Privacy and Personal Data Protection Policy

Oficina de Pitágoras recognises the importance of protecting the privacy and the personal data of everyone who deals with it, and undertakes to process that data lawfully, fairly, transparently, accountably and securely. This Privacy and Personal Data Protection Policy is intended to inform data subjects how Oficina de Pitágoras collects, uses, organises, keeps, discloses and protects the personal data processed in the course of its activity. This Policy applies, in particular, to processing carried out through: • the Oficina de Pitágoras website; • electronic or printed forms; • enrolment forms; • contact in person; • e-mail; • telephone; • SMS; • WhatsApp; • digital platforms; • administrative management tools; • educational or video-conferencing platforms; • teaching, training, educational, cultural, recreational or complementary activities; • and the other channels legitimately used in the course of the activity of Oficina de Pitágoras. Personal data is processed in accordance with Regulation (EU) 2016/679 of 27 April 2016 — the General Data Protection Regulation (GDPR), with Portuguese Law no. 58/2019 of 8 August, and with the other national and European legislation applicable to personal data protection, privacy and electronic communications.

For the purposes of the General Data Protection Regulation, the controller of the personal data processed in the course of the activity is Oficina de Pitágoras, as the entity responsible for organising, managing and providing its services. Oficina de Pitágoras Rua dos Netos, 64, 9000-084 Funchal Madeira — Portugal Telephone: +351 926 125 158 WhatsApp: +351 926 125 158 E-mail: admin@oficinadepitagoras.xyz Website: oficinadepitagoras.xyz Throughout this Policy, “Oficina de Pitágoras” identifies the entity responsible for managing the activity and for the processing of personal data carried out in connection with the services provided. Whenever the legal structure or the entity responsible for the activity changes, this Policy will be updated accordingly.

This Policy applies to personal data processed in relation to: • students; • former students; • children and young people; • guardians; • parents; • tutors; • legal representatives; • trainees; • private clients; • prospective clients; • participants in activities; • website users; • users of digital platforms; • representatives of companies or institutions; • teachers; • trainers; • specialist practitioners; • activity leaders; • staff and collaborators; • applicants to join the team; • service providers; • suppliers; • partners; • and any other individuals who establish a relationship with Oficina de Pitágoras.

This Policy applies across the different areas of activity carried out, or that may come to be carried out, by Oficina de Pitágoras.

Oficina de Pitágoras processes personal data according to the principles set out in the GDPR, namely: • lawfulness, fairness and transparency; • purpose limitation; • data minimisation; • accuracy; • storage limitation; • integrity and confidentiality; • accountability. Only data that is adequate, relevant and necessary for the purposes determined in advance will therefore be collected.

The data collected depends on the service, on the age of the data subject and on the relationship established with Oficina de Pitágoras. The following data may be processed.

Given the nature of its activity, Oficina de Pitágoras regularly processes the personal data of children and young people. That data is given particular protection. Oficina de Pitágoras undertakes to: • limit collection to what is strictly necessary; • use clear language in the information addressed to data subjects; • restrict access to the professionals who genuinely need the data; • impose duties of confidentiality; • implement proportionate security measures; • avoid unnecessary disclosure of personal information; • ensure that the data is used for the purpose for which it was collected; • take the age and maturity of the minor into account. Minors hold their own data protection rights. Those rights may, as the law provides, be exercised by their legal representatives, without prejudice to the minor's growing autonomy according to age and maturity.

Oficina de Pitágoras does not systematically collect health data. In certain situations, however, it may be necessary to know specific information relating to: • allergies; • relevant medication; • clinical conditions that may require emergency intervention; • physical limitations; • special educational needs; • information indispensable to a participant's safety; • adjustments needed to take part in an activity. Collection of this information is limited to what is strictly necessary for the purpose in question. Whenever special categories of personal data are processed, an appropriate legal basis under Article 9 of the GDPR will be ensured. Access to that data is particularly restricted.

