GDPR Compliance

1. Data Controller

IVALION by Imersa VRTOOLS AI ("IVALION", "we", "our") acts as the data controller for the processing of personal data through this platform, in accordance with the General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679 of the European Parliament and of the Council. IVALION is a global AI-first sales infrastructure platform for the real estate industry, operated by Imersa VRTOOLS AI Tecnologia Ltda., headquartered in São Paulo, SP, Brazil, with global operations.

Data Protection Officer (DPO): [email protected]

2. Scope of Application

This GDPR Compliance Statement applies to the processing of personal data of individuals located in the European Economic Area (EEA), the United Kingdom, and Switzerland. It supplements our Privacy Policy and provides specific information required under the GDPR. Where IVALION offers goods or services to individuals in the EEA or monitors their behavior within the EEA, the GDPR applies regardless of where IVALION is established.

3. Lawful Bases for Processing

Under Article 6(1) of the GDPR, IVALION processes personal data based on the following lawful bases:

4. Data Subject Rights

Under the GDPR, data subjects in the EEA have the following rights:

• Art. 15 Right of Access: Obtain confirmation of whether personal data is being processed and access to such data.
• Art. 16 Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Art. 17 Right to Erasure: Request deletion of personal data ("right to be forgotten") under applicable conditions.
• Art. 18 Right to Restriction: Request restriction of processing in certain circumstances.
• Art. 20 Right to Data Portability: Receive personal data in a structured, commonly used, machine-readable format.
• Art. 21 Right to Object: Object to processing based on legitimate interests, including profiling.
• Art. 22 Automated Decision-Making: Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects.

To exercise any of these rights, contact our DPO at [email protected]. We will respond within 30 days of receipt, as required by the GDPR.

5. International Data Transfers

As IVALION is headquartered in Brazil and operates globally, personal data from the EEA may be transferred to countries outside the EEA. Such transfers are conducted in compliance with Chapter V of the GDPR, using the following safeguards:

• • Standard Contractual Clauses (SCCs): As adopted by the European Commission (Decision 2021/914), ensuring adequate protection for transferred data.
• • Adequacy Decisions: Where applicable, transfers to countries recognized by the European Commission as providing adequate data protection.
• • Supplementary Measures: Additional technical and organizational measures, including encryption and pseudonymization, to ensure the effectiveness of the transfer mechanism.

6. Data Processing for AI and Analytics (GENESIS)

IVALION's GENESIS platform processes behavioral data within immersive environments to generate commercial intelligence for real estate developers. This processing is based on legitimate interest (Art. 6(1)(f)) and is subject to the following safeguards:

• • Data is aggregated and anonymized before being shared with third-party clients.
• • Individual-level profiling does not produce legal effects on data subjects.
• • Data subjects may object to this processing at any time by contacting our DPO.
• • A Data Protection Impact Assessment (DPIA) has been conducted for GENESIS processing activities.

7. Data Retention

Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected. Specific retention periods are as follows: account data is retained for the duration of the contractual relationship and up to 5 years thereafter; behavioral analytics data is retained for up to 24 months in aggregated form; marketing consent records are retained for the duration of the consent plus 3 years; and server logs are retained for up to 12 months.

8. Data Breach Notification

In the event of a personal data breach, IVALION will notify the competent supervisory authority within 72 hours of becoming aware of the breach, as required by Article 33 of the GDPR. Where the breach is likely to result in a high risk to the rights and freedoms of data subjects, affected individuals will be notified without undue delay, in accordance with Article 34.

9. Sub-Processors

IVALION engages the following categories of sub-processors, all bound by data processing agreements compliant with Article 28 of the GDPR:

10. Supervisory Authority

Data subjects in the EEA have the right to lodge a complaint with their local supervisory authority if they believe their data protection rights have been violated. A list of EU data protection authorities is available at the European Data Protection Board (EDPB) website: edpb.europa.eu.

11. Contact