Terms of Use

1. Who We Are

1.1. Clav Soluções em Software Ltda. ("Clav" or "Provider"), registered under CNPJ No. 63.829.686/0001-48, with headquarters at Alameda Rio Negro, No. 503, Room 2005, Alphaville Centro Industrial e Empresarial, Barueri – SP, ZIP code 06.454-000.

2. Subject Matter

2.1. These Terms govern access to and use of the Clav Platform ("Platform"), a software solution made available by Clav through remote access via browser, without the need for local installation, and through an application programming interface ("API"), comprising a control panel ("Dashboard") and its modules of control frameworks, requirement libraries, evidence repositories, document templates, and other features described in the Agreement.

3. Scope and Acceptance

These Terms of Use ("Terms") govern access to and use of the Platform by any natural person authorized by the Client to operate on its behalf ("User"). The Client is the legal entity that has entered into the corresponding agreement or service order with Clav ("Agreement"), to which these Terms are supplementary.

By creating an account, accessing, or using any feature of the Platform, the User declares that it has read, understood, and fully agreed to these Terms. In the event of a conflict between these Terms and the Agreement, the Agreement shall prevail.

3.2. These Terms are supplemented by Clav's Privacy Notice and Cookie Policy, available on its website.

4. Definitions

4.1. For the purposes of these Terms, the expressions below have the following meanings:

• a) Platform: SaaS system developed and operated by Clav, accessible via browser or API, intended for the management of regulatory compliance, including control frameworks, evidence repositories, dashboards, and other features described in the Agreement.
• b) Client: legal entity that contracts access to the Platform and assumes the obligations set forth in these Terms and in the Agreement.
• c) User or Authorized User: natural person authorized by the Client to access the Platform on its behalf, including employees, officers, direct consultants, and members of third parties contracted by the Client for purposes related to the use of the Platform, such as certifiers, auditors, and regulatory advisors.
• d) Client Data: information, documents, and content entered or generated by the Client or its Authorized Users on the Platform.
• e) Services: set of features made available by the Platform according to the plan and modules described in the Agreement.
• f) SPSAV: Virtual Asset Service Provider Company, a category of VASP constituted as a company and subject to the authorization process to operate before the Central Bank of Brazil, pursuant to BCB Resolutions No. 519 and 520/2025 and supplementary rules.
• g) BCB: Central Bank of Brazil.
• h) VASP: Virtual Asset Service Provider, a legal entity that performs one or more of the activities set forth in Article 3 of Law No. 14.478/2022 (Legal Framework for Virtual Assets), pursuant to the regulations of the Central Bank of Brazil.
• i) LGPD: Federal Law No. 13.709/2018, which governs the processing of personal data in Brazil.

5. License of Use

Clav grants the User, during the term of the Agreement entered into by the Client, a non-exclusive, non-transferable, non-sublicensable, and revocable license to access and use the Platform exclusively for the Client's own internal compliance purposes. The license does not imply the transfer of ownership, source code, methodologies, control libraries, templates, documentation, or any other intellectual property right over the Platform.

5.2. The User is expressly prohibited from:

• a) reselling, sublicensing, renting, or making the Platform available to unauthorized third parties;
• b) copying, modifying, reverse engineering, decompiling, or attempting to derive the Platform's source code;
• c) using the Platform for unlawful purposes or in violation of applicable Brazilian law;
• d) interfering with the Platform's infrastructure or security, including through unauthorized scripts, bots, crawlers, or scraping techniques.

6. Registration and Access

Access to the Platform requires the Client's prior registration, indicating an Administrator responsible for managing the account and the Authorized Users. The number of Authorized Users is limited to that contracted, as described in the applicable Proposal or Service Order.

6.2. The Platform provides two access profiles, the assignment of which is the Client's exclusive responsibility:

• a) Administrator: has full access to the Client's account on the Platform, and may invite and remove Authorized Users, define access profiles, and manage general settings.
• b) Member: has operational access to the Platform, limited to the features and modules defined by the Administrator.

6.3. The Client is fully responsible for:

• a) maintaining the confidentiality of the access credentials of all Authorized Users;
• b) any and all actions carried out through its accounts, even if performed by third parties;
• c) promptly revoking access of Authorized Users whose relationship with the Client has ended, whose duties have changed, or who no longer need the Platform — including members of contracted third parties whose contract has been terminated;
• d) immediately notifying Clav in the event of unauthorized use or suspected compromise of credentials, through the channel [email protected].

