Privacy and Cookies Policy

TEX COURIER S.A recognizes the importance of privacy and has the mission to establish a transparent relationship with its clients and users regarding the processing of personal data through this policy.

This Privacy Policy (Policy) contains information about the processing of personal data of users and visitors of the website https://totalexpress.com.br/ (Site) and our mobile applications, herein referred to as Platforms. This document describes the personal data we collect, how it is processed, and your rights regarding this data. We recommend careful reading.

This Privacy Policy applies to all clients, potential clients, users, and visitors of the Site. Our Privacy Policy is regularly reviewed to ensure compliance with laws, regulations, and new technologies, reflecting possible changes in our operations and practices. It is important that you regularly access this policy and observe its update date.

After reading this Privacy Policy, if you wish to communicate with us about questions, complaints, or to exercise your rights related to your personal data, you can contact our responsible department through the channel https://helloethics.com/totalexpress/lgpd/. For questions or complaints related to our services, you can contact us by phone (11)3627-5900, through the EVA chatbot available on our website.

1. Basic concepts: what do I need to know to understand this Policy?

Processing Agents: the controller and the processor; National Data Protection Authority (ANPD): federal public administration body responsible for ensuring, implementing, and overseeing compliance with LGPD throughout the national territory. Database: structured set of personal data, established in one or several locations, in electronic or physical support; Legal Bases or Legal Base: These are the legal hypotheses that authorize the processing of personal data, for example: (i) consent; (ii) compliance with legal or regulatory obligation; (iii) processing and shared use of data necessary for the execution of public policies provided for in laws and regulations or supported by contracts, agreements, or similar instruments; (iv) conducting studies by research bodies; (v) execution of contract or preliminary procedures related to a contract of which the data subject is a party; (vi) regular exercise of rights in judicial, administrative, or arbitral proceedings; (vii) protection of life or physical safety of the data subject or third party; (viii) health protection, exclusively, in procedures performed by health professionals, health services, or health authority; (ix) meeting the legitimate interests of the controller or third parties; and (x) credit protection. Consent: free, informed, and unequivocal manifestation by which the data subject agrees to the processing of their personal data for a specific purpose; Controller: natural or legal person, under public or private law, who has the authority to make decisions regarding the processing of personal data; Anonymized Data: data relating to the data subject that cannot be identified, considering the use of reasonable and available technical means at the time of its processing; Personal Data: information related to an identified or identifiable natural person; Sensitive Data: all personal data about racial or ethnic origin, religious conviction, political opinion, union membership or membership in religious, philosophical, or political organizations, health or sexual life data, and genetic or biometric data, when linked to a natural person; LGPD: General Personal Data Protection Law (Federal Law 13.709/2018); Processor: natural or legal person, under public or private law, who processes Personal Data on behalf of the Controller; Platforms/Site: Total Express virtual environments, such as proprietary mobile applications and website under Total Express domain name, including tracking service pages, client area, and other subdomains Data Subject: natural person to whom the Personal Data that is the object of processing refers; Processing: any operation performed with Personal Data, such as those referring to collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, elimination, evaluation or control of information, modification, communication, transfer, dissemination, or extraction; Shared Data Use: communication, dissemination, international transfer, interconnection of personal data or shared processing of personal data databases by public bodies and entities in compliance with their legal competencies, or between these and private entities, reciprocally, with specific authorization, for one or more processing modalities permitted by these public entities, or between private entities

2. Personal Data Collection

The types of Personal Data and the form of collection depend on how you relate to us and why. For us to provide our services, it becomes essential to collect some information about you. Therefore, depending on the type of relationship established, we may collect Personal Data provided directly by you, by third parties, or collected in another way, according to the service provided.

2.1. Forms of collection

In general, we collect Personal Data in the following ways: (i) Personal Data provided directly by you: Personal Data inserted or sent when accessing our Platforms. (ii) Personal Data provided by third parties: Personal Data received through third parties, whether clients, partners, or service providers who have some relationship with you. It is also possible that there is collection of your data from public databases. (iii) Personal Data collected in another way: Personal Data collected through certain market technologies, such as computational and navigation data, with the purpose of improving your browsing experience in our services, according to your habits and preferences.

2.2. Types of data collected

The Personal Data we process varies according to the purposes of use, including those indicated in this Policy, and with the activities we perform. This Personal Data may include, among others, the following: Personal Data: name, date of birth, gender, ID, CPF and/or other identification documents, such as driver's license, photo, date of birth, residential and commercial address, residential, commercial and mobile phones, email, profession, occupation, marital status, nationality, place of birth, among others.

