Corporate Privacy Policy & Data Governance

• Brazil: The General Data Protection Law (Law No. 13,709/2018 – LGPD) and the Statute of the Child and Adolescent (Law No. 8,069/1990 – ECA);
• European Union & United Kingdom: General Data Protection Regulation (EU GDPR 2016/679 and UK GDPR);
• United States: California Consumer Privacy Act (CCPA / CPRA) and the Children's Online Privacy Protection Act (COPPA);
• International Treaties & Frameworks: OECD Privacy Recommendations and International Guidelines on Cross-Border Data Flows.

Our activities are grounded in good faith, ethics, transparency, security, and fundamental respect for privacy and the protection of intellectual property. This document forms an integrated part of our Corporate Governance System.

1. The Nature of BIG's Business Activity

BIG is a company specialized in strategic consulting, business development (Business Development), commercial representation, and operational support in the digital games sector and the creative economy.

Our activities include:

• Business Development & Commercial Representation: Representing independent studios before publishers, investors, and international strategic partners.
• Strategic & Commercial Consulting: Structuring sales departments, defining sales processes, planning expansion, and preparing studios for events and B2B matchmaking sessions.
• Fundraising & Mentorship: Consulting on capital raising, acceleration programs, mentoring, and development-team upskilling.
• Intellectual Property & Curation: Technical/commercial curation of games, optimization of development pipelines, and consulting on the protection of creative assets and brands.

2. Scope of Application and Data Subjects

This Policy applies to the processing of personal data of:

• Clients, legal representatives, and members of game development studios;
• Representatives of publishers, investors, business partners, service providers, and suppliers;
• Partner consultants, mentors, specialists, and BIG personnel;
• Candidates in selection processes and participants in mentoring, acceleration, workshops, and training programs;
• Visitors to our digital platforms and participants in physical or virtual events organized or participated in by the company.

3. Fundamental Distinction: Personal Data vs. Confidential Business Information

For purposes of maximum transparency, legal certainty, and sound information governance, BIG draws a clear distinction between Personal Data, which is subject to data-protection and privacy laws, and Confidential Business Information, which is protected under intellectual property law, unfair-competition law, trade-secret law, copyright law, confidentiality agreements (Non-Disclosure Agreements – NDAs), and other applicable legal instruments.

Personal Data means any information relating to an identified or identifiable natural person, governed by the LGPD, GDPR, CCPA/CPRA, and related statutes.

In turn, Confidential Business Information comprises any informational, technical, technological, strategic, operational, commercial, or financial asset that holds economic, competitive, or intellectual value for BIG, its clients, partners, publishers, investors, or represented studios, regardless of whether it also constitutes personal data.

Without limitation, the following are considered Confidential Business Information:

• Source code, object code, and development repositories;
• Development builds, alpha and beta versions, and release candidates;
• Software architecture and technology infrastructure documentation;
• Game Design Documents (GDD), Technical Design Documents (TDD), and engineering specs;
• Development pipelines, continuous integration (CI/CD), and production workflows;
• Software Development Kits (SDKs), APIs, libraries, frameworks, and proprietary tools;
• Documentation related to artificial intelligence, including models, prompts, datasets, parameters, and AI technical specs;
• Graphic assets, concept art, animations, 2D and 3D models, visual effects, interfaces, soundtracks, scripts, narratives, and other creative assets;
• Product roadmaps, strategic timelines, launch plans, and technology planning;
• Monetization models, pricing strategies, game economies, reward systems, and commercial projections;
• Financial documentation, economic projections, management statements, cash flow, and fundraising materials;
• Business plans, business strategy, expansion strategies, and market research;
• Sales playbooks, proprietary methodologies, negotiation models, CRM records, sales funnels, and training materials;
• Contracts, proposals, memoranda, legal opinions, pitch decks, investor materials, and deal-related documents;
• Lists of clients, partners, publishers, investors, suppliers, strategic contacts, and competitive intelligence.

The protection of Confidential Business Information is an essential element of BIG's corporate governance and forms part of its institutional policy on information security, intellectual property, and asset management, applying to employees, partners, consultants, service providers, business partners, and any third parties who gain access to such information by virtue of a contractual relationship or business dealings.

4. Categories of Personal Data Processed

BIG collects and processes only the personal data strictly necessary to carry out its corporate and contractual activities:

• a) Identification and Contact Data: Full name, job title/role, associated company/studio, phone number, corporate email, country, and city.
• b) Professional and Academic Data: Resume, project portfolio, professional profile (LinkedIn), industry experience history, technical skills, and team structures/organizational charts.
• c) Commercial and Deal-Related Data: Contracts, business proposals, meeting minutes and records, negotiation history, and corporate communications.
• d) Financial and Tax Data: Corporate revenue (when associated with an individual data subject who is a Partner), invoices, banking details for payments/receipts, and tax information required for contract performance.
• e) Technical Browsing Data: IP address, access logs, browser type, device identifiers, and information collected via cookies strictly necessary on our websites.

5. Purposes of Processing and Legal Bases

BIG processes personal data exclusively for legitimate, specific, explicit purposes compatible with its business activities, observing the principles of purpose limitation, adequacy, necessity, transparency, security, accountability, and non-discrimination set forth in the LGPD, GDPR, and other laws applicable to its operations.

6. Data Sharing and International Transfer

6.1. Restricted Sharing

The personal data processed by BIG may be shared solely when necessary for the performance of contracted services and projects, involving:

• Game publishers and digital-game investment funds;
• Technical partners, mentors, and specialized consultants who are duly bound by confidentiality obligations;
• Technology, cloud-storage, and infrastructure service providers meeting rigorous compliance standards;
• Public and regulatory authorities, pursuant to a court order or legal obligation.

6.2. International Data Transfer

Given that the games industry is inherently global in nature, and that BIG brokers deals with parties located in various countries, personal data may be transferred outside the data subject's country of origin (for example, transfers between Brazil, the European Union, the United Kingdom, the United States, and Asia).

BIG ensures that every international transfer complies with the applicable legal requirements, using:

• Standard Contractual Clauses (SCCs) approved by the European Commission and the ANPD;
• Transfers to countries that provide an adequate level of protection recognized by the competent authorities;
• Organizational, technical, and contractual safeguards equivalent to the standards required by the LGPD and the GDPR.

7. Protection of Minors and Children's Privacy

BIG conducts its activities predominantly in a Business-to-Business (B2B) environment, providing strategic consulting, business development, commercial representation, and operational support services to companies, development studios, publishers, investors, and other participants in the global digital games industry. Its services, platforms, and forms are, as a general rule, intended for legally capable individuals and representatives of legal entities.

However, considering that some projects on which BIG advises may involve digital games, interactive applications, online platforms, events, or products aimed at a child or youth audience, the company is committed to adopting high standards for protecting the privacy of children and adolescents, strictly observing:

• The General Data Protection Law – LGPD (especially Article 14);
• The Statute of the Child and Adolescent – ECA (Law No. 8,069/1990);
• The European Union's GDPR (especially Article 8);
• The Children's Online Privacy Protection Act (COPPA) of the United States;
• The Age Appropriate Design Code (Children's Code) published by the United Kingdom's Information Commissioner's Office (ICO).

Whenever relevant, BIG encourages products, services, and solutions developed or advised on by the company to comply with the principles of Privacy by Design, Privacy by Default, and Age-Appropriate Design.

8. Information Security

BIG maintains an Information Security Management System (ISMS) based on international best practices, implementing technical, administrative, organizational, and contractual measures proportionate to the risks inherent in its activities, in line with the LGPD, GDPR, and ISO/IEC 27000 family standards.

• 8.1. Information Classification: Information is classified according to its degree of sensitivity, criticality, and business impact as public, internal use, confidential, or restricted.
• 8.2. Access Control & Segregation of Duties: Access is granted exclusively to duly authorized users in accordance with Least Privilege, Need to Know, and Segregation of Duties (SoD).
• 8.3. Periodic Access-Privilege Review: Access rights are reviewed on a recurring basis and upon hiring, termination, or role changes.
• 8.4. Authentication & Credential Protection: Multi-factor authentication (MFA), robust password policies, periodic credential renewal, and automatic lockout after repeated failures.
• 8.5. Encryption: Encryption mechanisms applied during electronic transmission (in transit) and during storage (at rest).
• 8.6. Audit Logging: Audit logs maintained to document relevant events (authentications, access, modifications, exports) protected against alteration.
• 8.7. Vulnerability Management: Continuous processes for identifying, evaluating, and mitigating cyber vulnerabilities and applying security patches.
• 8.8. Vendor Management: Third-party suppliers and processors are vetted for compliance, required to sign DPAs, and adhere to strict technical standards.
• 8.9. Backup & Data Recovery: Periodic backups of essential data with recovery procedures tested regularly to ensure operational resilience.
• 8.10. Business Continuity: Business Continuity Plans (BCPs) and Disaster Recovery Plans (DRPs) aimed at reducing operational impact and restoring systems.
• 8.11. Security Incident Response: Structured internal procedures for identifying, containing, investigating, mitigating, and reporting incidents to authorities and data subjects.
• 8.12. Monitoring & Continuous Improvement: Ongoing audits and reviews to keep controls aligned with national and international standards.
• 8.13. Secure Retention & Disposal: Secure deletion, anonymization, or archiving upon expiration of retention periods.

