By this private instrument, on one side, the company SUR ENGENHARIA, MÁQUINAS E INSTALAÇÕES INDUSTRIAIS LTDA, registered with CNPJ No. 01.290.449/0001-02, headquartered at AV. PRESIDENTE CASTELO BRANCO, 936, INDUSTRIAL DISTRICT, SANTA CRUZ DO SUL – RS, herein referred to as the holder, and on the other side, the user who accesses the website www.surengenharia.com or related sites, agree consensually and in the best form of law to this addendum to the data and cookies privacy policy, as follows:

-The holder will collect and process personal data, i.e., use the following personal data for the purposes listed in clause two: Full name, date of birth, RG, CPF, complete address, phone numbers, WhatsApp, and email addresses, username and password specific to the use of the Controller's services, verbal and written communication between the Holder and the user, as well as other data necessary for communication and relationship management between Sur Engenharia and any user.

- The user authorizes the holder to use the personal and sensitive personal data listed in this term for all purposes related to communication, evaluation, and contact, to comply with obligations arising from the legislation, mainly labor, social security, and specific laws of the information treatment regime under the current legislation Law No. 12.965, of April 23, 2014 – Civil Rights Framework for the Internet; for admission procedures and execution of formal and informal contracts with the holder, even after their termination; when necessary to meet the legitimate interests of the holder or third parties, except when fundamental rights and freedoms of the holder that require the protection of personal data prevail, provided that the holder's interest in contracting the services is demonstrated.

- The holder guarantees to the user, the data subject, that all data collected and processed under this contract will comply with the guidelines and principles established by Law 13.709/2018 (General Data Protection Law – LGPD) and Law No. 12.965, of April 23, 2014 – Civil Rights Framework for the Internet, fulfilling the purpose of the collection, as well as to meet legal obligations, as determined by art. 7 of the aforementioned legislation.

- The holder is authorized to share the personal data of the data subject with other data processing agents, if necessary for the purposes listed in this instrument, provided that the principles of good faith, purpose, adequacy, necessity, free access, data quality, transparency, security, prevention, non-discrimination, and accountability are respected.

- The processing of personal data carried out by the Holder will comply with the company's Privacy and Personal Data Protection Policy, to fulfill legal or regulatory obligations, to protect the life of the user and their data. Any doubts can be resolved together with the responsible officer.

- The USER commits, in an irrevocable and non-retractable manner, not to directly or indirectly transmit to anyone, at any time, any documents, audio, videos, information, client registration data, technical, administrative, or commercial knowledge, specialized skills, projects, methods and methodology, flowcharts, specializations, components, products/services relevant to the HOLDER, its partners, and clients, including regarding internal organization, clients, research, improvement, inventions, work systems, and general services.

- The confidentiality and secrecy mentioned above are also necessary to comply with the rules of the General Data Protection Law – LGPD (Law No. 13.709/2018) concerning the protection of personal data to ensure the privacy, intimacy, honor, and image of the data subjects.

- Therefore, the USER is responsible for all individuals who may access the information through them, committing to reimburse any damage or loss resulting from any breach of the confidentiality of the provided information.

- The obligation of confidentiality and secrecy assumed by the USER through this term will remain valid indefinitely until the information is publicly disclosed by any other person or with written authorization from the HOLDER.

- In the event of termination of the relationship with the HOLDER, the USER undertakes to promptly return any documents, audio, and videos in their possession, and not to use any information accessed to derive exclusive and/or unilateral benefit, present or future, or for the benefit of third parties.

- Non-compliance with the provisions herein acknowledges that the company may terminate its duties under this agreement for just cause, without prejudice to any resulting losses and damages.

- The user may revoke their consent at any time by email or written letter, as per Article 8, § 5, of Law No. 13.709/2020. The holder acknowledges that they may continue to use the data for purposes allowed by law despite the revocation.

- Furthermore, failure to comply with the provisions herein may result in the holder being obligated to pay fines as provided by the General Data Protection Law – LGPD (Law No. 13.709/2018).

- This policy comes into effect on the date of its acceptance, with the remaining clauses and conditions of the privacy and cookies policy remaining unchanged.

This policy shall be governed, interpreted, and enforced in accordance with the laws of the Federative Republic of Brazil, particularly Law No. 13.709/2018, regardless of laws of other states or countries. The competent forum for resolving any doubts arising from this document shall be the domicile court of the Holder.

COOKIE POLICY

DATA COLLECTION TYPE
We receive, collect, and archive information that you add on our website or provide to us in any other way. Additionally, we collect the IP address used to connect your computer to the Internet; login data; email address; password; computer and internet information; and purchase history. We may use tools to measure and collect browsing information, including page response times, total time spent on certain pages, interaction information on pages, and methods used to exit pages. We also collect personal identification information (including name, email, password, communication methods); payment details (including credit card information), comments, feedback, recommendations, and personal profiles.

WHEN WE COLLECT:
When you make a transaction on our website, as part of the process, we collect the personal information provided such as your name, address, and email address. Your personal information will only be used for the specific actions mentioned below.

FOR WHAT PURPOSES ARE THEY COLLECTED:
1. To provide our users with continuous customer assistance and technical support;
2. To provide and operate the Services;
3. To offer continuous customer support and technical assistance to our users;
4. To contact our visitors and users with general or personalized notices related to services and promotional messages of mutual interest;
5. To create aggregated statistical data and other aggregated and/or inferred non-personal information that may be used by us or our business partners to provide and improve our respective services;
6. To comply with any applicable laws and regulations.

HOW ARE THEY STORED:
Our business is hosted on the napoleon.com.br platform. napoleon.com.br provides us with an online platform that allows us to sell products and services to our customers. Your information may be stored in napoleon.com.br's database. napoleon.com.br stores your information on secure servers protected by a firewall.

All direct payment entries offered by napoleon.com.br and used by our company comply with the standards set by PCI-DSS, managed by the PCI Security Standards Council, a collaborative effort among brands such as Visa, MasterCard, American Express, and Discover. PCI-DSS requirements help ensure the secure handling of credit card information by our store and its service providers.

HOW WE COMMUNICATE WITH THE USER
We may contact you to notify you about your account, assist in resolving any issues related to your account, resolve a payment dispute, collect fees or debts, conduct surveys or questionnaires, provide updates about our company, or for any other reason necessary to review our contract, in accordance with local laws. For this purpose, we may contact you via email, telephone, text messages, and mail. Participation is not mandatory.

If you do not wish for us to collect your personal information, please contact us at jaime@surengenharia.com or send us a message to: Avenida Presidente Castelo Branco, 936, Distrito Industrial, Santa Cruz do Sul, CEP: 96835-666.

We reserve the right to modify this privacy policy at any time, so please check regularly for updates. Changes and clarifications will take effect immediately upon their posting on our website. If we make material changes to this policy, we will notify you again when you visit our site, and it is your responsibility to review and decline if you find it appropriate. You are free to use our services and can opt to be excluded at any time by following the formal procedure described in this publication.

If you wish to access, correct, or delete any information we have collected about you, please feel free to contact us via email at mauricio@surengenharia.com.