Privacy Policy

PRIVACY AND DATA PROTECTION POLICY

CFL INC PAR S.A., a legal entity registered under CNPJ No. 08.117.803/0001-32, headquartered in Porto Alegre, Rio Grande do Sul, at Av. Doutor Nilo Peçanha, No. 2.825, suite 1008, Chácara das Pedras, postal code 91.330-001, recognizes that personal data protection is a fundamental right of the Data Subject and that safeguarding privacy is an essential duty.

We have prepared this Privacy and Data Protection Policy clearly and objectively so that you (the Data Subject) know exactly what data is collected, the practices adopted by CFL INC PAR S.A. when processing it, and why your data is requested or collected, demonstrating our commitment to good faith, security, privacy and transparency.

This Policy applies to everyone who accesses our website and social media and may apply to other forms of data collection necessary for CFL INC PAR S.A. to provide services.

Data Processing Agent

Company name: CFL INC PAR S.A.

CNPJ: 08.117.803/0001-32

Address: Av. Doutor Nilo Peçanha, No. 2.825, suite 1008, Chácara das Pedras

City/State: Porto Alegre/RS

Postal code: 91.330-001

Role in Processing

Predominantly Data Controller

Nature of the Data:

  1. Personal data provided by the Data Subject
  2. Data collected while providing services
  3. Data collected automatically while our services are used

Purposes of Data Processing

We use only the personal data strictly necessary to provide our services, both on and outside Digital Platforms, always respecting your privacy.

Legal Bases:

  1. Consent (Article 7, item I, Law No. 13.709/18)
  2. Compliance with a legal or regulatory obligation (Article 7, item II, Law No. 13.709/18)
  3. Performance of a contract (Article 7, item V, Law No. 13.709/18)
  4. Credit protection (Article 7, item X, Law No. 13.709/18)

Protection Measures

We are committed to adopting policies and standards of good practice relating to data protection. We implement technical, physical, administrative and organizational security measures appropriate to the security of your data.

Rights of the Data Subject

As a personal data subject, you are guaranteed the following rights by Brazil’s General Data Protection Law:

  1. Confirmation of the existence of processing: At any time, through the dedicated channel, you may ask CFL INC PAR S.A. to inform you of and confirm the processing of your data in our electronic or physical records.
  2. Access to data: Whenever necessary, you may request access to the personal data held in CFL INC PAR S.A.’s database.
  3. Correction of incomplete, inaccurate or outdated data: If you identify that your personal data requires correction or is incomplete, inaccurate or outdated, you may submit a request through the channel dedicated to data subjects.
  4. Anonymization, blocking or deletion of unnecessary or excessive data or data processed in breach of the LGPD.
  5. Portability of your data to another service or product provider.
  6. Deletion of data processed with the data subject’s consent.
  7. Information about public and private entities with which the controller has shared data.
  8. Information about the possibility of withholding consent and the consequences of doing so.
  9. Withdrawal of consent.

Use of Data

CFL INC PAR S.A. will collect data actively provided by the Data Subject when registering personal data on the website.

Data entered manually by the Data Subject at any point of interaction with one of our applications may also be collected.

We may also store information collected automatically while our services are used, such as IP address and the dates and times of interactions, among other information.

Personal data provided by the Data Subject:

The term “personal data” means any information relating to you that allows you to be identified.

We collect all personal data provided by the Data Subject when registering through our service channels, such as name, email, telephone number and full address.

When completing the form to express an interest in working with us, in addition to the data listed above, we also collect date of birth and CPF (Brazilian individual taxpayer registration number).

Personal data collected automatically:

We automatically collect information such as the characteristics of the device used for access: browser, operating system, IP address and cookies, as well as information about browsing within the applications, including clicks, pages accessed and browsing time, among other automatically collected information.

Data sharing:

We may occasionally share your personal data with third parties, such as:

  1. Service providers, suppliers or partner companies essential to our operations, such as financial institutions, service providers, management software and others that enable the performance of business activities and the provision of services.
  2. Real estate agents when the sale is brokered.
  3. Regulators, authorities or government entities for the purpose of protecting the interests of CFL INC PAR S.A., or in any other dispute, including lawsuits and administrative proceedings.
  4. Government authorities or bodies due to legal or regulatory obligations.

When sharing data, we adopt appropriate measures to ensure personal data security and prevent alteration, loss, leaks, unauthorized processing or access, through specific contractual clauses and other legally appropriate mechanisms.

Non-sharing of data:

We do not share your personal data with fitted furniture service providers or financial institutions, except at the Data Subject’s request and with their consent.

COOKIES

When browsing a website, the user’s personal information and interests are stored through cookies, which are records of their visit to the website. More information about the use of cookies is available on our website in the “Cookie Policy”.

Data storage, retention and deletion

Any personal data collected will be processed and stored in accordance with security best practices. For this purpose, CFL INC PAR S.A. takes the necessary precautions in compliance with the security standards guidelines established in applicable laws and regulations.

Information may be retained to comply with a legal or regulatory obligation, always respecting data processing requirements.

Your personal data will be deleted when its purpose has expired and it is no longer necessary to comply with any legal obligation, or when the Data Subject requests its deletion, unless retention of the data is expressly authorized by law.

Privacy Channel

If you need clarification about how your personal data is being processed or wish to submit a formal request provided for under Brazil’s General Data Protection Law, please use our Privacy Channel at dpo@cfl.com.br.

Final Considerations

CFL INC PAR S.A. makes every effort to respond to requests as quickly as possible. However, justifiable factors, such as the complexity of the requested action, may delay or prevent a prompt response.

The Data Subject should nevertheless be aware that a request may be denied on legal grounds or for formal reasons, such as difficulty in verifying identity or a request to delete data that CFL INC PAR S.A. is entitled to retain in the exercise of its rights.

This Policy is governed, interpreted and enforced in accordance with the laws of the Federative Republic of Brazil, in particular the General Personal Data Protection Law (LGPD), Law No. 13.709/2018, regardless of the laws of other countries.

Any changes to this Privacy Policy will be communicated through a posting on our website. We therefore recommend that Data Subjects access our Policy periodically and check the modification date at the end of this document to confirm any changes.

This Privacy Policy was approved and published on July 22, 2022.