Brazil Product Privacy Notice Addendum

Effective Date: June 28, 2022

This Addendum applies to personal data processed pursuant to the Brazilian Personal Data Protection Law and its amendments (collectively, “LGPD”), the Brazilian Child and Adolescent Statute (“ECA”) and its amendments, and other applicable data protection laws. 

This Privacy Notice should be read in conjunction with our global Instructure Privacy Product Notice (“Privacy Notice”). In the event of any conflicts, this Addendum will prevail. 

We are guided in this mission also by the following Privacy Principles:

1. Purpose: we will process your personal data for legitimate, specific, and explicit purposes of which you are informed, with no possibility of subsequent processing incompatible with these purposes.
2. Adequacy: your personal data processed will be compatible with the purposes communicated to you, in accordance with the context of the processing activity.
3. Necessity: your personal data will be processed to the minimum necessary to achieve its purposes, relevant, proportional, and non-excessive personal data in relation to the purposes of the personal data processing.
4. Free access: we will provide you with facilitated and free of charge information request concerning the type and duration of the processing of your personal data, as well as its integrity.
5. Quality of the data: we will provide you with the accuracy, clarity, relevancy and update of your personal data, according to the need and for achieving the purpose of its processing.
6. Nondiscrimination: your personal data will not be processed for unlawful or abusive discriminatory purposes.

Children´s Privacy. The processing of personal data belonging to children under twelve years of age and adolescents under eighteen years of age will be done in their best interest, in compliance with LGPD and ECA. As applicable, the processing of children’s personal data shall be done with specific and highlighted consent given by at least one parent or guardian. We shall use all reasonable efforts to verify that the consent was given by the child’s parent or guardian considering available technologies.

Your Rights. In addition to the rights you have to your personal information described on Section VI - Your Information, Your Control of the Privacy Notice – you have the right to:

• the confirmation of the processing of your personal data
• access your personal data
• correct your incomplete, inaccurate or out-of-date personal data
• have your personal data de-identified, blocked or deleted whenever unnecessary or excessive 
• the portability of your personal data
• have your personal data deleted
• object to the processing of your personal data
• delete your personal data processed with your consent
• obtain information about the possibility of not consenting to the processing of your personal data and the consequences of the refusal

Your rights provided in LGPD and in this Privacy Notice may be exercised upon your express request or by your legal representative request to Instructure and may be made by emailing us at privacy@instructure.com. We will respond to your request, when permitted by law and subject to exceptions, within fifteen days. 

Consent. You may change or withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, by emailing us at privacy@instructure.com. You may withdraw your consent if you disagree with the changes made to this Privacy Notice regarding the specific purpose of the processing, the type and duration of the processing, Instructure´s identification and information regarding the shared use of your personal data.

Retention: Instructure may retain your personal data for as long as it reasonably requires it for the purposes described in this Privacy Notice. In determining data retention periods, Instruction takes into consideration local laws, contractual obligations, and the expectations and requirements for handling your personal data.

International transfer of personal data. If your personal data is transferred to countries which may not have the same level of protection of personal data as the LGPD we will take the necessary measures in order to guarantee the same level of protection, such as specific and standard contractual clauses, and binding corporate rules.