Dear, welcome!

The Fotop is a platform that connects professionals, companies, and people who want to register and immortalize special moments, whether at various events or on tourist programs (?Platform?).

For the proper development of the services provided by the Platform, it is necessary that we use personal data - and because we recognize the importance of protecting your personal data, we have prepared this Privacy Notice to provide transparency on how this data is handled byo Fotop, as well as to inform you of your rights related to the processing of your personal data and the means by which it is possible to exercise them.

This Notice is reviewed periodically and may be changed at the discretion ofo Fotop. But don't worry, if any changes are made, we will communicate whenever necessary, either through our website or by email.

- GLOSSARY -

So that you can clearly understand the terms of this Notice, some definitions used will be explained below. Whenever you read the terms below described (in uppercase or lowercase, in the plural or singular, with or without emphasis), they should be interpreted as follows:

Anonymization: a processing technique used to remove or modify information that can allow the identification of the personal data owner.

Legal Bases: hypotheses in which the LGPD authorizes the processing of personal data.

Controller: a natural person or legal entity, public or private, who is responsible for decisions regarding the processing of personal data, in other words, the definition of the purposes of the processing and its classification under the legal bases.

Personal Data: information that can identify a natural person, directly or indirectly. The direct identification occurs when the data itself already identifies the person who is the owner of that data (such as, for example, the CPF). On the other hand, indirect data are those that need additional information for identification (for example, a residential address).

Sensitive Personal Data: information about racial or ethnic origin, religious belief, political opinion, union membership or membership in a religious, philosophical, or political organization, data related to health or sexual life, genetic or biometric data, when linked to an identified or identifiable natural person.

LGPD: acronym that refers to the General Personal Data Protection Law (Law No. 13.709/2018).

Operator: a natural person or legal entity, public or private, that carries out the processing of personal data on behalf of the controller.

Data Subject: The natural person to whom the personal data refers.

Processing: any operation carried out with personal data such as collection, production, reception, classification, use, access, reproduction, transmission, distribution, among others.

User or you: users of the Fotop Platform, whether they are interested in the acquisition of photographs (photographed), or the registered professionals (photographers) - each one specified below, as necessary.

Event: Solemnties, events, ceremonies, in which those responsible hire Fotop to provide services.

SPECIAL NOTE FOR CHILDREN AND ADOLESCENTS

Please, do not register or use our platform if you are not yet 18 (eighteen) full years old.

  1. General Terms

1.1. Definition of the Legal Responsible for the Platform. The Platform is owned by and operated and maintained by the companies (a) FOTOP SERVIÇOS LTDA., a company registered with the CNPJ under number 07.936.428/0001-90, with headquarters at Rua Ricardo Severo, No. 73, Perdizes, São Paulo/SP, ZIP code 05010-010. 

1.2. Scope. This Privacy Notice applies to all data subjects whose personal data, directly or indirectly, are processed by Fotop in the development of our activities.

1.3. Applicable Law. This document is governed and must be interpreted in accordance with Brazilian legislation, including and especially, with the terms of Law No. 12.965/2014 (the Brazilian Civil Rights Framework for the Internet) and Law No. 13.709/2018 (General Personal Data Protection Law) and other applicable laws and regulations.

1.4. Acknowledgment of Terms. Before registering on our Platform, You must acknowledge the terms of this Privacy Notice and agree to the Terms of Use.

  1. Personal Data Processed

2.1. Method of Personal Data Collection. Personal data may be collected by Fotop when the user registers on the Platform, by filling in the requested data, uploading images, or contacting our service channels.

2.2. Types of Data Processed. The type of personal data processed by Fotop depends on the use or service contracted by the user, as defined below:

2.2.1. Photographers' Registration Data. The following personal data are collected:

  1. Full name of the photographer or the legal representative of the photography company;

  1. Email;

  1. Phone number;

  1. Financial data.

2.2.2. Photographed Users' Data. The following personal data are collected from users who wish to purchase photographs:

  1. Full name of the data subject or the legal representative of the acquiring company;

  1. Email;

  1. Phone number;

  1. CPF number (optional);

  1. Payment Data (such as credit cards, PIX transactions, etc.);

  1. Biometric facial recognition data (optional, as available).

2.3. Contact Data. When the data subject contactso Fotop (for example, through the contact form available on the website), the following personal data are collected:

  1. Name;

  1. Email;

  1. Phone.

2.4. Usage Data. During the use of the Platform, "usage data" may be collected, among the following:

2.5. Purpose of Processing. The personal data processed byo Fotop are classified under the following purposes:

Type of Data Collected

Purpose of Processing

Registration Data of Photographers and Photographed.

Identify the data subject;

Validate access to the Platform;

Enable the use of Platform services;

Send communications (registration confirmation, purchase, support to Photographers with opportunities and articles, etc.);

Perform financial payment operations.

Biometric Facial Recognition Data

Facilitate the location of photographs that contain the data subject of the photograph.

Photographs of Data Subjects

Allow photographer users to sell and photographed users to buy the photos registered in the Events.

Financial Data /

Payment Data

Enable the process of buying and selling photographs.

Usage Data

Create statistics and metrics;

Develop improvements in the provision of services offered on the Platform.

2.6. Other processing hypotheses. It is possible thato Fotop also carries out the processing of personal data, in the following hypotheses:

  • To exercise Fotop's rights, whether judicial or administrative;
  • To prevent fraud and to preserve the security of our users;
  • To comply with tax and regulatory obligations.

2.7. Personal Data Provided by Third Parties. Fotop receives data from third parties, whether partners, service providers or customers, related to the data subjects. The data received allowso Fotop to carry out its activities and provide its services.

2.8. Responsibility. The photographers and or those responsible for the events in which the photos are commercialized on our Platform are responsible for collecting the authorizations for capturing and using the image of the data subjects before the photographs are taken.

2.9. Facial Recognition (biometrics). Facial recognition does not imply additional sharing with third parties, and it is certain that this processing is carried out on the Platform's own server and only by using the resource made available to facilitate access for photographed users who wish to acquire their respective photographs registered by photographer users and made available on the Platform. It is important to highlight thato Fotop does not store the information related to the facial biometrics of the Users; when used, a hash (a unique, irreversible cryptographic code) is generated, which is used in the Platform's functions.

2.10. Native Applications. Native applications, such as payment links, for example, can store usage data, images, videos, texts, financial data, which are not shared witho Fotop.

2.11. Storage Period. The photographs commercialized on our Platform are available for a period of 2 years. After this date, the files may be deleted.

  1. Personal Data Sharing

3.1. In order for the services provided by the Platform to be possible, such as cloud storage, for example, it is necessary to share personal data with business partners, who act as operators linked to privacy terms that are compliant with the legislation applicable to the processing of personal data.

3.2. Fotop carefully analyzes its business partners, so that everyone involved in the processing of data related to the Platform follows strict security standards, as well as being responsible for the confidentiality of your information, for the purposes determined in this Privacy Notice.

3.3. In addition, personal data may be shared in the following hypotheses:

  • Cases in whicho Fotop is required to disclose or share the processed data, in order to comply with a court order, or for the purposes of preventing fraud or other crimes, as well as in response to a request for information presented by a competent authority, if we understand that the disclosure is in accordance with or required by applicable laws, regulations or procedural procedures;

  • To protect the rights, property or security of the Platform;

  • With law enforcement agents and/or governmental authorities, if it is understood that their actions are inconsistent with the provisions in our terms of use, or to protect the rights, property or security of Fotop and our users;

  • By action of the data subjects themselves;

  • In cases of partial or total sale of the business or its assets, or as part of any reorganization or restructuring of the business, merger, demerger or incorporation, so that the third parties who are part of the respective businesses take the necessary measures to ensure that privacy rights continue to be protected, in accordance with this Notice.
  1. Cookies

4.1. A cookie is a small piece of information stored locally on the user's computer or device, which contains information about their activities on the Internet.

4.2. Cookies can be used in different ways and for different purposes. Fotop may use:

  1. Performance Cookies: These cookies collect anonymous information about how users interact with the Platform, in order to optimize its performance. The information collected by these cookies never contains personal details from which you can be identified.

  1. Advertising Cookies: These cookies collect information about browsing habits, with the aim of making advertising more relevant to the user.

4.3. Access to Cookies. Access to cookies ends as soon as the user closes the browser. The user is given the option to accept or refuse cookies.

4.4. Consent for the Use of Cookies. The user's acceptance is required, before the session starts, for non-essential cookies to be used.

4.5. Option without Cookies. The data subject may choose to refuse the use of cookies. However, if they do so, they may not be able to access all the functionalities of the Fotop website.

     

  1. Data Subject Rights

5.1. The personal data subject may contact Fotop whenever deemed appropriate to exercise their rights related to the processing of personal data.

5.2. Requests will be answered during business hours, Monday to Friday, from 10 a.m. to 7 p.m., within 48 (forty-eight) hours in a simplified manner, or within 15 (fifteen) days in a detailed manner, and may be sent by email or another means of contact provided by the data subject.

5.3. Fotop may, at its sole discretion, implement additional methods to identify the data subject before responding to requests, in order to preserve the privacy of the data subjects themselves.

5.3. The rights of data subjects include:

Right of the Data Subject

Definition

Confirmation of Processing

Request confirmation and clear information about the origin of the data subject?s personal data processed by Fotop, the criteria used, the purpose of the processing and, furthermore, information regarding the (non)existence of the record.

Access

Access the data subject?s personal data that are in the database or being processed by Fotop.

Rectification

Request correction of the data subject?s personal data that are incorrect or incomplete.

Deletion

Request deletion of the data subject?s personal data or, if this is not possible (due to mandatory retention, which will be addressed later), keep them for the period provided by law in an inactive database.

Portability

Transmission of the data subject?s personal data for use by third-party services.

Review of Automated Decisions

Request review of decisions made solely by automated means.

  1. Personal Data Security

6.1. Location of Processing. The personal data registered in your account are securely stored and transmitted on Amazon servers in the United States. In cases where chest-number identification services are used, the processing of this data will be carried out through our Business Partners.

6.2. International data transfer. As noted in the previous item, the data collected by the system are stored on servers that are not located in Brazil, which constitutes, under the LGPD, an international transfer of personal data. Since your data must be stored in locations that comply with Brazilian legislation (see art. 33, II, ?a? of the LGPD), we inform and guarantee that the servers meet the requirements set forth in the aforementioned legal provision.

6.3. Commitment to the Confidentiality of Information. Regarding the use of the database by the Platform, only employees authorized by Fotop may have access to your personal information and are mandatorily subject to confidentiality duties and strict respect for your privacy under this notice and the policies adopted by Fotop.

6.4. Information Security. All operations carried out on the Fotop Platform are encrypted, subject to data backup, monitoring tools, security policies and access controls for employees, using up-to-date security software.

6.5. Processing of Children?s and Adolescents? Personal Data. The processing of personal data of children and adolescents will only be carried out in accordance with the authorization of the legal guardian, as provided by law, and in the best interest of the child.

  1. It is the responsibility of our Business Partners, when holding events, to obtain the necessary means and authorizations from parents or legal guardians.

  1. We do not recommend the use of our Platform, as a User in the capacity of photographer, by persons under 18 (eighteen) years of age.

6.6. Notification. If Fotop becomes aware of any security breach of the Platform or the processing companies, including intrusions, data leaks or any other information security incident, the national authorities and the users will be notified, in cases provided by law, regarding this breach, and as many details as possible will be provided concerning the nature and extent of the breach and the compromised data, within a reasonable period, in accordance with Article 48, § 1, of the LGPD.

6.7.  Data Retention Period for Users/Buyers. Fotop will store users? data for the entire period in which the user?s registration is active and, additionally, to comply with legal/regulatory obligations and for possible defense in judicial and/or administrative proceedings.

  1. Data Protection Officer

7.1. The Data Protection Officer (Data Protection Officer, or DPO) of Fotop is Mr. Bruno Cunha de Almeida e Silva , who can be contacted via email dpo@fotop.com .

7.2. In case of suggestions, questions about the Privacy Notice or exercise of rights, the data subject may contact the Data Protection Officer at the email indicated above.

7.3. Requests will be answered during business hours, Monday to Friday, from 9 a.m. to 6 p.m.

  1. General Provisions

8.1. Changes to the Privacy Notice. Fotop may change the Privacy Notice from time to time. If Fotop makes changes to how it processes personal information, it will notify users by sending email or via a pop-up on the Platform.

8.2. Unannounced Adjustments. Minor adjustments to this Privacy Notice may occur without significantly affecting how Fotop processes personal data, and therefore will not be notified. In any case, Fotop will keep a version history of this document so that previous versions can be consulted upon request to the Data Protection Officer.

8.3. Anti-Spam Policy. Fotop takes the necessary measures to avoid sending unsolicited emails.

8.4. Legislation and Records. As we are in Brazil, this Notice must be read and interpreted in accordance with Brazilian laws and, although it was written to be read and interpreted as a whole, if any part of this document is disregarded by a competent Authority, the remainder will remain in force and, as soon as possible, we will adjust the suppressed part. In addition, every record we make will be cataloged based on the official Brazilian time ? Brasília time.

V02.3

Reviewed on September 12, 2023.