Introduction and Overview:

This Privacy Policy ("Policy") explains how Basemaker Digital Performance Solutions Ltd. (“Basemaker”, “Company” or “We”) handles your personal information (collectively, “Personal Data”) when you use or access this digital platform (“Platform”). The Policy also describes your rights regarding your Personal Data and explains how to contact us to learn more about our data practices or to exercise your rights. For the purposes of this Policy, “Users” are all those who, in any way, use or visit Basemaker's Platform.

This Policy explains, in a simple, direct, and transparent way, what Personal Data is collected and processed by Basemaker and for what purposes, as well as indicating with whom they may be shared and what resources are available for you to manage your Personal Data. We do not collect more Personal Data than is strictly necessary for the execution of our activities. For the purposes of processing Users' Personal Data under this Policy, Basemaker is the data controller of those who visit or register on our Platform, whether the registration is carried out directly by an individual or as a representative of a legal entity, under the terms of the General Data Protection Law – Law No. 13.709/2018 (“LGPD”).

PLEASE, WE RECOMMEND THAT THE POLICY BELOW BE READ CAREFULLY. IT DESCRIBES HOW YOUR PERSONAL DATA IS HANDLED WHEN YOU: (I) USE OUR PLATFORM; (II) CONTACT US; (III) USE OUR SERVICES; OR (IV) HAVE YOUR PERSONAL DATA HANDLED, IN ANY WAY, BY THE PLATFORM.

As portrayed in this Policy, it is possible to register on our Platform as an advertiser (“Advertiser”) or as a digital content creator (“Creator”). Please read our [Terms and Conditions for Advertisers, if you intend to use our Platform as an Advertiser] or our [Terms and Conditions for Creators, if you intend to use our Platform as a Creator]. If you do not agree with this Policy or with the respective Advertiser or Creator Terms and Conditions, as applicable, please do not access or use our Platform.

Policy Modifications: We inform you that Basemaker may change this Policy from time to time in order to reflect changes in the processing of Users' Personal Data. If we make changes, we will update the effective date or the date of the last modification at the top of this Policy.

If after reading this Policy, you still have any questions or, for any reason, need to communicate with us regarding matters involving your Personal Data, you can contact us at the following email: Person in charge of processing Personal Data: privacy@basemaker.co. If you do not agree with the updated version of this Policy, please cease the use of our Platform.

1. Who we are

Basemaker, headquartered in the City of Itajaí, State of Santa Catarina, at Rua Israel de Almeida, nº 1424, house 01, CEP 88.312-050, and registered with CNPJ/ME under nº 49.001.164/0001-22, is a technology platform available at www.basemaker.co, created and developed to provide an environment in which Creators can find advertising opportunities from Advertisers for their profiles and pages on social networks (“Profiles”), and Advertisers can carry out targeted advertising on Creators' Profiles, aiming to enhance the performance of digital campaigns (“Services”). We emphasize that Advertisers will never have access to personal data or any other information of followers or users of Creators' social networks. There is no sharing of personal data between Creators and Advertisers.

The Platform allows Creators to provide anonymized data about their audiences' engagement and interests, such as demographic information, interests, consumption behaviors, and preferences. Neither the Creators nor the Platform provide personal data to Advertisers. Based on these anonymized engagement data, Advertisers can choose which audiences they wish to target and thus create more relevant and personalized advertising campaigns without ever accessing any user or follower data.

2. What Personal Data we collect and process:

Basemaker only receives or otherwise collects the following types of information related to Users: (1) registration information, whether as an Advertiser or Creator, for the use of the Platform; (2) financial information; (3) information about visitors or Users of our Platform; and (4) information for communications and support.

Upon deciding to proceed with your registration on our Platform, you declare that all the information provided is true, complete, and current, and you are responsible for updating it as necessary.

2.1. Registration Information. When the User makes, on their own behalf or as a representative of a legal person, the [pre-registration and registration] on the Platform, and when you complete or alter your registration on our Platform, we request some information to verify your identity and enable the creation and maintenance of an account. The Personal Data collected in pre-registration and registration will depend on the type of access that the User will have to the Platform: (a) as an Advertiser; or (b) as a Creator.

a) Advertiser

• full name;

• CPF;

• ID;

• email address;

• date of birth;

• phone number;

• address;

• profession;

• company;

• position;

b) Creator

• full name;

• CPF number;

• ID number;

• date of birth;

• copy of an identity document;

• social media username;

• possible information about the Profile on social networks, such as the number of followers, engagement percentages among other available data;

• email address;

• phone number; address;

• profession;

• contact preference;

• profile photo, optional; and

Eventually and optionally, the Creator may provide income data for profile analysis.

