This Privacy Policy (“Policy”) aims to inform spread.chat users and other data subjects about how their personal data will be processed when they access and use the spread.chat website and platform, when they interact through Smart Contacts (Chatbots) created via spread.chat, or when they interact with the Company through other channels.

1. How do we collect your personal data?

When you access and use our website or the spread.chat platform, or when you interact with spread.chat through other channels, we may collect your personal data in different ways, including (but not limited to) the examples below:

• • By information you provide, when you enter details to register on the spread.chat platform, or when you contact the Company directly through other channels such as phone, email, or messages on our social networks.
• • By automatic collection of data, such as your device type, unique device identifier, browser type, and approximate geographic location, via your browser tools and other technologies like cookies (see Section 7 of this Policy).
• • By receiving your personal data from recruiting firms, referrals, or other people who share your data with us to enable your participation in recruitment processes conducted by the Company.
• • By receiving your personal data through our partners, group companies, service providers, vendors, or third parties—for example, where we have business relationships with your employer, we may receive your personal data to ensure communication and confirm your identity as that company’s employee, or to set up your account on the spread.chat platform. We also receive your personal data from companies with which you have a commercial relationship and that use chatbot services or other solutions provided by spread.chat.

2. Why do we collect your personal data?

spread.chat processes your personal data for various purposes, depending on your relationship with the Company and the way you interact with us.

The main purposes for which we collect, process, or otherwise handle your personal data include:

