SUMMARY BOX

FLAMENGO'S ROLE AS PROCESSING AGENT

CONTROLLER:

CLUBE DE REGATAS DO FLAMENGO

CNPJ:33.649.575/0001-99

Address: Avenida Borges de Medeiros, nº 997, Lagoa, Rio de Janeiro/RJ, CEP 22.430-041.

DATA SUBJECT RIGHTS

By law, you have the right, at any time, to:

•  Access the data we collect about you;

•  Change and correct your data;

•  Deny consent to data processing. However, this measure may make your objectives with FLAMENGO unfeasible. It is important to observe the necessity, and if you have questions, we recommend contacting us so that we can clarify them in detail. See the "Contact for your request" section at the end of the document

• Revoke previously given consent. However, note whether this measure will make your objectives with FLAMENGO unfeasible.

• Anonymization, blocking, or deletion of data. You do not want your personal data exposed in any way? We can do this, provided there is no law or regulation preventing us. Furthermore, such deletion may affect the way or make the provision of the service impossible, but we will explain better when this request occurs.

• Data portability. Portability has to do with the transfer of your data from one provider to another of the same nature. We do not expect you to change teams! But, if this right is applicable to our case someday, we will fulfill your request.

• Be aware of the partners and third parties with whom FLAMENGO shares your data.

ORIGIN OF PERSONAL DATA

Personal data is generally provided by the user and/or collected automatically upon the subject’s association, registration, and/or enrollment for access and/or use of services inside and outside the facilities of Clube de Regatas do Flamengo, whether as a local fan member, through embassies and consulates, admission as a permanent employee or third party allocated to the facilities, as an hourly teacher or athlete, self-employed person, bidder in tenders, suppliers or service providers, business partners, sponsors, licensees, auditors, celebrities, press, competent authorities, and interested or regulatory governmental entities.

PERSONAL DATA COMMONLY PROCESSED BY FLAMENGO

Basically, we collect name, affiliation (minors must have the consent of legal guardians), date of birth, place of birth, sex, telephone, email, address, identity card, CPF registration, official identification record (when foreign), and your facial biometrics, in case you are a fan member and wish to buy a ticket for a Flamengo match at Maracanã.

PURPOSES AND LEGAL BASES FOR PERSONAL DATA PROCESSING

Due to the nature of Flamengo's operations, there is a very broad diversification of personal data processing purposes, according to the subject's objective. For example, for Club members: identification data (registration), contact, financial history, medical certificates for school students, digital biometrics, images from CCTV cameras (for the physical security of our member and their children) and legal responsibility – if minor; for fan members: identification data (registration), contact, billing data, purchase history, and facial biometrics; for fans who are not fan members: registration data, purchase data, bank data and or credit card (which are stored in banking institutions), facial biometrics (for access to Maracanã); for employees: registration data, employee data for proof of employment bond, security (PIS, PASEP, NIS, E-social, among others) and benefit maintenance; for athletes, in addition to the previously mentioned data, health and physical performance data is needed, to enable health care inherent to the exercise of the function; for third parties: registration data, document images, contractual data (for hiring), digital biometrics for access to facilities and physical security, and payment history. for access to facilities.

Generally, we carry out the following processing activities:

- Access, Registration and/or Cadastro (Enrollment): registration of employees or third parties for access to Club facilities for leisure or work purposes, to sponsor, market licensed products, participate in tenders, supply and/or provide services. In relation to Club members or athletes, to exercise rights and obligations as a member or athlete, according to their sport; if a fan member, for identification and exercise of the rights offered by the acquired plan. Documents and/or certificates regarding health conditions are used to attest to health fitness, according to the nature of the data subject, necessity, legislation, regulation, and objectives. All these registrations are linked to the legal basis of contract execution, preliminary or otherwise, agreed upon between the parties. We collect digital biometrics for access to Club facilities, as a form of security for members, employees, and third parties, and facial biometrics for entry to the Mario Filho Stadium (Maracanã) as required by Law No. 14597 of June 14, 2023, and in accordance with the Estádio Seguro (Safe Stadium) project, of which Flamengo will be part.flamengo-privacy-finalidade-acesso-p2

- Active Data Collection: when registering a Club member, employee, service provider allocated to Club facilities, members of embassies and consulates, or Fan Member and non-member fan, at a minimum, full name, email, CPF, cell phone number, date of birth, address, and purchase history are collected. In the case of minors, date of birth, affiliation, and the legal guardian's Consent Form are requested. Data processing may occur for checking the member's active registration, disclosing advertising material, promotions, sweepstakes, discounts, loyalty programs, satisfaction surveys, partner benefits, and for selling tickets for sporting events at Maracanã/others, or entry to the Flamengo Museum. These cases will fall under the same legal bases as access, registration, or enrollment.

