Privacy and Personal Data
Protection Policy

Having your personal data properly cared for is a right protected by Brazilian Law No. 13,709 of 14 August 2018, the General Personal Data Protection Law (Lei Geral de Proteção de Dados Pessoais, LGPD), and an obligation SixTree has towards you.

This Policy adopts privacy by design and explains how SixTree processes your personal data, in accordance with:

• the Brazilian Federal Constitution of 1988, article 5, items X and LXXIX;
• Law No. 13,709/2018 (LGPD);
• Law No. 12,965/2014 (Brazilian Internet Civil Framework, Marco Civil da Internet) and Decree No. 8,771/2016;
• regulations issued by the National Data Protection Authority (Autoridade Nacional de Proteção de Dados, ANPD).

This Policy applies to the personal data processed by SixTree in its products, Advisory services and digital channels, including:

• visitors to the sixtree.co website and its subdomains;
• people who take the Diagnostic Brief;
• people who get in touch or request a product or service through the website;
• people who book a call with SixTree;
• leads, clients and business partners;
• professionals who interact with SixTree at events and through official channels.

It does not apply to third-party websites and services reached through links in our channels. We recommend reading those third parties' policies.

SIXTREE CONSULTORIA EM DESENVOLVIMENTO SUSTENTÁVEL LTDA CNPJ (Brazilian company registration number) 62.144.984/0001-31 Quadra ARNO 12, Alameda das Aroeiras, H.M. 02, Lote 03, CEP 77.001-048, Palmas/TO, Brazil Privacy matters: office@sixtree.co

To make this document easier to understand, we adopt the terms defined in article 5 of the LGPD, summarised below:

Personal data

information relating to an identified or identifiable natural person.

Sensitive personal data

personal data on racial or ethnic origin, religious belief, political opinion, membership of a trade union or of an organisation of a religious, philosophical or political nature, data concerning health or sex life, and genetic or biometric data, when linked to a natural person.

Anonymised data

data relating to a data subject who cannot be identified, considering the use of reasonable technical means available at the time of processing.

Data subject

the natural person to whom the personal data being processed refers.

Processing

any operation carried out with personal data, such as collection, production, receipt, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, deletion, evaluation or control of the information, modification, communication, transfer, dissemination or extraction.

Controller

the natural or legal person, governed by public or private law, responsible for decisions regarding the processing of personal data.

Processor

the natural or legal person, governed by public or private law, that processes personal data on behalf of the Controller.

Data Protection Officer (Encarregado, DPO)

the person appointed by the Controller to act as the channel of communication between the Controller, data subjects and the National Data Protection Authority (ANPD).

Consent

a free, informed and unambiguous statement by which the data subject agrees to the processing of their personal data for a specific purpose.

Anonymisation

the use of reasonable technical means available at the time of processing, through which data loses the possibility of being associated, directly or indirectly, with an individual.

ANPD

the National Data Protection Authority, the federal public administration body responsible for safeguarding, implementing and enforcing compliance with the LGPD throughout Brazil.

We only collect the data needed for the purposes of this Policy (principle of necessity, article 6, III).

5.1 Diagnostic Brief

The Diagnostic Brief is a free reading of where your organisation stands. When you take it, we process:

• The respondent: name, email and role in the organisation.
• The organisation: name, CNPJ (optional), whether it is a legal entity, type of organisation (private, third sector or public), sector, what it offers, team size, business model and fundraising history.
• How you heard about SixTree.
• The language in which you answered.
• Your answers to the questions in the questionnaire, which concern recent events in the organisation.
• Response time per question, recorded automatically and used only to improve the questionnaire. It does not appear in your reading and is not shared.
• The result calculated from your answers, according to methodological criteria defined by SixTree (section 7.1).
• Record of consent: the version of the text accepted, and the date and time of acceptance and of email confirmation.
• Access account: when you confirm your email through the link we send, we create an account linked to your address, without a password, used to link your answers to you and to let you come back.

The reading is only sent after you confirm your email address. Answers that are never confirmed are deleted (section 10).

We do not ask for sensitive personal data. The questions concern the organisation. If you mention other people's data, such as partners', treat it with the same care you would in a conversation with SixTree.

5.2 Contact form

When you write to SixTree, we process your name, email, phone number, organisation (optional), the subject you choose, which may be the product or service you are interested in, and the message you write.

5.3 Bookings and calls

When you book a call with SixTree, through the calendar on the website or through any other channel, such as email or message, we process your name, email, the agreed date, time and time zone, and whatever you write when booking. The invitation and the call link are sent to your email, with links to this Policy and to the Terms of Use.

Every booked call is transcribed, to keep a record of what was said and to prepare the next steps. By booking, through any channel, you agree to the transcription, under this Policy and the Terms of Use. Audio and video recording only takes place with your agreement, requested at the start of the call; without it, the call is not recorded. You may ask at any time for the transcription and the recording to be deleted (section 12).

