Policies

Imagem exibe moça executiva com tablet na mão

Updated August 2026
Updated on October 20, 2023
Updated on October 20, 2023

Privacy Notice

Locaweb SA (“LWSA” or “we”) takes privacy seriously. For this reason, in this Privacy Notice (“Notice”) we explain how we use, store, share and protect the personal data collected through the use of our services and solutions (collectively, the “Services”) and visits to our websites, as well as how data subjects can exercise the rights provided for under applicable legislation.

Specific Privacy Notices may apply to some of our products and services. For more information about our privacy practices relating to a specific product or service, please visit that product's or service's webpage.

This Notice does not replace the Terms of Use and Conditions of each LWSA product, platform or application, which specifically govern the obligations, responsibilities and procedures of the contractual relationship between the User/Client and the respective contracted product or service.

1. Who we are

LWSA, as a corporate group, offers a complete portfolio of comprehensive and modular digital solutions for businesses of all sizes and maturity levels. Operating on several fronts, such as Commerce SMB, Commerce Enterprise, BeOnline and SaaS, ERP Management and Financial Services, which include website hosting, cloud computing solutions, online stores, e-mail marketing tools, payment intermediation, among others. Learn more about our services here: www.lwsa.tech

LWSA includes the following companies/business units: Bagy, Bling, CPlug, Delivery Direto, KingHost, Locaweb, Melhor Envio, Octadesk, Wake Commerce, Wake Experience, Tray, Vindi, and any other affiliated or controlled companies.

The LWSA company corresponding to the company or business unit with which you have contracted or interacted may act as processor or controller of your personal data, depending on whether it determines, or merely carries out, the purposes and means of processing your personal data.

2. Who the Data Subjects are

The personal data we collect depend on the context of your interactions with LWSA. To facilitate your understanding, Data Subjects may include:

Clients (and their representatives, agents and employees): professional identification and contact data; registration and tax data; account credentials; financial, payment and billing data; support and assistance, including phone recordings; device, log and browsing data; credit data; interaction with AI Technologies.
Clients' Consumers: identification and contact data received from the Client; payment and transaction data; device, log and browsing data on the Client's channels; data from public sources and credit bureaus; profile and interaction with campaigns.
Users of websites and channels: professional identification and contact data; field of activity and interests; content of communications; device, log and browsing data; non-necessary cookies; marketing preferences; interaction with AI Technologies.
Partners and suppliers (and their representatives): professional identification and contact data; registration, tax and banking data; compliance and integrity data.
Investors and their representatives: identification and contact data; registration data and securities ownership data.
Job applicants: identification and contact data; resume data, education, experience and assessment results.

Important definitions

a) General Data Protection Law (LGPD). Federal Law No. 13,709, published on August 14, 2018, which regulates Personal Data Processing activities, including in digital media, carried out by an individual or legal entity governed by public or private law, with the purpose of protecting the fundamental rights of freedom and privacy and the free development of an individual's personality;
b) Processing Agents: those responsible for Personal Data Processing, divided into two categories: the Controller and the Processor. The Controller is the person or company responsible for decisions regarding Personal Data Processing. The Processor, in turn, is the person or company that processes Personal Data on behalf of the Controller, following its instructions;
c) ANPD: the National Data Protection Authority, the body responsible for overseeing, implementing and enforcing compliance with the LGPD in Brazil;
d) Anonymization: the use of reasonable technical means available at the time of Processing through which data loses the possibility of being associated, directly or indirectly, with an individual;
e) Legal Basis: the authorizing hypothesis provided for in articles 7 and 11 of the LGPD that underlies each Processing operation carried out by LWSA;
f) Personal Data: information related to an identified or identifiable individual;
g) Sensitive Personal Data: personal data concerning racial or ethnic origin, religious belief, political opinion, membership in a trade union or religious, philosophical or political organization, data concerning health or sex life, or genetic or biometric data, when linked to an individual;
h) Data Protection Officer: the person or entity appointed by LWSA to act as a communication channel between LWSA, Data Subjects and the National Data Protection Authority, pursuant to article 41 of the LGPD;
i) Deletion: the removal of data or a set of data stored in a database, regardless of the procedure used;
j) Processing: any operation carried out with Personal Data, whether automated or not, i.e., the collection, production, receipt, classification, use, access, reproduction, transmission, distribution, processing, storage, filing, deletion, evaluation or control of information, modification, communication, transfer, dissemination or extraction;
k) Artificial Intelligence (AI) Technologies: systems, models or computational tools capable of processing natural language, generating responses, executing commands or automating tasks based on instructions provided by a user (“prompts”), including virtual assistants, chatbots, large language models (“LLMs”) and automated integrations made available on LWSA's platforms;
l) Data Subject: the individual to whom the Personal Data being processed relates, including Clients (and their representatives, agents and employees), Consumers and Users;
m) Sub-processor: a third party engaged by LWSA to carry out Personal Data Processing on its behalf and under its instructions, including cloud infrastructure providers and AI Technology providers;
n) Group Companies: LWSA and the companies, Business Units, subsidiaries and affiliates listed in item 1 of this Notice, considered individually or jointly.

3. How we obtain personal data

We obtain personal data from four sources:

a. Data you provide to us: when you contract, use or interact with the Services, visit our websites, participate in surveys, subscribe to newsletters, download informational content, apply for a job opening, or communicate with us in any way;
b. Data we collect automatically: when you access, contract or use the Services and our websites, through our systems, access logs, and the tracking technologies described in item 3.1 below;
c. Data we receive from our Clients: when a Client uses the Services to process data of its own consumers. In these cases, LWSA generally acts as Processor, following the Client's instructions, and the Client remains the Controller of the data;
d. Data we obtain from other sources: public databases, public social media profiles, credit protection entities and partners, particularly in payment intermediation and credit analysis operations.

