Your data deserves clarity, security, and respect.

01

Who is responsible for the data

The Saint Jude platform is operated by Erik Scaranello Ltda., registered in Brazil under CNPJ No. 18.252.603/0001-46, referred to in this Policy as “Saint Jude,” “we,” “us,” or “our.”

Depending on the context, Saint Jude may act as a controller of personal data, for example with respect to registration information, business contacts, website users, communications, and account administration. When an organization uses the platform and determines the purposes and essential means of processing data relating to its projects and personnel, that organization will generally act as the controller and Saint Jude will act as an operator under the LGPD or a processor under the GDPR.

When we act as an operator or processor, we process data in accordance with the customer's documented instructions, applicable agreements, and, where necessary, a Data Processing Agreement or equivalent instrument. The customer remains responsible for decisions regarding the purposes of processing and for obligations applicable to it as the controller.

02

Where this policy applies

This Policy applies to data processed through:

• Saint Jude's corporate website and blog;
• contact, demonstration, and pilot application forms;
• LinkedIn campaigns and other promotional platforms;
• our partner and channel program;
• registration, access, and use of the Saint Jude platform;
• authorized integrations with project management tools and third-party services;
• commercial, institutional, technical, and support communications.

03

Data we may collect

Data provided directly

We may collect information such as:

• first and last name, business email address, and phone number;
• job title, business area, company, and industry;
• company size and approximate number of projects or teams;
• management tools used by the organization;
• interest in a pilot, demonstration, purchase, or partnership;
• information voluntarily provided through messages, meetings, and forms;
• data necessary to create, authenticate, and administer an account.

Data collected automatically

When you access our websites or services, we may collect:

• IP address and device or browser identifiers;
• device type, browser, and operating system;
• pages visited, date, time, and duration of the visit;
• referral source and campaign parameters, such as UTMs;
• clicks, scrolling, interactions, and browsing events;
• cookies and similar technologies, in accordance with your preferences and applicable law.

Business data processed by the platform

When an organization uses Saint Jude and authorizes an integration, we may process data relating to projects, programs, portfolios, tasks, sprints, teams, allocations, estimates, hours, costs, schedules, risks, dependencies, deliverables, indicators, and other information made available by the integrated system.

Depending on the configuration of the integrated tool, these records may include names, business email addresses, job titles, user identifiers, activities performed, work assignments, or other information relating to the professionals involved.

Saint Jude does not intentionally request that customers provide special categories of personal data or sensitive personal data that is not necessary to provide the services. Customers should avoid providing such information through integrations, free-text fields, or other features unless there is a legitimate need, an appropriate legal basis, and the safeguards required by applicable law.

Source of data obtained through integrations

Not all personal data processed by Saint Jude is collected directly from the data subject. When an organization connects Jira, Azure DevOps, ClickUp, monday.com, Asana, or another system, data may be obtained from those third-party services and from the customer organization itself. When Saint Jude acts as an operator or processor, the controller customer is responsible for providing data subjects with the information and notices required by applicable law, and Saint Jude will provide contractual assistance where necessary.

04

How we use data

We may use data to:

• respond to requests, questions, and inquiries;
• evaluate companies interested in Saint Jude pilot programs;
• schedule meetings, presentations, and demonstrations;
• evaluate and manage partner and channel relationships;
• create, authenticate, and administer user accounts;
• provide, operate, maintain, secure, and improve the platform;
• perform analyses of projects, programs, portfolios, and teams authorized by the customer;
• provide technical support and customer service;
• measure the effectiveness of campaigns and content;
• personalize the experience and improve our services;
• prevent fraud, abuse, unauthorized access, security failures, and incidents;
• perform contracts, comply with legal or regulatory obligations, and establish, exercise, or defend legal rights;
• send commercial, institutional, technical, or service-related communications consistent with the existing relationship, the recipient's preferences, and applicable law.

05

Legal bases

Personal data will be processed on an appropriate legal basis considering the context, purpose, and applicable law. Depending on the circumstances, we may rely on:

• the data subject's consent, when required or appropriate;
• performance of a contract or steps taken at the data subject's request before entering into a contract;
• compliance with a legal or regulatory obligation;
• the legitimate interests of Saint Jude, the customer, or a third party where permitted, after evaluating the purpose, necessity, and the rights and expectations of the data subject;
• the establishment, exercise, defense, or protection of rights in judicial, administrative, or arbitration proceedings, as applicable;
• other legal bases permitted under applicable law, including, where applicable under the LGPD, credit protection.

