Privacy Policy – MP BIOMEDICALS DO BRASIL

For the purposes of this Policy, MP BIOMEDICALS DO BRASIL is considered a Limited Liability Company with headquarters at Rua Cavalheiro Ernesto Giuliano, 909 - Olímpico, São Caetano do Sul - SP, 09571-310, registered under CNPJ number 07.776.689/0001-90.

Basic Concepts: What do I need to know to understand this policy?

To facilitate your reading, we present some useful definitions for your interpretation:

Personal Data
Any information related to an identified or identifiable natural person. This may include, for example: name, address, CPF (Individual Taxpayer Identification Number), RG (Identity Card), email.

Sensitive Personal Data
It is a category of personal data that requires additional protection due to its potential to cause discrimination or prejudice against the affected person. This information includes, but is not limited to: information about the individual's physical or mental health, racial or ethnic origin, political opinions, religious or philosophical beliefs, sexual orientation, and genetic information.

Data Subject
The natural person to whom the personal data refers. It is the individual who has the right to control their own data and exercise their rights related to the protection of personal data, such as access, correction, deletion, or portability of their personal data.

Data Protection Officer
It is our Data Protection Officer, who acts as a communication channel between MP BIOMEDICALS DO BRASIL, data subjects, and the National Data Protection Authority (ANPD) when it comes to the protection of personal data.

Data Controller
Refers to MP BIOMEDICALS DO BRASIL responsible for decisions regarding the processing of personal data

Data Processor
Refers to third parties and partners that process personal data on behalf of MP BIOMEDICALS DO BRASIL.

Consent
A freely given, informed, and unequivocal expression by which the data subject agrees to the processing of their personal data.

How we collect your personal data? What type of personal data are collected?

Good data is transparent data – we operate on this principle. We collect personal data to serve you in the best way, and most of the time, this sharing of data will be your choice. Additionally, the types of personal data and how we collect them depend on how you engage with us and why.

Data may be collected directly from you, through forms you fill out, through contracts entered into with us, through the use and interaction with our products, businesses, and experiences, both online and offline, during visits by our team, and/or automatically, through cookies or similar technologies related to digital platforms.

Additionally, we use technologies to link data and build a single record, contributing to data accuracy and adherence to the principles of quality and free access. To do this, we employ artificial intelligence mechanisms to relate data to the same data subject. In general, we do not process data from adolescents.

Below, we provide examples of the types of data processed and their respective purposes:

What data can be collected?

• Name, CPF (Individual Taxpayer Identification Number), RG (Identity Card), email, date of birth, gender, address.
• Name, email, customer identification.
• Name, email, CPF, bank details, social media profile.
• Name, email, cookies, purchase history, past interactions, preferences, gender, opinions about our products and services.
• Name, CPF, phone number, transaction history.

Processing Purpose

• Complete purchases of our products and use of our products, businesses, and experiences.
• Register you on different platforms and/or products, businesses, and experiences.
• Prevent fraudulent registrations and ensure your security in establishments, technologies, and/or platforms.
• Improve your experience and offer better products, businesses, and experiences for you.
• Safeguard the rights of   MP BIOMEDICALS DO BRASIL   and maintain the security of our products, businesses, and experiences.

Politics Update External Consulting / DPO January 30th, 2024

Main activities covered by this purpose:

• Process payment for the purchased products.
• Deliver the products.
• Confirm your identity and perform security and fraud prevention procedures, including by third parties.
• Conduct profile of purchase studies.
• Manage any competitions, promotions, marketing campaigns, surveys, or contests in which you choose to participate.
• Evaluate responses provided by you in opinion surveys.
• Prevent unauthorized registrations or changes to your registration.
• Provide personalized product, business, and experience recommendations based on your profile.
• Conduct analyses or collect statistics.
• Inform you when a product you desire or would be interested in is available or on promotion.
• Keep your registration updated.
• Send opinion surveys.
• Respond to your questions and interact with you (including via chatbot).
• Maintain business in case of transactions or corporate changes involving   MP BIOMEDICALS DO BRASIL.
• Keep our products, businesses, and experiences secure.
• Protecting you and ourselves against fraud, including exchanging information with other companies and organizations, investigating fraud, or unauthorized changes to systems and your registrations.

With whom do we share your personal data?

In order to dedicate ourselves to creating opportunities for high-quality scientific research, we operate in partnership with several companies to offer our products, businesses, and experiences. In this way, we may share your data in the following situations:

Social networks

Some digital platforms allow you to register by logging in with a third-party mechanism, such as your Facebook or Google profile. When this happens, certain personal data may be shared with these third parties. You can always decide whether or not you want to integrate this information. Please note that we do not control the policies and practices of any other website or third-party mechanisms.

