1. Introduction

This Privacy Policy explains how RenewBud collects, uses, stores, shares and protects personal data when you visit our website, create or use a RenewBud account, communicate with us, or otherwise interact with our services.

RenewBud is operated by MM Sistemas e Informática, registered in Brazil under CNPJ 42.188.885/0001-44, with its registered address at:

In this Privacy Policy, "RenewBud", "we", "us" and "our" refer to MM Sistemas e Informática and the RenewBud service.

"You" means a visitor to our website, an account holder, a user invited to a RenewBud workspace, a customer representative, supplier contact, prospective customer or other person whose personal data we process.

2. About RenewBud

RenewBud is a business software platform designed to help organisations track and manage subscriptions, licences, contracts, recurring costs, renewal dates, cancellation deadlines and related business information.

RenewBud is primarily designed for business and professional use.

3. Data Protection Laws

Depending on where you are located and how our services are provided to you, our processing of personal data may be subject to applicable privacy and data protection laws, including:

• Brazil's Lei Geral de Proteção de Dados Pessoais – Lei nº 13.709/2018 ("LGPD");
• the UK General Data Protection Regulation ("UK GDPR");
• the Data Protection Act 2018;
• the Privacy and Electronic Communications Regulations 2003 ("PECR"); and
• other applicable privacy and data protection legislation.

Where different laws apply, we seek to comply with the requirements applicable to the relevant processing activity and individual.

4. Our Role: Controller and Processor

Our role under data protection law depends on the circumstances in which personal data is processed.

4.1 When RenewBud acts as a controller

RenewBud generally acts as a controller when we determine why and how personal data is processed, including when we process:

• account registration information;
• billing and subscription information;
• website visitor information;
• customer support communications;
• security and fraud-prevention information;
• service usage information;
• marketing preferences;
• sales enquiries; and
• information required to administer our relationship with customers.

4.2 When RenewBud acts as a processor

Business customers may upload or create information within their RenewBud workspace that contains personal data relating to their employees, contractors, suppliers, customers or other individuals.

Where we process that personal data solely on the instructions of a business customer, the customer will generally act as the controller and RenewBud will generally act as a processor or operator on that customer's behalf.

In those circumstances, requests relating to that Customer Data should normally be directed to the organisation that controls the relevant RenewBud workspace.

We may assist that organisation in responding to data protection requests where required by applicable law or by our Data Processing Agreement.

5. Personal Data We Collect

The categories of personal data we collect depend on how you interact with RenewBud.

5.1 Account information

This may include:

• name;
• email address;
• company or organisation name;
• job title or role;
• account identifier;
• workspace membership;
• department;
• permissions and user role;
• language preference; and
• authentication and security information.

5.2 Billing information

This may include:

• billing name;
• business billing address;
• tax or company information;
• subscription plan;
• transaction history;
• payment status;
• invoice details; and
• limited payment-related identifiers received from our payment providers.

Where payments are processed by a third-party payment provider, RenewBud may not receive or store your full payment card number or complete payment credentials.

5.3 Customer workspace information

Customers may enter information relating to recurring business costs, including:

• subscription and contract names;
• supplier information;
• contract owners;
• employee names and business email addresses;
• departments;
• cost centres;
• renewal dates;
• cancellation deadlines;
• financial amounts;
• notes;
• vendor contacts;
• documents or attachments where supported;
• audit history; and
• other information entered by users.

5.4 Technical and usage information

When you access RenewBud, we may automatically receive technical information such as:

• IP address;
• browser type and version;
• device type;
• operating system;
• approximate location derived from IP address;
• login date and time;
• pages or features accessed;
• referring website;
• session identifiers;
• error logs;
• security events; and
• application usage information.

5.5 Communications

If you contact us, we may process information contained in your communications, including:

• support requests;
• emails;
• feedback;
• complaints;
• sales enquiries; and
• other correspondence.

5.6 Cookies and similar technologies

We may collect information through cookies and similar technologies.

Further details are provided in our Cookie Policy.

6. Information We Ask You Not to Upload

RenewBud is not designed to store highly sensitive personal information unless a particular feature expressly requires it.

