Fluency Academy’s Personal Data Collection and Processing Policy (‘Privacy Policy’)

Rules for the relationship between Fluency Academy and personal data holders

This Personal Data Collection and Processing Policy (“Personal Data Policy” or “Privacy Policy”) sets forth rules and procedures that must be followed by partners, employees, and service providers who collect or process personal data on behalf of Fluency Academy Ensino de Idiomas Ltda. (“Fluency” or “Organization”). The provisions contained herein establish standards of conduct and transparency and bind all individuals or entities that collect or process personal data controlled by Fluency.

This Personal Data Policy must be observed in accordance with Law No. 13.709, of August 14, 2018, the General Data Protection Law (“LGPD”). Where applicable and relevant, it will also follow the general principles and rules of Law No. 12.965, of April 23, 2014, the Brazilian Internet Civil Framework, Decree-Law No. 5.452, of May 1, 1943, the Consolidation of Labor Laws (“CLT”), applicable labor and social security regulations, Law No. 5.172, of October 25, 1966, the National Tax Code (“CTN”), applicable tax and fiscal regulations, and Law No. 8.069, of July 13, 1990, the Statute of Children and Adolescents (“ECA”). The rules contained herein must also be observed in compliance with Fluency Academy’s Articles of Association.

Fluency only processes personal data to achieve legitimate, specific, and informed purposes to the data subject, in accordance with this Privacy Policy. The Organization values compatibility in processing with the purposes informed and collects only the minimum necessary to achieve its social objectives. Fluency does not process personal data for discriminatory, unlawful, or abusive purposes. The Organization will use its best efforts to maintain transparency in its relationship with personal data holders under its control, providing clear, precise, and accessible information to the holders. Fluency adopts preventive technical and administrative measures that, in the Organization’s understanding, are capable of protecting personal data from unauthorized access and from accidental or unlawful situations, in order to avoid damage resulting from the processing of personal data.

This Privacy Policy consists of four sections: 1) Scope and Definitions; 2) Nature of Collected Personal Data and Processing Purposes; 3) Rights of Personal Data Holders; and 4) Information Security.

First Section

1. Scope and Definitions

1.1 Personal Data: All information related to an identified or identifiable natural person and that is subject to collection or processing by Fluency or by an entity or person acting under its express instructions.
1.2 Personal Data Holder: A natural person to whom the personal data being processed by Fluency relates.
1.3 Interested Parties: Personal data holders whose data is processed by Fluency and who may belong to one of the following profiles:

• 1.3.1 natural person partner of Fluency;
• 1.3.2 employee of Fluency and/or their dependent;
• 1.3.3 student, former student, and potential student of Fluency;
• 1.3.4 content producer and/or natural person service provider of Fluency;
• 1.3.5 legal representative and partner of corporate clients;
• 1.3.6 other interested parties not falling into the above categories. 1.4 Controller: Fluency acts as the Data Controller whenever it is responsible for decisions regarding the processing of personal data. 1.5 Processor: Any natural or legal person, public or private, who processes personal data on behalf of Fluency. 1.6 Data Protection Officer (DPO): A person designated by Fluency to act as a communication channel between the Organization, data subjects, and the National Data Protection Authority (“ANPD”). 1.7 Processing of Personal Data: Any operation performed on personal data, such as collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, elimination, evaluation or control of information, modification, communication, transfer, dissemination, or extraction. 1.8 Consent: A free, informed, and unequivocal expression by which the data subject agrees to the processing of their personal data for a specific purpose. 1.9 Sensitive Personal Data: Personal data about racial or ethnic origin, religious belief, political opinion, union membership or membership in a religious, philosophical, or political organization, data concerning health or sex life, genetic or biometric data, when linked to a natural person.

Second Section

2. Nature of Collected Personal Data and Processing Purposes

2.1 According to this Privacy Policy and as per its Articles of Association, Fluency collects and processes personal data of Interested Parties as part of its efforts to achieve its social objectives.
2.2 Fluency will collect sensitive personal data through a specific consent agreement signed by the data subject, outlining, among other things, the purpose for which the data will be collected and processed, or, alternatively, in accordance with the authorizing provisions for the processing of sensitive personal data under Article 11 of the LGPD.
2.3 If the Interested Party is a child, Fluency will only process their personal data with the specific and highlighted consent of at least one parent or legal guardian, observing the best interest of the child, except for the provision established in paragraph 3 of Article 14 of the LGPD.
2.4 Fluency processes personal data to achieve the following purposes: 2.4.1 Execution of Fluency’s Social Purpose: Processing personal data of natural persons to enroll and register them to ensure access and assess the experience of students and content producers and/or service providers in language courses on the Fluency Academy platform, undertaking the following activities:

• a) Enroll and create profiles for students and content producers and/or service providers;
• b) Track students’ usage and study sessions; track course audience; track app audience; use voice recognition algorithms; record student sessions with content producers and/or service providers; monitor content producers’ and/or service providers’ activities; create heat maps of platform usage; monitor the platform usage by students and content producers and/or service providers; conduct qualitative research with students; receive and publish public reviews from students regarding service quality; address students’ inquiries about courses and platform usage; track corporate clients’ students’ performance; monitor communications between students and content producers and/or service providers to ensure compliance with the Organization’s policies, among others.

Sole Paragraph: To enable the execution of the actions described above, Fluency collects and processes personal data from the following types of information: first and last name, email, phone number, CPF (Brazilian taxpayer identification), date of birth, city, state, and country of origin, nationality, income, company or organization name, address, and credit card data linked to the individual, corporate email, motivation for learning a language, available study time, study history, study time, study location, course performance, such as completion of class schedules, units and stages, completion of additional activities, videos and audios played, social media profile, audio, image, and voice of session participants, location data, behavior of students and content producers and/or service providers in the organization’s digital environments, such as clicks, traffic, downloads, connection type, mouse movement, survey responses, proficiency test results, course community comments, lesson evaluations, lesson comments, chat transcriptions, and more.

2.4.2 Administrative, Financial, and Human Resource Management: Carrying out the following activities:

• a) Complete and manage contracts with students; control access to the Organization’s physical premises; complete contracts with corporate clients; complete contracts with service providers; complete contracts with content producers and/or service providers; manage contractual terms with service providers; manage contractual terms with content producers and/or service providers; assess the suitability of potential service providers with the Organization’s values; assess the suitability of potential content producers and/or service providers with the Organization’s values; send office supplies, onboarding kits, gifts, and materials for corporate campaigns, among other tasks.
• b) Manage the Organization’s financial sustainability; control student and corporate client payments; process refunds for students via bank deposit, among other tasks.
• c) Perform specific human resources management tasks such as concluding employment contracts, defining job roles, processing payroll, handling salary adjustments or increases, managing work hours, managing time off, evaluating the suitability of potential employees with the Organization’s values, and more.

Single Paragraph: To enable the execution of the above activities, Fluency processes personal data based on the following information: first and last name, CPF, RG, CNH (Brazilian driver’s license), employment contract information such as PIS (Social Integration Program), CTPS (Work Card), education and professional qualifications, full address, social media profile, professional CV, professional history, phone number, job role, department, and employment start date, bank account details like bank name, branch, and account number, credit card details linked to an individual, health information necessary for employment contracts, payment information, and more.

2.4.3 Communication and Marketing: Fluency performs the following activities with the goal of promoting and publicizing language courses:

• a) Send newsletters; promote events; create and distribute e-books; accept referrals; conduct targeted advertising on social media and other digital platforms; identify potential students and corporate clients (generate leads); identify student interest in new courses; assess language proficiency levels of potential students; profile students based on qualitative information, among other tasks.

Single Paragraph: To execute these activities, Fluency processes personal data such as social media profiles, email, first and last name, CPF, address, date of birth, city, state, and country of origin, nationality, cell phone, income, language learning history and duration, school attended, proficiency test results, cookies, pixels, and IP identification, payment method, personal data of the payer (if different from the student), motivation for taking a language course, information provided by the data subject regarding missed opportunities due to a lack of foreign language knowledge, available study time, study history, location of previous courses, personal data of corporate client representatives such as name, last name, email, and phone number.

2.4.4 Legal Basis: The personal data processing activities mentioned in:

• a) item 2.4.1 are based on the necessity to execute a contract or preliminary procedures related to a contract in which the Interested Party is a party, at their request, in accordance with Article 7(V) of the LGPD.
• b) item 2.4.2 are based on the necessity to execute employment, service provision, and/or content production contracts or preliminary procedures related to such contracts in which the Interested Party is involved, according to Article 7(V) of the LGPD, or, depending on the specific case, based on the data subject’s consent in accordance with Article 7(I) of the LGPD.
• c) item 2.4.3 are based on the data subject’s consent or, depending on the specific case, on the legitimate interest of Fluency or a third party, according to Articles 7(I) and 7(IX) of the LGPD.
• d) In the case of processing sensitive personal data as defined in Article 5(II) of the LGPD, Fluency will collect the specific and highlighted consent of the Interested Party or their legal representative for specific purposes, in accordance with Article 11(I) of the LGPD.

2.4.5 Sharing Personal Data: Fluency contracts external service providers to assist in carrying out the activities described in Item 2 of this Privacy Policy, using functionalities offered by companies such as Google (Google Workspace tools), Meta (WhatsApp, among others), Hotmart, and others. Fluency may act as either a Controller or Joint Controller of personal data in the processing chain, depending on the specific case. Fluency may also contract Personal Data Processors, who, under specific data processing rules outlined in contracts, will process personal data on behalf of Fluency.

