SpeakSafely Platform Terms of Use

These Terms of Use ("Terms") govern access to and use of the SpeakSafely platform, made available by SafeReport Ltda. Please read them carefully. By accessing or using the Platform, you represent that you have read, understood, and accepted these Terms. If you do not agree with them, do not use the Platform.

This English version is a convenience translation. For Brazilian legal and compliance purposes, the Portuguese text is the reference version.

1. Identification of the provider and acceptance

1.1. The SpeakSafely Platform (speaksafely.com) is owned and operated by SAFEREPORT LTDA, a limited-liability company enrolled with the CNPJ under no. 52.784.630/0001-06, with its registered office at Rua José Henrique Barbosa dos Santos, no. 159, Room 1, Bairro Dom Feliciano, Gravataí/RS, ZIP 94.015-171, email contato@speaksafely.com ("SafeReport").

1.2. SpeakSafely is provided exclusively to business customers (B2B) that contract the Platform to receive and manage reports from their workforce, partners, and third parties.

1.3. These Terms apply to everyone who accesses or uses the Platform, including the Customer, its Authorized Users, and Reporters.

1.4. Where a Contract has been executed between SafeReport and the Customer, these Terms form part of that Contract. In the event of inconsistency or conflict, the provisions of the signed Contract prevail, following the order of precedence set out in it and described in item 23.1, especially as to liability and limitation of liability (Section 18) and venue (Section 24).

1.5. Where there is no signed Contract, the engagement is governed by these Terms and by the Commercial Proposal accepted by the Customer, which defines the plan, modules, prices and, if any, the Special Commercial Condition and the Minimum Commitment Period. In the event of inconsistency, the Commercial Proposal prevails as to those commercial terms, and these Terms prevail on all other matters.

1.6. A Customer that accepts these Terms on behalf of a legal entity represents that it has authority to bind that entity.

2. Definitions

2.1. For the purposes of these Terms, the following terms, when capitalized, have the meanings below:

• Platform or SpeakSafely: software system made available by SafeReport in a web environment, on a SaaS (Software as a Service) basis, for the management of reporting channels, whistleblowing, ethics, and corporate compliance.
• Customer or Licensee: the legal entity that contracts the license to use the Platform.
• Contract: the software-licensing instrument executed between SafeReport and the Customer, including its Summary Table (Quadro Resumo), annexes, and amendments, when one exists.
• Commercial Proposal: a proposal issued by SafeReport and accepted by the Customer, including the related service order or equivalent order document, setting out the plan, modules, quantities, prices, and other commercial terms of the engagement, including any Special Commercial Condition.
• Authorized User: an employee, manager, investigator, or administrator of the Customer with access to the Platform through individual credentials provided by the Customer.
• Reporter or whistleblower: any person who uses the Platform's reporting channels to submit a complaint, report, or other communication.
• Workforce Members: the Customer's employees, interns, apprentices, officers, and directors, as well as third parties (individuals hired directly or professionals assigned by service providers) who work for the Customer on an ongoing basis and have access to the Platform's reporting channel.
• Contracted Base: the number of Workforce Members declared by the Customer at contracting and used to calculate the Monthly Fee, updated only upon the reclassifications described in Section 9.
• Monthly Fee: the monthly amount owed by the Customer for the license to use the Platform, as set out in the Contract or the Commercial Proposal.
• Guaranteed Minimum Fee: the initial monthly amount of the engagement, calculated on the ordinary pricing terms (unit price multiplied by the initial Contracted Base), disregarding any discounts, promotional prices, free periods, or other benefits arising from a Special Commercial Condition, updated by the annual adjustments in item 9.5, below which the ordinary Monthly Fee will not be reduced during the term of the engagement and its renewals.
• Contracted Plan: the set of modules and features covered by the Monthly Fee, corresponding to the Included Modules.
• Included Modules: features made available in the Contracted Plan at no additional charge, including those that depend on the Customer supplying a BYOK key.
• Premium Modules: optional features subject to an additional charge.
• Special Commercial Condition: an economic advantage granted by SafeReport relative to the ordinary pricing terms (for example, a discount, reduced price, annual or prepaid plan, waived or reduced implementation fee, or free months), expressly set out in the Contract or the Commercial Proposal and tied to a Minimum Commitment Period.
• Minimum Commitment Period: the minimum commitment (lock-in) period tied to a Special Commercial Condition and indicated in the Contract or the Commercial Proposal.
• BYOK (Bring Your Own Key): the model in which the Customer is responsible for contracting and supplying its own LLM-provider API key to activate the Platform's Artificial Intelligence modules.
• LLM (Large Language Model): a large-scale language model, from a third-party provider, used by the Artificial Intelligence modules.
• Personal Data: any information relating to an identified or identifiable natural person, under Law No. 13.709/2018 (Brazil's General Data Protection Law – LGPD).
• Security Incident: any confirmed adverse event that compromises the confidentiality, integrity, or availability of Personal Data or of the Customer's confidential information processed on the Platform.
• SLA (Service Level Agreement): the minimum availability and support levels of the Platform, described in Section 12.
• Severe Availability Failure: total unavailability of the Platform for more than 24 (twenty-four) consecutive calendar hours, or monthly availability below 90% (ninety percent), measured under items 12.1 and 12.2, in either case for a cause attributable to SafeReport.
• Support Hours: 9:00 a.m. to 6:00 p.m. (Brasília time), Monday to Friday, excluding national holidays.

3. Nature of the service

3.1. SafeReport grants the Customer a non-exclusive, non-transferable, onerous license to use the Platform, for the term provided in Section 20, on a SaaS basis, together with technical support and updates, within the limits of the Contracted Plan.

3.2. The license does not assign or transfer any intellectual-property rights in the Platform, which remain entirely with SafeReport, under Law No. 9.609/1998 (Software Law) and Law No. 9.610/1998 (Copyright Law).

3.3. The Contracted Plan includes corrective and evolutionary updates that do not represent a substantial change in features. New features, additional modules, or relevant structural changes may be the subject of a specific engagement. SafeReport does not provide custom development services.

3.4. The Platform is a tool to support the implementation and operation of reporting channels, intake, investigation management, and other corporate-compliance processes, including those related to: (i) the measures to prevent and combat sexual harassment and other forms of violence in the workplace under Law No. 14.457/2022 (Emprega + Mulheres Program), including receiving and following up on complaints; (ii) the integrity programs addressed by Law No. 12.846/2013 (Anti-Corruption Law) and Decree No. 11.129/2022; and (iii) psychosocial-risk mitigation and NR-1 (General Provisions and Occupational Risk Management), where applicable.

