Effective date of this privacy policy is June 10, 2021 (v1.0).

Emptor, Inc. (“Emptor”) takes privacy matters very seriously and is committed to privacy protection. Emptor Inc.’s Privacy Policy (“Privacy Policy”) is meant to inform users of Company’s website (“User”) what personal information is collected and stored as well as any applicable safeguards in place to protect the users. The following applies to both emptor.io, and dashboard.emptor.io.

Information Collected and Stored

Business Inquiries: Through the use of Emptor’s website and public facing dashboards, we collect certain information that is directly relevant to both monitoring site traffic and being able to provide and improve Emptor’s services. Note that Emptor only collects this information for reasons directly related to managing its site and providing services, and does not resell this information to any third parties. Generally, and with limited exceptions, Emptor’s website acts as a touchpoint for potential clients and inquiries about our company and services and this information is sent directly to info@emtpor.io.

Job Applications and Resume Submissions: Any potential candidates who submit their resumes should be aware that Emptor operates its hiring process through third party website Lever. Information relevant to Lever’s information retention policies can be found at this link: www.lever.co/privacy. These resumes are shared with all Emptor management who are relevant to the hiring process. This information is only shared internally, and is not shared with, given or sold to any third parties. These resumes and the information they contain, once submitted, will be retained by Emptor indefinitely, should Emptor feel that a candidate may be more suitable for a different or future position.

Children’s Online Privacy Protection Act of 1998 (COPPA)/California Online Eraser Law

Emptor neither collects nor stores personal information from its website and this further applies to minors (defined as anyone under the age of 13). Neither Emptor’s website nor its services are directed toward minors. Therefore, Emptor explicitly does not collect or store the personal information of minors.

Cookies

What are Cookies? Cookies are small text files, which are transferred to your computer or mobile when you visit a website or application. The cookies are used to:

• Remember information about you, so you don’t have to repeatedly give information.
• Remember information about you to keep you signed in from different devices.
• Accumulate analytical information to help us improve our website and services

Emptor’s website uses Cookies, which contain anonymous information, such as a unique identifier, the website’s domain name, and some digits and numbers. Emptor’s website uses the following types of cookies:

• First Party Cookies. These are the cookies accumulated and used by the website you are currently on, in this case, Emptor’s website. These cookies are set by the website you’re visiting, and only that website can read them.
• Third-Party Cookies. These cookies are set by someone other than the owner of the website the User is visiting – i.e. not Emptor. For our application processes, any information and resumes given are accumulated through Lever. For any cookies relating to Lever’s Cookies Policy, the USer should visit Lever’s site. For Lever’s Privacy Policy, follow this link: www.lever.co/privacy.
• Strictly Necessary Cookies. These cookies let you use Emptor’s website, and without them, services that you ask for cannot be provided. Emptor also collects this information to see traffic on the site, so that we may improve our website.
• Functional Cookies. Functional Cookies help to personalize a website to User’s preferences and settings.
• Performance Cookies. These Cookies help Emptor to maintain its website and alert us to any bugs or errors. Additionally, by monitoring performance, Emptor is able to not only make improvements, but gives us statistical data upon which we may creatively reorganize our site and the way that you interact with it.

User Rights

Emptor strives to go above and beyond as it pertains to Users’ rights. That is why each and every User has the right to know, the right to delete, the right to non-discrimination, and the right to correct inaccurate information. Users are made aware of how any personal information is collected and stored by reading this Privacy Policy. Users can exercise their right to delete by contacting info@www.emptor.io. User should state that he or she wishes for his or her personal information to be deleted and Emptor will then permanently delete the email and any reference in any internal database containing personal information. Emptor will not under any circumstances deny services or engage in any type of price discrimination or any other method of discrimination to anyone who has exercised his or her rights herein. However, it is necessary to keep in mind that Emptor cannot maintain contact and advance negotiations if someone has requested that all of their information be deleted. If User inputs any inaccurate information in the form, User can request that Emptor fix any such inaccurate information by contacting Emptor at info@www.emptor.io. Emptor shall respond to any of the requests above as soon as is reasonably practicable. The right to opt-out is not applicable as Emptor does not sell any User’s personal information under any circumstances.

Privacy Policy Updates

This Privacy Policy will be updated from time to time. Therefore it is imperative to regularly review this Privacy Policy as changes may occur over time.

Privacy and Compliance under Brazil and LGPD

Emptor is a technology company focused on creating safe and trustworthy communities for its customers through the development of fraud prevention, identity verification and background check technologies. For this reason, we consider it very important to maintain direct and transparent relationships with all those who provide us with information and personal data through any of our communication channels.

