WINNIN INTELLIGENCE

Winnin Inc collects information from different sources to operate and improve its services, always based on the principles of necessity and transparency. Below, we detail the data sources, the types of information collected, for what purposes, and more details about the data processing we carry out.

1. Data You Provide Directly to Us

• When interacting with our Site: We collect information you provide us when filling out forms, such as in the "Contact Us" area, including full name, work email, phone number, where you work, and your company size, for the purpose of responding to your request. Or in the "Careers" area, including full name, email, cell phone with area code, LinkedIn, salary expectation, and resume, for the purpose of evaluating your application.
• When registering for our Services: When you create an account on the Winnin Intelligence platform to use our Services, we collect partial or full name, professional email, job title and the name of the Company that the User work for, User account number, and age, to execute the contract and/or provide support.

2. Data Collected Automatically, Through Cookies and Similar Technologies

When you visit our Site and/or Platform, we may use cookies and similar technologies to collect access information such as location information via IP address, browser type, pages visited, browsing time, search terms, and other interaction data with the Service. Winnin Inc also uses local storage, such as browser storage or application data caches, databases, and server logs in the processing of personal data.

Based on your consent, where applicable, in compliance with legal or regulatory obligations or in our legitimate interest, we use this data to:

• Customize your experience and optimize the usability of the site and platform;
• Ensure the technical functioning and security of the site and platform;
• Remember your preferences;
• Perform aggregated statistical analyses to understand how our Services are used and how we can improve them; and
• Comply with data protection legislation and other applicable regulations, by keeping access records and logs.

During your navigation and use of the Site and Platform, we may use our own and third-party cookies to collect certain information about your device, including storing data on your device or transmitting this data to a server for further processing.

Please pay attention to cookies from other companies. We do not control and are not responsible for third-party cookies, which may or may not continue to monitor your online activities even after you have left your browser.

You can configure your browser to accept all cookies, reject them, or notify you when a cookie is set. However, if you reject all cookies, you may not be able to use the Site and the Platform in their entirety.

Your consent will be requested before we use your information for any purpose not covered in this Privacy Notice. For more information, we invite you to access our Cookie Policy.

3. Data We Collect from Public Sources – Partner Platforms

To build our cultural insights, we process public data collected from our Partner's Platforms such as, but not limited to, YouTube, Facebook, Instagram, and Twitch, through access to their APIs, whenever possible. The processing of this data is carried out based on the legitimate interests of Winnin Inc and third parties, for the purpose of providing Culture and Brand intelligence, always in accordance with the general principles of personal data protection, including, but not limited to, the principles of security, necessity, adequacy, purpose, and transparency.

The processed data, such as posts, creators, likes, comments, shares, number of subscribers, subscribers gained and lost, views, videos added or removed from playlists, audience ratings, including average view duration and estimated minutes watched, relative performance retention, percentage of viewers, among others, are always used for providing the Winnin Intelligence Platform services and generating aggregated metrics and proprietary insights.

When analyzing interactions such as comments on videos, Winnin Inc adopts, as a Privacy by Design practice, a pseudonymization process that occurs at the time of collection. This process ensures that the identity of the comment's author, such as their username and profile picture, is immediately replaced by an internal alphanumeric identifier, preventing directly identifying data from being stored in our systems. The extracted information, such as the sentiment of the text, is then used in an aggregated and statistical manner to generate metrics and proprietary insights, without the objective of analyzing or identifying specific individuals.

From the public interaction data, already pseudonymized, Winnin Inc may infer additional information to compose its insights, such as estimating age and gender from the profile picture, or analyzing sentiment from the text of a comment, in order to generate aggregated statistics for our clients.

Based on this processed data, and in addition to the general information, data, and metrics collected from our Partner's Platforms, Winnin Intelligence provides its Users with additional metrics that are proprietary and independent of those provided by other platforms, including YouTube API Data and other social media APIs.

Personal data may be shared to achieve the purposes presented in this Notice. Below, we describe the categories of third parties that may be involved in the sharing of personal data:

• Suppliers and service providers that assist Winnin Inc in the activities described in this notice. All our partners are bound by a commitment to confidentiality, in compliance with the best practices of data processing, and meet the highest standards of security and privacy.
• Public authorities and regulatory bodies, to comply with legal and/or regulatory obligations and express requests;
• Third-party companies, in the case of corporate transactions involving Winnin Inc; and
• Other subsidiaries of Winnin Inc, allowing for the centralized management of our business.

During the use of the Winnin Intelligence Platform, your data may be shared with the following suppliers and service providers:

• Amazon Web Services – Cloud Computing Services that help Winnin Inc strengthen the security of Winnin Intelligence with encryption.
• Hubspot – CRM Platform that assists Winnin Inc in organizing emails for marketing and sales teams.
• Google Drive – Cloud computing services that allow Winnin Inc to save files on the network and access them from anywhere.
• Mixpanel – Helps Winnin Inc group events performed by Users, allowing a timeline view for each one individually.
• D4Sign – Assists Winnin Inc with the service of managing and signing documents.
• Jira – Helps Winnin Inc track tasks and manage projects.
• Confluence – Helps Winnin Inc with project documentation.
• Sendgrid – Assists Winnin Inc in sending and managing email communications.
• Intercom – Helps Winnin Inc communicate with customers via chat and email in an automated way.
• Product Fruits – Platform that allows creating interactive tours and guides to teach Users how to use a product, assisting Winnin Inc in User onboarding.
• Osano – Helps Winnin Inc manage cookie consent, user data requests, and the management of its privacy program.
• Datadog – Helps Winnin Inc monitor and analyze application and infrastructure performance.
• Webdox – Platform that assists Winnin Inc with legal management, legal compliance, and document management.
• Generative Artificial Intelligence Providers – The Winnin Intelligence platform uses a hybrid artificial intelligence architecture. While our analyses and classifications are generated by proprietary models, the conversational AI functionality (ZAI™) is powered by LLM solutions from partners, such as OpenAI and Google Gemini. It is for this purpose that we share a minimal and strictly necessary set of data, such as User prompts and queries. As per our contracts and technical configurations, we ensure that the submitted data is not used by these partners to train their own AI models.

Our suppliers and service providers have their own privacy policies and help us operate the platform according to the purposes described in this Privacy Notice. This sharing is done with the awareness of the Users obtained through access to the software and acceptance of the Winnin Intelligence Platform's Privacy Notice, or as necessary to comply with legislation or to respond to legal questions and processes.

You will always be informed of any changes to these tools.

Winnin Inc is committed to ensuring You have full control over your information. All requests can be made through our Data Subject Portal available on our Site. Below, we detail your main rights and how to exercise them.

How can I know if Winnin processes my data and how can I access it?

If you have interacted with Winnin Inc by accessing the Site, you can request confirmation of processing and a copy of your data at any time through the Data Subject Portal available on our Site. After verifying your identity, we will provide the information.

If you are a Winnin Intelligence User, you can obtain a copy of the content in your platform profile at any time.

How to correct the Personal Information Winnin has about you?

If you have interacted with Winnin Inc by accessing the Site, you can access the Data Subject Portal available on our Site to request the correction of your Personal Information.

If you are a Winnin Intelligence platform User, upon noticing that any of your Personal Information is incorrect or outdated, you can also request Winnin to change the Personal Information in your registration at any time by requesting this change to cs@winnin.com.

It is important to note that, as Winnin collects certain types of data on publicly accessible social media platforms, it is possible that, in addition to the version of your corrected Personal Data upon your request, records of the original version of your data, as made available by the APIs of the Partner Platforms, may also be kept. The maintenance of data of this nature will occur to ensure the integrity and traceability of all data processed by Winnin Inc, while guaranteeing You the right to correct your Personal Information when it is in databases controlled by Winnin Inc. In other words, this means that Winnin Inc cannot make any changes to your Personal Information contained in the databases made available by our Partner's Platforms, and it is recommended that Users contact such Platforms directly to correct the data contained therein.