3.5. SafeReport:

• does not provide legal advice;
• does not prepare a Risk Management Program (PGR);
• does not replace an ethics committee, internal ombuds office, or other governance and compliance structures of the Customer;
• does not verify the truth of reports, does not conduct investigations, and does not make decisions on recorded cases.

3.6. Inquiry into reports, the conduct of investigations, the adoption of measures, and all decisions based on reports received are the Customer's exclusive responsibility. Regulatory compliance depends on processes, internal policies, proper use of the Platform, and the Customer's fulfillment of its legal obligations as employer and data controller.

3.7. The intake and psychosocial-questionnaire modules are intended to support the monitoring and management of reports related to psychosocial factors and do not replace clinical care, medical expert examination, or specialized technical assessment.

4. Accounts, access, and credentials

4.1. Authorized Users access the Platform through individual, non-transferable credentials provided and managed by the Customer.

4.2. The Customer is responsible for the custody, secrecy, and proper use of the credentials of all of its Authorized Users, as well as for the security of its own equipment and networks, and is liable for acts they perform on the Platform.

4.3. The Customer must provide the minimum technical resources for access to and use of the Platform, including devices, internet connectivity, and up-to-date browsers, as informed by SafeReport.

4.4. The Customer must ensure that its Authorized Users know and comply with these Terms and, where applicable, the Contract.

5. Acceptable use and prohibited conduct

5.1. The Platform must be used only for legitimate purposes, such as reporting irregularities, ethical violations, or risk situations truthfully; managing reports impartially and within legal deadlines; and using investigation tools ethically and responsibly.

5.2. It is expressly prohibited to:

• commercialize, resell, sublicense, assign, share, or allow use of the Platform by unauthorized third parties, including by business partners or consultancies to serve their own clients, unless under a specific contract with SafeReport;
• reverse-engineer, decompile, disassemble, or otherwise attempt to access the Platform's source code;
• remove, conceal, or alter copyright notices, trademarks, or other proprietary notices of SafeReport;
• perform penetration tests (pentest), vulnerability scans, or any action that may compromise the security, integrity, or availability of the Platform and of other users, without SafeReport's prior written authorization;
• use the Platform for unlawful, fraudulent, or defamatory purposes, or purposes contrary to public order and applicable law;
• insert or transmit to the Platform data obtained or processed unlawfully;
• submit reports known to be false, slanderous, or defamatory;
• use the Platform for harassment, stalking, or retaliation;
• directly or indirectly attempt to identify or re-identify anonymous Reporters, or circumvent the Platform's anonymity mechanisms;
• register a trademark or visual identity that may cause confusion with "SpeakSafely" or "SafeReport".

5.3. Unlawful use of the Platform authorizes termination of the engagement under Section 20, without prejudice to other available legal measures.

6. Rules applicable to Reporters (whistleblowers)

6.1. Reporting channels are made available by the Customer, which defines their configuration, report categories, and the persons responsible for handling cases. The report is received and handled by the Customer, not by SafeReport.

6.2. Anonymity. The Platform allows reports to be submitted and followed up anonymously, when that option is available on the channel configured by the Customer. For anonymous reports submitted or followed up through the Platform's web pages, including by protocol, the Platform does not record the Reporter's IP address or browser identification (user-agent), and the Customer neither receives nor has access to the IP address or other technical access metadata of anonymous Reporters. The reporting pages do not use third-party tracking or browsing-analytics tools; they may use security and anti-abuse mechanisms solely for those purposes. The application access logs required by article 15 of Law No. 12.965/2014 (Brazilian Internet Civil Framework – Marco Civil da Internet) are kept by SafeReport for 6 (six) months, in confidence and with access restricted to SafeReport; those logs are not made available to the Customer, are provided only under a court order, and are deleted after the legal period, unless retention for a longer period is requested as provided by law. SafeReport takes no measure aimed at identifying anonymous Reporters, including through those logs, and does not share data that would allow their identification, except to comply with a court order. The content of the report and its attachments is defined by the Reporter, who should avoid including information that could identify them if they wish to remain anonymous. On telephone, email, or messaging-app channels, the originating number or address is received by the service that operates the channel. The WhatsApp channel uses SafeReport's own number; WhatsApp is a third-party messaging service chosen by the Reporter, whose message transport is provided by Meta under its own terms and policies, which may involve processing of data outside Brazil, and, once received, the data is processed by the automated conversation flow (Typebot) run by SafeReport itself on an AWS server in the United States (us-east-1 region) and then recorded on the Platform, which is hosted in Brazil (item 13.1). For maximum anonymity, the Reporter should prefer the web channel.

6.3. Good faith. The Reporter must act in good faith and provide information they believe to be true. The content of reports is the responsibility of the person who submits them. Submitting reports known to be false, slanderous, or defamatory is prohibited and may give rise to liability under the law.

6.4. Protocol and follow-up. Upon submitting a report, the Reporter receives a protocol number or follow-up credential, which allows them to track the case through the means made available on the channel. The protocol is personal and must be kept confidential by the Reporter.

6.5. Non-retaliation. The Customer undertakes not to attempt to re-identify anonymous Reporters and is responsible for adopting policies and measures to protect Reporters against retaliation, as well as for responding to reports within the applicable deadlines.

6.6. Telephone channel (0800). When the 0800 Telephone Channel is enabled and calls are recorded or transcribed, SafeReport plays an automatic message at the start of each call informing the Reporter of this. A voice recording is Personal Data and may compromise the Reporter's anonymity; Reporters who wish to preserve it may use the available written channels.

6.7. Reporter data. Personal Data provided by the Reporter is processed by the Customer, as controller, and by SafeReport, as processor, as set out in Section 14. Requests relating to such data must be directed to the Customer.

6.8. Reporting channels are not intended for emergency response. In situations of immediate risk to life or physical integrity, contact the competent authorities.

6.9. Channel evaluation (CSAT). After a case is closed, the Reporter may evaluate the reporting channel. An evaluation made by an anonymous Reporter remains anonymous and is not used by the Customer or by SafeReport to identify them.

7. Customer obligations

7.1. Without prejudice to the other obligations set out in these Terms and in the Contract, the Customer undertakes to:

• use the Platform in accordance with these Terms, the Contract, and applicable law;
• comply with, and cause all of its Authorized Users to comply with, these Terms, and be liable for their acts and omissions;
• not violate intellectual-property rights, confidentiality obligations, or data-protection rules;
• keep its registration and contact data, including the email address for notices, up to date;
• notify SafeReport, within 24 (twenty-four) hours of becoming aware, of any suspected or confirmed compromise of the credentials, accounts, or devices of its Authorized Users, or of unauthorized access to the Platform through its users;
• declare the number of Workforce Members truthfully;
• fulfill the controller obligations set out in the LGPD, including defining the legal basis for the processing carried out;
• not insert or transmit unlawful content or data to the Platform;
• not attempt to re-identify anonymous Reporters;
• conduct inquiries, investigations, and decisions arising from reports and adopt non-retaliation measures.

8. SafeReport obligations

8.1. SafeReport undertakes to:

• make the Platform available in accordance with the service levels in Section 12;
• provide technical support during Support Hours and through the channels indicated in Section 12;
• maintain LGPD compliance, as processor, and implement the security measures described in Section 13;
• notify the Customer of Security Incidents within the timeframes in Section 14;
• make available the updates included in the Contracted Plan;
• maintain Platform documentation and training materials;
• not use the Customer's data for purposes other than providing the contracted services, except for the generation and use of aggregated and anonymized metrics under item 15.5, within the limits of items 15.6 to 15.8.

9. Pricing, billing, and Guaranteed Minimum Fee

9.1. Calculation basis. The Monthly Fee is the unit price per Workforce Member set out in the Contract or the Commercial Proposal multiplied by the Contracted Base, subject to the Guaranteed Minimum Fee. The Contracted Base remains unchanged between anniversary dates of the engagement, except as provided in item 9.8. The current price table is made available upon request.

9.2. Billing and payment. The Monthly Fee is invoiced monthly, on the due date set out in the Contract or the Commercial Proposal, with issuance of the corresponding electronic invoice (nota fiscal). Payment may be made by bank slip (boleto), PIX, or another method made available by SafeReport. Whether taxes are included in the price is indicated in the Contract or the Commercial Proposal.

9.3. Late payment. Late payment entails, without notice: (i) a late-payment penalty of 2% (two percent) on the amount due; (ii) default interest of 1% (one percent) per month, pro rata die; and (iii) monetary adjustment by the IPCA or the official index that replaces it, from the due date.

9.4. Suspension. Default for more than 30 (thirty) calendar days from the due date authorizes SafeReport to suspend the Customer's access to the Platform, upon at least 10 (ten) days' prior written notice, until outstanding amounts are paid in full. During suspension, the Customer's data is preserved and the Customer may request the export of its data under item 15.2. Suspension does not release the Customer from payment obligations for the period.

9.5. Annual adjustment. Amounts are adjusted every 12 (twelve) months by the accumulated variation of the IPCA/IBGE, or the official index that replaces it, with prior written notice of at least 30 (thirty) days. In the event of deflation in the period, the Monthly Fee is maintained, without reduction.

9.6. Guaranteed Minimum Fee. If the number of Workforce Members found in the annual reconciliation is more than 10% (ten percent) below the Contracted Base, with documentary proof, the Contracted Base is reduced from the anniversary, without retroactive effect, credit, or refund, provided that the ordinary Monthly Fee will not be lower than the Guaranteed Minimum Fee. The Guaranteed Minimum Fee is calculated on the ordinary pricing terms, without considering the benefits of any Special Commercial Condition.

9.7. Annual reconciliation. Within 30 (thirty) days after each anniversary of the engagement, the Customer declares the updated number of Workforce Members, and SafeReport may request supporting documentation: for employees, eSocial records, RAIS, or payroll; for other Workforce Members, a declaration signed by the Customer's legal representative. SafeReport notifies the Customer of the reconciliation result, which the Customer may challenge, with reasons, within 15 (fifteen) days of receipt of the notice. If no declaration is made within that period, the reconciliation may be based on the last declaration submitted or on information provided by the Customer. If the number found exceeds the Contracted Base by more than 10% (ten percent), the Contracted Base becomes the total number of Workforce Members found, and the unit price then in force is applied to that entire number (and not only to the excess), cumulatively with the annual adjustment. Reclassifications take effect exclusively on the anniversary date, except as provided in item 9.8, which guarantees the Customer stability of the Contracted Base and of the Monthly Fee for 12 (twelve) months. Item 9.9 is reserved. If there is a signed Contract, item 9.13 applies.

9.8. Extraordinary growth. Growth resulting from a merger, amalgamation, or acquisition of other companies may be subject to immediate reclassification, upon negotiation between the parties and formalization by amendment.

9.9. False declaration. A false or inaccurate declaration, or a material omission, about the number of Workforce Members constitutes a serious breach and authorizes SafeReport to charge retroactively the differences identified, relating to up to the last 12 (twelve) months, plus the late charges in item 9.3, counted from the due date of each invoice that would have been owed.

9.10. Premium Modules. Premium Modules are not included in the Monthly Fee. A Premium Module whose price and billing terms are set out in the Contract or in the Commercial Proposal accepted at contracting is deemed contracted from that time; other Premium Modules require an amendment or a new Commercial Proposal. Premium Modules are not subject to the base-growth reclassification in item 9.7, but their prices are adjusted annually on the same base date and by the same index as in item 9.5. The billing terms of the 0800 Telephone Channel are set out in Section 10.

9.11. Group companies. When the "Multiple Companies" module is used, the Workforce Members of the Customer's group companies registered on the Platform are counted in the Contracted Base.

9.12. Special Commercial Conditions. SafeReport may grant a Special Commercial Condition tied to a Minimum Commitment Period, provided it is expressly set out in the Contract or the Commercial Proposal. The Special Commercial Condition applies only to the amount invoiced during its benefit period and does not change the Guaranteed Minimum Fee, the Contracted Base, or the unit price applicable to reclassifications, which are always calculated on the ordinary pricing terms. If a reclassification occurs during the benefit period, the benefit continues to apply only to the Monthly Fee corresponding to the Contracted Base considered when it was granted and does not extend to the increase resulting from the reclassification, which is invoiced in full on the ordinary pricing terms. Once the benefit period ends, the Monthly Fee follows the ordinary pricing terms. Early termination during the Minimum Commitment Period is governed by item 20.3.

9.13. Customers with a Contract. If there is a signed Contract, the matters in this Section 9 are governed by the Contract, in particular adjustment, Guaranteed Minimum Fee, reconciliation and reclassification of the Contracted Base, and false declaration, which are governed by Clause 6 of the Contract, which fully replaces the corresponding items of this Section.

10. Platform modules and 0800 telephone channel

10.1. The modules available to the Customer, and the status of each (included in the Contracted Plan or Premium), are those indicated in the module catalog of the Contract or the Commercial Proposal. New Premium Modules require an amendment or a new Commercial Proposal.