When the Creator logs into the Platform via social networks, such as Facebook, Instagram, or Twitter, the Platform may request marketing and advertisement permissions to access Profile information, according to the terms of use and privacy policies of each social platform. This information may include demographic data, such as age, gender, geographical location, interests, and consumption behaviors, as well as information on user activities and interactions on the social network, such as likes, shares, and comments.

2.2. Financial Information. If the User registers on the Platform as an Advertiser, we may collect the financial and transactional data indicated below:

• full name;

• payment or deposit method details;

• billing address.

2.3. Navigation and Device Information. Basemaker collects, during access to the Platform, even if the User is not registered or logged in, the information listed below:

• technical data, such as URL information;

• cookies data;

• your IP address;

• browser type;

• information about mobile or computer devices;

• browser language;

• request date and time;

• type of network connection;

• information that allows digital copyright management;

• operating system; geolocation data;

• pages visited on the Platform;

• duration of the visit on the Platform and paths of view on the Platform

2.4. Communications and Support. If the User contacts Basemaker for any reason, such as obtaining support, making compliments, criticism, and suggestions, or reporting any problem or question (regardless of having created an account or not), contact information of the User is collected and stored, as well as messages and other data about the User, such as listed below:

• full name;

• email address;

• messages.

  
  

3. Why we collect and process these Personal Data

The following list details the Personal Data collected by us and explains their respective purposes:

a) Registration Data – Advertiser or Creator

• Carry out User pre-registration and registration on the Platform, whether as an Advertiser or Creator; Grant access to the Platform to the User, whether as an Advertiser or Creator;

• Manage the User's account on the Platform, whether as an Advertiser or Creator; Provide our Services; Authenticate your identity;

• Conduct research and analysis; Comply with legal and/or regulatory requirements;

• Respond to questions and concerns;

• Provide User support, whether as an Advertiser or Creator;

• Contact the User (via email, mail, text messages, and/or phone) about various topics, including use of the Platform and/or to conduct satisfaction surveys;

• Send messages with information and offers about products or services that may be of your interest; Develop engagement actions;

• Conduct advertising and marketing; and Generate knowledge, innovate and/or develop new products.

b) Financial Data

• Prevent and investigate fraud, as well as other illegal activities;

• and Enable payments on the Platform, as applicable

c) Navigation and Device Data

• Ensure the correct functioning of our Platform and Services in support of our analytic efforts; - Operate and improve our Platform and web resources, as well as simplify interaction with the User; Ensure Platform security;

• Comply with legal obligations of data collection and sharing with public authorities, in lawful forms of applicable legislation and regulation;

• Assist us in understanding your usage patterns of our Platform and implementing improvements;

• Recommend services or Platform functionalities to the User, including third-party services, that may be of their interest;

• Prevention of attacks and monitoring consecutive users' accesses, aiming to offer a better experience to the same. and Prevent and investigate fraud, as well as other illegal activities.

d) Data for Communication and Support

• Promote User support;

• and Respond to assistance requests.

In addition to what is set in the above table, We may use your Personal Data for any other purpose disclosed to you before you provide us with your Personal Data or that is reasonably necessary to provide the Services or other related products and/or services requested, with your permission or under your direction.

Attention: When contacting us by email or through forms on our Platform, or when sharing publicly through our Services, we ask that you do not send us any sensitive information regarding yourself or others.

We do not intentionally collect or store Sensitive Personal Data (as defined in art. 5º, II of the LGPD). However, if you voluntarily provide us with information about race or ethnic origin, religious belief, political opinion, union membership, or philosophical, political organization membership, data related to health or sexual life, genetic or biometric data, we may process sensitive information.

4. Classification of Personal Data

All Personal Data processed in the context of using the Platform is classified by Basemaker as “Confidential.”

5. Sharing Personal Data

Basemaker does not sell or trade your Personal Data. As a technology platform connecting Advertisers to Creators, some profile data of Creators may be publicly made accessible to Advertisers, so they can connect to Creators for campaign effectiveness.