This privacy policy governs Emptor’s use of the information collected or received directly through its public website, and to inform the holders of this information about their rights regarding their information, as well as the processing, storage, and the deletion of all personal data covered by this policy. While all principles articulated herein are applied to the entirety of Emptor’s online presence, here they are contextualized specifically within the regulatory framework applicable in Brazil. If there are any concerns not resolved by the terms of this policy, any holder of data collected through the Emptor website may contact us at info@www.emptor.io.

LEGAL INFORMATION

Emptor is fully committed to complying with personal data protection legislation. As such, we are always seeking to adapt to the best standards and best practices dictated by the authorities and any applicable legislation. This privacy policy was prepared in compliance with the provisions of the General Data Protection Law (LGPD) – Law No. 13.709 of 2018 – in force in Brazil since August 2020. LGPD is the legal regulation for all processing of personal data carried out in Brazil. It is therefore important for us to ensure that this law is observed in the application of our internal and external operations, both internal or external (such as our website).

The definitions used in this policy for terms such as treatment, controller, operator, consent, among others, are the same as those given by the LGPD.

COLLECTED DATA

• Registration Forms
  • Clients: on our website we make a form available to be filled in by any user who wishes to become an Emptor Client – this form collects basic contact data between Emptor and the potential Client: name, e-mail and represented company, in addition to an open field so they are relevant comments in text.
  • Candidates for Vacancies: on our website we publish how vacancies are available on Emptor, and any user who is interested in applying for one of these vacancies can do so through the form that we provide. The form is filled with the following personal data: full name, email, phone number, resume, current job and social networks.
• Newsletter: Emptor provides a newsletter to follow updates on our blog, receive news and send information about new products, services and solutions. Subscription to this newsletter is voluntary, and only requires the user to fill in the field indicated on our website with their email address. This is the only personal data collected to participate in our newsletter.
• Cookies: Emptor uses cookie technology – small data files – to ensure the correct functioning and performance of its website, in addition to providing personalized navigation for each user. The cookies we use fall into the following categories:
  • Own Cookies: These are cookies collected and used by the Emptor website. These cookies are added by the Emptor website and only this website can read them.
  • Third Party Cookies: These are cookies that are not added by Emptor, ie cookies from other parties. In the case of the Emptor website, these are cookies used in the application process for vacancies at Emptor, as applications and resumes are collected through the Lever platform (see “INFORMATION SHARING”).
  • Required Cookies: These cookies allow you to use the Emptor website. Without them none of the services provided through the website can be performed. These cookies cannot be changed by the user and do not depend on consent for use. They are activated by accessing Emptor’s website and are related to checking traffic on its website, subdivided into:
    • Functionality Cookies: These cookies help the Emptor website to customize users’ preferences and settings (eg acceptance of terms and policies, choice of language, previous access).
    • Performance Cookies: These cookies help Emptor maintain the website and alert us to any errors or bugs that may occur (eg prevention of malicious access and data protection). They also help, by monitoring the website’s performance, making improvements and gathering statistical data through which we can creatively reorganize the website and better interact with users.

SENSITIVE PERSONAL DATA AND CHILDREN’S DATA

Emptor does not collect any sensitive personal data on its website, as defined by the LGPD. In addition, none of our services, forms or other processes focus on or concern children (thus considered those under 13, according to specific legislation). If any data sensitive or concerning a child is added to the Emptor website, it will be immediately disregarded and deleted from all our systems.

DATA USE

The personal data collected is used only for the following purposes:

• Customer Data: the data provided by users who wish to enter into a business relationship with Emptor will only be used for the purpose of contact between Emptor and the potential Customer. The form made available to the Client, after being filled in, is sent to an internal Email address that can only be accessed by Emptor’s sales and marketing team.
• Candidate Data: the data entered by candidates in the application form for a job vacancy is processed only for the purpose of filling the vacancy for which they applied. Emptor uses the Lever platform, as operator of personal data, to organize and carry out the company’s selection process – only Emptor employees who effectively participate in the selection for the open position have access to Emptor’s space on this platform.
• Newsletter Subscriber Data: The data provided for subscription to our newsletter will only be used for information and updating purposes on Emptor’s activities. This data will be added to a chain of periodic sending emails used exclusively for the purpose described above.
• Cookie Data: the purposes for which the data collected through the cookies present on the Emptor website are used, directly relate to the category in which such cookies fall within those described in the previous sections. Thus, the information collected through third-party cookies will be used to share data with third parties and the information collected through their own cookies will only be used internally by Emptor – and only for the purposes explained in the description of the required cookies, or that is, just to ensure a personalized and secure experience within the Emptor website, in addition to allowing the website to effectively work for each user.

