Privacy and Personal Data Protection Policy

The purpose of this Privacy Policy is to clearly explain how PICCHAT LTDA collects, uses, stores and protects the personal data of its users, in compliance with the Brazilian General Data Protection Law (LGPD, Law No. 13,709/2018). The terms “Picchat”, “Platform”, “our”, “we” or “us” refer to PICCHAT LTDA.

This policy sets out the rules for the processing of information provided or collected during the use of the platform (app.picchat.com.br), ensuring transparency and respect for privacy rights.

Picchat LTDA, registered with the CNPJ (Brazilian National Registry of Legal Entities) under No. 23.487.997/0001-51, headquartered at Avenida Paulista, nº 1636, CEP: 01310-200, Conjunto 04, Pavimento 15, São Paulo/SP, Brazil, reaffirms its commitment to the security and protection of personal data, promoting a reliable and secure experience for its users.

To make this Privacy Policy easier to understand, we explain the main terms used below:

• Picchat: Refers to the platform that collects, uses and protects users' personal data, in accordance with the Brazilian General Data Protection Law (LGPD), and is responsible for the use, storage and protection of such data.
• Personal data: Information that identifies or can make a person identifiable, such as name, e-mail, phone number and address, among others.
• Data processing: Refers to any operation performed with personal data, such as collection, storage, use, sharing or deletion.
• Data subject: The natural person to whom the personal data refers, i.e., the user, customer, partner or supplier of the platform.
• Controller: PICCHAT LTDA is the data controller, i.e., the company responsible for deciding how and why personal data will be processed, as defined by law.
• Processor: The person or company that processes data on behalf of the controller, following the instructions of PICCHAT LTDA.
• Cookies: Small text files stored on the user's device to collect information about browsing, such as preferences and behavior on our website.
• Sensitive data: Personal data revealing information about racial or ethnic origin, political opinion, religious belief or health, among others, which warrant special protection.

Picchat may collect users' personal data at different points of interaction with the platform, whether provided directly by the data subjects or automatically during the use of our services. The main types of data collected are listed below:

3.1. Data provided directly by the user

This data may be collected when you create an account or interact with Picchat:

• Full name;
• E-mail address;
• Phone number;
• Company or organization name;
• Payment information, where applicable.

3.2. Data collected automatically

When you use the platform or visit our website, we automatically collect information through cookies and similar technologies, such as:

• IP address;
• Type of browser and device used;
• Pages visited and time spent on them;
• Information about approximate location (if authorized).

3.3. Third-party data

We may collect personal data from other sources, such as:

• Information provided by customers or partners for integration and customer service purposes;
• Data obtained from authorized suppliers or service providers.

3.4. Purposes of collection

The data collected is used to:

• Personalize your experience on the platform;
• Provide efficient support and customer service;
• Generate performance reports and analyses;
• Comply with legal and regulatory obligations.

The personal data collected by Picchat is processed exclusively for the legitimate purposes necessary for the use of the platform, ensuring compliance with the LGPD. The main purposes include:

4.1. Provision of services

• Managing users' access to and use of the platform;
• Personalizing and improving the user experience;
• Providing technical support and customer service.

4.2. Communication and marketing

• Sending notifications related to the contracted services;
• Sharing information about Picchat's updates, features, promotions and campaigns;
• Generating insights on engagement and use of the platform.

4.3. Data analysis and improvements

• Monitoring the platform's performance and fixing technical issues;
• Analyzing user behavior to improve our services and develop new features.

4.4. Relationships with third parties

• Carrying out integrations and partnerships with other systems, as authorized by users;
• Sharing information with suppliers and partners for the performance of contracted services, while respecting confidentiality.

Picchat shares users' personal data only when necessary and as permitted by applicable law. This may include:

• Service providers: Data shared with third parties for essential operations, such as data hosting, payment processing and the sending of communications.
• Business partners: Data shared with partners, always in accordance with the stated purposes.
• Legal and regulatory authorities: Data provided to comply with legal obligations, court orders or applicable regulations.
• Integrations authorized by the user: Sharing with integrated platforms or systems, subject to the data subject's consent.

Picchat adopts technical and organizational measures to ensure the security and protection of personal data, including:

• Secure storage: Data stored on servers protected by industry-recognized security protocols.
• Restricted access: Only authorized employees and service providers have access to the data, always under confidentiality.
• Monitoring and audits: Ongoing review of security practices to prevent unauthorized access, alteration or leaks.

Data will be retained for the period necessary to fulfill the purposes described in this policy or for as long as required by law.

Under the LGPD, data subjects have the following rights, which may be exercised at any time:

• To confirm the existence of processing of their data;
• To access the stored data;
• To correct incomplete, inaccurate or outdated data;
• To request the deletion of data processed on the basis of consent;
• To request the portability of the data to another service provider;
• To obtain information about the entities with which the data is shared;
• To revoke previously given consent.

To exercise these rights, data subjects may contact us through the channels provided in this policy.

Picchat uses cookies and similar technologies to optimize the user experience, including:

• Strictly necessary cookies: Ensure the basic functioning of the platform.
• Performance cookies: Collect information about how the website is used, for continuous improvement.
• Functionality cookies: Allow the user experience to be personalized, such as by remembering preferences. Users can manage their cookie preferences through their browser settings or the options made available on the website.

Picchat reserves the right to update this Privacy Policy to reflect changes in its services or in legal or regulatory requirements. Whenever this occurs, users will be informed, either through notifications on the platform or through other appropriate channels. We recommend that users revisit this page periodically to stay up to date.

If you have any questions or requests, or wish to exercise your rights as a data subject, please contact Picchat through the following channel:

• E-mail: contato@picchat.io
• Phone: +55 (11) 99423-7500

This Privacy Policy shall be governed by and construed in accordance with the laws of Brazil. Any disputes or controversies shall be settled by the courts of the judicial district of São Paulo/SP, unless otherwise provided by law.