Policies

1. Controller and data protection officer

The app and the website are operated by 200DEV SVCS LTDA., CNPJ 42.364.275/0001-54, with registered address at Alameda Rio Negro, 503, Sala 2020, Alphaville Centro Industrial e Empresarial, Barueri – SP, CEP 06454-000 (“we”), which is the controller of the personal data processed in them. The app is provided for P1 Track Club (“the club”), whose administrators manage accounts, events and vehicle listings within it.

Data protection officer (encarregado, LGPD Art. 41): DPO EXPERT (www.dpoexpert.com.br), represented by Rafael Susskind, with Renata Adeli Franhan Parizotto as deputy. Contact: dpo@200dev.com.

2. Scope

This policy applies to the P1 Track Club app for iOS (APP_STORE_URL — to be supplied), Android (PLAY_STORE_URL — to be supplied) and the web, and to the website p1trackclub.com. It is published at p1trackclub.com/policies and linked from the app’s registration screen and Profile tab.

It does not apply to the club’s activities outside the app, such as club membership, the events themselves, payments, or benefits granted by partner businesses, nor to third-party websites and services linked from the app or the website.

3. Personal data processed

All personal data is provided by you or generated by your use of the app; we do not obtain personal data from third parties. No decision about you is automated: account registrations, event registrations and vehicle listings are reviewed by club administrators.

Data	When collected	Purpose	Legal basis (LGPD Art. 7)
Name, e-mail address, phone number	Account registration	Identifying you and reviewing your registration; signing you in (e-mail); contacting you about events, listings and registrations	V, performance of a contract
Password	Registration and password reset	Authentication. Stored only in hashed form	V; IX, security
Member number, account status, account dates	Generated at registration	Operating your account. The member number is encoded in your digital card; the creation date records your acceptance of this policy	V
CPF	Event registration form, only when the event requires it	Documentation required by the event organiser. Stored once on your record	V; II where a legal requirement applies
Driving licence and CBA licence: number, expiry date and uploaded file	Profile → My documents, or an event form that requires the document	Verifying eligibility for events that require a licence	V; IX, event safety
Vehicles: make, model, year, colour, track-car indication	My Garage, or when submitting a car for sale	Indicating the vehicle you bring to an event; preparing a listing	V
Vehicle listing: vehicle, mileage, price, description, city, up to ten photos, and the record of who submitted it	Submitting a car for sale	Reviewing, publishing and managing the listing	V
Answers on an event registration form	Each event registration	Organising the event. Questions are defined by the club per event; optional ones are marked	V
Password-reset and session records (hashed codes and tokens, expiry, status)	Password reset, sign-in, session renewal	Account recovery and session management	V; IX, security
E-mail delivery record (message type, recipient address, time, result)	Each e-mail sent to you	Troubleshooting e-mail delivery	IX
Approximate location	Only when you select Nearest first or a distance filter	Sorting or filtering that search by distance. Not stored	V
Server access logs (IP address, user-agent, time, method, path, status, timing)	Each request to the API	Operation, troubleshooting and security	IX; II, Marco Civil da Internet Art. 15

The app does not collect date of birth, home address, gender, or payment or card data. Where an event has a price, the app only displays it; payment takes place outside the app.

Registration form questions. The club defines the questions for each event. Registration forms do not request health data or any other category of sensitive personal data (LGPD Art. 5, II). