GENERAL PRIVACY AND DATA PROTECTION NOTICE – CBMM 

5.4.WHAT PERSONAL DATA WE USE

CBMM may collect information and Personal Data from two different ways:

i. Personal Data provided by Data subjects: CBMM collects all Personal Data actively entered or shared by Data subjects when getting in contact or accessing CBMM’s portals, such as full name, email, taxpayer number, address and telephone. Regardless of which Personal Data Subject´s actively provides to CBMM, we shall only use those effectively relevant and necessary for achieving the purposes informed to them on a case-by-case basis. 

ii. Third-party data: CBMM, in the exercise of its activities, may also process personal data of customers, partners, external public in general, such as name, image, taxpayer number, date of birth, among others, for the purpose to establish any contractual relationship, or to carry out campaigns, projects, among other actions developed by CBMM on its premises and/or with the local community.

iii. Personal Data collected automatically by CBMM: CBMM also collects a series of information automatically, such as: features of the access device, browser, IP (with date and time), IP origin, information about clicks, accessed pages, search terms entered in our portals, among others. To collect such data, CBMM uses some standard technologies, such as cookies, pixel tags, beacons and local shared objects, to improve Data subjects’ experience browsing the Services, according to their habits and preferences.

5.5.HOW  DO WE USE  COOKIE

Cookies are files or information that may be stored on your devices when you visit CBMM’s websites or use its online services. Generally, a cookie contains the name of the website that originated it, its lifetime and a value, which is randomly generated.

CBMM uses cookies to facilitate use and to better adapt its pages to the interest and needs of Data subjects, as well as to compile information about the use of its websites and services, helping to improve its structures and contents. Cookies may also be used to speed up your future activities and experiences on our portal. The cookie policy established by CBMM is available on the website (legal information).

5.6.Types of cookies 

After Data subjects’ consent to the use of cookies, when using CBMM pages, the website temporarily stores a cookie on their device to remember this in the next session.

It is possible to disable the automatic collection of certain Personal Data, through our preference center available in our cookie banner. The Holder must be aware that, if these technologies are disabled, some features offered by the website, which depend on the processing of said data, may not function correctly. For further information, access our cookies policy available on our website. 

5.7. How do we use data?

CBMM processes Personal Data in order to enter into contractual relationships or to manage, provide, expand and improve Services to Data subjects, adapting them to their preferences and tastes, as well as to create new services and products to be offered to Data subjects. 

CBMM may centralize the Personal Data collected, which may be used in other Services related to all CBMM’s brands, respecting the purposes set forth herein and Data subjects’ consent, whenever required by law.

In some cases, CBMM may also process Personal Data whenever necessary to comply with legal or regulatory obligations. 

Besides, CBMM may also process Personal Data based on its legitimate interest (or the legitimate interest of another company in the group), always according to Data subjects’ expectations, and never at the expense of their interests, rights and fundamental freedoms.  

Additionally, information collected may be, upon Data subjects’ consent, used for advertising purposes, such as to send information about CBMM’s brands, products, promotions and discounts, as well as to promote events or conduct surveys related to CBMM’s activities.  

CBMM may also collect data relating to the image, as it uses security cameras and video monitoring systems, in order to guarantee the security of its assets and the protection of the lives and physical safety of employees and other passersby who are within CBMM premises and/or other companies in the group.

It is worth mentioning that security cameras are positioned in common use environments, identified by signs and notices that allow Data subjects to know the locations where there is video monitoring, in addition to providing easier access to this policy and the exercise of their rights, guaranteeing inviolability of fundamental rights to privacy and image. 

5. WHO WE WILL SHARE DATA WITH

CBMM is an economic group that works in partnership with various companies in Brazil and worldwide, which list is available here. This way, CBMM may share information collected through its pages or by contacting Data subjects, in the following cases:

i.With other companies of the CBMM group, incorporated or operating in any country, which undertake to use the information for the same purposes indicated in this Policy. 

ii.With partner companies and suppliers, in the development of Services aimed at the Data Subject. 

iii.With authorities, government entities or other third parties, for the protection of CBMM’s interests in any type of conflict, including lawsuits and administrative proceedings.

iv.In case of transactions or corporate changes involving CBMM, in which case the transfer of information will be necessary for the continuity of the Services; or,

v.Upon court order or by request of administrative authorities that have legal competence for its request. 

5.9. International Data Transfer

Additionally, some of the transfers indicated above may take place outside Brazil, notably to countries where the business group operates. CBMM undertakes to do so only to countries which provide a level of Data Protection compatible with the applicable law provisions or upon the use of guarantees and safeguards, such as specific provisions, standard clauses, global corporate standards, among others; as well as upon the specific consent of Data subjects or under the other circumstances authorized by law and regulated by the National Personal Data Authority. 

5.10. HOW WE KEEP DATA SECURE

CBMM uses reasonable market and legally required means to preserve the privacy of the Personal Data collected. This way, it adopts various technical and administrative security measures capable of protecting Personal Data from unauthorized access and from accidental or unlawful situations of destruction, loss, alteration, communication or any other form of inappropriate or unlawful processing.

In addition to the technical efforts, CBMM also adopts institutional measures aimed at Personal Data protection, so that it maintains an information security and privacy governance program applied to all its activities and governance structure, which is constantly updated.  

Although CBMM makes its greatest efforts to preserve privacy and protect Personal Data of Data Subject, no information transfer is totally secure. Therefore, CBMM cannot fully guarantee that all information it receives and sends will not be subject to unauthorized access perpetrated through methods developed to improperly obtain information. 

For this reason, we encourage Data Subject to take appropriate measures to protect themselves, such as, keeping confidential all access credentials (usernames and passwords), being certain that such information is personal, non-transferable and of the sole responsibility of the Data Subject.

CBMM undertakes to inform the Holder and data protection bodies of any security incidents that may pose significant risks or losses to the Data subjects, after prior notification and validation of the request. 

i.confirmation of the existence of Processing;

ii.access to the Personal Data;

iii.editing of incomplete, inaccurate or outdated Personal Data;

iv.anonymization, blocking or deletion of Personal Data which are unnecessary, excessive or processed in violation of the law;

v.take their Personal Data to another service or product supplier, upon Data subjects’ express request; 

vi. delete any Personal Data processed based on Data subjects’ consent;

vii. obtain information about the public and private entities with whom CBMM shared their Personal Data;

viii. obtain information about the possibility of denying consent, as well as of the consequences of such denial;

ix. revoke consent;

x. oppose any Processing carried out in the event of waiver of consent, if not in compliance with the law.