How to delete your Personal Information, in whole or in part?

You can stop using the Service at any time and according to the terms stipulated in your Winnin Intelligence Subscription Agreement. To delete your account, send an email to cs@winnin.com or request it through the Data Subject Portal available on our Site. This will include the removal of your login and password to access Winnin Intelligence and the removal of your data within a period of 30 (thirty) business days. You also have the option to request a copy of your data. Such a copy will not include any reports or dashboards available in the Services, but only your personal data.

The User may also request the revocation of access by Winnin Inc to their data shared during the use of Winnin Intelligence, through the Google Security Settings, a Partner Platform of Winnin Inc. Note that if the User chooses not to provide User Information to Winnin Inc, they may not have access to the Service or certain tools of Winnin Intelligence.

It is important to know that not all personal Information we have in our databases can be deleted, especially in cases of necessity to comply with legal obligations, court orders, fraud prevention, credit protection, and other legitimate interests. Data retention for a period longer than these deadlines will only occur if it is strictly necessary for the fulfillment of legal or regulatory obligations, or for the regular exercise of rights in legal proceedings, as permitted by applicable law.

In case of anonymization, the data loses the ability to be identified and is used for statistical purposes to improve our services, always protected by our confidentiality commitments.

How to object to and/or revoke the processing of your Personal Information?

You can access the Data Subject Portal available on our Site and present an objection to the processing of your Personal Information for the purpose you deem excessive. In some cases, we may demonstrate that we have legitimate reasons to continue processing your Personal Information, but we will always justify this to you in the best way possible, giving you specific information about our motivations for maintaining Personal Information.

It is important to remember that any removal from our systems does not affect the original content. For definitive exclusion, you must exercise your rights directly on our Partner's Platforms that host the source content.

A User who has consented to the processing of their data by Winnin Inc may, at any time, withdraw consent through the Data Subject Portal available on our Site, informing which specific consent the User would like to withdraw.

Is it possible to obtain a list of the entities, public or private, with which Winnin Inc shares the Personal Information of its Users?

Winnin Inc provides in Section II of this Policy the suppliers with whom it shares your Personal Information. For more information, you can register your requests through the Data Subject Portal available on our Site.

It is necessary to remember that Winnin Inc may choose not to share information of this nature if there is any legitimate reason for secrecy, such as in cases where Personal Information has been shared with a public authority under judicial secrecy or even when it is necessary to protect Winnin Inc's trade or industrial secrets, to the extent guaranteed by law.

As Winnin Inc obtains data from Partner's Platforms, which may play the role of controllers, such as YouTube, Facebook, Instagram, and Twitch, it is not possible to guarantee that every request to exercise rights addressed to Winnin Inc will be fully met if such a request includes services from the Partner Platforms. However, in cases where Winnin Inc is the Controller of the Personal Data to which a request to exercise rights is related, all measures will be taken to meet such request, including with Winnin Inc's contractors and subcontractors.

When we receive formal written complaints, we will respond by contacting the person who made the complaint within 3 (three) business days. We will work with the appropriate regulatory authorities, including local data protection authorities, to solve complaints related to the processing of your data that cannot be solved directly with you.

Winnin Inc developed and has in force a personal data retention policy aligned with applicable laws. Personal Information is stored only for the time necessary to fulfill the purposes for which it was collected and may be deleted or anonymized, unless there is any other reason for its maintenance, such as compliance with legal, regulatory, contractual obligations, among others, provided they are based on an adequate legal basis.

Winnin Inc may take certain steps to verify requests made by you, through the User's email address and any information associated with the User's account. The Personal Information provided to Winnin Inc may also be used for the verification and maintenance of the User's request records.

