4. How we use the collected information

4.1 Security. MEISTRARI will do everything possible to keep Personal Data always secure and will adopt security and protection measures, both technical and administrative, compatible with the nature of the Data collected, used, stored, or otherwise Processed by MEISTRARI, in accordance with appropriate market practices.

4.1.1 Exceptions. However, no method of electronic data transmission or retention is fully secure and may be subject to external attacks. Thus, MEISTRARI cannot guarantee that such security measures are error-free or not subject to third-party interference (hackers, among others). By its nature, despite MEISTRARI's best efforts, any security measure may fail, and any Data may become public. BY USING Tela, USERS EXPRESSLY UNDERSTAND AND ASSUME THIS RISK AND AGREE THAT MEISTRARI WILL NOT BE RESPONSIBLE FOR SUCH TYPE OF LEAKAGE OR UNAUTHORIZED ACCESS TO DATA.

4.1.2 The above-described security measures apply to User Data only from the moment MEISTRARI receives them and while they are under its custody. The operation and security of the device Users use to access Tela, as well as third-party networks through which data travels, are not the responsibility of MEISTRARI.

4.2 Servers. For as long as Users keep their account on Tela active, all collected information will be stored with a high-security standard on MEISTRARI's or third-party servers, located in Brazil and/or abroad. The User is hereby aware that MEISTRARI may store their Personal Data on servers outside Brazil and/or use service providers not located in Brazilian territory. In such cases, MEISTRARI will observe the legal requirements for such international transfers, ensuring the same level of security applied to Processing carried out in Brazilian territory.

4.3 Storage period. Personal Data will be retained as long as necessary for the purposes listed in this Privacy Policy. MEISTRARI adopts controls to ensure that Data is retained only as long as it is indeed necessary, being discarded whenever the Processing is terminated or no legal retention hypothesis applies. In addition to the provisions, data may eventually be retained for a longer period when necessary to comply with legal/regulatory obligations.

4.4 Data deletion. When we no longer need to use Personal Data, it will be removed from our systems and records or anonymized so that MEISTRARI can no longer be identified from this data, at MEISTRARI's sole discretion. MEISTRARI may retain some Personal Data to comply with legal or regulatory obligations, as well as to allow and ensure the regular exercise of our rights (for example, in judicial, administrative, or arbitral proceedings). For audit, security, fraud control, and rights preservation purposes, MEISTRARI may retain the historical record of Personal Data for a longer period in cases where the law or regulatory norm so establishes or for rights preservation.

4.5 LIMITATION OF LIABILITY. NOTHING IN THIS PRIVACY POLICY IS INTENDED TO EXCLUDE OR LIMIT ANY CONDITION, WARRANTY, RIGHT, OR LIABILITY THAT CANNOT BE LEGALLY EXCLUDED OR LIMITED. SOME JURISDICTIONS DO NOT ALLOW THE EXCLUSION OF CERTAIN WARRANTIES OR CONDITIONS OR THE LIMITATION OR EXCLUSION OF LIABILITY FOR LOSS AND DAMAGE. CONSEQUENTLY, ONLY THE LIMITATIONS THAT ARE PERMITTED BY LAW IN YOUR JURISDICTION WILL APPLY TO YOU. IN CASES WHERE EXCLUSION OF LIABILITY IS NOT POSSIBLE, BUT LIMITATION OF LIABILITY IS LEGALLY APPLICABLE, MEISTRARI'S TOTAL LIABILITY WILL BE LIMITED TO R$ 1,000.00.

5. Rights of Data Subjects

5.1 MEISTRARI provides tools for Data Subjects to exercise their legal rights over their Personal Data. In this item, we will describe these rights and how Data Subjects can exercise them.

• Confirmation of processing existence: Data Subjects can confirm whether MEISTRARI is Processing their Personal Data;
• Access to Personal Data: Data Subjects can access their Personal Data, including requesting a copy of the Processed Data;
• Correction of incomplete, inaccurate, or outdated Data: Data Subjects can request the alteration or correction of their incorrect Personal Data;
• Anonymization, blocking, or deletion: Data Subjects can request the anonymization, blocking, or deletion of unnecessary, excessive, or non-compliant data with Data Protection Legislation;
• Portability. Data Subjects can request the portability of their Data by requesting it through the contact channels indicated in this Privacy Policy;
• Deletion of Personal Data. Data Subjects can request the deletion of their Personal Data processed by MEISTRARI when collected and processed based on their consent, through Tela itself or by requesting it through the contact channels indicated in this Privacy Policy;
• Information about sharing. Data Subjects can request information about which public and private entities MEISTRARI has shared their Personal Data with, under the terms of this Privacy Policy;
• Information about the possibility of not consenting. Data Subjects receive through this Privacy Policy and can request, through the contact channels, information about the possibility of not consenting to the Processing of Personal Data and its potential consequences, including the impossibility of MEISTRARI providing services;
• Revocation of Consent. Data Subjects can, at any time and at their discretion, revoke the Consent previously provided for the Processing of Personal Data, with the treatments carried out based on it until that moment remaining valid.

5.2 Exercise of rights. The rights mentioned above and others provided by applicable legislation can be exercised by the Data Subject directly through Tela, according to the functionalities made available on it (such as tools for accessing and editing Personal Data) or by requesting it via email privacy@tela.com. MEISTRARI reserves the right to request information or documents to verify the applicant's claims.

5.3 Consequences of data deletion. It is important to note that, in some cases, by complying with deletion requests, MEISTRARI may be unable to provide its services. Thus, the request for deletion of Personal Data will result in the immediate deactivation of the User's account on Tela, with the permanent loss of any such Data entered into Tela. After the deletion of this Personal Data, MEISTRARI may continue to use it in a non-individualized and anonymized manner, i.e., without any personal identification, for the purposes provided in this Privacy Policy.

5.4 Data retention. MEISTRARI may retain the Personal Data of certain Users for a period longer than the legal retention period, in compliance with possible orders from public authorities, to defend itself in judicial and/or administrative proceedings, and in cases where Personal Data has been duly anonymized.

IN COMPLIANCE WITH APPLICABLE LEGISLATION OR COURT ORDER, MEISTRARI MAY RETAIN CERTAIN PERSONAL DATA FOR A PERIOD NOT LESS THAN 6 (SIX) MONTHS AFTER YOUR DELETION REQUEST. SUCH DATA WILL NOT BE ANONYMIZED OR DESTROYED BY MEISTRARI BEFORE THE END OF THIS PERIOD. MEISTRARI WILL STORE YOUR DELETION REQUEST AND, OBSERVING THE LEGAL MANDATORY RETENTION PERIOD OF CERTAIN DATA, WILL PROVIDE FOR THE DESTRUCTION OR ANONYMIZATION, AT MEISTRARI'S SOLE DISCRETION, OF INFORMATION CAPABLE OF IDENTIFYING THE USER.

IF THE USER REQUESTS THE DELETION OF THEIR INFORMATION BUT STILL HAS ANY PENDING OBLIGATION WITH MEISTRARI, THEIR INFORMATION WILL NOT BE DELETED AND WILL REMAIN STORED TO ENABLE THE RESOLUTION OF THE PENDING ISSUE AND THE ADOPTION OF APPROPRIATE MEASURES.

5.5 Failure to provide consent in cases where it is necessary may prevent MEISTRARI from providing its services or certain functionalities of Tela from being used by the User.

6. Contact with MEISTRARI

6.1 In case of doubt, suggestions, complaints, or clarifications about this Privacy Policy or the Processing of Personal Data by MEISTRARI, or to request the exercise of any of the rights described in this Privacy Policy or Data Protection Legislation, the User can contact MEISTRARI via email: privacy@tela.com. MEISTRARI will be pleased to clarify any doubts and/or fulfill your request.

