Privacy Policy

1. Who processes your data

This Privacy Policy describes how Ads Ativos,FULL LEGAL ENTITY NAME, registered under CNPJ No. 00.000.000/0001-00, headquartered at FULL ADDRESS ("Ads Ativos", "we"), collects, uses, shares and protects personal data.

For the purposes of the Brazilian General Data Protection Law (Law No. 13.709/2018 — "LGPD"), Ads Ativos acts as a controller of the personal data processed in its own commercial activities, and as aprocessor when it processes data at the request and under the instructions of its clients, as detailed in section 11.

2. Scope of this policy

This policy applies to the agency.adsativos.com website and to the other domains and subdomains operated by Ads Ativos — including the diagnostic tool available at diagnostic.adsativos.com —, to the forms we provide, to our support channels (email, WhatsApp and Telegram) and to the contracting and delivery of our media infrastructure, agency account and performance consulting services.

Our website contains links to and integrations with third-party services — such as the Google Calendar appointment schedule and the ad platforms themselves. Data processing carried out by those third parties is governed by their own privacy policies, not by this document.

3. Data we collect

3.1. Data you provide to us

• Contact and identification data: full name, email, phone number, the company you represent and your role.
• Commercial qualification data: answers to the diagnostic quiz, monthly media investment volume, operating verticals, platforms used and account ban history.
• Scheduling data: information filled in when booking a call through our appointment schedule, including the time slot chosen and any notes.
• Contract and registration data: if you become a client, legal entity name, tax ID, address, legal representative details and the documentation required in our verification and onboarding procedures.
• Communication data: the content of messages exchanged with us by email, WhatsApp, Telegram or during meetings.

3.2. Data collected automatically

• Browsing and device data: IP address, browser type and version, operating system, language, pages visited, time spent and referring page.
• Server log data: application access records, kept for the applicable legal period.

4. Purposes and legal bases

All processing we carry out is supported by one of the legal bases set out in art. 7 of the LGPD:

• Responding to requests and running the sales process — qualifying the request, holding the diagnostic call and presenting a proposal. Legal basis: preliminary procedures related to a contract, at the data subject's request (art. 7, V).
• Performing the contract — provisioning accounts, providing technical support, invoicing and monitoring the operation. Legal basis: performance of a contract (art. 7, V).
• Complying with legal and regulatory obligations — issuing invoices, keeping tax and accounting records, and retaining access logs as required by the Brazilian Internet Civil Framework. Legal basis: compliance with a legal obligation (art. 7, II).
• Preventing fraud and verifying partners — compliance checks and registration verification during onboarding. Legal basis: legitimate interest (art. 7, IX) and fraud prevention (art. 11, II, "g", where applicable).
• Improving the website and our services — aggregate analysis of browsing and performance. Legal basis: legitimate interest (art. 7, IX).
• Sending marketing communications — content, news and offers. Legal basis: consent (art. 7, I) or legitimate interest with respect to active clients, always with an opt-out option.
• Exercising rights in proceedings — defense in judicial, administrative or arbitration proceedings. Legal basis: art. 7, VI.

Where processing relies on legitimate interest, we carry out the balancing assessment required by art. 10 of the LGPD and limit processing to what is strictly necessary for the intended legitimate purpose.

5. Who we share it with

We do not sell personal data. We share data only as far as necessary, with the following categories of recipients:

• Infrastructure and technology providers — hosting, corporate email, cloud storage and productivity tools.
• Google LLC — for the appointment schedule used to book calls and for the web font service loaded on our pages.
• Ad platforms — Meta, Google, TikTok and others, where asset provisioning and management require it.
• Payment processing partners and financial institutions — for billing and reconciliation.
• Professional advisors — accountants, auditors and lawyers, bound by confidentiality duties.
• Public authorities — where there is a legal request, court order or regulatory obligation.

We require our processors to adopt adequate security measures and to restrict processing to the purposes we determine.

6. International transfers

Some of our technology providers are based or keep servers outside Brazil, including in the United States. This means your data may be transferred and stored internationally, under arts. 33 to 36 of the LGPD.

In those cases, we adopt contractual safeguards with the providers — including standard data protection clauses — to ensure a level of protection consistent with Brazilian legislation.

7. Cookies and tracking

Our website is static and, as of the date of this policy, does not use advertising cookies, tracking pixels or first-party analytics tools. The only third-party data loads come from:

• Google Fonts — loading the typefaces transmits your IP address to Google's servers.
• Google Calendar — the booking schedule is displayed in an iframe and may store Google's own cookies when loaded or used.
• Browser local storage — we usesessionStorage to record that the scheduling invitation has already been shown during the session, avoiding repetition. That data stays in your browser and is not transmitted to us.

Should we implement analytics tools or remarketing pixels, this policy will be updated and, where required, a consent notice will be presented before activation.

8. How long we keep it

We keep personal data only for as long as necessary to fulfill the purposes for which it was collected, observing the following parameters:

• Leads who did not become clients: up to24 months after the last contact.
• Contract and tax data: for the period required by tax and civil legislation, counted from the end of the contract.
• Application access records: 6 months, under art. 15 of the Brazilian Internet Civil Framework (Law No. 12.965/2014).
• Data needed for defense in proceedings: until a final decision is issued or the applicable limitation periods expire.

Once the periods and legal bases authorizing retention end, the data is deleted or anonymized.

9. Information security

We adopt technical and administrative measures to protect personal data against unauthorized access and accidental or unlawful destruction, loss, alteration or disclosure — including encryption in transit (HTTPS), role-based access control, two-factor authentication on critical systems and internal confidentiality policies.

No system is entirely immune to incidents. Should a security incident occur with relevant risk to data subjects, we will notify the Brazilian National Data Protection Authority (ANPD) and the affected data subjects, under art. 48 of the LGPD.

10. Your rights as a data subject

The LGPD grants you, at any time and upon request, the following rights over your personal data:

• Confirmation that processing exists;
• Access to the data;
• Correction of incomplete, inaccurate or outdated data;
• Anonymization, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law;
• Portability to another provider, upon express request;
• Deletion of data processed on the basis of consent, except where retention is mandatory by law;
• Information about who we share your data with;
• Information about the option not to give consent and the consequences of refusing;
• Withdrawal of consent;
• Objection to processing carried out on the basis of legitimate interest.

To exercise any of these rights, write tosuporte@adsativos.com.br. We will respond as quickly as possible, within the legal deadlines. We may ask for additional information to confirm your identity before fulfilling the request — a necessary measure to protect your own data.

You also have the right to petition theBrazilian National Data Protection Authority (ANPD)directly.

11. Data processed on behalf of clients

While delivering campaign management and media infrastructure services, we may have access to personal data collected by our clients from their own leads and consumers — for example, audience lists, conversion events and lead capture forms.

In those cases, Ads Ativos acts as a processor: it processes the data exclusively in line with the client's documented instructions, and the client remains the controller, responsible for establishing the legal bases, informing data subjects and handling rights requests.

If you are a lead or a consumer of one of our clients and wish to exercise rights over your data, we recommend contacting the company you interacted with directly. We can forward your request to the responsible controller if you prefer.

12. Children and teenagers

Our services are intended exclusively for legal entities and professionals over the age of 18. We do not target communications to, or intentionally collect data from, children and teenagers. If we identify that such data was collected inadvertently, we will delete it.

13. Changes to this policy

This policy may be updated to reflect legal, regulatory or operational changes. The date of the last update appears at the top of the page. Material changes will be communicated through the contact channels you have provided to us.

14. How to reach us

Questions, data subject requests or complaints about data protection may be sent to our Data Protection Officer (DPO):

• Email:suporte@adsativos.com.br
• Data Protection Officer (DPO):OFFICER NAME
• Address:FULL ADDRESS