Privacy Policy

1. Who We Are

We are a TaxTech that simplifies the day-to-day of tax professionals in Brazil. Our focus is to transform the routines of tax departments through technologies that serve people. We elevate the performance of corporate tax teams with disruptive products that increase productivity, reduce costs and support a data-driven decision culture. This allows tax professionals to shift their focus from operational services to participating in strategic business decisions, boosting their evolution and supporting their digital transformation journey (Tax Transformation).

2. What You Need to Know Before Reading This Document

• Personal Data: any information that allows your identification, such as your name, ID number, email, phone, among others.
• Sensitive Personal Data: personal data related to racial or ethnic origin, religious conviction, political opinion, union membership, health or sexual life, genetic or biometric data, when linked to you.
• Data Protection Officer (DPO): the professional responsible for acting as a communication channel between Taxcel, Data Subjects and the Brazilian Data Protection Authority (ANPD). One of the DPO's goals is to ensure Taxcel's compliance with privacy and personal data protection laws.
• Data Subject: the natural person to whom the Personal Data refers.
• Processing of Personal Data: any operation such as collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, deletion, evaluation or control of information, modification, communication, transfer, dissemination or extraction, performed with personal data.

3. Collection and Storage of Personal Data

To build and maintain a relationship of trust, it is important that you know how we handle your Personal Data, and especially how, where, and which data we collect, as described below:

• Information provided by clients or users: Taxcel collects and stores the following non-sensitive personal data: name, phone, email, company and job title, via forms for downloading free content. Occasionally, additional information may be requested through direct email or phone contact. For paid clients, credit card data is collected exclusively for payment processing, via a dedicated contract form.
• Website browsing information: when clients or users visit Taxcel's websites, cookies are inserted in their browsers via Google Analytics. This is done to identify how often each client or user returns. Data such as IP address, geographic location, referral source, browser type, visit duration and pages visited are collected.
• Contact history: Taxcel stores information about all contacts made with clients and users, such as content downloaded from our pages and email interactions.
• Usage behavior data in Taxcel Hub: to improve the platform's user experience (UI/UX), Taxcel uses Mixpanel to collect usage and navigation data in Taxcel Hub, such as screens and features accessed. Fields that may contain user-entered information are automatically masked, so their content is not recorded by the tool. The data collected is used exclusively for statistical analysis, usability assessment and continuous improvement of the platform. Content entered by the user is not collected or recorded, nor is any data that allows identification. Users can disable this collection at any time at hub.taxcel.com.br/configuracoes/perfil, in the Privacy section.
• Information provided by event participants: Taxcel collects and stores the following non-sensitive personal data: name, phone, email, company and job title, via forms for ticket purchase or event registration.
• Personal Data Not Collected or Stored: Taxcel does not collect, store or process any sensitive personal data, such as racial or ethnic origin, religious conviction, political opinion, union membership, health or sexual life data, genetic or biometric data.

4. For What Purposes Do We Use Personal Data?

Taxcel collects data for the provision of the company's services, mainly to enable the commercial relationship, comply with contractual and legal obligations, and engage our brand. Taxcel will use the data and information of its clients and users for the following purposes:

