Privacy Policy

What is the purpose of this Privacy Policy?

This Privacy Policy describes how we collect and use personal information about you, in accordance with the Brazilian General Data Protection Law (Law No. 13.709 of August 14, 2018), also known as the LGPD, and any other applicable laws and regulations in Brazil (Data Protection Legislation).

It is important that you read this Privacy Policy together with any other privacy or data processing policy that may be provided to you when we are collecting or processing your personal data, so that you are fully aware of how and why we are using your data. This Privacy Policy supplements any other notices we may provide to you and is not intended to override them.

Who we are

EXP BRASIL CONSULTORIA IMOBILIARIA LTDA. is a company incorporated with the Commercial Registry of the State of São Paulo, Brazil, registered with the National Registry of Legal Entities under number 40.812.440/0001-68, at Av. Brigadeiro Faria Lima, No. 4221, 1st floor, Itaim Bibi, São Paulo, ZIP 04.538-133 ("eXp Global Brasil"), qualified as a "Data Controller" for purposes of Law No. 13.709 of August 14, 2018 – Brazilian General Data Protection Law (LGPD).

In this Privacy Policy, references to "eXp", "we", "us" and "our" refer to eXp Global Brasil.

How we collect personal information

We generally obtain information about you on a voluntary basis when you use our websites, for example:

• (i) when you fill in forms on our websites, subscribe to any service, participate in surveys or contests, submit requests, when you send or provide information such as property searches and preferences or any other personal information related to the process of searching for properties to buy or sell, or when you contact us about eXp services;
• (ii) we collect details of your visits to our websites, including traffic data, location data, weblogs and other communication data, and the resources you access.
• (iii) if you contact us online or by telephone, post, email or social media, we may keep a record of those communications.

We may also obtain your personal data from the following third-party sources ("third-party sources"), such as:

• i) public online platforms, social media platforms (including people with whom you are friends or otherwise connected),
• ii) from eXp independent brokers and agents. Information you may have given to an independent broker with whom you have a pre-existing relationship.
• iii) from public databases, such as property held by public entities, registries and agencies.

If you are an eXp agent, in addition to the sources above, we will obtain information about you when you register with us as an eXp agent and during the course of our interactions with you as part of that relationship, including through your use of your back office and approved company channels, including online platforms, electronic communications and official company materials provided to you.

If you are a job applicant at eXp, we use the information you provide to us to build your candidate file. However, we may also contact third parties (for example, recruitment agencies, former employers, internship supervisors or clients with whom you worked in prior roles) to collect information about you in order to assess your application or profile.

We may enrich or combine the information you provide to us with information we obtain about you from third parties, primarily for commercial or marketing purposes.

Categories of Personal Data we collect

Various categories of personal data relating to you may be collected, depending on the nature of your relationship with us (for example, a customer or prospective customer, eXp agent or applicant, job candidate, service provider or visitor), the purpose for which the data is required and our legal and regulatory obligations.

In particular, the following categories of personal data are processed:

• Identification data: this includes data such as title, first and last name, contact details (email address, telephone number, postal address);
• Technical data, such as IP address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on devices used to access the Company's websites and other online services, files downloaded or entered on the site;
• Data relating to the monitoring of your relationship with eXp: contact requests, information or documentation, digitized physical letters that were exchanged;
• Data relating to family (number, characteristics, etc.), personal (core interests, hobbies, etc.) or professional situation (employment, workplace, etc.) of customers and prospective customers;
• Data relating to real estate preferences or projects and properties (address, number of rooms, living area, etc.);
• Data useful for carrying out real estate agency activities and the relationship with customers;
• Data necessary to carry out customer loyalty, prospecting, studies, surveys, etc.;
• Information and documents (resume and recommendation letter) provided in the context of job applications, as well as information we may collect for this purpose in recruitment operations (school and university education, training and diplomas, professional experience and career, information relating to professional life in general, economic or financial information, information relating to personal life where applicable, etc.).

Information required by "know your customer", anti-money laundering or criminal legislation procedures — some of this information we may request or obtain from third parties.

Financial and Transaction Data (bank account, credit card details, payments to and from eXp and other details of products and services you purchased from or provided to eXp).

In particular, for job candidates, resume data relating to identity, training, experience, references obtained from previous employers and/or educational services.

How we use information

We may process your personal data for purposes necessary for the performance of a contract with you, for example, for the processing or fulfilment of the provision of our services, and to comply with our legal obligations.

We may process your personal data for the purposes of our own legitimate interests, provided those interests do not override any of your own interests, rights and freedoms that require protection of personal data. This includes processing for marketing, business creation, development, management, statistical and research purposes, which will include analysis and tracking of transactions and creation of marketing profiles.

We may process your personal data for certain additional purposes with your consent, and in those limited circumstances where your consent is required for the processing of your personal data, we will obtain your separate consent at that time and you will also have the right to withdraw your consent for those specific processing purposes (see the 'Right to withdraw consent' section below).

Please note that we may process your personal data under more than one legal basis, depending on the specific purpose for which we are using your data.

