Privacy Policy

This Privacy Policy aims to explain, in a clear and accessible manner, how Sioux processes personal data in the context of its activities, including what data may be collected, for what purposes it is used, which legal bases may authorize the processing, with whom it may be shared, for how long it may be retained, and what rights are guaranteed to data subjects.

This Policy applies to users of the Sioux website, job applicants, employees, former employees, service providers, clients, potential clients, leads, business contacts, third parties, suppliers, business partners, and other natural persons who access or use Sioux's digital channels or who, in any way, maintain a relationship with Sioux.

For the purposes of this Policy, the terms below shall have the following meanings:

• “User” means any and all persons who access or browse the Sioux website or interact with its digital channels.
• “Data subject” means the natural person to whom the personal data processed by Sioux relate.
• “Personal data” means information relating to an identified or identifiable natural person.
• “Sensitive personal data” means personal data concerning racial or ethnic origin, religious belief, political opinion, membership of a trade union or of a religious, philosophical, or political organization, data concerning health or sexual life, and genetic or biometric data, when linked to a natural person.
• “Processing” means any operation carried out with personal data, such as collection, production, receipt, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, deletion, evaluation, control of information, modification, communication, transfer, dissemination, or extraction.
• “Controller” means the legal entity responsible for decisions regarding the processing of personal data.
• “Processor” means the legal entity or natural person that processes personal data on behalf of the controller and in accordance with its instructions.

“Sioux” means:

• Sioux Social Agência de Publicidade Ltda., a private legal entity, registered under CNPJ No. 19.614.018/0001-01, with address at Av. Nova Independência, 87, conj. 92, sala 2, Brooklin, São Paulo/SP; and/or
• Sioux Consulting Ltda., a private legal entity, registered under CNPJ No. 00.316.268/0001-37, with address at Av. Nova Independência, 87, 9º andar, Brooklin, São Paulo/SP.

Depending on the relationship maintained with the data subject and the purpose of the processing, Sioux may act as the controller of personal data or, in certain situations, as the processor of personal data processed on behalf of clients, partners, or third parties.

Sioux may process personal data for the following purposes, as applicable to the relationship maintained with the data subject:

• to enable the operation of the Sioux website and digital channels;
• to respond to contacts, questions, requests, and business proposals;
• to conduct prospecting, business relationship, and institutional marketing activities;
• to send communications, content, invitations, newsletters, and information about services, when applicable;
• to conduct selection processes, hiring, employee management, and internal human resources routines;
• to register, qualify, contract, and manage suppliers, service providers, third parties, and business partners;
• to perform contracts, fulfill pre-contractual obligations, and administer commercial, labor, corporate, and institutional relationships;
• to comply with legal, regulatory, tax, accounting, labor, social security, and occupational health and safety obligations;
• to exercise rights in judicial, administrative, or arbitration proceedings;
• to carry out audits, internal controls, access records, corporate governance, and process improvement;
• to measure campaigns, analyze traffic, improve the user experience, and optimize content and services.

The legal bases that may support the processing of personal data by Sioux include, depending on the specific case: consent, compliance with a legal or regulatory obligation, performance of a contract or preliminary procedures related to a contract, the regular exercise of rights, legitimate interest, protection of the life or physical safety of the data subject or a third party, health protection, and credit protection, when applicable.

In the case of sensitive personal data, Sioux will observe the specific applicable legal grounds, such as compliance with a legal or regulatory obligation, the regular exercise of rights, protection of life or physical safety, health protection, ensuring fraud prevention and the data subject's security, or specific and highlighted consent when necessary.

Sioux does not sell personal data. Personal data may be shared only when necessary to fulfill the purposes set out in this Policy, for the performance of contracts, for compliance with legal or regulatory obligations, for the regular exercise of rights, or on another applicable legal basis.

Depending on the purpose of the processing, personal data may be shared with:

• companies within the same economic group;
• authorized employees and professionals of Sioux;
• suppliers of technology, hosting, cloud storage, information security, electronic signature, administrative management, CRM, marketing, recruitment and selection, people management, and internal tools;
• providers of administrative, accounting, legal, financial, tax, social security, labor, and audit services;
• social media, digital advertising, and campaign measurement platforms, when applicable;
• clients, business partners, or contracting parties, when necessary for the performance of services or contracts;
• public authorities, regulatory bodies, government entities, the Judiciary, or third parties, when there is a legal obligation, an order from a competent authority, or a need for the regular exercise of rights.

Whenever applicable, Sioux will adopt contractual and organizational measures to ensure that processors and suppliers process personal data in accordance with its instructions, with the contracted purposes, and with adequate standards of security and confidentiality.

Sioux may use technology suppliers, digital tools, storage platforms, communication services, social media, advertising tools, and corporate systems that store or process data in other countries.

In such cases, the international transfer of personal data will occur when necessary for the purposes described in this Policy and will be carried out in accordance with the applicable legal grounds, subject to the contractual, technical, and organizational measures appropriate for the protection of personal data.

Should a given processing activity be subject to foreign data protection legislation, including the European Union's General Data Protection Regulation (GDPR), when applicable, Sioux will assess the additional measures necessary to meet the corresponding requirements.

Personal data will be retained for the period necessary to fulfill the purposes that justified its collection and processing, subject to the applicable legal, regulatory, tax, accounting, labor, social security, contractual, and limitation periods.

Sioux may retain personal data, even after the end of the relationship with the data subject, when such retention is necessary for compliance with a legal or regulatory obligation, performance of a contract, the regular exercise of rights, protection against fraud and security incidents, response to audits, or in other cases authorized by applicable law.

Once the purposes have ended and in the absence of any obligation or legal basis for retention, the personal data will be deleted or anonymized. Where there is an applicable legal basis for retention, the data may be kept in a secure environment for the period necessary and proportionate to the respective purpose.

Sioux adopts reasonable technical and administrative measures compatible with the nature of the data processed to protect personal data against unauthorized access, loss, alteration, improper disclosure, or any form of inappropriate or unlawful processing.

Among the measures that may be adopted, as applicable, are access controls, restriction of permissions, log recording, environment segregation, use of security tools, credential management, internal policies, contracts with suppliers, and periodic review of data processing practices.

Although Sioux adopts security measures to protect personal data, no physical or digital environment is entirely immune to risks. In the event of a security incident that may result in relevant risk or harm to data subjects, Sioux will assess the appropriate measures, including notifications to the data subjects and to the National Data Protection Authority, when required by applicable law.

Data subjects may exercise, under the terms of the Brazilian General Data Protection Law (LGPD), the following rights:

• The right to confirm the existence of processing of their personal data, pursuant to Article 18, I, of the General Data Protection Law;
• The right to access their personal data, pursuant to Article 18, II, of the General Data Protection Law;
• The right to correct incomplete, inaccurate, or outdated data, pursuant to Article 18, III, of the General Data Protection Law;
• The right to anonymize, block, or delete unnecessary or excessive data, or data processed in noncompliance with the General Data Protection Law, pursuant to Article 18, IV;
• The right to data portability, pursuant to Article 18, V, of the General Data Protection Law, subject to applicable regulations;
• The right to delete personal data processed on the basis of consent, pursuant to Article 18, VI, of the General Data Protection Law, subject to the legal grounds for retention;
• The right to information about the public and private entities with which Sioux has shared data, pursuant to Article 18, VII, of the General Data Protection Law;
• The right to information about the possibility of not providing consent and about the consequences of refusal, pursuant to Article 18, VIII, of the General Data Protection Law;
• The right to withdraw consent, easily and free of charge, pursuant to Article 18, IX, of the General Data Protection Law;
• The right to lodge a complaint against the controller before the National Data Protection Authority, consumer protection bodies, or the Judiciary, under the terms of applicable law;
• The right to request a review of decisions taken solely on the basis of automated processing of personal data that affect their interests, including decisions intended to define a personal, professional, consumer, or credit profile, or aspects of their personality, pursuant to Article 20 of the General Data Protection Law.

Requests may be sent to Sioux's Data Protection Officer through the contacts indicated in this Policy. Sioux may request additional information to confirm the data subject's identity and ensure the security of the service.

Some requests may not be fully met when there is a legal obligation to retain data, a need for the regular exercise of rights, protection against fraud, performance of a contract, or another legal basis that authorizes the retention or continuation of the processing of personal data.

Sioux adopts reasonable technical and administrative measures compatible with the nature of the data processed to protect personal data against unauthorized access, loss, alteration, improper disclosure, or any form of inappropriate or unlawful processing.

Nevertheless, certain breaches of the confidentiality or security of personal data may result from conduct, equipment, networks, systems, or digital environments beyond Sioux's reasonable control.

For this reason, subject to applicable law, users acknowledge that Sioux shall not be liable for damages arising exclusively from:

• Failures, viruses, malware, ransomware, or other harmful elements present in the equipment, systems, networks, or digital environments used by the user themselves or by third parties beyond Sioux's reasonable control;
• Improper access to personal data when such access results exclusively from a fault attributable to the user themselves, such as improper sharing of credentials, use of insecure passwords, access through unprotected networks, or failure to comply with basic security guidelines;
• Acts of third parties that are beyond Sioux's reasonable control, without prejudice to the applicable legal responsibilities and the measures that may be appropriate for mitigating incidents.

The terms of this Privacy Policy may be amended at any time, according to the need to adapt to Sioux's activities, the technologies used, the purposes of processing, legal or regulatory requirements, and good practices for the protection of personal data.

It is up to data subjects to review this Policy from time to time.

Should substantial changes be made to the purposes for which Sioux collects personal data or to the legal bases that authorize the processing, the affected data subjects may be notified by email, a highlighted notice on the website, or another appropriate means, as the case may be.

In the event that any provision of this Privacy Policy is deemed illegal or invalid, the remaining provisions shall remain in full force and effect.

This Privacy Policy shall be governed by and interpreted in accordance with the laws in force in the Federative Republic of Brazil, in particular the General Data Protection Law — Law No. 13.709/2018.

Any litigation or disputes related to this Privacy Policy shall be resolved before the Central Civil Court of the Judicial District of São Paulo, State of São Paulo, with express waiver of any other, however privileged it may be.