Privacy Policy

PRIVACY POLICY AND TERMS OF USE FOR PLATFORMS RELATED TO THE VILLAVISTA DEVELOPMENT

A. PURPOSE

To establish how essential service providers and/or representatives of the owner of the Villavista development collect, use, store, and protect your personal data, with transparency and respect for your privacy, by informing:

  • Which data is collected
  • The reasons for the collection
  • How you can exercise your rights

All in accordance with the Brazilian General Data Protection Law (LGPD) and current Brazilian legislation.

B. SCOPE

This policy applies to essential service providers and/or representatives of the owner of the Villavista development and covers all of their platforms.

C. DEFINITIONS

Adolescent: Any natural person aged between 12 (inclusive) and under 18 years old.

ANPD: National Data Protection Authority.

Controller: A natural or legal person, governed by public or private law, who is responsible for decisions regarding the processing of personal data.

Cookies or Browsing Data: Text files sent by platforms to the user's computer, storing information related to website navigation, such as access data (location and time).

Child: Any natural person under 12 years old.

Personal Data: Information related to an identified or identifiable natural person, such as name, email, phone number, CPF, RG, driver's license.

Sensitive Personal Data: Information regarding racial or ethnic origin, religious beliefs, political opinions, union membership, or affiliation to a religious, philosophical, or political organization, health or sex life data, genetic or biometric data, when linked to a natural person.

Data Protection Officer (DPO): The person appointed by the controller and processor to act as a communication channel between Bullla, data subjects, and the ANPD.

LGPD: Brazilian General Data Protection Law.

Processor: A natural or legal person who processes personal data on behalf of the controller.

Platforms: Virtual environment that enables interaction and informational sharing between Users through websites, emails, and messaging services.

SCR: Credit Information System, composed of data sent to the Central Bank of Brazil regarding credit operations, as defined by CMN Resolution No. 5.037, of September 29, 2022, as amended.

Acceptance Term: The record of the data subject's free, informed, and unequivocal expression of agreement with the processing of their data for a specific purpose, made through the website and/or a specific document.

Data Subject: The natural person to whom the personal data being processed refers.

Processing: Any operation involving personal data, such as collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, deletion, evaluation, control, modification, communication, transfer, dissemination, or extraction.

User: A person who uses the website www.villavista.com.br and/or communicates via emails, instant messaging services, and/or telephone with essential service providers and/or representatives of the Villavista development owner, providing personal data to enable contact and address related matters.

D. GUIDELINES

1. DATA COLLECTED

Essential service providers and/or representatives of the Villavista development owner collect and process personal data to:

  • Provide their products and services
  • Ensure the efficient operation of their platforms
  • Comply with applicable legal obligations

Data is obtained during:

  • Platform usage by the data subject
  • Direct interactions with these providers and/or representatives
  • When needed for administrative or personnel management purposes

1.1. Acting as Controller or Processor

They may process personal data either as:

  • Controller: when processing on their own behalf
  • Processor: when processing on behalf of another Controller

1.2. Types of Personal Data Collected

To access and use the platforms, the User must provide personal data to be identified and obtain information about the Villavista development. The following data may be collected:

Identification Data:

  • Full Name
  • CPF

Contact Data:

  • Email
  • Phone

Access Data:

  • Platform access logs
  • Cookies
  • IP address

1.2.1. Data of Children and Adolescents

Personal data of children and adolescents is collected and processed only with specific and highlighted consent from at least one parent or legal guardian, as required by the LGPD. This data is used solely for purposes essential to service provision, ensuring the safety and privacy of minors.

2. DATA SUBJECT CONSENT

The processing of personal data is based on legal grounds established by the LGPD. Consent, when used, is obtained freely, informedly, and unequivocally, through a positive user action.

By accepting this Privacy Policy, the user also agrees to the cookie policies of analytics companies working with Villavista's representatives.

2.1. Revocation of Consent

Consent can be revoked at any time, free of charge, via the communication channel provided in this Policy. If revoked, third parties with whom the data was shared will be informed, unless it's impossible or disproportionately burdensome.

2.2. Consent Management

All consent-related actions will be recorded, including:

  • Collection
  • Revocation

Technical and organizational measures will be implemented to manage consent and prevent improper processing of data.