10.2. SafeReport may evolve, change, or discontinue modules and features upon at least 60 (sixty) days' written notice to the Customer, without reducing the essential features of the reporting channel and case management during the term of the engagement. If a module or feature used by the Customer is discontinued, the Customer may, until the end of the notice period, end the engagement without a fine, penalty, or repayment obligation (item 20.4). No Included Module will be converted into a Premium Module or become chargeable during the term of the engagement.

10.3. When contracted, the 0800 Telephone Channel depends on prior reservation of the number with ABR Telecom, under ANATEL rules. SafeReport conducts that process on the Customer's behalf, upon the Customer's delivery of the required documents.

10.4. The estimated activation period is up to 30 (thirty) business days from receipt of the complete documentation, subject to ANATEL and ABR Telecom procedures, over which SafeReport has no control. Delays resulting from those procedures or from incomplete or incorrect documentation do not constitute a SafeReport default.

10.5. The Customer is responsible for the truth, currency, and completeness of the documentation provided for 0800 activation.

10.6. The costs of reserving the 0800 number with ABR Telecom and of implementing the channel with telephone carriers are borne by SafeReport and are not passed on to the Customer.

10.7. 0800 billing. The 0800 Telephone Channel is charged a fixed monthly amount, which includes a monthly minute allowance, plus a per-minute price for minutes exceeding the allowance, as set out in the Contract or the Commercial Proposal. Billing of the monthly amount starts on the number's activation date, meaning the date on which the channel is able to receive calls, as notified in writing by SafeReport, email being acceptable. Excess minutes are charged in 30 (thirty)-second increments, each increment started being charged in full, and are invoiced in the month following their use, together with the Monthly Fee, subject to item 9.2; SafeReport provides, upon request, a usage report for the invoiced period. The allowance does not roll over: minutes not used in a month are not carried over to later months and do not generate any credit, refund, or set-off.

10.8. The per-minute price already includes the traffic tariffs charged by telephone carriers. Increases in those tariffs, set by the carriers or by applicable regulation, may be passed on to the Customer upon proof and at least 30 (thirty) days' prior written notice.

10.9. CSAT. An Included Module in the Contracted Plan that allows the Reporter, after a case is closed, to evaluate the reporting channel, subject to item 6.9.

10.10. CAPA. An Included Module in the Contracted Plan that allows recording and tracking the Customer's compliance-program corrective and preventive actions, with independent verification of effectiveness. Defining and carrying out the actions is the Customer's exclusive responsibility, and the module does not replace the PGR or other legal obligations (item 3.5). CAPA records linked to reports or investigations follow the confidentiality and access regime of the corresponding case (Section 16).

10.11. Awareness Campaigns. An Included Module in the Contracted Plan that allows recording, with a date, the Customer's actions to publicize the reporting channel and downloading the corresponding evidence for CIPA audits or ISO standards. The module functions as a reminder to the responsible committee and does not send messages to Workforce Members. Carrying out the awareness actions and the accuracy of the records are the Customer's responsibility.

11. Artificial Intelligence modules (BYOK)

11.1. The Platform offers optional Artificial Intelligence modules that use third-party LLM providers to generate suggestions, summaries, and analyses in support of the compliance process.

11.2. The AI modules operate exclusively on the BYOK model. To activate them, the Customer must directly contract a compatible LLM provider, generate and enter its own API key in the Platform's "AI Settings" area, and keep it active under the chosen provider's terms. SafeReport does not supply, fund, or manage LLM-provider API keys.

11.3. The Customer is exclusively responsible for: (i) contracting and keeping the LLM provider active; (ii) verifying that provider's adequacy under the LGPD and other applicable laws; (iii) defining and maintaining the legal basis for processing data submitted to the AI modules; and (iv) bearing all costs of the LLM provider. The LLM provider is contracted directly by the Customer, as controller, and acts as a processor engaged by the Customer; it is not a SafeReport sub-processor. The Platform only transmits to the provider the data needed to run the AI features, on the Customer's instruction.

11.4. AI features are strictly assistive and suggestive, intended to support, and not replace, human judgment. Every AI-generated result must be reviewed by a responsible person before any decision. SafeReport is not liable for decisions made based on AI results without proper human supervision, nor for content generated by the models.

11.5. SafeReport is not liable for unavailability, limitation, change, or discontinuation of the LLM provider's services, for that provider's charges, or for privacy and security violations occurring in processing performed by the provider chosen by the Customer.

11.6. The Customer's API key is stored in encrypted form and is not accessed, shared, or used by SafeReport for any purpose other than providing the services.

11.7. The exclusions in this Section relate only to the LLM provider contracted by the Customer. SafeReport remains responsible for its own failures of integration, of storage or protection of the API key, of transmission of data to the provider, and of Platform security, under Sections 13, 14, and 18.

11.8. Platform's own AI. Separately from the BYOK AI modules, SafeReport may use, in the Platform's own features that do not depend on the Customer's API key, an artificial-intelligence service that SafeReport contracts and pays for, currently Google Gemini, which acts as a SafeReport sub-processor (item 14.3). Those features are provided under SafeReport's responsibility, the exclusions in items 11.3 and 11.5 do not apply to them, and they are subject to the assistive nature set out in item 11.4 and to the prohibition in item 15.7.

12. Availability, support, and maintenance (SLA)

12.1. Availability. SafeReport undertakes to keep the Platform available for at least 99.5% (ninety-nine point five percent) of the time in each calendar month (monthly uptime), excluding duly communicated scheduled-maintenance windows.

12.2. The following do not constitute unavailability for SLA purposes: (i) scheduled maintenance communicated 48 (forty-eight) hours in advance; (ii) the Customer's connectivity failures; (iii) external attacks that exceed reasonable protective measures; and (iv) acts of God, force majeure, or events outside SafeReport's reasonable control.

12.3. Technical support. Support is provided during Support Hours (9:00 a.m. to 6:00 p.m., Brasília time, Monday to Friday, excluding national holidays), through the official channels indicated by SafeReport, with the timeframes below:

12.4. Timeframes are counted only in business hours and business days, within Support Hours, from the formal opening of the ticket. For tickets opened outside Support Hours, counting starts at the beginning of the next Support Hours period.

12.5. Maintenance. Scheduled maintenance is communicated at least 48 (forty-eight) hours in advance, preferably outside business hours. Emergency critical-security maintenance may be performed without prior notice, with notice to the Customer as soon as reasonably possible.

12.6. Credits. If the minimum availability in item 12.1 is not met, the Customer is entitled to a credit calculated on the Monthly Fee for the month of the failure, according to the table below:

12.7. The credit is applied to the next invoice, upon the Customer's request made within 30 (thirty) days after the end of the month in which the failure occurred.

