharing with third parties is restricted to the purpose of service provision, and is detailed in the item "Data Disclosure".

Your email address will only be used to contact you with news and updates about D4Sign, to send you notices regarding system operations, and to conduct satisfaction surveys about our services.

4.5 Data Storage

D4Sign is the developer of the signature platform it commercializes. The services provided are delivered through the AWS Cloud platform of Amazon Web Services, Inc. The AWS Cloud holds numerous security and compliance certifications such as ISO 9001, ISO 27001, and ISO 27018, in addition to guaranteeing an SLA (Service Level Agreement) of up to 99.9% availability, according to its service model.

The servers are owned and operated by Amazon, with data storage taking place in Brazil, the United States, and Italy.

All information of our clients is considered confidential, stored in the AWS Cloud and encrypted, being released only upon a valid and legal order from a governmental or regulatory body.

4.6 Data Retention

a) Personal Data:

Regardless of the contracted plan, D4Sign adopts the following data retention guidelines, even after the eventual inactivation of the account by the user:

• User Registration Data: retained for as long as the account remains active and, upon its inactivation, preserved for a period of 10 years or until the data subject formally requests deletion, except in cases where the law requires retention for a specified period (such as access logs provided for under the Brazilian Civil Rights Framework for the Internet / Marco Civil da Internet);
• Signatories' data: stored to ensure the legal validity of the electronic signatures. Even upon account closure, these data are retained for up to 10 (ten) years, based on the statute of limitations under Article 205 of the Brazilian Civil Code.

D4Sign may retain your Personal Data after receiving your deletion request if necessary for the fulfillment of legal obligations, resolution of disputes, maintenance of security, prevention of frauds and abuses, and guarantee of contract compliance.

• Documents sent for signature: The documents sent are encrypted and stored securely, according to criteria defined by D4Sign. The storage period varies according to the contracted account type:
• Free account: the documents are available for up to 30 (thirty) days after submission. Upon expiration of this period, the documents may be automatically deleted, without prior notice to the user.
• Paid account: access to the documents is terminated with the end of the contract, with the client being responsible for downloading and backing up the documents during the contractual period. After this period, the documents may be deleted or archived definitively, in accordance with the Information Security Policy, except in cases where there is a legal obligation for retention or a contractual clause with a defined period, such as the preservation of signatories' data for up to 10 (ten) years, according to Article 205 of the Brazilian Civil Code.

4.7 Data Disclosure

D4Sign does not provide Personal Data collected on its websites to email list brokers without your express consent.

D4Sign may share collected Personal Data with third parties in the following situations and within the limits required and authorized by law:

• a) With suppliers and partners for the execution of services contracted with D4Sign, including payment information operated by a third party;
• b) With companies and individuals contracted for the performance of certain activities and services on behalf of D4Sign;
• c) When necessary due to legal obligation, determination by a competent authority, or judicial decision.

In cases of sharing Personal Data with third parties, all subjects mentioned above must use the shared Personal Data consistently and in accordance with the purposes for which they were collected (or with which the User previously consented) and in accordance with what was determined by this Privacy Policy, other website or country privacy statements, and applicable privacy and data protection laws.

5. USER OBLIGATIONS AND RESPONSIBILITIES

User obligations and responsibilities include:

