Main Types of Data Collected and Used by RD

Source	Types of Data	Purpose	Legal Basis
Access to and browsing of RD’s and its Affiliates’ websites	IP address, date and time of access, time spent on the page, search terms used to find the website, geolocation, device type, operating system, and browser.	Improving website functionality, analytics, content personalization, marketing, and related purposes.	Legitimate interests and/or compliance with a legal obligation.
Sales contact forms	Name, business email address, mobile phone number, company, job title, industry, and data relating to interactions with RD.	Sales prospecting, Lead qualification, sending communications, marketing, and related purposes.	Legitimate interests or consent.
Newsletter subscriptions and/or landing pages	Name, email address, job title, company, industry, and website.	Sending newsletters, promotions, and content relating to the RD Platform’s and its Affiliates’ products.	Legitimate interests or consent.
Registration on the RD Platform	Name, email address, and password.	Providing access to the RD Platform and Services.	Performance of a contract.
Customer support channels	Name, email address, password, company, Customer ID, cookies, contact details, and other relevant information.	Providing technical support, responding to Customers and/or Data Subjects, and answering inquiries from Leads.	Performance of a contract, legitimate interests, or compliance with a legal obligation.
Cookies and tracking technologies	Data associated with cookies, tags, scripts, and pixels, including behavioral and browsing identifiers.	Improving the user experience, operating the website, analyzing browsing behavior, marketing, and related purposes.	Legitimate interests for necessary cookies and other technologies; consent for other cookies.
Data relating to the use of RD Platform Products	Name, email address, phone number, job title, company, account usage behavior, Leads’ interactions with campaigns, interaction history, messages, and other relevant information.	Improving our solutions and developing new features.	Legitimate interests.
Applications for jobs at RD	Name, professional history, email address, phone number, profile assessment results, and other relevant information.	Managing recruitment processes at RD and/or its Affiliates.	Performance of a contract.
Participation in events organized by RD and Partners	Name, job title, industry, company, email address, phone number, and other relevant information. In some cases, data concerning racial or ethnic origin may be Processed solely for diversity initiatives.	Enabling participation in RD’s events and communities, sending communications about events and RD-related topics, and supporting diversity initiatives.	Performance of a contract, consent, and/or legitimate interests.

When acting as a Processor, RD Processes Personal Data in the course of providing the Services in accordance with the directions and instructions of the Controllers (its Customers). RD follows the instructions set out in its contracts with Customers and carries out Processing activities as determined by them. RD does not decide how its Customers Process Personal Data on the RD Platform. Processing carried out on behalf of Customers is governed by specific contractual provisions designed to protect the confidentiality and security of the information.

Some RD Services may also use artificial intelligence (“AI”) technologies, including RDSM, RD Conversas, and other tools used to communicate with Leads. These technologies help personalize and automate processes within the Services contracted by Customers and improve user interactions and experiences. RD may also use AI technologies in its support channels, meetings, and communications with Customers and other Data Subjects. RD uses AI with due care and in accordance with applicable law, respecting the privacy and security of the information Processed. Whenever possible, and without compromising the quality of the Services, we apply Anonymization techniques to protect your privacy.

We are committed to Processing Personal Data securely and transparently to provide effective Services to our Customers while complying with applicable law.

RD may occasionally Process Personal Data for purposes not expressly described in this Privacy Notice, provided that those purposes are compatible with the purposes described here, taking into account the context of the Processing, and comply with applicable law.

5. How We Share Personal Data

RD may share your Personal Data with the categories of recipients described below, depending on the circumstances.

• Customers: RD may share your Personal Data with Customers solely to comply with legal obligations, perform a contract, or provide the Services.
• Suppliers: RD may share your Personal Data with Suppliers to enable RD and its Affiliates to provide the Services and carry out their activities.
• Partners: When necessary to provide the contracted Services, RD may share Personal Data with business or technology Partners. This sharing supports the features offered and the continuity of the Services.
• Affiliates and other companies in the same corporate group: As part of the TOTVS group, RD may share Personal Data with other group companies, including Affiliates, to provide our Services, improve our operations, and pursue legitimate business purposes, including marketing activities.
• Public authorities: RD may share Personal Data with public authorities, such as the ANPD or other government bodies, in response to formal requests or court orders, to comply with legal or regulatory obligations or to present a defense in administrative or judicial proceedings.
• Third-party applications: RD may make third-party applications, such as widgets or extensions, available through its Services. Information obtained by RD when a Customer enables a third-party application is Processed in accordance with this Privacy Notice. Information collected by the application provider is governed by that provider’s own privacy notice, which the Customer should review. Third-party websites may collect information about the Customer, use cookies or other tracking technologies, and monitor interactions with embedded content, including when the Customer has an account and is signed in to the third-party website. Please review the privacy notice of any third-party website you visit to understand how it collects and uses your information.
• Google APIs: Customers may choose to connect the RD Platform to their Google accounts, such as Gmail, Google Calendar, and Google Drive. In that case, RD uses integrations that enable it to access, read, import, and Process information through Google APIs. These integrations are designed to protect the authentication process and the information received through Google Workspace scopes. RD’s use of this information complies with the requirements for Google’s Restricted Scopes set out in the Google API Services User Data Policy. Data accessed or received through Google APIs will: (a) be used only to provide or improve features requested by the User; and (b) not be used to develop, improve, or train artificial intelligence or machine learning models.

