Privacy Police

We collect your Personal Data through the following sources: Clara Resorts Group Websites: All of our websites may be used for the collection of Personal Data. This includes both websites that we operate directly through our own domains and IP addresses, as well as websites or pages we establish on third-party services such as Facebook, LinkedIn, and other platforms that offer this type of service. Email and instant messaging systems: Services used to maintain electronic communication between you and the Clara Resorts Group, including those provided directly by us or by third-party services such as WhatsApp, Telegram, SMS (short message service), and similar platforms. Clara Resorts Group mobile applications: Mobile applications provided directly by the Clara Resorts Group or through third-party services such as Google or Apple. Customer service and sales center: Communications carried out with you through our customer service and sales channels. Online ads, advertisements, and forms: Interactions with any type of online ads, marketing materials, or forms from the Clara Resorts Group. Offline records: Paper or offline forms completed during events or other interactions with the Clara Resorts Group. Data received from third parties: Including, but not limited to, social networks and third-party websites such as Facebook, Instagram, LinkedIn, and similar platforms, data aggregators, Clara Resorts Group partners, public sources, and data received during the acquisition of other companies.

During your interaction with the Clara Resorts Group, using one of the previously mentioned data collection sources, we may collect various types of Personal Data about you, as outlined below: Contact Information: Includes any type of information that allows us to reach you, such as your physical mailing address, telephone numbers, email addresses, websites, and social media profiles. Login Information: Includes information used to identify and authenticate You in services provided by the Clara Resorts Group, such as your registered username (login), password stored in an unrecoverable (encrypted) format, and security questions. Demographic information and your interests: Any information that may describe your demographic data, habits, or behavioral characteristics, including items such as your birthday, date of birth, age or age group, gender, geographic location, favorite products, hobbies and leisure activities, other interests, as well as family information or details about your lifestyle. Technical information about your computer equipment or mobile devices: Details about your computer or other portable device used to access one of our websites, services, or applications, including the IP address used to connect your computer or device to the internet, as well as its geographic location, operating system type and version, and web browser type and version. If you access a website or application of Grupo Clara Resorts using a mobile device, such as a smartphone or tablet, the information collected will also include, whenever permitted, your phone’s unique device ID, geographic location, and other similar mobile device data. Information about how you use our websites and services: During your interaction with our websites and services, we use automatic data-collection technologies to capture information about the actions you take. This may include details such as which links you click, which pages or content you view and for how long, and other similar information and statistics about your interactions, such as content response times, download errors, and the duration of visits to specific pages. This information is collected through automated technologies such as Cookies (browser Cookies, Flash Cookies and similar technologies) and web beacons, as well as through third-party tracking. You are entirely free to object to the use of such technologies; for more information, please refer to the section “About Your Rights Regarding Personal Data”. Market research and consumer feedback: Information that you voluntarily share with Grupo Clara Resorts about your experience using our products and services. Consumer-generated content: Includes any content you create and share with Grupo Clara Resorts on third-party social networks or by uploading it to one of our websites, applications, and other online or offline services, including through the use of third-party social media applications such as Facebook, Instagram, LinkedIn, and similar platforms. These data include text, comments, articles, photos, videos, personal stories, or other similar content and media. Whenever permitted, we collect and publish consumer-generated content in connection with a variety of activities, including promoting Grupo Clara Resorts products and services, contests, awards and other promotions, website community features, consumer engagement, and third-party social networks. Third-party social media information: This refers to any data that you publicly share on a third-party social network or information that is part of your profile on a third-party social network (such as Facebook, Instagram, LinkedIn, and similar platforms) and that you allow the third-party social network to share with us. This data may include details such as your basic account information (name, email address, gender, date of birth, current city, profile photo, user ID, friend list, and similar information) as well as any additional information or activities that you authorize the third-party social network to share with us. We receive your third-party social media profile information (or portions of it) whenever you download an item or interact with a Grupo Clara Resorts application or web service on a third-party social network, whenever you use a social network feature integrated into a Grupo Clara Resorts website, or whenever you interact with us through a third-party social network. To learn more about how your third-party social media information is obtained by Grupo Clara Resorts or to opt out of sharing such information, please visit the website of the specific third-party social network. Financial and payment information: Any data that Grupo Clara Resorts needs to fulfill an order or that you use to make a purchase, such as your debit or credit card information (cardholder name, card number, expiration date, etc.) or other payment methods used. Grupo Clara Resorts or our payment processing service providers handle your financial and payment information in accordance with applicable laws, regulations, and security standards, such as PCI DSS (Payment Card Industry Security Standards Council”). Contacts with our Consumer Service Department and Sales Center: Your interactions with our Consumer Service Department and Sales Center may be recorded or monitored, in accordance with applicable laws, for operational purposes of Grupo Clara Resorts. Financial and payment information details are not recorded. When required by law, You will be informed of such recording at the beginning of your call. Sensitive Personal Data: Grupo Clara Resorts does not normally handle Personal Data considered sensitive under current legislation; therefore, we do not intend to collect or process sensitive personal data during your typical interactions with our products or services. When there is legitimate interest or when it becomes necessary to process your sensitive personal data for any reason, we will obtain your prior, express, and formal consent for any processing carried out on a voluntary basis (for example, for marketing purposes). If we process your sensitive personal data for other purposes, we rely on the following legal bases: (i) crime detection and prevention; and (ii) compliance with applicable law.

