4kst Data Protection Commitment

4kst Commitment
Personal Data Protection in Virtual Media

4kst is committed to fully respecting every individual's right to privacy and the protection of their personal data. Therefore, we follow and comply with all national and international laws and regulations involving this issue wherever we conduct our business, and we emphasize the importance of the Brazilian law LGPD – General Personal Data Protection Law (Law 13.708/2018). Our "Personal Data Protection Policy" defines the standards adopted by 4kst, through its departments and employees, for the processing and protection of personal data.

This commitment documents the diligence assumed by 4kst in any and all operations it performs with personal data collected or received in virtual format, whether they come from the company's various relationships, such as data on:

• representatives of companies/customers 4kst;
• representatives of prospecting companies/clients;
• 4kst team members;
• candidates for positions on the 4kst team;
• users of the 4kst Reporting and Communication Channel;
• representatives of partner, supplier and investor companies; and
• consumers/individuals from companies/4kst customers or companies/customers at
  prospecting, etc.

4kst adopts the Principle of Necessity as a fundamental pillar of its work involving the processing of personal data. In other words, we limit our processing (from collection to storage) to the minimum necessary for conducting our activities, serving 4kst companies/customers, and complying with legal requirements.

 

I'm an individual

Transparency is also one of our commitments to everyone we interact with, and in this regard, we aim to clarify any questions you may have about how we process and protect your personal data, including the data you provide when browsing our product and/or service websites, as well as our Reporting and Communication Channel tool.

In addition to the information provided in this document, we also provide a communication channel so that you can talk to us and ask any other questions you may have about 4kst and your personal data (see the section "How can I contact 4kst?").

 

I'm a legal entity

If you represent a company that maintains or intends to start a new relationship with 4kst, whether as a customer, supplier, or partner, this document can also be very informative about how we handle personal data and our commitment to complying with the law. In any case, our commercial relations team is ready to provide you with more details on the matter or, if you prefer, you can seek further information through our communication channel (see the section "How can I contact 4kst?").

 

Some of the questions you may have are answered in this document:

1. How and what data does 4kst collect about me?
2. Why does 4kst collect my data?
3. How and what data does 4kst receive about me?
4. Why can 4kst receive data about me?
5. How and with whom can 4kst share my data?
6. What precautions does 4kst take when processing personal data?
7. What are my rights as a data subject?
8. How can I contact 4kst?
9. How does 4kst serve public authorities?

 

1. How and what data does 4kst collect about me?

4kst collects personal data in the following situations:

4kst websites

• when you register your data to receive news, commercial campaigns, newsletters, or for our team to contact you;
• when you register your details to purchase a 4kst product or service online;
• when you register your details to offer services or apply for a position on the 4kst team; and

 

Events

• when you provide your data at meetings with 4kst or events in which 4kst participates (e.g., webinars).

The collection of data in the above situations will always be preceded by an alert for you to give your consent and, in general, the data we will collect is as follows:

• name and/or surname
• e-mail
• the company it represents
• telephone
• city*
• professional information (profession, experience, education, etc)*

* This data is collected only when you access and register in the "Careers at 4kst" area, or on recruitment platforms provided by third parties and used by 4kst.

 

4kst System Authentications

If you interact with 4kst product systems (by logging in to use any of our products via the web), 4kst servers collect data to support any audit or investigation for misuse or unauthorized access. The data that our servers may automatically collect includes:

• information about your computer, cell phone, tablet or other device used for access; and
• authentication data such as:
  • login,
  • password,
  • Internet Protocol (IP) address,
  • type of browser,
  • language,
  • schedule,
  • language,
  • visited domain,
  • navigation information,
  • clickstreams (sequence of clicks made on our site) and
  • location

 

Cookie Usage Rules

4kst uses cookies on its websites to improve performance and user experience.

Cookies are small files that a website, when visited by a user, places on their computer or mobile device via their browser. Placing cookies will help the website recognize the device the next time the user visits the same website.

The cookies used by 4kst do not collect information that identifies the user. Cookies collect generic information, specifically how users arrive at and use the 4kst website or the region from which the user accesses our site.

Cookies only retain information related to your preferences. At any time, you can choose to be notified of the receipt of cookies via your browser or block them from entering your system.

Refusing to use cookies on our website may result in you not being able to access some of its areas or receive personalized information.

Once you have authorized the use of cookies, you can always deactivate our cookies. All internet browsers allow you to accept, refuse or delete cookies by managing the settings in your browser. Please note that if you disable cookies, parts of our websites may not function properly.

 

2. Why does 4kst collect my data?

Personal data is collected by 4kst for the following purposes:

• offering their products or services;
• registration and participation in events;
• commercial negotiations;
• formalization of contracts;
• billing;
• processes for searching for and selecting professionals to join your team;
• control of logins and authentications in the 4kst systems and facilitation of investigative processes for improper use or access;
• conducting investigative processes or analyzing reports submitted to the 4 PÚBLICA Whistleblower and Communications Channel.
• offering their products or services;

 

3. How and what data does 4kst receive about me?

4kst provides services as a personal data operator for various segments, such as the financial market, manufacturing, insurance, retail, education, among others, serving various companies/clients through a formal relationship, and always on a legal basis.

Quite clearly, 4kst acts as a transit operator, receiving data controlled by the company/client, performing the processing contracted by the latter, and completely discarding all data after each processing. In other situations, 4kst acts merely as a provider of a technological platform so that its clients can consult data bureaus.

It is important to note that 4kst does not possess or maintain any personal databases related to the provision of services to its companies/clients.

