Brazil

Country-Specific Privacy Addendum for Brazil, last updated: 19 February 2026

This Country-Specific Privacy Addendum for Brazil (“Addendum”) applies to all IDC customers and website visitors based in Brazil. This Addendum supplements the information contained in the Privacy Policy.

IDC is respectful of data privacy and adopts best practices in compliance with applicable privacy law and regulations, including the Brazilian General Data Protection Law (“LGPD”), Federal Law no. 13,709/2018, entered into force on September 18, 2020. For purposes of the LGPD, IDC acts as the controller (“controlador”) of personal data collected through its websites and services.

1. Data Subject Rights

   In addition to rights outlined in Section 8 of the Privacy Policy, you have the following rights:

   1. The right to obtain confirmation of the existence of the processing of your personal data;
   2. The right to anonymize, block or delete unnecessary or excessive data or data processed in noncompliance with the provisions of the LGPD; and
   3. The right to information about the possibility of denying consent and the consequences of such denial; and
   4. The right to petition the National Data Protection Authority (ANPD) regarding your personal data.

2. International Data Transfers

   1. IDC is headquartered in the United States, and personal data collected from Brazilian data subjects may be transferred to, stored, and processed in the United States and other countries where IDC, its affiliates, service providers, or business partners operate. Such international transfers are conducted in accordance with Article 33 of the LGPD and applicable regulations, and may rely on: (a) standard contractual clauses or other contractual instruments approved by competent authorities; (b) transfers to countries or international organizations that have been recognized by Brazilian authorities as providing an adequate level of data protection; or (c) other lawful transfer mechanisms as permitted under applicable law.

3. Data Protection Officer

   1. IDC has designated a Data Protection Officer (“Encarregado de Protecao de Dados”) in accordance with LGPD requirements. Inquiries regarding IDC’s processing of personal data or requests to exercise your rights under the LGPD may be directed to our Privacy Team at privacy@idc.com.

4. How to Exercise Your Rights

   1. You may exercise any of the rights described in Section 8 of the Privacy Policy and Section 1 of this Addendum by contacting IDC at privacy@idc.com. IDC will respond to your request within fifteen (15) business days of receipt, provided that IDC reserves the right to extend such period for complex requests or where additional time is necessary to properly address your request.

5. Changes to this Addendum

   1. We may periodically modify the provisions of this Addendum and encourage you to review it from time to time in order to stay up to date with the most recent developments in the area of the protection of your personal data. In the event of significant changes, we may also choose to notify you via email should we have your email address in our records.
   2. Updated versions of this Addendum will be published on our website.
   3. This Addendum was last updated on 19 February 2026.