9. Rights of Data Subjects

BIG guarantees data subjects the ability to exercise all rights provided for under the LGPD, GDPR, CCPA/CPRA, and other applicable operations. Requests will be reviewed and answered within legally established time limits.

10. Integration with BIG's Corporate Governance

This Privacy Policy should not be read in isolation, but rather interpreted in conjunction with BIG's internal regulatory framework:

• Corporate Governance Manual and BIG Methodology;
• Code of Ethics and Professional Conduct;
• Confidentiality and Information Security Policy;
• Intellectual Property Protection and Commercial-Intermediation Best-Practices Policy;
• Anti-Corruption and Conflict-of-Interest Prevention Policy.

11. Security Incidents and Personal Data Breaches

BIG maintains a structured information-security incident-management process for identifying, recording, classifying, containing, investigating, mitigating, responding to, and recovering from events capable of compromising the confidentiality, integrity, availability, authenticity, or resilience of data and corporate information.

Where required by applicable law, or whenever the incident could pose a relevant risk or harm to data subjects, BIG will notify the competent supervisory authorities (including Brazil's ANPD) and the affected data subjects within legally mandated timelines, describing the nature of the data affected, risks involved, and remedial steps taken.

12. Data Retention and Disposal

Personal data processed by BIG will be retained only for the period strictly necessary to fulfill the purposes that justified its collection, or for as long as legal, regulatory, or contractual obligations remain in effect.

13. International Compliance and Corporate Integrity

BIG conducts its operations in compliance with applicable law and with the highest standards of ethics, integrity, transparency, corporate governance, and corporate responsibility.

14. Cookies and Similar Technologies

BIG may use cookies, pixels, tags, web beacons, device identifiers, local storage, and other similar technologies to ensure the proper functioning of its websites, digital platforms, electronic forms, and services.

14.1. Consent for the Use of Cookies

Whenever required by applicable law — particularly the LGPD, GDPR, and the EU ePrivacy Directive — the installation of non-essential cookies will depend on the user's prior, free, informed, and unambiguous consent.

14.2. Preference Management

Users may, at any time, review, change, or withdraw their cookie preferences through the consent-management tool or device settings. Disabling optional cookies does not prevent access to essential platform features.

14.3. Updates to Technologies Used

BIG may change, add, or discontinue tracking technologies to keep pace with technological developments, legal requirements, and industry best practices.

15. Automated Decisions and Use of Artificial Intelligence

BIG may use Artificial Intelligence (AI) tools, including generative AI solutions, machine learning, and natural language processing (NLP), exclusively as decision-support tools assisting its corporate, administrative, commercial, and analytical activities, always in accordance with applicable law, ethical governance principles, and international standards.

• 15.1. Human Oversight: AI is a decision-support tool and does not replace the technical, commercial, or managerial analysis of professionals. Any decision capable of producing legal, financial, strategic, or reputational effects is subject to human review.
• 15.2. Protection of Confidential Information: Personnel and service providers must refrain from entering confidential, strategic, or contractually protected information into public AI platforms lacking enterprise security guarantees.
• 15.3. Protection of Source Code & Intellectual Assets: It is strictly prohibited to enter, reproduce, train on, or process in public AI tools any source code, proprietary algorithms, development pipelines, builds, SDKs, or trade secrets belonging to BIG or its clients.
• 15.4. Handling of Prompts & Generated Content: Commands (prompts), instructions, documents, and output generated through AI are treated in accordance with internal corporate classification and confidentiality policies.
• 15.5. Artificial Intelligence Governance: Periodic risk assessments, vendor security monitoring, bias mitigation, and staff training.
• 15.6. Data Subject Rights & Transparency: Ensuring transparency, purpose limitation, and the right to request human review of decisions governed by automated processes producing legal effects.

16. Support Channel and Data Protection Officer (DPO)

BIG provides a dedicated channel for handling requests related to privacy and personal-data protection, ensuring that data subjects may exercise their statutory rights.

BIG is committed to reviewing and responding to requests received within the time limits provided for under applicable law.

17. Changes and Updates to this Policy

BIG reserves the right to periodically update this Privacy Policy to reflect changes in operating practices, technological advances, or applicable legislation. Any material changes will be communicated through official communication channels and published on our corporate website.