Legal Information

DFSpro identification

These policies are maintained by:

Legal name: DFSO TECNOLOGIA DA INFORMACAO LTDA

Trade name: DFSPRO IT SOLUTIONS

CNPJ (Brazilian company tax ID): 31.609.116/0001-56

Public registered address: Avenida Anita Garibaldi, 850, Cabral, Curitiba/PR, CEP 80.540-400

Company email: go@dfspro.com.br

Email for privacy, personal data, cookies and legal requests: go@dfspro.com.br

Data protection officer: Douglas Oliveira

Data protection officer channel: go@dfspro.com.br

The address above is the company's public registered address, unless another operating, contractual or service address is stated expressly.

For personal data protection purposes, DFSpro may act as controller when it defines the purposes and means of processing personal data in its digital channels, forms, communications, newsletters, technical materials, commercial relationships, pre-contract processes, contracts and company activities.

DFSpro may also act as processor in specific situations where it provides services to clients and handles personal data on behalf of a client who is the controller, following that client's documented instructions. In these cases, the applicable rules must be set out in a contract, proposal, service order, data processing agreement, confidentiality agreement or equivalent instrument.

Definitions

To make these policies easier to read, the following terms apply:

Personal data: information about an identified or identifiable natural person.

Sensitive personal data: personal data about racial or ethnic origin, religious belief, political opinion, membership of a union or of a religious, philosophical or political organization, data about health or sex life, and genetic or biometric data, when linked to a natural person.

Professional data: personal data used in a business setting, such as name, work email, work phone, company, job title, area, role, unit, department and history of professional interaction.

Corporate information: information about the company the user represents, such as field of work, structure, operation, project, need, process, system, technology, SAP environment, tax tool, operating flow or commercial context.

Confidential information: non-public information of a tax, accounting, technology, financial, commercial, strategic, operational, contractual, system or technical nature, including internal documents, system screenshots, XML files, databases, reports, setups, logs, access details, credentials, tax codes, master data, configurations, and information about suppliers, clients or operations.

Data subject: the natural person the personal data refers to.

Controller: the person or company that makes decisions about the processing of personal data.

Processor: the person or company that processes personal data on behalf of the controller.

Subprocessor: a third party hired by a processor or supplier to support personal data processing activities.

Data protection officer: the person named to act as the communication channel between DFSpro, data subjects and the Brazilian National Data Protection Authority (ANPD).

Processing: any operation done with personal data, such as collection, receipt, classification, use, access, copying, transmission, distribution, processing, filing, storage, deletion, evaluation, change, communication, transfer or extraction.

Cookies and similar technologies: files, identifiers, pixels, tags, scripts, SDKs, analytics tools or technical mechanisms used for operation, security, measurement, personalization, communication or analysis of browsing.

Preliminary diagnostic: a conversation, first analysis, commercial survey, screening, exploratory assessment or pre-contract discussion held before a contracted technical scope is formalized.

Formal contracted diagnostic: a contracted technical activity, with the scope, assumptions, responsibilities, deliverables, limits and conditions defined in a proposal, contract, service order or equivalent instrument.

Privacy Policy

3.1. Scope

This Privacy Policy explains how DFSpro may collect, use, store, share, protect and delete personal data in its digital channels and company interactions.

It applies, among others, to:

• website visitors
• article readers
• newsletter subscribers
• people who fill in forms
• representatives of clients or prospective clients
• representatives of suppliers or partners
• participants in meetings, diagnostics, presentations or events
• people who interact with DFSpro communications

users who open links, technical materials, pages, content, forms or publications.

This policy does not fully govern processing done under specific contracts, projects, service work, client environments, support, AMS, formal diagnostics, integration, implementation, technical processing or contracted consulting. Those activities must be governed by their own instruments when needed.

3.2. Data that DFSpro may collect

DFSpro may process data that the user gives directly, including:

• name
• email
• phone
• company
• job title
• area or department
• city, state and country
• message sent through a form
• information given in a contact request, diagnostic, proposal, meeting or presentation
• communication preferences
• subscription, opens, clicks, unsubscribes and interaction with newsletters

information given in replies to invitations, events, surveys, forms or materials.

DFSpro may also process technical and browsing data, including:

• IP address
• date and time of access
• browser
• operating system
• device type
• pages visited
• traffic source
• browsing events
• campaign parameters
• cookie identifiers
• records of consent or preference

technical logs needed for the security, operation and protection of the website.

DFSpro does not ask, through public channels, for sensitive personal data, confidential tax information, internal documents, access credentials, passwords, system screenshots, databases, XML files, tax reports, third-party data, information about clients or suppliers, or details of a production environment.

If a user sends this kind of information on their own through an unsuitable channel, DFSpro may ignore, delete, block, return, restrict or minimally process it, depending on the purpose, the need, security, applicable law and the protection of rights.