12.8. Nature of the credits. The credits in item 12.6 constitute the specific financial compensation owed by SafeReport for availability below the level in item 12.1, except for Severe Availability Failure and for cases of LGPD breach, confidentiality breach, and Security Incident, which are governed by Section 18.

12.9. In the event of a Severe Availability Failure, SafeReport provides, upon request, a technical root-cause report and a correction plan, without prejudice to the obligation to correct the identified failures. If a Severe Availability Failure occurs, or the level in item 12.1 is not met for 3 (three) consecutive months, the Customer may terminate the engagement without a fine, penalty, or repayment obligation.

13. Information security

13.1. SafeReport adopts and maintains an information-security program comprising the following measures: (i) hosting of the main application and of the Platform's database on Amazon Web Services (AWS) cloud infrastructure located in São Paulo, Brazil (sa-east-1 region), except for the automated conversation flow of the WhatsApp channel (Typebot), run by SafeReport itself on an AWS server in the United States (us-east-1 region), and except for services provided by other sub-processors, whose location is shown in the list referred to in item 14.3; (ii) encryption of data in transit (TLS/HTTPS); (iii) encryption at rest of the database (Amazon RDS), of attachments (Amazon S3), and of the application server's disk (Amazon EBS); (iv) role- and permission-based access control; (v) activity and access logs; (vi) automated monitoring of Platform availability 24 (twenty-four) hours a day, 7 (seven) days a week, with alerts; and (vii) daily automatic backups of the database, performed through the cloud provider's managed database service (Amazon RDS) and kept for the retention period configured in that service.

13.2. The Customer is responsible for the security of its credentials, equipment, and networks. The backups kept by SafeReport are intended to recover the Platform in the event of a failure or Security Incident and are not an archiving service or a service for restoring specific data at the Customer's request. The Customer is encouraged to perform periodic exports of its critical data.

14. Personal data protection (LGPD)

14.1. Roles. With respect to Personal Data processed on the Platform, the Customer acts as controller and SafeReport acts as processor, processing the data exclusively on the Customer's behalf and according to its documented instructions.

14.2. SafeReport does not use the Customer's Personal Data for its own purposes, commercialization, or profiling, except when required by law or court order, and except for the generation and use of aggregated and anonymized metrics under item 15.5, within the limits of items 15.6 to 15.8.

14.3. Sub-processors. SafeReport may engage sub-processors (for example, cloud, telephony and voicemail, transcription, email sending and receiving, artificial-intelligence, and payment-processing services), provided they assume equivalent data-protection obligations, remaining fully responsible for them vis-à-vis the Customer. SafeReport keeps an up-to-date list of sub-processors, indicating the country in which each one processes Personal Data, available at https://speaksafely.com/en/subprocessors, and notifies the Customer by email, at least 15 (fifteen) days in advance, of the addition of any new sub-processor that will process the Customer's Personal Data. Within that period, the Customer may raise a reasoned objection on personal-data-protection grounds; if the objection is not resolved, the Customer may end the affected module or the engagement without a fine, penalty, or repayment obligation (item 20.4). The LLM provider contracted by the Customer for the AI modules is not a SafeReport sub-processor, as set out in item 11.3. Slack, when integrated by the Customer into its own workspace, is also a service contracted directly by the Customer and is not a SafeReport sub-processor; the Customer is responsible for its contracting, compliance, and any international transfers, and SafeReport is responsible for its own integration, transmission, and security operations.

14.4. Data-subject rights. SafeReport assists the Customer in responding to data-subject requests, responding to requests for assistance within 5 (five) business days of receipt.

14.5. Security Incidents. SafeReport will notify the Customer of a Security Incident:

• on a preliminary basis, within 24 (twenty-four) hours of confirmation of the incident, with the information available at the time; and
• by a full report, within 72 (seventy-two) hours of the same confirmation, containing the nature and scope of the incident, the containment measures adopted, and the contact of the person responsible.

14.6. The parties will cooperate on notice of the Security Incident to the National Data Protection Authority (ANPD) and to data subjects, where applicable, and SafeReport will provide the information and support needed for the Customer, as controller, to give those notices within the deadlines of ANPD Resolution CD/ANPD No. 15/2024 or any rule that replaces it.

14.7. International transfer. Certain SafeReport sub-processors process Personal Data outside Brazil, such as voice-recording transcription, email sending and receiving, the Platform's own artificial intelligence, and payment processing, as shown in the list in item 14.3. Message transport for the WhatsApp channel is provided by Meta, which is not a SafeReport sub-processor, as set out in item 6.2, and messages received through that channel are processed by SafeReport on an AWS server in the United States (us-east-1 region), as set out in item 13.1. Those transfers are carried out under articles 33 to 36 of the LGPD and ANPD Resolution CD/ANPD No. 19/2024 or any rule that replaces it, supported by one of the mechanisms in article 33 of the LGPD, such as ANPD adequacy decisions or ANPD-approved standard contractual clauses; SafeReport is responsible for adopting those mechanisms and for ensuring that sub-processors observe a level of data protection consistent with these Terms. The list in item 14.3 shows the country in which each sub-processor processes Personal Data. International transfers resulting from the use of the LLM provider contracted directly by the Customer (Section 11) are the Customer's sole responsibility, and the Customer must verify the applicable transfer mechanism.

14.8. Data protection officer (DPO). SafeReport maintains a data protection officer, whose contact is available on the official website (speaksafely.com). Additional information is set out in the Privacy Policy, available at https://speaksafely.com/en/privacy#encarregado-dpo.

14.9. Audit. The Customer may audit, directly or through an independent third party, SafeReport's compliance with data-protection and information-security obligations, subject to the following: (i) a limit of 1 (one) audit per calendar year, except for a proven Security Incident that justifies an additional audit; (ii) a request with at least 30 (thirty) days' notice; (iii) scope limited to the LGPD and information security; (iv) a duty of confidentiality; and (v) performance during business hours, without interfering with operation of the Platform. Audit costs are borne by the Customer, unless a material non-compliance attributable to SafeReport is proven, in which case SafeReport will correct the material non-compliances identified. Upon request, SafeReport may offer, in lieu of an on-site audit, compliance questionnaires, security-assessment reports, or recognized certifications, when available.

14.10. Anonymity and voice recordings. SafeReport takes no measure aimed at identifying anonymous Reporters, as set out in item 6.2, and the Customer undertakes not to attempt, directly or indirectly, to re-identify them and to prevent any form of retaliation against Reporters. When the 0800 Telephone Channel is contracted and calls are recorded or transcribed, SafeReport plays an automatic message, with wording defined by SafeReport, at the start of each call informing the Reporter of this (item 6.6). Voice recordings are Personal Data and may compromise the Reporter's anonymity; the Customer, as controller, defines the applicable legal basis and the internal policy for processing, access to, and retention of those recordings.

