PRIVACY POLICY

Previous version date: May 12, 2025
Current version date: July 25, 2025

This Privacy Policy is intended to demonstrate the commitment of ZOOX SMART DATA (“ZOOX”) in relation to the privacy and protection of personal data collected from its USERS (individuals who access ZOOX’s website), in our role as Data Controller with regard to the processing described herein.

This Policy does not extend to users of any of the Zoox products, whose respective Privacy Policies will be made available to users at the authentication stage for access to the product.

As a condition for accessing and using the exclusive features of ZOOX’s website, the USER declares that USER has read the rules contained in this Privacy Policy thoroughly and carefully, being fully aware of and thus freely and expressly agreeing with the terms stipulated herein.

---

TABLE OF CONTENTS

1. COLLECTION AND USE OF DATA AND REGISTRATION OF ACTIVITIES
2. COOKIES
3. LEGAL BASIS FOR COLLECTION AND PROCESSING
4. STORAGE, INTERNATIONAL TRANSFER, RETENTION AND DELETION
5. DATA SHARING
6. DATA SUBJECT RIGHTS
7. SECURITY
8. GENERAL PROVISIONS

---

1. COLLECTION AND USE OF DATA AND REGISTRATION OF ACTIVITIES

1.1. The data collected from the USER meets the minimization principle and may include:

DATA CATEGORY	DATA COLLECTED	PURPOSES OF USE
REGISTRATION (collected from voluntary submission)	Name, email, telephone, company, segment, company size and title, region (continent)	Contact identification with Zoox Communication, sending information Download content Personalized offers at the User’s request by filling out a demo request
ELECTRONIC LOGS (automatically collected)	IP, Cookies, activity log	Access logs for the purpose of complying with legal obligation Analytics on the website use behavior.

1.2. User identification data collected by the User’s voluntary insertion into the forms on Zoox’s website may be processed in the Customer Relationship Management (CRM) tool to fulfill the purposes set out above. We strongly recommend that the USER read CRM’s Privacy Policy, available here.

1.3. All personal data may be used as evidence in cases of illegal acts or acts contrary to this Privacy Policy or any other legal document made available by ZOOX, as well as to comply with a court order or administrative request.

• 1.3.1. It is up to the USER to configure their mobile device if they wish to block the collection of cookies or other data. In this case, some ZOOX features may be limited.

1.4. ZOOX is not responsible for the accuracy, truthfulness or lack of the information provided by the USER or its outdatedness, being the USER’s responsibility to provide them with accuracy and update them whenever necessary.

1.5. It is important to highlight that, once on ZOOX website, the USER may be led, via a link to other portals or platforms, which may collect their information and have their own Privacy Policy.

• 1.5.1. It is up to the USER to read the Privacy Policy of such platforms outside ZOOX’s environment. ZOOX is not responsible for the privacy statements or content of any third party’s websites.

1.6. The database formed by collecting data on ZOOX’s website is ZOOX’s responsibility, and its use, access and sharing will be made within the limits and purposes of ZOOX’s business.

1.7. Internally, the USER’s data will only be accessed by professionals duly authorized by ZOOX, respecting the principles of proportionality, necessity and relevance.

2. COOKIES

2.1. It is up to the USER to configure their device if they wish to block the collection of cookies. In this case, some website features may be limited.

2.2. ZOOX uses cookies from Google to generate anonymised statistics (analytics) related to the use of the site, and cookies from the CRM according to its Cookies Policy, available [INSERT LINK HERE].

• 2.2.1. Data collected via cookies may be used to re-identify the USER when they come back to ZOOX’s website.
• 2.2.2. The data collected via CRM cookies may compose the profile of the USER who fills out the form on ZOOX’s website, for the purpose of customizing offers.

3. LEGAL BASIS ALLOWING THE COLLECTION AND PROCESSING OF DATA BY ZOOX

3.1. The collection and processing are authorized under 4 (four) hypotheses provided by law:

1. Legal Obligation: Compliance with the obligation imposed by law to register and keep the records of access to the website for at least six months.
2. Preliminary Procedures: Enable the contracting of ZOOX’s product demonstrations at the request of the USER.
3. Legitimate Interest: Adding information about the use of the website to the profile of the USER for personalization of offers.
4. Consent: Authorization for communications and sending of information and offers by agreeing to this express purpose with the “Proceed” button.

Note: The right to “opt-out” (withdrawal of consent) is guaranteed at any time. The withdrawal of consent will not affect processing already carried out or based on hypotheses (i), (ii) and (iii).

