PRIVACY AND PERSONAL DATA PROTECTION POLICY

May 22, 2025

This Privacy Policy describes the procedures and measures adopted by Intellux Ltda (“Intellux”, “we”, “us” our “our”), in accordance with the provisions of applicable legislation and regulations, (hereinafter jointly referred as the “Legislation”). This Privacy and Personal Data Protection Policy (the “Policy”) explains how we collect, use, disclose, and safeguard your information when you use our AI-powered digital marketing SaaS platform (the "Platform"), in terms of processing personal data of users and visitors (“Owners”, “Subjects” or “Users”) to our website and/or our Platform and clarifies the rights guaranteed to them.

Website or Plataforma refers to www.intellux.com.

Please read this Policy carefully. If you do not agree with the terms of this Policy, please do not access the Platform. User is aware that when User accepts the Terms of Use and this Policy and uses the Services provided by us, it is necessary to process certain Personal Data and sensitive info and that these may be shared with third parties to achieve the purposes defined in this document.

1. INFORMATION COLLECTED

1. To provide and improve our services, Intellux collects the following information from Users:
   • Registration Data: Name, email address, phone number and access password.
   • Advertising Platform Credentials: Permissions and tokens granted by You for integration with third-party advertising platforms such as Meta Ads and Google Ads.
   • Advertising Campaign Data: Data related to your advertising campaigns, including statistics, metrics, performance data, ad spend, creative content, and audience information accessed via the integrated advertising platforms.
   • Platform Usage Information: Data on how you interact with our Platform, including features used, clicks, navigation paths, and session duration.
   • Technical and Browse Information: Cookies, IP address, browser type, device information (operating system, device identifiers), and interactions within the Platform.
   • Information for AI Processing: Data derived from your campaign performance and Platform usage, which may be used to train and improve our AI models (as detailed below).
2. Data collection occurs with your express consent upon registration and use of the Platform, or as necessary for the performance of our Services. This collection aims to provide our Services, enhance your User experience, and optimize the performance of your digital marketing campaigns.
3. Processing of Personal Data: means any operation carried out with Personal Data, such as those relating to the collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, elimination, evaluation or control of the information, modification, communication, transfer, dissemination or extraction.
4. Personal Data means all information and data related to the natural person, which identifies or makes it possible to identify the natural person, whether that person is a User of our website/Platform or contracts Services provided by us, visitor or participant in the selection process, or has signed a commercial partnership or service agreement. The Data of partners, administrators and end-beneficiaries of a legal entity User are also protected.
5. Data Operator means any natural or legal person who processes Personal Data on behalf of and under the instructions of the Controller.
6. Controller means Intellux and/or Google.
7. Owner or Subject means a natural person to whom the Personal Data that are the object of Processing refers to.

