Privacy and Personal Data Protection Policy

1.1. Before explaining how we process your Personal Data, we define below some of the terms used in this Policy. This will allow you to refer to their meanings whenever you have any questions:

• a) News and Promotions: if you provide your name and email address, we will use this Data solely to send you our “newsletter,” which includes MEMO’s latest news and promotions. You may opt out of receiving communications for this purpose at any time.
• b) Customer Service: you may contact us through the channels available for “Technical Support,” “Contact Us,” “Customer Service,” “Representatives,” and “Request a Quote.” We will generally only need your name and email address or phone number to initiate the service, but additional Personal Data may be collected during the interaction when necessary to provide the services you expect and deserve.
• c) Online Store: to make purchases on our website, we will need certain Personal Data from you to process the transaction. Initially, you will be asked to provide your Brazilian Taxpayer ID (CPF) or email address to log in. We will then request your full name, CPF, and phone number so that we can contact you and issue the corresponding invoice. Once you have selected a product, we will request your delivery address and payment information (for credit card payments, we collect the card number, cardholder’s name, expiration date, and security code).

On our website, we may also collect Personal Data through “Cookies,” which are small pieces of text or code primarily used to monitor traffic, identify users and their sessions, and track and record activities on the website. These technologies help you connect to our services, remember your settings and preferences, and maintain the security of your information. Below, we explain the types of Cookies that are or may be used on our website, as well as the third parties involved.

Third-Party Cookies are Cookies that operate through our website but are provided by third-party providers to enable certain features during your browsing experience. It is important to note that, in such cases, the third parties that created the Cookies are responsible for any Processing of Personal Data carried out through them, as MEMO has no control over how such information is used or stored through these Cookies.

2.1.1. Resumes will be accepted exclusively through our website (https://platform.senior.com.br/hcmrs/hcm/curriculo/?tenant=memoindbr&tenantdomain=memo.ind.br#!/login/register). As a best practice, we ask you to provide only the minimum Personal Data necessary for us to assess your suitability for the position you are applying for. If additional information is required, we will request it at the appropriate time.

2.1.2. Resumes submitted to MEMO through other channels will be promptly deleted without being reviewed.

2.2.1. To purchase MEMO products, whether in person, by phone, email, or through our Online Store, you will need to provide us with the Personal Data necessary to process the transaction. This will generally include identification data (name and CPF), contact information (phone number and email address), delivery information (business or residential address), and payment information (credit card details or information related to the payment method used by the Data Subject).

2.2.2. Depending on the order amount and payment method, we may need to conduct a credit assessment. In such cases, you will receive a link to an online form where you can provide the necessary information. Rest assured that we will not collect any Data that is not strictly necessary to conduct the assessment.

3.2.1. For the Processing of your Personal Data for recruitment and selection purposes, we rely on the legal basis set forth in Article 7, IX, of the LGPD, namely, our Legitimate Interest in identifying a candidate who is a suitable match for the position available. As the recruitment process progresses, we may also rely on Article 7, V, of the LGPD, since the analysis of the Data contained in your résumé and other documents constitutes a preliminary procedure related to an employment agreement to which you, as a candidate, are interested in becoming a party.

3.3.1. To process your purchase of our products, we will process your Data based on Article 7, V, of the LGPD, namely, as necessary for the performance of our purchase and sale agreement. When a credit assessment is required, we will rely on Article 7, X, of the LGPD, which allows the Processing of Personal Data for credit protection purposes.

3.4.1. When you participate in UNIMEMO ACADEMY, we will process your Personal Data based on the Company’s Legitimate Interest (Article 7, IX, of the LGPD) in providing content about our products, as well as on the performance of a contract (Article 7, V, of the LGPD) when you purchase a course or other material.

• a) For Personal Data collected through Cookies, the storage period will be as set forth in Section 2.1.2 and the following sections of this Policy.
• b) Personal Data collected for the purpose of promoting our products and sharing news will be retained for as long as you wish to receive such communications.
• c) If you purchase a product, your Data will be retained for as long as necessary to comply with applicable laws (the Brazilian Civil Code, Consumer Protection Code, etc.) and to allow MEMO to protect its legal rights.
• d) For business relationships, provision of services, and similar matters, we will retain your Data for as long as necessary to perform the contract or comply with the legal obligations arising from it.

4.1.1. If it is necessary to retain your Data after the Processing has ended, MEMO will do so in accordance with Article 16 of the LGPD.

