Objective

Your privacy is important to us. It is Cast Group's policy to respect your privacy regarding any information we may collect from you. This policy applies when we act as a data controller or data operators in relation to the personal data of users of our Services. It aims to provide guidelines on Personal Data and how we will treat it. It applies to individuals who interact with Cast group services such as customers, employees, people who access our pages and services ("you"). This Policy explains how your Personal Data is collected, used and disclosed by Cast group ("Cast", "Cast group", "We", "Us"). It also tells you how you can access and update your Personal Data and make certain decisions about how your Personal Data is used.

This Policy covers our online and offline data collection activities, covering the Personal Data that We collect through our various channels, including websites, apps, third-party social networks, Service, Sales and Events. Please note that We may aggregate Personal Data from different sources (website, offline event). As part of this, We combine Personal Data that was originally collected by different Cast group entities or Cast partners.

NORMATIVE REFERENCES

NBR ISO 9001 - Quality Management System.
Lei Geral de Proteção de Dados Pessoais (LGPD) - Law No. 13.709, OF AUGUST 14, 2018.
Marco Civil da Internet - Law No. 12.965, OF APRIL 23, 2014, establishes principles, guarantees, rights and duties for the use of the Internet in Brazil.

AREAS INVOLVED

All areas of Cast group, all group companies and their customers or users, browsers of Cast group pages or services.

DEFINITIONS

LGPD - General Data Protection Law - Law No. 13,709, of August 14, 2018.

ANPD - National Data Protection Authority - This is the body that will supervise and guide the application of the LGPD, as well as being responsible for applying administrative sanctions in the event of a breach of the law.

Legal Basis for Processing - The processing of Personal Data is permitted by the LGPD in accordance with the legal bases provided, such as the consent of the Data Subject, compliance with legal and/or regulatory obligations by Cast group, the existence of a contract between Cast group and the Data Subject, as well as the legitimate interests of Cast group or the Data Subject.

Biometrics - A measurable physical characteristic or personal behavioral trait used to recognize or verify a person's identity. Facial images, fingerprints, fingerprints and iris samples are examples of biometrics.

Consent - The free, informed and unequivocal expression by which the Data Subject agrees to the processing of his or her Personal Data for a specific purpose.

Personal Data - This is any data relating to an identified or identifiable natural person, such as: IP, geolocation, name, ID, CPF, address, telephone number, bank account, vehicle data, among others.

Sensitive Personal Data - This is Personal Data relating to racial or ethnic origin, religious conviction, political opinion, trade union membership, data relating to health or sex life, genetic or biometric data.

Purpose - The reason or motivation for processing Personal Data.

Legitimate Interest - Data processing carried out by the Controller in its own interest, that of other companies or society, without the processing affecting the individual rights and freedoms of the Data Subject.

Free Access - The Data Subject's right to have access to all information relating to the processing of their Personal Data.

Opposition - The Data Subject's right not to have their data processed. This right can be exercised in certain specific situations.

Security - Means the use of technical and administrative measures to protect Personal Data from unauthorized access and accidental or unlawful destruction, loss, alteration, communication or disclosure.

Processing - Any operation carried out with Personal Data, such as: collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, deletion, evaluation, information control, communication, transfer, dissemination or extraction.

Data Subject - The natural person to whom the Personal Data being processed refers.

Transparency - The guarantee to Data Subjects of clear, precise and easily accessible information on the performance of the processing and the respective processing agents, with due regard for commercial and industrial secrets.

Data minimization - Collecting only the personal data necessary for the functionality of the product.

Right of data subjects - Right guaranteed to the user to access, correct and delete the data processed

Retention period - Period in which the data is stored and after a certain period deleted.

Cookies - As is common practice on almost all professional websites (Cast group pages may use cookies), which are small files downloaded to your computer to improve your experience.

Cody: Cast group's mascot for interaction with users, used in the ombudsman channel where users can make complaints, suggestions, ask questions or make compliments anonymously or identified.

DOM: Diagnosis, Optimization and Metrics - Tool used to evaluate the behavioral profile of candidates for vacancies and employees for personal and professional development at Cast group.

