Privacy Policy and Data Protection

Studio Theodora Home with. E REPRESENTATIONS LTDA , headquartered in the city of São Paulo, State of São Paulo, Avenida Abrahão Gonçalves Braga, 412, Room 01, Vila Liviero, registered with the CNPJ under No. 26,751,132/0001-49 As a controlling agent , it is committed to respect for the privacy of its users, as well as the protection and security of their personal data.

The present privacy policy (" Policy ") aims to clarify what information is collected from users who access our website, how this data is treated and the rights you have, under the terms of laws Applicable, in particular Law No. 13.709/2018 ("General Law on Personal Data Protection")

To offer products and services to your customers, Theodora Home, through your site, collects various data and information, aiming mainly to provide an ever better experience for you.

The platform is online and accessible by URL https://www.theodorahome.co which offers the possibility of registering or hiring the advertised products and services.

Theodora Home acknowledges that its privacy is very important, so we take all possible measures within the best practices and solutions to protect it. In this sense, the present policy aims to inform you as your personal data will be treated.

We do not collect or consciously request information from under 18 years. Users under 18 should not send us information through our platform. If we learn that we collect information from a person under 18, we will disregard the information provided and not keep it on our bases.

This policy has been written simply and accessible, precisely so that you can read and understand how we use your data to provide a safe and comfortable experience in using the services offered.

The acceptance of this policy will be considered formalized when you enter your information and register or buy any product or service through Theodora Home website.

This will indicate that you are aware and in total agreement with how we will use your information and data.

If you do not agree with this policy, please do not continue your registration procedure and your purchase. However, we kindly ask for Theodora Home about its eventual disagreement so that we can use its foundations to evaluate the review of this policy.

For the privacy policy to be well understood, it is essential to clarify some important concepts:

• Customer or Potential Customer - Any individual who registers on the store's website or who purchases products or services through the site or WhatsApp.
• Personal data ? All information related to a natural person who identifies her or used in combination with other information may identify her.
• Personal data processing - All operation performed with personal data from collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, elimination, evaluation or control of Information, modification, communication, transfer, diffusion or extraction.
• Data Holder - Natural person to whom the personal data that is the subject of treatment refer.
• Controller - Natural or legal person, of public or private law, who compete for decisions regarding the processing of personal data.
• Operator - Natural or legal person, of public or private law, who processes personal data on behalf of the controller.
• In charge of processing personal data - person indicated by the controller and operator to act as a communication channel between the controller, the data holders and the National Data Protection Authority.
• National Data Protection Authority (ANPD) - public administration body responsible for ensuring, implementing and overseeing compliance with this law throughout the national territory
• Purpose - Performing treatment for legitimate, specific, explicit and informed purposes to the holder, without the possibility of later treatment incompatible with these purposes.
• Platform - Website, e -commerce managed by Theodora Home.
• Legal Base ? It is the legal hypotheses that authorize us to treat personal data.

Theodora Home, within the context of LGPD, acts as a controller regarding personal data processing. Next, a list of the main processes that treat personal data:

1. Personal data collected when registering or making purchases through the website or whatsapp, including wedding list purchases:
   1. Registration Data: Full Name; Date of birth; Gender; CPF; Address; Telephone; Email; Cell phone and profession.

      Note: The customer is still allowed at the time of registration on our platform, to perform the login through the pre -existing profile on social media.

   2. Payment data: card number; Name of card holder; Validity date and CVV number.

      Purpose of Data Collection: Compliance with the contractual obligations - Delivery of the product purchased on the website - online sales and sale through WhatsApp; Maintenance of registrations for better communication with our customers; Invoice issuance, reversal procedures, exchange and return, product delivery.
      Legal Base: Execution of contract and legal or regulatory obligation.

2. Personal data collected for newsletters and email marketing:
   • E-mail

   Purpose of data collection: sending newsletters and marketing campaigns.

   Legal Base: Consent.

3. Personal data collected at Contact Us/Leave your opinion:
   • Full name
   • E-mail

   Purpose of data collection: Serve the customer when they come in contact with Theodora Home to answer any questions, problem or want to leave any suggestions.

