GENERAL PRIVACY AND DATA PROTECTION NOTICE – CBMM 

5.4.WHAT PERSONAL DATA WE USE

CBMM, in the performance of its activities, may collect information and Personal Data in the following ways:

(i) General external public: CBMM may process Personal Data actively entered or shared by the Data Subject for registration purposes when contacting through service channels or accessing CBMM's official portals, such as full name, email, CPF, address, position or function, company, phone number, among others. Regardless of which Personal Data the Data Subject actively provides to CBMM, we will only use those that are effectively relevant and necessary to achieve the purposes declared to the Data Subject on a case-by-case basis.

(ii) Local community residents: CBMM is present in the daily lives of residents near the industrial park in Araxá, conducting programs, events, and campaigns with local residents. Additionally, considering CBMM's business activities, there are legal obligations to be developed with the local community. When carrying out any of the mentioned actions and/or fulfilling a legal obligation, CBMM may process personal data and sensitive personal data of local residents, including minors, such as name, address, age, identification of guardians, image, health data, among other personal data collected directly from the data subjects, to enable community participation in promoted actions or to comply with relevant legislation.

(iii) Job applicants: When applying for a job, CBMM may process personal data provided by the applicant, such as name, date of birth, address, phone number, email, marital status, academic background, previous experiences, among others. These data will be used exclusively to allow the applicant's participation in the selection process, including the identification and choice of the most suitable candidate for the position. CBMM will only process the necessary data for this purpose. The applicant can also obtain more information about the processing of their personal data through the External Privacy Notice for applicants.

(iv) Dependents of employees: CBMM may process personal data of employees' dependents, including minors, such as name, date of birth, individual registration, image, among other data, during the employee's admission phase or while the employment contract lasts. These data will be processed to allow the inclusion and use of benefits offered to employees that are extendable to dependents, to enable dependents' participation in programs and events conducted by CBMM, and to fulfill legal obligations related to these data subjects.

(v) Partners and Clients: In the exercise of its activities, CBMM may also process personal data of clients and partners, such as name, image, individual registration, date of birth, company, position or function, among others, provided by the data subject in registrations or events, to enable the participation of interested parties in CBMM's BID's, request technical and commercial proposals, place purchase orders, manage payment of invoices, establish contractual relationships, conduct audits, receive communications about the CBMM brand, and related activities.

(vi) Personal Data automatically collected by CBMM: CBMM also collects a series of information automatically, such as device characteristics, browser, IP (with date and time), IP origin, click information, accessed pages, search terms entered on our portals, among others. For this collection, CBMM will use standard technologies such as cookies, pixel tags, beacons, and local shared objects, which are used to improve the Data Subject's browsing experience on the Services, according to their habits and preferences

5.5.HOW  DO WE USE  COOKIE

Cookies are files or information that may be stored on your devices when you visit CBMM’s websites or use its online services. Generally, a cookie contains the name of the website that originated it, its lifetime and a value, which is randomly generated.

CBMM uses cookies to facilitate use and to better adapt its pages to the interest and needs of Data subjects, as well as to compile information about the use of its websites and services, helping to improve its structures and contents. Cookies may also be used to speed up your future activities and experiences on our portal. The cookie policy established by CBMM is available on the website (legal information).

5.6.Types of cookies 

After Data subjects’ consent to the use of cookies, when using CBMM pages, the website temporarily stores a cookie on their device to remember this in the next session.

It is possible to disable the automatic collection of certain Personal Data, through our preference center available in our cookie banner. The Holder must be aware that, if these technologies are disabled, some features offered by the website, which depend on the processing of said data, may not function correctly. For further information, access our cookies policy available on our website. 

5.7. How do we use data?

CBMM processes Personal Data in order to enter into contractual relationships or to manage, provide, expand and improve Services to Data subjects, adapting them to their preferences and tastes, as well as to create new services and products to be offered to Data subjects. 

CBMM may centralize the Personal Data collected, which may be used in other Services related to all CBMM’s brands, respecting the purposes set forth herein and Data subjects’ consent, whenever required by law.

