LGPD — Data Protection

Our Commitment to the LGPD

NAVROZ PARTICIPAÇÕES LTDA (CNPJ 64.335.226/0001-26), operator of the Geniau platform, is committed to full compliance with the General Data Protection Law (Lei n.º 13.709/2018 — LGPD), ensuring transparency, security, and respect for the rights of data subjects.

Legal Bases for Data Processing

All personal data processing carried out by Geniau is grounded in one of the legal bases set forth in Art. 7 of the LGPD:

• Data subject consent (Art. 7, I): used for sending marketing communications, newsletters, and non-essential cookies. Consent may be revoked at any time, at no cost, by contacting suporte@geniau.com or through account settings.
• Contract performance (Art. 7, V): used for providing Platform services, including account creation, transaction processing, AI analysis generation, and delivery of business plans.
• Legitimate interest of the controller (Art. 7, IX): used for continuous improvement of the Platform, fraud prevention, anonymized statistical analysis, and information security. Legitimate interest is always weighed against the rights and freedoms of the data subject.
• Legal or regulatory obligation compliance (Art. 7, II): used for fulfilling tax and fiscal obligations and responding to requests from competent authorities.

Data Subject Rights (Art. 18 of the LGPD)

The data subject has the right to obtain from the controller, at any time and upon request:

• I — Confirmation of the existence of data processing;
• II — Access to data;
• III — Correction of incomplete, inaccurate, or outdated data;
• IV — Anonymization, blocking, or deletion of unnecessary, excessive, or non-compliant data;
• V — Data portability to another service provider;
• VI — Deletion of personal data processed based on consent;
• VII — Information about public and private entities with which the controller has shared data;
• VIII — Information about the possibility of not providing consent and the consequences of refusal;
• IX — Revocation of consent pursuant to § 5 of Art. 8 of the LGPD.

Requests will be answered within 15 (fifteen) business days, which may be extended for an equal period with justification, as per ANPD regulations.

Automated Decisions (Art. 20 of the LGPD)

Geniau uses artificial intelligence for idea analysis and business plan generation. These analyses are performed automatically and produce scores, indicators, and reports.

Pursuant to Art. 20 of the LGPD, the data subject has the right to request a review of decisions made solely based on automated processing of personal data that affect their interests. To request a review, please contact our DPO.

Important: scores and indicators generated by AI are exclusively informational and do not constitute binding decisions regarding credit, employment, or the data subject's rights.

Data of Minors

Geniau is not intended for persons under 18 (eighteen) years of age. We do not intentionally collect personal data from children or adolescents. If you become aware that a minor has used the Platform without authorization, please contact us so that the data can be promptly deleted, in compliance with Arts. 14 et seq. of the LGPD and the Child and Adolescent Statute (Lei n.º 8.069/90).

Security Incidents

In the event of a security incident that may pose a risk or relevant damage to data subjects, Geniau will notify the National Data Protection Authority (ANPD) and affected data subjects within a reasonable timeframe, pursuant to Art. 48 of the LGPD, providing:

• A description of the nature of the affected personal data;
• Information about the data subjects involved;
• An indication of the technical and security measures used;
• The risks related to the incident;
• The measures taken to reverse or mitigate the effects of the incident.

Data Protection Officer (DPO)

The Data Protection Officer, pursuant to Art. 41 of the LGPD, serves as the communication channel between the controller, data subjects, and the ANPD.

• Email: suporte@geniau.com
• Controller: NAVROZ PARTICIPAÇÕES LTDA
• CNPJ: 64.335.226/0001-26
• Address: Rua Min. Correia de Castro, 232, Vila Serralheiro, São Paulo/SP, ZIP 02.836-060

Complaints Channel — ANPD

If the data subject believes that their personal data has been processed in violation of the LGPD, they may file a petition with the National Data Protection Authority (ANPD) through the website gov.br/anpd, pursuant to Art. 55-J, V of the LGPD.