LWSA does not intentionally request or collect sensitive personal data for the purposes of this Notice. Should the processing of sensitive personal data be necessary, it will occur exclusively based on one of the hypotheses of article 11 of the LGPD, and you will be informed at the time of collection.

The Services are not directed at children and adolescents. LWSA does not intentionally collect personal data from individuals under 18 years of age and, when the processing of a child's data is essential, will observe the specific and prominent consent of a parent or legal guardian, pursuant to article 14 of the LGPD.

The Data Subject is responsible for the content submitted in interactions with Artificial Intelligence Technologies and must avoid providing sensitive personal data or third-party data without an adequate legal basis or authorization.

3.1 Cookies and tracking technologies

We and our partners may use various technologies to automatically collect and store data about the use of the Services. These technologies include cookies, pixels, web beacons and SDKs. We use the information collected through these technologies to optimize and customize your browsing experience, target advertising campaigns, develop and apply security features and fraud prevention procedures, among other possible uses. For more information, please see our Cookies Policy, available on our website at: https://lwsa.tech/politicas/

We use these technologies for the following reasons: (i) necessary cookies, essential for the operation, authentication, load balancing and security of the Services; (ii) performance and analytics cookies, which allow us to measure audience, identify errors and improve browsing; (iii) functional cookies, which store language, region and session preferences; and (iv) advertising and marketing cookies, which allow us to measure campaigns and present relevant ads on our channels and on third-party channels.

Necessary cookies are used based on the performance of the contract and LWSA's legitimate interest (article 7, items V and IX, of the LGPD). Performance, functional and advertising cookies depend on your consent (article 7, item I, of the LGPD), collected through the banner displayed on first access to our websites.

You may grant, review or withdraw your consent at any time in the cookie preference panel available on our websites, as well as block or delete cookies in your browser settings. Refusing non-necessary cookies does not prevent access to the Services but may limit certain features and customizations.

Each cookie has its own retention period, as informed in our Cookie Notice, with session cookies being deleted when browsing ends.

4. Why and how we process personal data

We process personal data for determined purposes and always based on one of the legal bases of the LGPD, indicated below. The purposes and legal bases listed in this section apply to cases in which LWSA acts as Controller. When LWSA acts as Processor — which generally occurs in Services contracted by Clients to process data of their own consumers, as described in item 3, letter (c) — the purpose and legal basis of the processing are defined by the Client, as Controller.

The same company may act as Controller or as Processor, depending on the activity. We act as Controllers of the Personal Data we process for our own purposes, such as the direct contractual relationship with end Clients, billing, support, information security, marketing and compliance with legal and regulatory obligations. We act as Processors of the Personal Data that our Clients enter or process through the Services, including data of their own consumers, in which case we follow our Client's instructions, and the Client remains the Controller.

The purposes below apply to all Data Subjects, unless otherwise indicated:

a. Perform the contract and provide the Services: create and manage accounts, verify your identity, process transactions, and provide, customize and improve the Services and our websites. Legal basis: performance of a contract or preliminary procedures related to a contract (article 7, V, of the LGPD);
b. Billing and invoicing: charge amounts owed, issue tax documents, and proceed with payment orders in intermediation operations. Legal basis: performance of a contract (article 7, V) and compliance with a legal or regulatory obligation (article 7, II, of the LGPD);
c. Support and technical assistance: record and resolve support tickets, provide support and document the assistance provided. Legal basis: performance of a contract (article 7, V) and legitimate interest (article 7, IX, of the LGPD);
d. Operational communications: notify you of changes to our products, services and this Notice. Legal basis: performance of a contract (article 7, V) and compliance with a legal or regulatory obligation (article 7, II, of the LGPD);
e. Information security and fraud prevention: reinforce security controls, detect, prevent and remedy fraud and illegal activities, investigate violations of policies, contracts or terms of use, and retain access logs. Legal basis: legitimate interest (article 7, IX) and compliance with legal obligations, including the Brazilian Internet Civil Framework (article 7, II, of the LGPD);
f. Internal operations and improvement: troubleshooting, testing, research, data analysis and statistics, using anonymized data whenever possible. Legal basis: legitimate interest (article 7, IX, of the LGPD);
g. Marketing and recommendations: send communications and recommend LWSA products or services according to your preferences, ensuring you may unsubscribe at any time. Legal basis: consent (article 7, I) or, in the case of products similar to those you have already contracted, legitimate interest (article 7, IX, of the LGPD);
h. Advertising and campaign measurement: assess the effectiveness of the advertising we run and present relevant ads, including through cookies. Legal basis: consent, when dependent on non-necessary cookies (article 7, I), or legitimate interest (article 7, IX, of the LGPD);
i. Credit analysis, offering and management: assess and reduce credit risk, offer credit, and consult and record information with credit bureaus and the Central Bank's Credit Information System (SCR). Legal basis: credit protection (article 7, X) and consent, when required (article 7, I, of the LGPD);
j. Artificial Intelligence features: make available, operate, monitor and improve AI Technologies integrated into the Services, including processing prompts, commands and context data necessary to generate the requested response. Submitted content is not used to train third-party public or commercial AI models. Legal basis: performance of a contract (article 7, V) and legitimate interest (article 7, IX, of the LGPD);
k. Integration between LWSA products and services used by you. Legal basis: performance of a contract (article 7, V) and legitimate interest (article 7, IX, of the LGPD);
l. Marketing strategies for our Clients (applicable to Consumers): support our Clients in offering relevant advertising to their consumers. Legal basis: the Client's instructions (as Controller) or, when LWSA acts as Controller, consent (article 7, I) or legitimate interest (article 7, IX, of the LGPD);
m. Recruitment processes (applicable to job applicants): conduct selection processes, assess fit for the position, and build a talent pool. Legal basis: preliminary procedures related to a contract (article 7, V) and consent for the talent pool (article 7, I, of the LGPD);
n. Management of partners, suppliers and investors: contracting and contract management, payments, integrity due diligence, and compliance with corporate and regulatory obligations. Legal basis: performance of a contract (article 7, V), compliance with a legal or regulatory obligation (article 7, II), and legitimate interest (article 7, IX, of the LGPD);
o. Exercise and defense of rights: establish, exercise and defend rights in judicial, administrative or arbitration proceedings. Legal basis: regular exercise of rights (article 7, VI, of the LGPD);
p. Compliance with legal and regulatory obligations and response to requests from competent judicial, administrative or regulatory authorities. Legal basis: compliance with a legal or regulatory obligation (article 7, II, of the LGPD);
q. Other purposes, in which case we will provide specific notice at the time of collection, indicating the applicable legal basis, or otherwise, as authorized or required by law.

