1. GENERAL INFORMATION AND DEFINITIONS

BIS School values the privacy of its Students and Legal Guardians and provides this Privacy Policy to demonstrate its commitment to protecting your Personal Data, in accordance with the General Data Protection Law (LGPD – Law No. 13,709, dated 8/14/2018), and other relevant laws. This policy describes how the school protects your privacy when collecting, processing, and storing personal information.

• 1.1 Definitions

Contracting Party: all individuals or legal entities that contract educational services provided by BIS School. Personal Data: means any information provided and/or collected by BIS School and/or its affiliates, by any means, even if public, that: (I) identifies or that, when used in combination with other information processed, identifies an individual; or (II) through which an individual’s identification or contact information can be derived. Personal Data can be in any medium or format, including electronic or computerized records as well as paper-based files. However, Personal Data does not include business phone numbers, business mobile numbers, business addresses, or business emails. Necessity: the justification for which it is strictly necessary to collect personal data, to achieve the purpose, avoiding excessive data collection. Legal Bases: the legal basis that legitimizes the processing of personal data for a specific prior purpose by BIS School. Consent: express and unequivocal authorization given by the data subject or Legal Guardian for BIS School to process their personal data for a previously described purpose, in which the necessary legal basis for the act requires the express authorization of the subject. This policy applies, in general, to all Students and Contracting Parties of the services offered by BIS School and summarizes how the school may collect, produce, receive, classify, use, access, reproduce, transmit, distribute, process, archive, store, delete, evaluate or control the information, modify, communicate, transfer, disseminate or extract collected data, including personally identifiable information, in accordance with applicable legal bases and all privacy and data protection laws in effect. By using the services provided by BIS School, the Contracting Party declares full and express capacity to accept the terms and conditions of this Privacy Policy for all legal purposes.

2. COLLECTION AND USES OF PERSONAL INFORMATION

The Contracting Party is aware that they provide information consciously and voluntarily, including their own and the Students’ Personal Data, through Forms, Enrollment, Contracts, etc. The personal information of Students and Legal Guardians provided to the school will be collected by ethical and legal means and may have one or more purposes, about which the Contracting Parties will be informed.

3. SHARING AND PROCESSING OF PERSONAL INFORMATION

BIS School may disclose collected Personal Data to third parties, in the following situations and within the limits required and authorized by Law:

1. With companies and individuals contracted to carry out certain activities and services on behalf of BIS School (such as transportation, extracurricular activities, among others).
2. With group companies.
3. With suppliers and partners to carry out the services contracted with BIS School (such as information technology, accounting, legal, among others).
4. With third parties responsible for any required medical assistance.
5. For administrative purposes such as research, planning, service development, security, and risk management.
6. When necessary due to legal obligation, determination by a competent authority, or judicial decision.

In cases of sharing Personal Data with third parties, all subjects mentioned in items I to VI must use the shared Personal Data consistently and in accordance with the purposes for which it was collected (or with which the Contracting Party has previously consented) and in accordance with this Privacy Policy and all applicable privacy and data protection laws.

4. LEGAL GROUNDS FOR DISCLOSING YOUR DATA

Under certain circumstances, BIS School may disclose Personal Data, to the extent necessary or appropriate, to government agencies, consultants, and other third parties to comply with applicable law or with an order or subpoena, or if the school believes in good faith that such action is necessary to:

1. Comply with a law that requires such disclosure.
2. Investigate, prevent, or take action regarding suspected or actual illegal activities or to cooperate with public authorities or to protect the safety of its Students.
3. Enforce its contracts.
4. Investigate and defend itself against any third-party claims or allegations.
5. Protect the security or integrity of the services.
6. Exercise or protect the rights, property, and safety of BIS School and its affiliates.
7. Protect the personal safety of its employees, users, or the public.
8. In case of sale, purchase, merger, reorganization, liquidation, or dissolution of BIS School.

BIS School will notify the respective Contracting Parties of any legal demands that result in the disclosure of personal information, as provided in item 4, unless such notification is prohibited by law or forbidden by a court order or if the request is urgent. BIS School may contest such requests if it believes they are excessive, vague, or requested by incompetent authorities.

5. SECURITY OF PERSONAL INFORMATION

All Personal Data will be stored in BIS School’s database or in databases maintained by the school’s contracted service providers, who are duly in accordance with current data legislation. BIS School and its providers use various security procedures to protect the confidentiality, security, and integrity of all collected Personal Data, preventing potential damages as a result of data processing. Although BIS School uses security measures and monitors its system to check for vulnerabilities and attacks to protect Personal Data from unauthorized disclosure, misuse, or alteration, the Contracting Party understands and agrees that there are no guarantees that the information cannot be accessed, disclosed, altered, or destroyed by a breach of any of the physical, technical, or administrative protections.

6. DATA RETENTION

BIS School retains all data provided, including Personal Data, from the signing of the Educational Services Contract and as necessary for the provision of its services. The Data will be retained and stored until any request for deletion. BIS School may retain Personal Data after receiving a deletion request if necessary to comply with legal obligations, resolve disputes, maintain security, prevent fraud and abuse, and ensure compliance with contracts.

7. LEGAL GROUNDS FOR PROCESSING

BIS School only processes Personal Data in situations where it is legally authorized or with the express and unequivocal consent of the Contracting Party. As described in this Policy, the school has legal grounds to collect, produce, receive, classify, use, access, reproduce, transmit, distribute, process, archive, store, delete, evaluate or control the information, modify, communicate, transfer, disseminate or extract data about the Students and their Legal Guardians, always observing good faith and the legal principles for its use, which are: purpose, adequacy, necessity, free access, data quality, transparency, security, prevention, non-discrimination, accountability, and accountability. The legal bases include consent, contracts, preliminary contractual procedures, and legitimate interests, provided that such processing does not violate your rights and freedoms. Such interests include protecting Students and Legal Guardians and the school from threats, complying with applicable legislation, exercising regular rights in judicial, administrative, or arbitration proceedings, enabling business performance or administration, including quality control, reporting and services offered, managing business transactions, understanding and improving business and customer relationships. The Contracting Party has the right to refuse or withdraw the consent provided to BIS School, where this is the legal basis for processing personal data, and the school may terminate the provision of its services to this Contracting Party in the event of such a request.

8. RIGHT TO ACCESS AND CONTROL YOUR PERSONAL DATA

BIS School provides the Contracting Party with options on what to do with the collected, processed, and stored Personal Data, including its deletion and/or correction. The Contracting Party may:

1. Delete data: The Contracting Party can request the deletion of provided Personal Data (for example, if it is no longer necessary to provide services).
2. Change or correct data: The Contracting Party may edit or request the editing of Personal Data. The Contracting Party may also request updates, changes, or corrections, especially if they are incorrect.
3. Raise objections, limitations, or restrictions on the use of data: The Contracting Party may request the cessation of use of all or some of the provided Personal Data or limit the use of such data (for example, if the Personal Data is incorrect or illegally stored), emphasizing that BIS School may process Personal Data according to legal bases.
4. The Contracting Party has the right to access or transfer their data: The Contracting Party may request a copy of Personal Data and the data provided in a readable format, either in print or electronically.