- Automatic Data Collection: FLAMENGO collects and/or shares a series of information automatically – directly or via API (Application Programming Interface), such as those actively collected or access, registration, or enrollment information from your electronic or digital equipment, characteristics of your phone or PC, browser, IP (with date and time), IP origin, click information, accessed pages, subsequent pages accessed after leaving the previous pages, or any search term entered on the websites or in reference to them, among others. For this, FLAMENGO uses some standard technologies, such as cookies, pixel tags, beacons, and local shared objects, with the purpose of, in addition to those described in access, registration, or enrollment, improving the User's browsing experience on the pages, according to their habits and preferences. And all of this relates to the legal bases of preliminary contract execution or even your legitimate interest in navigating well and quickly finding everything you want, based on what we provide as the best experience for you to stay with us.

NOTE: automatic collection of information through technologies, such as cookies* and caches, can be disabled through the settings of your internet browser and on our own website, specifically regarding cookies. However, the User must be aware that, by disabling these technologies, some features offered by the websites may not function correctly, as they depend on data processing for that purpose.

The collected information may eventually be shared by FLAMENGO with (i) partner companies, when necessary for the adequate maintenance, provision of service and/or participation of the data subject in a promotion, obtaining a benefit (in these cases, we rely on the prior and express consent of the user, which is granted through acceptance of the Terms of Use or contractual instruments, in accordance with the LGPD); and (ii) by judicial decision or request from a competent administrative authority. We may also share fan data with companies that commercialize ticket sales in cases of games where Flamengo is the visitor to maintain discounts on ticket purchases or to comply with specific state legislation.

- Communications and Marketing Initiatives: sending information or disclosing brands, products, promotions, and discounts from FLAMENGO, operationalization and dissemination to Club members or Fan Member programs, Embassies, and Consulates; also, for conducting satisfaction surveys and planning the offer of its own products and services and those of partners to employees, third parties, and customers. Communication and marketing initiatives are also linked to the execution of contracts with our partners, given the legal nature and business purpose, to compliance with a legal or regulatory obligation, in cases of communicating records, for example, labor issues and/or accidents with members, research (with the purpose of sizing or fostering promotions and advertising), exercising rights in judicial and administrative proceedings, health protection (when we carry out actions aimed at the physical or mental well-being of employees, members, or athletes) and/or credit protection, when we need to verify a condition to enter into agreements that require this action; remembering that everything depends on the purpose of the processing, as we are discussing all possible purposes here.

- Data Extraction, Production, or Reproduction: when we need to identify business opportunities or conduct research to size spaces, products, or services, we may carry out extractions, production, or reproduction of information from our databases to support the sizing and scope of an initiative or campaign. For example, to define the appropriate location for a soccer match based on the number of likely fan member ticket buyers. And we do this based minimally on the legal basis of contract execution, prior consent of the Club's legitimate interest, or the legitimate interest of the data subject.

- Data Reception: when you make any registration or enrollment with FLAMENGO, our direct employees or partners receive the information to carry out various processing activities, according to the purpose of the registration. The legal basis for reception also relates to preliminary contract execution or even a legal or regulatory obligation. In some cases, for health protection (incidents and accidents – service at health posts within FLAMENGO's facilities).

- Data Storage: personal data collected and processed by FLAMENGO remains in our databases and, by virtue of contract execution or even a legal or regulatory obligation, may be stored by suppliers and/or service providers. The collected information will be stored on our own servers or those contracted by us (IaaS) and for the time necessary for the implicit purposes, due to legal or regulatory obligations or authorized by the data subject. FLAMENGO uses reasonable market means and legally permitted ways to preserve the privacy of the data collected on its pages. Based on this, the precautions provided by the security standards guidelines established in Decree No. 8.771/2016 are adopted.

The information collected by FLAMENGO through its official pages will be automatically deleted from its servers if it ceases to be useful for the purposes for which it was collected, or when you request it. However, the information may be conserved for compliance with a legal or regulatory obligation, transfer to a third party, provided that data processing requirements are respected, and for the exclusive use of FLAMENGO, with access by a third party prohibited, provided the data is anonymized.