When processing is based on legitimate interest, LWSA previously assesses the legitimacy of the purpose, the necessity of the processing, and the balance between that interest and your fundamental rights and freedoms, adopting measures to mitigate any impact. You may object to such processing through the channels indicated in the section on Data Subjects' rights.

5. How we share personal data

We may share the personal data collected with other LWSA companies, third parties and business partners, as relevant to enable the provision and integration of the Services. Such sharing is based on the following criteria and for the purposes described below.

LWSA Companies: may share personal data collected in connection with the provision of the Services among themselves in order to operate, perform, improve and integrate our services and products regarding sales, deliveries, payments and credit. Likewise, to understand, customize, support and advertise our Products and Services, as well as to prevent fraud;
Third-party service providers: We work with third-party service providers who help us operate, perform, improve, understand, customize, support and advertise our Services. When we share data with third-party service providers, we require them to use such data in accordance with our instructions and terms or with your express consent, when applicable;
Credit Protection Entities: We may share your collected data with partner companies, financial institutions and payment institutions that have an agreement with LWSA (or any company of the Economic Group), for purposes of analysis, credit risk reduction, fraud prevention and credit offers. Accordingly, you grant express authorization, which may be revoked or withdrawn at any time under applicable law and regulations, for the data collected by LWSA and shared with partners, financial institutions, payment institutions and their affiliated companies to be used in accordance with applicable regulations and article 7, items I, II and X of the LGPD, to:
(i) access your Receivables Schedule with Registry Entities, including with other payment institutions or financial institutions that provide accreditation services, in order to identify receivables units not subject to liens, encumbrances or assignment restrictions of any nature;
(ii) consult your information and that of your partners arising from credit transactions, including records of legal proceedings, with agencies that provide credit assessment services, credit bureaus or related systems, including, but not limited to, the Central Bank of Brazil's Credit Information System (SCR), or systems that may complement or replace it; and
(iii) record data on any credit transaction in the SCR (or in a system that may replace or complement it).
Regulatory bodies, judicial or administrative authorities: we may share your personal information to provide competent authorities with all information requested regarding the Data Subject and the transactions carried out by them. In addition, we may share your personal data with public authorities or private entities to combat fraud and abuse in the use of the Services, to investigate suspected violations of the law, or to address any other suspected non-compliance with our Notices and agreements;
Transfer of Assets: Should an LWSA company be reorganized or sold, and all or substantially all of its assets transferred to a new owner, your personal information may be transferred to the buyer regardless of your authorization, in order to ensure the continuity of services;
With your authorization: In other cases not provided for above, where there is an intention to share personal data and information, we will send you a notice with information about such sharing to request your consent for the specific purpose;
Third parties who question the manner of use or content published in our contracted products and/or services: In order to enable and comply with free enterprise, free competition and the defense of users' interests in commercial relations, we may share your name, address, corporate or individual taxpayer ID (CNPJ or CPF) and e-mail address, in the event of questions raised by consumers, clients and/or users regarding the manner and content published in our products and/or services;
Native Artificial Intelligence Providers (Sub-processors): when using native AI assistants and automations on our platforms, LWSA uses Large Language Model (LLM) providers as data sub-processors. LWSA's architecture performs dynamic, automated routing of the request to the appropriate provider. All of our AI sub-processors operate under a contractual Zero Data Retention obligation and are expressly prohibited from storing, retaining or using our Clients' data to train or improve their public or commercial AI models;
External Connections and Context Protocol (MCP Server): should the Client choose to use connectors based on the MCP (Model Context Protocol) or similar APIs to connect its account to external AI assistants (e.g., Anthropic Claude, ChatGPT):

a) The activation of the MCP Server and the provision of credentials constitute a direct, express and documented instruction from the Client (Controller) for the transmission of the selected data to the third-party platform.

b) Third-party AIs integrated by the Client via MCP are not LWSA sub-processors. The processing of data within the third-party AI's environment is the sole responsibility of the Client and the respective provider.

6. International transfer of Personal Data

To enable the provision of our services, including cloud hosting, request processing by AI sub-processors, and integrations enabled via the MCP protocol, personal data may be transferred to and processed outside Brazil (notably in the United States), in accordance with the mechanisms provided for in article 33 of the LGPD and ANPD Resolution No. 19/2024.

