Privacy Policy

This is a courtesy translation. The Privacy Policy is governed by Brazilian law, and in case of any discrepancy the original Portuguese version prevails.

Responsible area: Marketing · Version 1 · Published on 06/16/2025 · Review by 06/16/2027

SECTION 1 – GENERAL INFORMATION

This Privacy Policy contains information about the collection, use, storage, processing and protection of the personal data of Users and Visitors of the aquarela.eco.br website, also referred to as "Data Subjects", in order to demonstrate full transparency on the subject and to clarify to all interested parties the types of data collected, the reasons for collecting them and how Users and Visitors can manage or delete their personal information.

This Privacy Policy applies to all Users and Visitors of the aquarela.eco.br website and forms part of the General Terms and Conditions of Use of the aquarela.eco.br website, duly registered under CNPJ (Brazilian company registration number) 52.039.758/0001-37, located at Rua Evaristo Silva, n.º 90, Jardim Tarraf II, São José do Rio Preto/SP, Brazil, ZIP code 15092-520.

This document was prepared in compliance with the Brazilian General Personal Data Protection Law – "LGPD" (Law 13,709/18), the Brazilian Internet Civil Framework (Law 12,965/14) (and EU Regulation no. 2016/679). In addition, this document may be updated as a result of regulatory changes, which is why the User is invited to check this section periodically.

SECTION 2 – HOW DO WE COLLECT THE PERSONAL DATA OF USERS AND VISITORS?

The personal data of Users and Visitors is collected by the platform as follows:

When the User fills in their details in the forms available on the aquarela.eco.br website: this is basic identification data, such as name, e-mail, phone number, state and city, among others. Based on it, we can identify the User and the Visitor, in addition to ensuring greater security and well-being for their needs.

When a User or Visitor accesses pages of the aquarela.eco.br website: information about interaction and access is collected by the company to ensure a better experience for the User and Visitor. This data may relate to the keywords used in a search, the sharing of a specific document, comments, page views, profiles, the URL from which the User or Visitor comes, the browser they use and their access IPs, among others that may be stored and retained.

Through third parties: the aquarela.eco.br platform receives data from third parties, such as Google and Facebook, when a User logs in with their profile from one of these websites. The use of this data is authorized in advance by Users with the third party in question.

SECTION 3 – WHAT PERSONAL DATA DO WE COLLECT ABOUT USERS AND VISITORS?

The personal data of Users and Visitors collected is as follows:

Data provided when filling in forms on the aquarela.eco.br website: name, phone number, e-mail, state and city of residence.

Data for browsing optimization: pages accessed, keywords used in searches, recommendations, IP address.

Newsletter: the e-mail registered by the Visitor who chooses to subscribe to the Newsletter will be collected and stored until the User requests to unsubscribe.

SECTION 4 – FOR WHAT PURPOSES DO WE USE THE PERSONAL DATA OF USERS AND VISITORS?

The personal data of Users and Visitors collected and stored by the aquarela.eco.br website is intended for:

Well-being of Users and Visitors: improving the product and/or service offered, facilitating, speeding up and fulfilling the commitments established between the User and the company, improving the User experience and providing specific features depending on the User’s basic characteristics.

Platform improvements: understanding how the User uses the platform’s services, to help develop business and techniques.

Advertising: showing personalized ads to the User based on the data provided.

Commercial: data is used to personalize the content offered and to support the platform in improving the quality of its services.

User profile prediction: automated processing of personal data to evaluate use of the platform.

The processing of personal data for purposes not provided for in this Privacy Policy will only take place after prior notice to the User, so that the rights and obligations set out herein remain applicable.

SECTION 5 – HOW LONG IS PERSONAL DATA STORED?

The personal data of Users and Visitors is stored by the platform for the period necessary to provide the service or fulfill the purposes set out in this document, in accordance with item I of article 15 of Law 13,709/18.

Data may be deleted or anonymized at the User’s request, except in cases where the law provides otherwise.

Furthermore, Users’ personal data may only be retained after the end of its processing in the following cases provided for in article 16 of the aforementioned law:

I – Compliance with a legal or regulatory obligation by the controller;

II – Study by a research body, ensuring, whenever possible, the anonymization of the personal data;

III – Transfer to a third party, provided that the data processing requirements set out in this Law are respected;

IV – Exclusive use by the controller, with access by third parties prohibited, and provided the data is anonymized.

SECTION 6 – SECURITY OF STORED PERSONAL DATA

Grupo Aquarela handles the personal data of its Users and Visitors responsibly.

The platform undertakes to apply technical security and organizational measures capable of preserving availability and integrity, as well as protecting personal data from unauthorized access and from destruction, loss, alteration, communication or dissemination of such data, using mechanisms such as data encryption.

The platform is not liable in cases of the exclusive fault of third parties, such as attacks by hackers or crackers, or the exclusive fault of the User, as in the case where the User transfers their data to third parties. The website undertakes to notify the User in the event of any security breach involving their personal data.

Stored personal data is treated confidentially, within legal limits. However, we may disclose your personal information if (i) we are required by law to do so, (ii) the User or Visitor violates our Terms of Service, and (iii) to meet requests made by the User or Visitor.

Grupo Aquarela may also, subject to compliance with the LGPD, share such Personal Data with Third Parties: (i) Service providers; (ii) Partners; (iii) Government authorities.