15. Ownership, export, and deletion of data

15.1. Content, reports, and information entered on the Platform by the Customer, its Authorized Users, and Reporters belong to the Customer, without prejudice to the rights of Personal Data subjects and to SafeReport's intellectual property in the Platform.

15.2. The Customer may export its data in a structured format at any time during the term of the engagement, including during any suspension for non-payment.

15.3. Upon ending or termination of the engagement, for any reason:

• operational access to the Platform ends on the effective end date;
• for 30 (thirty) calendar days from that date, SafeReport maintains restricted access to the export feature or, at the Customer's request, delivers the data in a structured, interoperable format (for example, CSV or JSON);
• after that period, SafeReport, as processor, deletes the data or, at the Customer's choice, returns it, upon the Customer's written instruction as controller (articles 16 and 39 of the LGPD), within 30 (thirty) days of receiving the instruction, including in its sub-processors' environments;
• if no instruction is received by the end of the export period, SafeReport asks the Customer in writing to provide it within 30 (thirty) days; if the Customer remains silent, SafeReport may delete the data without further instruction;
• after deletion, only data whose retention is required by law, such as application access logs kept for 6 (six) months (item 6.2), or necessary for the regular exercise of rights is kept, always under confidentiality, in addition to the anonymized metrics in item 15.5;
• data contained in automatic database backups is overwritten in the normal retention cycle of those backups and is not restored except to recover the Platform, in which case data already deleted is deleted again;
• SafeReport provides, upon the Customer's request, a formal deletion declaration.

15.4. For as long as any data remains in its custody, SafeReport remains responsible for its confidentiality, integrity, and security.

15.5. Aggregated and anonymized metrics. The Customer authorizes SafeReport to generate, from the data processed on the Platform, metrics that are aggregated and irreversibly anonymized under article 12 of the LGPD, such as number of reports, categories, intake channels, handling times, and usage indicators, and to use them, including after the end of the engagement, solely for statistical purposes, Platform improvement, information security, and the preparation of comparative indicators (benchmarking).

15.6. The following are not part of those metrics and may not be used by SafeReport for any purpose of its own: (i) the text, descriptions, attachments, and other free-form content of reports, complaints, communications, and investigations, even if subjected to anonymization or identifier-removal techniques; (ii) voice recordings and transcriptions; and (iii) any data that allows the direct or indirect identification of the Customer, Reporters, or other data subjects.

15.7. Artificial-intelligence training. The Customer's data, including anonymized data, may not be used to train, fine-tune, or improve artificial-intelligence models, whether SafeReport's own or third parties'. SafeReport uses artificial-intelligence services that it contracts, including the one referred to in item 11.8, only under contractual terms or configurations in which the respective provider undertakes not to use the submitted data to train or improve its models. This prohibition does not cover processing performed by the LLM provider contracted directly by the Customer (Section 11), which is governed by the Customer's contract with that provider.

15.8. Comparative indicators may be disclosed only in aggregated form, without identifying the Customer, and with a minimum sample of 10 (ten) companies.

16. Confidentiality

16.1. The parties must keep confidential the confidential information to which they have access by reason of the engagement, using it solely to perform the engagement.

16.2. Given the sensitive nature of the service, SafeReport recognizes as strictly confidential all reports, complaints, documents, evidence, investigation records, CAPA records linked to cases, CSAT evaluations made by Reporters, communications, Personal Data (including sensitive data), and strategic, commercial, and operational information entered or produced by the Customer on the Platform, limits access by its team and its sub-processors to what is strictly necessary to provide the service, and is liable for the acts of its personnel and sub-processors regarding that obligation.

16.3. Information is not confidential if it is lawfully in the public domain, was already in the legitimate possession of the receiving party, was independently developed, or must be disclosed by law or by a court or administrative order, to the extent so required.

16.4. Confidentiality obligations apply during the engagement and for 5 (five) years after its end. Personal Data, the content of reports and complaints, the identity of Reporters, and information about investigations remain confidential indefinitely, except solely for the aggregated and anonymized metrics in item 15.5, within the limits of items 15.6 to 15.8. The party that breaches these obligations must fully compensate the damage caused, subject, as to SafeReport, to Section 18.

17. Intellectual property

17.1. The SpeakSafely Platform, the brand, the software, the design, the documentation, and all associated technology are the exclusive property of SafeReport. Reproduction, copying, or distribution without prior written authorization is prohibited.

17.2. The license is limited to use on the contracted terms, without assignment or co-ownership of any right.

17.3. Feedback and suggestions about the Platform may be freely incorporated by SafeReport, without giving rise to remuneration or co-ownership, provided they do not contain confidential information or Customer data.

17.4. Data and reports entered by the Customer remain the Customer's property, as set out in Section 15.

17.5. Third-party intellectual-property claims. If the Customer receives a claim, notice, or lawsuit from a third party alleging that the Platform, used in accordance with these Terms and, where applicable, the Contract, infringes that third party's intellectual-property rights, SafeReport, at its discretion and expense: (i) takes over the Customer's defense, in or out of court, provided the Customer promptly notifies it of the claim, entrusts it with the conduct of the defense and of any settlement, and provides reasonably necessary cooperation; and (ii) obtains for the Customer the right to continue using the challenged feature, modifies it so that it is no longer infringing, or replaces it with an equivalent feature, without material reduction in performance or features. If none of those alternatives is reasonably possible, SafeReport may discontinue the affected module, refunding prepaid amounts for the unused period; if the discontinued module is essential to the Customer's use of the Platform, the Customer may end the engagement without a fine, penalty, or repayment obligation (item 20.4). Defense costs, judgments, and settlement amounts borne by SafeReport count toward the Aggregate Extended Cap (item 18.4). This item does not apply where the alleged infringement results from content or data entered by the Customer, from use of the Platform not in accordance with these Terms, or from its combination with products, services, or providers not supplied by SafeReport, including the LLM provider under the BYOK model.

18. Limitation of liability

18.1. General Cap. Except as provided in items 18.3 to 18.7, SafeReport's total and aggregate liability to the Customer, arising out of or relating to the engagement of the Platform, is limited to the sum of the Monthly Fees actually paid in the 12 (twelve) months immediately preceding the date of the first event giving rise to liability (the "General Cap"). The General Cap is aggregate: it applies to all events, claims, and damages occurring during the entire term of the engagement combined and does not renew with each event, claim, or period.