PERSONAL DATA WE COLLECT ABOUT YOU, HOW WE COLLECT IT AND ITS PURPOSE

Dependendo de como você interage com a Cast group (online, offline, por telefone e etc.), nós coletamos vários tipos de informações sobre você, conforme descrições a seguir:

Informações pessoais de contato: incluem qualquer informação que você nos fornece e que possa nos permitir contatá-lo, como seu nome, endereço postal, e-mail, endereço comercial, detalhes de redes sociais ou número de telefone.

Informações de login de conta: Qualquer informação que seja necessária para lhe dar acesso ao seu perfil de conta específico. Exemplos incluem seu endereço de e-mail, nome de usuário, senha em formato irrecuperável e/ou pergunta e resposta de segurança, dentre outros para efetuar seu acesso a serviços fornecidos por nós.

Informações técnicas sobre o computador/dispositivo móvel: qualquer informação sobre o sistema de computador ou outro dispositivo que você utiliza para acessar uma de nossas páginas, serviços ou aplicativos, endereço IP utilizado para conectar seu computador ou dispositivo à internet, o tipo de sistema operacional e o tipo e a versão do navegador da web, dentre outras informações de navegação. Se você acessar uma página ou aplicativo da Cast group ou de algum de seus parceiros (como por exemplo: SAP, Localizador Zeus para ponto, Microsoft Office 365, Microsoft Teams), as informações coletadas também incluirão, sempre que permitido, o ID de dispositivo, a localização geográfica e outros dados similares do dispositivo.

Informações de utilização de sites/comunicação: conforme você navega e interage com nossas páginas e serviços, Nós utilizamos tecnologias de coleta automática de dados para coletar determinadas informações sobre as suas ações. Isso inclui informações como em quais links você clica, quais páginas ou conteúdos você visualiza e por quanto tempo e outras informações e estatísticas semelhantes sobre suas interações, como tempos de resposta a conteúdo, erros de download e duração das visitas a determinadas páginas. Essas informações são capturadas por meio de tecnologias automatizadas, como Cookies (Cookies de navegador, Cookies Flash) e web beacons, e também via rastreamento de terceiros. Você tem o direito de se opor à utilização de tais tecnologias.

Pesquisas de mercado e feedback de clientes. Isso inclui informações que você compartilha voluntariamente Conosco sobre sua experiência de uso de nossos produtos e serviços, por meio de pesquisas de satisfação e outros meios que a Cast group utiliza para ter o feedback de seus clientes.

Conteúdo gerado por consumidores/clientes/colaboradores: Refere-se a qualquer conteúdo que você cria e compartilha Conosco por e-mail, em redes sociais de terceiros ou por meio de carregamento para um de nossos sites ou aplicativos, incluindo o uso de aplicativos de rede social de terceiros, como o Facebook, Instagram, etc. Exemplos incluem fotos, vídeos, histórias pessoais ou outros conteúdos e mídias semelhantes. Sempre que permitido, Nós coletamos e publicamos conteúdos gerados por consumidores/clientes/colaboradores em conexão com uma variedade de atividades, incluindo concursos e outras promoções, recursos de comunidade do site, engajamento e redes sociais de terceiros.

Conteúdos gerados no Microsoft Teams: Refere-se as gravações de Reunião e Eventos Ao Vivo, e coleta de dados como: imagem, voz, endereço IP, nome, e-mail, localização geográfica e outras informações de conexão, de todos os participantes. Deve ser informado no convite do evento, que será gravado e que os dados acima serão coletados. Quando for iniciado o Evento Ao Vivo, a gravação é iniciada automaticamente, fazendo necessário que o organizador/palestrante do evento ao vivo informe aos participantes que está sendo gravado o conteúdo que pode ter ou não imagens de vídeo e voz dos participantes. No caso de reuniões, o organizador ou participante que deseja iniciar a gravação deve questionar os demais participantes se pode ou não gravar. Deve também avisar logo após o início da gravação que foi iniciada e requerer que os participantes se manifestem, para que fique gravado no mesmo vídeo tal consentimento.

