Privacy Policy

1. Purpose of the policy

At ZBRA we understand the fundamental importance of privacy for everyone. We are committed to protecting and respecting the privacy of your personal information in every interaction you may have with us.

Our policy is grounded in the ethical principles and values practiced by ZBRA, in accordance with the General Personal Data Protection Law (LGPD) – Law No. 13,709 of August 14, 2018, and the Marco Civil da Internet (Brazil's Internet Civil Framework) – Law No. 12,965 of April 23, 2014. This legislation sets out the principles, guarantees, rights and duties for the use of the internet in Brazil.

To facilitate the understanding of this Privacy Policy, we recommend consulting the terms defined in the Terminology section.

2. Applicability

This Privacy Policy applies to all of our employees, suppliers, partners and clients. Its purpose is to clarify the practices we adopt in the Processing of your personal information, covering the collection and Processing of such information through various channels, including but not limited to sales activities and events, as well as the processing of the data of job applicants, current employees, partners, clients and suppliers, in service-provision contexts.

3. Scope of the policy

This document applies to ZBRA and to its controlled or affiliated companies, each of which is individually referred to herein as the "Company".

The rules set out in this document apply to all users who use ZBRA's information assets and technological assets.

4. Terminology

ANPD

— National Data Protection Authority (Autoridade Nacional de Proteção de Dados) – A federal public administration body defined pursuant to CHAPTER IX, Section I of the LGPD. The creation of several ANPDs for specific categories is contemplated. The ANPD for each sector will be the body that oversees and guides the application of the LGPD for that sector, and will also be responsible for imposing administrative sanctions in the event of a violation of the law.

Legal Basis or Ground for Processing

— The Processing of Personal Data is permitted by the LGPD in accordance with the legal bases provided for, such as ZBRA's compliance with legal and/or regulatory obligations, performance of established contracts, as well as ZBRA's legitimate interests or through the Consent of the Data Subject.

Consent

— The free, informed and unambiguous expression by which the Data Subject agrees to the Processing of their Personal Data for a specified Purpose.

Cookies

— A common practice on almost all professional websites; these are small files downloaded onto your computer to improve your experience. ZBRA's website uses essential cookies to provide you with the best possible experience and collects basic demographic data for the functionality and security of the site. We will not use your data for marketing purposes except where previously specified and accepted by the Data Subject.

Personal Data

— Any data related to an identified or identifiable natural person that requires protection under the LGPD.

Sensitive Personal Data

— Personal data concerning racial or ethnic origin, religious conviction, political opinion, membership of a trade union or of a religious, philosophical or political organization, data concerning health or sex life, genetic or biometric data, when linked to a natural person. Any biometric data of the Data Subject (fingerprint, facial recognition, iris, voice, retina, etc.) is also considered Sensitive Personal Data.

Data Subject's Right

— A right guaranteed to the Data Subject for the access, correction and deletion of their Personal Data.

Purpose

— The policy of the objective or motivation for which the collection and Processing of each item of personal data is carried out. It is the carrying out of Processing for legitimate, specific and explicit purposes informed to the Data Subject, without the possibility of subsequent Processing in a manner incompatible with those purposes.

Legitimate Interest

— When the collection of a group of Personal Data is carried out to comply with the law, to provide services, and to conduct its business.

LGPD – General Personal Data Protection Law

— Law No. 13,709 of August 14, 2018.

Free Access

— The Data Subject's right to access all information regarding the collection and Processing of their Personal Data.

Mac address

— The MAC address (Media Access Control) is a unique physical address associated with the communication interfaces used in network devices. The identifier is written into the hardware by network card manufacturers, subsequently becoming part of equipment such as computers, routers, smartphones, tablets, network printers and various other devices that use network communication.

Objection

— The right of the Data Subject not to have their data collected or processed. This right may be exercised in certain specific situations, especially where it does not harm the Legitimate Interest.

Retention period

— The period defined by ZBRA for the storage of Personal Data and its subsequent deletion.

Security

— Defines the use of actions to protect Personal Data from unauthorized access and from accidental and/or unlawful situations related to unauthorized destruction, loss, alteration, communication or dissemination.

Data Subject

— The natural person to whom the Personal Data being processed refers.

Data Processing

— Any operation carried out with Personal Data; such as those relating to: access, the ability to communicate with a device, storage medium, network drive, memory, record, file, etc., for the purpose of receiving, providing, or deleting data.