   Legal base: legitimate interest.

4. Personal data collected in online service (chat):
   • Name
   • E-mail
   • Phone

   Purpose of data collection: Serve the customer when they come in contact with Theodora Home to answer any questions, problem or want to leave any suggestions.

   Legal Base: legitimate interest

5. Personal data collected for the wedding list of the bride and groom:
   • Full Name of Grooms
   • Wedding date
   • E-mail
   • Cell phone
   • Address

   Purpose of data collection: supply of a wedding list and delivery of products to the bride and groom.

   Legal Base: Execution of Contract

6. Electronic Record Data and User Interaction: In this process the data are collected when navigating the platform, even from visitor without registration , ie in all processes listed above or only by the user to browse the site, will be collected:
   • Geolocation
   • Screening Websites
   • Apparatus model/so
   • IP address
   • Device device model/version of the device

   Purpose of data collection: Definition and analysis of consumer preference patterns of our customers, advertising campaigns, personalized offers, seek adequate security for the services offered and means of identification in the case of improper or illicit uses, Deal statistical and behavioral information (analytics), prevention of fraud on purchases.

   Legal base: legitimate interest and consent

Eventually, the request for other information may be made through direct contact of Theodora Home with users via email or telephone.

Navigation information on the site - When you access our site, can one? cookie can be installed? In your browser to identify how many times you return to our address. In this hypothesis, information such as IP address, geographical location, access routes, time, type of browser, visit duration and visited pages may be collected. For more information go to ourCookies Policy.

All data and information about you will be treated as confidential, and only used for the purposes described here and authorized by you.

Eventually, we may use data for purposes not provided for in this policy, but that are within their legitimate expectations. The eventual use of your data for purposes that do not comply with this prerogative will be done by authorization that we will ask you in advance.

Without prejudice to item 6 below, access to your personal information will be restricted only to Theodora Home employees and partners, and among them, only people with the specific internal authorizations to do so.

All your data is confidential and any use of such data will be in accordance with the law and this policy. Theodora Home will undertake all reasonable market efforts to ensure the safety of our systems and, consequently, their personal data.

All your information will be, whenever possible, encrypted, if you do not make your use unfeasible by Theodora Home.

Among other rights provided for by law, by request and at any time, you may have access to your personal data stored in our systems.

In order to achieve the purposes of the treatments provided for in this policy, the user agrees and consents that Theodora Home can share his personal data with:

1. Google Analytics - Software that evaluates how users interact with Theodora Home's website content. (Only the order number is shared). (https://policies.google.com/privacy?hl=en - Link to access Google's privacy policy)
2. LinkOnChatBot - Marketing Management Software (Marketing Automation and Email Marketing); (https://www.LinkOnChatBot.com.br)
3. Rumo - Website platform
4. Network - Payment Gateway(https://www.userede.com.br/novo/termos-de-uso - Link to access the company's privacy policy)
5. Government Agency (SP) - Invoice issuance
6. Accounting Office Confirp - for invoice issuance (https://confirp.com.br/politica-de-privacidade/ - Link to access the company's privacy policy)
7. Outsourced carriers - For shipping and delivery of products purchased through Theodora Home or WhatsApp.
8. Post Office - For shipping and delivery of products purchased by Theodora Home website or Whatsapps. (https://www.correios.com.br/falecomoscorreios/politica-de-privacidade-e-cookies - Link to access the post office privacy policy)
9. competent judicial, administrative or government authorities - whenever there is a legal determination, request, request or court order.

Some of the third parties with whom we share their data may have their servers or have facilities located in foreign countries, under these conditions, their personal data will be subject to the general data protection law and other Brazilian data protection legislations.

In this sense, Theodora Home is committed to always adopting efficient cyber security and data protection standards, in the best efforts to guarantee and comply with legislative requirements, as well as sharing with partners located in other countries, we only hire partners who have standard data protection and information security compatible with this privacy policy, so that data is always protected in these terms.

By browsing our site, you agree to process your information, including international data transfer, when necessary.