4kst always requires a formal commitment from its companies/clients to ensure the legitimacy of the services they contract with us, whether through the express consent of their clients or another legal basis for processing.

In general, the personal data that may be received by 4kst for the provision of services are:

• Name and/or surname;
• Date of birth and age;
• Gender;
• CPF;
• RG;
• Address;
• E-mail;
• Phone;
• Profession;
• Place of work; and
• Presumed income.

 

4. Why can 4kst receive data about me?

If 4kst receives data about you, it is likely that you have or had a relationship with a 4kst company/client that hired us to provide services to you. We build predictive models, which are tools used by our companies/clients for various purposes, such as credit analysis and anti-fraud.

 

5. How and with whom can 4kst share my data?

The personal data we collect virtually may be shared:

• With 4kst service providers that perform credit card processing and other payment methods, marketing research and analysis, and customer support services;
• With offices contracted to carry out due diligence services (prior investigation), recruitment and selection of human resources;
• In special circumstances, with professionals who provide consulting, legal, structured operations, accounting, insurance services, or with third parties involved in merger processes, corporate reorganization, sale of assets, among other operations in which 4kst is involved;
• 4kst investors; and
• With public authorities when it involves compliance with legal and/or judicial obligations, or with professionals involved in conducting legal proceedings in which 4kst is a party.

The personal data we receive from our companies/customers may be shared:

• With data bureaus contracted by 4kst that perform data enrichment;
• With suppliers contracted on an ad hoc basis by 4kst to provide a specific service that it has contracted;
• With public authorities when it involves compliance with legal and/or judicial obligations, or with professionals involved in conducting legal proceedings in which 4kst is a party.

In all our contracts with suppliers or business partners, we require compliance with data protection regulations, as well as seeking confidentiality agreements that are consistent and aligned with our Personal Data Protection Policy and that especially limit the use or disclosure of this data.

We may share data about you that you have voluntarily made public, for example data published on social networks.

 

6. What precautions does 4kst take when processing personal data?

The entire 4kst team is trained and attentive to only processing personal data when it is fully compliant with current legislation on the matter. In addition, each area of 4kst has a designated Personal Data Protection Representative, who is responsible for supporting our Data Protection Officer (DPO) in identifying and monitoring risks involving non-compliance with the LGPD. The following are some of our internal rules that demonstrate this commitment:

• The personal data we process must be obtained fairly and lawfully, with the data subject's right to full information;
• Personal data must be collected exclusively for specified, explicit and legitimate purposes;
• Personal data must be adherent, relevant and not excessive in relation to the purposes for which it is collected and processed;
• Personal data will only be made available to third parties for the fulfillment of the specified purposes and when legally permitted;
• Personal data may not be retained for longer than is necessary to fulfill the purposes for which it was collected, except in cases where this data is required for legal reasons or where there is specific consent indicating a certain period; and
• In its role as a data transfer operator, 4kst must delete personal data as soon as the service is completed and accepted by the data controller company/client, except for data that may need to be retained for compliance with current legislation, for auditing and/or inspection purposes.

4kst recognizes that it must fully protect all personal data under its control, even if temporarily. For this reason, it adopts control and audit programs aimed at detecting, continuously monitoring, and identifying possible violations of its internal rules that could lead to unauthorized access and/or disclosure of personal data under its control.

We use hardware and software from reputable suppliers. When data is transferred over the Internet, it is encrypted using Transfer Layer Security (TLS) or similar technology that provides encryption solutions. Encryption is a method of guaranteeing the confidentiality and authenticity of data during transmission and storage.

 

7. What are my rights as a data subject?

As the owner of your personal data, you should be aware of your rights under Brazilian law:

• Confirmation that your data is being processed;
• Access to your data;
• Correction of incomplete, inaccurate or outdated data;
• Anonymization, blocking or deletion of data that is unnecessary, excessive or processed in breach of the LGPD;
• Portability of data to another service or product provider, upon express request, in accordance with the regulations of the national authority, observing commercial and industrial secrets;
• Revocation of consent;
• Deletion of personal data processed with the consent of the data subject, except in the cases provided for in the LGPD;
• Information on public and private entities with which 4kst has shared data; and
• Information about the possibility of not giving consent and the consequences of this refusal.

4kst has procedures in place to ensure fast and simplified service so that you can exercise any of your rights regarding your personal data under our control. Follow the instructions in the section "How can I contact 4kst?"

 

8. How can I contact 4kst?

If you still have questions about how 4kst treats and cares for your personal data, or if you need to request any changes in the treatment of your data by 4kst, just contact our Data Protection Officer (DPO) by email: dpo@4kst.com.

One detail: for your own safety and the protection of your personal data, when you contact us we will require some proof of your identity before we make any information available, or fulfill any request from you regarding your data. But rest assured, this whole process of confirming your identity will be done remotely/digitally.

In addition to this channel, please be aware that all our marketing materials contain a link so that you can electronically unsubscribe your data to stop receiving these materials.

 

9. How does 4kst serve Public Authorities?

4kst is committed to promptly responding to any Public Authority, in particular the ANPD, on issues related to the processing and protection of personal data carried out by it. Our DPO is available and can be contacted via email: dpo@4kst.com, or via our address provided on our website http://www.4kst.ai.

 

¹ Personal data: any data that individually, or through a set of them, identifies or can identify a natural person.

4kst Commitment – Personal Data Protection in Virtual Media – version 1.2
Published on January 23, 2026

dpo@4kst.com

compliance@4kst.com