Colorminas

This Privacy and Personal Data Protection Policy purpose is demonstrating the commitment of Colorminas Colorifício e Mineração Ltda “In Judicial Reorganization”, duly registered with the CNPJ under nº 80.084.809/0001-88, with headquarters at Rod. SC 443, Km 01, Bairro Getúlio Vargas, Içara/SC, CEP [Zip Code] 88820-000, hereinafter referred to as CONTROLLER with protection of the personal data collected, hereinafter referred to as SUBJECTS, clarifying the rules on treating personal data, in accordance with the provisions of the General Data Protection Law (Law No. 13.709/2018).

It is noteworthy that this policy has been fully read by the SUBJECTS, who declare their free and express agreement with the provisions stipulated herein, transparently, clearly and unequivocally, and authorize obtaining data and information mentioned, which will be used for the purposes described below, being aware of the data processing indispensability, to enable the provision of educational services eventually contracted, under the terms of §3, art. 9 of the General Data Protection Law.

1. CONSENT AND PERSONAL DATA COLLECTION

1.1. The SUBJECTS declare that the acceptance of this policy will be registered in the CONTROLLER's database, with the consent manifestation date, and such information may be used as proof of the SUBJECT´s acceptance, regardless of any other formality.

1.2. The SUBJECTS declare that they are aware that the CONTROLLER, in this capacity, promotes their personal data processing, limited to the minimum necessary to meet the purposes informed in this Policy, especially for communications that may be carried out between the parties.

1.3. The data will be collected and stored for the purpose of fulfilling the contract, legal and regulatory obligations, complying with public policies, protecting life and health, as well as improving the services provision, for the period required to fulfill the purpose of collecting the data or until the end of the legal or regulatory requirement to store the data.

1.3.1. If necessary and applicable, the SUBJECTS expressly authorize, through their legal guardian, their personal data processing by the CONTROLLER, always in their best interest and in compliance with the General Data Protection Law.

1.3.2. If applicable and necessary, the SUBJECTS, through their legal guardian (or person authorized by them) also authorize, in this act, processing their Sensitive Personal Data related to health, collected through a specific document (if necessary, completed by the legal guardian), provided by the SUBJECT him/herself for the purpose of emergency care, in compliance with articles 11 and 14 of the General Data Protection Law.

1.4. Among the PERSONAL DATA that may be collected are: full name, electronic address (e-mail), personal document (CPF number, for example), telephone number (landline and mobile), professional and/or residential address, profession, interests expressly provided, description/curriculum, course evaluations, comments, participation in surveys and polls, payment conditions for the CONTROLLER´s products and services, among others, related to the contract purpose for services provision.

1.4.1. Registration data, such as full name, marital status, CPF, address, telephone contact, profession, e-mail, among others, are used to fulfill the contract, of legal obligation, sharing data with third parties and authorities when requested and strictly necessary, whenever possible, in an anonymized way, to protect credit and collection procedures, and ensure the SUBJECTS´ safety.

1.4.2. The SUBJECTS' image records are used for identification and security, through monitoring, for historical collection, institutional use, recorded meetings and advertising use, when authorized.

1.4.3. Sensitive personal data, such as those related to religious conviction, health, biometric data of SUBJECTS, when applicable and necessary, are collected to enable compliance with legal/regulatory obligations, as well as for the SUBJECTS´ safety.

1.5. The SUBJECTS are aware that failure to provide some data may prevent their access to features or content made available by the CONTROLLER.

1.6. The CONTROLLER may also automatically collect some information from SUBJECTS when they access and use the website, such as characteristics of access device, browser, internet protocol (IP with date, time and origin), information about clicks, pages accessed, searches performed on the website and cookies.

1.7. After the SUBJECTS' personal data anonymization, the CONTROLLER may carry out studies and research of a historical, scientific, technological or statistical nature of interest.

1.8. The CONTROLLER may share personal data with third parties, whether public or private entities, as long as they are used for the same purpose described in this policy, to comply with the contract signed between the parties.