4.2.1. The Personal Data collected by MEMO will be stored through cloud services provided by our suppliers, including the SENIOR, AWS, and AZURE platforms. Their servers may be located outside Brazil. These providers comply with applicable data protection laws and have their own privacy policies.

5.1. Personal Data will only be shared under the circumstances described below.

• a) Employees and Service Providers: your Data may be accessed by our employees and service providers only to the extent strictly necessary to fulfill a specific purpose. (e.g., when you purchase a product through our Online Store, we process your order internally and share the necessary Data with the carrier responsible for delivering it).
• b) Business Partners: we may share your Data with partners who assist us with marketing and lead generation activities. Such Data will only be used for purposes that are within your reasonable expectations.
• c) Legal Obligations / Judicial or Extrajudicial Proceedings: we may share your Data to comply with a legal obligation or to exercise our rights in judicial or extrajudicial proceedings.

5.3. MEMO requires all third parties with whom it shares or provides access to Personal Data to comply with the LGPD. We formally establish, through contractual agreements, the obligation to process your Data only to the extent strictly necessary for the purposes set forth in this Policy, as well as to implement appropriate technical and administrative measures to protect it.

6.1. The Personal Data processed by MEMO will remain under its custody for as long as necessary to fulfill the purpose communicated to and informed to the Data Subjects, as well as for the retention periods required by applicable law.

6.2. If the Data is processed based on your consent, you may revoke your consent by submitting an express request to dpo@memo.ind.br, which will result in the termination of the Processing. This measure will be taken within 15 (fifteen) days of MEMO’s receipt of the request.

• a) confirmation of the existence of Processing of Personal Data;
• b) access to information relating to the Personal Data we hold;
• c) correction of incomplete, inaccurate, or outdated Data;
• d) anonymization, blocking, or deletion of unnecessary or excessive Data;
• e) portability of the Data, within the limits established by law and following the ANPD's guidance on the portability of Personal Data to third parties;
• f) deletion of Personal Data;
• g) information about the public and private entities with which we share your Personal Data;
• h) information about the possibility of refusing to provide consent for the Processing of your Data and the consequences of such choice;
• i) revocation of consent, pursuant to item 6.2. above.

8.1. MEMO has appointed Marcelo Facciolli to act as the communication channel between the Company, Personal Data Subjects, and the Brazilian Data Protection Authority (ANPD). The DPO may be contacted at any time via the email address dpo@memo.ind.br.

9.1. We have adopted technical and organizational measures capable of protecting your Personal Data.

9.2. The development, implementation, and updating of the technical measures referred to in the preceding item will take into account the current state of technology, the scale and volume of the operations to be carried out, as well as security and risk mitigation mechanisms consistent with good digital compliance practices.

10.1. MEMO adopts the best digital compliance practices to provide an appropriate level of privacy and security for your Personal Data. However, we emphasize that, despite all our efforts, we cannot ensure the absolute and complete security of the Processing, and therefore cannot be held liable for any damages caused by third parties as a result of non-compliance with this Policy and/or the contractual obligations assumed with MEMO.

10.2. MEMO shall also not be held liable for the criminal activities of hackers, crackers, or similar actors, nor for any actions or omissions that may be attributed exclusively to you or third parties, except in cases of proven negligence by MEMO in keeping its systems updated and adopting the necessary best practices to ensure the security of your Data.

11.1. This Policy may be amended or replaced at any time, at MEMO's sole discretion, without prior notice. MEMO undertakes to keep the full content of this document updated and available for access through our websites.

11.2. We recommend that you review this Policy periodically, as the rules and information regarding the Processing of your Personal Data will always be governed by the most recent version of the document.

12.1. If one or more provisions contained in this Policy are deemed invalid, illegal, or unenforceable in any respect, the validity, legality, or enforceability of the remaining provisions contained in this Policy shall not, in any way, be affected and/or impaired as a result. In such case, MEMO shall arrange for the replacement of the invalid, illegal, or unenforceable provisions with valid provisions.

13.1. This Policy shall be governed by the laws of the Federative Republic of Brazil.

13.2. For the resolution of any issues or disputes arising from this Policy, the courts of the District of Ribeirão Preto, State of São Paulo, Brazil, are hereby elected as the exclusive jurisdiction, with a waiver of any other jurisdiction, however privileged it may be.