Grupo Clara Resorts may collect personal data from children and adolescents directly from their parents or legal guardians, with explicit consent, and in accordance with the rules set forth in applicable legislation.

It is important to remember that it is your responsibility to ensure that the settings on your computer or portable device reflect whether y ou consent to the acceptance of Cookies. Most browsers allow you to set rules to notify you before accepting Cookies or to simply refuse them. You do not need to have Cookies enabled to use or navigate most of Grupo Clara Resorts’ websites and online services; however, in this case, we cannot ensure that you will be able to access all of their features. We recommend that you refer to the “help” section of your browser to learn how to configure these settings. Keep in mind that if you use different browsers or even different computers and/or portable devices in various locations, you must ensure that each device and browser is adjusted according to your personal Cookie preferences As our web beacons may be part of a web page, it is not possible to opt out of this type of feature; however, you can make it completely non-functional by activating the opt-out feature for the Cookies placed by that beacon.

The items below describe the purposes for which Grupo Clara Resorts collects your Personal Data and the different types of Personal Data we collect for each purpose. Please note that not all of the uses described below will be relevant to all individuals and may apply only in specific situations. Customer services: Your Personal Data is used for the purpose of providing customer services, including responding to your questions, inquiries, and suggestions. This usually requires certain personal contact information and information regarding the reason for your inquiry, question, or suggestion—for example, details about your request, whether there is a technical issue, a product-related concern or complaint, or a general inquiry. Legal basis for the use of your personal data in this situation: – To fulfill contractual obligations; – To comply with legal obligations; – Our legitimate interests. Our legitimate interests in this situation: – To continuously improve Grupo Clara Resorts’ products and services; – To continuously improve the effectiveness of our customer service. Contests, promotions, and other marketing activities: With your consent (when required under applicable law), Grupo Clara Resorts uses your Personal Data to provide information about products or services, such as marketing communications, advertising campaigns, or promotions. This may be done through various communication channels, including email, advertisements, SMS messages, phone calls, and postal mail (as permitted by applicable law), as well as through our own websites and/or third-party websites and social media platforms. In this situation, the use of your Personal Data is entirely voluntary, which means that you may object to or withdraw your consent at any time regarding the processing of your Personal Data for these purposes. For further details on how to change your preferences regarding marketing communications, please refer to the section “About Your Rights Regarding Personal Data” in this policy. For more information about our contests and other promotions, please see the rules or details posted for each contest/promotion. Legal basis for the use of your personal data in this situation: – To fulfill contractual obligations; – Our legitimate interests; – Your consent (when require). Our legitimate interests in this situation: – To understand which of our products and services may be of interest to you and to provide you with information about them; – To define target consumers for new products or services. Social media and third-party websites: We use your Personal Data when you interact with social media features and third-party websites, such as “liking” content, in order to provide advertisements and interact with you on third-party social networks. How these interactions work, the profile data that Grupo Clara Resorts obtains about you, and how to opt out can be understood by reviewing the privacy policies directly on the respective social networks and third-party websites. Legal basis for the use of your personal data in this situation: – Our legitimate interests; – Your consent (when required). Our legitimate interests in this situation: – To understand which of our products and services may be of interest to you and to provide you with information about them; – To define target consumers for new products or services. Personalization (offline and online): Based on your consent (when required under applicable law), Grupo Clara Resorts uses your Personal Data (i) to understand your preferences and habits, (ii) to anticipate your needs based on our understanding of your profile, (iii) to improve and personalize your experience on our websites and applications; (iv) to ensure that the content of our websites and applications is optimized for you and for your computer or device; (v) to send you targeted advertising and content; and (vi) to allow you to participate in interactive features whenever You choose to do so. In this situation, the use of your Personal Data is entirely voluntary, which means that you may object to or even withdraw your consent at any time regarding the processing of your Personal Data for these purposes. For further details, please refer to the section “About Your Rights Regarding Personal Data” in this policy. Legal basis for the use of your personal data in this situation: – Our legitimate interests; – Your consent (when required). Our legitimate interests in this situation: – To understand which of our products and services may be of interest to you and to provide you with information about them; – To define target consumers for new products or services. Fulfillment of your requests: We use your Personal Data to process and deliver your orders, as well as to inform you about the status of your orders, correct addresses, and carry out identity verification and other fraud-prevention activities. This involves the use of certain Personal Data and, in some cases, payment information. Legal basis for the use of your personal data in this situation: – To fulfill contractual obligations; – Legal obligations; – Our legitimate interests; – Your consent (when required). Our legitimate interests in this situation: – To improve and develop new products and services; – To be more efficient in fulfilling your requests; – To protect our systems, networks, and employees; – To fully comply with legal obligations. Legal reasons or merger/acquisition: If Grupo Clara Resorts or its assets are acquired by or merged with another company, including in the event of bankruptcy, we will share your Personal Data with our legal successors, in compliance with applicable legal requirements. We may also disclose your Personal Data to third parties (i) when required by applicable law; (ii) in response to legal proceedings; (iii) in response to a request from a competent legal authority; (iv) to protect our rights, privacy, safety, or property; or (v) to enforce the terms of any agreement or the terms of our website, products, and services, as permitted by applicable law. Legal basis for the use of your personal data in this situation: – Legal obligations; – Our legitimate interests; Our legitimate interests in this situation: – To fully comply with legal obligations; – To protect our systems, assets, and employees. Other purposes and general situations: In accordance with applicable law, Grupo Clara Resorts uses your Personal Data for other general business purposes, such as maintaining your account, conducting internal or market research, and measuring the effectiveness of our advertising campaigns. If you have Grupo Clara Resorts accounts, we reserve the right to integrate such accounts into a single account. We also use your Personal Data for the management and operation of our communications, IT systems, and data security and protection systems. Legal basis for the use of your personal data in this situation: – To fulfill contractual obligations; – Legal obligations; – Our legitimate interests; – Your consent (when required). Our legitimate interests in this situation: – To improve and develop new products and services; – To be more efficient in fulfilling your requests; – To protect our systems, networks, and employees; – To fully comply with legal obligations.