18.2. Exclusions. Except for the cases in item 18.3, and subject to item 18.4, SafeReport is not liable for:

• indirect, incidental, special, consequential, or punitive damages;
• lost profits, lost revenue, lost business opportunities, or reputational harm;
• damages arising from misuse of the Platform solely by the Customer or by third parties;
• failures or unavailability of LLM services contracted by the Customer under the BYOK model;
• damages arising from decisions made based on AI results without human supervision;
• data loss caused by the Customer's failure to perform exports or backups.

18.3. Cases excluded from the General Cap. The General Cap does not apply to the cases below, which are governed by items 18.4 to 18.7:

• (a) proven willful misconduct or fraud by SafeReport;
• (b) breach of data-protection (LGPD) obligations by negligent act or omission of SafeReport, as processor;
• (c) leakage, loss, or unauthorized disclosure of the Customer's confidential information by negligent act or omission of SafeReport;
• (d) breach of confidentiality obligations by negligent act or omission of SafeReport;
• (e) a Severe Availability Failure;
• (f) infringement of third-party intellectual-property rights caused by the Platform itself, subject to item 17.5;
• (g) a Security Incident resulting from a proven negligent act or omission of SafeReport.

18.4. Extended regime and Aggregate Extended Cap. In the cases in items (b), (c), (d), (e), (f), and (g) of item 18.3, SafeReport is liable for proven direct damages and also for indirect damages, lost profits, and reputational harm, provided the causal link and the extent of the loss are proven, subject to both parties' duty to mitigate damages. SafeReport's total and aggregate liability for all such events combined, occurring during the entire term of the engagement, regardless of the number of events, claims, or data subjects affected, is limited to 24 (twenty-four) times the Reference Monthly Fee (the "Aggregate Extended Cap"), a single ceiling that does not renew with each event, claim, or period.

18.5. Reference Monthly Fee. The Reference Monthly Fee is the monthly amount in force on the date the first event under items (b), (c), (d), (e), (f), or (g) of item 18.3 occurred (or, if that date cannot be determined, on the date of its confirmation), covering the Contracted Plan and the contracted Premium Modules, without deducting discounts or free months arising from a Special Commercial Condition.

18.6. No stacking. The General Cap and the Aggregate Extended Cap are not added together. Amounts paid or owed under the General Cap count toward, and are deducted from, the Aggregate Extended Cap, so that SafeReport's total and aggregate liability to the Customer, except for item (a) of item 18.3, never exceeds the Aggregate Extended Cap.

18.7. Uncapped cases. In the case in item (a) of item 18.3 and as to non-derogable legal obligations, no limitation of liability applies, and the corresponding amounts do not count toward the General Cap or the Aggregate Extended Cap.

19. Third-party dependencies

19.1. The Platform may use third-party supplier services, such as cloud providers, 0800 telephony, transcription, and, under the BYOK model, LLM providers contracted directly by the Customer.

19.2. SafeReport does not directly control the operation of third-party suppliers' services. Interruptions or failures caused by those suppliers do not constitute a SafeReport breach when they result from events that are unforeseeable or, if foreseeable, unavoidable and outside its reasonable control, provided it adopts reasonable mitigation measures and notifies the Customer. SafeReport will use its best efforts to communicate relevant supplier changes reasonably in advance.

19.3. That exclusion applies only to events that are demonstrably unforeseeable or, if foreseeable, unavoidable and outside SafeReport's reasonable control, and SafeReport must show that it adopted reasonable measures to prevent, mitigate, and restore the services as soon as possible. SafeReport remains responsible for failures arising from negligence in the selection, management, oversight, or replacement of its essential suppliers, except as to LLM providers contracted by the Customer (Section 11) and the regulatory timeframes and procedures of ANATEL and ABR Telecom (Section 10).

20. Term, cancellation, and termination

20.1. The engagement takes effect from the date of its signature or acceptance. When the Contract or the Commercial Proposal provides for an initial term, the engagement remains in force for that period and renews automatically and successively for equal periods, unless either party gives notice to the contrary at least 30 (thirty) days before the end of the then-current period. If there is no such provision, the engagement remains in force for an indefinite term. In any case, cancellation without cause under item 20.2 and, if any, the Minimum Commitment Period tied to a Special Commercial Condition apply.

20.2. Cancellation without cause. Either party may end the engagement at any time, without cause, by written notice of at least 30 (thirty) days, without a fine or penalty, with only the amounts proportional through the effective end date remaining due. Where there is no Special Commercial Condition, only this rule applies, with no repayment obligation.

20.3. Special conditions and lock-in. Where there is a Special Commercial Condition tied to a Minimum Commitment Period, the Customer must repay SafeReport the economic benefit actually received under that condition if the engagement ends before the end of the Minimum Commitment Period: (i) through cancellation without cause by the Customer; or (ii) through termination by SafeReport due to the Customer's fault (culpable default, unlawful use of the Platform, or infringement of intellectual property, confidentiality, or the LGPD attributable to the Customer). The repayment is proportional to the months remaining in the Minimum Commitment Period and is calculated as R = B × (Mr ÷ Mt), where "B" is the benefit actually received up to the effective end date, "Mr" is the number of remaining months, and "Mt" is the total number of months of the Minimum Commitment Period, with fractions of a month counted pro rata die. The repayment is a restitution of the benefit, not a penalty, is not cumulative with the penalty in item 20.6, as set out in that item, and may be included in the last invoice or set off against prepaid amounts relating to the period after the end of the engagement.

20.4. No repayment is due: (i) after the end of the Minimum Commitment Period; (ii) upon cancellation without cause by SafeReport; (iii) upon termination by the Customer due to SafeReport's fault or in the cases in items 12.9 and 22.3; (iv) upon termination due to an act of God or force majeure; (v) upon termination by the Customer due to the discontinuation of a module or feature it uses (item 10.2); (vi) upon termination by the Customer due to an unresolved objection to a new sub-processor (item 14.3); or (vii) upon termination by the Customer due to the discontinuation of an essential module because of third-party intellectual-property infringement (item 17.5).

20.5. Termination for cause. A material breach may give rise to termination for cause by the injured party if not cured within 15 (fifteen) days of receipt of written notice. The following terminations for cause do not depend on that cure period: (i) fraud or unlawful use of the Platform; (ii) serious infringement of intellectual property, confidentiality, or the LGPD; (iii) bankruptcy, judicial reorganization with impossibility of performance, or insolvency; (iv) payment default for more than 60 (sixty) days; or (v) act of God or force majeure lasting more than 60 (sixty) days (item 23.6).