1.8.1. In these cases, the CONTROLLER will only share the minimum information necessary to achieve the respective purposes.

1.9. The CONTROLLER may subcontract data processing and storage service (Data Operator), so that SUBJECTS are aware of the personal data access and processing by third parties, service providers, the purpose of which is ensuring efficiency of the services to be provided.

1.9.1. The CONTROLLER ensure to the SUBJECTS, upon request, the right to entities information, public or private, with which personal data was shared.

1.10. The SUBJECTS' personal data will be processed for a period of 5 (five) years, counting from the contractual relationship end, with subsequent elimination, and its conservation is authorized in cases described in article 16 of the General Data Protection Law.

1.11. The parties declare that they are aware that the data provided by the SUBJECTS, once anonymized, are not considered personal data, as established in article 12 of the General Data Protection Law.

1.12. The SUBJECTS are responsible for the accuracy and veracity of the information provided to the CONTROLLER, and must provide accurately and update whenever necessary.

1.12.1. The SUBJECTS may, at any time, request display or rectification of their personal data, as well as change their consent grants, grant new permissions or withdraw their consent to the current permissions, through the Service Channels available in this policy, being warned of the withdrawing consent consequences.

1.13. Access to processed data is restricted to professionals authorized by the CONTROLLER, and their use, access and sharing, when necessary, will be in accordance with the purposes described in this policy.

1.14. In the event of transmission, by the SUBJECTS, of their personal data to third parties, the CONTROLLER disclaims any responsibilities arising from the data provided leakage.

1.14.1. The CONTROLLER undertakes to immediately notify the SUBJECTS, if any type of security breach of the collected data may cause risks, considered as those that may accidentally or illicitly cause destruction, loss, alteration, disclosure or unauthorized access to personal data transmitted, stored or subjected to any other processing type.

1.14.2. The SUBJECTS must adopt the necessary preventive measures for internet use, including using antivirus, personal access password and other technical and managerial measures, to avoid failures, invasions or other inconveniences in accessing the tools made available by the CONTROLLER.

2. CONTROLLER INFORMATION

2.1. Colorminas Colorifício e Mineração Ltda “In Judicial Reorganization” will be considered as CONTROLLER and OPERATOR, for the provision purposes of the General Data Protection Law (Law No. 13.709/2019, and can be contacted by telephone number 48 3431-9000; electronic address contato@colorminas.com.br or directly at its headquarters, established at Rod. SC 443, Km 01, Bairro Getúlio Vargas, Içara/SC, CEP [Zip Code] 88820-000.

2.2. The SUBJECTS may contact the CONTROLLER, at any time, through contacts mentioned in the preceding paragraph, to exercise the rights provided for in current legislation and in this policy.

2.3. When data is shared, so that the treatment is carried out by a third party indicated by the CONTROLLER, the third party will be considered as OPERATOR, for the provision purposes of the General Data Protection Law.

2.4. In due course, the CONTROLLER will indicate the person in charge of data protection on the website, as guaranteed by article 41 of the General Data Protection Law, which will act as a communication channel between CONTROLLER and SUBJECTS and between CONTROLLER and National Authority.

3. CONTROLLER´S OBLIGATIONS AND OTHER OPERATORS

3.1. The CONTROLLER will provide service within quality and safety standards applicable to works of this nature, using duly qualified personnel, being responsible for the faithful and exact fulfillment of the obligations established in this policy, in the Contract signed between the parties, if it is the case and in the governing legislation.

3.2. The CONTROLLER will use its best efforts to protect information, applying necessary administrative and technical protection measures available at the time, demanding from partners and suppliers the same acceptable level of information security, based on best market practices, from contractual clauses.

3.3. The third party, in the capacity of OPERATOR, shall carry out the treatment according to instructions provided by the CONTROLLER, within the limits of the SUBJECTS' consent, expressed through adherence to this policy and in full compliance with the governing legislation, in particular the General Data Protection Law.

