This Term seeks to provide transparency on how Casa Figueira collects, uses, processes, stores, shares, and protects your personal data.

How do we collect personal data?
We inform you below which personal data we collect and use and for what purposes we do so:
• Registration and contact details: information voluntarily provided by the data subjects, such as name, email, address, telephone number.
• Data arising from the relationship between the data subject and Casa Figueira: We collect data that enables the establishment or maintenance of the relationship between the data subject and Casa Figueira, which includes information regarding registration for events, campaigns, emails, or other communications exchanged with users to receive institutional/informative material.
• Electronic device logs and user interaction data: such as IP address, mobile device ID, information obtained through the use of cookies, Google Analytics, web beacons and other information related to user interaction with our platforms (web and applications), such as date and time of access, time spent on pages, areas visited, resources and tools used, click records and cookie identifiers (for more information see our Cookies Policy).
• Geolocation data: We may collect geolocation data, with your consent, to indicate our units and facilities closest to you.
• Social media browsing data: We may collect browsing data on social networks such as comments and reviews made by users about Casa Figueira through a monitoring tool, with the purpose of improving the user experience and the provision of our services.
Legal Grounds of Processing
Casa Figueira may justify the processing of personal data based on the following legal bases to operate our business and provide our services:
• Agreement: we may process personal data to fulfill our contractual obligations or enter into agreements.
• Consent: We may use the personal data that you have authorized us to process voluntarily and through your free, informed, and unequivocal consent.
• Legitimate interests: we may rely on legitimate interests, provided that the processing is previously assessed to ensure fair, reasonable, and balanced processing. Among the cases of data processing based on legitimate interests, we have the following situations:
o To enable the provision of our services to data subjects;
o To provide personalized content through direct marketing, the receipt of which we believe users will welcome;
o To investigate complaints and carry out audits;
o To inform data subjects registered on our platforms and mailing list about events, campaigns, facilities, and benefits.
• Legal and regulatory obligations and regular exercise of rights: We may process personal data to comply with our legal and regulatory obligations or mandates, as well as in legal actions or administrative or arbitration proceedings to which we are a party.
Purpose of the processing
We use the personal data collected for purposes related to the provision of our services and communication with data subjects about products, events, campaigns, facilities, and benefits.
In this context, the processing of personal data is necessary to:
• Manage, provide services, and comply with contractual obligations assumed, ensuring operability and continuity in the delivery of our services;
• Define and adjust the format of our content, including to deliver personalized and more assertive materials;
• Customize the user experience, improving the performance, functionality, and efficiency of Casa Figueira's online presence;
• Identify and authenticate users appropriately, to enable us to respond to requests and queries regarding our services;
• Analyze traffic trends, as well as track data on the use of our platforms, measuring the effectiveness of our marketing activities;
• Create user profiles and operations performed, to personalize the services and benefits offered, as well as communication with the data subjects;
• Carry out various research and statistical surveys for the purpose of analyzing indicators and business strategy;
• Increase the security of our customers and combat fraud in our services;
• Comply with legal or regulatory obligations and/or exercise rights in judicial, administrative, or arbitration proceedings;
• Consult third parties, such as marketing companies, to better adapt the services provided by Iguatemi One.
In addition to these situations, we may use anonymized data (i.e., in a way that does not lead to the direct or indirect identification of an individual), to improve and personalize the services provided.
Sharing your data with third parties
Casa Figueira may share your data with third parties, provided there is a legal basis for doing so, as per the examples below:
• Business partners/service providers: to constantly improve our content and services, we may share personal data with commercial partners, such as partners in carrying out specific campaigns and events, technology providers, which we do in strict compliance with the purposes informed to the data subjects and only with service providers that meet strict security standards in the processing of personal data.
• Fraud-fighting partners: To enable fraud detection, we may share some personal data indicated by our partners, which may even result in the contracting of specific anti-fraud services.
• Public authorities or official bodies: To comply with legal obligations to which we are subject, we may have to share data with public authorities or official bodies, upon express request or legal provision.
Cookies
Our platforms (web and apps) may use cookies. In cases where cookies are used, a statement will be sent to your browser explaining the use of cookies and asking for your authorization when sharing data with third parties. To learn more, see our Cookie Policy.
What are the rights related to privacy and data protection and how to exercise them?
Casa Figueira considers the rights of personal data subjects to be extremely relevant. For this reason, we strive to ensure that the rights over personal data provided for by law (in particular, article 18 of the General Data Protection Law — Law No. 13,709/2018) can be fully exercised by their data subjects, except for applicable limitations.
We highlight below the following rights that can be exercised:
• Confirmation of processing and access to data: Anyone can request access to data processed in the context of Casa Figueira, as well as information about possible sharing with third parties. However, to enable the exercise of this right, we may use identity verification and checking mechanisms, with the aim of guaranteeing the security and protection of the information processed from the requested data against possible fraud.
• Correction or Update: If personal data is incorrect, inaccurate, or out of date, the data subject may request correction or even make it possible by updating their registration on our platforms.
• Withdrawing Consent: in cases where the processing of personal data requires obtaining consent, this may be revoked at any time by the data subject, who may express their choice in a simple, free, and easily available manner. The processing carried out until the data subject's expresses itself are maintained.
• Exclusion: the data subject may request the deletion of their data provided in some specific situations (when the legal basis for their processing is consent or the legitimate interest of Casa Figueira), especially when they understand that they are processed excessively, unnecessarily, or in non-compliance with applicable legislation. However, it is possible that, even after the deletion request, some personal data remains stored in our database, as a way of complying with legal obligations or to protect the interests of Casa Figueira.
• Objection: When we send institutional communications and personalized materials via email, such as electronic newsletters, the data subject may choose to no longer receive this type of message, in which case they must request the cancellation of their subscription by following the instructions contained in each communication. Upon request to opt-out, we will make efforts to remove personal data from our databases within a reasonable period, although we may request additional information before processing such request.
• Portability: the data subject may, once regulated by the Brazilian Data Protection Authority ("ANPD"), request the portability of personal data stored on our platforms, which means that, if such a request is made after due regulation, Iguatemi One will provide a copy of the personal data collected, in a commonly readable format, in accordance with the applicable regulations.
• Request to the Brazilian Data Protection Authority: if the data subject, even after requesting the processing of their personal data in the context of Iguatemi One, still believes that their request has not been processed properly, they may submit the claim to the Brazilian Data Protection Authority (ANPD).
To exercise your rights, at any time and free of charge, send your request by filling out this request form which can be sent automatically after completion or by letter, to the address: R. Angelina Maffei Vita, 200, 9º andar - Jardim Paulistano – São Paulo – SP – Zip Code (CEP) 01455-070. To ensure that requests are processed securely, we can implement mechanisms to validate and authenticate your identity.