Where processing is based on consent, consent may be withdrawn or revoked at any time using the available methods, without affecting the lawfulness of processing carried out before the withdrawal.

When Saint Jude acts solely as an operator or processor on behalf of a business customer, determining the legal basis applicable to data entered or made available by the customer will generally be the responsibility of the relevant controller.

06

Pilots and partners

Pilots and demonstrations

Data submitted through campaigns or pilot forms may be used to assess company fit, understand its project management environment, contact the company, schedule meetings, organize the pilot, and evaluate its results. Submitting a form does not guarantee approval or availability of a pilot.

Partner and channel program

Data relating to organizations interested in the partner program may be used to evaluate the organization's profile, present the partnership model, conduct business meetings, onboard the partner, and manage opportunities related to the program.

Learn more about the program at saintjude.co/en/partner .

07

Integration data

Saint Jude may connect, with authorization, to tools such as Jira, Azure DevOps, ClickUp, monday.com, Asana, and other supported services. Access is limited to permissions granted through the integration, permissions already available to the account being used, and information necessary to provide the enabled functionality.

The customer and the user enabling an integration are responsible, according to their respective roles, for ensuring that they have the necessary rights, permissions, authorizations, and legal bases to make the organization's and relevant individuals' data available to Saint Jude. Having technical access to a system, project, API, token, or dataset does not, by itself, mean that the user has organizational authorization to share that information with third parties.

Credentials, tokens, and integration keys must be protected and used exclusively to establish and maintain authorized connections. Saint Jude will apply access controls and security measures appropriate to the context of the integration and will use those credentials only for purposes necessary to provide the service.

When enabling an integration, the user must also comply with the authority, authorization, and data-use requirements described in our Terms and Conditions .

08

Artificial intelligence and automated processing

Certain Saint Jude features may use artificial intelligence, statistical models, automated rules, or other analytical techniques to organize information, identify patterns, compare indicators, anticipate risks, and generate analyses or recommendations related to project management.

These analyses are intended to support decision-making. Saint Jude should not be used as the sole basis for decisions that produce legal, disciplinary, financial, or other significant effects on an individual without human review and the safeguards required by applicable law.

Where applicable, data subjects may exercise rights relating to automated processing, including requesting information, challenging results, or requesting review in circumstances provided under the LGPD, GDPR, or other applicable law.

09

Commercial and institutional communications

We may send communications relating to requests, pilots, demonstrations, partnerships, products, security, support, content, and Saint Jude updates in accordance with the existing relationship, applicable legal basis, and the recipient's preferences.

You may opt out of promotional communications at any time through the unsubscribe link included in the message or by emailing contact@saintjude.co. Communications strictly necessary for account administration, security, or delivery of the service may continue to be sent.

10

Who we may share data with

We may share data only where necessary and consistent with the disclosed purposes with:

• hosting, infrastructure, database, and cloud storage providers;
• email, CRM, customer support, authentication, monitoring, and security services;
• analytics, advertising, and measurement platforms, such as Google and LinkedIn, in accordance with cookie preferences and applicable law;
• service providers and subprocessors acting on Saint Jude's behalf that are, where applicable, subject to contractual data protection, security, and confidentiality obligations;
• legal, accounting, financial, technical, and security advisers;
• government authorities, regulators, courts, or other competent bodies where required by law or pursuant to a valid request;
• parties involved in investments, reorganizations, financing, mergers, acquisitions, or asset sales, subject to appropriate safeguards;
• technology providers necessary to operate analytics or artificial intelligence features, where used and only to the extent necessary to provide the relevant functionality.

When Saint Jude acts as an operator or processor, the use of subprocessors will be governed by applicable agreements and the obligations imposed by relevant data protection law.

Saint Jude does not sell personal data.

11

International data transfers

Certain providers, subprocessors, and technology partners may store or process data in countries other than the country where the data subject or customer is located. In such circumstances, international transfers of personal data may occur.

Where an international transfer is subject to the LGPD, GDPR, or other applicable law, Saint Jude will use the legal mechanism and safeguards required for the relevant transfer. These may include adequacy decisions, standard contractual clauses, approved contractual clauses, binding corporate rules, or other legally recognized mechanisms, together with appropriate technical and organizational measures.

