Privacy Policy — 20DASH

1. Who we are

This Privacy Policy explains how 20DASH processes personal information. It applies to:

• Twenty Dash Consultoria e Serviços em Tecnologia Ltda., CNPJ 31.945.601/0001-09, Rua Camilo, 556, cj. 151, Ed. Giardino, Vila Romana, São Paulo/SP, CEP 05045-020, Brazil; and
• 20DASH, Inc., a United States company controlled by Twenty Dash Ltda.

Together, "20DASH", "we" or "us". The 20DASH entity you contact or contract with is responsible for your personal information.

The policy covers the website 20dash.com, our contact and support channels, the 20 Studio [AI] platform, and the campaigns and activations 20DASH builds and operates.

Contact: privacy@20dash.com

2. Our role

As a controller (business): 20DASH decides how to process information about website visitors, people who contact us, client representatives, suppliers and partners, and job applicants.

As a processor (service provider): in campaigns, activations and 20 Studio [AI] projects built for clients, 20DASH processes participants' personal information on behalf of the client (the brand or agency), which is the controller. We follow the client's instructions and our contract with them. The client's privacy policy, shown in the campaign, applies to participants. Requests about this information that reach 20DASH are forwarded to the responsible client.

3. Information we collect

• Contact and business relationship: name, email, phone, company, job title and the content of messages sent through the website, chat, email, WhatsApp or forms.
• Website use: IP address, browser and device type, pages visited, date and time of access, and information collected by cookies and similar technologies.
• AI chat on the website: the content of messages exchanged with the assistant.
• Suppliers, partners and applicants: registration and professional information needed for contracting, payment or hiring.
• Campaigns and 20 Studio [AI] (as processor): the information each client defines for each campaign, such as name, contact details, images, audio or content submitted by participants to create personalized digital assets.

4. How we use information

• To respond to inquiries, prepare proposals and negotiate contracts.
• To deliver the services our clients hire us for.
• To operate, secure and improve the website and chat.
• To send updates about 20DASH work, with an unsubscribe option at any time.
• To comply with legal, tax and regulatory obligations.
• To establish, exercise or defend legal claims.
• To run hiring processes.

For processing subject to Brazil's General Data Protection Law (Law No. 13,709/2018, LGPD), the legal bases are: performance of a contract and preliminary steps (art. 7, V), legitimate interest (art. 7, IX), consent for non-essential cookies (art. 7, I), legal or regulatory obligation (art. 7, II), and the regular exercise of rights (art. 7, VI).

20DASH does not use campaign participants' personal information for its own purposes, or to train artificial intelligence models, without the controller's authorization and an appropriate legal basis.

5. Sharing

We may share personal information with:

• Service providers that support our operations, such as hosting and cloud providers (for example, Amazon Web Services, including for email delivery), productivity and communication tools, artificial intelligence providers and payment services. They process information only on our instructions.
• Client controllers, for information processed in campaigns built for them.
• Between 20DASH entities (Twenty Dash Ltda. and 20DASH, Inc.), when needed to serve clients and projects.
• Public authorities, when required by law, court order or a valid request from a competent authority.

We do not sell personal information.

6. International transfers

20DASH operates in Brazil and the United States, and some service providers are located in other countries. When information is transferred across borders, we use contractual clauses and other safeguards that provide protection consistent with the laws that apply, including art. 33 of the LGPD and the rules of Brazil's National Data Protection Authority (ANPD).

7. Retention

We keep personal information for as long as needed for the purposes in this policy, to meet legal and regulatory obligations, and to exercise rights. After that, it is deleted or anonymized. Information processed as a service provider is kept and deleted according to our contract with the client.

8. Security

We use technical and administrative measures to protect personal information against unauthorized access, loss, alteration and disclosure. These include need-to-know access controls, encryption in transit, cloud environments with security controls, and confidentiality obligations for staff and suppliers. If an incident may create significant risk or harm, we will notify the authorities and affected individuals as required by law.

9. Cookies and Do Not Track

The website uses essential cookies to work and may use analytics and marketing cookies, which depend on your consent where required by law. You can manage or block cookies in your browser settings. Blocking essential cookies may affect how the website works.

The website does not currently respond to browser "Do Not Track" signals.

10. Your rights

Brazil (LGPD, art. 18): confirmation that we process your information and access to it; correction; anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed information; portability; deletion of information processed based on consent; information about who we share it with; information about the option not to consent and its consequences; withdrawal of consent; and review of decisions made solely by automated processing. You may also file a complaint with the ANPD.

United States: depending on the state where you live and whether its privacy law applies to 20DASH, you may have the right to know what personal information we hold about you, to access, correct or delete it, and to opt out of its sale. We will not discriminate against you for exercising these rights.

Other countries: you may exercise the rights granted by the data protection law that applies to you.

To make a request, email privacy@20dash.com. We may ask for information to verify your identity. An authorized agent may submit a request on your behalf with proof of authorization.

11. Children

Our website and contact channels are not directed to children under 13, or to anyone under 18 where local law sets a higher age, and we do not knowingly collect their personal information through them. When a campaign operated by 20DASH involves information about children or teenagers, processing follows the client controller's instructions and the applicable law, including art. 14 of the LGPD and, in the United States, the Children's Online Privacy Protection Act (COPPA).

12. Data Protection Officer

Data Protection Officer (Encarregado): Denis Shirazi
Email: privacy@20dash.com

13. Changes

We may update this policy. The current version is always available on our website with its "last updated" date. We will communicate material changes through appropriate channels.

This policy is also available in Portuguese and Spanish. If there is any conflict between versions for processing subject to the LGPD, the Portuguese version prevails.