To ensure the protection of your data, we use technical and administrative security measures to avoid unauthorized access and accidental and/or illicit situations of handling, loss, destruction and/or alteration of these data.

Safety measures are improved and continually adapted to the applicable technology update, as well as the best market practices in this regard.

All your information will be, whenever possible, encrypted, if you do not make your use unfeasible for the purposes provided herein.

It is also very important for you to know that we will never send electronic or conventional mail messages, requesting data confirmation or with attachments that can be executed or links to any downloads.

Nor do we send emails with attached slips, we do not ask you to install programs, we do not request deposits for third parties and never call to request your SMS code.

In accordance with art. 48 of Law No. 13,709, the controller shall communicate to the holder and the National Data Protection Authority (ANPD) the occurrence of a security incident that may lead to risk or relevant damage to the holder.

Your personal data collected by Theodora Home will be used and stored during the time required for the provision of the service or for the purposes listed in this Privacy Policy to be reached, considering the rights of data subjects.

In general, your data will be maintained as long as the contractual relationship between you and Theodora Home lasts, always respecting the data retention period determined by applicable law.

After the storage period of personal data, these will be excluded from our databases or anonymous ones, unless such information is necessary to fulfill the legal obligation by Theodora Home, compliance with legitimate interests, or regular exercise of rights in judicial proceedings, administrative or arbitral.

You can exercise your rights about personal data dealt with by us, being:

1. Confirmation of the existence of treatment - Your right to ask Theodora Home information about the data it has about you and how it is treated;
2. Access to personal data - Your right to access your personal data under our treatment;
3. Correction of incomplete, inaccurate or outdated data - the right to ask Theodora Home to correct incomplete, inaccurate or outdated data;
4. Anonymization, blocking or elimination of unnecessary, excessive data - the right to request the temporary suspension of any transaction of your personal data or to request the deletion of a data data or set of databases, when these are unnecessary, excessive or dealt with in non -compliance with the General Data Protection Law (LGPD);
5. Portability of data to another service supplier or product, upon express request, in accordance with the regulation of the National Authority, observing the commercial and industrial secrets;
6. Elimination of personal data treated with the consent of the holder - the right to have their personal data eliminated from our databases
7. Information from public and private entities with which the controller has made shared data use;
8. Information on the possibility of not providing consent and the consequences of negative - Law of information on any treatment that the legal basis is consent and clear explanation of what may occur if the holder does not give consent
9. Revocation of consent - the right to revoke its consent to the purposes of processing personal data
10. Automated decisions review - The right to request clear information regarding the criteria and procedures used for decision making based on automated personal data treatment affecting their interests.

8.1. The right to data correction may be directly performed by the Holder himself through his account. Upon entering your account using your login and password, you will have a field with “ my registration data ”, by clicking on this field, the user can change their registration data.

8.2. Data holders may exercise their rights by written communication sent to the email: privacidade@theodorahome.com.br indicating with the subject: “Subject - Rights of the holder”.

8.3. It is important to clarify that their rights are not absolute and apply to all cases, but we will always do everything we can to honor their rights under applicable data protection laws.

8.4. The deadline for compliance with your rights is up to 15 (fifteen) days from the receipt of the request.

8.5. To meet your rights, Theodora Home will request some information to confirm that the person who is exercising this rights is indeed you or a person who is authorized to act on his behalf.

Any doubt about this policy can be clarified by contacting us through the email address privacidade@theodorahome.com.br, indicating as subject “ personal data privacy ”

In charge of processing personal data:
Office Cremasco and Vianna Lawyers Society (Dr. Samanta Amaro Vianna Cremasco)
e-mail: privacidade@theodorahome.com.br

You also have the right to petition before the National Data Protection Authority, the authority responsible for ensuring the respect for the rights of personal data holders in Brazil and to oversee compliance with the General Personal Data Protection Law (Law No. 13.709/18 or LGPD). Access in: https://www.gov.br/anpd/pt-br.

This policy can undergo updates. Therefore, we recommend you periodically visit this page so that you have knowledge about the modifications. If relevant changes are made that give you new authorizations, we will make public the new privacy policy.

This policy was last modified on October 20, 2021.