Data Processing Agreement — Crisarium

Version 1.0 · effective from October 5, 2026

This Agreement is part of the contract between the purchasing organization ("Controller") and Segurança em Jogo LTDA, Brazilian company number (CNPJ) 58.907.118/0001-88 ("Processor"), formed by the accepted order, the Terms of Use and the Refund Policy. It governs the processing of personal data that the Processor carries out on the Controller's behalf in Crisarium's plans for organizations, under the LGPD (Brazilian Law 13,709/2018, in particular Arts. 37 to 40) and, where applicable, the GDPR (Art. 28). In any conflict about personal data, this Agreement prevails.

1. Roles

• The Controller decides who takes part in the exercises, what data it sends and what it uses the results for. It is responsible for the legal basis for the processing and for informing participants.
• The Processor processes the data only to provide the contracted service, under this Agreement and the Controller's documented instructions. Using the platform according to its functions and configuring sessions are documented instructions.
• For the data it processes on its own account (administrator accounts, billing, platform security), the Processor is a controller, under the Privacy Policy.

2. The processing

3. Processor's obligations

The Processor:

• processes the data only under this Agreement and the Controller's instructions, and tells the Controller if an instruction appears to be unlawful;
• does not use the data for its own purposes, does not sell it and does not use it to train artificial intelligence models, its own or third parties';
• ensures that the people authorized to process the data are bound by confidentiality;
• maintains the security measures in Annex I;
• does not access session content (decisions, rationales, reports, crisis plan), except: (a) at the Controller's formal request; or (b) when the Controller authorizes, on the platform, access to a session's reports for quality control, an authorization it can revoke at any time. Each access is logged;
• helps the Controller respond to data subject requests (access, correction, deletion, explanation of an automated result), forwarding within 5 business days any requests it receives directly;
• helps the Controller with impact assessments and consultations with authorities, to the extent of the information it holds;
• makes available the information needed to demonstrate compliance with this Agreement (section 8).

4. Controller's obligations

The Controller:

• has a legal basis for the processing and informs participants. Before the first round, the platform shows each participant a notice screen stating what is recorded, who sees it and for how long;
• does not use the reports as the sole basis for decisions on hiring, promotion, compensation or dismissal;
• uploads to the adherence feature only documents it has the right to use, without unnecessary personal data;
• keeps its administrators' credentials secure.

5. Sub-processors

The Controller authorizes the sub-processors in Annex II, which lists, for each one, the activity, the data received, the place of processing and the transfer mechanism. The Processor signs with each one a contract that replicates the security, confidentiality and data protection obligations of this Agreement, and is liable for them to the Controller.

Changes: the Processor notifies the administrators by email 30 days in advance before adding or replacing a sub-processor. If the Controller objects on reasonable data protection grounds and the parties cannot reach a solution, it may terminate the contract with a refund proportional to the remaining term of the plan.

6. International transfers

The data is stored in Brazil. When a sub-processor processes it in another country, the transfer relies on:

• for the United States and other countries without an adequacy decision, the ANPD standard contractual clauses (ANPD Resolution CD/ANPD No. 19/2024), adopted in the Processor's contract with the sub-processor, including for any onward transfers it makes;
• for European Union countries, the adequacy decision (ANPD Resolution CD/ANPD No. 32/2026).

Each sub-processor's mechanism is listed in Annex II. For Controllers in the European Union, Brazil holds an adequacy decision from the European Commission; the European standard contractual clauses do not apply.

7. Security incidents

The Processor notifies the Controller of any security incident affecting the data under this Agreement without undue delay and within 24 hours of becoming aware of it, with the information available: nature of the incident, data and data subjects affected, likely consequences and measures taken or proposed. Missing information is sent as soon as it is obtained. Notifying the ANPD, other authorities and the data subjects is the Controller's responsibility, with the Processor's support; the Controller's regulatory deadline is short (3 business days with the ANPD), hence the deadline above.

8. Demonstrating compliance

The Processor keeps the security document, the sub-processor list and this Agreement published on the trust page. The Controller may send one security questionnaire per year, answered within 30 days. On-site audits only in the event of a relevant incident or an authority's requirement, with 30 days' notice, at the Controller's expense and without access to other customers' data.

9. Retention, return and deletion

Before deletion, the administrator can export the reports. At the Controller's request, the Processor deletes the data before these periods. A person removed by the administrator has their name, email and certificate removed from closed sessions; their decisions remain attributed to the role ("participant removed").

10. Liability

Each party is liable for the damage it causes by breaching this Agreement or data protection law, under the LGPD (Art. 42). The limitations in the Terms of Use apply, except where the law does not allow them.

11. Term

This Agreement remains in effect for as long as the Processor processes the Controller's data, including after the contract ends, until the data is deleted.

Version 1.0 · effective from October 5, 2026.

Annex I — Security measures

• Data stored and processed in Brazil (São Paulo), encrypted in transit and at rest.
• Separation between organizations in the database, with row-level policies and an automated test, on every change, that tries to read another organization's data.
• Participants sign in through a personal link sent by email, with no password; each use is logged. Administrators and internal staff use a password and a mandatory second factor, with lockout after 3 failed attempts.
• The browser never accesses the database directly; credentials are kept in protected cookies.
• Crisis plan: only PDF and Word files, checked by their content; files with suspicious signs are rejected; read in memory without storing the file; extracted text encrypted until confirmation; the AI reading is isolated, with no tools and no access to other data.
• Internal staff do not access session content without the Controller's request or recorded authorization; all administrative actions are kept in an audit log.
• Emails always identified as a simulation, never asking for a password or payment, with a public page for checking invitations.
• Pinned dependency versions and automatic vulnerability alerts.
• Our own incident response plan, exercised.

Annex II — Sub-processors and international transfers