LGPD — Your Rights

1. What Is the LGPD

The Brazilian General Data Protection Law (Lei Geral de Proteção de Dados Pessoais — LGPD, Lei n.º 13.709/2018) is the Brazilian legislation that governs the processing of personal data by individuals and legal entities, whether governed by public or private law.

The LGPD was inspired by the European Union's General Data Protection Regulation (GDPR) and has been in force since September 2020. Its purpose is to protect the fundamental rights of freedom and privacy, as well as the free development of the personality of natural persons.

The law applies to any personal data processing operation carried out in Brazilian territory, regardless of the means used, the country where the organization is headquartered, or the country where the data is located.

2. Yowpi Tech's Commitment

Yowpi Tech Ltda (CNPJ 48.579.987/0001-77) is committed to protecting your personal data and to full compliance with the LGPD. Our data processing is guided by the principles set out in Art. 6 of the law:

• Purpose: processing carried out for legitimate, specific purposes made known to the data subject.
• Adequacy: compatibility of the processing with the purposes communicated.
• Necessity: limitation of the processing to the minimum necessary for its purposes.
• Free access: guarantee of easy, free-of-charge consultation about how and for how long data is processed.
• Data quality: guarantee that data is accurate, clear, and up to date.
• Transparency: clear, accurate, and accessible information about the processing.
• Security: use of technical and administrative measures capable of protecting the data.
• Prevention: adoption of measures to prevent harm from occurring.
• Non-discrimination: processing may never be carried out for unlawful or abusive discriminatory purposes.
• Accountability: demonstration of the adoption of effective compliance measures.

3. Your Rights as a Data Subject

Under Art. 18 of the LGPD, you, as a personal data subject, have the following rights, which may be exercised at any time and free of charge:

I — Confirmation of processing

You have the right to obtain confirmation of whether Yowpi Tech processes your personal data.

II — Access to data

You may request access to the personal data we hold about you and receive a complete copy in a readable format.

III — Correction of data

If your data is incomplete, inaccurate, or outdated, you have the right to request its correction.

IV — Anonymization, blocking, or deletion

You may request the anonymization, blocking, or deletion of data that is unnecessary, excessive, or processed in violation of the LGPD.

V — Portability

You have the right to request the portability of your data to another service provider, upon express request, subject to trade and industrial secrets.

VI — Deletion of data processed with consent

You may request the deletion of personal data processed on the basis of your consent, except in the retention scenarios provided for in Art. 16 of the LGPD (compliance with a legal obligation, study by a research body, transfer to a third party, or exclusive use by the controller, provided the data is anonymized).

VII — Information about data sharing

You have the right to be informed about the public and private entities with which we share your data. This information is detailed in the "Sharing with Third Parties" section of our Privacy Policy.

VIII — Information about the option not to consent

You have the right to be informed about the option of not providing consent and about the consequences of refusing. In Yowpi Tech's case, withholding consent prevents the contact form from being submitted and, as a result, the diagnostic session from being scheduled.

IX — Withdrawal of consent

You may withdraw the consent you have given at any time, by express request, through the channels listed on this page. Withdrawal does not affect the lawfulness of processing carried out previously on the basis of that consent.

4. How to Exercise Your Rights

To exercise any of the rights listed above, send an email to our Data Protection Officer:

• Email: contact@yowpi.com
• Suggested subject line: "LGPD Request — [type of right]" (e.g., "LGPD Request — Access to data")

In your request, include:

1. Your full name.
2. The email address used in the contact form (so we can locate your data).
3. A description of the right you wish to exercise and, if applicable, the data you wish to correct or delete.

We will respond to your request within 15 (fifteen) days of receipt, as provided for in Art. 18, §5 of the LGPD. This period may be extended in cases of exceptional complexity, with a reasoned notice.

To keep your data safe, we may ask you to verify your identity before we process the request.

5. Data Protection Officer (DPO)

In compliance with Art. 41 of the LGPD, we provide the details of our Data Protection Officer (DPO — Encarregado pelo Tratamento de Dados Pessoais):

• Name: Marlon Trettin
• Email: contact@yowpi.com
• Company: Yowpi Tech Ltda — CNPJ 48.579.987/0001-77

The DPO is responsible for accepting complaints and communications from data subjects, providing clarifications, and taking action; receiving communications from the National Data Protection Authority (ANPD) and taking action; advising employees and contractors on personal data protection practices; and performing the other duties assigned by the controller or established in supplementary rules.

6. National Data Protection Authority (ANPD)

If you believe that Yowpi Tech's processing of your personal data violates the LGPD, or that your request was not adequately handled, you have the right to file a petition with Brazil's National Data Protection Authority (Autoridade Nacional de Proteção de Dados — ANPD), as provided for in Art. 18, §1 of the LGPD.

The ANPD can be reached through:

• Website: www.gov.br/anpd
• Complaints channel: available on the ANPD website for filing complaints and reports.

We recommend that, before turning to the ANPD, you contact us so that we can resolve your issue directly.

7. Security Measures

Yowpi Tech adopts appropriate technical and organizational measures to protect your personal data. For detailed information about our security practices, see the "Data Security" section of our Privacy Policy.

The main measures include:

• Encryption in transit (HTTPS/TLS).
• Partial anonymization of IP addresses (SHA-256 cryptographic hash).
• Database access control with row-level security policies.
• Temporary, controlled access to uploaded files (signed URLs with expiration).
• Protection against automated submissions (anti-spam mechanism).

8. Updates

This page may be updated from time to time to reflect changes in our practices or legal obligations. The "last updated" date at the top of this page indicates when the most recent revision was made.

We recommend reviewing this page periodically to stay informed about how we protect your data and what your rights are.