PRIVACY POLICY

1. General information

This Privacy Policy contains information on how we handle, totally or partially, whether in an automated manner or otherwise, personal data of users who access our app. Its purpose is to clarify the stakeholders about the types of data that are collected, the reasons for the collection and how the user can update, manage or delete this information.

This Privacy Policy was prepared in accordance with Federal Law no. 12,965, of April 23, 2014 (Brazilian Civil Rights Framework for the Internet), with Federal Law no. 13,709, of August 14, 2018 (Personal Data Protection Law) and with EU Regulation no. 2016/679, of April 27, 2016 (General Data Protection Regulation - GDPR).

This privacy policy may be updated due to eventual regulatory updates, which is the reason the user is required to periodically consult this section.

2. User rights

The application may compromise compliance with applicable standards in the GDPR, respecting the following principles:

- The user's personal data will be processed in a lawful, loyal and transparent manner (lawfulness, loyalty and transparency);

- The user's personal data will be collected only for displayed, explicit and legitimate purposes, they cannot be handled later in a manner that is incompatible with those purposes (limitation of purposes);

- The user's personal data will be collected in an appropriate, relevant and limited manner to the requirements of the objective for which they are processed (data minimization);

- The user's personal data will be accurate and updated whenever necessary, so that the inaccurate data is erased or rectified when possible (accuracy);

- The user's personal data will be retained in sech a manner that allows the identification of the data holders only for the period necessary for purposes for which they are handled (retention limitations);

- The user's personal data will be securely handled, protected from unauthorized or unlawful handling and against its accidental loss, destruction or damage, adopting adequate technical or organizational measures (integrity and confidentiality).

The user of the app has the following rights, conferred by the Personal Data Protection Law and the GDPR:

- Right of confirmation and access: it is the user's right to obtain from the application the confirmation that the personal data concerning them are or are not subject to handling and, if that is the case, the right to access their personal data;

- Right of rectification: it is the user's right to obtain from the application, without undue delay, the rectification of inaccurate personal data concerning them;

- Right to delete data (right to be forgotten): it is the user's right to have their data deleted from the application;

- Right to limit the handling of data: it is the user's right to limit the handling of their personal data, obtaining it when the accuracy of the data is disputed, when the handling is illegal, when the application no longer needs the data for the proposed purposes and when they have opposed the handling of data and in case of handling unnecessary data;

- Right of opposition: it is the user's right to oppose, at any time, for reasons related to their particular situation, to the handling of personal data concerning them, and may also oppose the use of their personal data to define a marketing profile (profiling);

- Right to data portability: it is the user's right to receive personal data concerning them and which was provided to the application, in a structured format, in current use and automatic reading, and the right to transmit this data to another application;

- Right not to be subject to automated decisions: it is the user's right not to be subject to any decision taken exclusively on the basis of automated handling, including profiling, which has an effect on a legal sphere or affects them significantly similarly. The user can exercise his/her rights through written communication sent to the application with the subject "GDPR-", specifying:

- Full name or corporate name, CPF number (Individual Taxpayer Registry, Internal Revenue Service of Brazil) or CNPJ (National Registry of Legal Entities, Internal Revenue Service of Brazil) and user's email address and, if applicable, its representative’s email;

- Right you want to exercise with the application;

- Date of the request and user signature;

- Any document that can demonstrate or justify the exercise of your right. The request must be sent to the email: [email protected], or by mail, to the following address:

Igreja Internacional da Graça de Deus

Estr. dos Bandeirantes, 1000

Taquara, Rio de Janeiro - RJ

ZIP CODE: 22710-113

The user will be informed in case of rectification or deletion of their data.

3. Duty not to provide third party data

When using the website, in order to safeguard and protect the rights of third parties, the user of the application must provide only their personal data, and not those of third parties.

4. Collected information

The collection of data from users will take place in accordance with the provisions of this Privacy Policy and will depend on the user's consent, which is dispensable only in the cases provided for in art. 11, item II, of the Personal Data Protection Law.