Certain services may be provided by external practitioners or specialist collaborators who, by virtue of their profession, are subject to their own legal, ethical or professional rules. Depending on the nature of the service and the professional autonomy involved, these practitioners may: • process data under the responsibility of Oficina de Pitágoras; • act as independent controllers; • or be joint controllers. Whenever the nature of the service warrants it, the data subject will be informed of the identity of the practitioner responsible and of the specific rules that apply to that processing.

Personal data may be used for the purposes described in the following sections.

Processing personal data does not, in every case, depend on the data subject's consent. Depending on the purpose, different legal bases may apply.

Confirming that this Privacy Policy has been read and understood serves to show that the data subject was given the information the law requires about the processing of their personal data. That declaration is not general consent to every kind of processing of personal data. Whenever a particular processing operation depends on consent, that consent will be requested separately and specifically.

The forms used by Oficina de Pitágoras may distinguish between fields that are: • mandatory; • optional. Data marked as mandatory is information needed to: • process the enrolment; • provide the service; • ensure the participant's safety; • issue documentation; • invoice; • comply with a legal obligation. If that data is not provided, it may not be possible to complete the enrolment or to provide the service requested. Optional data may be left out without affecting the enrolment, unless it later proves indispensable to the specific service requested.

Oficina de Pitágoras carries out its activity with a team that may include professionals on different legal arrangements, including: • employees; • collaborating teachers; • trainers; • independent service providers; • specialist practitioners; • activity leaders; • group leaders; • specialist professionals; • other collaborators. Whatever the legal arrangement, access to personal data is limited to the information strictly necessary to carry out their duties. These professionals may have access to: • the student's name; • level of education; • subject; • timetable; • strictly necessary contact details; • relevant educational information; • information indispensable to the student's safety or support. They are bound by duties of: • confidentiality; • discretion; • security; • data protection; • use of the data exclusively for professional purposes. Information obtained while working with Oficina de Pitágoras may not be used for: • private purposes; • their own commercial approaches; • building personal databases; • directly soliciting clients; • unauthorised disclosure to third parties; • any purpose unconnected with the duties performed. Where a service provider processes personal data on behalf of Oficina de Pitágoras in a situation legally qualifying as processing on behalf of a controller under the GDPR, the corresponding data protection agreement will be entered into.

Anybody applying to work with the Oficina de Pitágoras through the “Join the team!” page provides identification and contact details, the subjects and levels they can teach, their qualifications, their availability, their timetable if they send one, their CV and a photograph. This data is processed only to assess the application and to contact the applicant, on the basis of steps taken at the applicant’s request before entering into a contract. Access is limited to the management of the Oficina de Pitágoras: it is not shared with other collaborators or with third parties, and the CV is not sent by e-mail. The application, CV, photograph and timetable are kept for 12 months from when they are received and then deleted automatically. If the applicant expressly agrees to their CV being kept for future vacancies, the period is 5 years (60 months). That agreement can be withdrawn at any time, using the contact details in this Policy. The data of anybody who joins the team is then processed under the section on teachers, trainers, specialists, activity leaders and other collaborators.

Oficina de Pitágoras applies the need-to-know principle: each professional should have access only to the data indispensable to carrying out their duties. Accordingly: • the administrative team may access the information needed for administrative and financial management; • teachers may access the educational information needed about the students they teach; • trainers may access the information needed about their trainees; • specialist practitioners may access only the data needed for the specific service; • those responsible for payments may access the financial information needed; • other collaborators have access only where it is indispensable.

Oficina de Pitágoras does not sell, rent or trade personal databases. Data may, however, be disclosed or made available to third parties where that is necessary or legally permitted. These may include: • the accountant or accountancy firm; • invoicing platforms; • banks; • payment service providers; • insurers; • IT service providers; • website hosting providers; • e-mail providers; • digital storage providers; • management platforms; • educational platforms; • video-conferencing services; • maintenance providers; • security companies; • external practitioners; • partners involved in particular activities; • public bodies; • the Portuguese tax authority; • courts; • police authorities; • administrative authorities; • other bodies whenever disclosure is legally required. The information disclosed is limited to what is strictly necessary for the corresponding purpose.

