1.1. HLB SISTEMAS LTDA, enrolled with the CNPJ under no. 53.140.952/0001-77, headquartered at Rua dos Pinheiros nº 1057, Apt. 1712, Sala 1B, CEP 05422-012, São Paulo/SP, Brazil (“HLB”, “we”), develops and provides timeshifter, a desktop application that captures and automatically classifies computer activity, by means of artificial intelligence, to generate time entries (timesheets).

1.2. This Privacy Policy (“Policy”) describes, transparently, how personal data is processed in connection with the institutional website, the commercial relationship with customers and the operation of the application, in compliance with Law No. 13,709/2018 (the Brazilian General Data Protection Law — “LGPD”), the regulations of the Brazilian National Data Protection Authority (“ANPD”) and, where applicable, the Brazilian Internet Civil Framework (Law No. 12,965/2014) and the Consumer Protection Code.

1.3. This Policy should be read together with the Terms of Use, which complement it.

2. Definitions

2.1. For the purposes of this Policy, the definitions of the LGPD apply, in particular:

Personal data — information relating to an identified or identifiable natural person.

Sensitive personal data — data on racial or ethnic origin, religious belief, political opinion, membership of a trade union or of a religious, philosophical or political organization, data concerning health or sex life, genetic or biometric data, when linked to a natural person.

Data subject — the natural person to whom the personal data refers.

Processing — any operation carried out with personal data, such as collection, use, access, classification, storage, sharing, transfer and deletion.

Controller — the party responsible for decisions regarding the processing.

Processor — the party that carries out processing on behalf of the controller and according to its instructions.

Data Protection Officer (Encarregado) — the person appointed to act as the communication channel between the controller, data subjects and the ANPD.

Monitored User — the employee or service provider whose computer activity is captured by timeshifter, by decision of the contracting company.

Activity Data — the activity records captured and classified by the application, described in Section 5.

Anonymization — the process by which data loses the possibility of being associated, directly or indirectly, with an individual, considering reasonable and available technical means; it differs from pseudonymization, which is reversible and keeps the data in the condition of personal data.

3. Who this Policy applies to

3.1. This Policy applies to the processing of personal data of the following categories of data subjects: (i) website visitors and potential customers (prospects); (ii) contracting customers and their representatives, administrators, finance staff and other contacts; and (iii) Monitored Users.

3.2. The roles assumed by HLB and the applicable legal bases vary according to the category of data subject and the purpose, as set out in Section 4 and Section 6.

4. Roles in processing: controller and processor

4.1. HLB acts as controller in relation to the data it processes for its own purposes, notably operating the website, prospecting and commercial relationships, managing the contractual relationship with customers, billing and the security of its operations.

4.2. With respect to the Activity Data of Monitored Users, the contracting company — as a rule the User’s employer or the recipient of the User’s services — is the controller, as it decides on the adoption of the monitoring, its purposes, its limits and its means. In this case, HLB acts as processor, processing the data exclusively according to the contracting company’s documented instructions. In the absence of a specific instrument entered into between the parties, this Policy and the Terms of Use constitute the documented instructions applicable to the processing.

4.3. As a result of this distinction: (i) the controller contracting company is responsible for defining the legal basis for the monitoring, informing Users in advance and responding, in the first instance, to their requests; and (ii) HLB, as processor, assists the contracting company in handling data subject requests, responding to incidents and preparing impact assessments, to the extent of its legal and contractual obligations.

4.4. This Policy does not replace the privacy notices that the contracting company must provide to its own employees regarding the monitoring.

5. Categories of data processed and their source

5.1. The categories of personal data processed, by type of data subject and source, are summarized in the table below.

Category of data subject	Data processed	Source
Website visitors	Identification and professional contact data; browsing data, IP address, device identifiers and cookies.	Provided by the data subject and collected automatically on the website.
Prospects	Professional name, e-mail and telephone, company, job title and commercial qualification data.	Data subject, referrals and third-party professional sources/databases (Section 8).
Customers and representatives	Registration and contact data; billing and payment data; credentials; access, usage and support records.	Provided by the customer and generated through use of the platform.
Monitored Users	Applications and windows in use, window titles, addresses (URLs), periods of activity and inactivity, and other signals necessary for classification and time entry. When authorized by the User, includes the truncated text content of permitted applications and text extracted from the screen by local OCR, as set out in items 5.2 and 5.3.	Collected on the device on which the application is installed by the contracting company and by a browser extension (URLs and page titles).
Monitored Users — WhatsApp channel	Telephone number; content of messages exchanged with the assistant; voice recordings sent by the User and their transcription; and the time-entry data extracted from them (client, matter, description, activity type, cost center, date and time).	Provided by the User when sending a message to timeshifter’s official number.

