Privacy and Cookie Notice

1. Introduction

1.1. We respect and care about the privacy and protection of our users’ Personal Data. Therefore, we process our users’ Personal Data with due care and in accordance with applicable legislation, particularly the Brazilian General Personal Data Protection Law (Lei Geral de Proteção de Dados Pessoais – LGPD).

1.2. This Privacy Notice clearly and accessibly explains which Personal Data we collect and process when you use and access our services or browse our websites, the purposes for which we use your Data, how such Data is processed, your rights in relation to your Personal Data, and how you may exercise those rights.

2. Definitions

2.1. Anonymization: Use of reasonable and available technical means at the time of Processing, through which data loses the possibility of being directly or indirectly associated with an individual.

2.2. Cloud Computing: A service virtualization technology built through the interconnection of more than one server via a common information network, such as the Internet, with the purpose of reducing costs and increasing the availability of supported services.

2.3. Cookies: Small files sent by the Platform and stored on your devices that retain preferences and certain other information for the purpose of personalizing your browsing experience according to your profile.

2.4. Anonymized Data: Data relating to a Data Subject who cannot be identified, considering the use of reasonable and available technical means at the time of Processing.

2.5. Sensitive Personal Data: Personal Data concerning racial or ethnic origin, religious beliefs, political opinions, trade union membership or membership in religious, philosophical or political organizations, data concerning health or sex life, genetic or biometric data, when linked to an individual.

2.6. Personal Data: Data relating to an identified or identifiable individual.

2.7. Data: Any information entered, processed or transmitted for the performance of services related to the use of our Platform.

2.8. Solely Automated Decisions: Decisions affecting a user that are programmed to operate automatically, without human intervention, based on automated Processing of Personal Data.

2.9. Data Protection Officer (“DPO”): Person appointed by us to act as a communication channel between us, you, other Personal Data Subjects and the Brazilian National Data Protection Authority (“ANPD”).

2.10. Session ID: Identification assigned to a user session when accessing the Platform.

2.11. IP: Abbreviation for Internet Protocol. It is an alphanumeric identifier used to identify your devices on the Internet.

2.12. Link: A term used to refer to an Internet address.

2.13. Logs: Records of activities performed by any users who use the Platform.

2.14. Platform: the website https://checklistfacil.com/.

2.15. Data Subject: An individual to whom the Personal Data subject to Processing relates.

2.16. International Data Transfer: Transfer of Personal Data to a foreign country or international organization of which the country is a member.

2.17. Processing: Any operation performed with Personal Data, including collection, production, receipt, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, deletion, evaluation or control of information, modification, communication, transfer, dissemination or extraction.

3. Controller

3.1. When Processing your Data as established in this Notice, we act as the Controller:

3.2. Starian S/A, headquartered in the city of Florianópolis, State of Santa Catarina, at Avenida Luiz Boiteux Piazza, 1302, Lote 87/89, Cachoeira do Bom Jesus, CEP 88.056-000, registered with the CNPJ under no. 15.087.394/0001-34 (“Starian”).

4. Special Notice for Children and Adolescents Under 16 Years of Age

4.1. Please do not access or register in Our Environments if you are under 16 years of age.

5. Special Notice for Legal Representatives

5.1. Although we prohibit registration and access by children and adolescents under 16 years of age, parents should supervise the online activities of their minor children.

5.2. The activities of adolescents over 16 and under 18 years of age must be supervised by their parents or legal representatives.

6. Awareness and Agreement with this Privacy Notice

6.1. By browsing and using the features of our Platform and environments, you confirm and declare that you have carefully read this Privacy and Cookies Notice and agree to the terms set forth herein. Your agreement is freely and expressly given, and you also agree to the Processing of your Data under the conditions described below.

7. How Data Is Collected

7.1. During your navigation through our Platform and environments, we may collect Personal Data in the following ways:

7.1.1. Through Your Browsing and Interactions:

7.1.1.1. We collect the Data you voluntarily provide to us when using our services, filling out registration forms, creating user profiles, participating in promotional registrations, sweepstakes or contests, submitting customer service requests, downloading software and mobile applications, posting comments, accessing pages and content, and through other interactions with our website and environments.

7.1.2. Data Collected Automatically:

7.1.2.1. We may automatically collect certain Data, as described in item 11.2.5 of this Notice.

7.1.3. Data Obtained from Third Parties:

7.1.3.1. We collect Personal Data available in public databases, social networks and Platforms containing data voluntarily provided by you. In addition, we may receive your Personal Data from partners that have a lawful basis to share such Data, always in accordance with this Notice and applicable legislation.

8. We Will Process Your Data Based on the Following Legal Grounds, as Applicable:

8.1. Consent: When you actively agree to the Processing of Data for a specific purpose. Such consent may be withdrawn at any time.

8.2. Legitimate Interest: When we or our partners have a legitimate interest in using your Data, as permitted by law, while respecting your fundamental rights and reasonable expectations.

8.3. Performance of a Contract: When Processing is necessary to perform a contract or pre-contractual procedures, such as when you subscribe to a service and we need to use your Data to process your request and deliver the contracted product.

8.4. Compliance with a Legal or Regulatory Obligation: When necessary to comply with legal and regulatory obligations, such as responding to requests from competent authorities.

8.5. Regular Exercise of Rights: When necessary for the exercise of our rights in administrative, judicial or arbitration proceedings.

8.6. Credit Protection: When necessary to prevent fraud and validate your identity, such as when subscribing to paid services.

9. Categories and Purposes of Data Collected

9.1. The Personal Data collected includes the following categories and is used for the purposes described below:

10. Data Accuracy and Updates

10.1. You are solely responsible for the accuracy, truthfulness or lack thereof of the Data you provide, as well as for keeping such Data up to date. You are responsible for ensuring that the Data is accurate and current.

11. Technology We Use

11.1. Location-Based Services:

11.1.1. We may collect, use and share with our partners, service providers and licensees precise location Data, including the real-time location of your fixed or mobile device.

11.2. Analytics Tools:

11.2.1. We use analytics tools, such as Microsoft Clarity software and other third-party technologies, to collect non-personal information in the form of various usage and behavioral metrics when you use our website or our services, referred to in this Notice as “Sites and/or Services”.

These tools and technologies collect and analyze certain types of information, including Cookies, IP addresses, device and operating system identifiers of the device accessing the website and software, referring and exit URLs, website usage and behavioral information, feature usage statistics, usage and purchase history, device identifiers and other similar information.

11.2.2. Third-party analytics companies that collect information on our Sites and/or Services and other products and/or online services may combine the information collected with other independent information from other websites and/or online or mobile products and services related to them, covering your activities across their networks of websites and online and/or mobile products and services. Many of these companies collect and use information in accordance with their own privacy policies.

11.2.3. In addition to using technologies as described herein, we may allow certain third-party companies to help us personalize advertisements that we believe may be of interest to you based on your use of our Sites and/or Services, and to collect and use data regarding such use. For more information about this practice, please refer to the “Third-Party Advertising Technologies” section below.

11.2.4. You may disable the DoubleClick Cookie by visiting Google’s advertising opt-out page or disable Google Analytics by visiting the Google Analytics opt-out page and/or other applicable data collection tool opt-out pages.

11.2.4.1. Google provides additional information regarding its marketing privacy guidelines and restrictions.

11.2.5. In some cases, our use of your Personal Data may result in automated decisions being made, including profiling. Automated decisions mean that a decision concerning you is made automatically based on a computational determination using software algorithms, without human review by us. For example, we may use automated decisions to provide targeted advertising through our Services that may be of interest to you.

You may opt out of targeted advertising by clicking “Unsubscribe” at the bottom of the advertising email you receive.

12. Who We May Share Your Data With

12.1. We may share your Data with third parties and partners where necessary to achieve the purposes described in this Privacy Notice. Such sharing will follow industry-standard information security practices and comply with applicable legislation, including, without limitation:

• 12.1.1. Automatically in the event of corporate transactions such as mergers, acquisitions and incorporations;
• 12.1.2. With competent judicial, administrative, regulatory or governmental authorities whenever required by law, request, requisition or court order;
• 12.1.3. With business partners, such as companies that assist us in resume analysis, recruitment and personnel selection, requiring such partners to adopt the technical measures necessary to protect the information, as described in the Partner Services section of this Notice;
• With other companies within our corporate group.

13. How We Use Cookies

13.1. Cookies are small text files placed on your devices that, when used on our website and environments, allow certain information to be collected, including your Data, for the purposes described in this Notice and to recognize, track and store your interactions and preferences while browsing the Internet.

13.2. The use of Cookies is common on digital Platforms. We therefore collect Cookies to improve your experience, both in terms of performance and usability, as the content made available may be tailored to your needs.

14. How Cookies Are Stored

14.1. Cookies allow the Platform to remember information when you access it, including your preferred language, location, frequency of sessions and other variables that we consider relevant to making your experience more efficient.

14.2. Cookies may also be used to compile anonymous and aggregated statistics that allow us to understand how you use the Platform and to improve its structure and content. We cannot personally identify you through such Data.

14.3. Cookies perform various functions, such as allowing you to navigate efficiently between pages, remembering your preferences and generally improving the user experience. They may also help ensure that the advertisements you see online are more relevant to you and your interests.

15. Categories of Cookies We Use

15.1. The following categories of Cookies may be used on the Platform:

15.1.1. Strictly Necessary Cookies: Cookies required for the proper functioning of the Services, allowing you to browse our environments and use the services subject to this Privacy Notice.

15.1.2. Session Cookies: Temporary Cookies that remain on your device until you finish browsing.

15.1.3. Persistent Cookies: Cookies that remain on your device until they are deleted. The length of time a Cookie remains on the device depends on the duration or expiration period of the specific Cookie and the settings of the browser used.

16. Types of Cookies Used

16.1. Performance Cookies: We collect Cookies on our Sites and/or Services to capture information regarding page visits, such as “Performance Cookies”. This information is anonymous and is used internally only to provide the most effective content to our visitors. Cookie information is used to evaluate page popularity, analyze traffic patterns on our Sites and/or Services and guide the development of further improvements to our Sites and/or Services.

16.2. Targeting, Performance and Functionality Cookies: In our email programs, we use certain tracking methods, such as “Targeting, Performance and Functionality Cookies”.

We track email access through a tracking pixel, meaning that we track who opens our email messages and when they are opened. We also track “clicks” through encoded URLs, meaning that we track whether you click links contained in our email messages. This information is used internally only to help us deliver relevant messages and is not shared with third parties.

16.3. We use the following Cookies during your browsing experience:

17. Cookie Control and Deletion

17.1. You may change your settings to block the use of Cookies or receive an alert when a Cookie is being sent to your device. Please refer to your browser instructions. If you use different devices to access the Platform, such as a computer, smartphone or tablet, you should ensure that each browser on each device is configured according to your Cookie preferences.

17.2. Disabling the Cookies we use may affect your experience on the Platform. For example, you may not be able to access certain areas of our pages or receive personalized information when visiting a page.

17.3. To manage your Cookie preferences through your browser in a simple and intuitive manner, you may use one of the links below:

• 17.3.1. For more information about “Private Browsing” and Cookie management in Firefox, click here;
• 17.3.2. For more information about “Incognito Browsing” and Cookie management in Chrome, click here;
• 17.3.3. For more information about “Private Browsing” and Cookie management in Internet Explorer, click here;
• 17.3.4. For more information about “Cookie Management” in Microsoft Edge, click here;
• 17.3.5. For more information about “Private Browsing” and Cookie management in Safari, click here;
• 17.3.6. For more information about “Private Browsing” and Cookie management in Opera, click here.

18. Measures You Should Take to Protect Your Personal Data

18.1. Password Security:

18.1.1. You are also responsible for maintaining the confidentiality of your Personal Data and should always be aware that sharing passwords and access credentials violates this Notice and may compromise the security of your Data.

18.2. Precautions You Should Take:

18.2.1. It is very important that you protect your Data against unauthorized access to your computer, account or password and always click “log out” when finishing a session on a shared computer. You should also be aware that we will never send electronic messages requesting confirmation of Data or containing executable attachments, such as files with .exe or .com extensions, or links for unexpected downloads.

19. How We Maintain the Security of Your Personal Data

19.1. We adopt rigorous security controls to protect your Data, following industry best practices and applicable technical and regulatory standards. Our measures include physical and logical asset protection, encrypted communications, access management, secure software development, and internal compliance policies and programs designed to ensure security throughout the lifecycle of our services. These controls are continuously reviewed to address new threats on the Internet.

Although it is not possible to guarantee the absolute inviolability of our services, we maintain teams prepared to detect and promptly respond to any event or incident that may compromise the security of your Data or our services.

19.2. Internally, the Personal Data collected is accessed only by duly authorized professionals, in accordance with the principles of proportionality, necessity and relevance to business purposes, as well as confidentiality obligations and preservation of your privacy under this Notice.

20. External Links

20.1. When using the Platform, you may be redirected through links to other websites, portals or environments that may collect your information and maintain their own Data Processing Policies.

20.2. You are responsible for reading the Privacy and Data Processing Policies of such websites, portals or environments outside our Platform and deciding whether to accept or reject them. We are not responsible for third-party Privacy and Data Processing Policies or for the content of any websites, content or services linked to environments outside the Platform.

21. Partner Services

21.1. We have business partners that may occasionally offer services through functionalities or websites accessible from Our Environments. Any Data you provide directly to these partners shall be their responsibility and shall be subject to their own data collection and use practices.

22. Processing by Third Parties Under Our Instructions

22.1. If third-party companies process any Personal Data under our instructions, they must comply with the conditions set forth herein and with applicable information security standards.

22.2. To optimize and improve communication, when we send you an email, we may receive a notification when the message is opened, where this functionality is available. Please note that our emails are sent only from the following domains: @checklistfacil.com and @checklistfacil.com.br.

23. How Your Personal Data and Activity Records Are Stored

23.1. Personal Data collected and activity records are stored in a secure and controlled environment for a minimum period in accordance with the table below:

23.2. Longer Storage Periods: For audit, security, fraud prevention, compliance with legal, judicial or administrative obligations and preservation of rights, we may retain a history of your Data records for a longer period where required by law or regulation or where necessary for the preservation of rights.

23.3. Data Transfer: The Data collected may be stored on servers located in Brazil or in another country where we use storage services. We undertake to adopt the necessary measures to ensure adequate protection of such Data.

23.4. Data may be stored in environments that use cloud resources or servers through Cloud Computing, which may require the transfer and/or Processing of such Data outside Brazil.

24. What Are Your Rights and How Can You Exercise Them?

24.1. We follow the guidelines established by the LGPD and undertake to ensure that you can exercise your rights regarding your Data through the Privacy Portal, including:

• 24.1.1. Receive clear and complete information about the Processing of your Data, including situations in which Data is shared;
• 24.1.2. Request access to your Data and/or confirmation of the existence of Data Processing;
• 24.1.3. Request correction of inaccurate, incomplete or outdated Data;
• 24.1.4. Request anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed Data, in specific circumstances;
• 24.1.5. Request deletion of Data processed based on your prior consent;
• 24.1.6. Request information about public and private entities with which we share your Data;
• 24.1.7. Request information regarding the possibility of refusing consent and the consequences of such refusal;
• 24.1.8. Object to Data Processing carried out based on one of the legal grounds that does not require consent;
• 24.1.9. Withdraw your consent at any time where Data is processed based on such authorization;
• 24.1.10. Request review of automated decisions that may affect your interests.

24.2. If you withdraw your consent for purposes that are essential to the proper functioning of the Platform, certain Platform functionalities may become unavailable to you.

24.3. Once the applicable retention period and legal necessity have expired, Personal Data will be deleted using secure disposal methods or used in anonymized form for statistical purposes.

24.4. For security purposes, additional identity verification measures may be required before we fulfill your requests to exercise your rights, such as confirmation of information and submission of necessary supporting documents.

25. Changes and Updates

25.1. This Notice is subject to continuous improvement and enhancement, and we reserve the right to modify it at any time according to its purpose or necessity, including for purposes of legal compliance with laws or regulations having equivalent legal force. You are responsible for reviewing this Notice whenever you access the Platform.

If this document is updated in a manner that requires renewed consent, you will be notified through the contact channels provided by you.

26. Anonymized Data

26.1. In addition to following the guidelines set forth in this Privacy Notice, we may also collect and process your Data in anonymized form, meaning that no personal identification is associated with such Data. It is important to note that, under the LGPD, anonymized data that cannot identify the Data Subject falls outside the scope of application of that law.

27. How to Contact Us

27.1. If you have any questions regarding this Notice, please contact us at protecaodedados@starian.com to submit requests concerning the Processing of your Personal Data.

28. Starian Data Protection Officers

28.1. Starian S/A’s Personal Data Protection Officers are: Camila Baschirotto and Bruna Salomão Chagas.

28.2. Date of the last modification to the Privacy Notice: June 12, 2026.

29. Document Control and Review

Version: 1.0

Prepared by:

• Bruna Salomão (Data Privacy Analyst)

Reviewed by:

• Vinicius Koerich Lourenço (Legal Analyst II)
• Wallace Santana (Compliance Assistant)
• Luana Navarro Medici (Chief Compliance Officer)
• Rafael Luiz Peixoto (Infrastructure Analyst)

Approved by:

• Camila Baschirotto (Data Privacy Coordinator)

Date: June 12, 2026

Modification and Justification: Privacy Notice update.