DPA

This Data Processing Addendum (DPA) is between the Customer and ZOFITI SOLUCOES LTDA (Zofiti) and is incorporated into the Terms of Use. It takes effect when Zofiti processes Customer Personal Data. If this DPA conflicts with the Terms on personal-data processing, this DPA prevails; applicable transfer clauses prevail over both for the transfer they govern.

Customer Personal Data means personal data contained in Customer Content and processed by Zofiti for the Customer. Terms such as controller, processor, operator, processing and data subject have the meanings in applicable data-protection law.

The Customer is controller and Zofiti is processor or operator for Customer Personal Data. Each party remains independently responsible for data it controls for its own purposes.

Zofiti will process Customer Personal Data only to provide, secure and support Sinalio; comply with the Terms and this DPA; follow documented configuration and support instructions; or comply with law. If law requires processing beyond an instruction, Zofiti will notify the Customer before processing unless prohibited.

If Zofiti believes an instruction violates applicable law, it will inform the Customer and may pause the affected processing while the parties resolve it.

The Customer will provide lawful instructions, notices and a valid basis; configure the service to minimize data; maintain accurate content, user and permission controls; respond to its data subjects; and not submit prohibited or unnecessary data. The Customer has primary responsibility for Customer Personal Data, the acts of its users and deciding whether Sinalio is appropriate for its legal and regulatory requirements.

Zofiti is responsible for operating and protecting the infrastructure and processing operations under its control. It will limit access to authorized personnel under confidentiality duties; apply the measures in section 7; assist with data-subject requests, security incidents, impact assessments and regulator consultations as reasonably required; maintain records required of a processor; and delete or return data at the end of service as described below.

The official channel for standard DPA assistance is joao.muller@zofiti.com.br. Zofiti may take up to seven calendar days to provide an initial response, counted from the Customer's latest message on the request. This period may restart after a new message and the response may request details or provide next steps rather than complete the work. Statutory deadlines, incident-notification duties and expressly agreed service levels take precedence.

• tenant and environment boundaries enforced by server-side identity;
• least-privilege access and separate administrative identities;
• TLS in transit and encryption at rest where supported by the hosting service;
• validation, rate limits and abuse controls at public interfaces;
• security, access and change logging with controlled retention;
• encrypted backups, restoration procedures and infrastructure monitoring;
• dependency maintenance, vulnerability response and incident handling;
• confidentiality duties and access removal when no longer needed.

Zofiti may update measures as technology evolves, provided the overall protection does not materially decrease.

The Customer gives general authorization for the subprocessors below. Zofiti remains responsible for their obligations to the extent required by law and will impose data-protection terms appropriate to their processing. Zofiti will provide reasonable notice before adding a subprocessor that materially processes Customer Personal Data. The Customer may object on documented data-protection grounds within 15 days; the parties will seek a reasonable solution, and the Customer may terminate the affected workspace if none is available.

Google or Microsoft identity, Stripe checkout, optional Google Tag Manager and Google Analytics primarily process Zofiti account, billing or website data as described in the Privacy Policy; they do not automatically receive Customer Content and are not listed here for that separate role.

Core Customer Personal Data is hosted in Brazil. If a subprocessor or support instruction transfers Customer Personal Data internationally, the parties will use a valid mechanism required by applicable law. When that mechanism is required for a Brazilian transfer, the parties will execute and attach the ANPD standard contractual clauses in full and without alteration. Where GDPR Chapter V applies, the applicable module of the European Commission Standard Contractual Clauses is incorporated, with the Customer as exporter and Zofiti as importer unless the transfer requires another arrangement.

The parties will cooperate on transfer impact assessments and supplementary safeguards proportionate to risk.

If Zofiti receives a request concerning Customer Personal Data, it will direct the person to the Customer unless prohibited and will not independently respond without authorization. Taking into account the nature of processing, Zofiti will provide reasonable technical and organizational assistance so the Customer can respond within the applicable deadline. Additional work beyond standard service may be charged at a disclosed reasonable rate.

Zofiti will notify the Customer without undue delay after confirming a breach of security involving Customer Personal Data. The notice will include available information about nature, likely consequences, affected data and measures taken. Zofiti will investigate, mitigate and reasonably cooperate. Notice is not an admission of fault. The Customer remains responsible for notifications it must make as controller.

Zofiti will provide information reasonably necessary to demonstrate compliance. No more than once per year, unless a confirmed incident or regulator requires otherwise, the Customer may request an audit by an independent professional bound by confidentiality. Audits must use existing reports first, avoid access to other customers' data, occur during business hours with reasonable notice and not unreasonably disrupt the service. The Customer bears its audit cost unless material noncompliance is found.

During the service, the Customer may use available export capabilities. After workspace termination, active Customer Personal Data remains recoverable for up to 30 days and is then deleted or anonymized, unless the Customer requests earlier deletion or law requires retention. Encrypted backup copies expire within up to 90 days and remain protected and unavailable for ordinary use until overwritten.

Zofiti will assess government requests for legal validity, disclose only data legally required and notify the Customer before disclosure when permitted. Zofiti will challenge overbroad or unlawful requests where reasonable.

Each party remains responsible for its duties under applicable data-protection law. The liability terms and governing law in the Terms apply to this DPA, except where applicable law or incorporated transfer clauses require otherwise. Nothing in this DPA reduces rights of data subjects or powers of supervisory authorities.