3. DATA PROCESSING

Data is processed in good faith and aligned with principles such as:

  • Purpose
  • Necessity
  • Transparency
  • Data quality
  • Accountability

3.1. Legal Bases

  • Data subject's consent
  • Compliance with legal/regulatory obligations
  • Execution of contracts or pre-contractual procedures
  • Exercise of legal rights
  • Legitimate interests
  • Credit protection
  • Fraud and security prevention
  • Protection of life or physical integrity
  • Health protection

3.2. Processing Purposes

Operation and Services:

  • Platform access and identification
  • Customer support
  • Contracting suppliers, partners, or potential buyers

Communication:

  • Sending emails, SMS, WhatsApp messages, notifications

Improvement and Personalization:

  • User behavior analysis
  • Content and offer personalization
  • Business development

Infrastructure and Security:

  • Data storage
  • Fraud prevention
  • Data updating

Legal Obligations:

  • Compliance with legal and regulatory demands
  • Legal proceedings

Partner Sharing:

  • Share minimal data with partners to assess investment/credit profile for property acquisition

4. DATA SHARING

Data may be shared with:

  • Partners and suppliers for registration and credit analysis
  • Public authorities and regulatory agencies
  • Fraud prevention and credit analysis companies
  • International data centers (e.g., USA, EU) following ANPD standards

Commitments:

  • Careful selection of third parties for data sharing
  • Required adequate security measures and LGPD compliance
  • No commercialization of personal data
  • Sharing according to informed purposes and LGPD legal bases

4.1. SCR and Credit Checks

Financial partners may access the SCR (Credit Information System) and credit protection services to assess user profiles for investment and/or credit evaluation purposes.

Upon request, users may receive information on which partners consulted their data, along with guidance about the SCR system.

Authorization for consultation is obtained through selection of: "I declare that I have read and agree with the Privacy Policy and Terms of Use, including SCR consultation" prior to submitting personal data through the Platforms.

4.2. Data Security

Villavista representatives are committed to data security, implementing technical and administrative measures such as:

  • Encryption
  • Access controls
  • Other security protections

Though absolute security cannot be guaranteed for internet transmissions.

Liability Limitations:The service providers will not be responsible for:

  • Illegal interceptions or violations of systems or databases by unauthorized persons
  • Improper use of information obtained through such means

In Case of Security Incidents:

  • Risks will be assessed
  • ANPD and data subjects will be notified within 3 business days of awareness
  • Additional information will be provided within 20 business days
  • Communication channel: concierge@villavista.com.br

4.2.1. Data Storage and Termination

Data is stored in physical or virtual data centers located in Brazil and/or other countries, such as:

  • United States of America
  • European Union countries

Prioritizing the use of cloud computing with data processing in Brazil.

In the event of business restructuring (sale, merger, corporate reorganization), data may be transferred ensuring:

  • Continuity of protection
  • User notification if there are significant changes to the Privacy Policy

5. DPO AND USER RIGHTS

Data Protection Officer (DPO) Contact: contato.dpo@bullla.com.br

The service providers commit to responding to requests within the timeframe established by current legislation, attending to the following user rights:

  • Access: Confirm the existence of processing and access your personal data
  • Rectification: Correct incomplete, inaccurate, or outdated data
  • Deletion: Request deletion of unnecessary, excessive, or improperly processed data
  • Anonymization/Blocking: Request anonymization, blocking, or deletion of data
  • Portability: Transfer your data to another service or product provider
  • Consent Revocation: Revoke consent for data processing
  • Information on Data Sharing: Obtain information about entities with whom your data is shared
  • Information on Consequences of Consent Refusal: Obtain information about consequences of not providing or revoking consent
  • Other Rights: Exercise any other rights provided under the LGPD

6. POLICY UPDATES

The service providers will periodically review and update this Privacy Policy:

  • Regularly
  • Whenever there are significant changes in legislation
  • Whenever there are changes in their data processing practices

Communication of Changes:Users may be notified about significant changes through:

  • Platform notifications
  • Email and/or messages
  • Publication of the updated version on the Platforms

Recommendation: Users should review this policy when using the Platforms.

Important Contacts: