# ANNEX 2 - DATA PROTECTION UNDER BRAZILIAN DATA PROTECTION LAW ("LGPD")

In this section, we give you more detailed information regarding the protection of your personal data according to the specific rules and provisions of the LGPD. Therefore, this section is an extension of the Compass Privacy Policy and only applies to those users who are located in Brasil at the time of collection of the data.

MARFEEL will act as the Publisher’s Processor, so MARFEEL’s use of your personal information, as explained in the Compass Privacy Policy, is limited to the specific purpose of performing its Services on behalf of the Publisher, whis is the Controller of your personal data, as explained in the "WHO IS THE DATA CONTROLLER FOR THE PROCESSING OF YOUR PERSONAL DATA?" section of the Compass Privacy Policy.

# 1. For what purposes are your personal information processed?

The purposes for which the Publisher uses your personal information are limited to the purposes indicated in the "WHAT ARE THE PURPOSES FOR THE PROCESSING OF YOUR PERSONAL DATA?" section of the Compass Privacy Policy.

# 2. Which type of data is collected and how long it is processed?

The categories of personal information listed in the "WHAT TYPE OF DATA DO WE COLLECT?" section of the Compass Privacy Policy are collected. Your personal information will be received through its different technological tracking tools.

Your Personal Data will only be kept during the period indicated in the "HOW LONG DO WE STORE YOUR PERSONAL DATA?" section of the Compass Privacy Policy.

# 3. Is there any shared use of data by the Controller?

As explained in the Compass Privacy Policy ("DO WE DISCLOSE YOUR PERSONAL INFORMATION TO THIRD PARTIES?" section), the Publisher may be required to disclose your personal information when required by law or by the government and other public administrations or when engaging service providers (such as MARFEEL) which need to access your personal data to provide their services and which will be duly authorised to such access in accordance with current data legislation.

In any case, if your personal data are shared with third parties, the recipients must use them in accordance with the purposes for which they were collected, or, if applicable, for which you previously authorised.

# 4. What are your rights?

As data subject under the LGPD, you, at any time and by means of request, has the right to obtain the following from the Publisher:

  • confirmation of the existence of the processing of your personal data;
  • access to your personal data, which will be provided in a readable format in printed form or by electronic means;
  • anonymization, blocking or deletion of unnecessary or excessive data or data processed in noncompliance with the provisions of the LGPD;
  • portability of the data to another service provider or product provider, by the means of an express request, except when the data have already been anonymized;
  • deletion of your personal data when its collection was based on your consent, except when the storage is needed for the purposes authorised by law (such as compliance with a legal or regulatory obligation or use by the Publisher of anonymised data)
  • information about public and private entities with which the Publisher has shared data;
  • information about the possibility of denying consent and the consequences of such denial;
  • revocation of your consent;
  • review of decisions made solely based on automated processing of personal data affecting your interests, or information on the criteria and procedures used for an automated decision, subject to commercial and industrial secrecy.

The regular exercise of your rights will not be used to your detriment.

Moreover, You have the right to petition, regarding your personal data, against the Publisher before the national authority, before consumer defense entities or in court, individually or collectively, as provided in pertinent legislation

Your rights should be exercised by means of an express request addressed to the Publisher whose website you visited. However, you may also address your requests to Marfeel, as Processor, sending an e-mail to Marfeel’s data protection officer ("DPO"): dpo@marfeel.com. We will make every effort to forward your request to the appropriate Publisher and process and manage it in accordance with applicable laws.