Whenever Oficina de Pitágoras uses external entities that process personal data on its behalf, it will seek to select suppliers offering adequate guarantees of compliance with data protection rules. Where legally required, data processing contracts or clauses will be entered into, setting out: • the subject matter of the processing; • its duration; • its purpose; • the categories of data; • the categories of data subjects; • the duty of confidentiality; • security measures; • conditions of access; • obligations to delete or return the data.

Oficina de Pitágoras may use digital means of communication, including: • WhatsApp; • e-mail; • SMS; • telephone; • educational platforms; • video-conferencing platforms. These may be used for communications about: • enrolment; • timetables; • payments; • how lessons run; • documentation; • activities; • changes; • educational support; • other matters connected with providing the service. The WhatsApp contact for Oficina de Pitágoras is exclusively the number +351 926 125 158, which is also the number used for telephone calls. Some of these platforms are operated by third parties and may process information in accordance with their own privacy policies. Oficina de Pitágoras will seek to avoid sending particularly sensitive information through these channels where it is not necessary.

Some of the technology providers used by Oficina de Pitágoras may process or store data outside the European Economic Area. Where an international transfer of personal data takes place, the legal mechanisms provided for by law will be used, namely: • adequacy decisions of the European Commission; • standard contractual clauses; • other safeguards provided for in the GDPR.

Personal data is kept only for as long as is necessary for the purpose for which it was collected, without prejudice to legally mandatory retention periods.

Oficina de Pitágoras applies technical and organisational measures appropriate to the risk of the processing carried out. These may include: • user authentication; • use of passwords; • restricted access; • permission management; • device protection; • backups; • software updates; • IT security mechanisms; • protected storage; • internal confidentiality rules; • awareness or training for collaborators; • procedures for handling incidents. Despite the measures in place, no computer system can guarantee the complete absence of risk.

Whenever an incident occurs that may constitute a personal data breach, Oficina de Pitágoras will assess: • the nature of the incident; • the data affected; • the number of data subjects potentially involved; • the potential consequences; • the likelihood and severity of the risk. Where the legal conditions are met, notification will be made to the Portuguese data protection authority — CNPD — and, where applicable, to the data subjects themselves.

Under the GDPR, and subject to the conditions it lays down, data subjects have the following rights.

These rights may be exercised through the following contact: E-mail: admin@oficinadepitagoras.xyz or by writing to: Oficina de Pitágoras Rua dos Netos, 64, 9000-084 Funchal Madeira — Portugal Contact may also be made by telephone, or by WhatsApp, on +351 926 125 158. Further information may be requested where it is necessary to: • confirm the identity of the person making the request; • confirm the authority of a representative; • ensure that data is not improperly disclosed to third parties. Requests are handled within the time limits provided for by law.

Where the data of children or young people is involved, these rights may be exercised by their legal representatives under the conditions provided for by the applicable legislation. Oficina de Pitágoras will, however, take into account: • the age of the minor; • their degree of maturity; • the nature of the data; • the context of the processing; • the minor's own fundamental rights; • their best interests.

Data subjects may lodge a complaint with the competent supervisory authority in Portugal: Comissão Nacional de Proteção de Dados — CNPD Further information is available at www.cnpd.pt. Lodging a complaint does not prevent the data subject from contacting Oficina de Pitágoras first, to try to resolve any question about the processing of their personal data directly.

Communications strictly necessary to the existing relationship with students, guardians, trainees or clients are not, as a rule, marketing communications. They may include: • the start of lessons; • timetable changes; • school holidays; • how the centre runs; • payments; • documentation; • activities directly related to the service agreed. Promotional communications, by contrast, may depend on consent or on another legally permissible basis. Where consent is requested for marketing, it: • is optional; • is presented separately from the enrolment; • is not pre-ticked; • may be refused; • may be withdrawn at any time. Refusing or withdrawing consent for marketing does not affect the services agreed.

