Privacy Policy

The terms used in this Policy are defined as follows:

The abbreviations used in this Policy are defined as follows:

This Policy sets out the principles, guidelines and responsibilities that govern the processing of personal data by Semantix, reflecting its commitment to privacy, data protection, information security and transparency. Its purpose is to promote compliance with the applicable legal, regulatory and contractual requirements, to support the governance of processing operations and to provide data subjects with clear information on how their personal data is collected, used, shared, stored and protected.

1.1 Target audience

Among SEMANTIX entities
This Privacy Policy of the SEMANTIX group is legally binding on all SEMANTIX entities.

Among employees
This Privacy Policy is part of the Group Policies that all employees must be aware of and are required to comply with under their employment contract. This Policy is available so that all employees can access it whenever needed.

1.2 Document maintenance and distribution

This Privacy Policy is maintained by SEMANTIX and reviewed periodically, or whenever there are relevant changes in the applicable legislation, in personal data processing operations or in the corporate guidelines related to privacy and data protection.

The current version of this document is made available through the official SEMANTIX channels, to ensure transparency and access to information on the privacy and data protection practices adopted by the organization.

The following standards and documents apply to this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies:

• ISO/IEC 27001:2022
• ISO/IEC 27701:2025
• SX PRIVACY INFORMATION MANAGEMENT SYSTEM (PIMS)

This Privacy Policy was developed by Semantix to provide transparency on how we use and protect the personal data processed as a result of the interactions between Semantix, its customers, suppliers and other data subjects.

You may already know that the General Personal Data Protection Law 13,709/2018 was created to establish rules for the processing of personal data by public and private companies, so that data subjects’ data is used appropriately, with transparency and security.

Here at Semantix, our goal as a company in the Analytics, Big Data and Artificial Intelligence segment is to transform companies into the data-driven model, generating value, automation and efficiency through intelligent solutions. That is why the privacy, protection and security of our operations is a priority.

Our solutions are based on the concept of Privacy by Design, which builds the security of personal information into the entire life cycle of the process, ensuring that privacy is a central focus of our actions.

We have teams dedicated exclusively to Information Security, Infrastructure, Privacy, Governance and Technology Controls, whose mission is to ensure compliance and the protection of personal and confidential information through a robust Information Security and Data Privacy Management System, as well as a training and awareness program focused on prevention and on preparing our employees.

We are certified and meet the most rigorous national and international privacy and security standards, carrying out periodic audits to maintain the global ISO/IEC 27001 (Information Security) and ISO/IEC 27701 (Privacy Management) certifications.

We believe that trust is one of the most important pillars in building connections. That is why we present our Privacy Policy below, to provide transparency on how we use and protect your personal data.

Depending on your interaction with us, some personal data may be processed. They are:

Registration data: data collected through the contact form available on our website, so that Semantix can respond to requests, questions and other dealings with the data subject. This data includes full name, email address and phone number.

Data collected to carry out activities: data collected so that Semantix can carry out its activities, which include providing its services, supplying its products, entering into partnership agreements and/or other contracts, among other related activities. Depending on the specific activity/purpose, this may include data such as: full name, job title, company, email address and phone number.

To provide our services and products, customers may supply third-party data. In this case, customers are the Controllers and are responsible for obtaining this data from the data subjects lawfully, with due transparency and with the appropriate authorizations.

Visitor and access control data: When you visit our offices, we process identification data (name, ID document, company, person visited and entry and exit times), CCTV images and biometric data (facial/fingerprint) for identification, access control and the security of people, information and facilities. We rely on legitimate interest (art. 7, IX, LGPD) for identification and CCTV, and on fraud prevention and the data subject’s security (art. 11, II, “g”, LGPD) for biometrics. Biometric data is deactivated after the visit and, together with the access records, kept for up to 30 days. CCTV images are kept for 20 days, unless they must be preserved to investigate incidents or to comply with a legal obligation. This data may be shared with the building management, access control and security providers and the competent authorities, where applicable.

Website browsing data (Cookies): data collected when you browse our website, such as IP address, geographic location, referral source, browser type, duration/frequency of visits and pages visited. This information is usually obtained automatically through cookies installed in your browser. You can set your preferences at any time and learn more about how we use cookies in our Cookie Notice.

Your personal data is stored only for as long as necessary to fulfil the purposes for which it was collected, unless there is another reason to keep it, for example, compliance with legal, regulatory or contractual obligations, among others, provided it is based on a legal basis.

Semantix has a Data Retention and Disposal Policy designed to guide and provide transparency on the process of storing and deleting data securely and in accordance with current legislation. Whenever possible, we will consider your right to request the deletion of, or object to the processing of, your data, as described in this Privacy Policy.

Semantix may share personal data with companies of the same group and/or with partner companies and service providers, to the extent that such sharing is reasonably necessary for the purposes set out in this Privacy Policy and for carrying out its activities, including providing its services and supplying its products.

We may also share data with public authorities and regulatory bodies to comply with legal and regulatory obligations.

Semantix may transfer personal data to service providers located abroad, including cloud service providers.

When your personal data is transferred outside Brazil, Semantix will choose destination countries with a level of protection equal to or higher than that provided for in Brazilian law and will adopt appropriate measures to ensure the adequate protection of your personal data in accordance with the requirements of the applicable data protection legislation, including entering into appropriate data transfer agreements with third parties when required.

To ensure your privacy and the protection of your personal data, we adopt appropriate technical and organizational measures, such as encryption techniques, access controls and other security and data protection management measures, to prevent unauthorized or unlawful processing and to protect against accidental loss, destruction or damage.

Your data is stored securely on protected equipment and only a limited number of people will have access to it. In addition, our employees take part in periodic awareness and training programs on information security and personal data protection.

You can also help us by adopting good security practices, such as not sharing passwords with third parties and using only secure environments.

We are certified in Information Security and Data Privacy and carry out periodic audits to verify and monitor our controls.

You have rights relating to the privacy and protection of your Personal Data and, in addition to caring about the security of this data, we also want you to have access to and knowledge of all your rights regarding the processing of your Personal Data. These rights include:

• Confirming access to the data;
• Correcting incomplete or outdated data;
• Porting the data to another company;
• Requesting the withdrawal of consent;
• Confirming that processing exists;
• Requesting the deletion of excessive or processed data;
• Being informed of the consequences of not giving permission;
• Being informed of which companies the data has been shared with.

To exercise your rights, Semantix provides a dedicated channel that you can access through our form.

Semantix reserves the right to change this Privacy Policy at any time by publishing the updated version on the website. We therefore recommend that you visit this channel periodically to stay informed of any changes.