6.5. Clav is not responsible for damages arising from the improper use of credentials or the inadequate assignment of access profiles, the management of which is the Client's exclusive responsibility.

7. Client Obligations

7.1. The Client undertakes to:

• a) use the Platform in compliance with applicable Brazilian law, including the LGPD;
• b) ensure that all information, documents, and evidence entered into the Platform are true, complete, and obtained by lawful means, with the Client being solely responsible for the truthfulness, integrity, and regulatory compliance of the submitted content;
• c) not enter into the Platform any content that violates third-party rights, trade secrets, personal data without a legal basis, or confidential information without the proper authorizations;
• d) keep the registry of Authorized Users updated;
• e) comply with the commercial conditions set forth in the Agreement, including payment deadlines.

8. Clav Obligations

8.1. Clav undertakes to:

• a) make the Platform available substantially in accordance with the description in the Agreement. Any errors or failures will be corrected as soon as possible; Clav does not, however, guarantee that operation will be uninterrupted or error-free, nor that scheduled maintenance or unavailability arising from failures in servers, cloud providers, or third-party infrastructure will be preceded by prior notice;
• b) implement and maintain information security controls appropriate to the nature of the Client Data processed on the Platform;
• c) notify the Client, within 72 hours, of security incidents affecting its Data, pursuant to Article 48 of the LGPD;
• d) perform periodic backups of the Client Data and make them available for export for 30 days after termination of the Agreement, as set forth in Section 13;
• e) provide technical support through a dedicated channel ([email protected]) according to the service levels described in the Agreement;
• f) communicate material changes to these Terms with at least 30 days' prior notice.

8.2. Access to the Platform may be interrupted, suspended, or temporarily intermittent, without any indemnity or compensation being owed to the Client, in the following cases: (i) failure of a system, server, or third-party infrastructure (including cloud providers, network operators, and financial institutions) beyond Clav's reasonable control; (ii) scheduled or emergency maintenance necessary for the security, stability, or updating of the Platform; (iii) act of God or force majeure, as defined under Brazilian law; or (iv) determination by a competent authority. Clav will use reasonable efforts to minimize the duration of any interruption and, whenever possible, will communicate scheduled maintenance in advance.

9. Intellectual Property

The Platform and all software, frameworks, methodologies, control libraries, templates, documentation, and other related materials, together with all intellectual property rights contained therein, are and shall remain the exclusive property of Clav and/or its licensors, and are protected by Law No. 9.609/98, Law No. 9.610/98, and other applicable rules. No rights are granted to the Client beyond the limited license expressly set forth in Section 5.

The Client Data remains the exclusive property of the Client. Clav acquires no right over such Data beyond what is strictly necessary to provide the Services. The Client grants Clav a limited, non-exclusive license to host, process, and use the Client Data exclusively to provide and support the Platform during the term of the Agreement.

The Client authorizes Clav to reference its trade name for portfolio purposes, with any other form of use prohibited without express written authorization.

10. Confidentiality

Each party shall maintain the confidentiality of all non-public information disclosed by the other party under these Terms and the Agreement, using it only for the purposes set forth herein and protecting it with at least the same degree of care it applies to its own confidential information.

The confidentiality obligation does not apply to information that:

• a) is or becomes public without violation of these Terms or the Agreement;
• b) was lawfully known to the receiving party before receipt;
• c) must be disclosed by legal, judicial, or competent regulatory authority determination — in which case the party shall notify the other as far in advance as possible.

The confidentiality obligation survives for 5 (five) years after the end of the contractual relationship.

11. Personal Data and Privacy

The processing of personal data in the context of the Platform is governed by the LGPD and conducted in accordance with Clav's Privacy Notice, available on the website, the terms of which the User declares to have read and accepted upon accessing the Platform.

With respect to the personal data entered by the Client into the Platform, the Client acts as controller and Clav as processor, pursuant to Article 39 of the LGPD. When necessary, the parties shall enter into a specific personal data processing addendum.

12. Payment and Price Adjustment

The payment conditions, charges, taxes, and price adjustment applicable to the Platform subscription are fully described in the Agreement entered into between Clav and the Client.

