PRIVACY POLICY

• User:User: A natural person who owns the personal data processed by KLAVE.
• Personal data:Personal data: Information related to an identified or identifiable natural person.
• Sensitive personal data:Sensitive personal data: Personal data regarding racial or ethnic origin, religious belief, political opinion, union membership or affiliation with a religious, philosophical, or political organization, data related to health or sexual life, genetic or biometric data, when linked to a natural person.
• Data processing:Data processing: Any operation performed with personal data, such as collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, deletion, evaluation or control of information, modification, communication, transfer, dissemination, or extraction.
• Controller:Controller: A natural or legal person, whether public or private, responsible for making decisions regarding the processing of personal data.
• Operator:Operator: A natural or legal person, whether public or private, who processes personal data on behalf of the controller.
• Consent:Consent: A free, informed, and unambiguous expression by which the data subject agrees to the processing of their personal data for a specific purpose. Consent is not the only reason that authorizes data processing but is one of the valid grounds.
• Deletion:Deletion: Removal of data or a set of data stored in a database, regardless of the procedure used.
• Data sharing:Data sharing: Communication, dissemination, international transfer, interconnection of personal data, or shared processing of personal databases by public bodies and entities in the performance of their legal duties, or between these and private entities, reciprocally, with specific authorization, for one or more types of processing allowed by these public entities, or among private entities.
• Cookies:Cookies: Small text files stored on a user’s computer that can be retrieved by the site that sent them during browsing. They are primarily used to identify and store information about visitors.
• Encryption:Encryption: A set of principles and techniques for encrypting writing, making it unintelligible to those who do not have access to the agreed conventions.

1.CONTROLER AGENT

• 1.1.This policy is used by KLAVE TECNOLOGIA E BLOCKCHAIN LTDA, a private legal entity duly registered with the CNPJ under nº 42.355.765/0001-94, headquartered at Rua Anita Garibaldi, nº 600, upper floor, Centro, Itajaí/SC, CEP nº 88.303-020, hereinafter referred to as KLAVE.
• 1.2.KLAVE collects and processes its Users' data, respecting the limits, purposes, and intentions set forth in this document.
• 1.3.Data may be actively captured and transmitted directly to KLAVE’s employees, physically or digitally, and will be transmitted and preserved on partner platforms as outlined in the DATA SHARING chapter.

2.ABOUT THE DATA WE COLLECT

• 2.1.Data, including personal data, may be collected when you submit it or when you interact with KLAVE's services.
• 2.2.Data collection. For the proper provision of services and other purposes expressed throughout this Privacy Policy, personal data of users, their employees, or legal representatives may be collected.
• 2.3.Processed personal data: KLAVE will collect only the data strictly necessary to ensure the adequate provision of contracted or offered services. This includes information such as your full name, email address, and mobile phone number.
• 2.4.Additionally, if you choose to log in through your Google or Facebook credentials, your user profile picture will also be processed. If you create or log in to your account through a social media site, we will have access to certain information from that site, such as your name, Facebook ID, cover photo, age range, profile link, profile photo, gender, location, timezone, profile update time, profile verification status, account information, and friends list, in accordance with the authorization procedures specified by that social media site.
• 2.5.In the 'Fans' feature, it is important to note that you authorize KLAVE to access and use your personal data recorded on platforms such as 'Spotify,' 'Apple Music,' 'Deezer,' and 'YouTube' to enhance your experience and provide personalized services.
• 2.6.Sensitive data provided by users: Sensitive data will not be collected; however, it may be transmitted if done so at the user's own initiative, with prior, absolute, and unequivocal consent.

• 2.7.Children's and adolescents' data. The processing of children's and adolescents' data will not be carried out, except with prior, absolute, and unequivocal consent from their legal guardians.

• 2.8.Specific data collection. Data is collected at the following times:

  a)Registration: At the time of registration with KLAVE, we request essential information such as full name, email address, and mobile phone number, necessary for the correct provision of the offered services.

  b)b) 'Fans' feature: When you choose to use the 'Fans' feature, you authorize KLAVE to access and use your personal data previously registered on third-party platforms, such as Spotify, Apple Music, Deezer, and YouTube. This allows us to personalize the services offered based on your preferences.

3.COOKIES POLICY

• 3.1.For administrative purposes, KLAVE may occasionally use cookies. The user can, at any time, activate mechanisms in their browser to inform them when cookies are activated or even disable them.