20.6. Reciprocal penalty. Culpable default means a breach of a material obligation, including non-payment, not cured within 15 (fifteen) days of receipt of written notice. Upon termination for cause due to culpable default by either party, the innocent party may require from the breaching party a compensatory penalty equivalent to 3 (three) Monthly Fees, in addition to outstanding amounts, without prejudice to compensation for actually proven losses and damages. If termination due to the Customer's culpable default occurs during the Minimum Commitment Period, the repayment in item 20.3 and this penalty are alternatives and not cumulative: only the higher of the two is due, both calculated as of the effective end date, without prejudice to outstanding amounts and actually proven losses and damages. Upon cancellation without cause by the Customer during the Minimum Commitment Period, only the repayment in item 20.3 is due, with no fine or penalty.

20.7. The Customer may also terminate without a fine, penalty, or repayment obligation in the cases in items 10.2 (discontinuation of a module or feature it uses), 12.9 (Severe Availability Failure or repeated SLA failure), 14.3 (unresolved objection to a new sub-processor), 17.5 (discontinuation of an essential module because of third-party intellectual-property infringement), 22.3 (disagreement with material changes to these Terms), and 23.6 (force majeure).

20.8. After the end of the engagement, the data-export and deletion rules in Section 15 apply. The provisions on data protection, data ownership and deletion, confidentiality, intellectual property, limitation of liability, anti-corruption, and venue survive termination, as do payment obligations for the period through the end date, the repayment in item 20.3, and the penalty in item 20.6.

21. Anti-corruption and compliance

21.1. The parties conduct their business in accordance with Law No. 12.846/2013 (Anti-Corruption Law), the LGPD, and other applicable laws, undertake not to offer, promise, grant, solicit, or accept an undue advantage, maintain adequate internal controls, and must immediately report suspected conduct contrary to those rules.

22. Changes to these Terms

22.1. SafeReport may change these Terms. The current version will always be available at https://speaksafely.com/termos-de-uso, with the date of last update.

22.2. Material changes to these Terms will be communicated in writing to Customers at least 30 (thirty) days before they take effect.

22.3. If the Customer does not agree with a material change, it may end the engagement without cause, without a fine, penalty, or repayment obligation, within 30 (thirty) days from receipt of the notice.

22.4. Non-material changes, such as corrections, drafting adjustments for greater clarity, or alignment with legislation, may be implemented by simple notice.

22.5. Changes to these Terms do not amend the signed Contract, which may be amended only by an instrument executed by both parties.

22.6. Transition to version 6. This version applies immediately to engagements entered into from its publication date. For Customers with an ongoing engagement, the change in this version that is less favorable to the Customer, which is the issuance of the formal deletion declaration only upon request (item 15.3), takes effect after the 30 (thirty)-day period in item 22.2, counted from receipt of the written notice of this version. The other changes in this version align with the Contract or are more favorable to the Customer and apply from publication. For Customers with a signed Contract, item 22.5 also applies.

23. General provisions and precedence

23.1. Precedence. For Customers with a signed Contract, in the event of inconsistency or conflict between the documents governing the engagement, exclusively the order of precedence set out in the Contract itself is observed, in which these Terms occupy the last place. A Commercial Proposal issued after the Contract was signed prevails over it only if executed by both parties as an amendment. In all cases, the Contract prevails as to liability, limitation of liability, and venue. For Customers without a signed Contract, item 1.5 applies.

23.2. Waiver. A party's tolerance of a breach of obligation does not constitute a waiver, novation, or amendment.

23.3. Severability. The nullity or invalidity of any provision of these Terms does not affect the others.

23.4. Assignment. The Customer may not assign its contractual position without SafeReport's prior written consent. SafeReport may assign the engagement to a company in its economic group, upon 30 (thirty) days' notice to the Customer.

23.5. Communications and notices. Formal communications and notices between the parties must be made in writing, by email: to SafeReport, at contato@speaksafely.com; to the Customer, at the email address indicated in the Contract, the Commercial Proposal, or the Platform registration. Data-protection matters and Security Incidents will also be sent to the security and data-protection contacts indicated by the parties. They are deemed received on the first business day after sending, except those relating to Security Incidents, which are deemed received on the date they are sent. Each party must inform the other in writing of any change to its email address; otherwise, communications sent to the previously indicated address remain valid.

23.6. Force majeure. Neither party is liable for a breach caused by an act of God or force majeure, under article 393 of the Brazilian Civil Code; if the event lasts more than 60 (sixty) days, either party may terminate the engagement without a fine or penalty.

23.7. Electronic signature and acceptance. Electronic signature and acceptance are valid under Provisional Measure No. 2.200-2/2001 and Law No. 14.063/2020, including by means of proof of authorship and integrity not issued by ICP-Brasil.

24. Governing law and venue

24.1. These Terms are governed by the laws of the Federative Republic of Brazil.

24.2. Negotiation. The parties will use their best efforts to resolve amicably, in good faith and through direct negotiation, any dispute arising from these Terms, for 30 (thirty) days from receipt of a written notice describing it. If no solution is reached within that period, the parties may, by mutual agreement, submit the dispute to mediation under Law No. 13.140/2015.

24.3. Item 24.2 does not prevent either party from seeking, at any time, urgent judicial relief necessary to preserve its rights, and does not apply to the collection of undisputed amounts, including overdue and unpaid Monthly Fees, or to the enforcement of an extrajudicial enforceable instrument, such as the Contract, where applicable, which may be brought directly before the venue in item 24.4.

24.4. Venue. If the dispute is not resolved under item 24.2, or in the cases in item 24.3, the courts of the Judicial District (Comarca) of Gravataí/RS, where SafeReport has its registered office, are elected to resolve any disputes between SafeReport and the Customer arising from these Terms, including questions of their validity, interpretation, performance, or termination, with a waiver of any other venue, however privileged.

24.5. As to Reporters and other natural persons who are not parties to the engagement, the rules of jurisdiction provided by law apply.

25. Contact

25.1. Questions about these Terms may be sent to SafeReport through the channels below:

• Email: hello@speaksafely.com
• WhatsApp: (51) 2481-0031
• Contact page: https://speaksafely.com/contato

25.2. Formal notices must be sent to contato@speaksafely.com, as set out in item 23.5.

25.3. For data-protection matters, use the data protection officer (DPO) contact indicated on the official website and in the Privacy Policy.

25.4. Reporters who wish to address a specific report should use the reporting channel and follow-up protocol of the company to which the report relates.

SAFEREPORT LTDA · CNPJ 52.784.630/0001-06 · Gravataí/RS