Informações de redes sociais de terceiros: Refere-se a quaisquer informações que você compartilha publicamente em uma rede social de terceiros ou informações que fazem parte de seu perfil em uma rede social de terceiros (como o Facebook, Instagram, Linkedin, etc. ) e que você permite que a rede social de terceiros compartilhe Conosco. Exemplos incluem suas informações básicas de conta (por exemplo, nome, endereço de e-mail, sexo, data de nascimento, cidade atual, foto de perfil, ID de usuário, lista de amigos e etc.) e quaisquer outras informações ou atividades adicionais que você permita que a rede social de terceiros compartilhe. Nós recebemos suas informações de perfil de rede social de terceiros (ou partes delas) sempre que você interage Conosco, nos marcando ou cintado por meio de uma rede social de terceiros. Para saber mais sobre como suas informações de uma rede social de terceiros são obtidas pela Cast group ou para optar por não compartilhar essas informações de rede social, visite o site da rede social de terceiros específica.

Informações financeiras e de pagamento: Quaisquer informações que Nós precisemos para atender a um pedido/contrato/faturamento, ou que você usa como dados de faturamento ou cobrança. Em qualquer caso, Nós ou nossos prestadores de serviço de processamento de pagamentos lidamos com as informações financeiras e de pagamento em conformidade com as leis, normas e os padrões de segurança aplicáveis.

Dados Pessoais Sensíveis: Não temos a intenção de coletar ou processor dados pessoais sensíveis no curso normal de nossas atividades. Quando for necessário processar seus dados pessoais sensíveis por qualquer motivo, nos apoiaremos em seu prévio e expresso consentimento para qualquer processamento que for voluntário (por exemplo, prevenção a Covid-19, biometria para acesso as instalações ou ponto, para finalidades de marketing, etc.). Se processarmos seus dados pessoais sensíveis para outras finalidades, Nós nos apoiamos nas seguintes bases legais: detecção e prevenção de crime (incluindo a prevenção de fraude); e cumprimento da lei aplicável (por exemplo, para cumprir com nossos relatórios de diversidade).

Dados Pessoais De Crianças: Nós não solicitamos ou coletamos, dados pessoais diretamente para crianças e menores de idade. Entretanto, a Cast group pode coletar dados pessoais de crianças e menores de idade por meio dos pais ou tutores diretamente, e com consentimento explícito de ao menos um dos tutores para utilização interna (exemplo plano de saúde e outros benefícios e ou obrigações). Podemos divulgar fotos e nomes das crianças com seus pais ou tutores em redes sociais e ou por e-mail em campanhas de engajamento e promoções com a expressa autorização do responsável.

COOKIES/SIMILAR TECHNOLOGIES, LOG FILES AND WEB BEACONS

In this Policy we will talk about Cookies and how you can manage your Cookie preferences. We will also provide detailed information on which Cookies are used and for what purpose. We will also talk about other similar technologies.

COOKIES (NAVIGATION TRACKERS)

How and why do we use Cookies? We use Cookies to improve the use and functionality of Cast group's pages and services and to better understand how our visitors use them, as well as the tools and services offered there. Cookies help us tailor Cast group's pages and services to your personal needs, make them easier to use, receive satisfaction feedback and communicate with you from other places on the internet.

What types of Cookies may be used on Cast group's and its partners' pages and services? We may use the following types of Cookies:

Session Cookies - These are temporary Cookies that are deleted when you close your browser. When you restart your browser and return to the site that created the cookie, that site treats you as a new visitor.

Persistent cookies - These cookies remain in your browser until you delete them manually or until your browser deletes them according to the duration period set by the cookie. These Cookies will recognize you as a returning visitor.

Necessary Cookies - These are Cookies that are strictly necessary for the operation of a Cast group page or service. They allow you to navigate the site and use our features.

Cookies that send us information about you - These Cookies are placed by us on a Cast group or partner page and can only be read by that Site. These are known as "first party" Cookies.

Cookies that send information to other companies - These are Cookies placed on a Cast group website by third parties (e.g. Facebook, etc.). They may use the data collected by these Cookies to anonymously send you targeted advertisements from other websites, based on your visit to the Cast group website. e.g. if you use a social widget (e.g. Facebook icon) on a Cast group website, it will record your "share" or "like". Facebook (being the company that placed the cookie) will collect this data.