5. Personal Data

5.1. What is collected, and how it is collected

Depending on the type of Data Subject (applicants, employees, suppliers, partners and clients) and how that Data Subject interacts with ZBRA, various personal data are collected, categorized as below:

• Name: full name (first name, middle name, surname);
• Personal characteristics: age, gender, date of birth, nationality, place of birth, marital status, number of children, photograph, ethnic origin;
• Parentage: full name of the father and full name of the mother;
• Identification documents for legal bodies: CPF (individual taxpayer registry), RG (national identity card), CNH (driver's license), CTPS (work and social security card), PIS/PASEP (social integration program registration), Passport;
• Residential information: home address, home telephone, personal email, personal telephone, social media;
• Education: diplomas and educational background, academic history;
• Professional information: occupation or position, business address, business telephone, business email, business mobile, employee ID number, pre-employment medical examination, periodic medical examination, termination medical examination, employment history;
• Financial information: banking details (bank number, branch and account), household income;
• Minors and adolescents: full name, age, gender, address, declaration of independence;
• Health data: health plan beneficiary number, medical diagnosis, medical treatment, medical reimbursements;
• Information about personal computers and mobile devices: Mac address, device make and model;
• Legal information: corporate shareholding, judicial proceedings;
• Other: recordings of videoconferences.

Personal Data are collected when provided by the Data Subject themselves or by third parties, in the case of clients, suppliers and partners regarding their employees for the provision of our services to them.

Our services are not intended for children or adolescents, whose Personal Data will be collected only to comply with legal or regulatory obligations, subject to the legal requirements for their Processing.

5.2. Purpose of Processing

ZBRA may carry out the Processing of the collected Personal Data in order to:

• Hire new employees;
• Carry out client relationship and support activities;
• Sell products and/or services;
• Perform contractual activities with clients and service providers, including financial obligations, related to the products and/or services acquired;
• Respond to requests from clients, former clients, and leads/prospects;
• Improve the products and services offered;
• Comply with the determinations of competent authorities;
• Respond to legal proceedings when required;
• Provide notification of the status and any changes to our products and services;
• Carry out internal operations (financial, accounting, labor-related, among others), troubleshooting, data analysis, data integration and consolidation;
• Register and control visitors on the Company's premises;
• Manage risks and detect, prevent and/or remediate fraud or other potentially illegal or prohibited activities, as well as violations of applicable policies, contracts or terms of use;
• Comply with legal or regulatory obligations, or as required in a judicial proceeding, by any law enforcement or government body;
• Conduct forensic investigation;
• Issue reports on diagnostics, audits and analyses in information technology.

The termination of the Processing of Personal Data will occur:

• When the Purpose for which the personal data was collected is achieved or the collected Personal Data are no longer necessary;
• When the Data Subject requests the deletion of their data, in compliance with the applicable law;
• When there is a legal determination to that effect.

5.3. Retention period

The storage of data and information will be:

• For the time required by law and/or for compliance with a legal or regulatory obligation;
• Until the termination of the Processing of Personal Data, as set out above;
• In compliance with the guidelines of the Information Security Policy.

The elimination of data and information, when necessary, will be:

• Carried out in compliance with other existing legislation;
• Carried out so as to eliminate all existing evidence and copies;
• Performed using established procedures for physical or electronic elimination.

5.4. Sharing

The sharing of data and information may occur with:

• Service providers, to act in the operation and performance of the contracted services, who will be aware of and will bear the responsibilities and commitment regarding the privacy of Personal Data agreed upon in specific contractual clauses;
• Banking institutions, exclusively for carrying out contractual or labor-related transactions;
• Regulatory bodies, judicial or administrative authorities, where we may share personal information to provide the competent authorities with all information requested in relation to the Data Subject for the investigation of suspected violations of the law, or to combat any other suspected breach of our policies and contracts.

For cases not provided for above in which the sharing of Personal Data is necessary, the Data Subject of the Personal Data will be asked for express authorization (Consent), through the sending of a notification with information about the sharing.

5.5. Rights of the Data Subject

Data Subjects of Personal Data have, under the law, the rights to:

• Confirmation of the existence of Processing of Personal Data;
• Confirmation of which Personal Data of the Data Subjects are held by ZBRA;
• Request for the correction of incomplete, inaccurate or outdated data;
• Deletion of data, when they are processed based on the Consent of the Data Subject or when the data are unnecessary, excessive or processed in non-compliance with the applicable law;
• Request for information about the possible shared use of data.

For security reasons, in order to fulfill these rights, additional data or information may be requested to confirm the identity and authenticity of the Data Subject.

The Data Subject may contact ZBRA through the email dpo@zbra.dev.

5.6. How we protect your Personal Data

ZBRA takes the security of the information it collects seriously. It has therefore implemented technology and security policies and procedures designed to reduce the risk of accidental destruction or loss, or of unauthorized disclosure of or access to such information, appropriate to the nature of the data in question. The personal information collected through our platform is stored on a structured platform, and it is subject to and aligned with ZBRA's information security policies and procedures.

6. Changes to this Policy

Whenever ZBRA changes the ways and objectives in the collection and Processing of Personal Data, this policy will be updated.

ZBRA reserves the right to make changes to its practices and to this Privacy Policy at any time, and therefore we ask that this policy be accessed periodically.

7. Contact

To ask questions about our privacy practices or to make a request, contact us at the email dpo@zbra.dev.