SECTION 7 – COOKIES OR BROWSING DATA

Categories of cookies used on this website:

• Essential — necessary for the website to work (e.g. recording your cookie preference). Always active.

• Analytics and marketing — help us understand how the website is used and personalize our communication with you. Enabled only after your express consent in the cookie banner shown on your first visit.

You can withdraw your consent at any time using the "Review preferences" button at the end of this page, or by clearing your browser’s browsing data.

Cookies are text files sent by the platform to the User’s and Visitor’s computer and stored on it, containing information related to browsing the website. This information relates to access data such as the place and time of access and is stored by the User’s and Visitor’s browser so that the platform’s server can read it later in order to personalize the platform’s services.

The User and Visitor of the aquarela.eco.br website acknowledge and accept that a browsing data collection system based on cookies may be used.

A persistent cookie remains on the User’s and Visitor’s hard drive after the browser is closed and will be used by the browser on subsequent visits to the website. Persistent cookies can be removed by following your browser’s instructions. A session cookie, on the other hand, is temporary and disappears after the browser is closed. You can reset your web browser to refuse all cookies, but some features of the platform may not work properly if the ability to accept cookies is disabled.

SECTION 8 – RIGHTS OF THE DATA SUBJECT

Under the LGPD, the Data Subject has rights and guarantees regarding their personal data.

Confirmation of the existence of processing: Grupo Aquarela processes the personal data of its Users and Visitors, keeping this data stored in secure and controlled environments. The Data Subject may request confirmation that their personal data is being processed;

Access to data: at any time, the Data Subject may ask Grupo Aquarela to report which personal data is being processed;

Correction of incomplete, inaccurate or outdated Personal Data: if the Data Subject finds that the information is incomplete, inaccurate or outdated, they may request the correction or completion of the missing or inaccurate personal data, as the case may be;

Anonymization, blocking or deletion of unnecessary or excessive personal data, or data processed in breach of the LGPD: the Data Subject may request the anonymization, blocking or deletion of Personal Data that Grupo Aquarela is processing without a legal basis justifying the processing. However, if Grupo Aquarela has a legal or regulatory justification for keeping the data, it will be retained for the period necessary to fulfill the legal obligation or for the right of defense in judicial, administrative or arbitration proceedings, or, in certain situations, in the legitimate interest of Grupo Aquarela (for example, to prevent violations and fraud);

Portability of Personal Data to another service or product provider, upon express request by the Data Subject: the Data Subject may ask Grupo Aquarela to port their personal data to another service or product provider. Where applicable, the Data Subject’s request will be fulfilled as quickly as possible;

Information about the public or private entities with which Grupo Aquarela shares the Data Subject’s Personal Data: the Data Subject may contact Grupo Aquarela through the customer service channel ( contato@aquarela.eco.br) to find out with whom their Personal Data has been shared;

Information about the possibility of the Data Subject not giving consent to the processing of Personal Data, and about the consequences of refusal: if the Data Subject does not wish to give consent for a specific processing that Grupo Aquarela needs to carry out, Grupo Aquarela will clarify to the Data Subject whether it is possible to provide the services or the software of interest without processing their Personal Data, and will also explain the consequences of not consenting;

Withdrawal of consent: when the processing of personal data is based on the Data Subject’s consent, the Data Subject may withdraw their consent and request the deletion of their personal data at any time. Withdrawal of consent may mean the Data Subject can no longer use the services provided by Grupo Aquarela. The processing of personal data will not be stopped when the data is: (i) anonymized; or (ii) necessary for Grupo Aquarela and/or third parties involved in providing the services for the purposes of judicial, arbitration or administrative defense, as well as for compliance with legal and regulatory obligations;

Deletion of data: in some cases, the Data Subject may request the deletion of their personal data.

Grupo Aquarela undertakes to meet all requests from Data Subjects as quickly as possible, also in accordance with the deadlines set by the ANPD (Brazilian National Data Protection Authority).

SECTION 9 – CONSENT

By using the services and providing personal information on the platform, the User consents to this Privacy Policy.

By registering, the User acknowledges that they may exercise their rights to cancel their registration and to access and update their personal data, and guarantees the accuracy of the information they provide.

The User has the right to withdraw their consent and to ask questions about this Policy at any time. To do so, they should contact us by e-mail at contato@aquarela.eco.br or by mail sent to the following address: Rua Atílio Bigoto, nº 85, Distrito Industrial Waldir Pala, Nova Aliança/SP, Brazil, ZIP code 15214-022.

SECTION 10 – CHANGES TO THIS PRIVACY POLICY

We reserve the right to modify this Privacy Policy at any time, so Users and Visitors are advised to review it frequently.

Changes and clarifications will take effect immediately upon publication on the platform. When changes are made, Users will be notified. By using the service or providing personal information after any changes, the User and Visitor demonstrate their agreement with the new rules.

In the event of a merger or sale of the platform to another company, Users’ data may be transferred to the new owners so that the services offered can continue.

SECTION 11 – JURISDICTION FOR DISPUTE RESOLUTION

Brazilian law shall apply in full to the resolution of disputes arising from this instrument.

Any disputes shall be brought before the courts of the district where the company’s headquarters is located.