Managing your cookies/preferences: You should ensure that your computer settings reflect whether you consent to accepting Cookies or not. You can set your browser to warn you before accepting Cookies or simply refuse them. You do not need to have Cookies to use or browse most of Cast group's and its partners' pages and services, although you will probably not be able to access all of their features in this case. By accessing the "help" button on your browser (e.g. Internet Explorer, Firefox, Chrome, etc.) you can find out how to enable, disable and clear cookies. You can also search for further actions. Remember that if you use different computers in different locations, you will need to ensure that each browser is set to your Cookie preferences. As the web beacon is part of a web page, it is not possible to use the "Disallow" feature in relation to that beacon, but you can make it ineffective by using the "Disallow" feature for Cookies placed by that beacon. In addition, where available, you can decide whether to allow Cookies to be placed on your computer or to opt-out of Cookies by visiting the following websites and selecting which company's Cookies you wish to refuse: http://www.aboutads.info/choices/#completed or http://www.youronlinechoices.eu/

Example of cookies:

Other similar technologies:

The websites or services of Cast group or its partners may also use other tracking technologies, including IP addresses, log files and web beacons, which also help us to tailor our websites to your personal needs.

IP addresses - An IP address is a number used by computers on the network to identify your computer every time you connect to the internet. We may record IP addresses for the following purposes: (i) technical issues the user visited on our website and how long they stayed on it); and, (iii) other navigation or click count data (e.g. website traffic reporting and unique visitor counts).

Web beacons - We may use web beacons (or transparent GIFs) on Cast group's and its partners' pages or services. Web beacons (also known as "web bugs") are small sequences of code that allow the delivery of a graphic image on a web page for the purpose of transferring data back to us. We use information from web beacons for a wide variety of purposes, including information about how a user responds to email campaigns (e.g. the time the email is opened, what link the user makes from the email), website traffic reports, unique visitor counts, advertising and email auditing and reporting, and personalization.

USES OF YOUR PERSONAL DATA (PURPOSES)

The following table describes the various purposes for which We collect your Personal Data, and the different types of Personal Data We collect for each purpose. Please note that not all of the uses below will be relevant to all individuals.

DISCLOSURE OF YOUR PERSONAL DATA

By using, registering, contracting or interacting with Cast group, you acknowledge that the personal data You provide to Cast group through the Services or our products may be available to operators around the world, since, to ensure the security of your data, We share it, when necessary, with the following types of third-party organizations:

Service providers. These are external companies that We use to help Us operate Our business (e.g. employee information, supplier information, order fulfillment, payment processing, fraud detection and identity verification, website operation, market research companies, support services, promotions, website development and data analysis.

STORAGE AND/OR TRANSFER OF YOUR PERSONAL DATA

Measures We Expect You to Take: It is important that You also play a role in keeping your Personal Data secure. When you create an online account, a password on one of our systems, etc., please make sure you choose a password that is difficult for others to guess and never reveal your password to other people. You are responsible for keeping this password confidential and for any use of your account. If you use a shared or public computer, never choose the option to remember your login ID, e-mail address, login or password and make sure that you log out of your account whenever you leave the computer/device. You should also use any privacy settings or controls that We provide on our website, services or applications.

PROCESSING OF PERSONAL DATA

Cast group may process the personal data collected for:

Execution of environmental and social responsibility projects and activities;
Execution of fraud prevention processes;
Execution of relationship and customer service activities;
Sale of products and/or services;
Execution of marketing activities aimed at attracting new customers;
Profile analysis (profiling);
Analysis of indicators and metrics;
Granting of benefits;
Recruitment and admission and training processes;
Execution of contractual activities related to the products and/or services acquired;
Compliance with legal and regulatory obligations;
Credit analysis;
Risk analysis;
Carrying out research and various statistical surveys;
Responding to requests from clients, former clients and prospects;
Improving the products and services offered;
Comply with the determinations of competent authorities;
Make automated decisions (including the creation of profiles) in order to calculate premiums and personalize its products/services to suit the needs of those who use our digital platforms.

Legal proceedings

Cast group may also use the information collected anonymously, without the possibility of direct or indirect association with specific people who use our platforms, in order to improve and personalize the products and/or services we provide.

YOUR CHOICES ABOUT HOW WE USE AND DISCLOSE YOUR PERSONAL DATA

The following mechanisms give you the following control over your Personal Data:

Cookies/Similar Technologies: You manage your consent through our consent management solution or your browser, to refuse some or all Cookies/similar technologies, or to alert you when they are being used.

