PRIVACY POLICY

Obtain information about your rights directly under the Brazilian General Data Protection Law (“LGPD”) through Law No. 13,709 (planalto.gov.br)

For CROMA, all information is valuable and essential for us to fulfill our mission of delivering services with excellence. We prioritize the privacy and security of information belonging to our employees, clients, and business partners.

This Data Protection and Privacy Policy complies with applicable laws. We use as reference the control objectives suggested by ABNT NBR ISO/IEC 27701:2019.

At CROMA, we act as facilitators of innovation processes. We bring knowledge, methodologies, and clear directions. We are midwives of ideas: we analyze, co-create, prototype, develop, test, and evolve. Because every project is unique in concept and delivery. Because reality is diverse and brands are unique. If you are looking for customized innovation, we have the solution.

In part of our activities, CROMA acts as an OPERATOR agent in the processing of personal data and follows the instructions provided by the CONTROLLER agent, provided they are lawful. Regardless of the activity, CROMA uses only the minimum and necessary data to enable contact, conduct recruitment, and collect opinions.

All precautions are applied in the transfer of personal data, which do not occur without the proper knowledge and instruction of the CONTROLLER or outside legal compliance with the laws in force in the country.

At CROMA, we are carefully committed to the right to privacy. When personal information is shared with us, we believe it is our duty to protect it appropriately. This privacy policy describes the personal information we typically receive, the purposes of collection, and the measures adopted to protect it.

Whenever necessary, you may exercise your rights over your personal data by sending us an email to [email protected], by correspondence, or by telephone contact, using the information of the DATA PROCESSING AGENT below.

DATA PROCESSING AGENT

CROMA SOLUÇÕES EM MARKETING LTDA.

CNPJ: 11.602.044/0001-08

Address: Av. Eng. Luiz Carlos Berrini, No. 1748, Suite 1710, Cidade Monções, ZIP Code 04571-000, São Paulo/SP.

Business hours: 9:00 a.m. to 12:00 p.m. and 1:00 p.m. to 6:00 p.m.

Phone: (11) 98874-1010

PERSONAL DATA

These are data that allow the clear identification of a person. Name, ID, taxpayer number, gender, date and place of birth, phone number, residential address, GPS location, photographic portrait, health records, bank card, income, payment history, consumption habits, leisure preferences, IP address (Internet Protocol), cookies, among others.

SENSITIVE PERSONAL DATA

These are data that reveal preferences, opinions, or biological data.

Racial or ethnic origin, religious or philosophical beliefs, political opinions, financial information, union affiliations, genetic, biometric, medical data, sexual orientation, criminal records, among others.

ANONYMIZED DATA

This is a procedure by which personal data can be transformed into anonymous data. Once the anonymization process occurs, it becomes impossible to identify who originally provided the information.

The personal data we receive, without intent of exhaustiveness and always with the express permission of the data subject, may include: name and nicknames, residential and/or business address, email address, phone number, city of residence, company name, Curriculum Vitae, and profiles on different social networks. Consent may be revoked at any time upon request. The deletion of all personal data may be requested without legal implications.

The collection process occurs when data are voluntarily submitted through our website, when contact information is provided in person at conferences, trade fairs, or similar events, when companies, organizations, or institutions provide data exclusively with the prior consent of the data owner, when professional or commercial communication is initiated, or through publicly accessible directories.

We use the collected data to send communications related to CROMA and the market research industry, respond to information requests, and evaluate applications in which individuals register, informing them of their status.

CROMA does not share collected data with third parties. We will never make personal information available or disclose it to companies, organizations, or entities external to Croma, except with express and direct consent, and in no case will such data be used for purposes other than those previously agreed upon.

At CROMA, user and client data privacy and protection are our highest priority. Our privacy policy complies with all applicable data protection laws.

At CROMA, we have a specialized team dedicated to privacy and personal data protection. If you wish to contact them, you may do so by email ([email protected]) or by phone (11) 98874-1010.

In the unlikely event of any technical, organizational, or other failure beyond our control that may compromise personal data security, we will immediately notify and inform you of the potential consequences and the measures we will take to resolve the issue.

Please remember that if you believe your rights have been violated, you may submit a complaint to the competent supervisory authority, in this case, the ANPD (Brazilian National Data Protection Authority).

Due to our intention to minimize the use of personal data, we commit to deleting all information that is not strictly necessary to provide our services or, in any case, after a long period following our last contact.

All organizations that collect data from Brazilian citizens are subject to the Brazilian General Data Protection Law (LGPD), Law No. 13,709/2018, including those headquartered in other countries.

Given the evolving environment in which we operate, CROMA reserves the right to make changes to this privacy policy, and we recommend that you review it periodically. If at any time we intend to use your data for purposes different from those authorized, we will contact you in advance so you may exercise your rights.