Terms and Agreements

Siteware is an IT company that provides specialized tools to simplify performance management in organizations, primarily under the Software as a Service (SaaS) model. Our applications are used by companies around the world.

Here we explain how data is handled throughout the information lifecycle—collection, processing, retention, protection, and management—with particular emphasis on information that may be considered personal data under the strictest market standards.

The Siteware platform is available only to organizations (B2B), our customers, and solely for business purposes. Our customers' employees are the users of the systems we provide. Personal data processed by the systems we provide is related only to these users' professional activities.

When you contract our solution, browse our website, complete our commercial forms, or interact with our channels, social media, and help center, Siteware will act as the "data controller" with respect to the personal data you provide.

If you (whether a customer, user, or visitor to our website) do not agree with the terms presented here, please do not use the Siteware platform or access our website. By using our applications and/or website, you acknowledge the content of this Policy and agree to be legally bound by all conditions set forth herein.

Whenever there is a change in how our software handles information that may be considered personal data, we will update and publish a revised version of this Policy.

If you have any questions, please contact our Data Protection Officer (DPO) at: [email protected]

Version History

What You Will Find in This Document

• What are Siteware's main products?
• What information do Siteware products collect? How is it used and shared?
• What may be considered personal data? How is it used and shared?
• How is information protected in Siteware applications?
• How long do Siteware applications retain this information?
• How do Siteware's artificial intelligence connectors (Claude and ChatGPT) work?
• What other data collection tools do Siteware applications use?

What are Siteware's main products?

The Siteware platform is made up of applications that support strategic management and goal tracking to improve business management, from the C-suite to frontline operations. Examples of available modules include:

• Corporate Performance: Monitoring Strategic Objectives, KPIs, and OKRs, enabling top-down deployment of goals and bottom-up consolidation of results.
• Variable Compensation: Calculation of managers' bonuses based on achieved goals. Competency Assessment, Feedback, and Individual Development Plan.
• Improvement Opportunities: Continuous process improvement through methodologies for Problem Analysis and Resolution using Action Plans.
• Meeting Management: Management of the entire meeting lifecycle, from convening the meeting and proposing the agenda through drafting and approving the minutes and tracking agreed decisions.
• Visual Management (exclusive to the Stratws One offering): Creation of dashboards and management reports.
• Project Portfolio Management (exclusive to the Stratws One offering): Project Portfolio Management through a framework incorporating project management best practices.

The modules are natively integrated. Adoption of the platform is flexible, and the modules share the same philosophy and a common core. Our customers typically start with 2 or 3 modules and gradually add others.

What information do Siteware applications collect? How is it used and shared?

Information is primarily collected to help organizational leaders monitor corporate performance. Data is shared only within the context of the organization that contracts with us, through the formal communication channels determined by that organization (emails, internal reports, dashboards, meetings, etc.).

Due to the nature and purpose of our applications, most data is corporate information. This information typically includes goals, KPIs, tasks, results, action plans, projects, and meeting minutes.

Customers and users should be aware that some information considered personal data under the strictest definitions is handled by our software, particularly information related to users' roles and professional activities.

What may be considered personal data? How is it used and shared?

Under the strictest standards, "personal data" means any information that may be used to identify a "user", directly or indirectly, either alone or in combination with other information. This includes corporate login and/or full name, email address, telephone number, photo, device IDs, certain cookie identifiers, network identifiers, and location identifiers.

When users are registered, the following fields are mandatory: name / username and email. Optional fields, when available, typically include CPF/ID, telephone, mobile phone, date of birth, marital status, gender, employee/registration number, management unit, leadership position, occupation, immediate supervisor, hire date, date appointed to the role, and photo.

Customer system administrators may choose, when creating a user, whether or not to complete the optional profile fields, if available. Users may update their own registration information.

The Siteware B2B platform does not store or request more sensitive personal information. In SaaS Premium versions, the software supports federated identity, which we recommend. In this case, access is provided through the customer's corporate directory, eliminating the need to store the user's access password.

When Siteware applications are used by a user, their activities are recorded for audit purposes. Under stricter definitions, this may be considered personal data. For example, when a KPI value is manually changed in the system, the name of the user who made the change is recorded, reflecting professional activities associated with that user's role. This meets commonly requested logging requirements (time and date + username + action + value).

User activities are also recorded in other situations, including system access, tasks, attached files, workflows, meetings, and other system objects. As in the previous example, this information is used for audit purposes.

The collection, use, and sharing of information relate to performance management and may vary depending on the modules used by customers. Check which Siteware application modules are used by your company. The most common features of each module are described below:

How is information accessed in Siteware applications? Who has access?

Once a user enters a valid username and password in a web browser, a secure connection is established using HTTPS (Hypertext Transfer Protocol Secure). After authentication, the user may access the company's business units for which permission has been granted by the customer's system administrator.

Siteware applications may only be accessed using a valid corporate email/ID. Login may use the customer's single sign-on mechanism in the SaaS Premium version with federated identity. Only authorized employees and contractors of the customer may access the system.