- Data Disposal, Elimination, Deletion: since we started the program to implement compliance with the General Data Protection Law and other privacy regulations from other countries, we have been observing disposal issues and striving to ensure that the disposal of printed materials, as well as the deletion of digital data, follow a secure process, whose goal is to eliminate the possibility of identifying a data subject due to inadequate elimination. Primarily, based on the legal basis of contract execution, whether with employees or third parties.

You must be aware that in some cases, the deletion of your information will not occur automatically, but upon your request, observing equally the cancellation rules established in the Terms of Use of some services, as well as the obligation to maintain them for a certain period for legal proof.

Finally, information necessary for filling out bank slips or payment by credit card is collected by FLAMENGO, but is not stored on FLAMENGO's servers.

SHARING DATA WITH THIRD PARTIES

We do not rent, sell, or share your information with third parties, except as described in this Privacy Notice.

Eventually, we may share information in the following ways:

•         with partners and service providers, so that they use personal data for the strict fulfillment of the purposes provided in contractual instruments and which relate to the activities carried out by FLAMENGO to achieve its results. However, they do not have any right to share the referred information without prior authorization: yours or FLAMENGO’s (when doing so to comply with a legal or regulatory obligation).

•          Our commercial partners, given the partnership, sponsorship, and brand strength, usually work with us to offer our members, fans, and customers opportunities arising from the partnership with FLAMENGO. Thus, we seek to minimize, but – due to business practice, we sign agreements for unidirectional or mutual sharing of databases to enable propositions of benefits, sales, and exclusive promotions from FLAMENGO or the commercial partner. All based on the legal bases of contract execution and legal or regulatory obligation (if the partner is a competent authority); of course, subject to your consent, which can be revoked at any time through the Data Subject Portal.

•          Consent: we may share your information in other ways if you request us to do so or if you have given us your consent, expressly and unequivocally.

•         Public Administration: your personal data may be shared with Public Administration bodies, that is, Public Powers and their legal representatives for legal or regulatory compliance and/or even by virtue of actions associated with the execution of public policies, such as those related to Health, Education, and Public Security in stadiums and for fans in general, for example. We will also need to share your information when there is a threat to the physical security of any individual, violations of this Privacy Notice or contracts, and, furthermore, to protect the legal rights of third parties, including our employees, fans, users, or the general public, naturally, through purposes associated with the legal bases of contract execution and preliminary, legal or regulatory obligation and/or protection of life.

NOTE: FLAMENGO's partner organizations are aware of and commit to the Club to respect, under the terms of this document and our internal guidelines, the protection and privacy of your data, under the terms of the LGPD or other related national or foreign laws, depending on the application.

COOKIES

  Cookies are files or information that can be stored on devices when a user visits FLAMENGO's website pages and accepts the use of Cookies. Generally, a cookie contains the name of the website that originated it, its lifespan, and a value, randomly generated.
FLAMENGO uses cookies to facilitate navigation and adapt the pages to your interests and needs. Cookies are also used to compile information about the use of our websites and services, which contributes to the improvement of our structures and content.
Another way we use cookies is to accelerate users' future activities and experiences on our pages. They can also be used to indicate FLAMENGO pages on the websites the user visited. FLAMENGO may share this information with third parties and business partners. But it is important to warn that you can (and should) choose your cookie usage options on the website(s). We provide this functionality, and you can change your preferences at any time. See the types we use below:
a) Necessary: are those that help understand how visitors interact with FLAMENGO pages, providing information about visited areas, time spent on the website, and any problems encountered, such as error messages.
b) Functional: are those that allow FLAMENGO pages to remember your choices to provide a more personalized experience. Furthermore, they allow users to watch videos and use social tools, comment fields, forums, among others.

c) Analytics and/or Performance: are cookies used to provide statistical information about our website - they are used to measure and improve performance.
This category is also known as Analytics. Activities such as counting page visits, page loading speed, bounce rate, and technologies used to access our website are included in this category.
d)  Advertising: are cookies used to provide content of interest to the User and display more targeted advertising or limit the number of times it is displayed on FLAMENGO Pages. It is also possible to allow the measurement of the effectiveness of an advertising campaign.
  After the user consents to the use of cookies, FLAMENGO stores a cookie on their device to remember this in the next session, and the user may revoke their consent regarding cookies when they deem it appropriate. Warning: if the user does not accept some cookies from FLAMENGO pages, certain services may not function optimally.
Third-party analytics are used to track and measure website usage, to enable the continuous production of attractive content. These cookies can track items such as the time you spend on the website or the pages visited, which helps us understand how we can improve the websites for you. New features are periodically tested, and subtle changes are made to how the website is presented. And these cookies can be used to ensure you receive a consistent experience while browsing, while FLAMENGO understands which optimizations our users appreciate most.

