Rules of Security and Privacy

Studenta Mexico

This Exhibit is part of the Global Privacy Policy – Grupo UOL. If personal data are collected and processed for Studenta in Mexico, the following provisions shall apply.

For further information of the Privacy Notice, please review the Global Privacy Policy – Grupo UOL.

In case of conflict, this Exhibit will prevail over the Global Privacy Policy – Group UOL.

(i) Identity and address of the Controller

The Controller of the personal data processed will be PASSEI DIRETO S/A, private legal entity, referred to as Studenta, a company belonging to GRUPO UOL, with address at Praia de Botafogo, 228 Bloco, A - 3º andar - Botafogo, Rio de Janeiro/RJ, 22250-906, Brazil.

(ii) Use of data (Purposes)

The purposes of data processing are set out in section 3.1 "Use of Data" in the Global Privacy Policy – Grupo UOL, these shall be deemed necessary except the following: iv, vi and x. The above distinction has its basis in the data protection legislation in Mexico which requests that it is requirement to distinguish between the purposes that are necessary to maintain the legal relationship with the data subject and those that are secondary and not required to maintain the legal relationship.

You may object to these secondary purposes through the mechanisms set out in the section 4 “Data Storage (ARCO Rights and Other Rights)”.

(iii) Use of Data (Transfers)

The use, access and sharing of the database created hereunder shall be made within the limits and purposes of Grupo UOL’s activities, and it may be shared and made available for access and/or research to third parties with whom Grupo UOL has a legal relationship, for the purposes described in the Global Privacy Policy - Grupo UOL, the provisions hereunder, Applicable Law or court order, and includes the following. Please consider that the purposes of the data transfers are established in the Global Privacy Policy – Grupo UOL. The transfers that require your consent are marked with an “asterisk” “*”:

(i) companies who are part of Grupo UOL;

(ii) business and financial partners; *

(iii) suppliers, such as, but not limited to, traffic research, data analysis/performance, user surveys, customer service, consultings, payment methods, social media, tax/accounting, partners education, promotions and advertising;

(iv) service providers and contractors for information technology, cybersecurity, technical support, data management, domain registrations, comment moderation, marketing/events, research, logistics, billing and others;

(v) authorities and public agencies;

(vi) general third parties such as tax solutions, external audit companies and law firms (who will act as Processors).

However, please consider that if you oppose to the transfers that require your consent, we could no longer provide our services to you since they are necessary for our operations.

We remind you that we can transfer your personal data without your consent according to article 37 of the Mexican Federal Law on Protection of Personal Data Held by Private Parties (“LFPDPPP”).

By accepting this Privacy Policy, you accept transfers that require your consent. To oppose any of these transfers please consult the mechanisms set out in the section "Data Storage (ARCO rights and other rights)".

(iv) Data Storage (ARCO Rights and Other Rights)

You as Data Subject have the rights established on the Global Privacy Policy – UOL Group besides the following rights:

- Object to the data processing to voluntary purposes or by legitimate grounds.

- Object and limit the use and disclosure of personal data.

- Oppose to data transfers that require your consent.

You can exercise any of the mentioned rights, know the mechanisms and requirements using the support tools available in the websites, applications, and services provided by Grupo UOL.

Versions in other languages are provided just for reference, if any question arises, the Portuguese version shall prevail.