• • User registration. We will process the personal data necessary to register you as a user on the spread.chat platform, enabling the creation and management of your account, whether linked to your employer or directly to you.
• • Creation and use of the spread.chat platform. We will process personal data to enable the features you use to create and operate the chatbot—such as Builder, Contacts, Agent Console, Payments, among other features.
• • Billing for the platform and other products/services. When you or your organization purchase one of the spread.chat plans, we will process your personal data to enable the transaction and payment for our services.
• • Responding to inquiries, praise, complaints, suggestions, and communicating with you. When you contact us—whether through our website, by phone, by email, via customer support and relationship sites, or any other communication channel—we will process your personal data to communicate with you, respond to your questions, praise, complaints, or suggestions, as well as any message you have sent us, including to report technical issues with our website, the spread.chat platform, or any other solutions offered by Rvops.
• • Promotion of our activities. We will process your personal data to send our newsletter, invitations to events organized by the Company and/or partner companies, and updates on our services, research, studies, news, podcasts, videos, promotions, new solutions, or any other content or materials we produce to promote our activities.
• • Marketing and product/service information. If you already have a commercial relationship with the Company, have interacted with us previously, or have subscribed to receive materials and updates from spread.chat through our website, content downloads, or sponsored media, we may process your personal data for marketing and/or to send information about spread.chat’s products or services.
• • Contacting potential customers, leads, and prospects. If you filled out the form on our website to contact our Sales team, provided your information via landing pages, or if we identify that you or your organization may be interested in our products or services, we will process your personal data to promote our activities, contact you, and share information about spread.chat’s solutions.
• • Conducting satisfaction surveys. We may process your personal data to carry out satisfaction surveys, to identify whether our products or services are being well received and what could be improved to enhance usability and operability.
• • Recruiting new employees. When you send us your resume via email, social networks, instant messaging apps, among others, when we receive your resume from third parties, or when we have an open position and look for professionals in the market, we will process your personal data to recruit new employees—contacting you and enabling you to participate in all stages of the respective selection processes, such as interviews, group dynamics, practical or theoretical tests, and other recruitment activities—to assess the compatibility of your professional profile with the open role.
• • Analyzing use of our platform. When you access and browse our website or the spread.chat platform, we process your personal data to understand aspects related to usage—such as pages visited and session duration, interactions via spread.chat, the most used tools, among others—to improve the content we provide to visitors, customers, and data subjects. We also process your personal data to measure email engagement and interactions with our published content, so we can understand which materials are best received by our users.
• • Ensuring the security of our platforms. We will process your personal data to ensure the security of the website and the spread.chat platform, evaluating unusual usage patterns, unexpected high-volume access requests, login attempts with invalid credentials, among other actions that may indicate a cyberattack or threats to the confidentiality, integrity, or availability of our systems.
• • Complying with legal, regulatory, or court orders. When we need to fulfill legal or regulatory obligations, or court orders, we will process the personal data necessary for such purposes, including sharing data with public authorities and the Judiciary.
• • Defending ourselves in judicial, administrative, or arbitral proceedings. Where necessary, we will process your personal data to defend our interests in legal, administrative, or arbitral proceedings brought by you or third parties against us, or brought by us against you or third parties.
• • Ensuring the safety of our premises and employees. If you visit our physical premises, we will process your personal data to ensure the safety of our employees and facilities, including the security of the information we store—whether personal data, trade secrets, or other corporate information.
• • Protecting your health and the health of our employees and third parties. If you visit our physical premises, we may process your personal data to ensure that you, our employees, or third parties do not present symptoms of a communicable disease (especially COVID-19) that could compromise everyone’s health.
• • Evaluating new acquisitions. We will process your personal data when necessary during the evaluation of potential acquisitions of products, services, or equity interests in other organizations—especially during legal or tax due diligence—during which we may access information about employees of organizations we are considering as business partners or potential equity acquisitions.
• • Investigating reports/complaints. When you initiate or are involved in a report made through our Whistleblower Channel regarding conduct that is inconsistent with our corporate values or that violates applicable law, we may process your personal data to investigate such reports and, if you are the reporter and choose to reveal your identity, to update you on the progress and outcome of the investigation.
• • Credit analysis. Where Spread.chat sells products or services to you, we will process your personal data to assess your ability to meet financial obligations and to protect our credit.
• • Holding meetings, video conferences, or conference calls. We will process your personal data to hold meetings, video conferences, or conference calls—including, depending on the medium used, your image and voice, as well as identification data and electronic contact information to send invitations and access links.
• • Receiving third-party referrals. We will process your personal data when we receive referrals from third parties about your potential interest—or your organization’s— in contracting our products or services, enabling us to contact you to present our solutions.
• • Conducting internal audits. We will process your personal data when necessary to conduct internal audits of our platforms and systems, including financial, tax, and accounting audits; compliance audits with the laws and regulations to which we are subject; financial and risk control audits; audits related to reorganization, sale, assignment, or transfer of part or all of our assets; audits required by Government Authorities; or any other audits necessary or relevant for the proper development of our business.

3. What data do we collect?

To achieve the purposes indicated above, we may process one or more of the following personal data, to the extent necessary for each specific purpose:

• • User registration data. If you are a user of the website or the spread.chat platform, we will process data such as your full name, email, and phone number to create your account and to send our newsletter and marketing emails. For our Sales team to contact you, we will process the data provided in the form, such as your full name, email, phone number, and your role in your company. To process payment for one of the spread.chat plans, we will process your name, taxpayer ID (CPF), information about the organization you represent, and contact details.
• • Usage and device data. We will process data related to your use of the website and the spread.chat platform, such as clicks, page scrolls, cursor movement, pages visited, geolocation, access date and time, your device’s IP, browser used, device type, language preference, features used, registrations performed, among others.
• • Data for chatbot operation. We will process personal data of users who interact with the Smart Contacts on the spread.chat platform—either on our own behalf or on behalf of our clients for whom we act as a Processor—such as full name, location, phone number, the content of your message; personal data of human agents providing manual support (e.g., full name, status, and working hours); the content of pre-formatted chatbot messages and your responses; and data for chatbot configuration, such as the chatbot’s name, description, image, welcome messages, and connection details, among others.
• • Other information. We will process additional data that may be voluntarily included by users in resumes or in communications sent to the Company via forms, email, correspondence, or any other means.