It's also worth noting that you may be the protagonist of marketing preferences that you will be subject to due to past interactions on such social networks. Always check your privacy options and adjust your preferences as desired.

Our Suppliers and Partners

We rely on the help of suppliers who may process personal data that we collect – all sharing is done with a proper legal basis. We always seek to carefully assess our suppliers and enter into contractual obligations with them regarding information security and personal data protection to minimize risks to the data subject.

Among these suppliers are, for example, companies that operate in the following areas:

(i) data hosting and activities;
(ii) owner and asset security, such as image monitoring and sending data to insurers for claims processing;
(iii) authentication and validation of registrations;
(iv) data and tools for advertising, marketing, digital and social media;
(v) logistics and product delivery;
(vi) data subject support and research;
(vii) debt collection and default registration and anti-fraud;
(viii) operation and enablement of certain products, businesses, and experiences for you, such as marketplaces, ticket issuance and transportation, and compliance with legal requirements;
(ix) payment means and processing;
(x) advisory and audit consulting.

Data Companies

Some of our suppliers are data companies, commonly known as bureaus, with whom we may share personal data for some important purposes, such as choosing the most effective means of contacting you for sending important communications and exclusive benefits from group brands; understanding how you use the platforms; enriching, keeping your contact data up-to-date and sanitized; validating a specific profile to prevent fraud; preventing any type of illegal, fraudulent, or suspicious activities, or for the conduct of other commercial and business transactions that involve financial risk. We always seek to carefully assess these companies and enter into contractual obligations with them regarding information security and personal data protection to minimize risks to the data subjects.

Public Authorities

We will comply with the law. Therefore, if a judge or an authority with legal competence requires that MP BIOMEDICALS DO BRASIL share certain personal data for, for example, an investigation, we will share, unless we perceive abuse of power. We will always defend the privacy of the data subjects.

International Data Transfer

Although MP BIOMEDICALS DO BRASIL has its headquarters in Brazil, and our products, businesses, and experiences are intended for people located in Brazil, and thus, the Brazilian laws related to the protection of personal data apply, the personal data we collect may be transferred to meet the purposes outlined in this Policy, as some of our suppliers and partners may be located outside of Brazil.

These transfers involve branches of MP BIOMEDICALS DO BRASIL that demonstrate compliance with applicable laws and maintain a level of compliance similar to or even more rigorous than that provided for in applicable Brazilian legislation.

If you have any questions regarding which branches these are, please contact the Data Protection Officer directly.

What are the rights as a data subject?

Brazilian law guarantees you the following rights, which are safeguarded by MP BIOMEDICALS DO BRASIL:

Confirmation and Access

Allows you to verify if MP BIOMEDICALS DO BRASIL processes your personal data, and if so, request a copy of your personal data that we process.

Correction

Allows you to request the correction of your incomplete, inaccurate, or outdated personal data.

Anonymization, blocking, or deletion

Allows you to, if there is no legal basis authorizing the processing, request us to: (a) anonymize your data, so that they can no longer be related to you and, therefore, cease to be personal data; (b) block your data, temporarily suspending our ability to process it; and (c) delete your data, in which case we will erase all your data with no possibility of reversal, except as provided by law.

Portability

You have the right to request, upon express request, that MP BIOMEDICALS DO BRASIL provides you, or third parties of your choosing, your personal data in a structured and interoperable format for transfer to another provider, provided that it does not violate the intellectual property or trade secrets of the company. Similarly, you can ask other companies to send your personal data to MP BIOMEDICALS DO BRASILto facilitate the contracting of our products, businesses, and experiences, for example. It is worth noting that this right is still pending regulation by the ANPD (National Data Protection Authority). As soon as it is regulated, we will inform you of the data to be ported and the appropriate format for sharing for sending and receiving.

Information about sharing

You have the right to know the public and private entities with which MP BIOMEDICALS DO BRASIL shares data. We will keep, in the "With whom do we share your personal data?" section of this Policy, the indication of the modalities and activities that may involve sharing data with third parties.

Information about the possibility of not consenting

Allows you to have clear and complete information about the possibility and consequences of not providing consent. Your consent, when necessary, must be freely given and informed. Therefore, whenever we ask for your consent, you will be free to deny it – although, in these cases, we may have to limit our products, businesses, and experiences.

Revocation of Consent

You have the right to withdraw your consent regarding activities based on this Legal Basis. However, this will not affect the legality of any processing carried out before. If you withdraw your consent, we may not be able to provide certain products and experiences, but we will notify you when this occurs.

Objection

The law allows the processing of personal data even without your consent or a contract with us. In this case, it is necessary to demonstrate legitimate reasons for processing your data, such as preventing fraud or improving our communication with you. If you disagree with this processing, you can object to it by requesting cessation.

