PRIVACY NOTICE – FLAMENGO

SUMMARY TABLE

Flamengo's Role as a Treatment Agent

CONTROLLER:

FLAMENGO REGATAS CLUB

CNPJ:33.649.575/0001-99

Address: Avenida Borges de Medeiros, nº 997, Lagoa, Rio de Janeiro/RJ, CEP 22.430-041.

RIGHTS OF THE HOLDER

By law, you have the right, at any time, to:

·         To have access to the data we collect from you;

·         Change and correct your data;

·         Refusing consent to data processing. However, this measure may make your objectives with FLAMENGO unfeasible. It is important to consider the necessity and, if you have any doubts, we recommend contacting us so that we can clarify them in detail. See the "Contact for your request" section at the end of the document.

·         Revoke previously given consent. However, consider whether this measure will jeopardize your objectives with FLAMENGO.

·         Anonymization, blocking, or deletion of data. Do you not want your personal data to be exposed in any way? We can do this, provided there is no law or regulation preventing us from doing so. Furthermore, such deletion may affect the way we provide the service or make it impossible to provide it, but we will explain this in more detail when we receive this request.

·         Data portability. Portability refers to the transfer of your data from one provider to another of the same provider. We don't expect you to change teams! But, if this right ever becomes applicable to us, we will fulfill your request.

·         Become aware of the partners and third parties with whom FLAMENGO shares your data.

ORIGIN OF PERSONAL DATA      

Personal data is generally provided by the user and/or collected automatically when the holder joins, registers, and/or signs up for access and/or use of services inside and outside the facilities of Clube de Regatas do Flamengo, whether as a local fan member, through embassies and consulates, admission as a permanent employee or third party allocated to the facilities, as an hourly teacher or athlete, freelancer, from bidders, suppliers or service providers, business partners, sponsors, licensees, auditors, celebrities, press, competent authorities, and interested or regulatory governmental entities.

Personal data commonly processed by Flamengo

Basically, we collect your name, parentage (minors need the consent of their legal guardians), date of birth, place of birth, gender, phone number, email, address, identity card number, CPF registration number (if foreign), and your facial biometrics, in case you are a fan club member and wish to purchase a ticket for a Flamengo game at Maracanã.

PURPOSES AND LEGAL BASIS FOR PROCESSING PERSONAL DATA      

Due to the nature of Flamengo's operations, there is a very wide range of purposes for processing personal data, according to the data subject's objective. For example, for club members, identification (registration) data, contact information, financial history, medical certificates for students in the youth academies, digital biometrics, CCTV camera images (for the physical security of our members and their children), and legal responsibility – if the member is a minor; for fan club members, identification (registration) data, contact information, billing information, purchase history, and facial biometrics; For fans who are not club members, we collect registration data, purchase data, bank details and/or credit card information (which is stored in banking institutions), facial biometrics (for access to Maracanã); for employees, we collect registration data, worker data to prove employment, social security (PIS, PASEP, NIS, E-social, among others) and maintenance of benefits; for athletes, in addition to the data mentioned above, we need health and physical performance data to enable health care inherent to the exercise of the function; for third parties, we collect registration data, images of documents, contractual data (for hiring), digital biometrics for access to facilities and physical security, and payment history.

In general, we perform the following treatments:

- Access, registration and/or sign-upEmployee or third-party records are kept for access to Club facilities for leisure or work purposes, to sponsor, market licensed products, participate in tenders, supply and/or provide services. Regarding Club members or athletes, this is used to exercise rights and obligations as a member or athlete, according to their sport; if they are a fan member, for identification and exercise of the rights offered by the acquired plan. Documents and/or certificates regarding health conditions are used to attest to health fitness, according to the nature of the holder, need, legislation, regulations, and objectives. All these registrations are linked to the possibility of executing a contract, preliminary or not, agreed upon by the parties. We collect digital biometrics for access to Club facilities as a security measure for members, employees, and third parties, and facial biometrics for entry into the Mario Filho Stadium (Maracanã) as legally determined by Law No. 14597 of June 14, 2023, and in accordance with the Safe Stadium project, of which Flamengo will be a part..

- Active data collection: When registering a Club member, employee, service provider located at the Club's facilities, members of embassies and consulates, or Fan Member and non-member fans, at a minimum, the following information is collected: full name, email, CPF (Brazilian tax identification number), cell phone number, date of birth, address, and purchase history. In the case of minors, the date of birth, parentage, and Consent Form from the guardian are requested. Data processing may occur for consultation of the active member registration, dissemination of advertising material, promotions, raffles, discounts, loyalty programs, satisfaction surveys, partner benefits, and for the sale of tickets for sporting events at Maracanã/other venues, or entry to the Flamengo Museum. These cases will fall under the same legal hypotheses as access, registration, or enrollment.