Purpose and Legal Basis for processing

When processing your personal data, the purpose and legal basis include the following, to the extent they apply to you:

• to perform customer services and fulfil our contractual obligations toward you, and on the basis of our legitimate interests, or the legitimate interests of our customers, to provide the best possible customer service;
• to support our business processes, including our information technology, electronic communications and electronic document storage, management and transmission, to fulfil our contractual obligations toward you, or, if not applicable, on the basis of our legitimate interests, to provide the best possible customer service, to support our business operations, administration, IT services and network security, and to prevent fraud;
• to safeguard your personal data and our IT systems with appropriate security, on the basis of your and our legitimate interests in such security;
• to exchange information, conduct due diligence and answer your initial questions, to take steps required to enter into a contract with you, or for the purposes of our legitimate interests in protecting our rights and third parties' rights, or, if not applicable, on the basis of your consent;
• in the case of a prospective employee, for recruitment purposes, including in the context of a selection and recruitment procedure, to take steps prior to entering into an employment relationship or contract with you or based on pre-contractual measures - we will not process any categories of sensitive personal data except where we are able to do so under applicable legislation or with your explicit consent.
• to keep you up to date with real estate news and offers that may be of interest to you, on the basis of your consent or our legitimate interests in using your personal data for marketing purposes;
• to present our websites and online content in the best possible way for you and on your computer, on the basis of our legitimate interests in keeping our websites updated and relevant, to develop our outreach and business operations, and to develop our marketing strategy;
• for business transactions such as a merger, acquisition by another company, or sale of all or a portion of our assets on the basis of our legitimate interests in selling or expanding our business operations; and/or
• to comply with legal and regulatory requirements applicable to us (including the need to prevent and combat money laundering).

If you are an eXp Agent, we may process your personal data for the following additional purposes:

• Processing the eXp Agent's application and Independent Contractor Agreement, in order to take steps toward entering into the contract;
• Providing support services to the eXp Agent, such as planning and facilitating meetings and training, related to performance of the eXp Agent contract or eXp's legitimate interest;
• Administering the eXp Agent's benefits, including under the Revenue Share Plan, related to performance of the eXp Agent contract;
• Developing and implementing policies, marketing plans and strategies related to eXp's legitimate interest;
• Publishing personal information in the Company's newsletters, promotional materials and company and intra-group communications, related to eXp's legitimate interest;
• Complying with applicable laws and regulations and assisting with any governmental or police investigation; and

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

Recipients of Personal Data

We share personal information with third parties where required by law, where it is necessary to administer our relationship with you or where we have another legitimate interest in doing so.

eXp may share personal information with the following categories of third parties:

• Other entities within the eXp group and the employees, directors and managers of eXp and its local and foreign associated/affiliated companies who need to access your personal information in carrying out their responsibilities; and
• eXp Agents, including Sponsors and higher-level eXp Agents who may need access to the personal information of lower-level eXp Agents in order to monitor sales activity and business development in their revenue share groups.
• Any agent, contractor, supplier or third-party service provider who provides administrative, payment processing, IT, marketing, printing, shipping, fulfilment, web tools, fraud prevention or other services to eXp or its affiliated companies.
• Professional advisers including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, security, insurance and accounting services.
• tax authorities, regulators and others who require reporting of processing activities in certain circumstances.

Where our third-party service providers act as our data processors, they are required to take appropriate security measures to protect your personal information and we do not allow those third-party service providers to use your personal data for their own purposes; we only permit them to process your personal data for specified purposes and in accordance with our instructions.

However, certain third-party service providers, such as payment gateways and other payment transaction processors, have their own privacy policies in respect of the information we are required to provide to them for your purchase-related transactions. For these providers, we recommend that you read their privacy policies so you can understand the manner in which your personal information will be handled by these providers.

We may share your personal information with third parties, for example in the context of a possible sale or restructuring of the business. We may also need to share your personal information with a regulator or to comply with the law.

Transfer of personal information outside Brazil

To carry out the purposes mentioned in this policy, your personal data may be transferred to our parent company, eXp international holding inc., based in the USA, and other business partners based outside Brazil (e.g. social media platforms).

Whenever we transfer your personal data outside Brazil, we request your consent for that purpose, or we ensure a similar degree of protection to that afforded to you by the LGPD, by implementing at least one of the following safeguards:

• We transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by Brazil's National Data Protection Authority - ANPD.
• Where we transfer your personal data to a data controller or processor outside Brazil in a country that has not been deemed to provide an adequate level of protection for personal data by the ANPD, eXp will use specific contractual clauses to cover and protect such transfer or standard clauses indicated by the ANPD.

Data retention

We will retain your personal data only for as long as necessary to fulfil the purposes for which it is collected, the retention period being determined by the nature and duration of your relationship with us, and by applicable legal requirements.

If you request that we stop sending you marketing materials, we will continue to keep a record of your contact details and appropriate information to enable us to comply with your request not to be contacted by us.

Data Subject Rights

In accordance with the LGPD, you have the right to:

• request confirmation of processing related to you and access your personal information. This enables you to receive details of the personal information we hold about you;
• Request correction of the personal information we hold about you if it is incomplete, inaccurate or out of date;
• Request anonymization, restriction or deletion of your personal information if it is unnecessary, excessive or processed in breach of the LGPD;
• Request transfer of your personal data to another service or product provider, in accordance with ANPD regulation (data portability);
• Request deletion of your personal data relating to activities processed based on your consent;
• Request information about the public and private entities with which we share your personal data;
• Request information about the possibility of not consenting to the processing of your personal data, where applicable, and the consequences of such refusal;
• Withdraw consent you have already given for any processing activity;
• Object to the processing of your personal data in case of unlawful processing;

If you wish to exercise any of the rights above, please contact us through the contact form here.

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any other right). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Questions Regarding this Policy / Contact Details

If you have any questions regarding this Privacy Policy, you can contact us by post at 4221 Brigadeiro Faria Lima Av., 1st floor, 04538-133 São Paulo, São Paulo Brazil or by email: privacy@expglobalbrasil.com.br. Please mark all emails on this subject with: "Data Protection".

If you are not satisfied with our response or believe we are not processing your personal data lawfully, you may also complain to the National Data Protection Authority – ANPD.