PRIVACY POLICY — PORTALBOX

This is an English translation of the Portuguese original; in case of conflict, the Portuguese version prevails.

Platform Controller (PortalBox): OPEN DIGITAL BRASIL INOVA SIMPLES (I.S.) | CNPJ: 50.748.071/0001-45 | Address: Rua Catanduva, nº 138, Loja 2, Chácara, Betim/MG, Brazil, ZIP 32670-334 Data Protection Officer (DPO): Matheus Breguez Rocha Vieira — matheus@beopendigital.com Version: 1.0 | Effective from: January 1, 2026

1. INTRODUCTION AND SCOPE

1.1. This Privacy Policy describes how PortalBox processes personal data within its container-management platform (SaaS), in compliance with Law No. 13,709/2018 (Brazilian General Data Protection Law — LGPD).

1.2. This Policy supplements the Terms of Use and Conditions. In the event of a conflict regarding the processing of personal data, this Policy prevails.

2. ROLES: WHO IS CONTROLLER AND WHO IS PROCESSOR

PortalBox acts in two distinct roles, depending on the type of data:

2.1. PortalBox as CONTROLLER. With respect to the data of the CUSTOMERS (subscribing companies) and their users — registration data, credentials, billing and platform access records — PortalBox decides on the processing and acts as Controller.

2.2. PortalBox as PROCESSOR. With respect to the personal data of third parties entered by the CUSTOMER on the platform — End Clients, drivers, contacts and others — the CUSTOMER is the Controller and PortalBox acts as Processor, processing such data only in accordance with the CUSTOMER's instructions and the purpose of providing the service.

2.3. Consequence for the data subject. If you are an End Client, driver or contact registered by a company that uses PortalBox, the Controller of your data is that company. Requests regarding such data must be addressed to it; PortalBox will provide the support incumbent on it as Processor.

3. PERSONAL DATA WE PROCESS

3.1. CUSTOMER and user registration data (PortalBox as Controller):

• Legal name, company name, CNPJ and state registration;
• Name and CPF of the person in charge;
• Phone and e-mail addresses (commercial and billing);
• Address;
• Access credentials (the password is set by the user and stored in protected form at the identity provider — it is not transmitted by e-mail).

3.2. Third-party data entered by the CUSTOMER (PortalBox as Processor):

• End Clients: name/contact, tax document (CPF/CNPJ and equivalents), phone, e-mail, address;
• Drivers: name, tax document, driver's license (CNH), phone, address, vehicle plates;
• Service contacts and suppliers/carriers: name, phone, e-mail.

3.3. Billing and payment data:

• Data necessary to process Subscription charges, handled by the payment gateways (see Section 6);
• Invoice history and payment status.

3.4. Technical and audit data (collected automatically):

• IP address and browser agent (user-agent);
• Records of acceptance of legal documents (date/time, IP, accepted version);
• Operation audit trail (user identification, action, date/time);
• Technical records (logs) and platform operation and observability metrics.

3.5. The platform is not intended for the collection of sensitive personal data or data of children and adolescents. The CUSTOMER must not enter such categories without an adequate legal basis.

4. PURPOSES AND LEGAL BASES FOR PROCESSING

4.1. Where processing relies on consent, it may be withdrawn at any time, without prejudice to the processing already carried out.

5. HOW WE COLLECT DATA

5.1. Provided directly: upon CUSTOMER registration and platform use by users.

5.2. Entered by the CUSTOMER: data of End Clients, drivers and contacts, under the CUSTOMER's responsibility as to the legal basis.

5.3. Collected automatically: technical data, IP, logs, acceptance and audit records, generated by interaction with the platform.

6. SHARING AND PROCESSORS (SUB-PROCESSORS)

6.1. PortalBox shares data, to the extent necessary for operation, with third-party suppliers and services acting as processors/sub-processors, including:

• Identity/authentication provider — account, credential and access-control management;
• Cloud provider — storage of files, documents and secrets;
• Financial institution and payment gateways — processing of Subscription charges and issuance of bank slips (they receive data such as document/CNPJ and billing information);
• Document-generation service — production of invoices and platform documents;
• CRM/marketing service — when the CUSTOMER enables the corresponding features;
• E-mail delivery provider — transactional communications.