For the aforementioned reasons and purposes, Emptor will not always need the user’s consent. The LGPD provides that data processing may occur, even without the explicit collection of consent, when it is intended for specific purposes and provided that it does not exceed the scope of such purposes, informed to the holders of the collected data. As such, users should be informed that:

• Both the Customer data and the Candidate data are treated based on Article 7, item V of the LGPD, that is, they are necessary data for preliminary procedures related to the contracting with Emptor.
• The data provided by users who wish to access our newsletter are treated based on Article 7, item I of the LGPD, that is, based on their consent. It is the data subject’s right to withdraw his consent at any time, which can be done through the contact informed at the end of this policy.
• The data collected through the cookies referred to in this Policy are treated based on Article 7, item IX of the LGPD, that is, in accordance with Emptor’s legitimate interest in maintaining the website’s functionality and improving it so that the user have a personalized and complete experience, as well as to be able to undertake constant improvements in the service offered.

STORAGE

Data added by users to Emptor’s website or those collected through our cookies are stored through third-party cloud services (cloud computing) located in Brazil and the United States (ex. AWS). Before sending any information to these servers, we sign contracts that guarantee the adequate level of data protection according to the parameters established by the LGPD.

INFORMATION SHARING

Emptor relies on technological service providers to ensure the best experience for any user on its website. Thus, in order to maintain transparency in our relationship, we inform you that, in order to fulfill the purposes described in the previous sections of this Policy (and only to fulfill the specific purposes), we may share data with the third parties identified below:

• Hubspot: hosting service used by Emptor for website structuring and development. Hubspot’s Privacy Policy can be accessed through this link: https://legal.hubspot.com/br/privacy-policy
• Lever: The Application Form for Emptor Jobs is collected through Lever, Lever is an online recruitment and candidate management platform that we use to streamline our selection process. With Lever, only the information added to the Application Form for a Job Vacancy will be shared only for the purpose of filling the available vacancy for which the user applied. Lever’s Privacy Policy can be accessed through this link: https://www.lever.co/privacy.
• Authorities: Emptor may share the information described in this Policy with judicial, law enforcement or governmental authorities or other third parties with whom we are required by law, regulatory rule or court order to share the data. Whenever requested, Emptor is obliged to share information with the competent authorities, provided that such request is made in accordance with legal or regulatory provision.

Emptor does not practice the sale of information or any other form of commercialization of any of the personal data collected in accordance with this External Privacy Policy.

INFORMATION SECURITY

Emptor adopts technical and administrative measures to protect all information to which it has access against any type of security incident, including unauthorized access, destruction, loss of integrity, communication or any other form of illicit or inappropriate treatment. We always follow market-appropriate security standards and good personal data governance practices.

From a technical point of view, Emptor performs end-to-end encryption of all the information it manages, from the moment of collection to its disposal. We also have technical protection processes present in all data storage locations, such as access via VPN with different degrees of access and cloud security through our partners (eg AWS).

From an administrative point of view, we maintain Confidentiality Agreements with all our employees and collaborators, in addition to limiting the access and use of information to those who need access for the purposes described in this policy to be achieved. Thus, for example, only our HR team will have access to information on job applicants at Emptor while only the sales and marketing team will have access to customer data.

In addition, whenever we share your data with any of our suppliers or use storage services (as described above), we ensure that they also adopt security standards and good practices that are in accordance with the security levels we adopt internally and according to market standards.

DELETION AND DISPOSAL OF DATA

In general, data collected through our website will only be stored for the period necessary to carry out the purpose described in this Policy. However, we may keep this information for a longer period of time in view of legal obligations of any nature, to guarantee our rights (defense in legal, administrative or arbitration proceedings) or for any other legitimate reason authorized in the relevant legislation. In all cases, the maintenance of data in our databases will be limited to a minimum to comply with the exceptions listed above.

We further inform that the data may be kept anonymously in our databases. Anonymized data is outside the scope of LGPD and is understood as data that no longer allows direct or indirect association with a specific individual.

Finally, any user may request the deletion of any of their data provided to Emptor based on their consent through the contact provided at the end of this Policy. However, if the maintenance of any related data is a legal or regulatory obligation, the data must be maintained by Emptor.

DATA SUBJECT’S RIGHTS

According to LGPD, the holder of personal data is entitled to:

• confirmation that we possess and are processing data subject information;
• access to data;
• correction of data that is incomplete, inaccurate or out of date;
• anonymization, blocking or deletion of unnecessary, excessive or processed data in violation of the provisions of LGPD;
• transfer of data to another supplier (portability), observing Emptor’s