4. STORAGE, INTERNATIONAL TRANSFER, RETENTION AND DELETION OF DATA

4.1. The data collected may be processed and stored in the customer relationship management (CRM) tool. As a result, data may be transferred internationally to the eastern United States. In case of doubt, the USER can read the CRM system’s Privacy Policy, available [INSERT LINK HERE].

• 4.1.1. The tool will be fully responsible for any international transfer of data, ensuring compliance with applicable legislation and best international practices.
• 4.1.2. The duration of the international transfer will remain as long as the CRM database is located in regions outside Brazil.

4.2. ZOOX shall ensure that the tool used stores data in a secure environment, controlled for a minimum period of 6 (six) months (Brazilian Civil Rights Framework of the Internet). However, ZOOX disclaims liability for damages arising from failures or invasions, except in cases of willful misconduct.

• 4.2.1. Some data may be deleted before the period of 6 months if requested by the USER and there is no longer any legal obligation.
• 4.2.2. At the end of the purpose of use and the mandatory retention period, the data may be eliminated or used anonymously for statistical purposes.

5. SHARING

5.1. The data collected and the activities recorded may be shared:

• (i) With competent judicial, administrative or governmental authorities, upon legal request or court order;
• (ii) With information security professionals (under confidentiality agreement) and public authorities for fraud detection;
• (iii) Automatically in case of corporate changes, such as mergers, acquisitions or incorporation;
• (iv) Automatically, with service providers hired by ZOOX to make viable the website and its functionalities.

5.2. All third parties contracted (item “iv”) undertake to process the data with confidentiality and only for the contracted purpose.

6. DATA SUBJECT RIGHTS

6.1. The law establishes several rights that can be exercised by a Personal Data Subject:

• (i) CONFIRMATION: Confirmation of whether or not your personal data are being processed by Zoox.
• (ii) ACCESS: Request a copy of your personal data under Zoox responsibility.
• (iii) CORRECTION: Request correction of incomplete, inaccurate, or outdated data.
• (iv) ANONYMIZATION: Request safe elimination (no return) of data that identifies you directly or indirectly. The remaining data will be used for statistics.
• (v) BLOCKING: Request temporary suspension of processing (only storage allowed).
• (vi) DELETION: Request deletion of personal data deemed unnecessary or processed in violation of the law.
• (vii) PORTABILITY: Transfer your personal data (raw) to another service provider.
• (viii) INFORMATION: Be informed about public and private entities with which we shared your data.
• (ix) PETITION: Right to make requests before the Data Protection Authority (e.g., ANPD in Brazil). We recommend contacting Zoox first for a faster solution.
• (x) OPPOSITION: Request preclusion of data processing performed based on exemptions from consent if not in accordance with the law.
• (xi) REVOCATION OF CONSENT: Revoke consent at any time.

How to exercise your rights: Contact our Data Protection Officer (DPO) at dpo@zooxsmart.com.

• Important: Identify yourself with your registered email, taxpayer’s registration number, and date of birth for authentication/security.
• Deadlines: Maximum of 15 days for confirmation/access requests, and 30 days for others.

6.2. For auditing and security purposes, ZOOX may keep the history of data registration for longer than 6 months if required by law.

7. SECURITY

7.1. ZOOX is ISO 27001 certified, adhering to the highest information security standards. ZOOX applies technical and administrative measures to ensure confidentiality, integrity, and availability, protecting personal data from unauthorized access or accidental/unlawful situations.

7.2. The CRM tool used also has a high standard of information security, as can be seen [INSERT LINK HERE].

8. GENERAL PROVISIONS

8.1. ZOOX does not use any automated decision that impacts the USER.

8.2. ZOOX reserves the right to change this Privacy Policy at any time.

• 8.2.1. If updates require a new collection of consent, ZOOX will notify the USER.

8.3. DPO Contact: The Data Protection Officer (DPO) is Pedro Nunes, Legal & Privacy Director.

• Email: dpo@zooxsmart.com
• Hours: Monday to Friday, 9 am to 6 pm (Sao Paulo time), except national holidays.

8.4. Outsourced companies must obligatorily comply with the conditions stipulated herein.

8.5. If any provision is considered illegal by local authority, others remain in force.

8.6. Electronic communication (email, SMS, apps) is valid as documentary evidence.

8.7. This document is governed by applicable legislation, electing the USER’s domicile to settle disputes.

Thanks for your attention, and welcome to ZOOX!

---

® All rights reserved.