• Contract execution (art. 7, V, of LGPD): use of data to ensure the provision of our services. Registered credit card data may be used exclusively for payment of services (one-time or recurring), as indicated.
• Targeted communications: use of email to send materials or information requested by the client or user via forms, as well as to send newsletters, content, events, materials and information about Taxcel products and services, and eventually those of its partners, observing the applicable legal bases under LGPD. Recipients may unsubscribe at any time via the unsubscribe link in messages or through official Taxcel channels.
• User experience improvement: download data may be published as research and statistics, without revealing personal information unless expressly authorized; users may receive service or support messages such as alerts, notifications and updates; browsing behavior data collected via Mixpanel is used for usability analysis and UI/UX improvement of Taxcel Hub, based on Taxcel's legitimate interest (art. 7, IX, of LGPD).
• Contract execution and legitimate interest (art. 7, V and IX, of LGPD): Taxcel reserves the right to monitor the entire platform to ensure compliance with contract rules and prevent violations or abuse of applicable laws. Taxcel also reserves the right to exclude any client or user if this Privacy Policy is not respected.
• Marketing with consent (art. 7, I, of LGPD): with prior consent, Taxcel may use data for advertising and/or marketing purposes, such as promoting products and services on social media, sending communications about products, services, promotions, news, updates, events and other topics of interest, and promoting products and services of commercial partners.
• Processing of event participants' data: for events promoted by Taxcel, registration data may be used to send marketing emails, prospecting and presentation of solutions, sharing name, email and phone of the participant with sponsors and speakers of the Event subject to free, informed and specific consent obtained at registration, and enrollment in Taxcel's CRM database. The data subject may revoke consent at any time, without prejudice to the legality of processing previously performed based on the consent granted.

5. With Whom Do We Share Personal Data?

Only authorized Taxcel employees and contractually bound subprocessors will have access to client and user data. All client and user data and information is confidential and any use will comply with this Policy. Taxcel will undertake all reasonable market efforts to ensure the security of our systems and our clients' and users' data. All client and user information will, whenever possible, be encrypted, provided this does not make its use by Taxcel unfeasible.

• Microsoft Azure: for cloud computing services, including data storage (Azure Blob Storage) and database (Azure SQL Server).
• MongoDB: for database services.
• Conta Azul: for payment processing.
• Mixpanel: usability analysis and heatmap tool used to improve the platform's UI/UX. Only usage and navigation data is recorded. No user-entered data is collected, nor any data that allows identification.
• Busca Legal: technical partner responsible for the Tax Reform Simulator (CBS/IBS) module available in Taxcel Hub. Busca Legal provides rule bases, analytical engines and technical updates used by the module. For the provision of the service, when necessary, technical information and de-identified tax data strictly necessary for the execution of business rules and calculations may be exchanged. No identifiable personal data is shared with Busca Legal in this integration.
• The complete and up-to-date list of our subprocessors, including information about the services provided and the security measures adopted, is available in our Security Center, accessible through our website.
• Some of our subprocessors, such as Microsoft Azure and MongoDB Atlas, may store or process data on servers located outside Brazil. In such cases, international data transfer is carried out in compliance with articles 33 to 36 of LGPD, based on standard contractual clauses ensuring a level of protection equivalent to that established by Brazilian law, or in countries that offer an adequate level of personal data protection.

6. Personal Data Storage

The Company will keep data and information only as long as they are necessary or relevant for the purposes described in this Policy, or for periods pre-determined by law, or as long as they are necessary to maintain Taxcel's legitimate interests. At any time, clients and users may request a copy of their data stored in Taxcel's systems by contacting us by email or phone, available on our website and at the end of this document.

7. Subscription Cancellation and Modification/Deletion of Personal Information

Each client or user may choose to no longer receive any type of email from Taxcel. Every email communication contains an unsubscribe link at the end of the message. By clicking this link, you can remove yourself from the list. If the client or user submits any form again, this constitutes reinstatement of the email in Taxcel's active contacts list, requiring a new cancellation request. Data collected from each client or user may be deleted from the Company's database upon express request, or when no longer necessary or relevant to Taxcel's activities, unless there is another reason for retention, such as a legal obligation, the need to preserve rights, or the need to use the data to provide services. To manage, modify or delete your Personal Data, contact us by email or phone, available on our website and at the end of this document.