- Automatic data collection: FLAMENGO collects and/or shares a range of information automatically – directly or via API (Application Programming Interface), such as actively collected information or access, registration, or sign-up information from your electronic or digital equipment, characteristics of your phone or PC, browser, IP address (with date and time), IP origin, information about clicks, pages accessed, subsequent pages accessed after leaving previous pages, or any search term typed on or in reference to the websites, among others. To this end, FLAMENGO uses some standard technologies, such as Cookies, pixel tags, beacons and location shared objectsIn addition to the purposes described in access, registration, or sign-up, this aims to improve the User's browsing experience on the pages, according to their habits and preferences. All of this relates to the preliminary execution of a contract or even their legitimate interest in browsing well and finding everything they want quickly, based on what we provide as the best experience for them to continue using our services.

NOTE: Automatic collection of information through technologies such as cookies* and caches can be disabled through your internet browser settings and on our website, specifically regarding cookies. However, the User should be aware that by disabling these technologies, some features offered by the websites may not function correctly, as they depend on data processing.

The information collected may eventually be shared by FLAMENGO with (i) partner companies, when necessary for the proper maintenance, provision of services and/or participation of the data subject in any promotion, obtaining any benefit (in these cases, we rely on the prior and express consent of the user, which is granted through acceptance of Terms of Use or contractual instruments, in accordance with the LGPD); and (ii) by court order or request from a competent administrative authority. We may also share the fan's data with companies that sell tickets in cases of games where Flamengo is the visiting team, to maintain discounts on ticket purchases or to comply with specific state legislation.

- Communications and marketing initiatives: The dissemination of information or promotion of Flamengo's brands, products, promotions, and discounts; operationalization and dissemination to Club members or members of the Fan Club, Embassies, and Consulates programs; also, for conducting satisfaction surveys and planning the offering of our own and partner products and services to employees, third parties, and clients. Communication and marketing initiatives are also linked to the execution of contracts with our partners, given the legal nature and business purpose, compliance with legal or regulatory obligations, such as in cases of communication of records, for example, labor issues and/or accidents involving members, research (for the purpose of sizing or promoting promotions and advertising), exercise of rights in judicial and administrative proceedings, health protection (when we carry out actions aimed at the physical or mental well-being of employees, members, or athletes), and/or credit protection, when we need to verify a condition to enter into agreements that require this action; remembering that everything depends on the objective of the treatment, since we are talking about all the possible ones here.

- Extraction, production or reproduction of data: When we need to identify business opportunities or conduct research to size spaces, products, or services, we may extract, produce, or reproduce information from our databases to support the sizing and scope of an initiative or campaign. For example, to define the appropriate location for a football game based on the number of likely ticket buyers as club members. And we do this based at least on the assumption of contract execution, prior consent of the legitimate interest of the Club, or the legitimate interest of the data subject.

- Data reception: When you register or sign up for anything with FLAMENGO, our direct employees or partners receive the information to carry out various processing tasks, according to the purpose of the registration. The legal basis for receiving the information also relates to the preliminary execution of a contract or even a legal or regulatory obligation. In some cases, it is for health protection (incidents and accidents – care at health posts within FLAMENGO facilities).

- Data storage: The personal data collected and processed by FLAMENGO remains in our databases and, due to contract execution or legal or regulatory obligations, may be stored by suppliers and/or service providers. The collected information will be stored on our own servers or those contracted by us (IaaS) for the time necessary for the purposes implicit in the data collection, due to legal or regulatory obligations, or authorized by the data subject. FLAMENGO uses reasonable market and legally permitted means to preserve the privacy of the data collected on its pages. Based on this, the precautions provided for in the security standards guidelines established in Decree No. 8.771/2016 are adopted.

The information collected by FLAMENGO through its official pages will be automatically deleted from its servers if it is no longer useful for the purposes for which it was collected, or when you request it. However, the information may be retained to comply with legal or regulatory obligations, transferred to third parties, provided that data processing requirements are respected, and for the exclusive use of FLAMENGO, prohibiting access by third parties, provided that the data is anonymized.

- Discarding, eliminating, deleting data: Since we began implementing the program to comply with the General Data Protection Law and other privacy regulations from other countries, we have been observing disposal issues and have sought to ensure that the disposal of printed materials, as well as the deletion of digital data, follows a secure process aimed at eliminating the possibility of identifying a data subject due to improper disposal. This is mainly based on the principle of contract execution, whether with employees or third parties.

You should be aware that in some cases, the deletion of your information will not occur automatically, but only upon your request, and in accordance with the cancellation rules established in the Terms of Use of some services, as well as the obligation to keep them for a certain period for legal purposes.

Finally, information necessary for filling out bank slips or making payments via credit card is collected by FLAMENGO, but is not stored on FLAMENGO's servers.

DATA SHARING WITH THIRD PARTIES

We do not rent, sell, or share your information with third parties except as described in this Privacy Notice.

Eventually, we may share information in the following way:

·         with partners and service providers, so that they use personal data strictly for the purposes set out in contractual instruments and which relate to the activities carried out by FLAMENGO to achieve its results. However, they do not have any right to share said information without prior authorization: yours or FLAMENGO's (when they do so to comply with any legal or regulatory obligation).

·         Our business partners, considering the partnership, sponsorship, and brand strength, often work with us to offer our members, fans, and customers opportunities arising from the partnership with FLAMENGO. Therefore, we seek to minimize data loss, but – due to business practice – we enter into one-way or mutual data sharing agreements to enable proposals for benefits, sales, and exclusive promotions from FLAMENGO or the business partner. All of this is based on the terms of a contract and legal or regulatory obligation (if the partner is a competent authority); of course, with your consent, which can be revoked at any time through [the appropriate channels/methods]. HOLDER PORTAL.

·         Consent: We may share your information in other ways if you ask us to do so or if you have given us your explicit and unequivocal consent.

·         Public Administration: Your personal data may be shared with Public Administration bodies, i.e., Public Authorities and their legal representatives, for legal or regulatory compliance and/or even due to actions associated with the execution of public policies, such as those related to Health, Education, and Public Security in stadiums and for fans in general, for example. We will also need to share your information when there is a threat to the physical safety of any individual, violations of this Privacy Notice or contracts, and also to protect the legal rights of third parties, including our employees, fans, users, or the general public, naturally, for purposes associated with the legal hypotheses of contract execution and preliminaries, legal or regulatory obligation, and/or protection of life.

NOTE: Flamengo's partner organizations are aware of and committed to respecting the Club's data protection and privacy, in accordance with this document and our internal guidelines, as stipulated by the LGPD (Brazilian General Data Protection Law) or other related national or international regulations, depending on the applicable law.

 COOKIES

Os Cookies Cookies are files or pieces of information that can be stored on devices when a user visits the FLAMENGO website pages and accepts the use of cookies. Generally, a cookie contains the name of the website that originated it, its lifespan, and a randomly generated value.

Flamengo uses the Cookies Cookies are used to facilitate navigation and adapt pages to your interests and needs. They are also used to compile information about the use of our websites and services, which contributes to the improvement of our structures and content.

Another way we can use the Cookies This is to speed up future user activities and experiences on our pages. They can also be used to indicate FLAMENGO pages on websites the user has visited. FLAMENGO may share this information with third parties and business partners. But it's important to note that you can (and should) choose your cookie usage options on the website(s). We offer this functionality and you can change your preferences at any time. See below the types we use:

       RequiredThese are the tools that help us understand how visitors interact with Flamengo's pages, providing information about the areas visited, the time spent on the site, and any problems encountered, such as error messages.

       Functional: These are the features that allow Flamengo's pages to remember your choices in order to provide a more personalized experience. In addition, they enable users to watch videos and use social tools, comment sections, forums, and more.

PerformanceThese are cookies used to provide statistical information about our website - they are used to measure and improve performance.

This category is also known as AnalyticsActivities such as page visit counts, page load speed, bounce rate, and technologies used to access our website are included in this category.

      Publicity: These cookies are used to provide content of interest to the User and to present more targeted advertising or limit the number of times it is displayed on FLAMENGO's Pages. It is also possible to measure the effectiveness of an advertising campaign.

After the user consents to the use of CookiesFlamengo stores a cookie on your device to remember this for the next session, and the user may revoke their consent to cookies whenever they deem it appropriate. Warning: if the user does not accept some cookies from Flamengo's pages, certain services may not function optimally.

Third-party analytics are used to track and measure website usage so that we can continue to produce engaging content. These cookies may track things like how long you spend on the site or the pages you visit, which helps us understand how we can improve the sites for you. Periodically, new features are tested and subtle changes are made to how the site presents itself. And these cookies may be used to ensure you receive a consistent experience while browsing, while FLAMENGO understands which optimizations our users appreciate most.