3.2b. Data collected by specific forms

The website forms collect the following data:

• Diagnostic Request (/diagnostico): name, email, phone, company, job title, current SAP environment, use of GUEPARDO Tax (yes/no) and a free description of the tax pain reported.
• Contact (/contato): name and email (required); phone, company and ERP used (optional); subject and message (required).
• Conversation booking (calendar form embedded in /contato): name and email as set by the booking tool, phone, company, job title or role, current SAP environment, use of GUEPARDO Tax, main tax challenge reported, reason for the conversation and any extra details the user writes freely.
• DFSpro Radar (/radar): email only. The form does not collect name or company.
• Readiness Assessment (/avaliar-prontidao): email, at the point in the flow where the self-assessment result is delivered; the answers to the questionnaire itself are not linked to any identification other than this email.

3.3. Data processing matrix

DFSpro may process personal data as shown in the matrix below, subject to changes according to how the operation actually works:

DFSpro may review this matrix when new forms, tools, campaigns, integrations or services are put in place.

3.4. General purposes

Personal data may be processed to:

• answer requests
• keep company, technical or commercial contact
• send newsletters, articles, invitations and materials
• organize meetings, diagnostics, proposals and presentations
• provide technical content and in-depth materials
• manage forms, subscriptions and preferences
• measure the performance of pages, campaigns and communications
• improve the website, the browsing experience and the quality of content
• protect digital channels against fraud, abuse, spam, attacks or improper access
• meet legal, tax, regulatory, accounting, contractual and administrative obligations
• document the relationship with clients, prospective clients, suppliers and partners
• deliver the result of the Readiness Assessment tool and, when the risk level found is High or Critical, contact the user later to offer the Tax Diagnostic

protect DFSpro's rights in administrative, court, arbitration or out-of-court proceedings.

3.5. Legal bases

DFSpro may process personal data on the grounds set out in the LGPD (Brazil's General Data Protection Law), as the case requires:

• consent
• compliance with a legal or regulatory obligation
• performance of a contract or preliminary procedures related to a contract
• regular exercise of rights
• legitimate interest
• credit protection, when it applies

fraud prevention and the security of the data subject, when it applies.

DFSpro will not use one single legal basis for all activities. The legal basis will be assessed according to the purpose, the data subject's expectation, where the data came from, the B2B context, the need for the processing, the risks to the data subject's rights and whether a prior or contractual relationship exists.

3.6. Legitimate interest

When DFSpro uses legitimate interest as the legal basis, it will consider:

• the legitimate purpose of the processing
• the need for the data used
• the context of the B2B relationship
• the data subject's reasonable expectation
• the possible impact on rights and freedoms
• the safeguards in place
• transparency about the processing

the data subject's right to object, when it applies.

DFSpro may document a legitimate interest assessment, or balancing test, internally when the nature of the processing calls for it.

3.7. Data of company representatives

In B2B interactions, DFSpro may process professional data of representatives, employees, managers, directors, coordinators, analysts, consultants, suppliers, partners and corporate contacts.

When the user interacts on behalf of a company, the user declares to have the authority to do so and accepts that internal, technical, tax, system, financial, operational or strategic information of the organization must not be sent through public or unauthorized channels.

Confidential information, third-party data, tax documents, databases, credentials, system screenshots or details of a production environment may be shared only after the scope is defined, authorization is given, a suitable channel is chosen, the need can be shown and, when it applies, a specific confidentiality instrument is in place.

3.8. Sensitive data

DFSpro does not use its digital channels to collect sensitive personal data.

If sensitive data is sent on the user's own initiative through a public channel, DFSpro may delete it, restrict its processing or take other measures that fit the LGPD, as the case requires.

DFSpro does not ask for sensitive personal data to subscribe to the newsletter, download materials, use the contact form or browse the website as usual.

3.9. Data of children and teenagers

DFSpro's digital channels are aimed at a professional, corporate and business audience. DFSpro does not aim its content, forms or digital services at children or teenagers.

If improper processing of data of children or teenagers is found in public channels, DFSpro may delete it or restrict the processing, unless the law allows it or rights must be preserved.

Data Sharing, Processors, Third Parties and Subprocessors

4.1. Necessary sharing

DFSpro may share personal data with suppliers, processors, platforms and providers needed to run its digital channels, communications, security, commercial relationships, contracts and services.

These third parties may include:

• website, blog, CRM or CMS platforms
• newsletter and email marketing tools
• sales automation platforms
• hosting, cloud, security and monitoring providers
• analytics and measurement tools
• social networks and content platforms
• technology suppliers
• legal, accounting, administrative, commercial and operational providers

public authorities, when there is a legal obligation, a valid order or a need to defend rights.

DFSpro does not sell personal data.

4.2. Criteria for hiring and managing suppliers

DFSpro may assess suppliers using criteria in proportion to the risk, including:

• purpose of the processing
• categories of data processed
• volume of data
• location of storage or processing
• technical and administrative security measures
• existence of subprocessors
• retention policy
• track record of reliability
• availability of privacy documentation
• data protection contract clauses
• support channel

ability to respond to incidents.

Using well-known suppliers does not remove the need for a risk assessment, a review of settings and a check that the tool fits DFSpro's operation.

4.3. Tools that may be used

Depending on how the operation is actually set up, DFSpro may use tools such as:

DFSpro must keep an up-to-date internal list of the tools actually used, their purposes, the categories of data processed, the approximate location of the processing, the legal basis and the likely legal role.

