FlipDesk Privacy Policy

Introduction and definitions

Conceptual foundation of the document and institutional commitment to privacy.

FlipDesk ("we", "our", or "company"), a private legal entity, is committed to protecting the privacy and personal data of its users ("you", "your", or "data subject"). This Privacy Policy was prepared in compliance with the General Personal Data Protection Law (Law No. 13,709/2018 - "LGPD"), the Internet Civil Framework (Law No. 12,965/2014), and other applicable regulations.

Legal bases

Legal bases supporting the processing of personal data carried out by FlipDesk.

The processing of personal data carried out by FlipDesk is based on the following legal grounds set forth in the LGPD:

• Data subject's consent (Art. 7, I)
• Compliance with a legal or regulatory obligation (Art. 7, II)
• Execution of a contract (Art. 7, V)
• Legitimate interest (Art. 7, IX)
• Credit protection (Art. 7, X)

Personal data collected

Distinction between directly provided information and automatically captured data.

3.1. Directly provided data

• Full name
• CPF/CNPJ (tax ID)
• Full address
• Email
• Phone number
• Banking and payment details
• Company data (when applicable)

3.2. Automatically collected data

• IP address
• Device information
• Cookies and similar technologies
• Platform usage data
• Access logs

Processing purposes

Core and complementary objectives for the use of personal information.

4.1. Main purposes

• Provision of contracted services
• Payment processing
• Customer support
• Compliance with legal and regulatory obligations
• Regular exercise of rights in contracts and proceedings

4.2. Other purposes

• Improvement of our services
• Statistical analysis
• Marketing and promotional communications (with consent)
• Fraud prevention

Data sharing

Scenarios in which information may be shared with third parties and associated contractual safeguards.

Your data may be shared with:

• Essential service providers (payment processing, hosting, etc.)
• Public authorities or official bodies
• Commercial partners (with your consent)
• Companies within the same economic group

All sharing is performed under contracts that ensure the confidentiality and security of the data.

International transfer

Rules applied when data needs to be processed outside Brazil.

Some data may be transferred to other countries, always observing the legal requirements of the LGPD and ensuring adequate security and protection through:

• Specific contractual clauses
• Global corporate rules
• Recognized certifications
• Countries with an adequate level of data protection

Data security

Technical and organizational measures adopted to reduce risks and protect information.

We implement appropriate technical and organizational measures, including:

• Encryption of sensitive data
• Strict access controls
• Continuous monitoring
• Employee training
• Regular backup policy
• Incident response plan

Data subject rights

Rights guaranteed to the data subject under the General Data Protection Law.

Under the LGPD, you have the right to:

• Confirmation of the existence of processing
• Access to data
• Correction of incomplete or outdated data
• Anonymization, blocking, or deletion of unnecessary data
• Data portability
• Deletion of data processed with consent
• Information about sharing
• Revocation of consent

Data retention

Criteria adopted for maintaining personal information for as long as necessary.

We retain your personal data for as long as necessary to:

• Fulfill the purposes for which they were collected
• Meet legal and regulatory obligations
• Exercise rights in judicial or administrative proceedings

Data Protection Officer (DPO)

Primary channel for exercising rights and clarifying questions about data processing.

To exercise your rights or ask questions, contact us at:

• Email: comercial@flipdesk.com.br
• Phone: (48) 98836-3228
• Address: Avenida Prefeito Osmar Cunha, 416 - Room 1108 - Centro, Florianópolis/SC

Policy changes

Future updates may occur and will be communicated through appropriate channels.

This policy may be updated periodically. We will notify you about significant changes through our website or email.

Continued use of our services after changes constitutes acceptance of the updated policy.