In addition to the entities that are part of Grupo Clara Resorts, we may share your Personal Data with the following types of third-party organizations: Service providers: These include external companies used by Grupo Clara Resorts to assist in operating our business. Service providers and their selected employees are only authorized to access your Personal Data on behalf of Grupo Clara Resorts for the specific tasks requested of them based on our direct instructions. Our service providers are contractually required to keep your Personal Data confidential and secure, and in the event of a breach they shall be jointly liable in accordance with applicable law. Credit analysis agencies, debt collection agencies, and financial services: s permitted by applicable law, credit analysis and/or debt collection agencies are external companies that Grupo Clara Resorts may use to help verify your credit status or to collect overdue payments. Third-party companies that use Personal Data for their own marketing purposes: Except in situations where you have given your specific consent, Grupo Clara Resorts does not license or sell your Personal Data to third-party companies for their own marketing purposes. In cases where such sharing occurs, the identity of these third-party companies will be disclosed prior to obtaining your consent. Third parties that use your Personal Data for legal reasons or due to merger/acquisition: We will disclose your Personal Data to third parties for legal reasons or in the context of a merger or acquisition involving Grupo Clara Resorts.

In accordance with applicable law, Grupo Clara Resorts will use your Personal Data for as long as necessary to fulfill the purposes for which your Personal Data was collected, as described in this policy, or to comply with applicable legal requirements. Personal Data used to provide you with a personalized experience will be retained exclusively for the period permitted under applicable law. You may obtain further details about the retention of your Personal Data through the communication channels detailed in this policy. Upon termination of the processing of your Personal Data, such data will be deleted within the scope and technical limits of the activities, with retention being authorized in the situations provided for under applicable law.