4.4. Subprocessors

Some suppliers may use subprocessors or support providers. DFSpro will try to use suppliers that give reasonable information about their subprocessors, security measures, processing conditions and data protection mechanisms.

DFSpro does not fully control all the subprocessors that global technology platforms use, but it may assess whether the use of these tools is reasonable given the purpose, risk, criticality and alternatives available.

4.5. Third parties as independent controllers

Some external platforms may act as independent controllers for the data they process in their own environments. This may happen when the user interacts directly with LinkedIn, Substack, Google, Meta, YouTube, calendar platforms, social networks, embedded tools or third-party websites.

DFSpro does not fully control the privacy, security, cookie, retention or sharing practices of these third parties in their own environments.

4.6. International data transfer

DFSpro may use global suppliers of technology, hosting, analytics, newsletter, automation, security, CRM and social networks, which may involve storing or processing personal data outside Brazil.

In these cases, DFSpro will try to use suppliers that adopt contractual, technical and organizational mechanisms that fit the LGPD and recognized data protection practices, without prejudice to a specific assessment of the tools actually used.

Cookie Policy and Similar Technologies

5.1. What cookies are

Cookies are small files or identifiers stored in the user's browser or device while browsing a website. Similar technologies include pixels, tags, scripts, identifiers, analytics tools and measurement mechanisms.

These technologies can support technical operation, security, fraud prevention, audience measurement, performance analysis, personalization, communication, campaigns or integration with third-party tools.

5.2. Categories of cookies

DFSpro may use:

Necessary cookies: essential for operation, security, page loading, browsing, form submission, abuse prevention and keeping essential preferences.

Functional cookies: used to remember preferences, improve the experience, keep settings and make interactions easier.

Aggregated or strictly technical analytics cookies: used to understand general metrics of use, performance and stability, with no marketing purpose and no individual behavioral identification, depending on the settings that apply.

Behavioral analytics cookies: used to understand interactions, traffic source, browsing events, access journey and content performance, and they may depend on consent or on specific settings.

Marketing or measurement cookies: used to measure campaigns, understand conversions, build audiences, assess engagement, remarketing or targeting, when it applies.

Third-party cookies: set by external tools built into the website, such as analytics, pixels, video, social networks, newsletter, automation, CRM or content platforms.

5.3. Consent and preference management

Strictly necessary cookies may be used without consent, because they enable the basic operation and security of the website.

Cookies that are not necessary, especially behavioral analytics, advanced functional, marketing, remarketing, behavioral measurement or third-party cookies, must follow the preferences the user records through the banner, preference center or an equivalent mechanism, when one is in place.

The user may accept, reject or adjust cookies that are not necessary, according to the options provided.

The option to reject cookies that are not necessary must be shown as clearly as the option to accept, whenever it is technically possible and according to the tool used.

DFSpro must avoid banners that push the user to consent through confusing wording, buttons of unequal size, no option to reject, presumed consent, or installing cookies that are not necessary before the data subject gives valid consent, when consent is the applicable legal basis.

5.4. Cookie table

DFSpro keeps an up-to-date inventory of the cookies actually used, recording for each one the technology, the supplier, the category, the purpose, the duration, the applicable legal basis and whether it can be turned off. This inventory can be requested through the contact channels given in this policy.

5.5. Browser controls

The user can also set the browser to block, delete or limit cookies. Some features of the website may not work well if necessary cookies are blocked.

5.6. Contact about cookies

Questions about cookies, pixels, tags, analytics, trackers or similar technologies must be sent to:

go@dfspro.com.br

Retention, Deletion and Minimization

6.1. General criterion

DFSpro will keep personal data for the time needed to meet the stated purposes, taking into account need, suitability, security, legal obligation, contractual obligation, defense of rights, fraud prevention, audit and governance.

Whenever possible, DFSpro must limit collection, access and retention to what the legitimate purpose needs.

6.2. Reference periods

DFSpro may follow the reference periods below, subject to checking against how the operation actually works:

6.3. Deletion

Personal data may be deleted when:

• the purpose has been reached
• the data subject asks for deletion, when it applies
• consent is withdrawn, when that is the legal basis
• there is no need, legal obligation, legal basis or legitimate interest that justifies keeping it

a law, an administrative authority or a court requires it.

Deletion may be replaced by anonymization, blocking, minimal retention or restricted storage when there is a legal obligation, regular exercise of rights, fraud protection, audit or another case set out in law.

Data Subject Rights

7.1. Rights set out in the LGPD

The data subject may ask for the following, when it applies:

• confirmation that processing exists
• access to the personal data
• correction of incomplete, inaccurate or outdated data
• anonymization, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law
• data portability, under the applicable rules
• information about sharing
• information about the option not to give consent and its consequences
• withdrawal of consent
• deletion of data processed on the basis of consent, subject to legal exceptions
• objection to processing based on one of the cases where consent is not required, when the LGPD is not being followed

review of decisions made only by automated processing, when it applies.

7.2. Request channel

Requests must be sent to:

Email: go@dfspro.com.br

Data protection officer: Douglas Oliveira

Data protection officer channel: go@dfspro.com.br

7.3. Authentication and security

To protect data subjects, DFSpro may ask for extra information to confirm the identity of the person who makes the request, their authority, representation or link to the request.