4. SUBJECTS´ RIGHTS

4.1. Every natural person is assured personal data ownership and the fundamental rights of freedom, intimacy and privacy, under the terms of the Federal Constitution of 1988 and the General Data Protection Law.

4.2. Pursuant to article 18 of the General Data Protection Law, SUBJECTS have the right to obtain from the CONTROLLER, in relation to the data processed, at any time and upon request:

a) treatment existence confirmation;
b) access to data;
c) correction of incomplete, inaccurate or outdated data;
d) anonymization, blocking or elimination of unnecessary, excessive or treated data in violation with the provisions of the General Data Protection Law or this policy;
e) portability of data to another service provider, upon express request and observing commercial and industrial secrets, in accordance with legal regulations and the data exception that have already been anonymized by the CONTROLLER;
f) elimination of personal data from data processed with the consent of the SUBJECTS, except in cases provided for in article 16 of the General Data Protection Law;
g) information about the possibility of not providing consent and about the refusal consequences, among which stands out the impossibility of accessing some functionalities or content of the electronic site;
h) consent revocation, pursuant to §5, article 8 of the General Data Protection Law.

4.3. SUBJECTS have the right to petition in relation to their data, against the CONTROLLER, before the National Authority, and to use legal means to enforce this instrument and the governing legislation.

4.4. SUBJECTS may oppose the treatment carried out in disagreement with the General Data Protection Law or with this policy, upon express request to the CONTROLLER.

4.4.1. The request will be answered, free of charge, to the SUBJECTS, within 15 (fifteen) days, except for another legal term, and under the terms established in this policy and in legal rules.

4.4.2. In the event that the request aims at the correction, elimination, anonymization or data blocking, if they have been shared with a third party, the CONTROLLER will immediately inform them, so that it also meets the SUBJECTS' request.

4.5. Pursuant to § 4 of art. 18 of the General Data Protection Law, in case of impossibility of immediate adoption of the measures mentioned in the previous item, the CONTROLLER will send the SUBJECTS a response in which it may (i) communicate that it is not a processing agent (CONTROLLER or OPERATOR) of the data and indicate, whenever possible, the person responsible; or, (ii) indicate factual or legal reasons that prevent the measure immediate adoption.

5. FINAL PROVISIONS

5.1. The SUBJECTS confirm the data informed veracity at the time of registration, under penalty of civil and criminal liability.

5.2. The CONTROLLER reserves the right to modify this instrument in any provision, including without prior notification, except in cases required by law.

5.3. From now on, the SUBJECTS express their consent for information and rights arising from this instrument to be transferred to third parties, as a result of sale, acquisition, merger, corporate reorganization or any other change under the CONTROLLER´s control, provided that they are used for the same purpose described in the service provision contract and in this policy.

5.4. Communications made by the CONTROLLER through registration data informed by the SUBJECTS will be considered valid, for all purposes.

5.4.1. It is up to the SUBJECTS to proceed with any updates to their registration data.

5.5. If any provision of this instrument is considered illegal, void or unenforceable for any reason, the other provisions will not be affected and will remain valid and in force.

5.6. Any failure of the CONTROLLER to enforce or exercise any provision of this instrument or related rights does not constitute a waiver of that right or provision.

5.7. Tolerance of one party to the other regarding breach of any obligations assumed in this contract will not imply in novation or waiver of right. The tolerant party may, at any time, demand from the other party the faithful and complete compliance with this policy.

5.8. The CONTROLLER will keep the entirety of this policy available for consultation on its website.

5.8.1 Questions related to this policy may be resolved by the CONTROLLER's secretariat, through the channels mentioned in item 2.1.

5.9. This policy will remain in force for as long as the effects resulting from its adhesion last.

5.10. This instrument will be governed by Brazilian laws.

5.11. The parties elect the jurisdiction of the District of Içara/SC, to resolve any questions arising from this instrument application, renouncing any other, however privileged it may be.

Içara, 16 of June 2021.