Customers may manage the authorizations and permissions granted to applications at any time through their Google account settings or the RD Platform. Users may also revoke those permissions through the same channels.

• Integrations with artificial intelligence assistants (MCP): RD may offer connectors that allow a Customer to link its account on the RD Platform to third-party artificial intelligence assistants. These connectors use the Model Context Protocol (MCP), a standard that enables communication between the assistants and RD Products. Once the connection is authorized, the assistant may access information in the account and, subject to the permissions granted, take actions within RD Products. The data involved depends on the Product used and the request made. It may include information about users, contacts and Leads, deals, conversations, interactions, activities, and other records entered by the Customer into the platform. To operate, support, and secure the integration, RD may also Process authentication data and usage logs, such as account and user identifiers, the date and time of requests, the tool used, IP addresses, and information about the actions performed. Information provided by RD in response to requests will be transmitted to the provider of the assistant chosen by the Customer and Processed by that provider in accordance with its own Terms of Use and Privacy Notice.

The Customer or an authorized user may revoke the connection at any time using the available connection management options. RD does not use data accessed through the connectors to develop, improve, or train artificial intelligence or machine learning models.

If a Customer or user chooses to connect, integrate, enable, grant access to, or use, together with RD’s products or services, artificial intelligence models, agents, AI co-workers, APIs, applications, platforms, connectors, or any other third-party resources that RD has not made available, contracted, or approved for that purpose, the Customer does so at its sole responsibility. This includes any resulting unavailability, excessive load, or interruption of RD’s services.

When sharing is necessary, RD takes appropriate measures to ensure that the information shared is used only for the specified purposes.

6. Information Security

RD adopts technical and organizational measures to protect the Personal Data it Processes against unauthorized access, alteration, disclosure, or destruction. Our Privacy and Data Protection Program and security practices are governed by internal information security standards that follow applicable law and industry practices, including the requirements of ISO 27001 and NIST.

We use measures such as encryption, penetration testing, and security protocols to protect data in transit and at rest. We also conduct regular internal audits to assess the effectiveness of our security systems and processes and adapt them to emerging threats.

Access to Personal Data is limited to RD employees and service providers who need it to perform their duties. They are required to comply with our security and privacy policies. RD also protects its physical facilities by controlling access to locations where data is stored.

Despite these measures, RD cannot be held responsible for security incidents involving third-party systems or services, failures in internet infrastructure, misuse or inadequate protection of access credentials by Customers, or other circumstances beyond RD’s control. Users and Customers must also adopt security practices for their own systems and devices, such as using strong passwords and keeping them up to date.

7. Storage, Retention, and Deletion of Personal Data

RD follows responsible practices for storing and deleting Personal Data in accordance with applicable law and to protect the security and privacy of the information it Processes. Personal Data may be stored on RD’s own servers or on servers operated by third parties contracted for that purpose, in Brazil or abroad, as permitted by applicable law. We may use cloud computing and other technologies to improve the Services provided to our users while observing data protection requirements.

Personal Data is stored for as long as necessary for the purposes for which it was collected or while it remains relevant to RD’s legitimate interests. It may be kept for longer when required to comply with legal, contractual, or regulatory obligations. When Personal Data is no longer needed for these purposes, it will be securely deleted in accordance with Articles 15 and 16 of the LGPD.

The Processing of Personal Data will end in the following circumstances:

• When RD ceases to be the Controller of the Personal Data, or when the Customer’s account or contract ends for any reason.
• When the Personal Data is no longer necessary or relevant to the purposes for which it was collected.
• When the Data Subject requests that Processing end, where applicable, and there is no legal or contractual basis for retaining the data.
• When required by a final decision of the Brazilian Data Protection Agency (ANPD) or another competent authority.

Personal Data that must be retained to comply with the Brazilian Civil Rights Framework for the Internet (MCI) is stored in a secure and controlled environment for at least six (6) months. This period may vary depending on the type of contract with the Customer.

 

In specific circumstances, such as when data is needed to comply with legal obligations, RD may retain it for an additional period as required by law. Following the end of the contractual relationship with a Customer, data will be deleted within sixty (60) days. A backup may be retained for up to seventy-two (72) hours for security and compliance purposes.