4. With whom is your personal data shared?

We may share your personal data with:

• • Companies within our corporate group. We may share your personal data with other companies in our corporate group to improve our products or services and gain efficiency in our operations—such as by using unified or integrated systems within the same group.
• • Our partners, service providers, and vendors. To conduct our business activities, we maintain relationships and contract with various partners, service providers, and vendors that are essential to our operations. Some of these partners and vendors may need access to the personal data we collect to perform their functions—such as cloud hosting providers or email communication solutions, external recruiters, auditors, banks, and affiliated companies—in which cases we will share your personal data with them. We assess all partners and vendors, requiring that personal data be processed in compliance with all applicable laws and with appropriate information security, in order to minimize any risks in data sharing.
• • External advisors. We may share your personal data with external advisors who provide services to us, including financial, accounting, legal, or technical advisors who need access to data to perform their contracted activities.
• • Government Authorities. We may share your personal data with any Government Authority that requests it, including labor or financial supervisory bodies, so that we can comply with our legal or regulatory obligations.
• • Judiciary. We may share your personal data with judicial bodies whenever necessary to comply with a court order, our legal or regulatory obligations, or for the regular exercise of our rights.
• • Law enforcement authorities. We may share your personal data with police authorities or bodies with police powers, such as the Public Prosecutor’s Office, whenever we suspect or confirm any unlawful or criminal act, when necessary to protect our employees, our rights, and our property—even if there is no specific legal or regulatory obligation requiring the sharing.
• • Third parties interested in a business combination or acquisition. We may share your personal data with third parties interested in a combination or acquisition of our business, with whom we are discussing potential merger, acquisition, or spin-off transactions of the Company, its business units, or specific assets—both during the due diligence phase carried out by third parties on the Company’s business and thereafter, with the definitive transfer to the acquiring company or person, where applicable. In the event of any insolvency or restructuring process of the Company, your personal data may also be shared with third parties that acquire our business or assets.
• • Third parties indicated by you. We may share your personal data with third parties you have indicated, upon your request and based on your consent.

5. What are the legal bases authorizing the processing of your personal data?

All our personal data processing operations are always carried out under a legal basis provided for in the applicable legislation, in accordance with the particularities of each processing activity.

The legal bases we rely on to perform our processing activities include:

• • Compliance with legal or regulatory obligations. In certain situations, we process your personal data to fulfill a legal or regulatory obligation—for example, when we retain logs of your access to our website or applications in accordance with Article 15 of Law No. 12.965/2014 (the “Brazilian Internet Civil Framework”).
• • Contract performance. When you decide to use the spread.chat platform, we establish a contractual relationship with you based on your acceptance of spread.chat’s Terms of Use and— for paid plans—on a signed Agreement for the provision of features. In such cases, we will process the personal data necessary to perform the contract, such as your full name, email, and phone number, to link your registration to the platform.
• • Regular exercise of rights. We may process your personal data when necessary to enable the regular exercise of our rights under contracts or in administrative, judicial, or arbitral proceedings—for example, by indicating your registration data in a lawsuit filed by you against the Company.
• • Protection of life or physical safety. We will process your personal data when necessary to protect life or physical safety—yours or that of third parties—such as when measuring your body temperature before allowing entry into one of our physical premises, to ensure you do not show signs of contagious diseases that could infect our employees or third parties.
• • Credit protection. We will process your personal data when necessary to protect our credit—for example, where we need to verify your ability to pay for products or services offered by spread.chat.
• • Legitimate interest. We will process your personal data when we have a legitimate interest in doing so, except where your fundamental rights and freedoms prevail—for example, when we promote our activities by sending emails to our customers.
• • Fraud prevention and data subject security. We will process your personal data when necessary to ensure fraud prevention and the security of the data subject, in identification processes and authentication of registrations in electronic systems.
• • Consent. Where no other legal basis is applicable, we may process your personal data based on your free, informed, and unambiguous consent, which may be revoked at any time, free of charge and easily.