• 3.2.Cookies are categorized as follows:

  a)Necessary Cookies: These are important for the functioning of the platforms; without them, functionalities would be affected and usage would be impossible. These cookies may collect the following information: system preference settings, action history, and IP number.

  b)Third-Party Cookies: These cookies are used to improve the platform’s performance and marketing strategies, with the help of partner but independent companies such as Google Analytics and Google Ads. These cookies may collect the following information: visit duration, accessed pages, completed downloads, filled forms, and IP number.

  c)Preference Cookies: These cookies aim to remember the user's preferences for using the platform, even after closing the browser or restarting, by collecting information such as: access password (if the user has chosen this option), searched keywords, visited pages, and IP number.

• 3.3.Rejection or deletion of Cookies: You can manage cookies through your browser, which may already have default authorizations.

4.USE OF COLLECTED INFORMATION

• 4.1.Destination of collected data. We use the information collected about users to carry out our communications, notifications, and policy changes, as well as to provide the contracted service of KLAVE.

• 4.2.For greater clarity regarding the use of data, we aim to outline the purpose of collecting this information as transparently as possible.

  DATA	LEGAL BASIS	PURPOSE
  Clause 2.3.	Data necessary for contract execution or preliminary procedures related to the contract to which the data subject is a party, at the request of the data subject (Art. 7, V, Law No. 13.709/2018). Data necessary for the regular exercise of rights, including in contracts (Art. 11, II, d, Law No. 13.709/2018).	The listed data are processed to provide services to the user who contracts KLAVE or requires preliminary procedures related to the contract.
  Clause 2.3.	Data necessary to comply with legal or regulatory obligations (Art. 7, II, and Art. 11, II, a, Law No. 13.709/2018)	The listed data are processed for potential legal obligations arising from the contractual relationship of the parties or otherwise, such as the issuance of invoices, tax declarations, among other similar situations.

• 4.3.Change in the purpose of collected data usage. If we change the purposes provided for in item 4.2 of this Privacy Policy, disregarding the consent originally provided, users will be informed, with specific emphasis on the nature of the changes, thus allowing for consent revocation.

5.DATA SHARING

• 5.1.Data sharing. Except as provided in this Privacy Policy, we will not share your personal information with third parties without your specific consent. We may share non-personal information, such as aggregated user statistics, demographic information, and usage information, with third parties such as Google Play and Apple Store.

• 5.2.Instances of data sharing. By using this service, you agree to have your personal information shared solely for the purpose of transmission and storage, with exclusive use of the data by KLAVE, and that your personal information may be transmitted to third parties and the personal information you disclose will be subject to the privacy policy and business practices of these third parties;

  •With suppliers, consultants, and other service providers who need access to this information to perform work on our behalf, including, but not limited to, third-party payment processors;

  •With our artist partners for their own services and marketing purposes, unless you choose to opt-out of this type of sharing;

  •In response to an information request, if we believe disclosure is consistent with or required by any applicable law, regulation, or legal process;

  •With your consent, we may share email addresses with record labels for their own services and marketing purposes, unless you choose to opt-out of this type of sharing.

• 5.3.Business Transfers. We may share your personal information with other entities and affiliates controlled by KLAVE for business and operational purposes. As we continue to develop our business, we may sell or buy assets. If another company acquires our company, business, or assets, it may also acquire the personal information (and Usage Information) collected and stored by us, thus assuming the rights and obligations regarding your personal information, as described in this Privacy Policy. Additionally, if any bankruptcy or recovery proceedings are filed by or against us, all such information may be considered one of our assets and, as such, may be sold or transferred to third parties.

• 5.4.Legal Disclosure. Except where KLAVE receives a legal or judicial order, your personal information will not be transferred to third parties or used for purposes other than those for which it was collected.

• 5.5.By connecting to 'Spotify,' 'Apple Music,' 'Deezer,' and 'YouTube,' you agree to the Terms and Privacy Policy of these platforms. This means that by using these third-party services in conjunction with KLAVE, you are subject to the policies and terms established by each of them, in addition to KLAVE's privacy policies and terms. Make sure to read and understand the policies and terms of all these services before proceeding.

6.INFORMATION SECURITY

• 6.1.Confidentiality. KLAVE follows strict security and confidentiality standards to protect our users' personal information. All personal information provided will be collected by ethical and legal means, and users will be informed about the purpose of data collection, allowing them to decide whether to provide the information. KLAVE will maintain the integrity of the personal information provided by users.

• 6.2.Legal provision. You hold all rights provided in Article 18 of Law 13.709 of 2018. This means that, at any time, you can exercise any right stated there and as further exemplified in this policy. These rights may be exercised before consumer protection agencies, as well as the National Data Protection Authority (ANPD).

• 6.3.Security measures. We employ technical and organizational measures to protect personal data from unauthorized access and situations of destruction, loss, theft, or alteration of this data. The measures we use consider the nature of the data, the context and purpose of processing, the risks that a potential violation would generate for the user’s rights and freedoms, and the standards currently employed by similar companies. Among the measures we have adopted, we highlight the following:

  a)Our users' data is stored in a secure environment;

  b)We limit access to our users' data, ensuring that unauthorized third parties cannot access it;

  c)We keep a record of all those who, in some way, have contact with our data;

  d)Access to data is only permitted after an authentication process involving a login and password.

• 6.4.For inquiries related to the General Data Protection Law (LGPD) and the rights of data subjects, please email [email protected]. Your request will be processed within 15 (fifteen) business days. Users can also contact us through the same channel for suggestions or questions.

• 6.5.Responsibility. Please be aware that, although we strive to secure information in our possession and control, no security system can prevent possible security breaches, and we are not responsible for the use or disclosure of personal or non-personal (anonymized) information arising in connection with theft. Likewise, users are responsible for safeguarding the confidentiality of passwords, and we are not responsible for access, use, or disclosure of information if such access, use, or disclosure arises from the theft or (intentional or negligent) disclosure of a password. Despite our security measures, complete confidentiality cannot be guaranteed.

• 6.6.In the event of any security incident that could generate significant risk or harm to any of our users, we will inform the affected individuals and the National Data Protection Authority about the incident, in compliance with the provisions of the General Data Protection Law.

• 6.7.Access to information. Access to collected personal information is restricted to authorized employees or contractors who help us operate the Site or process orders and contracts made through the site. Employees and contractors who misuse this information, violating this Privacy Policy, will be subject to our company's disciplinary process, as well as civil and criminal penalties provided by law.

7.USER RIGHTS AND DATA TRANSFER

• 7.1.User consent. Users are aware and expressly, freely, informedly, and unequivocally agree that KLAVE, as a result of this Agreement, may process their personal data, including sensitive personal data, within the limits specified in this document, solely to fulfill the intended purpose, and in compliance with all applicable information security, privacy, and data protection laws, including, but not limited to, Law No. 13.709/2018 (General Data Protection Law), under penalty of liability for damages caused by the infringing party.

• 7.2.In addition to the information provided in this Privacy Policy, users may also exercise the rights provided under the General Data Protection Law, including:

  (i)Confirmation of the existence of personal data processing;

  (ii)Access to personal data;

  (iii)Revocation of consent;

  (iv)Correction of incomplete, inaccurate, or outdated personal data;

  (v)Deletion of personal data processed with consent or unnecessary, excessive data, or when any point of the LGPD has not been met;

  (vi)Information about the instances and with which companies, partners, and other institutions we may share or receive personal data related to you;

  (vii)Information about the possibility of not providing consent and the consequences of denial, when applicable;

  (viii)All requests will be handled free of charge and will be subject to prior verification of your identity and feasibility of the request to fulfill any obligations that may prevent complete fulfillment of the requests of data subjects.

• 7.3.Transfer of users' personal data. Some of your personal data may be transferred to other countries, for example, when we use cloud computing services for data processing or storage. It is noteworthy that all requirements established by current legislation are observed, adopting the best market practices to ensure the protection and privacy of your personal data.

8.RETENTION PERIOD

• 8.1.Data retention period. KLAVE has established data retention periods based on the processing objectives and the company's legal obligations. We retain your personal data until the purposes outlined in this Privacy Policy are achieved, i.e., while legal and/or contractual relationships exist between the parties. After the contract ends, KLAVE retains user data for a period of 5 (five) years. After this period, the data is deleted or anonymized.

• 8.2.If there is a legal or regulatory justification, data may continue to be stored, even if the purpose for which it was collected or processed has been fulfilled.

• 8.3.Once the processing is completed, in accordance with the provisions of this section, the data is deleted or anonymized.

9.GENERAL PROVISIONS

• 9.1.If, for any reason, a competent court finds any provision of this Privacy Policy (or any part of it) unenforceable, that provision (or any part of it) will be applied to the maximum extent permitted to reflect the intent of KLAVE's Terms, and the remaining provisions of this Policy will remain in full force and effect.

• 9.2.Any tolerance of a breach of this contract will be considered mere leniency, not a waiver, and will not be considered as an integration of these Terms.

• 9.3.The chosen forum is the Court of Florianópolis, State of Santa Catarina, to settle any disputes arising from this instrument, waiving any other forum, no matter how privileged.

After presenting the terms and conditions of the Privacy Policy, the user must agree to the provisions for the effective use of the service offered. Use without express written agreement will be considered as implicit consent.

Florianópolis/SC, May 20, 2023.

KLAVE TECNOLOGIA E BLOCKCHAIN LTDA

CNPJ nº 42.355.765/0001-94