International transfers carried out by LWSA observe, as applicable: (i) transfer to a country or international organization that provides an adequate level of data protection, as recognized by the ANPD (article 33, I, of the LGPD); (ii) the provision and demonstration of guarantees by LWSA, through specific contractual clauses, standard contractual clauses approved by the ANPD, global corporate rules, or seals, certifications and codes of conduct regularly issued (article 33, II, of the LGPD, and ANPD Resolution No. 19/2024); or (iii) the other hypotheses of article 33 of the LGPD, notably the necessity for the performance of a contract, compliance with a legal or regulatory obligation, the regular exercise of rights, and the Data Subject's specific and prominent consent.

Regardless of the destination country, we require our Sub-processors to provide contractual guarantees of confidentiality, information security, purpose limitation, assistance in responding to Data Subjects' requests, incident notification, and restrictions on further subcontracting, in accordance with applicable legal and regulatory standards.

7. Interactions with other third-party websites

We may provide links to other websites on the Internet.

LWSA IS NOT RESPONSIBLE FOR THESE WEBSITES AND THEIR CONTENT. FURTHERMORE, WE DO NOT SHARE, ENDORSE, MONITOR, VALIDATE OR ACCEPT THE WAY IN WHICH THESE WEBSITES OR CONTENT STORAGE TOOLS COLLECT, PROCESS AND TRANSFER YOUR PERSONAL AND PRIVATE INFORMATION.

We recommend that you review the respective privacy notices of such websites to be properly informed about the use of your personal information by other websites or tools.

We may record your access to third-party websites in order to measure the relevance of those websites to our users.

8. Security measures

Personal Data processed by LWSA are protected by physical, technical and organizational security measures to reduce the risk of loss, misuse and unauthorized access, disclosure and alteration, such as firewalls and data encryption, physical access controls at data centers, and controls over authorization to access information.

How we store your personal data: personal data is stored in cloud computing environments and data centers contracted by LWSA, located in Brazil and abroad, under the responsibility of providers acting as Sub-processors, which are subject to contractual confidentiality and information security obligations.

Measures adopted include: data encryption; environment segregation; access control based on the principle of least privilege; multi-factor authentication for administrative access; log recording and monitoring; backup routines; vulnerability management and security testing; and periodic training of our employees on privacy and information security.

Access to personal data is restricted to employees and service providers who need to use it for the purposes described in this Notice, always subject to a duty of confidentiality. Requests sent to Artificial Intelligence Technology providers travel through encrypted channels and are processed under a contractual Zero Data Retention obligation.

Although LWSA adopts market best practices, no environment is entirely immune to incidents. Should a security incident occur that may pose a relevant risk or harm to Data Subjects, LWSA, when acting as Controller, will notify the ANPD and affected Data Subjects, within the timeframes and in the manner set out in article 48 of the LGPD and applicable regulations, informing the measures adopted to mitigate the effects.

9. Data Subjects' rights

Data Subjects have certain rights regarding their personal data and may exercise them by contacting us through our official channels (privacidade@locaweb.com.br), such as:

Confirmation of the existence of personal data processing;
Access to personal data, in accordance with applicable legislation;
Correction of incomplete, inaccurate or outdated data;
Data portability;
Deletion of data, when processed based on the Data Subject's consent or when the data is unnecessary, excessive, or processed in non-compliance with applicable legislation;
Request for information about shared use of data. Please note that this Privacy Notice describes the personal data sharing activities;
Withdrawal of consent, when applicable;
Review of decisions made solely based on automated processing, including those made through AI Technologies, when such decisions affect your interests, pursuant to article 20 of the LGPD, including the right to request clear and adequate information about the criteria and procedures used in the automated decision;
Objection to processing carried out based on one of the hypotheses that waive consent, in the event of non-compliance with the LGPD;
Anonymization, blocking or deletion of unnecessary or excessive data, or data processed in non-compliance with the LGPD;
Information about the possibility of not giving consent and the consequences of refusal;
Filing a petition regarding your data with the ANPD, pursuant to article 18, paragraph 1, of the LGPD.

For security reasons, we will only be able to fulfill your request if we are certain of your identity. Accordingly, we may request photo identification documents, or additional data or information, to confirm the Data Subject's identity and authenticity.

We will handle your requests free of charge and within the shortest possible time, in accordance with the timeframes set out in article 19 of the LGPD: in simplified form, immediately, or through a clear and complete statement, within up to 15 (fifteen) days from your request.

Should the request not be fully fulfilled — for example, when there is a legal or regulatory retention obligation, when LWSA acts as the data Processor, or when fulfilling the request would affect third-party rights — we will inform you of the factual or legal reasons for the refusal.

Please note that, as mentioned above, in most of the products and services we offer, LWSA acts as Processor of personal data, following the instructions of our Clients. If you are a Consumer and wish to exercise your rights regarding personal data that LWSA processes as Processor, you should contact the Client that is using the Services.

10. Data Protection Officer contact

LWSA's Data Protection Officer is the law firm LIMA ≡ FEIGELSON ADVOGADOS, represented by JEAN MARC WEINBERG SASSON, an attorney duly registered with the Rio de Janeiro Bar Association (OAB/RJ) under No. 160,554, who can be contacted at [jean.sasson@limafeigelson.com.br or privacidade@locaweb.com.br].

11. Termination of processing

This Privacy Notice applies to the aforementioned circumstances throughout the entire period during which LWSA stores personal data. We store and retain your information:
(i) for the period required by law;
(ii) until the termination of personal data processing, as described below; or
(iii) for the period necessary to preserve LWSA's legitimate interest. Accordingly, we will process your data, for example, during applicable statutes of limitation or for as long as necessary to comply with a legal or regulatory obligation.