INSTITUTIONAL COMMUNICATION TOOLS AND VIDEO CALLS (MICROSOFT TEAMS AND BLUEJEANS)

Third-party software used for communications may collect data such as image, voice, IP address, name, e-mail address, geographical location and other connection information from all participants.

Live Events (Live / Webinar)

By default, when the Microsoft Teams Live Event is started, the recording is started automatically, making it necessary for the organizer/speaker of the live event to inform the participants that the content is being recorded. By staying in the Live Event, you agree to the collection of this information. The content of the recording may be used in other opportunities and/or promotions.

Meetings

By default, recording is disabled. If recording is required, the organizer must request permission to record the meeting from the participants before the recording begins and inform them as soon as the recording starts that they are being recorded. By remaining in the meeting, participants agree to the collection of this information. The content of the recording may be used in other opportunities and/or promotions.

NON-INSTITUTIONAL COMMUNICATION TOOLS AND VIDEO CALLS (WHATSAPP, TELEGRAM, FACEBOOK MESSENGER, SKYPE, FACETIME, WEBEX, GOOGLE MEETING, ZOOM, AMONG OTHERS)

Unofficial communication tools are not allowed, except when used with partners. The tools they provide must be authorized in advance by Corporate IT and must comply with the LGPD. In such cases, when using them, the recommendations of the institutional tools should be followed.

Changes to this Policy

If we change the way we treat your Personal Data, we will update this Policy. We reserve the right to make changes to our practices and this Policy at any time. Please check back frequently to see any updates or changes to our Policy.

Form of contact

For questions, comments or complaints about this policy and our privacy practices, please contact Arthur Juan Moragas (Data Protection Officer - DPO) at lgpd@www.castgroup.com.br.

Cast group's external communication channels

By sending your data to our communication channels listed below, you agree to the processing of the personal data sent in order to deal with your requests, complaints, assessments, reports and compliments.

Talk to HR: This communication channel is intended for employees and former employees to communicate with Cast group's Human Resources department, to make a wide variety of requests. The information sent voluntarily by the requester is processed by the various areas responsible for dealing with the request, depending on its content and content.
The former employee, when sending an e-mail to the address possoajudar@www.castgroup.com.br, is informed that they have 24 working hours to agree to the processing of their data. If they disagree or do not respond within 24 working hours, all the data sent will be permanently deleted and the request will not be fulfilled. If they agree to the processing in accordance with the terms of the LGPD (Law No. 13,709/18), as well as the collection and processing of personal and/or sensitive data necessary to respond to their request, the ticket will be forwarded to the team responsible for responding to and resolving it.

Talk to Cody: A Cast group ombudsman page where, via a form, users can make reports, complaints, compliments and criticisms to Cast group anonymously or identified. The information is provided spontaneously by users and will be dealt with by the Cast group team responsible according to its content.

DOM: Tool used by the Recruitment teams and the People Development team to select internal and external candidates, and to build an Individual Development Plan. It collects behavioral profile data by filling in a questionnaire that can be accessed via a link sent by our team, after identifying who is filling it in.

SPECIAL SECTION - COVID-19

(exclusively applicable to employees, contractors and visitors to Cast group premises)

In addition, as a result of measures to prevent and control the spread of Covid-19, Cast group may also collect personal information from its employees, contractors and visitors to its premises, as follows:

Covid-19 status and health history;
Workplace information;
Body temperature.

The collection of the above data is intended to help reduce the risk of Covid-19 spread on Cast group premises. To help reduce the risk of Covid-19 infection and keep our communities safe, all employees, contractors and visitors to Cast group premises will be able to complete a daily health survey and undergo a thermal body temperature screening to gain access to Cast group facilities. Thermal screening measures your body temperature anonymously and Cast group does not retain your body temperature. If your body temperature is 37.7 degrees Celsius or higher, you will be denied entry and/or asked to leave Cast group's premises. According to local legislation, masks are also compulsory, and without them you cannot enter Cast group premises. The tool used to carry out the health survey screening, available via email address, collects your name, email address and certain health data that you provide voluntarily. This information will not be shared with Cast group unless you report that you are positive for COVID-19. In this case, you will notify the HR team so that they can contact you and take the appropriate measures to protect the health and safety of people on Cast group premises. Your positive Covid-19 status will be shared with Cast group's HR team. Your status will also be shared anonymously with potentially infected individuals (who work in the same environment) for contact tracing purposes.