6. How long do we process your data?

spread.chat is committed to processing your personal data only for the period necessary to achieve the specific purposes of each processing activity, retaining the data for the shortest possible time—taking into account all existing legal and regulatory obligations and the need to defend the Company’s interests in judicial, administrative, or arbitral proceedings.

Accordingly, retention periods are defined by the Company based on the specific characteristics of each processing activity, including processing purposes, existing legal or regulatory obligations, among other criteria relevant to this definition.

7. Cookies

Cookies are text or image files made available on our website and stored on the devices used by Users who access it, enabling operation, performance, and optimized navigation.

Cookies may also be used to measure performance metrics, ensure proper and secure site operation, provide a better user experience, understand how the site works and where it needs improvement, and collect information about user behavior. There are several types of cookies. On our website, we use the following:

• • Strictly necessary cookies. Essential for our website to function, ensuring security and proper performance; without them, the site would not work correctly.
• • Preference cookies. Store information about your preferences—such as language and region—enabling a better browsing experience.
• • Analytics cookies. Collect information about your behavior while browsing our website—such as pages accessed, time on page, and least-accessed pages—so we can improve the site’s quality.

One example is cookies provided by Google Analytics, which help us understand how users interact with our platform so we can identify opportunities to improve our services.

Cookies may also be used to measure performance metrics, ensure proper and secure site operation, provide a better user experience, understand how the site works and where it needs improvement, and collect information about user behavior. There are several types of cookies. On our website, we use the cookies listed above.

Each browser provides its own way to configure cookies. By accessing the respective websites, you will be subject to other companies’ privacy policies, which may not be consistent with or similar to this Policy. To learn more about how to manage and delete cookies in your browser, visit:

• • How to remove cookies in Google Chrome
• • How to remove cookies in Mozilla Firefox
• • How to remove cookies in Internet Explorer
• • How to remove cookies in Safari

8. What are your rights as a data subject?

You have a number of rights regarding your personal data, and spread.chat is committed to fully respecting them in its role as a Data Processing Agent. Your rights include:

• • Confirmation of processing. Request confirmation of whether your personal data is being processed.
• • Access. Request a copy of your personal data processed by us, either electronically (secure and appropriate) or in printed form, according to your preference.
• • Rectification. Request correction of your personal data that is incomplete, inaccurate, or outdated.
• • Anonymization, blocking, or deletion. Request anonymization, blocking, or deletion of your personal data where it is unnecessary, excessive, or processed in violation of the law.
• • Portability. Request portability of your personal data to other content platforms, as regulated by the Brazilian National Data Protection Authority (ANPD), subject to spread.chat’s trade and industrial secrets, if any.
• • Information about sharing. Request information about the public and private entities with whom we share your personal data.
• • Information about the possibility of refusing consent. Receive information about the option not to provide consent, when consent is the applicable legal basis for processing personal data, along with the consequences of such refusal.
• • Withdrawal of consent. Withdraw your consent easily and free of charge by notifying spread.chat’s Data Protection Officer or through other formats made available by the Company exclusively for this purpose. Please note that withdrawing consent does not invalidate or render unlawful any personal data processing activities performed prior to the withdrawal date.
• • Objection to processing. Object to processing—stating your reasons—where consent is not the applicable legal basis and when there is any violation of the LGPD (Brazilian General Data Protection Law). spread.chat will assess whether your objection is justified and will take the necessary measures to suspend processing or inform you of the grounds on which it believes the processing is lawful and permitted.
• • Complaint. File a complaint regarding spread.chat’s processing of your personal data with the National Data Protection Authority. However, we hope you will give us the opportunity to address any questions or complaints directly first. Our Data Protection Officer is available to clarify any questions and assist you in handling any complaints.
• • Deletion of data processed with consent. Request deletion of your data where consent is the legal basis for a given processing activity, without prejudice to our ability to continue storing the data when necessary to comply with a legal or regulatory obligation or to defend our interests in judicial, administrative, or arbitral proceedings.