There are other controllers who may process your data using MP Biomedicals' brands. These cases occur when a social network, for example, suggests a product from our company based on your behavior or through public data. In these cases, we do not process your personal data, and the above-mentioned rights should be exercised directly with the responsible controllers.

It is important to note that when you receive emails from outside the MP Biomedicals domain, usually sent by marketing companies, we are not processing your data. Typically, such emails are sent from partners' own databases, and in these cases, we do not have information about you.

Regarding MP BIOMEDICALS DO BRASIL, whenever you exercise your rights through our channels, we may request some additional information for the purpose of verifying your identity, aiming to prevent fraud. We do this to respect the security and privacy of our customers, resellers, representatives, etc. Additionally, some requests may not be immediately answered, but MP Biomedicals commits to responding to all requests within a reasonable timeframe and always in compliance with applicable laws.

It is also worth noting that MP BIOMEDICALS DO BRASIL will process your information for the purpose of legal compliance and fraud prevention, including proving your identity. Complete deletion of data may not be possible due to the time required for these purposes. We do this to ensure the security and privacy of our customers, resellers, representatives, etc. Additionally, some requests may not be immediately answered, but MP BIOMEDICALS DO BRASIL commits to responding to all requests within a reasonable timeframe and always in compliance with applicable laws. If you have any doubts about these matters or how you can exercise these rights, feel free to contact us through the channels provided in this Policy.

How long will personal data be stored?

MP BIOMEDICALS DO BRASIL has an internal policy with rules on the retention and disposal of personal data, defining guidelines to determine the appropriate retention period for each type of collected personal data, considering its nature, necessity of collection, and the purpose for which it will be processed. Personal data is stored only for the time necessary to fulfill the purposes for which it was collected unless there is any other reason for its maintenance, such as compliance with legal, regulatory, contractual obligations, among others, as long as they are based on a legal basis. Of course, you always have the right to request the deletion of data, as described in this policy.

Responsibilities and how MP BIOMEDICALS DO BRASIL protects your data

Our responsibility is to take care of your personal data and use it only for the purposes described in this policy. To ensure your privacy and the protection of your personal data, we have adopted appropriate security and governance practices for our market. We have a governance and privacy program, rules of good practices and governance, internal policies and procedures that establish conditions for organization, and other aspects related to the processing of personal data. We promote training and educational activities with employees and carefully assess our suppliers, entering into contractual obligations with them regarding information security and personal data protection to minimize risks for you, the data subject.

We work to protect your privacy and personal data, but unfortunately, total security depends not only on our actions and processes. Unauthorized entry or use by third parties in your account, hardware or software failure beyond MP BIOMEDICALS DO BRASIL'S control, and other factors can compromise the security of your personal data. Therefore, your involvement is crucial to maintaining a secure environment for everyone.

You can help us by adopting good security practices regarding your account and your data (such as not sharing your password with third parties), and if you identify or become aware of anything compromising the security of your data, please contact us through the Privacy Portal or directly with the Data Protection Officer, whose contact channels are provided in the following section.

MP BIOMEDICALS DO BRASIL invests in robust anti-fraud controls and data verification during the registration processes. Nevertheless, like any other digital channel, we are subject to fraud attempts and improper use of personal data collected in third-party leaks.

If your data has been misused by fraudsters for registrations, please use our Privacy Portal to unsubscribe.

Data Protection Officer

The Data Protection Officer, also known as DPO (Data Protection Officer), is the professional designated to ensure compliance with data protection legislation and guarantee the protection of the rights of Data Subjects. They play a crucial role in supervising and advising on the processing of personal data within the organization. You can contact the Data Protection Officer of MP BIOMEDICALS DO BRASIL through the following means:

Name: Compliance for Business Consultancy Services in GRC
Email: [email protected] / [email protected]
Data Subject Portal: Access here

Changes to our policy

The date of the last revision of this Privacy Policy is indicated at the top and bottom of this document.

We may modify or update this Privacy Policy from time to time.

Some changes do not require your consent, for example, when we add a new processing purpose compatible with existing purposes or a new processing activity that falls within users' reasonable expectations. However, if the changes made could jeopardize your rights and freedoms (for example, by including a new processing purpose incompatible with existing purposes, a new legal basis, a new category of personal data to be collected, or a new data subject, all of which are not reasonably expected by users), we will request your consent for these changes separately from this Policy.

If you have not received a consent request for the changes or have refused to give consent, these changes will not apply to you. This may negatively impact some of the services provided to you if these services inevitably include consent to the changes.

Access the Data Subject Portal or contact our Data Protection Officer for more information.