13. Suspension and Termination

Clav may suspend or terminate the User's access to the Platform, upon written notice and a 30 (thirty) day period to cure the violation, in the following cases:

• a) use of the Platform in violation of these Terms or applicable law;
• b) default not cured after notice;
• c) determination by a competent authority;
• d) risk to the security, integrity, or availability of the Platform.

The Client may cancel the subscription at any time, subject to the conditions set forth in the Agreement. After termination, Clav will make the Client Data available for export for a period of 30 (thirty) days, after which it may be permanently deleted in accordance with applicable law. Termination does not release the Client from the obligation to pay amounts already due.

14. Warranties and Absence of Advisory

Clav warrants that it will provide the Platform with reasonable skill and care and substantially in accordance with the description in the Agreement. Except as expressly provided otherwise, the Platform is provided "as available" and Clav does not warrant that it will be uninterrupted or error-free.

The Platform provides software tools, frameworks, and methodologies to help the User organize and prepare documentation and evidence for regulatory compliance purposes. The Platform does not constitute legal, regulatory, accounting, or audit advice, and the Agreement does not create any fiduciary or advisory relationship between the parties.

Clav does not warrant, nor shall it be responsible for, the Client's or its User's obtaining of any regulatory authorization, technical certification, or result before the BCB or other competent authority. Such results depend on factors beyond Clav's control, including the Client's own compliance posture and the assessment of the competent bodies.

15. Limitation of Liability

To the maximum extent permitted by applicable law, neither party shall be liable to the other for any indirect, incidental, special, consequential, or punitive damages, or for loss of profits, revenue, data, or business opportunities, arising out of or related to the Agreement or the use of the Platform.

Clav's total liability arising out of or related to the Agreement shall not exceed the total amount of fees actually paid by the Client in the 12 (twelve) months preceding the event giving rise to the liability.

Without prejudice to the foregoing, Clav shall in no event be liable for: (i) damages to third parties caused by the improper use of the Platform by the Client or its Authorized Users; (ii) third-party services or systems used by the Client in connection with the Platform, including certifiers, identity providers, and financial institutions; (iii) damages arising from failures in the internet connection, equipment, or systems of the Client itself; (iv) viruses, malware, or cyberattacks affecting the Client's systems as a result of accessing or browsing the internet, except where originating directly from a proven vulnerability of the Platform; or (v) any damage resulting from the illegal or negligent conduct of the Client or third parties not under Clav's control.

The above limitations do not apply to liability arising from willful misconduct, fraud, or breach of the confidentiality or data protection obligations, nor to any liability that cannot be limited or excluded under applicable law.

16. Changes to These Terms

Clav reserves the right to update these Terms at any time. Material changes will be communicated to the User with at least 30 (thirty) days' prior notice, by email or by notice on the Platform itself.

Continued use of the Platform after the communicated changes take effect shall constitute tacit acceptance of the new Terms. Should the User disagree with the changes, it must stop using the Platform and request the Client to terminate the Agreement.

17. General Provisions

These Terms, together with the Agreement and its annexes, constitute the entire agreement between the parties with respect to their subject matter. Any amendment must be made in writing.

Neither party may assign these Terms without the prior written consent of the other, except to an affiliate or in the context of a corporate reorganization, merger, or sale of substantially all of its assets.

The parties agree that the Agreement and any amendments may be signed by means of an electronic signature platform (DocuSign, ClickSign, or equivalent), and signatures thus affixed are valid and legally effective pursuant to Provisional Measure No. 2.200-2/2001 and Law No. 14.063/2020.

Independent Parties. The parties are independent contractors. Nothing in these Terms creates a partnership, joint venture, agency, or employment relationship between them.

Neither party shall be liable for delay or non-performance caused by events beyond its reasonable control, provided it takes reasonable measures to mitigate the effects.

If any provision of these Terms is held invalid or unenforceable, the remaining provisions shall remain in full force and effect.

A party's tolerance of any breach shall not imply novation or waiver of the right to demand performance of the obligation.

18. Contact Channel

Questions, requests, or notices regarding these Terms should be sent to:

Address: Alameda Rio Negro, No. 503, Room 2005, Alphaville, Barueri – SP, ZIP code 06.454-000

Email: [email protected]

Website: clav.tech

19. Governing Law and Jurisdiction

These Terms are governed by and construed in accordance with the laws of the Federative Republic of Brazil. The parties elect the courts of the District of São Paulo, State of São Paulo, to settle any disputes arising from these Terms, expressly waiving any other, however privileged.