Data Processing Agreement

Translation. This is an English translation of the Portuguese original, version 1.0. If there is any difference between the two, the Portuguese text prevails.

Summary

1. Parties and roles

1.1. Controller: the Customer, identified in the dashboard sign-up.

1.2. Processor: DOMEO TECNOLOGIA HOSPEDAGEM DE SITES E TRATAMENTO DE DADOS LTDA, CNPJ 70.130.429/0001-89 ("Domeo").

1.3. This Agreement applies to the personal data of the visitors and buyers of the Customer's store processed by the Platform (Try-On, Storefront and integrations).

1.4. This Agreement does not apply to the data of the Customer itself and of its team (account, billing and support). For those, Domeo is the controller, as set out in the Privacy Policy.

1.5. Privacy channel. Domeo is a small-scale processing agent and, under art. 11 of Resolution CD/ANPD No. 2/2022, does not appoint a data protection officer. The channel for the Customer, data subjects and the ANPD is privacidade@domeo.com.br.

2. What is processed

Annex I describes the data subjects, the data, the purposes and the periods.

3. Face data

3.1. The camera image, the photo, the face points and the face measurements of the person trying on are processed on the person's device.

3.2. This data is not sent to Domeo's servers, is not stored by it and is not passed on to sub-processors.

3.3. Domeo does not change this way of working without notifying the Customer beforehand and without a new agreement on the matter.

4. Obligations of Domeo

Domeo:

4.1. processes the data only to provide the service and in accordance with the Customer's instructions, which are: the Terms of Service, this Agreement and the settings the Customer makes in the dashboard (LGPD, art. 39);

4.2. notifies the Customer if it understands that an instruction is against the law;

4.3. does not sell the data and does not use it for its own or third-party advertising;

4.4. ensures that the people with access to the data have a duty of confidentiality;

4.5. adopts the security measures in Annex II (LGPD, art. 46);

4.6. keeps a record of the processing operations it carries out on behalf of the Customer (LGPD, art. 37);

4.7. helps the Customer respond to data subjects' requests (clause 7) and to the ANPD, with the information it has.

5. Obligations of the Customer

The Customer:

5.1. defines the legal basis for using the Try-On and the Storefront with its visitors;

5.2. informs visitors, in the store's privacy policy, that it uses Domeo Try-On, what it does and that Domeo acts as processor;

5.3. keeps turned on in the dashboard the option to ask for consent before usage measurement, when the chosen legal basis requires it;

5.4. does not send to the Platform personal data that the service does not ask for, in particular photos of people in Studio;

5.5. responds to data subjects as controller.

5.6. Suggested text for the store's privacy policy:

"We use Domeo Try-On so you can see the glasses on your face. The camera image is processed on your device and is not sent or stored. Domeo receives only usage data without identification, so that we can measure how the try-on works."

6. Sub-processors

6.1. The Customer authorizes Domeo to engage the sub-processors in Annex III.

6.2. Domeo requires from each sub-processor data protection obligations compatible with those of this Agreement and is liable to the Customer for what they do.

6.3. Changes. Domeo notifies the Customer, by email and in the dashboard, at least 15 days in advance, before adding or replacing a sub-processor.

6.4. Objection. If the Customer has a reasonable ground not to accept the new sub-processor, it can cancel the agreement at no cost before the change takes effect, receiving back the proportional amount already paid.

7. Data subjects' rights

7.1. If a data subject asks Domeo for something directly, Domeo passes the request on to the Customer within 5 business days and does not answer in its place, unless the Customer asks.

7.2. Domeo helps the Customer fulfil requests for access, correction and deletion within the LGPD time limits.

7.3. Privacy requests made through the store platform (deleting the store's data, deleting or reporting a customer's data) are fulfilled automatically by the integration.

8. Security incidents

8.1. Domeo notifies the Customer within 48 hours after confirming a security incident involving data processed on its behalf.

8.2. The notice contains what is known so far: what happened, which data and data subjects were affected, the measures taken and the contact for questions.

8.3. Communication to the ANPD and to data subjects is up to the Customer, as controller, with the support of Domeo.

9. Data outside Brazil

9.1. Some sub-processors in Annex III process data outside Brazil.

9.2. Domeo only makes international transfers through the mechanisms of the LGPD (art. 33) and of Resolution CD/ANPD No. 19/2024.

10. Verification

10.1. Domeo provides the Customer, on request, with the information needed to show that it complies with this Agreement.

10.2. The Customer may request one verification per year, in writing, 30 days in advance, without access to other customers' data and without disrupting operations. The costs of the verification are borne by the Customer.

11. End of the agreement

11.1. While the agreement lasts, the Customer can export its data through the dashboard or ask support for the export.

11.2. After the end of the agreement, Domeo deletes the personal data processed on behalf of the Customer within 30 days, and confirms the deletion in writing when the Customer asks.

11.3. Only the data that the law requires to be kept and the aggregate numbers that do not identify anyone are kept.

12. Liability

Each party is liable for the damage it causes by breaching the LGPD or this Agreement, under arts. 42 to 45 of the LGPD and the limits in the Terms of Service, to the extent permitted by law.

13. Term and changes

13.1. This Agreement applies for as long as Domeo processes data on behalf of the Customer.

13.2. Changes to this Agreement follow clause 18 of the Terms of Service. Updating the list in Annex III follows clause 6.3 and does not require a new acceptance.

Annex I — What is processed

Annex II — Security measures

• Encrypted connection (HTTPS) on every access.
• Data separated by store, with access rules applied in the database itself.
• Access to the dashboard by role (owner, administrator and other roles), with a second authentication factor available.
• Integration keys with limited scope and the possibility of revocation.
• Log of the actions taken in the account.
• The card number never passes through Domeo's servers.
• Browser rules that prevent the try-on from sending data to addresses other than the Platform's.
• Daily, encrypted backups, with a copy kept off the server.
• Access by the Domeo team to the data limited to what is necessary and logged.

Annex III — Sub-processors and partners

List valid from 15 November 2026. The servers have been in Brazil since 13 November 2026. The current version is published on the site.

They process personal data on behalf of the Customer

For two weeks after the server move, made on 13 November 2026, a backup copy of the servers remains idle on Google Cloud, in the United States.

They process data of the Customer itself (Domeo is the controller)

Studio providers (they receive photos of frames, without data about people)

Platforms chosen by the Customer

Nuvemshop, Shopify and the other store platforms connected by the Customer process the data under the agreements that the Customer itself has with them.

Version history

• 1.0 (15 November 2026): first version.