5.1. Service Providers. Basemaker may share your Personal Data with third-party service providers, involved in technological, financial, accounting, legal advisory activities, and nonprofit activities, as indicated in the following list:

a) Provider of software and IT systems services, web hosting services (including cloud storage), application or software optimization services, customer relationship management software, email services, or system maintenance services.

b) Provider of payment services Third-party payment processing service

c) Marketing and advertising agencies Assistance to reach potential new clients across multiple communication channels, or sharing with affiliate companies that promote our services on their websites.

d) Customer service provider Assistance with customer support services.

e) Supplier of fraud prevention and information security services Identity verification, fraud prevention, or credit risk reduction services to protect our website (Platform) and our business.

In addition to the above-mentioned list, Personal Data sharing with service providers may be done for the following purposes:

• User authentication and identity checks;

• Verification of authenticity of information and documents;

• Risk prevention, fraud, and security assurance;

• Information enrichment about the User for profile analysis;

• Sending advertising campaigns and offering Services;

• Improvement of our Services, Platform, and operationalization of new products or services;

• Prevention and resolution of technical or security issues;

• Support, maintenance, and Customer service provision;

• Analytical studies;

5.2. Judicial, Administrative, or Government Authorities. In case of legal order or regulatory determination, Basemaker may share your Personal Data with competent judicial, administrative, or governmental authorities as stipulated by law.

5.3. Consent. We may disclose your Personal Data for any purpose with your consent.

5.4. Corporate Transactions. We may disclose your Personal Data to a potential buyer or investor in the event of merger, sale, restructuring, reorganization, dissolution, sale, or transfer of some or all of our assets, either as a continuing company or as part of bankruptcy proceedings, liquidation, or similar process.

5.5. Audit. In addition to the foreseen hypotheses above, Basemaker may share your Personal Data for legal due diligence and with auditing companies solely for the purpose of conducting audits on Basemaker operations and for compliance with legal or regulatory obligations

Please note that we may disclose, without restrictions, anonymized information about Users of our Platform, as such information does not identify any specific individual.

6. Personal Data of Followers or Users of Creators' Profiles

The Platform is a technology solution for Creators and Advertisers, and thus, it may access Creator's Profile data, including their followers and users. However, in this activity, the Platform acts merely as an operator of data from followers/users of Creators, under the terms of the LGPD. The relationship between followers and users of the Creator's Profiles takes place directly between Creators, the respective platform or social network, and its users.

7. Cookies and Other Tracking Technologies

As indicated in Clause 2.3 above, Basemaker records the activities performed by Users, creating, where possible and applicable, logs (records of activities carried out on the Platform and during the use of the Services) that will include: the IP address of the device used by the User, access and actions carried out by the User, date and time of each action made by the User, and information about the device used by the User, such as operating system version, browser, and geolocation.

Also, Basemaker uses certain monitoring technologies for the activities carried out on the Platform, such as cookies. A cookie is a text file placed on the hard drive by a web server without the ability to run programs or infect your computer with viruses. On our Platform, the use of cookies serves to personalize your online experience, saving your time, and optimizing your navigation. You can block some of these cookies on your computer. The Personal Data collected about our Users are used in accordance with this Policy.

Generally, we use cookies to:

• Detail each User's preferences and, with that, send ads that interest them;

• Conduct research and diagnoses to improve the experience and content of our Platform;

• Prevent fraudulent activities;

• Improve the security of our Platform

  
  

8. Security Controls and Risk Mitigation

Basemaker uses various technical and organizational security measures to protect your Personal Data. Our efforts aim to mitigate the risks of destruction, accidental or illegal loss, alteration, unauthorized disclosure, or access or any other form of illegal or inappropriate processing. For this purpose, Basemaker uses strict access controls, based on the least privilege, to information technology systems to protect Personal Data against potential security incidents.

Basemaker makes significant efforts to ensure the security of your Personal Data, taking precautions to prevent any improper processing of Personal Data. However, we cannot consider the Internet as a completely secure environment, and therefore, ensure the most complete security of our Users. Unauthorized access or use, hardware, or software failure, and other factors may compromise the security of our Users' information at any time.

In line with what was mentioned above, in the current state of technology, it is not possible to ensure that any data transmission carried out over the Internet is completely secure. Therefore, if you identify or become aware of anything related to Basemaker that compromises information security, we ask you to contact us as soon as possible, so that incident response measures can be taken.