In some cases, CBMM may also process Personal Data whenever necessary to comply with legal or regulatory obligations. 

Besides, CBMM may also process Personal Data based on its legitimate interest (or the legitimate interest of another company in the group), always according to Data subjects’ expectations, and never at the expense of their interests, rights and fundamental freedoms.  

Additionally, information collected may be, upon Data subjects’ consent, used for advertising purposes, such as to send information about CBMM’s brands, products, promotions and discounts, as well as to promote events or conduct surveys related to CBMM’s activities.  

CBMM may also collect data relating to the image, as it uses security cameras and video monitoring systems, in order to guarantee the security of its assets and the protection of the lives and physical safety of employees and other passersby who are within CBMM premises and/or other companies in the group.

It is worth mentioning that security cameras are positioned in common use environments, identified by signs and notices that allow Data subjects to know the locations where there is video monitoring, in addition to providing easier access to this policy and the exercise of their rights, guaranteeing inviolability of fundamental rights to privacy and image. 

5.8. WHO WE WILL SHARE DATA WITH

CBMM is an economic group that works in partnership with various companies in Brazil and worldwide, which list is available here. This way, CBMM may share information collected through its pages or by contacting Data subjects, in the following cases:

(i). With other companies in the CBMM Group, established or operating in any country, which commit to using the information for in the same purposes indicated in this External Privacy Notice;

(ii). With partner companies and suppliers, in the development of Services aimed at the Data Subject;

(iii). With authorities, government entities, or other third parties, to protect CBMM's interests in any type of conflict, including legal actions and administrative processes;

(iv). In the case of transactions and corporate changes involving CBMM, in which case the transfer of information will be necessary for the continuity of services; or,

(v). By court order or request from administrative authorities with legal
competence to request it.

5.9. International Data Transfer

Additionally, it is possible that some of the transfers indicated above may occur outside Brazil, notably to the countries where the business group operates, such as China, Singapore, the United States, Switzerland, and the Netherlands, applying in this case the Binding Corporate Rules (BCR), which were established to legitimize the international data transfer between companies of the same CBMM group. CBMM also commits to carrying out international data transfers only to countries that provide an adequate level of personal data protection as provided by applicable law or by using applicable guarantees and safeguards. 

5.10. HOW WE KEEP DATA SECURE

CBMM uses reasonable market and legally required means to preserve the privacy of the Personal Data collected. This way, it adopts various technical and administrative security measures capable of protecting Personal Data from unauthorized access and from accidental or unlawful situations of destruction, loss, alteration, communication or any other form of inappropriate or unlawful processing.

In addition to the technical efforts, CBMM also adopts institutional measures aimed at Personal Data protection, so that it maintains an information security and privacy governance program applied to all its activities and governance structure, which is constantly updated.  

Although CBMM makes its greatest efforts to preserve privacy and protect Personal Data of Data Subject, no information transfer is totally secure. Therefore, CBMM cannot fully guarantee that all information it receives and sends will not be subject to unauthorized access perpetrated through methods developed to improperly obtain information. 

For this reason, we encourage Data Subject to take appropriate measures to protect themselves, such as, keeping confidential all access credentials (usernames and passwords), being certain that such information is personal, non-transferable and of the sole responsibility of the Data Subject.

CBMM undertakes to inform the Holder and data protection bodies of any security incidents that may pose significant risks or losses to the Data subjects, after prior notification and validation of the request. 

i.confirmation of the existence of Processing;

ii.access to the Personal Data;

iii.editing of incomplete, inaccurate or outdated Personal Data;

iv.anonymization, blocking or deletion of Personal Data which are unnecessary, excessive or processed in violation of the law;

v.take their Personal Data to another service or product supplier, upon Data subjects’ express request; 

vi. delete any Personal Data processed based on Data subjects’ consent;

vii. obtain information about the public and private entities with whom CBMM shared their Personal Data;

viii. obtain information about the possibility of denying consent, as well as of the consequences of such denial;

ix. revoke consent;

x. oppose any Processing carried out in the event of waiver of consent, if not in compliance with the law.