Users' Information will be protected according to strict confidentiality standards. The security of Users' Information is very important to us, and therefore, we make our best efforts to protect it by various means, including the use of commercially acceptable measures, such as: use of updated versions of our software and libraries; two-factor authentication; encryption of data in transit (using TLS 1.2 or 1.3), and at rest (AES-256); application redundancy (contributes to availability); access control using RBAC (Role-Based Access Control); backups, logs for traceability and auditing (contribute to integrity), segregation of test and production environments and; network segregation, including firewalls and VPNs for access restriction or release.

Although we adopt the best practices and recommendations, we cannot guarantee that all technologies involved will be free from security flaws due to the constant evolution of technologies.

Winnin Inc will not disclose, sell, or rent User Information to third parties, except as provided in this Privacy Notice. Winnin Inc may send personally identifiable User Information to third parties in the following cases: (i) with your consent; (ii) when necessary to provide the product or service requested or authorized by the User; (iii) to trusted companies or individuals of Winnin Inc for any of the purposes described above, and (iv) to third parties to comply with any applicable law, court order, governmental request, or to detect, prevent, or otherwise address technical, security, or fraud-related issues, for the protection of the rights, property, or safety of Winnin Inc, Winnin Intelligence, its Users, or third parties, as required or permitted by regulations, as well as to enforce the applicable Terms of Service, including investigations of potential violations.

User Information eventually processed by Winnin Inc is limited to the team, agents, employees, and service providers ("Team") under contract with Winnin Inc, who need to be aware of this User Information in order to process it on behalf of Winnin Inc and assist in our business operations. This means we limit the number of people who have access and ensure that User Information can only be read, copied, modified, or removed by authorized Team members. We monitor internal activities to ensure the security and accuracy of User Information. The Winnin Inc Team is obligated to adopt conduct consistent with the company's guidelines and orientations regarding confidentiality, ethics, and appropriate use of User Information, including being subject to confidentiality agreements. Unless otherwise indicated, the Team will not have the right to use the submitted User Information beyond what is necessary to meet the needs of Winnin Inc and will be subject to and in compliance with our Privacy Notice, instructions, and any other appropriate confidentiality and security measures.

Winnin Intelligence may provide links to other sites – our Partner Platforms, which may collect personally identifiable information from the User. Thus, you acknowledge and agree that Winnin Inc is not responsible for the privacy practices of other sites and platforms and encourages the User to carefully read the privacy statements and terms of our Partner's Platforms such as, but not limited to, YouTube, Meta (Facebook and Instagram), and Twitch, as by using Winnin Intelligence the User will also be subject to compliance with them.

By clicking on the names of the Partner Platforms, you will be redirected to their respective Privacy Policies.

Click here to learn more about the Google API Services User Data Policy, and about the Limited Use requirements, to which Winnin Intelligence also adheres.

This Privacy Notice applies only to information collected and processed by Winnin Inc, that is, it does not apply to services that have separate privacy policies, which do not incorporate this Notice.

We maintain servers worldwide, and your information may be processed on servers located outside the country where You live. Data protection laws vary among countries, with some offering more protection than others. Regardless of where your information is processed, we apply the same protections described in this Policy.

When we transfer data to countries that do not yet have a recognized adequacy decision, we adopt valid transfer mechanisms, such as standard contractual clauses, to ensure an adequate level of protection.

You can obtain more information about these transfers or request copies of the mechanisms used through our Data Subject Portal.

This Privacy Notice may be modified from time to time by Winnin Inc. We will not reduce your rights under this Privacy Notice without your explicit consent. Changes will automatically take effect on the publication date of the new version of the Winnin Intelligence Privacy Notice.

To continue accessing Winnin Intelligence after the changes come into effect, You need to agree to and accept the latest version of the Privacy Notice.

If you still have any questions about how Winnin Inc uses your data, what your rights are as a data subject, or any other questions related to personal data, please access our Winnin Intelligence Platform Terms of Service and/or register your request through the Data Subject Portal available on our Site. Feel free to also contact our Data Protection Officer – Tatiana Chagas dos Santos Coutinho at dpo@winnin.com.