12

Cookies, analytics, and advertising

We use cookies and similar technologies to operate our websites, maintain preferences, understand browsing activity, measure content and campaigns, and, where permitted, support advertising and remarketing.

Cookies may be classified as:

• necessary: essential for basic functionality, authentication, and security;
• functional: remember choices and preferences;
• analytics: help us understand access, usage, and performance;
• advertising: help measure, attribute, and personalize campaigns where permitted.

We may use tools including Google Analytics, Google Tag Manager, and LinkedIn Insight Tag. Where required by applicable law, non-essential cookies will be used only after the user has made a choice or provided consent. Preferences may later be changed through the consent mechanism available on the website or through browser settings.

13

Data retention

Personal data will be retained only for as long as necessary to fulfill the disclosed purposes, provide the services, administer the relationship with the user or customer, maintain legitimate records, comply with legal and regulatory obligations, and establish, exercise, or defend legal rights.

Lead data that does not result in a contractual relationship may be retained for up to 24 months after the last interaction, unless deletion is requested earlier or there is a legitimate basis for retaining it for a different period. Contractual, tax, security, audit, and legal-rights records may be retained for the periods required or permitted by applicable law.

At the end of the applicable retention period, data will be deleted, anonymized, or, where permitted or required by law, retained in a protected form with restricted access.

Business and personal data processed by Saint Jude on behalf of customers may be subject to retention periods defined in the agreement, service settings, or documented instructions of the relevant controller customer, subject to applicable legal obligations and technical deletion and backup cycles.

14

Information security

We implement technical and administrative measures designed to protect personal data and business information against unauthorized access, loss, alteration, disclosure, destruction, or improper processing. Depending on the context, these measures may include access controls, authentication, privilege restrictions, security logging, encryption, backups, monitoring, and vulnerability management.

No technology environment is completely immune from risk. If a security incident involving personal data occurs and legal or regulatory action is required, we will take containment, investigation, and remediation measures and provide notifications to customers, data subjects, and competent authorities in accordance with the responsibilities and deadlines established under applicable law.

15

Your rights

Under the LGPD, GDPR, and other applicable laws, you may, depending on the circumstances, have rights including the right to:

• obtain confirmation of processing and access your personal data;
• request correction or rectification of incomplete, inaccurate, or outdated data;
• request anonymization, blocking, limitation, restriction, or deletion of data where applicable;
• request data portability where applicable legal requirements are satisfied;
• obtain information about categories of recipients and disclosures of personal data;
• request deletion of data processed on the basis of consent where applicable, subject to lawful retention requirements;
• receive information regarding the option not to provide consent and the consequences of that choice;
• withdraw or revoke consent at any time where consent is the legal basis for processing;
• object to processing where that right is available under applicable law;
• request information about automated processing and exercise applicable rights to challenge or seek review of such processing;
• request information regarding international transfers of your personal data where applicable;
• submit a complaint or petition to Brazil's National Data Protection Authority — ANPD or, where the GDPR applies, to the competent data protection supervisory authority;
• exercise any other rights provided under data protection laws applicable to your circumstances.

Requests relating to personal data may be sent to contact@saintjude.co. We may request additional information reasonably necessary to verify the requester's identity, locate relevant data, and prevent unauthorized disclosure or alteration of information belonging to third parties.

Where Saint Jude acts as an operator or processor for a business customer, a request relating to data controlled by that customer may be referred to the relevant controller. In such cases, we will provide the customer with assistance as required under the applicable agreement and law.

The exercise of privacy rights is subject to the conditions, limitations, and exceptions provided under applicable law. We will respond to requests within legally required timeframes, taking into account Saint Jude's role in the relevant processing activity.

16

Children and minors

Saint Jude's services are intended for businesses and professionals and are not intentionally directed to children or minors. We do not knowingly seek to collect data from children or minors through our commercial channels or platform. If inappropriate processing is identified, we will take appropriate steps to delete, block, restrict, or otherwise regularize the data in accordance with applicable law.

17

Changes and contact

This Policy may be updated to reflect changes to Saint Jude, its features, integrations, service providers, processing practices, or applicable law. The most current version will be published on this page together with its effective date. Where material changes significantly affect existing users or customers, we may use reasonable means to communicate them.

Questions, requests, or complaints regarding privacy and data protection may be sent to: