We at PURPLE METRICS LTDA. ("Purple Metrics" or "We"), a company headquartered at Rua Sader Macul, 98, room 02, Itaim Bibi, ZIP Code 04542-090, São Paulo – SP, care about ensuring privacy and the protection of Users' Personal Data ("You") insofar as our contact, registration on our website, and access to and use of our Site by You may lead to the collection and processing of Personal Data. Therefore, we have prepared this Privacy Policy ("Policy") to show you which Personal Data are processed, from whom we process them, how we use them, with whom we may share them, and the measures we take to protect and keep them secure, always observing the provisions of the General Data Protection Law ("LGPD").

To better understand how our Platform works, the protection of your Personal Data, and the guarantee of your privacy, we recommend reading this document in conjunction with the Purple Metrics Platform Privacy Policy and the Purple Metrics Platform Terms of Service.

WHAT TERMS DO YOU NEED TO KNOW BEFORE PROCEEDING?

Before proceeding with the guidelines of this Policy, we define below the main terms used for your understanding:

• National Data Protection Authority (ANPD): ANPD is a special nature agency responsible for ensuring the protection of personal data and for regulating, implementing, and supervising compliance with the LGPD in Brazil;

• Cookies: browsing files that temporarily store what You are visiting on a particular site or application;

• Personal Data: data that identifies or makes an individual identifiable, including but not limited to name, home address, ID number, CPF number, email, etc.;

• Sensitive Personal Data: Personal Data about racial or ethnic origin, religious belief, political opinion, union membership or membership in a religious, philosophical or political organization, data related to health or sex life, genetic or biometric data (such as facial features), when linked to a natural person, such as sexual orientation, biometrics collected for entry/exit of premises, health data extracted from exams;

• Artificial Intelligence or "AI": refers to computer systems or software programs that have the ability to analyze data, identify patterns and make automated decisions based on those patterns, using algorithms and advanced techniques;

• LGPD or General Data Protection Law or Federal Law No. 13.709/2018: legislation that regulates the Processing of Personal Data or any other laws and regulations regarding the processing, protection and privacy of personal data, including User Data, that are applicable and, if applicable, all guidelines, standards, rules, ordinances, regulations and codes of practice and conduct issued by the National Data Protection Authority ("ANPD") or another relevant supervisory or data protection authority;

• Purple Metrics Platform or Platform: SaaS solution developed by Purple Metrics.

• Purple Metrics: Legal entity under private law named Purple Metrics Ltda, registered with CNPJ under No. 41.799.147/0001-70, headquartered at Rua Sader Macul, 96, room 02 - Itaim Bibi - São Paulo/SP.

• Third Party: clients, partners, suppliers, or any entity external to Purple Metrics whose Personal Data is processed;

• Data Subject: natural person to whom the Personal Data being processed refers;

• Processing: operations involving Personal Data, such as collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, deletion, evaluation or control of information, modification, communication, transfer, dissemination or extraction of Personal Data.

HOW IS YOUR PERSONAL DATA COLLECTED?

Your Personal Data can be obtained in different ways, including:

• Provided directly by the Data Subject as a result of marketing actions. By expressing interest in learning more about our Platform, subscribing to receive content offered by Purple, or registering for our webinars and/or events, and interacting with our marketing actions, the Data Subject directly provides us with their Personal Data. The data received may include name, email, phone number, job title, and the name of the company where they work. We emphasize that the Data Subject must ensure the truthfulness/update of the Personal Data provided to us;

• Provided directly by the Data Subject due to a contract or contract negotiation with our Client. By expressing interest in contracting the Platform through the scheduling of a demo or a proposal meeting and moving forward to the contract signing stage with Purple Metrics, Personal Data of the involved Data Subjects will be processed.

• Provided directly by the Data Subject when participating in a selection process or registering in Purple’s talent pool.

• Provided through our Partners. By expressing interest in content produced jointly with our Partners or by registering for events sponsored by us, Purple Metrics may receive and process your Personal Data.

• Automatically collected by Us. Through the collection of information from the device used to access our Site, such as navigation data, IP address, Site usage patterns, cookie information or similar technologies, statistics, and aggregated data.

• Collected through the registration and use of our Platform. By creating a user account, contracting and/or browsing on our Platform, Personal Data is processed by Purple Metrics. To learn more about how this Personal Data is used in the context of the Platform, see our Platform Privacy Notice.

WHAT PERSONAL DATA ARE PROCESSED BY PURPLE METRICS?

We are responsible for the Processing of Personal Data from various categories through your access to and use of our Website, as shown in the table below:

• Contact Personal Data, such as name, corporate email, phone number, and the content of messages sent and received.

• Professional Personal Data, such as job title, the company you work for, and your relationship with the Purple Metrics brand.

• Business Personal Data, such as company name, corporate tax ID (CNPJ), legal name, company website, type of company (whether it is an agency or not), and available budget.

• Website Access and Interaction Data, such as browsing history, pages viewed, time spent, interactions performed, engagement with content, IP address, access dates and times, device information, and cookies.

• Contracting and Payment Personal Data, such as qualification details of partners or legal representatives of Purple Metrics’ client companies, name of the payment holder, CNPJ, payment method used, banking or credit card information.

• Personal Data Stored on the Platform. Purple may also process Personal Data as a result of making the Platform available to its Clients and fulfilling contractual obligations between the Client and Purple Metrics. The Personal Data processed by our Clients is stored by Purple Metrics on servers that are either contracted or leased in a cloud environment. For more information, please consult the Platform Privacy Notice.

• Personal Data from Job Applications to Purple Metrics, such as full name, phone number, email address, professional background and experience, and LinkedIn profile.

Data Subjects. We process the Personal Data of certain categories of individuals — the Data Subjects. This means that the Data Subject (“You”) may fall into one or more of the following categories, which we define as: (a) Visitors, (b) Purple Metrics Leads, (c) Candidates, and (d) Users.

• Visitors are those Data Subjects who visit or access our Website.

• Purple Metrics Leads are potential clients of Purple Metrics, i.e., Data Subjects who, representing a company, (i) have interacted or interact with Purple Metrics content and materials or have in some way agreed to receive our content, such as by downloading an ebook, subscribing to our newsletter, or engaging in other situations related to the promotion of Purple Metrics’ solutions; (ii) fit the ideal client profile for Purple Metrics and have been identified by Purple Metrics as sales opportunities through publicly available information; or (iii) have had their Personal Data shared with Purple Metrics through Partners, such as in co-marketing content initiatives or event sponsorships.

• Candidates are those Data Subjects who apply for positions at Purple Metrics or who share their information and résumé to be part of Purple Metrics’ talent pool.

• Client Representatives are natural persons who legally represent Clients — legal representatives — or who act on behalf of Clients’ interests — such as employees, managers, or directors.

• Users are those Data Subjects who have access credentials to the Purple Metrics Platform. Information on how Users' Personal Data is processed, as well as relevant details to ensure transparency, including how Users can exercise their rights, is provided in the Platform Privacy Notice.

FOR WHAT PURPOSES ARE PERSONAL DATA USED?

We will use the Personal Data described in the section above for the following purposes and in accordance with the applicable legal basis:

Regarding other activities involving the Processing of Personal Data, the applicable legal bases will be used as appropriate for each case, such as the execution of a contract or preliminary steps thereto; compliance with legal or regulatory obligations; exercise and defense of our rights and interests; or based on a legitimate interest of ours, always considering and respecting your fundamental rights and guarantees as a Data Subject.

WHO DO WE SHARE YOUR PERSONAL DATA WITH?

The sharing of Personal Data involves the transmission and receipt of information by a Third Party, which may be located in Brazil or abroad.

In our case, we only share statistical data with our clients. However, if a consumer voluntarily provides their Personal Data through the research form, their Personal Data may be shared with our client. In this case, the sharing is voluntary, as Purple does not request any identifying information from the consumer, but the consumer may choose to provide such data in the open field of the research form sent to them.

In addition to the situations already mentioned in this Privacy Policy, Personal Data may be shared with third parties in the following cases:

• Regular exercise of rights through administrative, judicial, or extrajudicial means: We may share Personal Data with third parties, such as law firms, consultancies, debt collection agencies, accounting firms, and similar entities, in order to exercise our rights or ensure compliance with this Privacy Policy and our Terms and Conditions of Use;

• Judicial or Administrative Request: We may share Personal Data in response to judicial or administrative orders;

• Compliance with legal or regulatory obligations: We may share Personal Data with government bodies, authorities, and other public or private entities to comply with legal or regulatory obligations.

• Third-Party Service Providers: We may also work with other companies in various activities to facilitate our service, perform services related to the Website, Platform, or Purple Metrics, or assist in analyzing how our service is used, such as companies that provide the cookies we use on our site. These third parties receive your data only to the extent necessary to provide the contracted services. We emphasize that our contracts are governed by data protection rules under Brazilian law, and prohibit these third parties from disclosing or using the data for any other purpose.

• Acquisition or Merger. In the case of a merger, acquisition, or other corporate transaction, we may share your Personal Data with the parties involved in the process, including purchasing or acquiring companies, for the purposes of product continuity and integration, always in compliance with applicable data protection regulations. In such cases, we ensure that data processing continues in accordance with applicable regulations and that data subjects are informed of any relevant changes that may affect the use of their personal information.

5.1 INTERNATIONAL TRANSFER OF PERSONAL DATA

Purple Metrics is headquartered in Brazil, and the data we collect is subject to Brazilian law. However, the Personal Data processed may be stored on servers located outside Brazil due to sharing with Third Parties that provide services to Purple, resulting in the processing and international transfer of data.

Therefore, data collected by Purple Metrics is stored on these servers, resulting in an international data transfer, as provided for in the Brazilian General Data Protection Law (LGPD).

We prioritize working with providers who adopt all necessary security measures to protect personal data and who perform international transfers in compliance with the LGPD and applicable resolutions of the Brazilian National Data Protection Authority (ANPD), specifically based on the legal grounds provided for in Articles 7 or 11 of the LGPD and the following safeguards: (i) to countries or international organizations that provide an adequate level of personal data protection according to the LGPD, (ii) standard contractual clauses, global corporate rules, or specific contractual clauses, or (iii) the scenarios provided for in items II, "d", and III to IX of Article 33 of the LGPD.

HOW LONG DO WE STORE YOUR PERSONAL DATA?

Personal Data will be retained for as long as necessary to fulfill the purposes described in this Privacy Policy. We implement controls to ensure data is retained only while it is genuinely needed, and it is deleted when processing ends or when no legal basis for retention applies. Additionally, in some situations, data may be retained for a longer period, such as to:

• Comply with legal or regulatory obligations, such as audits and fraud control;

• Exercise rights in administrative, judicial, or arbitration proceedings;

• Fulfill the duration of a contract.

If Personal Data is to be deleted, it will be removed when there is no longer a specific purpose for processing, being deleted from our systems and records or anonymized so that individuals can no longer be identified.

HOW DO WE ENSURE THE SECURITY OF YOUR PERSONAL DATA?

For Personal Data processed by us and for the purposes highlighted in section 4, we adopt appropriate technical and administrative security measures to the nature of the data collected, used, stored, or otherwise processed by us, in line with market practices.

However, no method of electronic transmission or data storage is completely secure and free from potential external attacks. Therefore, Purple Metrics cannot guarantee the absolute security of the measures adopted or the absence of interference from third parties (such as hackers). By their nature, despite our best efforts, any security measure may fail, resulting in a security incident involving Personal Data. These measures are also extended to Third Parties with whom Purple Metrics shares Personal Data.

WHAT ARE YOUR RIGHTS AND HOW CAN YOU EXERCISE THEM?

We provide means for you to exercise your legal rights over your Personal Data and your children's Personal Data. Below we describe these rights and how data subjects can exercise them:

• Confirmation of data processing: You can confirm whether we are processing your Personal Data;

• Access to Personal Data: You can access your Personal Data, including requesting copies;

• Correction of incomplete, inaccurate, or outdated data: You can request the modification or correction of any incorrect Personal Data;

• Anonymization, blocking, or deletion: You can request the anonymization, blocking, or deletion of data that is unnecessary, excessive, or processed in violation of the Data Protection Law;

• Review of Automated Decisions: You can request a review of decisions made solely based on automated processing of Personal Data that affect your interests;

• Deletion of Personal Data: You may request the deletion of your Personal Data processed by Purple Metrics when such data was collected and processed based on your consent, either through the Platform or by contacting us through the channels provided in this Privacy Policy;

• Withdrawal of Consent: You may, at any time and at your sole discretion, revoke the consent previously given for the processing of your Personal Data. Any processing carried out up to the time of revocation will remain valid.

The rights mentioned above and others provided by the LGPD can be exercised through our Platform. You may contact us to request any of these rights (such as access and editing tools for Personal Data) via the email address: dpo@purplemetrics.com.br.

9. PRIVACY NOTICE UPDATES

Our Privacy Notice may undergo changes due to ongoing legislative updates related to personal data protection and the continuous improvement and development of our services. Therefore, we recommend that you revisit this Policy regularly. If there is any relevant or substantial change, we will notify you. If you continue to access Purple Metrics' Website, we will assume that you are aware of all updates.

10. DATA CONTROLLER

On this website, the data controller for the collected Personal Data is PURPLE METRICS LTDA, registered under CNPJ No. 41.799.147/0001-70, located at Rua Sader Macul, 96, room 02 - Itaim Bibi - São Paulo/SP.

This Notice does not apply to any websites that may be referenced or linked through our page. Therefore, it is necessary to read the Privacy Policies of any external sites when redirected to a domain not owned by Purple Metrics.

11. DATA PROTECTION OFFICER OR “DPO”

Our Data Protection Officer (DPO) is DATA GUIDE CONSULTORIA E SOLUÇÕES EM PROTEÇÃO DE DADOS LTDA, a private legal entity registered under CNPJ No. 39.317.591/0001-60, represented by Taynara Rodrigues Bernardo, who can be contacted at dpo@purplemetrics.com.br.

12. QUESTIONS?

If you have any questions about the Processing of your Personal Data, you may contact us at dpo@purplemetrics.com.br.