2.3. Processing Purposes

Personal Data Processing may have various purposes. Thus, we present below, in an exemplary manner, the main purposes for which we will process your personal information: • For the execution of services in which the Data Subject expresses interest, through access to our Platforms or indirectly through contracting services from our clients/partners; • For the execution of contracted services: it will be necessary to use your Personal Data to perform our services and comply with our obligations, according to what is requested and based on our relationship, thus complying with our contractual obligations; • To provide Data Subjects with an electronic environment through which Users can obtain more information about our services; • To establish a direct communication channel and respond to user requests through available channels, such as "Track Package", "Client Area", "Work with us", "Eva Chatbot"; • For compliance with legal or regulatory obligations, such as, but not limited to: (i) resolutions; (ii) circulars; (iii) normative acts; (iv) communications from competent bodies; • For the regular exercise of rights in judicial, administrative, or arbitral proceedings, (i) in conducting complaint reception processes in ombudsman offices; (ii) in receiving and preparing responses to complaints presented to consumer protection bodies; and (iii) in storing information for defense in judicial, administrative, or arbitral proceedings; • In pursuing the legitimate interest of the company and third parties, always within the limit of your expectation, and never to the detriment of your interests, rights, and fundamental freedoms, for example, (i) in building and evaluating customer profiles to offer personalized services compatible with your needs; (ii) in implementing and developing our services; (iii) in establishing statistics, tests, and evaluations for research and development, aiming at business risk management and evaluation, improvement and/or creation of new services; (iv) in case of complaints, when the company is mentioned on social networks or specific platforms, with the purpose of resolving the complained points, as well as adopting necessary measures to resolve the situation in the best possible way; (v) in using chatbot/automated customer or consumer service system; • For conducting activities aimed at preventing fraud; • For compliance with legal or regulatory obligations, such as, but not limited to: (i) resolutions; (ii) circulars; (iii) normative acts; (iv) communications and compliance with requirements from competent bodies; • Through authorization granted by you, such as in processes of (i) sending communication about own or third-party services; • Occasionally, we may send communications and satisfaction surveys as part of our customer feedback process. It is in our interest to obtain such opinions to ensure that our services/products are being provided at the highest level; • To improve the service offered, facilitate, expedite and fulfill commitments established between our clients and consumers, improve user experience and provide specific functionalities depending on the user's basic characteristics; • To understand how the user uses the services, to help in business and technical development; • To present personalized advertisements to the user based on the data provided; • To improve commercial and promotional initiatives, within the limits permitted by law, and provide personalized experiences for you; • Allow sending notifications regarding our services; • Share information with third parties and/or with other companies in our economic group as necessary to enable service provision and respecting the limits imposed by applicable legislation; and • If you visit our facilities, we may record your image through our monitoring system for security reasons. Personal information will eventually be collected to provide your access credentials, in order to maintain a safe work environment.

3. How long are Personal Data stored?

Your Personal Data is stored only for the time necessary to fulfill the purposes for which it was collected, unless there is any other reason for its maintenance such as, for example, compliance with any legal and/or regulatory obligations, among other needs, provided they are based on a Legal Base.

4. Personal Data Security

Total Express seeks to guarantee the Confidentiality, Integrity, and Availability of Personal Data of clients, partners, consumers, employees, through the adoption of technical and organizational measures of security best practices for protection against unauthorized access, destruction, loss, improper alteration, among them, the following: • Monitoring of physical and logical environments; • Data protection in technological environments that support Total Express operation; • Policies, training, and user awareness campaigns; • Access management to systems and physical environments, so that data access is performed for the execution of work activities; and • Security incident management.

5. Data sharing

We may share Personal Data with third parties or business partners that are relevant for the purpose of enabling the use of Platforms or enabling service provision. In general, sharing occurs based on the following criteria and for the purposes described below: • With our partners and suppliers: we may share Personal Data that we collect from the Platforms with partners and/or suppliers for the purpose of: (a) providing software, anti-fraud systems and/or customer management tools, (b) lead generation, customer prospecting and marketing action development, (c) providing logistics services for orders placed through the Platforms; (d) assistance in promotion management; (e) providing customer service. Our partners and suppliers are only authorized to use Personal Data for the specific purposes for which they were contracted, therefore, they will not use your Personal Data for other purposes beyond those of providing services contractually provided, as well as ensuring compliance with legal obligations. • To protect and safeguard rights: we reserve the right to access, read, preserve and provide any Personal Data and information, including your interactions, if necessary to comply with a legal obligation or court order; to enforce or apply other agreements and/or contracts; or protect our rights, property or safety, as well as those of our employees and/or clients. • Request from competent authority: we may share your Personal Data with third parties (including government bodies) in order to respond to investigations, judicial measures, legal proceedings or investigate, prevent or take measures regarding illegal activities, suspected fraud or situations involving potential threats to anyone's physical safety or if otherwise required by legislation. • New business: if we are involved in a merger, acquisition or sale of all or part of assets, Personal Data may be transferred to the acquiring company or person. In circumstances where the identity of the Personal Data Controller changes as a result of any transaction, we will notify of any choices that Data Subjects may have regarding their Personal Data.