For the security of our Platform, if we have reasons to believe that any information provided to us is not true or there are signs of fraudulent activities, we may suspend or discontinue your account and refuse you any of our Services. Any errors, delays, damage, or losses caused due to incorrect or outdated Personal Data is the sole responsibility of the User. Furthermore, if Basemaker identifies inconsistencies or possible risks involving any of its Users or their operations, it may request you to provide means of validating the provided information.

Furthermore, Basemaker is not responsible for security failures occurring on the User's device, computer, mobile, or tablet, such as failures originating from viruses, malware, spyware, phishing, keylogger, and server DNS attacks or DNS cache poisoning, etc., nor for damages or problems resulting from delays, interruptions, or blockages in data transmissions occurring on the Internet. You declare and consent that all communication through the World Wide Web is subject to interruptions or delays that may prevent or hinder the sending of orders or the reception of updated information.

9. Account Details and Access Password

To help us ensure your security and that of your Personal Data, we recommend that your access password on the Platform is complex, personal, and non-transferable. It is important that you protect your password and limit its use and access to your computer and mobile devices to prevent unauthorized access to your account. It is your responsibility to keep your access password in a secure and restricted place.

We recommend, therefore, that your access password is not obvious, like birth dates. It is important that the password is composed of special and alphanumeric characters and that it is changed periodically or in case of suspected unauthorized access.

If you believe or suspect that, for any reason, the security of your account was compromised, we ask you to contact us as soon as possible.

10. Your Rights

Under the LGPD, you have the right to:

• Obtain confirmation that we process your Personal Data. In response to this request, we will inform you if we process your Personal Data or not. Note that if you are our client (User), we necessarily process your Personal Data, as explained in this Policy.

• Access your Personal Data. If you are interested, you can receive a report in which we present your owned Personal Data processed by us.

• Correct Personal Data that is incomplete, inaccurate, or outdated. If you believe that your Personal Data is incorrect, you can request correction, indicating what needs to be changed and why. We may request some proof to make the alteration.

• Request anonymization, blocking, or deletion of unnecessary, excessive, or data processed in disagreement with the provisions of the LGPD. If you believe we are processing your Personal Data unnecessarily, excessively, or in violation of the LGPD, you can request that the Personal Data is anonymized, blocked, or deleted.

• Request the portability of your Personal Data to another service or product provider, subject to our trade and industrial secrets, after regulation by - - -

• National Data Protection Authority (“ANPD”). You are the data subject of your Personal Data. Therefore, you can request that this Personal Data be transferred to another service or product provider, according to ANPD regulation, providing that trade and industrial secrets are respected.

• Request deletion of Personal Data processed based on your consent, except in cases of data conservation provided by law. If your Personal Data processing is based on consent, you can request the deletion of this Personal Data. However, the LGPD authorizes the conservation of data for the purpose of fulfilling legal or regulatory obligations; study by a research body, guaranteeing, if possible, anonymization; transfer to third parties, and exclusive use of the controller, provided they are anonymized. Request deletion of Personal Data processed based on your consent, except in cases of conservation of -

• Personal Data provided by law. If there is treatment of your Personal Data based on consent, you can request the deletion of this Personal Data. However, the LGPD authorizes data conservation for purposes of fulfilling legal or regulatory obligations; study by a research body, guaranteeing, if possible, anonymization; transfer to third parties, and exclusive use by the controller, provided that they are anonymized.

• Obtain information about with whom we share your Personal Data. You can request that we inform you of which entities we share your Personal Data.

• Obtain information about the possibility of not providing your consent and the respective consequences. When consent serves as the legal basis for treating Personal Data, you have the right to be informed about the possibility of not giving consent and the consequences of denying it.

• Revoke your consent for processing your Personal Data. If treatment of your Personal Data is conducted based on consent, you can revoke this consent. Thus, any treatment of your Personal Data that is being done based on consent will be interrupted.

• Oppose treatment that violates the LGPD. If you believe we are treating your Personal Data in a manner that contradicts the LGPD, you can object to this treatment. The request will be carefully analyzed and, if we agree, the treatment of your Personal Data that is in violation of the LGPD will be ceased.

• Request the review of decisions made solely based on automated processing of your Personal Data. It is possible that decisions are made based on the automated processing of your Personal Data. If this happens, you can request the review of these decisions.

• File a complaint regarding your Personal Data with the National Data Protection Authority. If necessary, you can file a complaint regarding your Personal Data with the ANPD.

