Supplemental Privacy Policy for Brazil

When you provide us with your personal information in connection with our Websites or Services, we serve as a data controller. Where we act as a data controller we determine how your personal information will be utilized, in accordance with our Privacy Policy and this Supplemental Privacy Policy for Brazil.

We rely on several legal bases to process your personal information. These legal bases include where:

• The processing is necessary to perform our contractual obligations related to a contract of which you are a party and at your request, such as to provide you with access to our Websites or to provide you Services;
• You have given your prior consent, which you may withdraw at any time (such as for marketing purposes or other purposes for which we obtain your consent from time to time);
• The processing is necessary to comply with a legal obligation, a court order or to exercise or defend legal claims; and
• The processing is necessary for the purposes of our legitimate interests, such as improving, personalizing, and developing our Websites, and Services, marketing new features or products that may be of interest, and promoting safety and security.

If you have any questions about or would like further information concerning the legal bases on which we collect and use your personal information, please submit your request by completing the Individual Data Request Form.

We have adopted Brazil’s General Personal Data Protection Law (Brazil) 13709/2018 (Lei Geral de Proteção de Dados Pessoais, or LGPD). This law governs the way in which we collect, use, disclose, secure and dispose of personal information.

If you are located in Brazil, you have the following rights in respect of your personal information that we hold:

• Rights of confirmation and access. The right to obtain a confirmation as to whether or not your personal information is processed, and to access your personal information and details concerning the processing of your personal information including details regarding data shared with other entities.
• Right to correction. The right to obtain rectification of your personal information without undue delay where the personal information is inaccurate or incomplete.
• Rights to anonymization and deletion. The right to anonymize, block or delete excessive personal data or data not processed in compliance with LGPD and to obtain the erasure of your personal information without undue delay in certain circumstances, such as where the personal information is no longer necessary in relation to the purposes for which it was collected or processed.
• Right to portability. The right to move, copy or transfer personal information from one organization to another.
• Rights to revocation and denial and to information about effects of revocation and denial. You have a right to revoke or deny your consent to processing your personal information and to information concerning how revoking or denying the processing of your personal information can impact you, such as if we will be unable to provide you Services.

If you wish to exercise one of these rights, submit your request by completing the Individual Data Request Form.

Under LGPD, sensitive information includes information about such things as an individual’s race or ethnicity, sexual orientation, health conditions, religious beliefs, political affiliations, and generic or biometric information. In many cases, much of these types of sensitive information will not be collected or used by MBO Partners. In the event this sensitive information is used, we only use sensitive information:

• For the primary purpose for which it was obtained;
• For a secondary purpose that is directly related to the primary purpose;
• With your consent; or
• Where required or authorized by law.

For any questions, concerns or complaints regarding a possible breach of your privacy by us, please contact our Data Protection Officer as follows:

• By completing the Individual Data Request Form
• By phone at 0011+1+703 793 6000
• By mail to MBO Partners, Inc, Attention Data Protection Officer, 20405 Exchange Street, Suite 301, Ashburn VA 20147

We will treat each complaint confidentially. We will investigate each complaint and will contact the individual that submitted the complaint within a reasonable time period once the complaint is resolved (and in any event within any applicable time periods required by law).

We may disclose your personal information to our affiliates, third party suppliers and service providers, and other third parties as described in our Privacy Policy and as authorized by Brazil’s LGPD. Some of these entities may be located outside Brazil, including in the United States, New Zealand, Singapore, Germany, Ireland, Australia, and the United Kingdom. We take reasonable steps to ensure that any entities located inside or outside Brazil that receive your personal information from us ensure the same level of data protection that is adhered to by us and that such entities do not breach applicable privacy obligations.

We may update this Supplemental Privacy Policy for Brazil from time to time. When we do update them, we will post a notice on our Websites, make the updated version of this Supplemental Privacy Policy for Brazil available on this page, and indicate the date it was last updated above. For clarity, any updates will apply from the date they are posted. Please check back periodically to see if this Supplemental Privacy Policy for Brazil has been updated.