2. PURPOSE AND LEGAL BASIS FOR DATA PROCESSING

2. Your data is collected and processed for the following purposes and based on the specified legal bases:
   • Service Provision: To operate and maintain your account, enable integrations with advertising platforms, and allow you to manage and optimize your advertising campaigns using the Intellux Platform (Legal basis: Performance of a contract).
   • AI-Powered Optimization and Insights: To leverage our artificial intelligence algorithms to analyze your campaign data, provide performance insights, automated optimization suggestions, and personalized recommendations to improve your marketing strategies (Legal basis: Performance of a contract; Legitimate interest in improving our services).
   • AI Model Training and Improvement: To use anonymized and aggregated data, and in some cases, personal data (with consent where required), derived from your campaigns and Platform usage to train, develop, and improve our AI models and the overall effectiveness of the Platform. You may have options to manage the use of your data for model improvement where applicable by contacting us (Legal basis: Legitimate interest; Consent where applicable). *
   • Personalization: To personalize your experience on the Platform, including providing tailored recommendations and reports (Legal basis: Legitimate interest).
   • Communication: To send you service-related communications, updates, security alerts, and support messages (Legal basis: Performance of a contract; Legitimate interest).
   • Security and Authentication: To ensure the security of our Platform, prevent fraud, and verify user identity (Legal basis: Legal obligation; Legitimate interest).
   • Legal Compliance: To comply with applicable legal obligations, court orders, or requests from competent authorities (Legal basis: Legal obligation).
3. Automated Decision-Making and Profiling: Our AI may perform automated analyses and make recommendations. While our AI assists in decision-making, you generally retain control over implementing these suggestions. Where automated decisions significantly affect you, you may have the right to obtain human intervention, express your point of view, and contest the decision.
4. Data Controller and Data Processor: For your Registration Data and direct interactions with Intellux, we act as the data controller. For the Advertising Campaign Data that you provide or make accessible through third-party platforms for processing within Intellux, you are the data controller (or act on behalf of the controller), and Intellux acts as a data processor, processing such data on your behalf and according to your instructions or as necessary to provide the services. Where required, a separate Data Processing Addendum (DPA) will govern such processing.
5. Your data is not sold to third parties. We do not share your personal information with third parties except in the situations described in this policy or with your explicit consent.
6. You acknowledge that it is your sole and exclusive responsibility to ensure the veracity, precision, completeness, updating and accuracy of your Personal Data. That said, you must inform users as soon as possible of any changes to the Personal Data provided.
7. Personal Data of personal identification are processed to allow the individualization of the User's registration and, consequently, the provision of the Services, and may also be used to contact you, to send newsletters, to disseminate new services and products, to manage and resolve your complaints, demands, requests for support, clarification of doubts, to prove the lawful origin of resources, to ensure compliance with applicable Legislation and/or to improve our Services.
8. We process the following Personal Data:
   • Full name, date and place of birth, nationality, signature, proof of address (e.g. consumer accounts), home, business and/or mobile phone numbers, business or home addresses and e-mail address;
   • Identification document such as Individual Taxpayer Registration, Passport, Foreigner National Registration, valid National Driver's License, Identity Card and data relating to the natural person contained in these documents;
   • Corporate and tax identification information necessary to verify that the client is a duly organized and validly existing legal entity, such as a U.S. IRS Form W-9 or equivalent documentation containing the entity's Taxpayer Identification Number (TIN).
9. Data on the use of our Website/Platform are collected with the Owner's consent when accepting this Privacy Policy and the website's warning popup, and Cookies from Intellux or third parties may be used in order to facilitate the use of the Website/ of the Platform, adapt its content to make it more useful and accessible, as well as provide and improve our Services. That said, we use some Cookies and observe the provisions of the applicable legislation. The User can configure the use of Cookies at any time by accessing the "Configuration" options of its web browser, being aware that by deactivating the update of Cookies, some Services may not work correctly, affecting, in whole or in part, the navigation.
10. We process the following Usage Data:
    • Internet protocol address (e.g. IP address);
    • Browser type and version;
    • The pages of our Services that you visit (preferences), time and date of visit, time spent on those pages, particular equipment used to access and other diagnostic information;
    • Technical data and information, usage statistics, preferences, content personalization, access to User Account(s).
11. Please note that you are not required to provide us with your Personal Data and sensitive info. However, if you choose not to do so, including not providing us with updated data, we will not be able to provide the Service, our products and other services or your access to them will be limited, suspended or terminated.
12. Intellux's data usage practices are fully compliant with the Google API Services User Data Policy. We do not use any data obtained through Google Workspace APIs to train, develop, or improve Artificial intelligence models. All such data is used exclusively for user-authorized functions within the Platform and solely to provide features, such as informative dashboards, to which the user has explicitly consented.

3. SHARING WITH META AND GOOGLE ADS (AND OTHER ADVERTISING PLATFORMS)

3. To enable integration with Meta Ads, Google Ads, and similar advertising platforms, Intellux requests specific permissions and access tokens from you. The use of data by these platforms is governed by their respective policies.
4. You can revoke Intellux's access to your advertising platform accounts at any time through the settings of the respective platforms or within your Intellux account settings.
5. Intellux does not modify campaigns without your authorization (either direct or through pre-set automation rules you configure) and only processes the data necessary for performance analysis, optimization, and reporting as permitted by you.

4. DATA STORAGE, SECURITY AND RETENTION

4. Security Measures: Intellux employs robust administrative, technical, and physical security measures to protect your data against unauthorized access, disclosure, alteration, loss, or destruction. These measures include data encryption in transit and at rest, access controls, secure server infrastructure, regular security assessments, and staff training.
5. Data Storage: Your data is stored on secure servers, which may be located in various jurisdictions, including the United States. Access to this data is restricted to authorized personnel who require it to perform their job duties.
6. Data Retention: We will retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including for the duration your account is active, to provide you with our Services, to comply with our legal obligations (e.g., tax, accounting), resolve disputes, enforce our agreements, and for the continued operation and improvement of our AI models. Data used primarily for AI model training may be anonymized or aggregated and retained for longer periods. You may request the deletion of your account and associated personal data as described in Section 5.
7. International Data Transfers: Your information, including Personal Data, may be transferred to, stored, and processed in countries other than your own, including the United States, where our servers or those of our service providers may be located. These countries may have data protection laws that are different from those in your country. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy.
8. Data Breach Notification: In the event of a Personal Data breach that is likely to result in a high risk to your rights and freedoms, a notice will be published on our website. Additionally, affected users will be notified directly by email.
9. Our employees who have access to Personal Data are bound by confidentiality and data protection duties under the terms of this Policy (except as provided for in this Policy and/or applicable Legislation). Authorized persons, Operators who have access to such data, and/or service providers eventually contracted, who use such data for other purposes or improperly, share or disclose them without prior written authorization from the Subject of the Personal Data, violating this Policy or applicable rules, shall be subject to liability and applicable legal measures.