DFSpro may refuse, limit or ask for more information when there is:

• a risk of fraud
• no way to identify the person safely
• a request made by an unauthorized third party
• a conflict with a legal obligation
• a need to preserve rights
• a trade or industrial secret
• an excessive, abusive or disproportionate request
• anonymized data
• no processing at all

a justified technical impossibility.

7.4. Record of requests

DFSpro may keep a record of the requests received, the answers given, the measures taken and the evidence of service, for the time needed to prove compliance, defend rights and give an account of its actions.

Data Protection Officer

8.1. Identification

DFSpro's data protection officer is:

Douglas Oliveira

Email: go@dfspro.com.br

8.2. Role

The data protection officer acts as the communication channel between DFSpro, the data subjects and the Brazilian National Data Protection Authority.

Duties may include:

• receiving requests from data subjects
• giving explanations
• passing demands on inside the company
• guiding the areas involved
• supporting privacy governance measures
• following the response to incidents, when it applies
• dealing with the ANPD when needed

supporting the documentation of processing, legal bases, suppliers and security measures.

8.3. Absence, replacement and outside support

In case of absence, unavailability, possible conflict, a serious incident, a formal complaint, a demand from the ANPD or a situation of greater legal complexity, DFSpro may call on outside legal support, specialized technical support or an additional internal person in charge, to make sure the demand is handled properly.

8.4. Conflict of interest

DFSpro must regularly assess whether the officer's role keeps a minimum of functional independence, has no relevant conflict of interest and can handle privacy demands properly.

When there is a possible conflict of interest, DFSpro may take compensating measures, such as outside legal support, independent review, separation of duties or technical support.

Information Security

9.1. Measures in place

DFSpro takes a proportionate approach to information security, in line with its size, its services, the tools it uses and the risks involved in processing personal data and corporate information.

The measures may include:

• access control on a need basis
• authentication in critical tools
• review of permissions
• contractual confidentiality with providers and employees
• supplier management
• account protection
• good storage practices
• limits on access to data
• incident records
• internal response procedures
• separation of information when it applies
• use of well-known market tools

internal guidance on personal data, confidential information and security.

9.2. Limits of security

No digital environment is free of risk. DFSpro does not guarantee absolute security, absence of flaws, uninterrupted operation, invulnerability, absence of attacks, outages or human error.

DFSpro works to reduce risks, to protect the integrity, confidentiality and availability of the information it handles, and to respond in proportion to events that may affect its digital channels.

9.3. Information sent through unsuitable channels

The user must not send through public forms, ordinary email or unprotected channels:

• passwords
• credentials
• API keys
• screenshots of SAP or GUEPARDO
• XML files
• tax documents
• databases
• information about clients or suppliers
• system logs
• spreadsheets with personal data
• sensitive personal data
• confidential tax information
• trade secrets

internal documents of their organization.

The email go@dfspro.com.br must not be used to send credentials, tax databases, system screenshots, XML files, internal documents, personal data in bulk or confidential information without an express request and prior guidance from DFSpro.

If this information is sent without an express request and a suitable channel, DFSpro may delete, block, restrict or ignore the material, with no obligation to analyze, store or return it.

Security Incidents

10.1. Internal procedure

In case of a security incident involving personal data, DFSpro may follow an internal procedure to:

• identify the event
• contain the exposure
• assess the nature, category and volume of the data affected
• assess the risk or relevant harm to data subjects
• preserve evidence
• record the measures taken
• inform the internal parties that need to know
• call on suppliers, when it applies
• assess the need to report to the ANPD and to data subjects

review controls to reduce the chance of it happening again.

10.2. Reporting to the ANPD and data subjects

When an incident may cause relevant risk or harm to data subjects, DFSpro will assess the need to report it to the Brazilian National Data Protection Authority and to the affected data subjects, following the criteria, deadlines and content that the applicable rules require.

When reporting is mandatory, DFSpro will follow the deadlines set by the ANPD rules in force, counted from the moment the controller becomes aware of the incident, and will send further updates if new information is found.

The report, when needed, will be made through a suitable channel, with information that fits the stage of the investigation, the nature of the incident, the data involved, the risks found and the mitigation measures taken.

10.3. Records and accountability

DFSpro may keep an internal record of incidents, including those that do not have to be reported to the ANPD or to data subjects, for governance, security, prevention, continuous improvement and the regular exercise of rights.

Newsletter, Email Marketing and Communications

11.1. Subscription

When subscribing to newsletters, materials, events or communications from DFSpro, the user may give data such as name, email, company, job title, area of interest and preferences.

This data will be used to send company, technical, editorial and commercial content related to DFSpro's work.

11.2. DFSpro Radar

DFSpro may send communications about DFSpro Radar, articles, analyses, regulatory alerts, and content about SAP tax, Tax Reform, GUEPARDO Tax, governance, compliance, tax diagnostics and related topics.

DFSpro Radar has an editorial, technical and interpretive purpose. Its aim is to help readers judge risk, consequence and priority in tax, regulatory and system topics, and it does not replace an analysis of your own case.