4.1. Types of collected data

4.1.1. User identification data for registration

The use, by the user, of certain functionalities of the application will depend on registration, and in these cases, the following user data will be collected and stored:

- name

- date of birth

- email address

- Postal code

- details of social networks

- phone number

- CPF number

- CNPJ number

- Data related to the user's geolocation will be obtained.

4.1.2. Data entered in the contact form

The data eventually informed by the user using the contact form provided in the application, including the content of the message sent, will be collected and stored.

4.1.3. Data related to the execution of contracts established with the user

For the execution of any purchase and sale contract or the provision of services eventually established between the application and the user, other data related or necessary for its execution, including the content of any communications with the user, may be collected and stored.

4.1.4. Access records

In compliance with the provisions of art. 15, caput and paragraphs, of Federal Law no. 12,965/2014 (Brazilian Civil Rights Framework for the Internet), user access records will be collected and stored for at least six months.

4.1.5. Sensitive data

The application will be able to collect the following sensitive data from users:

- Data related to the donation payment transaction via credit card, using the Digital Wallet (wallet) of the Faith Show Application.

4.1.6. Collection of data not expressly provided

Eventually, other types of data not expressly provided for in this Privacy Policy may be collected, provided that they are provided with the user's consent, or that the collection is permitted or imposed by law.

4.2. Legal basis for personal data handling

By using the application's services, the user is consenting to this Privacy Policy. The user has the right to withdraw his consent at any time, without compromising the lawfulness of the handling of his personal data before the withdrawal. The withdrawal of consent can be made by e-mail: [email protected], or by mail sent to the following address:

Estr. dos Bandeirantes, 1000

Taquara, Rio de Janeiro - RJ

ZIP CODE: 22710-113

The consent of the relatively or absolutely incapacitated, especially of children under 16 (sixteen) years old, can only be done, respectively, if properly assisted or represented.

Personal data necessary for the execution and fulfillment of the services contracted by the user in the application may also be collected. The handling of personal data without the user's consent will only be carried out due to legitimate interest or for the cases provided for by law, that is, among others, the following:

- for the fulfillment of a legal or regulatory obligation by the controller;

- to carry out studies by a research body, guaranteeing, whenever possible, the anonymization of personal data;

- when necessary for the execution of a contract or preliminary procedures related to a contract to which the user is a party, at the request of the data subject;

- for the regular exercise of rights in judicial, administrative or arbitral processes, the latter under the terms of Law No. 9,307, of September 23, 1996 (Arbitration Law);

- for the protection of life or physical safety of the data subject or third party;

- for the protection of health, in a procedure carried out by health professionals or by health entities;

- when necessary to serve the legitimate interests of the controller or third party, except where the fundamental rights and freedoms of the data subject prevail that require the protection of personal data;

- for credit protection, including the provisions of the relevant legislation.

4.3. Purposes of personal data handling

The personal data of the user collected by the application is intended to facilitate, streamline and fulfill the commitments established with the user and to enforce requests made by filling out forms.

Personal data may also be used for a commercial purpose, to personalize the content offered to the user, as well as to subsidize the application for improving the quality and functioning of its services.

The application collects user data so that profiling can be performed, that is, automated handling of personal data that consists of using this data to evaluate certain personal aspects of the user, mainly to analyze or predict characteristics related to their professional performance, their economic situation, health, personal preferences, interests, reliability, behavior, location or travel.

The registration data will be used to allow the user access to certain contents of the application, exclusive for registered users.

The collection of data related to or necessary for the execution of a purchase and sale contract or the provision of services eventually established with the user will have the purpose of providing the parties with legal security, in addition to facilitating and enabling the conclusion of the deal.

The handling of personal data for purposes not provided for in this Privacy Policy will only occur upon prior notification to the user, and, in any case, the rights and obligations provided herein will remain applicable.