5. YOUR DATA PROTECTION RIGHTS

5. Depending on your location and applicable data protection laws (such as LGPD – Data Protection General Law in Brazil, GDPR- General Data Protection Regulation in European Union (EU), CCPA/CPRA- California Consumer Privacy Act/ California Privacy Rights Act - in the USA, you may have the following rights regarding your Personal Data:
   • Right to Access: To request access to the personal data we hold about you.
   • Right to Rectification: To request correction of inaccurate or incomplete personal data.
   • Right to Erasure (Deletion): To request the deletion of your personal data, subject to certain legal limitations.
   • Right to Restrict Processing: To request the restriction of our processing of your personal data in certain circumstances.
   • Right to Data Portability: To request to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller.
   • Right to Object: To object to our processing of your personal data, particularly for direct marketing or where processing is based on legitimate interests.
   • Right to Withdraw Consent: To withdraw your consent at any time where we rely on consent to process your personal data.
   • Rights Related to Automated Decision-Making: Not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except under certain conditions.
   • Right to Opt-Out of Sale or Sharing (for CCPA/CPRA): If applicable, the right to opt-out of the "sale" or "sharing" of your personal information for cross-context behavioral advertising. (Intellux confirms it does not "sell" personal data in the traditional sense. For details on "sharing," please contact us).
   • Right to Non-Discrimination: To not be discriminated against for exercising your privacy rights.
6. To exercise these rights, or if you have any questions about them, please contact us at support@intellux.com. We will respond to your request in accordance with applicable data protection laws. We may need to verify your identity before processing your request.
7. If it is impossible to immediately respond to the request, we will take necessary measures within 5 (five) business days. If we are not the Personal Data Processing Agent, it will indicate the responsible Processing Agent and ask him to attend User´s request. In any circumstance, our right stated in 5.3.1 below shall remain valid and enforceable.
8. The right to delete Personal Data and other data will be evaluated and guaranteed when requested by the User, however, Intellux's right to keep stored Personal Data and data of operations and services necessary for the fulfillment of any legal or regulatory obligations to which Intellux is or may be subject to; for the statute of limitations for the regular exercise of Intellux's rights in any legal, administrative or arbitration claims or disputes (if any); or by decision or order of a judicial or administrative authority that so requires.

6. USE OF COOKIES AND TRACKING TECHNOLOGIES

6. Cookies are text files stored in the browser that collect data when you visit any web page or platform. Its main use is to store data for each visit made on the page, which can be used for advertising purposes, identification of User preferences, to optimize the performance of our website or Platform, as well as those strictly necessary to enable navigation and access to the Services. and resources that may be made available. Intellux uses cookies, web beacons, and similar tracking technologies to collect information about your Browse activities, enhance your user experience, analyze Platform usage, and assist in our marketing efforts.
7. You can manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform. For more detailed information, please see our Cookies Notice at: _________________

7. SUB-PROCESSORS AND THIRD-PARTY LINKS AND SITES

7. Intellux may engage third-party companies and individuals (sub-processors) to facilitate our Platform (e.g., cloud hosting providers like AWS or Google Cloud, analytics services, customer support tools). These sub-processors may have access to your personal data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose. We maintain a list of our key sub-processors and ensure they adhere to data protection standards comparable to ours.
8. Our Services, Website and Platform may contain links to other websites that are not operated by us. If you click on a third-party link, you will be directed to that third party's website. We encourage you to review the Policies and Terms of Use for each site you visit. We have no control over and assume no responsibility for the content, privacy policies, other policies or practices of any third-party websites, services or platforms of third parties and service providers.

8. CHILDREN'S PRIVACY

8. Intellux Platform is not intended for or directed at individuals under the age of 18 (or the relevant age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected personal data from a child without verification of parental consent, we will take steps to delete that information from our servers promptly. In case you are aware of any minor having accessed the site or Platform please immediately contact us by e-mail: privacy@intellux.com

9. CHANGES TO THIS PRIVACY POLICY

9. Intellux may update this Policy periodically to reflect changes in our practices, services, or applicable laws. In the event of significant changes, we will notify users through the Platform or by email.
10. Your continued use of the Platform after such modifications will constitute your acknowledgment of the modified Policy and agreement to abide and be bound by the new terms. We encourage you to review this Policy frequently to stay informed about how we are protecting your information.

10. CONTACT US

10. If you have any questions, concerns, or requests regarding this Policy or our data practices, please contact us at: Email: support@intellux.com. Please inform your full name, company denomination, contact info and details of your request.

By using the Intellux Platform, you declare that you are aware of and agree to the terms of this Policy.