SECURITY MEASURES ADOPTED

·          To ensure compliance with privacy and data protection guidelines, FLAMENGO has continuously and progressively adopted technical and administrative measures to prevent data breaches, and we require the same practices from our third parties. Essentially, we invest in physical security and information technology resources; maintain a dedicated area for privacy and personal data protection, the Privacy Management Department; train and raise awareness among our employees; partner with the Legal Department to jointly draft contractual clauses in agreements and contracts with our partners regarding best practices; use techniques and tools commonly employed in the market to provide security, within the acquisition possibilities available to FLAMENGO and the third party; and continuously build a personal data governance system and conduct audits aimed at continuous improvement. Among other measures, FLAMENGO:

·         Performs risk analysis of third parties before hiring them;

·         It uses standard and industry-leading methods to encrypt and anonymize the collected data;

·         It provides protection against unauthorized access to systems and applications;

·         It only authorizes access to the location where the collected information is stored to previously designated individuals;

·         Those who come into contact with the information must commit to maintaining absolute confidentiality, it being hereby established that breach of confidentiality will entail, at a minimum, civil liability; and;

·         It maintains a digital inventory with indicators of time, duration, identity of the employee or person responsible for access, and the file accessed, based on connection and application access logs, as determined in article 13 of Decree No. 8.771/2016.

It is important to note that FLAMENGO makes every effort to preserve the privacy of user data. Therefore, our full guarantees only apply to what is within our purview for proper protection, considering that information transmitted on the pages may be subject to unauthorized access perpetrated through methods developed to obtain information improperly, exceeding the most recent standard security measures. For this reason, FLAMENGO recommends that users also adopt appropriate measures to protect themselves, keeping all usernames and passwords confidential; that is, do not share or allow the theft of your access data anywhere.

Any information you provide will be collected and stored in accordance with security and confidentiality standards and will not be publicly available, provided, or sold under any circumstances. Unless there is a legal or judicial order, or prior authorization from the data subject, personal information will not be transferred or used for purposes other than those that FLAMENGO informs.

INTERNATIONAL TRANSFER

The transfer can only be made to another country if it meets the requirements of Article 33 of the General Data Protection Law, especially its first paragraph, which states that the country or territory in question or the international organization in question ensures an adequate level of protection for the user's data.

If an adequate level of protection is not in place, FLAMENGO will make greater efforts to protect your data in accordance with the strictest rules, through specific contractual clauses for a given transfer, standard contractual clauses, global corporate rules, or regularly issued seals, certificates, and codes of conduct.

We have several service providers such as AWS, Google, and Microsoft that maintain their Data Centers We prioritize using them outside the country, but we favor using them in countries that have privacy agreements with Brazil or have specific legislation on privacy and data protection.

PRIVACY AREA AND DPO

Flamengo's Privacy Management team is composed of individuals dedicated to the governance and management of privacy and personal data protection. It also includes the "DPO" (Data Protection Officer).(Data Protection Officer or DPO)), who is the professional designated, under the law, to mediate the relationship between FLAMENGO, its data subjects, and the competent authorities on the subject. In Brazil, under the LGPD (Brazilian General Data Protection Law), this person is called “Data ControllerHowever, we use the acronym "DPO" because we also have business abroad, where the acronym is widely used and recognized. This makes it easier for everyone to understand.

UPDATES TO THIS DOCUMENT

We anticipate updating our Privacy Notice from time to time (at least once a year). For changes requiring prior authorization under the LGPD (Brazilian General Data Protection Law), we will contact you through any of FLAMENGO's channels (email, websites, app, etc.); however, for textual changes that do not fall under these cases, we will make every effort to inform you of the change, but we ask that you periodically review this PRIVACY NOTICE.

CONTACT US FOR YOUR REQUESTS

Fulfilling all your rights is Flamengo's commitment, in accordance with the LGPD (Brazilian General Data Protection Law) and through our actions. Therefore, we have a communication channel available... HOLDER PORTALThis allows you to open support tickets and request any of your rights listed above. Through this system, you can contact our Data Protection Officer (DPO), who will then respond to your requests. We offer the following contact methods:

From Flamengo's website: https://flamengo.com.br/privacidade , Click in Holder Portal.

From the Fan Member website: https://mengo.com.br/privacidade

LEGISLATION AND JURISDICTION