7. Data Sharing with Third Parties

7.1 Processing Operators. MEISTRARI may hire third parties to assist in providing its services, such as cloud storage servers and payment processing platforms. Currently, MEISTRARI shares its Data with infrastructure providers (servers, hosting, and cloud services) for the proper functioning of Tela, IT service providers, and partners related to payment processing, which may be replaced at any time, provided that adequate data security and confidentiality standards are maintained. MEISTRARI, as the Data Controller, will require such partner Operators to maintain adequate security and confidentiality levels.

7.2 Third-Party Services. During the use of Tela, Users may use other services, channels, products, and platforms provided, maintained, and/or operated by third parties, used as channels or support means for services provided by MEISTRARI, but without any relation to MEISTRARI ("Third-Party Services"). These Third-Party Services may include, for example, payment platforms, file-sharing tools, among others. When MEISTRARI services use such Third-Party Services, the Processing of Personal Data will also be subject, in addition to this Privacy Policy, to the privacy policies and terms of use of such Third-Party Services, over which MEISTRARI has no control or influence. In this case, MEISTRARI and this third party will be Independent Controllers of Personal Data, each being responsible for the Processing of Personal Data carried out within their scope of action. Concerning MEISTRARI, even when Personal Data is received by such Third-Party Services, such Personal Data will always be processed in accordance with this Privacy Policy. However, we encourage the User to inform themselves about the policies applicable to such Third-Party Services, as MEISTRARI has no influence over the relationship between the User and such Third Parties and is not responsible for the use made by such Third Parties of the User's Personal Data entered by the Users into the Third-Party Services.

7.3 Other Third Parties. In addition to the cases already mentioned in this Privacy Policy, Personal Data may also be transferred to third parties, including as Controllers, in the following cases:

• 7.3.1 New Businesses. There may be a transfer of Personal Data to and among MEISTRARI affiliates and/or in the context of acquisition, sale, merger, corporate reorganization, or any other corporate change of MEISTRARI. In this case, MEISTRARI will ensure that the person, whether individual or legal entity, who comes to access or assume control over the Processed Data, under the terms of this Privacy Policy, is also bound by it, ensuring the continuity of Personal Data protection, and notifying Users in advance if this transfer implies any change in the Privacy Policy.
• 7.3.2 Regular exercise of rights through administrative, judicial, or extra- judicial means. MEISTRARI may share Personal Data with third parties such as law firms, consultancies, collection companies, accounting firms, and similar entities, for the purpose of exercising its own rights or ensuring compliance and enforcement of this Privacy Policy and the Terms of Use.
• 7.3.3 Judicial or Administrative Request. MEISTRARI may share Personal Data in case of judicial or administrative request.
• 7.3.4 Compliance with legal or regulatory obligation. MEISTRARI may share Personal Data with bodies, authorities, and other public entities, as well as with private individuals or legal entities, in compliance with legal or regulatory obligations.
• 7.3.5 With the User's authorization. In other cases, if there is a need to share information, we will send the User a notification requesting their Consent.

7.4 Legal basis for sharing. The sharing of Data with such third parties will always be carried out with the User's Consent or (i) for the regular exercise of MEISTRARI's rights, (ii) to comply with legal obligations, (iii) for the execution of a contract, or (iv) for MEISTRARI's legitimate interest (in this last case, not including the User's Sensitive Data), or any other applicable legal basis.

8. International Transfers

8.1 To optimize the efficiency, performance, and security of Tela, MEISTRARI may use a global technical infrastructure and have service providers not only in Brazil but also abroad. Therefore, your Personal Data, including Sensitive Personal Data, may be transferred to other countries for data Processing and storage, in accordance with the terms and purposes defined in this Privacy Policy, as well as to provide the services requested by You. MEISTRARI may transfer your Personal Data to service providers who will process Personal Data on behalf of MEISTRARI and according to our instructions.