5.2. Control of capture by the Monitored User. Once the contracting company has decided on the adoption of the monitoring, its purposes and its limits, as set out in Section 4, the actual extent of the capture within those limits is controlled by the Monitored User, through granular per-application permissions, provided that: (i) the window title, the application in use and the periods of activity are always captured; (ii) reading of text content in specific applications — such as web browsers, e-mail (Outlook), chats (Teams and WhatsApp), documents (Word), spreadsheets (Excel), text editors and artificial intelligence assistants — depends on an individual per-application permission, which the User may enable or disable at any time, and the User may also register blocked domains; and (iii) screen capture has its own master control, which the User may disable. On first use, the Application presents these permissions to the User for selection and confirmation, and the resulting configuration is recorded; the same permissions remain accessible in the Application’s settings at any time. These controls constitute a concrete necessity and minimization measure (art. 6, III, of the LGPD).

5.3. Screen capture and local OCR. When enabled by the User, screen capture takes place exclusively in memory: the image is submitted to optical character recognition (OCR) performed locally by the Windows operating system’s own engine, without being sent to third parties; only the extracted text is used, and the image is immediately discarded. No screen image is ever written to disk or transmitted, at any time. Items 5.4 and 5.5 must be read together with this item and with item 5.2.

5.4. Incidental capture of sensitive data. Because of screen and activity capture, data revealing sensitive information may be collected incidentally (art. 5, II, of the LGPD). HLB adopts technical minimization measures and provides configuration features to reduce such capture. The processing of any sensitive data complies with art. 11 of the LGPD and with the legal basis and instructions defined by the controller contracting company. HLB does not process sensitive data for its own purposes. This item must be read together with items 5.2 and 5.3.

5.5. Minimization. HLB does not request or encourage the collection of data beyond what is necessary for the purposes described, in compliance with the principles of art. 6 of the LGPD.

5.6. Integration credentials. For integration with the Customer’s management systems, HLB holds access credentials to those systems in custody, protected as set out in Section 13.

5.7. WhatsApp channel. The Monitored User may, optionally, record time entries by sending messages to timeshifter’s official WhatsApp number. In this case, the User’s telephone number, the content of the messages exchanged with the assistant and, when the User sends a voice message, the corresponding recording and transcription are processed. Use of the channel depends on the User’s own initiative and on prior verification of the User’s number, and is subject to items 9.6 and 10.5.

6. Purposes and legal bases

6.1. Each purpose is based on a specific legal basis. Consent is not used as the basis for operations essential to the service, given that it can be revoked (art. 8, §5, of the LGPD).

Purpose of processing	Legal basis (LGPD)	HLB’s role
Operation of the website and institutional communication	Legitimate interest (art. 7, IX)	Controller
Commercial prospecting and qualification of professional contacts	Legitimate interest (art. 7, IX), with balancing test (LIA) and option to object/unsubscribe	Controller
Contracting, provision of the service, account and support	Performance of contract (art. 7, V)	Controller
Billing and tax and accounting obligations	Compliance with legal/regulatory obligation (art. 7, II)	Controller
Information security, fraud prevention and defense of rights	Legitimate interest and regular exercise of rights (art. 7, IX and VI)	Controller
Capture and classification of activity; generation of timesheets	Basis defined by the controller contracting company (as a rule, performance of contract or legitimate interest of the employer)	Processor
Incidentally captured sensitive data	Art. 11 basis defined and documented by the controller contracting company	Processor
Recording of time entries through the WhatsApp channel, including transcription of voice messages	Basis defined by the controller contracting company, at the request of the User	Processor
Production of anonymized statistics for product improvement	Anonymized data (outside the scope of the LGPD, subject to art. 12) / controller’s authorization	Controller/Processor

6.2. Change of purpose. New purposes incompatible with those disclosed will be preceded by a new legal basis and due notice.