6. International Transfer

Your Personal Data, when applicable, may be transferred to service providers in other countries, including cloud service providers, for the purposes provided in this Privacy Policy. Transferred Personal Data may be subject to the laws of jurisdictions where the service provider or its facilities are located. We use third-party services that seek to adopt adequate standards in privacy and Personal Data protection, including globally recognized certifications.

7. Your rights as a Personal Data Subject and how to exercise them?

Users are guaranteed the possibility to present requests, based on the following rights: • Access and confirmation of the existence of data Processing, such as requesting a copy of this data; • Update, correction of incomplete, inaccurate or outdated data; • Anonymization, blocking or elimination of unnecessary, excessive data or data processed in non-compliance with LGPD provisions. In this case, we will inform the correction and update to third parties with whom Personal Data has been shared; • Data portability, observing applicable standards and commercial and industrial secrets; • Information about public and private entities with which Shared Data Use has been performed; • Information about the possibility of not providing Consent and about the consequences of refusal; • Consent Revocation, which may be performed at any time and without cost, through express manifestation; • Request for elimination of Personal Data processed with Consent, except in cases where data maintenance is necessary or permitted by legislation; • Opposition to Processing performed based on other Legal Bases, other than Consent; • Request for review of decisions made solely based on automated Processing of Personal Data that affect your interests.

To exercise your rights regarding your Personal Data, you can contact us through the channel https://helloethics.com/totalexpress/lgpd/. We may request additional information to ensure the authenticity of your request and provide greater security for you.

We will make every effort to provide information as quickly as possible, in a transparent, intelligible and accessible manner, in clear and simple language.

We may maintain some Personal Data and/or continue to perform Processing, even in the case of requests for elimination, opposition, blocking or anonymization, in specific circumstances, such as for compliance with legal, contractual and regulatory obligations, to protect and exercise company, user and client rights, for prevention of illegal acts and in judicial, administrative and arbitral proceedings, including questioning by third parties about their activities and in other cases provided by law.

8. Cookies or navigation data

We use cookies to facilitate use and adapt the Platforms to the interests and needs of their users, as well as to assist and improve their structures and content. Cookies may also be used to accelerate the loading of specific parts of the Platforms or their activities, as well as personalize and improve future experiences in our services.

We use some types of cookies as described below: Necessary cookies: Cookies are essential to allow you to navigate correctly on the Platforms, as well as make use of all available functionalities. Advertising cookies: Cookies are used to provide more relevant content of user interest. They may be used to present advertising with greater targeting or limit the number of times it is displayed. In addition to allowing measurement of advertising campaign effectiveness. Statistical cookies: Cookies help us understand how visitors interact with the Platforms, providing information about visited areas, visit time and any problems encountered, such as error messages. Functional cookies: They remember user preferences and choices, avoiding the need for configuration and/or filling in information again on a new access.

At any time, the user may revoke their authorization regarding the use of cookies, using, for this purpose, the settings of their preferred browser. However, we warn that, according to the choice made, certain functionalities of our services may not work in the ideally expected manner.

If you wish to remove cookies installed on your computer, you can eliminate them manually through the settings available in your browser, using, for example, instructions from Chrome, Mozilla Firefox, Microsoft Edge or Safari.

9. Changes to this Privacy Policy

We reserve the right to modify this Privacy Policy at any time, so it is recommended that you review it frequently. Changes will take effect immediately after publication on the Platforms. By using the service or providing Personal Data after any modifications, the user and visitor demonstrates knowledge and agreement with the new provisions.

10. How to contact us about Personal Data?

If you believe that your Personal Data has been used in a manner incompatible with this Privacy Policy or with your choices as a Personal Data Subject, or if you have questions, comments or suggestions related to this Policy, contact us. We have a Data Protection Officer (DPO) who is available at the following contact addresses:

Exercise Data Subject rights: https://helloethics.com/totalexpress/lgpd/

Updated on: 09/05/2022