Privacy Policy

NATEN SAS (trading as “nocnoc”), a foreign company based at Av. Dr. Luis Alberto de Herrera, 1248, World Trade Center, Montevideo, Uruguay, is committed to respecting your privacy and ensuring that all information and data from its Users are always secure. This is fundamental to ensuring the provision of services with transparency, security, and peace of mind.

For this reason, nocnoc has created this Privacy Policy (“Policy”) through which you can better understand what data is collected, why it is collected, how it is protected, how it is shared and processed, as well as understand the rights and guarantees regarding your personal data and ultimately decide whether or not to effectively use the services provided by nocnoc.

Please read this information carefully because, by requesting nocnoc’s services through Partners, you will be freely and expressly agreeing to its terms, and if you have any doubts or concerns, nocnoc is available to assist you in the best way possible.

It is important to clarify that the decision to share data or even the limits and period of sharing this data will always be yours. However, if the decision to share data or part of this data with nocnoc is not your desire, especially when it is necessary for the provision of services by nocnoc, you may choose not to use the services offered.

DEFINITIONS

For the purposes of this Policy, the terms and words below shall have the following meanings:

Database: set of personal data, stored in one or more locations, through physical or electronic means.

Consent: free, informed and unequivocal expression by which the data subject agrees to the processing of his/her personal data for a specific purpose.

Personal data: information related to a natural person, directly or indirectly, identified or identifiable, such as name, address, phone and email.

Anonymized data: data that cannot be identified.

LGPD: General Data Protection Law – Law 13,709/2018, which regulates the processing of personal data, in physical and digital means, so that the fundamental rights of freedom, privacy and free development of personality are protected, thus ensuring more transparency and control by their owners.

Controller: natural or legal person, public or private, to whom decisions regarding the processing of personal data are attributed.

Operator: natural or legal person, public or private, who processes personal data on behalf of the controller.

Data subject: natural person to whom the data refers.

Users: personal data subjects who use or in some way relate to nocnoc and/or the services provided by nocnoc and share their data.

Partners: retailers who sell products intermediated by nocnoc.

Platform: website made available through Partners of nocnoc for the sale of products, including both e-commerce and marketplace, as well as their respective applications.

Suppliers: manufacturers of products that are sold by Partners, through the intermediation of nocnoc.

Processing of personal data: any and all operations performed with personal data such as: collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, elimination, evaluation, control, modification, communication, transfer.

Anonymization: process by which the data loses the possibility of direct or indirect association with an individual, considering the reasonable and available technical means at the time of processing.

PRINCIPLES GOVERNING THE PRIVACY POLICY

nocnoc shall observe good faith and the following principles, among others, in the activities of processing personal data:

1. a) Purpose: the processing of data must aim at a legitimate, specific, and explicit purpose.
2. b) Adequacy: there must be a causal link between the processing of data and the intended purpose.
3. c) Necessity: access to data and the processing intended for them must be restricted to the minimum necessary to achieve their purpose.
4. d) Free access: guarantee to data subjects of easy and free consultation on the form and duration of processing, as well as on the integrity of their personal data;
5. e) Security: use of technical and administrative measures by nocnoc capable of protecting personal data from unauthorized access and accidental or unlawful situations of destruction, loss, alteration, communication, or dissemination.
6. f) Transparency: guarantee to data subjects of clear, precise, and easily accessible information about the processing and the respective processing agents, respecting commercial and industrial secrets.
7. g) Prevention: adoption of measures to prevent the occurrence of harm due to the processing of personal data.
8. h) Non-discrimination: data must be used in a way that does not allow for any discriminatory or abusive act.

nocnoc COMMITMENTS AND USER RIGHTS AND GUARANTEES PROVIDED BY LGPD

As provided for in the LGPD, nocnoc is committed to guaranteeing the following rights to its Users:

1. a) Confirmation of the existence of processing;
2. b) Access to data;
3. c) Correction of incomplete, inaccurate or outdated data;
4. d) Anonymization, blocking or elimination of unnecessary, excessive or data processed in breach of LGPD provisions;
5. e) Data portability to another service or product provider, upon express request of the User, in accordance with the regulation of the national authority;
6. f) Elimination of personal data processed with the consent of the data subject, except in the cases provided for in article 16 of the LGPD;
7. g) Information on public and private entities with which it shared data;
8. h) Information on the possibility of not providing consent and on the consequences of refusal;
9. i) Revocation of consent, under the terms of § 5 of article 8 of the LGPD.

WHICH PERSONAL DATA CAN BE COLLECTED

The collected data will be exclusively necessary for the excellence of nocnoc’s service provision, aiming to ensure that the products acquired by Users through Partners are duly delivered by Suppliers.

The personal data collected and processed are: full name, CPF, cell phone number with DDD, email address, and delivery address for the products (type of residence, street address, ZIP code, neighborhood, municipality, and state).

All collected data will be used exclusively for the intended and declared purposes, excluding the collection and processing of data that do not serve this purpose.

WHY DATA IS COLLECTED AND PURPOSES

The collection and processing of data serve for nocnoc to provide Users with intermediary services for the commercialization of products from different Suppliers through the Partners Platform.

The data will be used and processed exclusively to guarantee excellence in service provision and for the contracted purposes and/or for compliance with legal or regulatory obligations.

For a better understanding of the data involved and the purposes of the collection, see the summary table:

Description	Purposes
Personal data	Full name, CPF (Brazilian identification number), phone number with area code, email address, address for product delivery (residence type, street address, ZIP code, neighborhood, city, and state).	Registration purposes: necessary for the registration on the Partner Platform to be possible, as well as for the services to be executed.

HOW DATA IS COLLECTED AND PROCESSED

The personal data of Users will be collected and processed with the consent of the Users themselves, given on the Partners’ Platforms, so that nocnoc respects not only the LGPD, but also the limits of the Privacy Policies of its Partners. The initial consent and collection will be given through the Partners’ Platforms, either through an application or through the website, directly or by legal representatives, through written or other means that demonstrate the expression of will. nocnoc’s collection will be made through the sharing, by the Partners, of the Users’ data provided by them when using the Platform and purchasing products from different Suppliers marketed with nocnoc’s intermediation. In the case of companies and legal entities in general, the obtaining of this data must be done in accordance with the Privacy Policy of each legal entity.

USE AND SHARING OF DATA

Personal Data Description Purpose

Full name, CPF, mobile phone number with DDD code, email address, product delivery address (type of residence, street, zip code, neighborhood, city, and state).

Registration purposes: Necessary for the registration on the Partner’s Platform to be possible, as well as for the services to be executed.

A summary table of the external recipient groups that nocnoc may share the collected personal data with, always respecting the applicable legislation, follows.

Group of Recipients	Purpose
Suppliers and Companies related to the operation	For the products to be delivered to the address indicated by the Users, for services to be executed and for the amounts of services to be received by nocnoc
Marketing Operations	For operationalized marketing operations by nocnoc or third parties hired so that it is possible to maintain the sending of advertisements and offers to the User
Information Security and Anti-Fraud Service Company	To ensure the security of your information
Compliance with the law and data protection authorities	(i) For compliance with legal determination, request, requisition, or court order, with competent judicial, administrative, or government authorities; (ii) For the legitimate interest of nocnoc, or that of third parties, in matters of national security, law enforcement, litigation, criminal investigation, fraud prevention, protection of the safety of any person, or to prevent imminent death or physical harm, provided that we consider that such interest does not prevail over the interests or fundamental rights and freedoms of the User that require the protection of the User’s personal data
nocnoc Group Companies (including subsidiaries and controlled)	To centralize business indicators developed by nocnoc and improve the provision of services as a whole and offer Users the best business opportunities
Societary Transactions and Changes	For the continuity of services and product deliveries in the event of the sale of our business to a buyer or potential buyer

PERSONAL DATA OF CHILDREN AND ADOLESCENTS

Recipient Group Purpose

Suppliers and Companies related to operation To deliver Products to the address indicated by Users, services are executed, and service fees are received by nocnoc.

Marketing Operations For marketing operations carried out by nocnoc or third parties contracted to maintain the sending of advertisements and offers to the User.

Information Security and Anti-Fraud Service Company To ensure the security of their information.

Compliance with the law and data protection authorities

(i) For compliance with legal determination, request, requisition, or court order, with competent judicial, administrative, or government authorities;

(ii) For nocnoc’s legitimate interest or that of third parties, in matters of national security, law enforcement, litigation, criminal investigation, fraud prevention, protection of anyone’s security, or to prevent imminent death or physical harm, provided that we consider that such interest does not prevail over the User’s interests or fundamental rights and freedoms requiring the protection of the User’s personal data.

nocnoc Group Companies (including subsidiaries and controlled companies) To centralize the indicators of the businesses developed by nocnoc and improve the provision of services as a whole and offer Users the best business opportunities.

Transactions and Societary Changes For the continuity of services and product deliveries in the event of the sale of our business to a buyer or potential buyer.

The Partner Platform is not intended for persons under 18 years of age, according to their respective Terms and Conditions of Use made available to them. Thus, nocnoc does not deliberately collect or process personal data from children and adolescents. If the User is under 18 years of age, they should not use the Partner Platform. In the event that nocnoc becomes aware that personal data of a child or adolescent has been shared and collected, measures will be taken for their elimination, including the immediate interruption of services provided.

CHANGE IN THE PURPOSE OF CONSENT

If changes occur in the purpose for the processing of personal data that are not compatible with the original consent obtained on the Partner Platform, nocnoc must inform the User and/or their representative about the changes in purpose, and the User and/or legal representative may revoke the consent in whole or in part.

STORAGE AND ELIMINATION OF DATA

The personal data of Users will be stored as long as necessary for the effective provision of nocnoc services or for compliance with legal and business obligations, dispute resolution, and must be eliminated at the end of the processing period. Consent may be revoked at any time by express manifestation of the User or their legal representative. The request for elimination must be express and unequivocal. It is important to note that partial or total revocation of consent and request for data deletion may result in the immediate interruption of services provided. However, data may need to be kept for a longer period for legal reasons, court orders, fraud prevention (Art. 11, II, “a” of the General Data Protection Law “LGPD”, Law No. 13.709/2018), credit protection (Art. 7, X, LGPD), and other legitimate interests, in accordance with article 10 of the LGPD. Once the legal need has ended, the data will be deleted using secure disposal methods or used anonymously for statistical purposes

DATA PRIVACY AND SECURITY

nocnoc employs appropriate storage security practices in all of its systems and infrastructure, including physical and digital security measures aimed at ensuring the protection of your information.

Our users’ personal data will be treated with the rigor required by law and with nocnoc’s ethical and moral principles. The measures adopted include access controls, strong encryption, SSL implementation, firewalls, change log registration, among other mechanisms and protocols.

Access to personal data storage locations is only provided to individuals previously authorized by nocnoc, committed to keeping such data confidential, including through the signing of a confidentiality agreement. Such individuals hold individualized access passwords capable of identifying the data controller.

The collected data will be stored on servers located in Uruguay, as well as in an environment of resource use or cloud servers, which may result in data transfer or processing outside of Brazil, at nocnoc’s exclusive discretion.

Considering that no security system is infallible, nocnoc is released from any responsibility for any damages and/or losses resulting from failures, viruses or database invasions, caused by the user’s exclusive fault or third parties. However, nocnoc is committed to always seeking innovations in the protection of its users’ data.

Any problems with data storage and/or other situations that jeopardize the privacy of users’ data will be immediately communicated, and competent measures will be taken to minimize the damage to the minimum possible.

INTERNATIONAL TRANSFER

nocnoc is based in Uruguay, but our suppliers, partners, and other group companies (“International Third Parties”) may be based in Brazil or other countries besides Brazil, so the processing of personal data may be carried out both in Brazil and abroad.

In this case, we guarantee that International Third Parties will also be subject to the obligations of this Policy, as well as to legal instruments that ensure compliance with legal obligations.

By accepting this Policy, the User agrees that their personal data may be transferred to International Third Parties and declares themselves aware of all applicable guarantees for processing abroad, as established in this Policy.

CHANGES TO THE PRIVACY POLICY

nocnoc will have the right, at any time and at its sole discretion, to modify, change, add or remove any guideline or clause contained in this Policy, without prior notice to Users.

Any changes will be duly informed in a clear and visible manner on the nocnoc website (https://nocnocstore.com, and the date of the last update to the Policy will always be indicated, and it is up to the User to carefully review it whenever they use nocnoc services.

The User understands and agrees that once the changes to this Privacy Policy are published, acceptance and use of it will be automatically subject to it.

In the event of significant updates to this document that require new consent collection, they will be notified through the contacts provided in the registration.

DOUBTS AND CONTACT nocnoc

Questions, suggestions, complaints, requests, and reports can be made through the nocnoc channel identified below:

[email protected]

FINAL PROVISIONS

If any provision of this Privacy Policy is deemed illegal, void, or unenforceable for any reason, the other conditions will remain in full force and effect.

The User acknowledges that all communications made by e-mail (to the addresses provided in their registration on the Partner Platforms), SMS, instant messaging applications, or any other digital, virtual, and digital form are also valid, effective, and sufficient for the disclosure of any matter relating to the services provided, as well as the conditions of their provision or any other matter addressed herein, except as expressly provided otherwise in this Privacy Policy.