• 2.4.5.1 The use of Fluency’s platform and the transfer of any information to other applications via Google APIs must comply with the Google API Services User Data Policy, including the Limited Use requirements.
• 2.4.5.2 In its contracts with external agents requiring the sharing of personal data to fulfill contractual objectives, Fluency will make its best efforts to include clauses holding the parties responsible for complying with the General Data Protection Law (LGPD).
• 2.4.5.3 Fluency may share personal data with law enforcement authorities or in response to legal requests, in accordance with specific laws and regulations. Fluency may also share personal data with competent authorities when necessary to prevent and resolve fraud or other illegal activities and to prevent unauthorized use of data or services that do not comply with this Privacy Policy and the Organization’s Articles of Association.
• 2.4.6 International Transfer of Personal Data: To achieve its social purposes, Fluency transfers personal data to organizations established in foreign countries with which Fluency has service contracts or other legal instruments. These agreements bind the parties to comply with the principles, rights of the data subject, and the data protection regime outlined in the Brazilian General Data Protection Law.
• 2.4.7 Data Retention: The processing of personal data, including the retention guidelines, will comply with Fluency’s Personal Data Retention Policy and specific legislation, such as Article 15 of Law No. 12.965, of April 23, 2014 (Internet Civil Framework), which establishes a six-month retention period for application access logs. In the event of conflicting regulations, Fluency will rely on the legal basis that provides legal security in complying with legal or regulatory obligations or that does not result in the forfeiture of the regular exercise of rights, including in contracts or judicial, administrative, or arbitration proceedings.
• 2.4.8 Use of Cookies and Other Tools: Fluency uses cookies and other technological tools on its platforms and applications to measure, optimize, and create audiences for its advertising campaigns in line with the purposes outlined in Item 2 of this Privacy Policy. Fluency uses cookies to analyze platform usage, personalize the user experience, facilitate connections, recognize users accessing its digital environments, identify whether a page was visited, check if an email was opened, and make advertisements more effective.

Third Section

3. Rights of Personal Data Holders

3.1 Fluency grants the personal data holder the right to access, rectify, port, and delete their data, except in cases of mandatory data retention under specific legislation and in accordance with this Personal Data Policy. Therefore, personal data holders are entitled to exercise the following rights by submitting an express request to (dpo@fluencyacademy.io):

• 3.1.1 Request information on whether their personal data is being processed;
• 3.1.2 Request access to their personal data held by Fluency;
• 3.1.3 Request the correction of incomplete, inaccurate, or outdated personal data;
• 3.1.4 Request the anonymization, blocking, or deletion of personal data deemed unnecessary or excessive by the data subject, in accordance with Article 10, paragraph 1 of the LGPD, with Fluency reserving the right to refuse such requests, with due justification.

• 3.1.5 Request the portability of their personal data, with or without deletion of the data after the transfer, respecting commercial and industrial confidentiality;
• 3.1.6 Request the deletion of personal data processed based on consent, with the right of refusal by Fluency duly justified;
• 3.1.7 Receive information about public and private entities with which Fluency has shared personal data;
• 3.1.8 Revoke consent;
• 3.1.9 Be informed about the existence of shared data usage and its respective purpose.

3.2 Fluency retains personal data until it is no longer necessary to fulfill the purposes defined in this Personal Data Policy. The Organization also stores personal data as stated in item 3.1.6. In both cases, Fluency will observe the following:

• 3.2.1 The Data Protection Officer (DPO) may deny a request to delete personal data under the following circumstances: (i) when the request imposes an excessive burden on Fluency; (ii) when, due to the nature of the personal data, the processing is carried out based on legal or regulatory obligations; (iii) when personal data processing is required to comply with judicial decisions; or (iv) when the data subject’s request violates laws, regulations, or industry codes of conduct.

3.3 Fluency is not responsible for the consequences arising from incomplete, inaccurate, or outdated personal data.

Fourth Section

4. Information Security

4.1 Fluency adopts the necessary and appropriate security measures, both technical and administrative, to protect personal data from unauthorized access and from accidental or unlawful situations of destruction, loss, alteration, communication, or any form of improper or unlawful processing.

• 4.1.1 Fluency takes appropriate measures to ensure that processors who perform data processing activities under its direction are bound by confidentiality obligations. This includes using standard contractual clauses for personal data protection, requiring that any such shared information remains in a protected and secure environment. A copy of these clauses can be obtained by contacting: dpo@fluencyacademy.io.
• 4.1.2 Fluency contracts processors with whom it shares personal data, ensuring that they comply with the Minimum Standards and Regulations outlined in its internal policies, which can be obtained by contacting: dpo@fluencyacademy.io.

This Personal Data Collection and Processing Policy was adopted on September 24, 2021, and is subject to review at any time by the Organization.