11.3. Where contacts come from

DFSpro may send communications to contacts obtained through:

• voluntary subscription
• contact form
• material download
• event participation
• prior commercial relationship
• negotiation in progress
• legitimate referral
• company interaction
• professional connection
• contractual relationship

another case that fits the applicable law.

DFSpro does not recommend using email lists obtained in a way that conflicts with the LGPD, with no legitimate source, with no professional context or with no reasonable chance to object.

DFSpro must avoid sending commercial communications to lists that were bought, scraped, obtained with no documentable source, or that do not fit the data subject's reasonable expectation in a professional context.

11.4. Identification and unsubscribe

Commercial and editorial communications must identify DFSpro as the sender or the party responsible for the communication.

The user may ask to unsubscribe at any time through the link in the communications or by email:

go@dfspro.com.br

DFSpro may keep a minimal record of the unsubscribe to avoid sending again by mistake and to prove that the request was handled.

11.5. Communication metrics

Email and newsletter sending tools may record:

• delivery
• opens
• clicks
• bounces
• unsubscribes
• delivery errors
• interaction with links

communication preferences.

This information may be used to measure quality, relevance, security, deliverability, preference management and the company relationship.

11.6. Transactional, editorial and commercial communications

DFSpro may tell transactional, editorial and commercial communications apart.

Transactional communications are those needed to answer a request, confirm a subscription, set up a meeting, send a requested material, record an unsubscribe or handle a contractual relationship.

Editorial communications are those meant to send analyses, articles, newsletters, technical alerts and company content.

Commercial communications are those related to an invitation to a diagnostic, presentation, proposal, meeting, service offer or commercial relationship.

Each category may follow its own legal basis, retention and right to object, depending on its purpose.

11.7. Legitimate interest assessment for DFSpro Radar

When sending DFSpro Radar relies on legitimate interest, DFSpro keeps a documented assessment of this legal basis, reviewed regularly and built on three tests: purpose, necessity and balancing.

Purpose. Keep a company and editorial relationship with professionals in tax and technology areas who work with SAP, through technical content about tax governance, Tax Reform, CBS, IBS and related topics. The purpose is institutional and economic, lawful, and it is professional communication between companies about a subject that is part of the recipient's daily work. There is no profiling of sensitive data and no automated decision with legal effect on the data subject.

Necessity. Only professional data is processed, as far as the purpose needs:

• work email, which is essential, because it is the delivery channel itself
• name, to address the message personally
• company and job title, to fit the sector, the tax context and the technical depth of the content
• contact history, which is the element that shows the prior relationship

No sensitive data is processed for this purpose, there is no enrichment with third-party databases, and no browsing data is used beyond the opens and clicks of the message itself.

Balancing. In favor of the processing are a demonstrable prior relationship, the reasonable expectation of someone who has already interacted with DFSpro on the same subject, the editorial and technical nature of the content, the low frequency and the strictly professional context. On the data subject's side, the risks are reduced by:

• one-click unsubscribe in every message, with no login, password, reason or extra confirmation required
• a clear statement of where the contact comes from and the legal basis in the footer of the message
• processing of the unsubscribe request within two days
• minimal retention of the objection record, to make sure the data subject is not contacted again
• the data protection officer's channel open at any time, as set out in Section 8
• sending from DFSpro's own domain, with sender authentication by SPF and DKIM

Limit of the legal basis. Legitimate interest is not used to contact someone with no demonstrable prior relationship. In that case, the applicable legal basis is consent, as set out in the processing matrix in Section 3.

Review. The assessment is reviewed when the purpose, the source of the contacts or the sending frequency changes, and, as a routine, every twelve months.

The data subject may ask for information about this assessment through the channel given in Section 8.

Website Terms of Use

12.1. Acceptance

By accessing or using the DFSpro website, the user declares to be aware of these Terms of Use, the Privacy Policy, the Cookie Policy and the other applicable legal notices.

If the user does not agree with any point, they must stop browsing and not use the forms, materials or features provided.

12.2. Purpose of the website

The DFSpro website has an institutional, informative, technical, editorial and commercial purpose.

It presents information about the company, its services, technical content, articles, newsletter, company materials, contact channels and topics related to SAP tax, GUEPARDO Tax, Tax Reform, SPED, NF-e, AMS Fiscal Advisory, SAP Tax Diagnostic, tax governance, compliance and business-critical tax operations.

12.3. Permitted use

The user agrees to use the website in a lawful and ethical way that fits its purpose.

It is forbidden to:

• try to access restricted areas without authorization
• interfere with the operation of the website
• test for vulnerabilities without authorization
• scrape, crawl, mine or collect data automatically without authorization
• use bots, scripts or automated extraction methods
• send false, abusive or unlawful information, or third-party information without authorization
• copy DFSpro content without permission
• misuse the brand, visual identity, texts, images, diagnostics, frameworks or materials
• put at risk the security, availability or integrity of the website
• use the website for competitive purposes that are not authorized
• insert malicious code, spam, phishing, malware or harmful content

use DFSpro's channels to send confidential data without authorization.

12.4. Content sent by the user

When sending information, documents, messages, files or data through DFSpro's digital channels, the user declares to have authorization to share them.

The user accepts that they must not send confidential information, personal data of third parties, trade secrets, credentials, sensitive tax documents, internal system information, databases, XMLs, screenshots of SAP or GUEPARDO, logs or strategic documents without an express request and a suitable channel.

DFSpro may delete, ignore or restrict the processing of information received improperly.

12.5. Contractual relationship

Browsing the website, reading articles, receiving newsletters, downloading materials or sending forms does not, by itself, create a contractual relationship of consulting, service provision, tax advice, legal advice, SAP support or ongoing technical responsibility.

A service relationship is formed only by an accepted proposal, a contract, a service order, a specific term or an equivalent document.

12.6. Third-Party Trademarks Mentioned on the Website

Third-party trademarks and products mentioned in technical content, such as SAP and GUEPARDO Tax / NTT DATA, belong to their respective owners. Mentioning these trademarks on this website does not mean endorsement, a formal partnership or an affiliation beyond what is described explicitly on the matching Specialty pages.

12.7. Website Availability and Changes

This website may be changed, suspended for a time or discontinued at any time, with no mandatory prior notice and no guarantee of uninterrupted availability.

Legal Notice and Limitation of Technical Liability

13.1. Nature of the content

The information that DFSpro publishes on its website, blog, newsletter, presentations, in-depth materials, posts, articles, comments, videos, documents or communications is produced for informative, technical, educational, editorial and company purposes.

By itself, it is not:

• a legal opinion
• a tax opinion
• a tax-law opinion
• a technical report
• an audit
• an SAP diagnostic
• a GUEPARDO diagnostic
• individual accounting advice
• a guarantee of compliance
• a guarantee of results
• a final instruction for system setup
• guidance that applies automatically to any company
• a formal legal opinion

a replacement for a contract, a technical scope or individual consulting.

13.2. Need for a specific analysis

Topics such as Tax Reform, IBS, CBS, Split Payment, SPED, NF-e, GUEPARDO Tax, SAP ECC, SAP S/4HANA, TDF, DRC, tax integration, ancillary obligations, compliance, tax calculation, credits, tax benefits, master records, tax codes, CFOP, CST, master data and tax governance depend on an analysis of the context.

Applying any content must take into account:

• the law in force
• secondary rules
• administrative acts
• technical notes
• the applicable tax position
• case law
• the business sector
• the tax regime
• the corporate structure
• the tax operation
• the SAP architecture
• the system versions
• customizations
• integrations
• internal processes
• master data
• governance
• the evidence available

the contracted scope.

13.3. Content about the Tax Reform

Content about the Tax Reform, IBS, CBS, the Selective Tax, Split Payment, credit, assisted tax calculation, ancillary obligations, the transition period, cash impact, system impact and tax governance reflects an informative analysis on the date of publication.

The law, regulations, secondary acts, administrative guidance and technical interpretations may change.

No publication should be used by itself as the basis for tax setup, taking credits, defining tax treatment, changing a process, an operational decision, financial planning, an impact estimate or an investment decision.

13.4. Content about SAP, GUEPARDO and tax systems

Content about SAP, GUEPARDO Tax, TDF, DRC, ECC, S/4HANA, integrations, master data, setups, tax codes, CFOP, CST, tax calculation, SPED, NF-e, automation and tax architecture depends on each company's specific environment, version, scope, customizations, integrations, internal processes, security, access authorization, segregation of duties and governance.

DFSpro is not responsible for applying public content directly in a production environment without a formal technical diagnostic, validation in a suitable environment, the company's internal approval, change documentation, tests and transport governance, when they apply.

No public information from DFSpro should be applied directly in a production environment, tax setup, SAP transport, rule change, integration, job, report, ancillary obligation or tax process without internal technical validation by the responsible company, suitable tests, formal approval and documentation of the change.

13.5. Preliminary diagnostics

Any preliminary diagnostic done before hiring has an exploratory, commercial or screening purpose and does not replace a formal contracted diagnostic, a full analysis of the environment, document validation, a review of setups, tests, an audit, a technical opinion or an assessment of the tax architecture under a defined scope.

Preliminary conversations, presentation meetings, email replies, messages, comments, forms or public materials do not create an obligation to provide a formal diagnostic, technical support, an environment review, tax validation, setup, or responsibility for decisions the user makes.

13.6. No promise of results

DFSpro does not promise absolute compliance, full removal of risks, no tax assessments, approval by authorities, tax savings, success of an SAP project, removal of inconsistencies, uninterrupted operation of systems or any specific result without a formal analysis, a defined scope and an applicable contract.

Any result depends on the data available, operational maturity, system architecture, the participation of the areas involved, the quality of master records, the applicable tax rules, the client's cooperation, the history of the operation, the version of the systems, the suppliers involved and the technical execution.

13.7. Currency of the information

DFSpro tries to produce content with technical care, but tax, technology and regulatory rules may change.

Content published on a given date may be affected by new laws, regulations, technical notes, administrative decisions, court decisions, SAP updates, changes in GUEPARDO Tax, changes in the position of the competent authorities or new market practices.

The user must check that the information is still current before using it in important decisions.

13.8. User responsibility

Using the information that DFSpro provides is at the user's own account and responsibility.

Tax, technology, accounting, legal, financial or operational decisions must be made with the help of qualified professionals, a specific analysis and formal validation of the actual case.

Intellectual Property

14.1. Ownership

All content, materials and elements that DFSpro provides are protected by intellectual property rights, including:

• texts
• articles
• newsletters
• diagnostics
• frameworks
• methodologies
• matrices
• checklists
• images
• presentations
• in-depth materials
• reports
• visual identity
• brand
• logos
• editorial structure
• verbal architecture
• blog content
• technical publications
• commercial documents
• company documents
• scripts
• templates
• automation
• setup structures
• analysis models
• implementation materials
• configurations
• reports
• technical artifacts

materials about SAP Tax Governance, GUEPARDO Tax, Tax Reform, SPED, NF-e, AMS Fiscal Advisory and SAP Tax Diagnostic.

Unless stated otherwise, these elements belong to DFSpro or are used with authorization, a license or an applicable right.

14.2. Permitted use

The user may access, read, save or share public links to DFSpro content, as long as authorship, integrity, context and source are kept.

Short quotations may be made with a clear mention of the source, as long as they do not distort the content, do not imply improper endorsement, do not replace access to the original material and are not used for competitive or commercial purposes that are not authorized.

14.3. Prohibitions

Without DFSpro's prior written authorization, it is forbidden to:

• reproduce content in a substantial way
• republish materials
• adapt frameworks
• resell content
• distribute documents
• use materials in commercial training
• build content into third-party products or services
• use materials for competitive purposes
• remove authorship or brand
• create derivative works for commercial use
• scrape, mine or extract automatically
• use content to train, fine-tune, feed, mine, bulk-index, build a database for, or develop artificial intelligence models
• copy DFSpro's editorial architecture, methodology, diagnostic structure, matrices, scripts, checklists, commercial materials or technical documents

register a brand, domain, profile, product, service or material that could be confused with DFSpro, DFSpro Radar or other names the company uses.

14.4. Materials from clients and third parties

DFSpro respects the intellectual property rights of third parties. Materials from clients, suppliers or partners must be used only within the authorized scope.

By sending third-party materials to DFSpro, the sender declares to have authorization to share them.

14.5. Protection measures

DFSpro may take administrative, out-of-court or court measures to protect its brand, materials, texts, methodologies, documents, visual identity, technical content and other intellectual assets.

Requests for permission to use must be sent to:

go@dfspro.com.br

Pre-Contract Confidentiality and Corporate Information

15.1. Pre-contract interactions

Information shared in meetings, forms, preliminary diagnostics, presentations, commercial exchanges or pre-contract stages will be handled with care that fits its nature.

However, confidential information, sensitive tax data, internal documents, credentials, databases, technical details of a production environment, system screenshots or strategic information may be shared only after a suitable channel, scope and authorization are defined and, when needed, a specific confidentiality instrument is in place.

15.2. No obligation to analyze

Receiving information, a file, a message or a document through a public channel, or one that was not contracted, does not oblige DFSpro to analyze, answer, store, return, protect to a specific standard, issue an opinion, diagnose or provide a service.

DFSpro may delete or restrict the processing of materials received outside the scope, without prejudice to measures needed for security, proof or defense of rights.

15.3. Third-party information

The user must not send third-party information without valid authorization.

If the user sends data of another natural person, client, supplier, employee or company, the user declares to have the authority, authorization and a proper basis to share it.

Use of Artificial Intelligence and Automation

16.1. Internal use

DFSpro may use tools for artificial intelligence, automation, editorial organization, content analysis, research support, review, internal productivity, sales automation and information management.

These tools do not replace DFSpro's professional judgment, human review, technical validation or editorial responsibility.

16.2. Restrictions

Confidential client data, sensitive tax information, credentials, internal documents, databases, strategic information or relevant personal data must not be entered into AI, automation or third-party tools without a prior assessment of security, confidentiality, legal basis and applicable authorization.

Client information may be used in AI tools only when there is a legal basis, a legitimate purpose, applicable authorization, a confidentiality assessment, data minimization and a tool that fits the risk level of the information.

16.3. Automated content

Any automated replies, assistants, automatic flows or communications produced with technology support have an informative, operational or screening purpose and do not replace human interaction, a technical diagnostic, formal consulting, tax analysis, a legal decision or a contracted service.

Third-Party Integrations, APIs and Automation

Integrations, automation, APIs, connectors, webhooks and flows between third-party tools are subject to outages, supplier changes, technical limits, API changes, blocking, setup errors, authentication failures, plan limits, processing delays, network instability or one-sided changes by external platforms.

DFSpro is not responsible for outages at third parties outside its control, unless there is a specific contractual obligation, an assumed scope and a responsibility expressly defined in a contract.

When DFSpro uses integrations on behalf of clients, the responsibility, technical limits, assumptions, access, credentials, environments, tests and approvals must be defined in a separate instrument.

Accessibility

18.1. Company commitment

DFSpro recognizes the importance of digital accessibility and works to keep its digital channels organized, clear and increasingly accessible.

The company may adopt good practices such as:

• a logical heading structure
• clear text
• suitable contrast
• image descriptions when they apply
• consistent navigation
• descriptive links
• growing compatibility with screen readers
• fewer elements that get in the way of navigation
• care with forms, buttons and contact areas

regular review of pages and content.

18.2. Limitation

DFSpro does not declare full accessibility compliance without a specific technical audit.

If any content, form, page or material is not accessible, the user may ask for help by email:

go@dfspro.com.br

DFSpro will assess the request and, when reasonable and technically possible, may provide an alternative way to reach the content or specific guidance.

External Links, Embedded Content and Social Networks

The DFSpro website may contain links to third-party pages, social networks, content platforms, technical tools, newsletter services, external materials, videos, embedded posts, calendar pages, analytics platforms, company websites or supplier tools.

DFSpro does not control and is not responsible for the privacy, security, cookie, retention, availability, content, terms of use, policies or decisions of these third parties.

When opening external platforms, the user is subject to the own policies of those environments.

Advertising, Remarketing and Sponsored Content

DFSpro may use tools for measurement, campaigns, paid media, remarketing, conversion analysis or content distribution, as long as they fit the applicable law and the user's cookie and communication preferences.

If DFSpro publishes sponsored content, a paid commercial partnership, a recommendation tied to an economic benefit or material of an advertising nature, it will try to identify that condition in a suitable way.

DFSpro must not present technical content, tax analysis, regulatory interpretation or a company opinion as if it were independent when there is a relevant commercial relationship that must be disclosed.

Testimonials, Cases and Proof

DFSpro may publish testimonials, cases, results, examples or experiences, as long as the necessary authorizations, confidentiality, privacy, context and limits are respected.

Results shown in cases, testimonials or examples:

• reflect specific contexts
• depend on scope, environment, data, maturity and execution
• are not a guarantee of future results
• do not allow automatic generalization

do not replace a specific analysis of another company's operation.

Whenever needed, data about clients, people, operations, values, systems or contexts may be anonymized, aggregated, left out or changed to protect confidentiality.

The anonymization of cases must reasonably prevent direct or indirect identification of the client, taking into account sector, size, location, context, dates, systems, values, screenshots, suppliers, schedules, operational problems and technical details.

Contracts, Proposals and Order of Precedence

These policies do not replace contracts, commercial proposals, confidentiality terms, DPAs, service orders, technical scopes, SLAs, internal policies or specific instruments signed with clients, suppliers or partners.

If these policies conflict with a specific contract instrument, the specific contract instrument prevails, unless it conflicts with mandatory law or with rights that cannot be waived.

The absence of a formal contract does not create an obligation to provide services, technical support, a diagnostic, consulting, a reply within a specific time or responsibility for decisions made on the basis of public content.

Changes to the Policies

DFSpro may update these policies to reflect legal, regulatory, technical, operational, company or commercial changes.

The version in force is the one published in DFSpro's official channels.

When relevant changes are made, DFSpro may highlight the update in a suitable way, depending on the nature of the change, the data subjects affected, the materiality of the processing and the applicable law.

Changes to the policies do not reduce rights already set out in law and do not remove applicable legal obligations.

Jurisdiction and Governing Law

These policies are governed by Brazilian law, especially the General Data Protection Law (LGPD), the Brazilian Internet Civil Framework (“Marco Civil da Internet”), the Civil Code, the Copyright Law, the Software Law, the Industrial Property Law, consumer law when it applies and other relevant rules.

Any disputes will be brought before the competent court, subject to the applicable contract instrument and mandatory legal rules.

Where it applies and without prejudice to a specific legal rule, the courts of the District of Curitiba, PR may be chosen.

Contact Channels

For questions about privacy, cookies, terms of use, intellectual property, newsletter, accessibility, information security, legal requests, data subject rights or communication with the data protection officer:

DFSO TECNOLOGIA DA INFORMACAO LTDA

Trade name: DFSPRO IT SOLUTIONS

CNPJ (Brazilian company tax ID): 31.609.116/0001-56

Company email: go@dfspro.com.br

Email for privacy: go@dfspro.com.br

Data protection officer: Douglas Oliveira

Data protection officer channel: go@dfspro.com.br

Annex I: Executive Privacy Summary

DFSpro processes personal data mainly to answer contacts, send content, manage the newsletter, organize meetings, run B2B commercial relationships, protect its digital channels, meet legal obligations and preserve rights.

DFSpro may process data such as name, email, phone, company, job title, area, messages sent through forms, communication preferences and technical browsing data.

DFSpro does not ask through public channels for sensitive personal data, credentials, tax documents, system screenshots, XMLs, databases or confidential information.

The data subject may ask for access, correction, deletion, objection, withdrawal of consent and other rights set out in the LGPD by emailing go@dfspro.com.br.

DFSpro's data protection officer is Douglas Oliveira, who can be reached at go@dfspro.com.br.

DFSpro may use suppliers such as website, newsletter, CRM, analytics, automation, hosting, security and social network platforms, depending on the actual setup.

Non-necessary cookies, when used, must follow the user's preferences through a banner or preference center, when these are in place.