Where Processing is based on the Data Subject’s consent, RD will stop Processing the Personal Data, where applicable, if the Data Subject objects to the Processing or withdraws consent.

RD considers the amount, nature, and sensitivity of the Personal Data, as well as the risks involved, when determining an appropriate retention period, with the aim of Processing data responsibly and in compliance with legal obligations.

8. Data Subjects’ Rights

Data Subjects have rights concerning their Personal Data. This section explains how those rights may be exercised in relation to RD.

When RD acts as a Processor of Personal Data, the Customer, as Controller, is responsible for decisions about its Processing. Data Subjects whose information is Processed through RD’s Products and Services should therefore exercise their rights directly with the relevant RD Customer. RD does not respond directly to Data Subject requests concerning Processing for which it acts solely as a Processor.

When RD Processes data on behalf of a Customer, it does not make the final decisions about how that data is used, including decisions to send communications or emails about the Customer’s products or services. RD provides the tools through which the Customer carries out those activities. Requests or questions concerning them should be directed to the RD Customer, as Controller of the data.

When RD acts as the Controller, Data Subjects may contact us through our Help Center to ask questions or submit requests concerning their rights:

• Confirmation of Processing: You may ask whether RD Processes your Personal Data. To prevent fraud, we may ask you to verify your identity before providing this information.
• Access to Personal Data: You may request information about the Personal Data RD Processes about you.
• Correction of incomplete, inaccurate, or outdated Personal Data: You may request that your Personal Data be corrected or completed.
• Anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully Processed Personal Data: You may request the Anonymization, blocking, or deletion of Personal Data that RD Processes in violation of the LGPD. If RD has a legal or regulatory reason to retain the data, it will be kept for the necessary period.
• Portability of Personal Data: You may request the portability of your Personal Data to another service provider.
• Information about data sharing: You may request information about the public or private entities with which your Personal Data has been shared.
• Withdrawal of consent: When Processing is based on your consent, you may withdraw it at any time. You are not required to consent to any activity you do not wish to authorize.
• Deletion of Personal Data: You may request the deletion of your Personal Data, subject to the exceptions set out in Article 16 of the LGPD.
• Review of automated decisions: You may request a review of decisions made solely on the basis of automated Processing of Personal Data that affect your interests, in accordance with Article 20 of the LGPD.

You also have the right to opt out of marketing communications and other promotional messages sent by RD or its Customers. You may unsubscribe or stop receiving these messages at any time by using the unsubscribe link in each email or by contacting the Customer responsible for using RD’s Service.

RD is committed to responding to Data Subject requests promptly and within the time limits established by the ANPD.

9. International Data Transfers

RD’s Processing of Personal Data may involve international data transfers, particularly to the United States.

Data generated through the Services available on the RD Platform is stored using Google Cloud Platform (GCP) and/or Amazon Web Services (AWS). The relevant data centers are located in California and Iowa, United States. RD may also use Suppliers whose services require international transfers of Personal Data.

When providing Services that involve international transfers of Personal Data, RD gives preference to Processing in countries that provide a level of data protection equivalent to that of the LGPD and/or uses standard contractual clauses appropriate for the transfer, in accordance with ANPD Resolution No. 19 of August 23, 2024, and Article 33 of the LGPD. In exceptional cases, RD may use other international transfer mechanisms permitted by the LGPD.

Some RD Products may also be marketed and made available through business Partners located abroad. In these cases, RD applies the protections required for international data transfers and observes applicable law.

Where RD Processes Personal Data outside the scope of the LGPD because the Processing falls outside its territorial application or within an exclusion provided by the law, RD remains committed to protecting the Data Subjects’ Personal Data and privacy. RD will also address requests to exercise rights under applicable law through its official support channels, within reasonable limits and to the extent possible, and respond appropriately to authorities and other requests from entities located abroad.

10. Contact Us

You may contact our Help Center at any time with questions, Supplier assessments, requests to exercise your rights, or other comments and suggestions. When submitting a support request, select “Data Protection” in the “I want to discuss” field.

You may also send questions about this Privacy Notice or other privacy matters directly to RD’s Data Protection Officer:

Name: Fernanda Nones

Address: Rodovia Virgílio Várzea, No. 587, 3rd floor, Suite 302, Saco Grande, Florianópolis, Santa Catarina, Brazil

Email: [email protected]

11. Updates to This Privacy Notice

RD may update this Privacy Notice at any time, including to reflect new technologies, changes in the law, changes to the security of the Services, or other developments. Any updates will be made available on RD’s website and will take effect on the date they are published.

Atualizado em: 29/09/2026

Version: 03.03