7. Processing based on legitimate interest

7.1. When processing is based on legitimate interest (art. 7, IX), HLB does so for legitimate and concrete purposes — such as enabling and promoting the service, maintaining commercial relationships, ensuring security and preventing fraud — considering only the data strictly necessary for such purposes (art. 10).

7.2. HLB carries out a balancing test (LIA) to verify the necessity, proportionality and legitimate expectations of data subjects, adopting safeguards such as transparency, access restriction, minimization and an objection channel.

7.3. The data subject may, at any time, object to processing carried out on the basis of legitimate interest and request information about the criteria used, through the channel in Section 16.

8. Collection from third-party sources

8.1. For prospecting, HLB may collect professional data from public sources and from third-party contact databases and enrichment tools.

8.2. In these cases, HLB observes the duty of transparency, informing the data subject of the source of the data upon request and ensuring the right to object and to unsubscribe from communications.

9. Artificial intelligence and automated decisions

9.1. timeshifter processes Activity Data and uses artificial intelligence models, supported by third-party cloud services (Section 10), to classify activities and suggest time entries. The extent of the capture is controlled by the Monitored User, as set out in Section 5. For the Activity Data actually captured, processing and classification by artificial intelligence take place continuously and automatically throughout the workday, without the User needing to trigger them. The data sent to the AI service is limited to what is necessary for classification and time entry — the window title and truncated text content, the content sent by the User on the WhatsApp channel (item 9.6) and the lists provided by the Customer referred to in item 10.3 —, with no new categories of data, purposes or recipients beyond those described in this Policy.

9.2. Automated classification is ancillary in nature and is subject to correction and human validation; it does not, in itself, constitute a final decision about the data subject.

9.3. Under art. 20 of the LGPD, the data subject may request review of decisions made solely on the basis of automated processing that affect their interests, as well as information about the criteria used, subject to commercial and industrial secrecy.

9.4. Management, evaluation, compensation or disciplinary decisions that may be based on the results are the responsibility of the controller contracting company, which is responsible for ensuring meaningful human oversight.

9.5. Processing by the artificial intelligence service. Calls to the AI service follow a Zero Data Retention regime, such that: (i) the data sent is not used to train models of Microsoft, OpenAI or third parties; (ii) HLB is approved for the modified abuse monitoring program, so there is no storage for abuse review and no human review by the provider; (iii) calls are made with the parameter store: false, so that nothing is persisted by the provider; and (iv) only real-time automated safety analysis remains, without storage.

9.6. WhatsApp channel. When the User chooses to record time entries through the WhatsApp channel, the content of the messages is processed by artificial intelligence to extract the time-entry fields (client, matter, description, activity type, cost center, date and time). Voice messages sent by the User are automatically transcribed by the same service, and the transcription is used for the entry. This processing is subject to the no-retention regime described in item 9.5.

10. Sharing and recipients

10.1. HLB shares data only to the extent necessary for the purposes of this Policy, with recipients acting as processors or sub-processors, under documented instructions and security and confidentiality obligations, or when required by law.

Category of recipient	Purpose	International transfer
Cloud and AI provider (Microsoft — Azure and Azure OpenAI Service)	Hosting, processing and classification of captured activities	Yes — see Section 11
Messaging provider (Meta Platforms — WhatsApp Business Platform)	Operation of the WhatsApp time-entry channel and communication with Users and customers	Yes — see Section 11
Customer’s legal practice management ERPs (e.g., Legal One, Legal Desk, Legalmanager)	Reading the client and matter database and automated posting of time entries, including through automation (RPA)	Depending on the Customer
Error monitoring and telemetry tool	Fault detection and service stability	Yes — see Section 11
Payment, accounting and commercial tool providers	Billing, collection and commercial management	Depending on the provider
Legal advisors and the DPO (Bonuz do Brasil Assessoria Empresarial Ltda.)	Compliance, handling of data subject requests and defense of rights	As a rule, no
Public and regulatory authorities	Compliance with legal obligation or order of a competent authority	Case by case
Third parties in corporate reorganizations	Merger, acquisition or restructuring transactions, preserving the purpose	Case by case

10.2. HLB does not sell personal data or share it for purposes incompatible with those disclosed.

10.3. In processing by artificial intelligence, in addition to Activity Data, the content sent to the service includes lists provided by the Customer — such as lists of clients, matters, cost centers and activity types —, necessary for classification and time entry, and subject to the same no-retention regime described in item 9.5.