ADOPTED SECURITY MEASURES

• To seek compliance with privacy and data protection guidelines, FLAMENGO has continuously and progressively adopted technical and administrative measures to prevent data breaches, and we demand the same practice from our third parties. Basically, we invest in physical security and information technology resources; in maintaining an area dedicated to the topic of personal data privacy and protection, the Privacy Management; in training and awareness of our employees; in partnership with the Legal Department for the joint preparation of contractual clauses in agreements and contracts with our partners regarding good practices; in the use of techniques and tools commonly used in the market to provide security, within the acquisition possibilities that FLAMENGO and the third party have; and the continuous construction of a personal data governance system and audits aimed at continuous improvement. Among other measures, FLAMENGO: 

• Performs risk analysis of third parties before hiring;

• Uses standard and market methods to encrypt and anonymize collected data;

• Has protection against unauthorized access in systems and applications;

• Only authorizes access by previously established persons to the location where collected information is stored; 
• Those who come into contact with the information must commit to maintaining absolute confidentiality, being established that the breach of confidentiality will result, at a minimum, in civil liability; and;

• Maintains the digital inventory with indicators of moment, duration, identity of the employee or person responsible for access, and the object file, based on connection and application access records, as determined in article 13 of Decree No. 8.771/2016.

It is important to note that FLAMENGO makes its best efforts to preserve the privacy of user data. Thus, our integral guarantees are only valid for what is incumbent upon us for due protection, given that information circulating on the pages may be subject to unauthorized access perpetrated through methods developed to obtain information improperly that exceed the most recent standard security measures. For this reason, FLAMENGO recommends that users similarly adopt appropriate measures to protect themselves, keeping all usernames and passwords confidential, that is, do not share or allow the theft of your access data anywhere.

Any information provided by you will be collected and stored in accordance with security and reliability standards and will not be publicly available, provided, or commercialized under any circumstances. Unless there is a legal or judicial determination, or prior authorization from the data subject, personal information will not be transferred or used for purposes other than those informed by FLAMENGO.

INTERNATIONAL TRANSFER

The transfer can only be made to another country if it meets the requirements of article 33 of the General Personal Data Protection Law, especially its first clause, which states that the country or territory in question or the international organization concerned ensures an adequate level of protection for the user's data.

If there is no adequate level of protection, FLAMENGO will make greater efforts to protect your data in accordance with the most rigorous rules, through specific contractual clauses for a given transfer, standard contractual clauses, global corporate rules, or regularly issued seals, certificates, and codes of conduct.

We have some service providers such as AWS, Google, and Microsoft that maintain their Data Centers outside the country, but we prioritize using them in countries that have privacy agreements with Brazil or have specific legislation on data privacy and protection.

PRIVACY AREA AND DPO

FLAMENGO's Privacy Management is composed of a team of people dedicated to the governance and management of personal data privacy and protection. In it, we also have the figure of the “DPO” (Data Protection Officer), who is the professional designated, under the terms of the law, to mediate the relationship between FLAMENGO, its data subjects, and competent authorities on the matter. In Brazil, under the LGPD, he is called “Data Protection Officer”; but we use the acronym “DPO” because we also have business abroad where the acronym is widely used and recognized. This way, it facilitates general understanding.

The DPO of Clube de Regatas do Flamengo is Mr. Leandro Rocha, and you can contact him through the Data Subject Portal.

UPDATES TO THIS DOCUMENT

It is expected that we will make updates to our Privacy Notice over time (at least once a year). For those changes that require new prior authorization under the terms of the LGPD, we will contact you through any of FLAMENGO's channels (email, websites, application, etc.); however, if they are textual changes that do not fall into these cases, we will make our best efforts to communicate that there has been a change, but we ask you to maintain a periodic reading of this PRIVACY NOTICE.

CONTACT FOR YOUR REQUESTS

Meeting all your rights is FLAMENGO's commitment, under the terms of the LGPD and through our actions. Therefore, we provide a communication channel, the Data Subject Portal, so that you can open your requests and ask for any of your rights listed previously. Through it, you contact our DPO, and he will be responsible for returning responses to your requests. We provide the following ways to contact us:

Through the Flamengo website: https://flamengo.com.br/privacidade , click on Data Subject Portal.

Through the Fan Member website:https://mengo.com.br/privacidade

We provide a QR Code for immediate access via your mobile device.

LEGISLATION AND JURISDICTION