8.2 Privacy and data protection laws vary from country to country, and data protection standards in other countries may differ from those in Brazil. Nonetheless, MEISTRARI will make every effort to ensure the level of data protection informed in the Privacy Policy, in accordance with applicable laws.

9. Cookies

9.1 MEISTRARI may use Cookies and similar technologies, such as pixels and tags, to ensure that the services provided meet quality standards. Cookies collect only statistics and will not be used for purposes other than those expressly provided in this Privacy Policy.

9.2 What are Cookies and what are they for? A Cookie is a small file added to your device or computer to provide a personalized access experience to Tela. MEISTRARI may use Cookies:

• 9.2.1 Necessary: Cookies that enable the use of Tela and without which Tela may not function properly. As these Cookies are necessary, they are used based on the execution of the contract between MEISTRARI and the User.
• 9.2.2 Functional: Cookies that enable additional functions or serve to enable access to certain specific sections of Tela. The use of such Cookies is not absolutely necessary for the use of the service, but if you choose to disable them, the User may have reduced functionalities, so the use of these Cookies is based on your consent when activating such functions.
• 9.2.3 Performance: Cookies used to measure and improve the performance of a specific web page and specific content contained on the page.
• 9.2.4 Third-Party Cookies: Tela uses plugins from third-party sites, applications, and other services. The Cookies used by these third parties may be stored in the User's browser. Each third-party site has its own privacy and personal data protection policy, and the individuals or legal entities that maintain them are responsible for the Data collected and the privacy practices adopted. The User can search, on third-party sites, for information on how their Personal Data is Processed. MEISTRARI HAS NO CONTROL OR INFLUENCE OVER THESE THIRD-PARTY SITES AND WILL NOT BE RESPONSIBLE FOR THE CONTENTS, PRACTICES, AND SERVICES OFFERED BY ANY THIRD PARTIES, NOR FOR THE TREATMENT GIVEN TO YOUR PERSONAL DATA BY THESE SITES, EVEN WHEN THE LINKS ARE PRESENT ON Tela.

9.3 Is it possible to limit the use of Cookies? Browsers generally allow the collection of Cookies to be disabled, so if You do not change the Cookie collection policies of your browser, the User can object to such Processing by adjusting their browser settings to reject Cookies.

10. User Responsibility in Protecting Their Data

10.1 Notwithstanding our efforts to keep Personal Data confidential, according to the terms of this Privacy Policy, it is the responsibility of each User to keep their login and password for accessing their account on Tela secure and confidential.

10.2 If the User believes that their login and password for accessing their account on Tela have been improperly accessed by third parties or are known to other unauthorized persons, for any reason, the User should immediately notify MEISTRARI via email privacy@tela.com, without prejudice to the immediate password change through Tela by the User.

11. Privacy Policy Updates

11.1 MEISTRARI may, at any time, change this Privacy Policy at its sole discretion. Any changes will be informed, 30 (thirty) days in advance, through Tela itself and/or the email provided by the User and/or we will highlight these changes at the top of these Terms of Use and provide, for a reasonable period, a highlighted link to such changes. The User should check this page and review this Privacy Policy periodically to ensure they agree with the modifications.

11.2 Except when express Consent is mandatory, if the User continues to use Tela and/or does not object to the changes and new terms informed by MEISTRARI after 30 (thirty) days from the disclosure of the new version of the Privacy Policy, it will be understood that they are fully aware and agree with the new terms applicable to the Processing of Personal Data. If the User does not agree with the changes to the Privacy Policy, they should refrain from using Tela, and may request the cancellation of their account, in accordance with the Terms of Use.

MEISTRARI
Date of Last Update: 01/15/2025

Contact:
- Email: privacy@tela.com
- Address: Alameda Ministro Rocha de Azevedo 599, apt 11