Siteware may occasionally access the customer's environment for support and maintenance. Access is restricted to certain support team members for investigation of specific issues and product team members for fixes and updates. Permissions are restricted by role-based access control policies applicable to these Siteware employees. Access is logged.

How is information protected in Siteware applications?

Siteware treats customer and user information as confidential and applies high security standards to protect this data through multiple layers of security controls.

• All data is encrypted in transit and at rest
• Communication over SSL channels with digital signatures
• Regular vulnerability assessments and penetration testing
• Siteware access to customer environments is restricted and logged
• Customers may optionally purchase a web application firewall with DDoS protection and other additional security features

Siteware implements additional measures to protect customer data against unauthorized or unlawful processing, accidental or unlawful destruction, accidental loss, unauthorized alteration, unauthorized disclosure or access, and any other unlawful form of processing of data in our possession.

In the event of any security breach in environments made available to our customers, we provide all support required by law. A security breach is understood as a potential exposure of information that compromises the confidentiality or integrity of stored data.

How long do Siteware applications retain this information?

Information is retained in the software for an indefinite period while the customer maintains its contract with Siteware. If the contract ends:

• The information remains available for 30 days after termination of the contract
• After this period, the data will be stored in backup
• The entire SaaS instance (application, database, and storage) will be shut down and deleted
• For security purposes, this backup is retained for 1 year and will then be permanently destroyed

How do Siteware's artificial intelligence connectors work?

Siteware provides connectors that allow artificial intelligence assistants—currently Claude by Anthropic and ChatGPT by OpenAI—to access information from your Stratws One account. The connection is optional and only occurs at your initiative: to activate it, you must authenticate using your Stratws One credentials and expressly authorize access.

Once connected, the assistant may view, create, and modify the same corporate information already described in this Policy—such as goals, indicators and their values, tasks, results, action plans, projects, management units, meeting minutes, and feedback—as well as your name and email address. Changes made by the assistant have the same effect as changes made directly by you on the Platform. The connector does not grant the assistant any access beyond what you already have: the same permissions that apply to you in Stratws One also apply to the assistant connected to your account.

The connector does not store the information it retrieves; it only intermediates between Stratws One and the assistant. Siteware keeps operational records of these connections, including date, time, and user identification, for the purposes of securing access and diagnosing failures, for a period of 30 (thirty) days.

Once information is sent to the artificial intelligence assistant, processing of that data is governed by the privacy policy of the platform you chose to use, rather than by this Policy. Siteware does not contract, control, or assume responsibility for processing performed by those platforms. Before activating a connector, we recommend reading the privacy policy of the corresponding platform:

• Anthropic (Claude): www.anthropic.com/legal/privacy
• OpenAI (ChatGPT): openai.com/policies/privacy-policy

Siteware does not use customer data to train artificial intelligence models.

You may disable the connection at any time by removing the connector from the artificial intelligence platform you are using. Once the connection is terminated, the assistant immediately loses access to information in your account.

What other data collection tools do Siteware applications use?

Our applications use cookies to collect data and improve the user experience in our web application. Siteware also uses third-party analytics tools such as Google Analytics, Power BI, Mixpanel, and others to measure engagement with the system.

When you visit our website, voluntarily complete our commercial forms, or interact with Siteware in various ways, different types of personal data may be collected:

• Business Contact Data: First name, last name, corporate email, telephone (WhatsApp), company name, job title, department, and other information that may be requested optionally and provided voluntarily.
• Commercial Agreement Data: Data relating to the legal representative and the contact responsible for the agreement (full name, email, CPF, address, telephone), company, CNPJ, and financial information. Information about employees or third parties responsible for the agreement may also be requested.
• Candidate Data: Name, email, telephone, field of work, identification document, LinkedIn profile, portfolio, and résumé. Other information may also be requested and collected during the recruitment process.
• Cookies: Cookies used by Siteware applications collect and encrypt application context information, such as the last business unit accessed through the customer's web application, thereby improving the user experience. Authentication cookies are also used to validate the secure connection.

For what purposes is personal data processed?

As a data controller, Siteware processes personal data in accordance with Brazil's General Data Protection Law (Lei Geral de Proteção de Dados — Law No. 13,709/18, or LGPD), as well as to pursue legitimate interests, both ours and yours. Specific purposes include:

• Providing and managing our services or products
• Improving and enhancing our services or products
• Processing your registration
• Preparing commercial proposals for our services or products
• Complying with contractual, regulatory, or legal obligations
• Performing banking integrations
• Exercising rights of defense in judicial, administrative, or arbitration proceedings
• Complying with decisions of administrative or judicial authorities
• Notifying you about changes to our services or products
• Handling complaints, questions, and requests through our support channels
• Conducting recruitment and selection processes
• Conducting audits
• Analyzing data to improve the usability, experience, and interactivity of our website
• Offering and/or providing recommendations more tailored to your needs or interests, including marketing campaigns or simulations
• Conducting communications and relationship marketing research to improve our services
• Using cookies
• Maintaining and updating registration data
• Supporting and promoting our activities

Personal data collected by us will be processed, in accordance with applicable law, for the period necessary to fulfill the purposes for which it was collected or to comply with applicable legal requirements. For more details, contact our Data Protection Officer: [email protected]

What rights do I have as a personal data subject?