6.2. PortalBox requires adequate levels of data protection from its processors and does not sell personal data.

6.3. Data may be shared with competent authorities when required by law, court order or for the regular exercise of rights.

7. INTERNATIONAL DATA TRANSFER

7.1. The platform's infrastructure is hosted on Amazon Web Services (AWS), in the us-east-1 region (United States of America). Consequently, the personal data processed on the platform — including that of data subjects located in Brazil — is stored and processed in the United States. This covers the database, files and documents (Amazon S3), secrets and credentials (AWS Secrets Manager), and the hosting of the application and the identity provider.

7.2. In addition to the AWS infrastructure, an international transfer may occur in the processing of subscription payments of foreign tenants, carried out by Stripe (United States). Payment processing for Brazilian tenants is carried out by AbacatePay (Brazil), and CRM/marketing by RD Station (Brazil), with no international transfer in those cases.

7.3. For such international transfers, PortalBox adopts the safeguards required by Arts. 33 to 36 of the LGPD, such as contractual clauses and data protection commitments with providers.

8. INFORMATION SECURITY

8.1. PortalBox adopts technical and administrative measures to protect personal data, including:

• Logical isolation between the environments of different CUSTOMERS, so that one's data is not accessible by another;
• Segregation and protected storage of credentials and secrets;
• Protected communication with financial institutions;
• Operation audit trail;
• Role-based access control (permissions).

8.2. No system is entirely immune to risks. In the event of a relevant security incident, PortalBox will notify those affected and the National Data Protection Authority (ANPD) where applicable, under the terms of the LGPD.

9. DATA RETENTION AND DELETION

9.1. Data is retained for the time necessary for the purposes of this Policy and for compliance with legal and regulatory obligations.

9.2. Once the relationship with the CUSTOMER ends, business data is subject to logical deletion, ceasing to be accessible through the platform.

9.3. Billing, audit and consent records may be retained for the period necessary to comply with legal obligations and for the regular exercise of rights.

9.4. Portability and export. The right to portability provided for in Art. 18, V, of the LGPD applies to the data subject's personal data, upon express request, subject to trade and industrial secrets and to ANPD regulation. The platform does not, at this time, provide an automated export/portability feature; requests are handled manually, through the channels indicated in Section 12, within up to 15 (fifteen) days, extendable upon justification due to the complexity or volume of the request, with the personal data provided in a structured, commonly used format. Requests regarding data of End Clients, drivers and other third parties must be addressed to the CUSTOMER, in its capacity as Controller (Section 2).

10. DATA SUBJECTS' RIGHTS

10.1. Under Art. 18 of the LGPD, the data subject may request: confirmation of the existence of processing; access to the data; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary data or data processed in noncompliance; portability; information about sharing; and withdrawal of consent.

10.2. Where to address the request:

• If your data was entered by a CUSTOMER company (you are an End Client, driver or contact), the Controller is that company — address the request to it. PortalBox, as Processor, will provide the support incumbent on it.
• If you are a CUSTOMER or a platform user, address the request directly to PortalBox through the channels in Section 12.

10.3. PortalBox may take measures to confirm the requester's identity before fulfilling the request.

11. COOKIES AND TRACKING TECHNOLOGIES

11.1. The platform does not use cookies for advertising, tracking or behavior analysis (analytics). Authentication is performed by means of tokens (JWT), not cookies. Should strictly necessary functional cookies be used in the future, this Policy will be updated and, where required, the data subject's consent will be requested.

12. CONTACT CHANNEL AND DATA PROTECTION OFFICER (DPO)

12.1. Questions, requests and demands relating to this Policy and to data processing may be sent to the Data Protection Officer:

• DPO: Matheus Breguez Rocha Vieira
• E-mail: matheus@beopendigital.com
• Address: Rua Catanduva, nº 138, Loja 2, Chácara, Betim/MG, Brazil, ZIP 32670-334

13. CHANGES TO THIS POLICY

13.1. This Policy may be updated at any time. Versions are identified and dated, and acceptance may be requested again when there is a relevant change. Continued use of the platform after a new version takes effect implies awareness of its content.

14. GOVERNING LAW AND JURISDICTION

14.1. This Policy is governed by Brazilian law, electing the courts of the district of Betim/MG, Brazil to settle any questions arising from it.