4.4. Retention period of personal data

The user's personal data will be retained for a maximum period of: 2 years, unless the user requests its deletion before the end of this period. The users’ personal data can only be retained after the end of their handling in the following cases:

- for the fulfillment of a legal or regulatory obligation by the controller;

- for study by a research body, guaranteeing, whenever possible, the anonymization of personal data;

- for transfer to a third party, provided that the data handling requirements set out in the legislation are respected;

- for the exclusive use of the controller, access by a third party is prohibited, and provided the data is anonymized.

4.5. Recipients and transfer of personal data

The user's personal data may be shared with the following persons or companies:

Mobiup Desenvolvimento de Sistemas e Marketing Digital, CNPJ: 22.351.872 / 0001- 37, Address: Av. Angélica, 321, Conjunto 112.

The transfer can only be made to another country if the country or territory in question or the international organization concerned ensures an adequate level of protection of user data.

If there is no adequate level of protection, the application undertakes to guarantee the protection of your data in accordance with the most stringent rules, through specific contractual clauses for a specific transfer, standard contractual clauses, global corporate standards or stamps, certificates and codes of conduct regularly issued.

5. Handling of personal data

5.1. Data controller

The controller, responsible for the handling of the user's personal data, is the natural or legal person, the public authority, the agency or other body that, individually or in conjunction with others, determines the purposes and means of handling personal data.

In this application, the person responsible for the handling of the personal data collected is Igreja Internacional da Graça de Deus, CNPJ: 30.902.803/0001-00, represented by Webmaster IIGD, who can be contacted by e-mail: [email protected] or at Address:

Estr. dos Bandeirantes, 1000

Taquara, Rio de Janeiro - RJ

ZIP CODE: 22710-113

The person responsible for handling the data will be directly responsible for the handling of the user's personal data.

5.2. The data protection officer

The data protection officer is the professional in charge of informing, advising and controlling the data controller, as well as the workers who process the data, regarding the application's obligations under the terms of the GDPR, the Personal Data Protection Law and other data protection provisions in national and international law, in cooperation with the competent supervisory authority.

In this application, the data protection officer is Gustavo Kaller, who can be contacted by e-mail: [email protected].

6. Security in the handling of the user's personal data

The application undertakes to apply technical and organizational measures to protect personal data from unauthorized access and situations of destruction, loss, alteration, communication or dissemination of such data.

To guarantee security, solutions will be adopted that take into account: the appropriate techniques; application costs; the nature, scope, context and purposes of the handling; and the risks to the user's rights and freedoms.

The application uses SSL (Secure Socket Layer) certificate which ensures that personal data is transmitted in a secure and confidential manner, so that the data transmission between the server and the user, and in feedback, occurs in a totally encoded or encrypted manner.

However, the application disclaims liability for the sole fault of a third party, such as in the event of an attack by hackers or crackers, or the exclusive fault of the user, such as in the case where the user himself transfers his data to a third party. The application is also committed to communicating the user in a timely manner in the event of any breach of the security of your personal data that could cause you a high risk to your personal rights and freedoms.

The breach of personal data is a breach of security that causes, accidentally or unlawfully, the destruction, loss, alteration, disclosure or unauthorized access to personal data transmitted, stored or subject to any other type of handling.

Finally, the application undertakes to treat the user's personal data with confidentiality, within the legal limits.

7. Complaint to a supervisory authority

Without prejudice to any other means of administrative or judicial appeal, all data subjects are entitled to lodge a complaint with a supervisory authority.

The complaint may be made to the authority of the application's headquarters, the user's country of habitual residence, their place of work or the place where the infraction was allegedly committed.

8. Changes

This version of this Privacy Policy was last updated on: 07/29/2020.

The editor reserves the right to modify these rules at any time, especially to adapt them to the developments of the Faith Show App application, either by making new features available, or by suppressing or modifying existing ones.

The user will be explicitly notified if this policy changes.

When using the service after any modifications, the user demonstrates his agreement with the new standards. If you disagree with any of the changes, you must immediately request the cancellation of your account and submit your remark to the customer service, if you wish.

9. Applicable law and jurisdiction

In order to resolve disputes arising from this instrument, Brazilian law will be fully applied. Any disputes must be presented in the jurisdiction of the district where the head office of the application publisher is located.