Termination of personal data processing will occur in the following cases:
(i) when the purpose for which the personal data was collected has been achieved, and/or the personal data collected is no longer necessary or relevant to achieving that purpose;
(ii) when the Data Subject requests the deletion of their data; and
(iii) when there is a legal determination to that effect.

In cases of termination of personal data processing, except for the hypotheses established by applicable legislation or by this Privacy Notice, the personal data will be deleted and this Notice will no longer apply to your relationship with LWSA.

Data from interactions with Artificial Intelligence Technologies (prompts, commands and context), when not linked to a specific legal, contractual or regulatory obligation, will be retained for the period necessary to provide the requested service, and may be subject to a specific retention period, informed at the time of collection or in the product's technical documentation.

Once the retention period has ended, or one of the above hypotheses for termination of processing has occurred, personal data is securely deleted from our production environments.

LWSA may retain personal data after termination of processing exclusively in the hypotheses of article 16 of the LGPD, i.e., for compliance with a legal or regulatory obligation, study by a research body (with anonymization whenever possible), transfer to a third party in compliance with legal requirements, or exclusive use by LWSA, provided that third-party access is prohibited and the data is anonymized.

As an alternative to deletion, LWSA may anonymize the personal data, in which case it will no longer be considered personal data and may be used for statistical, security and Service-improvement purposes.

Deletion requests may be sent to the e-mail address privacidade@locaweb.com.br. When LWSA acts as Processor, deletion will depend on instructions from the Client responsible for the processing.

12. Amendment to the Notice

Due to the constant evolution of its business model, LWSA reserves the right to amend this Privacy Notice at any time, through publication of the updated version on its website. Should there be a material change in the processing of personal data, you will be informed and given the opportunity to review the revised Notice before deciding to continue using our Services.

13. Third parties involved in processing

LWSA engages third parties to enable the provision of the Services. These third parties act as Processors or Sub-processors, as applicable, always under LWSA's documented instructions and subject to contractual obligations of confidentiality, information security, purpose limitation, assistance in responding to Data Subjects' requests, incident notification, and restrictions on subcontracting.

The main categories of third parties involved are: (i) cloud infrastructure and hosting providers; (ii) payment method and payment processing providers; (iii) communication and messaging providers; (iv) Large Language Model (LLM) providers and other Artificial Intelligence Technologies, subject to a contractual Zero Data Retention obligation; (v) support, assistance and data analysis providers; and (vi) credit protection entities and registry entities.

The list of relevant sub-processors and their respective purposes may be requested through the channels indicated in the Data Protection Officer Contact section.

Clients acting as Controllers may formalize the processing carried out by LWSA through our Data Processing Agreement, available for download below.

Download Agreement

Cookies Policy

The objective of this policy is to supply to the audience that uses the website and the services offered by the Locaweb Group (“user” or “you”), clear and accessible information about the cookies that we use in our websites and mobile applications (collectively, the “websites”), and how they affect the experience of users. This policy is supplementary to our Privacy Policy.

1. What are “cookies”?

Cookies are essential tools for online browsing. They consist of files that identify the interactions between you, our Websites and our social networks or ads, and that are transferred to your equipment (PC, tablet or smartphone), aiming at optimizing and customizing your browsing experience in our Websites. The term “cookie” may be applied to describe several technologies, including, among others, pixel tags, web beacons and mobile devices identifiers. The Locaweb Group uses session cookies and persistent cookies. Session cookies collect information that does not allow to identify the user, and they are automatically excluded when you close your browser's window. Persistent cookies, in turn, are stored in your computer or mobile device until they expire, and they collect information that may identify a person. Additionally, the cookies used in our Websites may be “proprietary,” that is, they may be defined by us - or by a third party on our behalf -, or developed by third parties, to allow the supply of resources or functionalities of reliable third parties in our Websites, through our Websites, or through the services that you use, such as ads, interactive contents or analytics. These third parties may recognize your device when you browse our Websites or use our services, or when you browse other websites or use other services.

2. How does the Locaweb Group use cookies?

See below the different types of cookies that may be used in the Websites of the Locaweb Group.

2.1 Essential Cookies

Essential cookies are required for the operation of our Websites and the provision of services to you. Without these cookies, our Websites will not work as well as we would like, and we may not be able to supply certain services or resources linked to them. Types of Cookies

Session: Session cookies are used for keeping the state of the application.
Load Balancing: Load-balancing cookies are used for distributing and reducing the server's load.
User Identification: User identification cookies are applied to ensure that users will only see their own information.
Security: Security cookies are applied in security controls and checks.

2.2 Preference Cookies

Preference cookies collect information about your choices and preferences, not only allowing our Websites to remember the language, location, device used or other settings, but also allowing your experience to be customized according to such preferences. Types of Cookies:

Language: Language cookies are used for storing the language selected by users, and to show the correct options.
Location: The user's approximate address (city, state, country, zip code), which is determined by the IP address, is stored to allow an automatic selection of the country, so that the establishments that are closer to the user can be shown.
Mobile: When users view the Website using a mobile device, a cookie is defined to indicate whether the main website was selected (that is, if the device supports 'Flash'), or a non-Flash mobile website.
Reference Website: The reference website is recorded to better understand the user's preference.
Last Visit and Activity: The dates of your latest visits and activities, and similar information, are recorded in order to supply users with updates about “what has changed in the website since your last visit,” and to have a better understanding of your preferences.
Recently Viewed Videos: The dates and titles of recently viewed videos are recorded for a better definition of the user's preferences.
Flash Cookies: Flash cookies are used to allow the reproduction of audio and video contents.
Page History: Page history cookies are used to track the sequence of pages visited by the user. If the user receives an error message when visiting the Website, the cookie's information is stored in a log file for error reporting and resolution.
Session: Session cookies are used for keeping the state of the application.

2.3 Analytical Cookies

Analytical cookies collect information about the use of our Websites, allowing us to improve the way they work. For example, analytical cookies show us which Website pages are most visited; help us to record any difficulties users may experience in navigating the Website; and show us if our ads are being effective. This enables us to see the global usage patterns of our Websites in an anonymized and aggregate manner. Types of Cookies

Google Analytics: Google Analytics cookies collect statistical data to improve a website's presentation and browsing. Google completes the aggregated data with demographic data and other information of interest, so that we can better understand our visitors.

2.4 Advertising Cookies

Advertising cookies are used for marketing purposes, allowing us to target the ads that are shown to you based on your interests. The objective is to show advertising contents that are more important for you, as well as to improve campaign performance reports, and avoid showing ads that you have already seen. Some pages that you visit in the Websites may also collect information through the use of pixel tags, which may be shared with third parties that provide direct support to our promotional activities and website development. For example, the information on the use of our Websites may be shared with third parties such as advertising agencies, in order to help us targeting the advertising banners in our websites. Types of Cookies

Advertising: Distribute targeted/behavioral ads.
Market Studies: Conduct market studies.
Campaign/Promotion: Measure the campaign's effectiveness.
Fraud Detection: Detect click fraud.

3. Social Media Plug-ins

We also use social media buttons and/or plug-ins in our Websites. They allow you to connect to your social network in different ways. For purposes of plug-in operations, social media websites - such as Facebook - will define the tracking technologies in our website than can be used in improving your profile in their websites, or contribute with data stored for the different purposes set forth in their relevant privacy policy.

4. How to Manage Cookies?

While most Internet browsers are initially set to automatically accept cookies, you may change settings to block cookies, or to alert you when cookies are sent to your device. To learn more, see the help options in your browser.egador.

Bear in mind that, when cookies are disabled or removed, not all features of the Websites will operate as intended. For example, you may not be able to visit certain areas of our Websites, or to receive customized information when visiting them. If you use different devices to view and access the Websites (for example, PC, smartphone, tablet etc.), you should adjust the settings of browsers in each device, in order to meet your cookies preferences.

5. Contact us

If you have any question about this Cookies Policy, please send an e-mail to: abuse@locaweb.com.br.

Anti-spam Policy

Get acquainted with Locaweb's anti-spam policies.

The objective intended by the Locaweb Group is to fight SPAM practices, as stated in its “ANTI-SPAM COMMITMENT.” Accordingly, the measures adopted are classified as below:

a) Informational or Educative: intended to explain, not only to Locaweb's clients, but also to the public in general, WHAT SPAM IS and the ways to mitigate SPAM accusations. These explanations are included in this policy statement, and can be supplemented with “hints available at Locaweb's website;”

b) Technological: they consist of technical instruments that are made available for Locaweb's clients not only to avoid receiving SPAMs (such as filters, hidden nickname, list of blocked e-mails; confirmation of origin etc.), but also to avoid accusations of SPAM practices (active registration confirmation); and

c) Repressive: these measures consist of contractual provisions that authorize Locaweb to summarily interrupt the websites of clients who violate the ANTI-SPAM COMMITMENT undertaken by them upon engagement of Locaweb's services.

Anti-spam commitment of Locaweb and its clients

In compliance with the best Internet practices, and with those applied by the most influent non-governmental bodies on the internet, and following the requests of users, Locaweb hereby publicly expresses its commitment to anti-spam. Accordingly, Locaweb undertakes to avoid SPAM practices through all means that are within its reach, as well as to disclose the rejection of these practices and its purpose to prevent their adoption by clients.

On the other hand, in becoming a Locaweb client, you must accept fully and without restrictions, automatically, and for the simple fact of engaging any service provided by Locaweb, the commitment to NOT USING SPAM IN ANY OF ITS MODALITIES OR MANIFESTATIONS.

Thus, all Locaweb clients undertake to follow SPAM refusal norms, being responsible for complying with the rule of not using SPAM in any event or situation.

SHOULD WE NOTICE THAT A CLIENT IS SENDING SPAMS, HIS/HER WEBSITE WILL BE INTERRUPTED, AS PROVIDED FOR IN THE RELEVANT AGREEMENT, AND WITHOUT PREJUDICE OF OTHER APPLICABLE MEASURES.

Locaweb clients are not allowed to receive more than ten percent (10%) of bounced e-mails, except if another limit has been expressly set forth in the agreement signed with the client. In this case, the limit provided for in the agreement will prevail.

“Bounced e-mail” is any type of error that may compromise the delivery of messages to their recipients.

One of the most common errors is the absence of a destination inbox.

Thus, if a Locaweb client receives a percentage of e-mails above the 10% specified above, LOCAWEB will presume that the client is conducting SPAM activities.

The e-mail to denounce SPAM activities that may have been conducted by a Locaweb client is abuse@locaweb.com.br.

THIS IS LOCAWEB'S AND ITS CLIENTS' ANTI-SPAM COMMITMENT. PLEASE RESPECT IT, AND MAKE IT BE RESPECTED BY OTHERS, FOR A BETTER INTERNET.

Basic information about the characteristics of spam practices

What is SPAM?

Objectively, for purposes of this commitment, SPAM is defined as the sending of e-mails and/or any other electronic message that may give rise to a complaint by a recipient and/or organization and/or individual for purposes of combating and restraining SPAM activities.

SPAM is not a feasible advertising means. Despite the temptation to use it as an advertising means, SPAMs are imposing changes in Internet regulations on the use of the e-mail system, and the restrictions and penalties against companies that use SPAMs are increasing.

It is always important to report a SPAM, which is a negative practice for the Internet, and the only way to fight against it is by denouncing it.

Why is SPAM a problem?

Currently, the Internet is an extremely dynamic and complex environment with much information available. The e-mail is an Internet component, and, today, it is among the most important communication means in this environment.

However, this communication means has been increasingly degraded by the high number of e-mails, not only relating to advertising, but also to jokes or any other e-mail types that are sent arbitrarily, without being requested by the recipient. This is SPAM. This degradation results in the increased use of space to store messages, and overloads servers that manage and transmit e-mails, as well as communication networks etc.

Additionally, non-requested e-mails are more and more ignored by the recipients, who start to refuse the companies that send them. Accordingly, even in commercial terms, SPAMs are becoming something highly not recommended.

Basic instructions to minimize accusations of spam practices

Precautions

- Do not send “newsletters” assuming that recipients would like to receive them.
- Do not include a “register your e-mail” field in your website without strictly following de “Active Confirmation” described in this document.
- Do not buy e-mail lists. This is illegal, and it will certainly result in complaints on the sending of SPAM by your website.
- Do not believe if a seller assures that an e-mail list was approved by the recipients to receive messages. That's a lie.
- If a visitor to your website registers as your client, this does not mean that he/she accepted to receive your ads. The recipient should explicitly request to receive your advertising e-mails.
- If you have a program that records all e-mail addresses of persons that send questions to your website, and you use this list to send e-mails, you will certainly be accused of SPAM.
- There is not a legislation about this subject in Brazil. So, the argument that the e-mails sent cannot be considered a SPAM based on a congress act or legislation, whether national or international, will not be valid.
- Always refer to the website www.locaweb.com.br to see any updates about this subject.

Active Registration Confirmation

The best way to register in order to validate the sending of e-mails is through a process called “Active registration confirmation.” It consists of explicitly requesting the registration of a client, in order to guarantee that he/she will accept to receive you communications in the future.

This technique is particularly useful in cases where you want to build your e-mails list without taking the risk of being accused of being a SPAMMER for having accepted an address without the authorization of the owner. This is occurs frequently when you have an “Indicate a friend” field in your website, which leads to many “Friends” being indicated without their knowledge and, thus, they may consider any communication from you as a SPAM.

How to implement the active confirmation?

- If you have an “Indicate a friend” field and any e-mail address is indicated to receive communications, DO NOT include it in your list immediately.
- If you have a client registration form in place, be sure that it includes a clear “checkbox” stating that the client agrees to receive informative materials, ads etc. relating to your website.
- Send an e-mail to the registered address immediately with a very clear and objective text, WITHOUT ADS, and only containing the information that someone has indicated the e-mail address to continue receiving communications from your website. If the recipient really wants to receive such communications, he/she must reply to your e-mail using a text previously defined.
- Include the e-mail address in our list only if you receive such reply and if it is affirmative.
- Keep the e-mail with the confirmation, since it will be your single evidence that the visitor has explicitly accepted to receive your communications.

Important: this process does not guarantee that your website will not be accused of SPAM, but it is a means to protect yourself against this situation and show good faith and transparency.

ATTENTION:

If a Locaweb client is accused of SPAM practices, and his/her website cannot be immediately removed for some reason, Locaweb reserves the right to require, for purposes of maintaining the provision of its services, that the website accused of this practice COMPULSORILY adopts the “Active Registration Confirmation” technical resource. Also, depending on Locaweb's subjective analysis, the case may be considered “serious,” and Locaweb may require that the e-mails list used by the website is invalidated, so as to guarantee that the website will not continue to send potentially unwanted e-mails to certain addresses.

This “ANTISPAM COMMITMENT” cancels and replaces the previous commitment, registered in the 3rd Registry of Deeds and Documents of the Capital of the State of São Paulo, under No. 8518948, on August 29, 2006.

São Paulo, April 08, 2008

LOCAWEB S/A

Privacy Policy for Job Applicants

Locaweb Serviços de Internet S/A is committed to raise the awareness of its job applicants (“Job Applicants” or “you”) on the protection of their personal data. Accordingly, we present our privacy policy (“Privacy Policy”) with the purpose of supplying clear and accurate information to Job Applicants about the collection, use, storage, and other types of personal data processing carried out by Locaweb in the context of their selection and hiring process, in case that you are selected.

This document aims at presenting, in an objective manner, personal data processing characteristics and possibilities.

IN THE EVENT THAT YOU ARE APPROVED IN OUR SELECTION PROCESS AND HIRED, THE PROCESSING OF YOU PERSONAL DATA WILL START TO BE FULLY GOVERNED BY THE EMPLOYEE'S PRIVACY POLICY. IN CASE OF CONFLICT BETWEEN THIS DOCUMENT AND THE EMPLOYEE'S PRIVACY POLICY, THE LATTER WILL PREVAIL.

Personal data that we process

To the extent permitted by the applicable laws, we may collect and process the following types of personal data about you throughout your selection process.