Clara Resorts Group adopts appropriate measures to ensure that your Personal Data is kept confidential and secure. However, these protections do not apply to information that you choose to share in public areas, such as third-party social networks. Persons who may access your Personal Data: Your Personal Data will be processed by our employees or authorized agents, provided that they need access to such information, depending on the specific purposes for which your Personal Data has been collected. Measures taken in Operational Environments: We store your Personal Data in operational environments that use reasonable security measures, both technical and administrative, to prevent any type of unauthorized access. We follow reasonable protocols to protect Personal Data. Measures the Clara Resorts Group expects you to take: It is important that you also play a role in keeping your Personal Data secure. When creating an online account, please ensure that you choose a strong password to prevent unauthorized parties from guessing it. We recommend that you never disclose or share your password with others. You are solely responsible for keeping this password confidential and for any actions carried out through your account on the Clara Resorts Group’s compatible websites and services. If you use a shared or public computer, never select the option to remember your login name, email address, or password, and make sure that you log out of your account whenever you leave the computer. You should also use any privacy settings or controls that the Clara Resorts Group provides on our website, services, or applications, including those considered optional. Transfer of your Personal Data: Given the nature of our business, it is possible that we may need to transfer your Personal Data stored within the Clara Resorts Group to third parties, in accordance with the purposes set forth in this Privacy Policy. For this reason, we may transfer your Personal Data to other countries, provided that such countries have laws and regulations compatible with those in force in Brazil.

You have the right to confirm the existence and/or request an electronic copy of the information regarding your Personal Data that is processed by the Clara Resorts Group. You also have the right to request details about the origin of your Personal Data or the sharing of such data with third parties. At any time, you may also limit the use and disclosure of, or revoke consent for, any of our Personal Data processing activities, except in situations provided for under applicable law. These rights may be exercised through the communication channels detailed in this Policy, and your identity must be validated through the provision of a copy of your ID card or equivalent means of identification, in accordance with applicable law. Whenever a request is submitted without the necessary evidence to verify the data subject’s legitimacy, the request will be automatically rejected. We emphasize that any identification information provided to the Clara Resorts Group will only be processed in accordance with, and to the extent permitted by, applicable laws. We further emphasize that, in certain cases, we may not be able to delete your Personal Data without also deleting your user account. In addition, some situations require the retention of your Personal Data after You request its deletion, in order to comply with legal or contractual obligations. The Clara Resorts Group makes every possible effort to address all questions you may have regarding how we process your Personal Data.

O The Clara Resorts Group makes every effort to provide you with freedom of choice regarding the Personal Data that you provide to us. The following mechanisms give You control over the processing of your Personal Data: Cookies / Similar Technologies: You may manage your consent by using: – Our consent management solutions; – Your browser settings to refuse some or all cookies and similar technologies, or to alert You when they are being used. Advertising, Marketing, and Promotions: You may consent to having your Personal Data used by the Clara Resorts Group to promote our products or services by means of checkboxes located on registration forms or by responding to questions presented by our representatives. If you decide that you no longer wish to receive such communications, you may unsubscribe from receiving marketing-related communications at any time by following the instructions provided in such communications. To unsubscribe from marketing communications sent by any means, including third-party social networks, you may opt out at any time by using the links available in our communications, by logging into our compatible websites, applications, and online services or third-party social networks and adjusting your user preferences, or by contacting our customer service center directly. It is important to note that, even if you unsubscribe from our marketing communications, you will continue to receive administrative communications from the Clara Resorts Group, such as order confirmations, transaction confirmations, notifications regarding your account activities on our compatible websites and services, and other important non-marketing-related notices. Personalization (Offline and Online): Whenever permitted by law, if you wish your Personal Data to be used by the Clara Resorts Group to provide you with a personalized experience or targeted advertising and content, you may indicate this through the relevant checkboxes located on registration forms or by responding to questions presented by our representatives. If you decide that you no longer wish to benefit from such personalization, you may opt out at any time by logging into our compatible websites, applications, and services and selecting your user preferences in your account profile, or by contacting our customer service center directly. Targeted Advertising: The Clara Resorts Group may partner with advertising networks and other advertising or service providers that display advertisements and other promotional content on our behalf or on behalf of other companies not affiliated with the Clara Resorts Group. Some of these advertisements may be tailored to your interests, based on information collected on the Clara Resorts Group’s websites and other compatible services or on websites of organizations not affiliated with the Clara Resorts Group. You may contact us using the communication channels detailed in this Policy to obtain more information on how to manage or opt out of targeted advertising.

Whenever the Clara Resorts Group decides to change the manner in which we process your Personal Data, this Policy will be updated. We reserve the right to make changes to our practices and to this Policy at any time, provided that compliance with applicable law is maintained. We recommend that you review this Policy frequently, or whenever you have any questions, in order to stay informed of any updates or changes to our Privacy Policy.

For this purpose, we kindly ask that you contact us using the following channels: Person in Charge of Personal Data Processing: Rodrigo Resende dpo@clararesorts.com.br By phone: 55 16 3345-9999 – Reservations Center The Clara Resorts Group will receive, investigate, and respond, within a timeframe considered reasonable, to any request or complaint regarding the manner in which we process your Personal Data, including complaints related to non-compliance with your rights under applicable Personal Data protection and privacy laws.