You should not intentionally upload special category or sensitive personal data that is unnecessary for renewal management, including information concerning:

• health;
• racial or ethnic origin;
• religious or philosophical beliefs;
• political opinions;
• trade union membership;
• genetic or biometric identification data;
• sexual orientation or sex life;
• criminal convictions or offences; or
• government identification documents;

Customers are responsible for ensuring that personal data uploaded into their workspace is appropriate, relevant and lawful.

7. How We Use Personal Data

We may process personal data for the following purposes:

• creating and managing accounts;
• providing RenewBud services;
• managing subscriptions and billing;
• sending renewal reminders and service notifications;
• authenticating users;
• maintaining security;
• preventing abuse, fraud and unauthorised access;
• providing customer support;
• troubleshooting technical problems;
• maintaining audit records;
• improving the performance and reliability of RenewBud;
• understanding how our Service is used;
• communicating important changes;
• responding to enquiries;
• maintaining business and accounting records;
• complying with legal obligations;
• establishing, exercising or defending legal claims;
• sending marketing communications where permitted; and
• protecting the rights, property and security of RenewBud, our customers and others.

8. Lawful Bases for Processing

Where the UK GDPR applies, RenewBud will process personal data only where an appropriate lawful basis exists.

Depending on the processing activity, this may include:

8.1 Performance of a contract

We may process personal data where it is necessary to provide a service you have requested or to take steps before entering into a contract.

Examples include account creation, authentication, subscription management and delivery of paid features.

8.2 Legitimate interests

We may process personal data where necessary for our legitimate business interests or those of another party, provided those interests are not overridden by your rights and freedoms.

These interests may include:

• operating and improving RenewBud;
• protecting the Service from misuse;
• maintaining network and information security;
• understanding product usage;
• providing customer support;
• preventing fraud;
• maintaining business records; and
• communicating with business customers regarding our services.

8.3 Legal obligations

We may process personal data where necessary to comply with legal, tax, accounting, regulatory or law-enforcement obligations.

8.4 Consent

Where required, we may process personal data based on your consent.

Where consent is the lawful basis, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

9. Legal Bases Under the LGPD

Where the LGPD applies, RenewBud may process personal data under one or more lawful bases permitted by Brazilian law, including where processing is necessary:

• with the data subject's consent;
• for compliance with a legal or regulatory obligation;
• for the execution of a contract or procedures related to a contract requested by the data subject;
• for the regular exercise of rights in judicial, administrative or arbitration proceedings;
• for the protection of life or physical safety where applicable;
• for the protection of credit where applicable; or
• to meet legitimate interests of the controller or a third party, where permitted and balanced against the fundamental rights and freedoms of the data subject.

The lawful basis used will depend on the purpose and circumstances of each processing activity.

10. Marketing Communications

We may send marketing communications about RenewBud where permitted by applicable law.

Where consent is required, we will request it before sending the relevant marketing communication.

You can unsubscribe from marketing emails at any time using the unsubscribe link included in the communication or by contacting us.

Unsubscribing from marketing messages does not prevent us from sending transactional or operational communications required to provide your account or Service.

11. Transactional Communications

We may send communications necessary for the operation of RenewBud, including:

• account verification emails;
• password reset messages;
• security alerts;
• billing information;
• renewal reminders;
• workspace invitations;
• important service notifications; and
• changes affecting your account or subscription.

These communications form part of the Service and are not necessarily marketing communications.

12. Automated Decisions and Profiling

RenewBud may use automated processing to generate reports, identify potential duplicate records, calculate expenditure, estimate potential savings, classify renewals or highlight potentially unused or "ghost" subscriptions.

These features are designed to assist business users with decision-making.

Unless expressly stated otherwise, RenewBud does not make solely automated decisions that produce legal effects or similarly significant effects on individuals.

Customers remain responsible for reviewing information before making contractual, employment, financial, procurement or other business decisions.

13. Who We Share Personal Data With

We do not sell personal data.

We may disclose personal data to trusted third parties where reasonably necessary to operate RenewBud.

These may include:

• hosting and cloud infrastructure providers;
• database and storage providers;
• payment processors;
• email delivery providers;
• authentication providers;
• analytics providers;
• error monitoring and security providers;
• customer support providers;
• professional advisers such as accountants, solicitors and auditors;
• regulators and government authorities where legally required; and
• other service providers necessary to operate the Service.