10.4. In the integration with the Customer’s legal practice management ERPs, HLB reads the client and matter database and returns the time entries to those systems, including through automation (RPA), holding the corresponding access credentials in custody, protected as set out in Section 13.

10.5. On the WhatsApp channel, the User’s messages pass through the infrastructure of Meta Platforms (WhatsApp Business Platform), as provider of the messaging service, and are processed by artificial intelligence as set out in item 9.6.

11. International data transfer

11.1. Certain operations involve international data transfer, notably processing by cloud and artificial intelligence services, the messaging platform used on the WhatsApp channel and the error monitoring and telemetry tool, hosted in the United States of America. The AI resource operates in the Global Standard deployment type, so processing may take place in any geography in which the model is deployed, with data at rest stored in the designated geography.

11.2. As of the date hereof, the United States is not the subject of an ANPD adequacy decision. The transfer therefore complies with art. 33, item II, sub-item “b”, of the LGPD and with the International Data Transfer Regulation (ANPD Board Resolution No. 19/2024), through the adoption of the standard contractual clauses approved by the ANPD, incorporated in full and without alteration into the contracts with the importers.

11.3. Transfers are accompanied by contractual and technical safeguards that ensure compliance with the principles, the data subject’s rights and the protection regime of the LGPD.

11.4. The data subject may request the full text of the clauses applicable to the transfer, within 15 (fifteen) days, through the channel in Section 16, subject to commercial and industrial secrecy.

12. Retention and deletion

12.1. Data is retained for as long as necessary to fulfill the purposes, to meet legal and regulatory obligations and for the regular exercise of rights, according to the criteria below.

Category of data	Retention period/criterion
Visitor and prospect data	For as long as there is a legitimate commercial interest or until the data subject objects/unsubscribes.
Customer registration and contractual data	During the contractual relationship and for the subsequent legal and limitation periods.
Tax and payment data	For the periods required by tax and accounting legislation.
Activity Data (as processor)	According to the instructions of the controller contracting company. In the absence of specific instructions, the following default maximum periods apply: (i) text content captured from permitted applications and text extracted by local OCR (items 5.2 and 5.3): up to 45 (forty-five) days from capture; (ii) applications and windows in use, window titles, addresses (URLs), periods of activity and inactivity and generated time entries: up to 12 (twelve) months from recording. The contracting company may request different periods, which will be formalized in writing. Upon termination of the contractual relationship, the remaining data is deleted or returned, subject to art. 16 of the LGPD.
WhatsApp channel messages and transcriptions	For as long as necessary to record the time entry and to evidence the User’s request, subject to the criteria applicable to Activity Data.
Application access logs	In accordance with applicable law and security needs.

12.2. Once the period or purpose has ended, the data is deleted or anonymized, except for the retention cases authorized by art. 16 of the LGPD.

12.3. Backup copies are overwritten in a cycle of up to 20 (twenty) days, after which deleted data also ceases to exist in those copies.

12.4. Time entries exported to the Customer’s management systems are then retained in those systems according to the Customer’s own criteria, outside HLB’s control.

13. Information security

13.1. HLB adopts technical and administrative measures capable of protecting personal data from unauthorized access and from accidental or unlawful destruction, loss, alteration, communication or dissemination (arts. 46 to 49 of the LGPD).

13.2. Measures adopted include, to the extent applicable: access control based on least privilege and strong authentication; encryption of data in transit and, where applicable, at rest; environment segregation; event logging and monitoring; backup routines; vulnerability management and secure development; supplier security assessment; and confidentiality commitments and staff training. They also include the protected custody of the credentials used in the integration to access the Customer’s management systems.

13.3. No environment is entirely immune to incidents; HLB maintains a process of continuous improvement of its security posture.

14. Security incidents

14.1. In the event of a security incident that may result in relevant risk or harm to data subjects, HLB will comply with the duty to notify the ANPD and the affected data subjects within 3 (three) business days of becoming aware of it, as set out in ANPD Board Resolution No. 15/2024.

14.2. When acting as processor, HLB will notify the controller contracting company without undue delay, providing it with the information necessary to fulfill its duties.

15. Data subject rights

15.1. Under art. 18 of the LGPD, the data subject may request: confirmation of the existence of processing; access to the data; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary or excessive data or data processed in non-compliance; portability; deletion of data processed on the basis of consent; information about sharing; information about the possibility of not consenting and the consequences; and revocation of consent. The data subject may also object to processing based on legitimate interest and request review of automated decisions (art. 20).

15.2. Requests for confirmation and access are answered in simplified form, immediately, or, by means of a complete statement, within 15 (fifteen) days (art. 19 of the LGPD). The service is free of charge, except in cases of abuse.

15.3. For the data subject’s security, HLB may adopt identity verification measures before fulfilling the request.

15.4. Where the data is processed by HLB as processor, the request is forwarded to and handled together with the controller contracting company.

15.5. The data subject may file a petition with the ANPD and with consumer protection bodies.

16. Data Protection Officer (DPO) and contact channel

16.1. The Data Protection Officer (DPO) for the processing of personal data, appointed by HLB under art. 41 of the LGPD and ANPD Board Resolution No. 18/2024, is Bonuz do Brasil Assessoria Empresarial Ltda., enrolled with the CNPJ under no. 36.454.710/0001-39, located at Rua Estados Unidos, 1140, Sala A, Jardim América, São Paulo/SP, CEP 01427-001, Brazil, represented by Marcelo Brisolla. The DPO acts as the communication channel between HLB, data subjects and the ANPD.

16.2. DPO contact: e-mail dpo@bonuz.it and telephone +55 (11) 99021-3852. Requests to exercise rights, questions and complaints relating to this Policy are received through this channel.

16.3. In the event of absence, impediment or vacancy, the DPO’s duties will be performed by the designated substitute, Arthur Braga Nascimento (e-mail arthur@bonuz.it; telephone +55 (11) 99439-5810).

16.4. The identity and contact details of the DPO and their substitute are published on timeshifter’s official website, in accordance with art. 41, §1, of the LGPD and art. 9 of ANPD Board Resolution No. 18/2024.

17. Cookies and similar technologies

17.1. The website uses only cookies and local storage technologies that are strictly necessary for its operation or for the features requested by the user. No performance, analytics, advertising or tracking cookies are used, nor any third-party audience measurement or marketing tools. Visitors who do not log in or access pages with the support chat do not receive cookies from the website.

17.2. The cookies and technologies used are:

a) Authentication (__session and __txn_*): set only when the user logs in to the dashboard. The session cookie keeps the user logged in and expires after 1 (one) day of inactivity, 3 (three) days after login or on logout, whichever comes first. The transaction cookie protects the login process against request forgery and is deleted at the end of the login.

b) Support chat (cw_conversation, short-lived auxiliary cookies and the browser’s local storage): set by the chat widget, operated on timeshifter’s own server, on the pages where the chat is displayed. They allow an ongoing support conversation to be resumed and are valid for up to 12 (twelve) months.

17.3. Because they are necessary to provide the features requested by the user, these cookies are processed on the basis of performance of contract and legitimate interest (art. 7, V and IX, of the LGPD), in line with the ANPD’s Guidance on cookies, and do not depend on consent. For this reason, the website does not display a cookie consent banner.

17.4. The user may block or delete cookies at any time in their browser settings. Blocking the authentication cookies prevents access to the dashboard, and blocking the chat cookies prevents ongoing conversations from being resumed.

17.5. Should timeshifter start using non-necessary cookies, such as analytics or marketing cookies, they will only be activated with the user’s prior consent, through a mechanism that allows them to be accepted or refused, and this section will be updated.

18. Children and adolescents

18.1. timeshifter is intended for professional use in a corporate environment and is not directed at children and adolescents. HLB does not intentionally process data of minors in the context of the service (art. 14 of the LGPD).

19. Updates to this Policy

19.1. This Policy may be updated at any time. The current version, with its date and version number, is made available on timeshifter’s official website. Material changes are communicated through the appropriate channels.

19.2. This Policy is governed by Brazilian law.

Contents

1. Introduction