For products and services under contract, recording and transcribing the sessions is part of the service provided and is set out in the proposal or contract.

5.4 Cookies and local storage

We use two categories. We do not use advertising cookies or cross-site tracking cookies.

Two third-party services used at specific points on the website may also store data in your browser, solely so that they work: the booking calendar (Cal.com), when you open it, and the security check on the forms (Cloudflare Turnstile). Neither is used for advertising.

You can change your choice at any time under Cookie preferences, in the website footer. The list of cookies, with name, purpose and duration, is available on request from office@sixtree.co.

• Consent (article 7, I): the Diagnostic Brief, analytics cookies, transcription of the booked call (given when booking), recording of the booked call (given at the start of the call) and institutional communications. You may withdraw it at any time, free of charge, through the channels in this Policy; withdrawal does not affect processing already carried out.
• Preliminary procedures and performance of a contract (article 7, V): replies to enquiries and requests to engage our services, booking and holding calls, proposals and the provision of services, including the recording and transcription of sessions for products and services under contract.
• Legitimate interest (article 7, IX): recording response time per question, for the quality of the questionnaire, and transient IP processing and security checks against abuse of the forms. In both cases the impact on you is minimal, and you may object through the channels in section 12.
• Legal or regulatory obligation (article 7, II): keeping records as required by tax and accounting legislation and by the Brazilian Internet Civil Framework.
• Regular exercise of rights (article 7, VI): defending SixTree in judicial, administrative or arbitration proceedings.

7.1 Automated processing

The Diagnostic Brief reading is generated by automated analysis of your answers, according to methodological criteria defined by SixTree. It describes where the organisation stands and has no legal effect on you or on the organisation. You may ask for the reading to be reviewed by a person at SixTree, and the call we offer after the Brief serves exactly that purpose (article 20 of the LGPD).

SixTree does not sell, rent or trade your personal data.

8.1 Technology processors

They process data on SixTree's behalf, under contract and only for the authorised purposes:

8.2 Professionals bound by confidentiality

Where necessary to provide the services, lawyers, accountants, auditors and associated consultants may have access to personal data, always under confidentiality.

8.3 Authorities

We share data with the competent authorities when there is a court order, a legitimate administrative request or an investigation into fraud or a threat to security. Whenever the law allows, we will let you know.

Some of the processors in section 8.1 are based or keep infrastructure outside Brazil, mainly in the United States. As a result, some of your data is transferred internationally, including the content of the Diagnostic Brief: name, organisation, answers and the reading, which pass through the email services. The same applies to booking data and to the transcription and recording of calls.

These transfers follow Chapter V of the LGPD (articles 33 to 36) and ANPD regulations, based on data protection contractual clauses agreed with each processor, which ensure protection equivalent to or higher than that required in Brazil. The Diagnostic Brief database is held in Brazil.

At the end of the period, data is securely deleted or anonymised, except in the cases set out in article 16 of the LGPD. When you ask for deletion, we erase the data that identifies you; your answers may remain only as anonymous, aggregated statistics.

No system is immune to incidents. If you suspect an incident involving your data, write to office@sixtree.co. If an incident poses a relevant risk or causes relevant harm, we will notify the ANPD and the affected data subjects within the periods set out in article 48 of the LGPD.

Under article 18 of the LGPD, you may request at any time: confirmation that we process your data; access to it; correction; anonymisation, blocking or deletion of unnecessary data or data processed in breach of the law; portability; deletion of data processed on the basis of consent; information about who we share it with; information about the possibility of not giving consent and its consequences; objection to processing based on legitimate interest; withdrawal of consent; and review, by a person, of the automatically generated reading (section 7.1).

Write to office@sixtree.co with the subject line "Data Subject Rights · LGPD". We reply within 15 days. Complex requests may need longer, which we will justify. We may ask for information to confirm your identity before dealing with your request.

Our services are intended for people aged 18 or over in a professional context. We do not knowingly collect data from children or adolescents (article 14). If we identify inadvertent collection, we will delete the data.

If you consider that your request has not been met or that the LGPD has been breached, you may lodge a complaint with the National Data Protection Authority at www.gov.br/anpd.

This Policy may change to reflect new practices, laws or technologies. When a change is significant, we will notify by email anyone with an active registration and update the date at the top. Previous versions are available on request. The version accepted by Diagnostic Brief respondents is recorded alongside their answers.

Data Protection Officer (Encarregado): Emerson Zotti · office@sixtree.co

This Policy is governed by Brazilian law, in particular the Federal Constitution (article 5, X and LXXIX), the LGPD, the Brazilian Internet Civil Framework and its decree, the Consumer Protection Code where applicable, and ANPD resolutions. The courts of the district of Palmas/TO, Brazil, are chosen as the forum, without prejudice to the right of a data subject who is a consumer to bring proceedings in the courts of their place of residence, and without prejudice to the competence of the ANPD.