• a) Whenever requested, provide true, accurate, updated, and complete information, especially during registration on the SITE.
• b) Use the SITE solely and exclusively for lawful purposes and intents, with any other use being prohibited, especially those unrelated to its original purpose, being aware that the identification of evidence of illicit acts may result in the suspension or cancellation of registration, without prior notice.
• c) The preparation of documents to be electronically signed, even when using templates provided by the platform, should only be used as a reference, with the user being responsible for adjustments according to their needs and for all information contained therein.
• d) Properly upload the document to be electronically signed.
• e) Correctly register all signatories of the document to be electronically signed. Given that D4Sign is not responsible for sending the document to an erroneously registered signatory.
• f) Carefully read the document to be electronically signed, as D4Sign has no responsibility for the content of the document.
• g) Not violate any industrial and intellectual property rights of D4Sign and third parties in the use of the SITE, including applying reverse engineering, disassembly, decompilation, or any other attempt to discover the respective source codes, in whole or in part.
• h) Not use the SITE to store, distribute, transmit, or reproduce any materials that: violate third-party rights; are unlawful, defamatory, violent, pornographic, discriminatory, or contrary to morals and good customs; are contrary to the honor, reputation, intimacy, and privacy of any person; have drug-related content, or cause difficulties to the normal functioning of the SITE, not limited to these.
• i) Not use the SITE to commit and/or attempt to commit acts aimed at: altering the content of the SITE; obtaining unauthorized access to another computer, server, or network; interrupting service, servers, or computer network through any illicit method.
• j) Safeguard access credentials, being aware that they are for the exclusive, personal, and untransferable use of the user who registered, being responsible for their custody, secrecy, and security, as well as for their undue use by third parties.
• k) Not circumvent any authentication or security system; aiming to access confidential information of third parties, of any nature.
• l) Respect all and any current Brazilian legislation applicable to the use of the SITE and the user's acts within it, as well as any applicable norm or law in the country from which the user's access originates.
• m) Respect all conditions established in this instrument.

6. SECURITY MEASURES

D4Sign adopts high technical and operational standards to ensure the continuity and availability of its platform.

Under the terms of the service provision agreement, D4Sign undertakes to maintain, in each calendar month, a Service Level Agreement (SLA) with a minimum availability of 99.50%, ensuring access to the platform 24 (twenty-four) hours a day, 07 (seven) days a week, except in cases of scheduled maintenance, force majeure, or third-party failures.

In addition, D4Sign maintains a Service Level Objective (SLO) of up to 04 (four) hours for analysis and correction of critical access failures, counted from the formal notice sent to the support channel (suporte@d4sign.com.br).

This commitment to platform stability is an essential part of the contractual relationship and aims to ensure reliability, continuity, and security for the services provided.

D4Sign adopts security measures to ensure the confidentiality, integrity, and availability of information through internal Policies, awareness, and confidentiality terms with employees and third parties.

7. ACCOUNT CANCELLATION

Account cancellation may occur at any time, with fines and penalties defined in the contract being applicable. The effects on document storage and retention will follow the rules provided for free accounts and paid accounts, as well as the applicable legal provisions.

7.1 Monthly and annual plans – commitment period and cancellation policy

The CLIENT may choose to subscribe to the service under monthly or annual plans, according to the commercial terms available at the time of contracting.

a) Monthly plan

In the monthly plan, billing will be processed on a recurring basis every 30 (thirty) days. The CLIENT may request cancellation at any time; in this case, access to the service will remain available until the end of the current billing cycle already paid for. There will be no pro-rated refunds or reimbursement of amounts for the period already started.

b) Annual plan

By subscribing to the annual plan, the CLIENT agrees to a minimum commitment period of 12 (twelve) months, starting from the date of the subscription confirmation.

The annual plan is offered under special commercial conditions, including a reduced price compared to the monthly subscription, in consideration of the commitment to remain for the entire contracted period.

In the event of early cancellation by the CLIENT before the end of the commitment period, access to the service may be discontinued at the CLIENT's request. It is hereby established that there will be no total or partial refund, reimbursement, or restitution of amounts paid, considering that the contracted price corresponds to the availability of the service throughout the entire annual period.

The CLIENT declares to be aware that subscribing to the annual plan implies a commitment to remain for the entire contracted period, except as provided by law or in case of breach of contract by the CONTRACTOR.

8. PRIVACY POLICY REVISION

Should D4Sign modify this Privacy Policy, such changes will be visibly published on the D4Sign website. If the user has any questions regarding the website's privacy policies, please reach out using the contact channels provided on our website.

9. DATA PROTECTION OFFICER

D4Sign provides means for you to contact us to exercise your data subject rights.
If you have any questions about this Privacy Policy or the personal data we process, you can contact our Data Protection Officer - Head DPO, Mr. Anderson Santos, and Deputy DPO, Mr. Gabriel Comitto - via email at dpo@d4sign.com.br.