As a data subject, you may contact Siteware, in its capacity as data controller, at any time to:

• Confirm whether your personal data is being processed
• Obtain information about how to access your personal data
• Correct or request correction of incomplete, inaccurate, or outdated data
• Obtain information about anonymization, blocking, or deletion of unnecessary or excessive data, or data processed in violation of the LGPD
• Obtain information about portability of your personal data to another service provider upon express request
• Request deletion of data processed on the basis of your consent, except where retention is legally required or otherwise permitted by law
• Obtain information about the public or private entities with which we share your data
• Obtain information about the possibility of refusing consent and about the consequences of such refusal
• Withdraw consent to the processing of your personal data, except in the circumstances provided for by applicable law

To exercise any of your rights, send an email directly to our Data Protection Officer, Mr. João Batista Lopes: [email protected]

If you are an employee, former employee, or supplier of one of our customers and wish to exercise your rights as a personal data subject, we recommend contacting the responsible customer directly.

If, even after submitting a request to us, the data subject still believes that the request was not properly handled, the data subject may file a petition with Brazil's National Data Protection Authority (ANPD).

Google API Services User Data Policy

The use and transfer of information received from Google APIs to any other application will comply with the Google API Services User Data Policy, including the Limited Use requirements.

What You Will Find in the Trust Center

• Information security practices and policies
• Certifications and compliance reports
• Vulnerability management and penetration testing
• Access controls and data privacy
• Responses to due diligence questionnaires and audits

For audit requests or compliance questionnaires: [email protected]

1. Introduction

1.1. This Service Level Agreement ("SLA") governs the warranties offered by SITEWARE to its CUSTOMERS regarding its Services and the performance of the Software.

1.2. This SLA applies only to SITEWARE CUSTOMERS and only to Services directly provided by SITEWARE.

2. Warranty Regarding the Services and Software Performance

2.1. SITEWARE provides a 99% availability warranty for the Software, as well as for the integration and operation of Corporate Performance, Improvement Opportunities, Meeting Management, and Visual Management.

2.2. However, SITEWARE shall under no circumstances be liable for service interruptions caused by failures in customers' Internet connections, nor for integration failures in the Software involving data entered by the CUSTOMER into another system.

2.3. The CUSTOMER acknowledges and agrees that provision of the Services may be affected or temporarily interrupted, in whole or in part, due to technical reasons or other circumstances, including weather events, repairs, maintenance, and replacement of equipment related to provision of the Services, or whenever SITEWARE deems it technically necessary to protect, as a preventive measure, the integrity of its system and the security of the CUSTOMER's systems and/or the systems of other customers (without this implying any liability on SITEWARE's part for the CUSTOMER's systems). The CUSTOMER acknowledges that such circumstances are inherent to services of this nature and will not constitute a breach of SITEWARE's obligations or result in any penalties or other consequences for SITEWARE.

3. Service Levels

3.1. Support ticket severity levels are as follows:

• Severity 1: An issue that renders the production solution inoperable and prevents its use for any type of operation;
• Severity 2: An issue that prevents a process or function from meeting its functional specifications and seriously affects the overall operation of the process or function, with no known workaround;
• Severity 3: An issue that partially prevents a process or function from meeting its functional specifications but does not seriously affect the overall operation of the process or function. Technical and functional inquiries, requests for clarification, and documentation requests are also classified as Severity 3.

Technical or functional inquiries and requests for clarification must be answered within 8 business hours.

3.2. Support tickets will be handled remotely by SITEWARE.

3.3. The response and resolution time for support tickets depends on the severity level assigned by the parties to the support/maintenance request, as described in the table below:

(*) Releases will be provided monthly. However, if a Severity 3 case is opened close to the release publication date (less than 48 hours beforehand), the case will be corrected in the following monthly release.

3.4. The Parties acknowledge that the support schedule shall follow the official calendar of the city of Belo Horizonte, Minas Gerais.

Cookies are categorized as necessary and stored in your browser because they are essential to the operation of the website's basic features.

We also use third-party cookies that help us analyze and understand how you use this website. These cookies will only be stored in your browser with your consent.

You may also choose to disable these cookies. However, disabling some cookies may affect your browsing experience.

Necessary

Necessary Cookies are essential for the website to function properly. These cookies provide basic functionality and security features anonymously.

Functional

Functional Cookies help perform certain functions, such as sharing website content on social media platforms, collecting feedback, and enabling other third-party features.

Performance

Performance Cookies are used to understand and analyze key website performance indicators, helping provide visitors with a better user experience.

Analytics

Analytics Cookies are used to understand how visitors interact with the website. These cookies help provide information about metrics such as number of visitors, bounce rate, traffic source, and others.

Advertisement

Advertising Cookies are used to provide visitors with relevant advertisements and marketing campaigns. These cookies track visitors across websites and collect information to deliver personalized ads.

Other

Uncategorized cookies are cookies that are being analyzed and have not yet been assigned to a category.