Record data. Locaweb will process your record data, such as full name, address, date of birth, and ID number (RG, CPF, CNH, RNE and/or voter's card) for purposes of identification during your selection process and registration with Locaweb.
Contact information. Locaweb will process your electronic and home address data, as well as your phone number, in order to contact you about the development of the selection process and make a proposal, as the case may be.
Information made available by you in your resumé or in professional social networks. Locaweb will process information about your trajectory, and professional and academic experience, as well as on the skills indicated in the resumé you shared with Locaweb, such as those that you have publicly manifested in your professional networks. Locaweb processes this information in order to analyze your professional profile relating to other applicants, so as to assess if you have the profile required for the job position at Locaweb.
Information made available by you in interviews and tests, and in inquiries carried out by Locaweb. In addition to the information mentioned in the previous topics, in case that you selection processes advances and Locaweb invites you to carry out interviews and tests, after the initial inquiries, Locaweb will process any personal data that you have made available in these situations, which may include, among others, (i) details about your personal life and your latest jobs; (ii) compensation and benefits expectations; (iii) result of queries in the E-social program; (iv) behavioral profile report and autobiography; and (v) result of psychotechnic tests.
Additional information. As a mandatory part of the final phase of the selection process, and in order to know more about the Applicants, we may request additional information for confirmation purposes, which may include the possible receipt of information about you from third parties, including public databases. The processing of information obtained from third parties is strictly limited to the purposes provided for in this Privacy Policy, and it is intended for analyzing your profile for the job position at Locaweb.
Information available in public sources. Locaweb reserves the right to conduct searches in public sources, such as Courts, the Brazilian Tax Authority, Commercial Registries, Transparency Portal (Politically Exposed Persons), news portals, and others, in order to comply with the anti-money laundering legislation, the Law on conflict of interests, and the norms issued by the Central Bank of Brazil (Bacen) and the Brazilian Securities Commission (CVM), considering that some companies of our group are regulated by these bodies.

Locaweb may collect this information directly from you and/or from the profiles that are publicly available in social networks.

With whom do we share your personal data?

Locaweb may share your personal data with third parties or business partners that are important for information technology purposes, as well as for the management and performance of the selection process phases. Data sharing is based on the following criteria and purposes:

Service Providers. We may share your personal data with service providers engaged by Locaweb to supply HR software and other information technologies used in managing the selection process, and job agencies specializing in selection processes (including the recruiting and selection of Applicants who fit in the concept of “persons with disabilities” - PWD), among others.
Request from the relevant authorities. Locaweb may also share your personal data with third parties, including government bodies, in order to respond to investigations, court orders, and court proceedings, or to investigate, prevent or adopt measures regarding illegal activities, suspicion of fraud, or situations involving potential threats to the physical security of any person, or as required by legislation.
New Business. In case that Locaweb gets involved in a merger, purchase or sale of all or some of its assets, your personal data may be shared with the buyer. In case of change in the identity of your personal data controller as a result of any transaction, you will be notified of any choices you may have about your personal data.

International transfers of your personal data

Locaweb may transfer some of your personal data to service providers located abroad, including providers of cloud services.

If Locaweb transfers your personal data to locations outside Brazil, Locaweb will adopt the appropriate measures to ensure the right protection of your personal data according to the requirements of the legislation applicable, including by signing the appropriate agreements on the transfer of personal data.

How long will we retain your personal data?

Locaweb stores and keeps your information (i) for the time required by law; (ii) until completion of the personal data processing, as mentioned below; or (iii) for the time required to preserve Locaweb's legitimate interests, such as the statutes of limitation applicable, or for compliance with legal or regulatory obligations.

Personal data processing will be deemed complete when any of the following situations takes place:

The purpose for which the data were collected has been achieved.
The personal data collected ceased to be necessary or relevant to the achievement of the specific purpose planned.
Manifestation of the Job Applicant in cases where Locaweb has received his/her consent on certain personal data processing.
Legal or regulatory order.

In the cases of completion of personal data processing mentioned above, with due regard for the possibilities set forth in the applicable legislation or in this Privacy Policy, the personal data will be appropriately deleted.

If you are not selected, we will keep your resumé and your data for a period of three (3) months. If you want these data to be eliminated, you should contact Locaweb's Human Resources area or the Data Protection Officer by e-mail privacidade@locaweb.com.br

Your rights in relation to your personal data we process

You will have certain rights in relation to your personal data, including, among others:

Receive clear and complete information about processing of your personal data, including events of personal data sharing;
Request access to your personal data and/or confirmation about the existence of data processing;
Request that we rectify any inaccurate, incomplete and outdated personal data;
Oppose to the processing activities, and request anonymization and exclusion of personal data, in specific circumstances;
Request the portability of your personal data;
Withdraw consent at any time, when Locaweb processes your personal data based on consent;
Request the review of automated decisions that may affect your interests.

You may exercise these rights by contacting Locaweb's Human Resources area by e-mail rhrecrutamento@locaweb.com.brrhrecrutamento@locaweb.com.br, or the Data Protection Officer by e-mail privacidade@locaweb.com.br

Personal Data Protection

Locaweb uses the appropriate organizational technical measures to protect your personal data against non-authorized or illegal processing, or accidental loss, destruction or damage. Your personal data are safely stored in protected equipment. Just a limited number of persons will have access to this equipment, and only individuals with legitimate reasons will have access to your personal data.

Amendments to this Privacy Policy

Locaweb reserves the right to amend this Privacy Policy at any time, upon publication of the updated version on [insert]. Applicants will be duly informed about significant amendments to the Privacy Policy.

Identification of the Controller and Data Protection Officer

Locaweb Serviços de Internet S/A, enrolled with CNPJ under No. 02.351.877/0001-52, with principal place of business at Rua Itapaiuna, No. 2434, Vila Andrade, in the City and State of São Paulo, Postal Code 05707-001, is the controller of your personal data. Peck Advogados is the person in charge of personal data processing (“Data Protection Officer”), and they can be contacted by e-mail privacidade@locaweb.com.br

If you have any doubt about this Policy, please contact Locaweb's Human Resources area or the Data Protection Officer by e-mail privacidade@locaweb.com.br