You can exercise any of the above rights by sending an email to privacy@basemaker.co.

Before responding to a request to exercise the rights mentioned above, we may ask you to provide some information to confirm your identity.

11. Do you need to consent to Basemaker to use Personal Data as described in this Policy?

The LGPD establishes various situations where the processing of Personal Data is permitted independently of the consent of the owner of those Personal Data. These are the so-called “legal bases for data processing.”

This means that if you choose to use our Platform, in some cases, we can collect and process your Personal Data independently of your consent (if there is a “legal basis” provided in the LGPD that allows us to do so), such as for executing preliminary contractual measures or under a contract with you, for complying with legal and regulatory obligations, for regular exercise of rights in contracts or judicial, administrative, and arbitration proceedings, for credit protection, for ensuring fraud prevention and user safety in identification and registration authentication processes in electronic systems, for Basemaker's or third parties' legitimate interests, among others.

In other cases, we will ask for your consent to use your Personal Data. It is important to note that the revocation of your consent will only compel us to cease the Personal Data processing done exclusively based on consent.

12. Storage and Deletion of Personal Data

We have structured our Platform and operations so that your Personal Data is not retained in an identifiable manner for longer than necessary. This means we keep Personal Data only for the period in which they are required for the purposes described in this Policy.

However, we may keep your Personal Data for several reasons, including compliance with legal and/or regulatory obligations, the exercise of rights in legal actions, and administrative and/or arbitration proceedings, fraud prevention, and a regular exercise of our rights. We may also keep Personal Data in an anonymized manner, that is, without such data being or could be related to you, for longer periods under the law.

The information we collect regarding the IP address of Users of the page and access records of registered Users is stored for at least 6 (six) months, as determined by Article 15 of Law No. 12.965/2014 (Marco Civil da Internet).

13. Third-party Websites

As a resource for our Users, our Platform may contain links to other sites on the Internet. This Policy does not apply to these third-party sites. Basemaker is not responsible for these websites and content, and does not share, subscribe to, monitor, validate, or accept the way these websites or content storage tools collect, process and transfer your personal and private information. The information practices or the content of such other sites are governed by the privacy statements of those other sites. We recommend that you consult the respective privacy policies of such websites to properly inform yourself about the use of your personal information.

14. Use by Children and Adolescents

The eventual treatment of Personal Data of children and adolescents will be made under the law and obeying all specific requirements, including obtaining consent from a parent or guardian, if applicable.

15. International Transfer of Personal Data

Although Basemaker is headquartered in Brazil, your Personal Data may, eventually, be transferred to other countries, for example, to cloud storage service providers' servers abroad. In cases where your Personal Data is transferred outside Brazil, we will adopt all appropriate measures and those required by law to ensure that your Personal Data remains adequately protected, and that this transfer is carried out according to one of the mechanisms provided in the LGPD and any other applicable regulations.

16. Changes to this Policy

Basemaker may modify, update, extend, or otherwise change the content and scope of this Policy at any time and at its sole discretion. In these cases, we will publish these changes on our Platform with indication of the last update date (which you can find at the top of this Policy).

Every time we change this Policy substantially, these changes will be valid, effective, and binding after being: (i) disclosed on the Platform; and/or (ii) emailed to Users registered on our Platform.

The continuous use of our Platform and Services after publication on the Platform and/or notification via email or about changes in our Policy will be considered your consent to the changes to follow our privacy measures. In cases where the changes to this Policy require your consent, Users will be asked to acknowledge the new terms of this Policy after the change so that they can continue using the Platform and receiving the Services.

The User must check the updated version of this Policy every time they visit the Platform.

Basemaker encourages you to periodically review this Policy to keep up to date with our privacy practices.

17. Service Channel and Contact

If you wish to make a complaint or clarify doubts, please contact our Personal Data Protection Officer at the following email address: privacy@basemaker.co.

You can also send a message to the National Data Protection Authority, but we ask you to try to directly resolve any issues with us, as our main concern is to keep our Users satisfied with our Platform and Services, and we will strive to accomplish this mission through easy and attentive communication with Users.

18. Applicable Law

This Policy will be interpreted in accordance with the laws of the Federative Republic of Brazil. The Forum of the District of São Paulo, State of São Paulo, is elected to resolve any divergence arising from this Policy, with express waiver of any other, no matter how privileged it may be.