8. Other Rights of Users/Data Subjects

Users and clients have the following rights regarding their own data, subject to legal limits: confirmation of the existence of data processing; access to personal data; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary, excessive or non-compliant data; portability of raw data to another service provider, upon express request and within applicable limits; deletion of personal data processed with the data subject's consent, subject to legal exceptions and data necessary for services; information about the public and private entities with which the controller has shared data; refusal of consent for data sharing in applicable situations; and revocation of previously granted consent. To fulfill data subject requests, we may request a copy of your identification document to confirm and validate your identity, due to the existence of potentially malicious persons or homonyms. Requests involving Personal Data and/or documents of other Data Subjects will not be fulfilled, except by power of attorney, parental authority or another hypothesis that authorizes the exercise of another Data Subject's right by you. In situations where you no longer have access to the email registered on our platforms, we may also request a copy of your identification document for login and password recovery. In specific circumstances, your request may not be fulfilled, and we will explain the reasons. To exercise any of the rights mentioned above, contact us by email or phone, available on our website and at the end of this document.

9. Access to Data in the Tools We Offer

• TaxSheets: an on-premises solution, so the data entered remains locally on the user's machine, with no external sharing and/or sharing of personal data with Taxcel or third parties. All data and content entered into the Software by users is the sole and exclusive responsibility of the user. Taxcel does not have access to any tax or accounting information entered by the user in the Software; any tax or accounting declaration is the sole and exclusive responsibility of the declaring party. The client is exclusively responsible for compliance with the legislation regarding the authorization to process personal data made available in Taxcel's Software. Regarding this data, Taxcel qualifies as a Data Processor.
• Taxcel Studio: an on-premises desktop solution focused on the treatment and preparation of tax data, with processing performed entirely on the user's workstation. Connectivity with external environments is restricted, controlled and encrypted, limited to license validation and, when applicable, artificial intelligence assistance features with local execution. In standard processing, tax data is not sent to or stored in Taxcel's cloud environments. All data and content entered into the software by users is the sole and exclusive responsibility of the client. The client is exclusively responsible for compliance with the legislation regarding the authorization to process personal data made available in Taxcel's software. Regarding this data, Taxcel qualifies as a Data Processor.
• Taxcel Hub: Taxcel's SaaS platform, hosted on Microsoft Azure, focused on centralizing, organizing, processing and analyzing tax data. Data entered into the platform, including tax files, XML documents and associated information, is stored in cloud infrastructure under Taxcel's control, with restricted access, encryption in transit and at rest, and team and user permission controls. The platform features Olyve, Taxcel's AI assistant, which uses the user's context data for advanced tax analysis, automated queries and decision support. Data usage by Olyve is subject to permissions and access controls configured for each team. Data entered into the platform is not used to train artificial intelligence models. Taxcel may use any personal data entered into the platform exclusively for the provision of the contracted service and, when applicable, for the continuous improvement of the platform, observing the principles of necessity and minimization and the legal bases provided in LGPD, not using them for any other purpose without the prior consent of the user. All data and content entered into Taxcel Hub by client users is the sole and exclusive responsibility of the client. Regarding this data, Taxcel qualifies as a Data Processor.

10. Confidentiality and Legitimate Use of Data

Taxcel declares and warrants that it has always acted and will always act in accordance with the principles of good faith and loyalty regarding the data and information provided by its users and clients, as defined by Law 9,279/96. Under no circumstances will Taxcel use user data to obtain unfair or disloyal advantage or otherwise benefit from predatory or unlawful use of such data.

11. Changes to the Privacy Policy

If we change the way we handle personal data, this Privacy Policy may be updated. It is recommended that each client or user periodically visit the corresponding page on the Taxcel website to stay updated. Any changes aim to adapt to eventual modifications on our Sites, whether due to new technologies or new legal, regulatory or contractual requirements. If you do not agree with the changes, you have the right to request cancellation of your registration at any time.

12. Applicable Law

This document is governed by and shall be interpreted in accordance with the laws of the Federative Republic of Brazil. The Forum of the District of São Paulo/SP is elected as competent to resolve any questions arising from this document, with express waiver of any other, however privileged.

13. Contact

Any question, request or complaint regarding our privacy policy may be clarified by contacting us via email: lgpd@taxcel.com.br or by phone: +55 (11) 5039-4214. Taxcel's Data Protection Officer (DPO) is Leonardo Souza, who can be contacted at lgpd@taxcel.com.br.