Where these organisations process personal data on our behalf, we seek to put appropriate contractual and security protections in place.

14. Subprocessors

Where RenewBud acts as a processor on behalf of a business customer, we may engage subprocessors to provide infrastructure, communications, payment, security or other supporting services.

Where required by applicable law or contract, RenewBud will impose appropriate data protection obligations on subprocessors.

A current list of material subprocessors may be made available through the RenewBud website, customer documentation or Data Processing Agreement.

15. Payment Providers

Payments may be processed by external payment providers.

Those providers may process personal data independently under their own privacy notices and legal obligations.

RenewBud should not ordinarily store complete card details when payments are handled directly by a payment processor.

16. International Transfers

RenewBud is operated from Brazil and may use service providers located in Brazil, the United Kingdom, the European Economic Area, the United States or other countries.

As a result, personal data may be processed in countries other than the country in which you are located.

Where data protection laws require safeguards for international transfers, we will seek to use an appropriate transfer mechanism.

Depending on the applicable jurisdiction and circumstances, these safeguards may include:

• government adequacy regulations or decisions;
• approved contractual clauses;
• the UK International Data Transfer Agreement or applicable UK Addendum;
• standard contractual clauses approved by an applicable regulator;
• contractual provisions recognised by Brazil's ANPD;
• specific contractual clauses approved by an applicable authority; or
• another transfer mechanism permitted by applicable law.

Where required, we will also assess whether supplementary technical, contractual or organisational measures are appropriate.

17. Transfers Under Brazilian Law

International transfers of personal data originating in Brazil will be carried out in accordance with the LGPD and applicable regulations issued by the Autoridade Nacional de Proteção de Dados ("ANPD").

Where required, appropriate international transfer mechanisms may include adequacy decisions, standard contractual clauses approved by the ANPD, specific contractual clauses, binding corporate rules or another mechanism authorised by Brazilian law.

18. UK Representative

Where Article 27 of the UK GDPR requires RenewBud to appoint a representative in the United Kingdom, the representative's identity and contact details will be published in this section or otherwise made easily accessible to UK individuals and the Information Commissioner's Office.

UK Representative: To be confirmed where legally required.

19. Data Security

We use technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Depending on the nature of the processing, these measures may include:

• secure authentication;
• access controls;
• role-based permissions;
• password protection;
• encrypted communications;
• secure hosting infrastructure;
• database protections;
• logging and monitoring;
• backup procedures;
• software updates;
• security testing; and
• incident response procedures.

No internet-based system can be guaranteed to be completely secure.

20. Data Breaches

We maintain procedures intended to identify, investigate and respond to personal data breaches.

Where a breach is legally required to be reported, we will seek to notify the relevant supervisory authority and/or affected individuals within the time limits required by applicable law.

Where RenewBud acts as a processor, we will notify the relevant customer in accordance with applicable legal and contractual obligations.

21. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including to meet legal, accounting, tax, security and contractual requirements.

Retention periods may vary depending on the type of data.

We consider factors including:

• how long an account remains active;
• the nature and sensitivity of the information;
• why the information is required;
• legal retention obligations;
• potential disputes or legal claims;
• fraud-prevention requirements;
• security requirements; and
• customer instructions where RenewBud acts as a processor.

When personal data is no longer required, we will seek to delete, anonymise or securely dispose of it, subject to legal and technical requirements.

22. Account Closure

If a customer closes a RenewBud account, workspace data may remain available for a limited period where necessary to allow export, account recovery, dispute resolution or compliance with legal obligations.

After the applicable retention period, data may be deleted or anonymised.

Backup copies may remain for a limited additional period before being overwritten or deleted through normal backup rotation.

23. Your Rights Under the UK GDPR

Where the UK GDPR applies to you, you may have rights including:

• the right to be informed about how your personal data is used;
• the right to access your personal data;
• the right to correct inaccurate or incomplete personal data;
• the right to request erasure in certain circumstances;
• the right to restrict processing in certain circumstances;
• the right to data portability where applicable;
• the right to object to certain processing;
• the right to withdraw consent where processing is based on consent; and
• rights relating to certain automated decision-making and profiling.

These rights are not absolute and may depend on the lawful basis and circumstances of the processing.

24. Your Right to Object

Where we process your personal data on the basis of legitimate interests, you may have the right to object to that processing.