9. Data Access/Deletion Requests and how to exercise your rights

You may exercise all these rights at any time, free of charge—unless charging a fee is allowed by applicable law or regulation—and spread.chat is committed to using its best efforts to handle your requests transparently and promptly.

If you wish to request deletion of personal data or exercise any other data subject rights, please contact us at: [email protected].

To ensure rights are exercised by you or your duly authorized legal representative, spread.chat may request information or proof necessary to verify your identity, in order to prevent fraud and safeguard your privacy so your personal data is not shared with anyone without authorization.

We will respond to your requests within a reasonable period, in accordance with applicable law. Please note that we may only respond to certain requests after receiving the confirmations described above.

In certain cases—such as when your request is particularly complex or when we receive a high volume of requests at once—our response may not be as fast as we would like. In such cases, we will keep you informed and updated on the status of your request.

In situations where we act as a Personal Data Processor on behalf of companies with which you have a relationship, it is those companies’ duty to respond to your requests to exercise the rights listed above. If you send your request to spread.chat, we will identify the Controller of your Personal Data for that processing activity and forward your request to that organization. As we process data only at the respective Controllers’ direction in these cases, we are unable to fulfill your requests without the Controllers’ express authorization.

10. Information Security

spread.chat adopts technical and organizational measures—based on market best practices—to protect your personal data against unauthorized access or unlawful/accidental situations of destruction, loss, alteration, disclosure, or any other form of improper processing. Your data is stored in a secure operating environment that is not accessible to the public.

Measures we adopt to protect your personal data include: access controls; monitoring of access to local networks and remote connections via VPN; user authentication; antivirus; firewall; backups; periodic system testing and scanning; and data encryption in transit and at rest, among others.

We know no Internet transmission is 100% secure; therefore, the security of your data also depends on reasonable measures adopted by you when using your devices and software. It is important that you protect information such as the email and password used to authenticate on the spread.chat platform. This helps prevent others from accessing your services.

The security of your data also depends on reasonable measures adopted by you when using your devices and software. If you identify or become aware of anything that may compromise the security of your personal data—or of any potential vulnerability on our website or systems—please contact us.

11. Third-Party Websites

Our website may provide links to third-party websites. These websites have their own privacy policies, which may not be consistent with this Policy. We recommend reviewing those third parties’ privacy policies to learn about their personal data protection practices.

spread.chat is not responsible for the data protection practices of third-party websites, nor for their content, which is not in any way validated, endorsed, or subscribed to by spread.chat.

12. How to contact us

If you have any questions about this Policy or about how your personal data is processed by spread.chat—or if you wish to submit complaints, suggestions, or comments about our personal data processing practices—please contact us at: [email protected].

We have a duly appointed Data Protection Officer who is ready to address all your questions or complaints and serves as your point of contact with spread.chat regarding the processing of your personal data.

You can contact our Data Protection Officer directly at: [email protected].

13. Details of the Data Processing Agent

Rvops CRM, registered under CNPJ/ME No. 48.552.928/0001-05, headquartered at Av. Nove de Julho, No. 3575 – Suite 1009 – Jundiaí, is responsible for processing the Personal Data defined herein, in accordance with the definition provided by the Brazilian General Data Protection Law.

14. Updates

As our goal is to continually improve our services, this Privacy Policy may undergo changes and updates over time, to better reflect our personal data processing practices and to provide greater security and transparency in our operations. When relevant changes are made, we will post a notice on the main page of our websites so you can quickly identify that an updated version of this Policy is available.

For personal data processing activities that we carry out based on your consent, if changes to this Privacy Policy result in material changes to our personal data processing practices, we will request your consent again, based on the updated terms of this Policy.

We recommend that you periodically review this Policy to familiarize yourself with any changes.