Images captured during activities may serve different purposes. Whenever the use of an identifiable photograph, image, voice or video for institutional or promotional purposes depends on consent, a specific and separate authorisation will be presented. The image authorisation: • is optional; • is separate from the enrolment; • is independent of acknowledging this Policy; • may be refused; • may be withdrawn as regards future uses. Refusing the image authorisation cannot, in itself, prevent participation in the main services of Oficina de Pitágoras. In the case of minors, authorisation is requested from their legal representative as the law provides. Wherever possible and appropriate to the age and maturity of the minor, Oficina de Pitágoras will also respect the wishes expressed by the minor about the use of their image. Withdrawing consent does not affect the lawfulness of uses made before the withdrawal.

Where there is an appropriate legal basis, images or content relating to activities may be published on the institutional channels of Oficina de Pitágoras. These may include: • the website; • Instagram; • Facebook; • TikTok; • YouTube; • other social media or institutional platforms. Use of these platforms is also subject to the privacy policies and terms set by their operators.

The Oficina de Pitágoras website may use cookies or equivalent technologies. Depending on their purpose, cookies may be classified as: • strictly necessary; • functional; • analytical; • advertising; • third-party. Cookies strictly necessary for the operation or security of the site, or to provide features expressly requested by the user, may be used without consent where the law permits. Cookies whose use depends on consent are only activated after a valid choice by the user. Where applicable, the website will provide mechanisms allowing the user to: • accept optional cookies; • reject optional cookies; • configure their preferences; • change those preferences later. Specific information about the cookies actually used, their providers, purposes and durations will be made available through the cookie manager or through a separate Cookie Policy. As at this date, the website uses only a technical session cookie, strictly necessary for the secure operation of the forms, and uses no analytics or advertising cookies.

The website or the communications of Oficina de Pitágoras may include links to pages, applications or platforms operated by third parties. Oficina de Pitágoras does not control the privacy practices of external entities. Users are advised to read their privacy policies before providing personal data through those platforms.

Whenever new systems, forms, platforms or procedures involving the processing of personal data are implemented, Oficina de Pitágoras will seek to build in data protection principles from the design stage. Wherever possible, settings will be adopted that limit, by default: • the amount of data collected; • the extent of the processing; • the retention period; • the number of people with access; • the public exposure of the data.

Data subjects, guardians or legal representatives should tell Oficina de Pitágoras about any relevant change to the data previously provided. This includes: • changes of contact details; • change of address; • change of guardian; • change of billing details; • change of school; • relevant changes concerning the student's safety or participation. Oficina de Pitágoras may periodically ask for certain data to be confirmed or updated where that proves necessary.

Where a guardian or legal representative provides personal data about a minor or a third party, they declare that they are entitled to provide that information for the purpose in question. They should also ensure, as far as they are able, that the data provided is accurate, current and adequate.

This Policy may be revised whenever there is: • a change in legislation; • a change in the organisation; • a change of the entity responsible; • the creation of new services; • the adoption of new platforms; • a change in the purposes of the processing; • a significant change to internal procedures; • a change in the technology providers used. The updated version will be made available on the Oficina de Pitágoras website, showing the date it was last updated. Whenever the changes are materially relevant to ongoing processing, appropriate means will be used to inform data subjects.

For any question about this Privacy Policy, about the processing of personal data or about exercising the rights provided for in the GDPR, the following contacts may be used: Oficina de Pitágoras Rua dos Netos, 64, 9000-084 Funchal Madeira — Portugal Telephone: +351 926 125 158 WhatsApp: +351 926 125 158 E-mail: admin@oficinadepitagoras.xyz Website: oficinadepitagoras.xyz