You have the right to object at any time to the use of your personal data for direct marketing purposes.

25. Your Rights Under the LGPD

Where the LGPD applies, you may have rights including the right to request:

• confirmation of whether your personal data is being processed;
• access to your personal data;
• correction of incomplete, inaccurate or outdated data;
• anonymisation, blocking or deletion of unnecessary or excessive data or data processed unlawfully;
• data portability where applicable and subject to applicable regulation;
• deletion of personal data processed on the basis of consent, subject to legal exceptions;
• information concerning entities with which personal data has been shared;
• information about the possibility of refusing consent and the consequences of refusal;
• withdrawal of consent;
• review of certain decisions made solely on the basis of automated processing where applicable; and
• other rights provided by applicable Brazilian law.

26. Exercising Your Rights

To exercise a privacy right, please contact RenewBud using the privacy contact details provided below.

We may need to request information reasonably necessary to verify your identity and protect personal data against unauthorised disclosure.

We will respond within the timeframe required by the applicable law.

Ordinarily, exercising your data protection rights is free of charge. However, applicable law may permit a reasonable fee or refusal in limited circumstances involving manifestly unfounded, excessive or repetitive requests.

27. Requests Concerning Customer Workspace Data

If your personal data was placed into RenewBud by your employer or another organisation using RenewBud, that organisation may be the controller responsible for the data.

You should normally direct your request to that organisation.

Where appropriate, RenewBud will assist our customer in responding to your request.

28. Complaints

If you have concerns regarding how RenewBud processes personal data, we encourage you to contact us first so we can investigate.

Depending on where you are located and the law applicable to the processing, you may also have the right to lodge a complaint with a data protection authority.

United Kingdom

Individuals in the United Kingdom may have the right to complain to the:

Information Commissioner's Office (ICO)

Current contact and complaint information is available through the ICO's official website.

Brazil

Individuals in Brazil may have rights to submit matters to the:

Autoridade Nacional de Proteção de Dados (ANPD)

Current information concerning data protection rights and complaints is available through the ANPD's official government channels.

29. Cookies and Tracking Technologies

RenewBud may use cookies, local storage and similar technologies.

These technologies may be used for:

• authentication;
• security;
• session management;
• user preferences;
• performance monitoring;
• analytics; and
• marketing where permitted.

Cookies that are strictly necessary for the operation of RenewBud may be used without consent where permitted by applicable law.

Where consent is legally required for analytics, advertising or other non-essential technologies, those technologies should not be activated until consent has been obtained.

Please see our Cookie Policy for further information.

30. Children

RenewBud is a business service and is not intended for children.

We do not knowingly offer RenewBud directly to children or intentionally collect children's personal data through account registration.

If you believe that a child has provided personal information to RenewBud improperly, please contact us.

31. Business Transfers

If RenewBud or MM Sistemas e Informática is involved in a merger, acquisition, restructuring, financing, sale of assets or transfer of business, personal data may be disclosed to professional advisers, prospective purchasers or successor entities where legally permitted.

Appropriate confidentiality and data protection safeguards will be used where required.

32. Legal Disclosure

We may disclose personal data where reasonably necessary to:

• comply with applicable law;
• respond to a valid court order or legal process;
• respond to a lawful request from a regulator or authority;
• establish, exercise or defend legal claims;
• investigate fraud or misuse;
• protect the safety or rights of individuals; or
• protect RenewBud, our customers or our systems.

33. Links to Third-Party Websites

RenewBud may contain links to third-party websites or services.

We are not responsible for the privacy practices of independent third parties.

You should review the privacy policy of any third-party service you choose to use.

34. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to RenewBud, our service providers, applicable law or our data protection practices.

The latest version will be published on the RenewBud website together with its updated revision date.

Where changes are material, we may provide additional notice through the Service or by email where appropriate or legally required.

35. Privacy Contact

Questions, requests or concerns relating to this Privacy Policy or the processing of personal data may be sent to:

36. Data Protection Contact / Encarregado

Where RenewBud is legally required to appoint a data protection contact, Data Protection Officer, Encarregado or equivalent representative, the applicable contact information will be made available here.

Privacy / Data Protection Contact: Fernando Magalhaes
Email: renewal@renewbud.com