Privacy Policy

To contribute to the understanding of some more specific and common terms used in the processing of personal data, we have provided below some important definitions that will facilitate your understanding, as well as the limits of our use and your rights:

• Data Subject: The person who owns the data, which means you are the data subject of your personal data.
• Personal Data: Information that can individually or exclusively identify a data subject. Your name, CPF (Brazilian Tax ID), RG (Brazilian ID), address, and computer IP address are examples of personal data.
• Sensitive Personal Data: Data that can reveal a data subject’s racial or ethnic origin, as well as their political opinions, religious or philosophical beliefs, membership in trade unions, genetic or biometric data intended to uniquely identify a natural person, data related to a person’s health or sexual life, or sexual orientation.
• Anonymized Data: Data that does not allow the identification of a data subject but can provide inputs to identify a group of people. Behavior recorded by browsing pages of a visited website that does not require login and password can be an example of anonymized data.
• Controller: The entity responsible for making decisions related to the processing of personal data collected from data subjects. In this case, HARALD is the controller of the data provided on this website.
• Joint Controller: Other individuals or entities equally responsible for making decisions related to the processing of personal data of data subjects, along with the Controller.
• Processor: The entity responsible for contributing to the execution of data processing according to the instructions of a Controller. In this case, we can consider customer support (SAC), data storage servers of the website, the company responsible for maintaining the website’s systems as some of the processors of the data provided on this website.
• Processing: Any operation performed with personal data, which may include obtaining, accessing, analyzing, transferring, storing, anonymizing, deleting, among others.

Cookies are data files typically installed on your computer and/or other devices (such as mobile phones and tablets) while browsing websites. This is a generic term given to various technologies that serve the same purpose, with “Cookies” being the collective term for them.

We use Cookies to recognize your browser or device and provide a more personalized experience based on your browsing habits and learning about your interests. This allows us to provide more personalized features and services.

Cookies allow Harald to:

• Track your preferences to show only ads that are relevant to you.
• Conduct research and diagnostics to improve the availability of content, products, and other services.
• Enhance detection and action against fraudulent activities.
• Improve the security of the website.

You can check each of the Cookies used by Harald, a description of the individual purpose of each one, as well as the partners and platforms that provide them to achieve our goals. Click here to see the complete list.

The use of Cookies is not mandatory. However, if you block or reject their use, you may not be able to enjoy all the functionalities provided by this website.

You can manage your cookie preferences in your browser while browsing our website. To do so, you can click on “Help” in your browser’s settings to learn more about what cookies are, their expiration time, receive notifications whenever you receive new cookies from any website, or even how to disable them. The links below provide more details on how to disable cookies in the most popular browsers:

• Google Chrome
• Mozilla Firefox
• Safari
• Microsoft Edge
• Opera
• Internet Explorer

1. Browsing Data

Data such as IP address, geolocation, technical information about the device used for browsing, browser information, searched or viewed products and categories, view count, purchase history, and session information including page response times, download errors, and duration of page visits may be automatically collected during your access to Harald’s website, regardless of your registration, for the following purposes:

• Recommendation of online or physical stores for the purchase of Harald products;
• Display of personalized ads based on your interests;
• Diagnosing and resolving technical issues;
• Website improvement development;
• Analysis for the protection of the security level of your account and registration data.

The collection of this data may be carried out through monitoring technologies, including but not limited to, cookies (mentioned in item 3). Any monitoring technology used by Harald will not grant access to the device used or disclose information beyond what the user chooses to share. You can express your preferences through your browser settings.

1. Registration Data

Personal data such as full name, ID number, tax ID number, phone/mobile number, complete address, date of birth, email address, and access password, as well as banking, familial, employment, judicial, educational, and government identifiers, may be collected for the following purposes:

• Correct identification and authentication of the user; Updating your registration for contact via phone, email, SMS, WhatsApp, direct mail, or other communication methods;
• Recommendation of products, promotions, and offers;
• Handling your requests, complaints, suggestions, and/or inquiries through our Customer Service Center;
• Sending information about product updates, applications, news, and other relevant events for maintaining the relationship you have with Harald;
• Protection of Harald’s rights and obligations, including in legal and administrative measures;
• Compliance with a court order or request by an administrative authority;
• Conducting market studies and research, keeping your data anonymized;
• Completing human resources processes and maintaining access;
• Compliance with legal obligations;
• Execution and preparation of contracts;
• Other purposes that will be informed in advance of the collection of personal data.

When using a social media account to create your profile on the website, Harald will collect the data indicated at the time of linking the respective account, in accordance with your authorization.

Harald employees may have sensitive personal data, such as health data, disability or special needs information, race/ethnic origin, and union membership collected for the aforementioned purposes, in accordance with the legal bases of compliance with a legal or regulatory obligation, regular exercise of rights, according to Article 7, paragraph II, and Article 11, paragraph I, d) of the General Data Protection Law, Law No. 13,709/2018.

Harald does not use contacts and data from children and individuals under 18 years of age without the permission of their legal guardian. The Company makes efforts to process personal data of minors by obtaining explicit and unequivocal consent from their legal guardian, as established by the General Data Protection Law, Law No. 13,709/2018, for pre-established and informed purposes.

By voluntarily accepting the content of this Policy, you authorize Harald to collect your data and information, being solely responsible for the accuracy of this information, and assuming liability for any false, excessive, or inaccurate information provided during the registration process on the website, and for any direct or indirect damages caused to Harald or any third parties as a result of these facts.

The provision of data is not mandatory, however, it is important for you to know that if you choose not to provide them, Harald may not be able to offer you all the services available through the website or effectively provide customer support.

Whenever necessary, Harald may share your personal data, using tools equipped with security mechanisms that preserve the integrity of such information, with:

1. a) Service providers

Harald relies on various service providers to deliver its products and services, such as companies specialized in marketing activities and offers, promotional actions, data enrichment, cloud storage, security analysis, and anti-fraud measures. These service providers process personal data collected on behalf of and according to Harald’s instructions, for purely commercial and operational purposes.

1. b) Judicial, police, governmental authorities, or other third parties with whom Harald is required by law, regulatory standards, or court order to share your Data

To comply with legal or regulatory obligations, fulfill court orders, or respond to requests from government or administrative authorities, Harald may also share your personal data.

1. c) Potential buyers

In the event of an intention to sell or transfer part or all of Harald’s business, commercial, or operational activities, Harald may share your data with potential buyers for the legal audit of the company’s assets. Harald will formally request that these potential buyers maintain confidentiality regarding this information, using it only for this specific purpose, and that, if the transaction is not completed, they securely delete this data and provide proof of its proper disposal.

Harald relies on the assistance of its partner company Gupy for the recruitment of potential employees. Therefore, when browsing the options available on the “Work with Us” page, the data subject may be redirected to the third party’s page, which has its own data processing guidelines in accordance with the requirements imposed by the General Data Protection Law.

Within the recruitment process, in addition to the involvement of the company Gupy mentioned in section 7.1, your data is processed by other companies that assist us, such as Tecfy, where we utilize their hosting infrastructure, support services, and systems such as the employee hiring platform, electronic document management module, and electronic document signing module. For hired employees, their data is shared with the company Totvs, which provides us with the Human Resources management system, system support, and hosting of said data.

We use several legal bases, as provided in the General Data Protection Law, to process your personal data, mainly including:

Consent: The processing of your personal data may occur based on your consent. In such cases, you can withdraw your consent at any time without affecting the lawfulness of the prior processing. Providing your consent is voluntary.

Contractual Performance: We may process your personal data as necessary to fulfill or perform our contractual obligations or to take steps at the request of a contracting party prior to entering into a contract.

Regular Exercise of Rights: Your data may be used for the execution of disputes, such as civil, advisory, and labor matters.

Legitimate Interest: We may process your personal data as necessary to pursue our legitimate interests. In such cases, we will ensure that our interests do not override your legitimate interests.

Legal Obligation: We may process your personal data as necessary to comply with legal obligations to which we are subject and to cooperate with regulators and law enforcement agencies.

Harald may share your personal data with foreign countries in the following situations:

• To comply with legal or regulatory obligations;
• For legal cooperation under international legal instruments;
• For data storage on servers located abroad.

In the event of an international transfer of your personal data, Harald will take all necessary measures to ensure the protection and privacy of your data, carrying out such transfers only to countries whose legislation ensures a level of protection for personal data that is adequate or higher than that provided by Brazilian law. In the case of Data Processors, Harald will contractually require these measures to be guaranteed as well.

The data collected and/or shared by Harald is stored in a secure and controlled environment, on its own servers or contracted third-party servers, whether located in Brazil or abroad, in compliance with applicable law, to ensure the proper protection and privacy of your personal data.

In order to ensure the security of the collected data and prevent unauthorized access or unauthorized disclosure, Harald implements preventive and corrective security measures on its equipment and technical infrastructure, such as antivirus, anti-phishing, and vulnerability and intrusion testing.

Harald’s servers are hosted in TIER III category data centers and comply with TIA 942, NFPA75, and NFPA76 standards to ensure the level of service required by corporate clients, aligned with the strictest standards of a state-of-the-art data center.

In the case of Data Processors, Harald contractually requests the implementation of security measures to prevent unauthorized access or unauthorized disclosure of data.

Considering that no transmission of data over the Internet, wireless transmission, or electronic storage of information is 100% secure, we will make every effort to protect your data. In the event that our protection and control mechanisms fail, you will be notified, as well as the relevant regulatory agency. While we strive to protect your personal data to the best of our ability, by sharing them with us, you understand and accept the risks associated with any transmission of data over the Internet.

If you suspect that your data is at risk, please contact Harald through the direct channel with the Data Protection Officer (DPO): [email protected].

Your personal data will be kept by Harald and other service providers who require access to them, according to the purpose for which they are intended, based on applicable legal grounds and for the minimum necessary period.

Harald and other service providers with access to your data will retain them until the purpose for which they were collected is achieved or until they become unnecessary for that purpose.

Harald and other service providers with access to your data may also keep them for the period established by law in order to defend themselves in any legal action or complaints relating to their relationship with this company, or for any other legal basis that justifies the retention of such data.

The database will be periodically reviewed by Harald and other service providers with access to your data to ensure elimination when necessary, or anonymization after the completion of legal, commercial, or customer/client obligations, without the need to inform the data subject of this specific treatment.

As the exclusive owner of your data, you have the right to exercise the following rights guaranteed by the LGPD at any time:

1. Confirmation of the existence of data processing;
2. Access to the data;
3. Correction of incomplete, inaccurate, or outdated data;
4. Anonymization, blocking, or deletion of unnecessary, excessive, or data processed in violation of the law;
5. Portability of data to another service or product provider, upon express request, in accordance with the regulations of the national authority, subject to commercial and industrial secrets;
6. Deletion of personal data processed with your consent;
7. Information on public and private entities with which the controller has shared data;
8. Information about the possibility of not giving consent and the consequences of refusal;
9. Revocation of consent.

For legal reasons, some requests may not be fulfilled, such as in cases where:

• Compliance with legal or regulatory obligations by the controller;
• Existence of a valid and effective contract;
• If specific legislation determines a minimum period for data retention.

If you have any questions regarding this Privacy Policy, the processing of your personal data, or if you wish to exercise any of your rights guaranteed by the LGPD or file a complaint about a possible violation of the law, please contact HARALD through the “Contact Us” section available at the following address: Contact Us, or via email at: [email protected].

You can manage your data directly in the following ways:

For candidate data for job positions, on the Gupy platform, through the following link: Careers.

You can also directly contact the Data Protection Officer (DPO), who is responsible for the protection of personal data collected and processed by Harald, using the following email address: [email protected].

Harald may change the provisions of this Policy at its sole discretion and at any time. The changes will be considered valid after being published on the website, with highlights of the modifications, and/or after being communicated to customers/users through any other means, including but not limited to email.

If the changes to the Policy result in changes to the way your personal data is processed, a new consent will be required from you in order to continue using the services provided on this website.

During the implementation of campaigns or promotions by Harald, additional privacy terms or policies specific to these events will be made available on this website or on another specific platform to be disclosed in due course. In such cases, your specific consent will be required for participation.

This Privacy Policy shall be governed, interpreted, and enforced in accordance with the applicable Brazilian legislation, especially Law No. 13,709/2018 (“General Data Protection Law” or “LGPD”). The competent forum for resolving any issues arising from this document shall be the jurisdiction of the customer/user’s domicile.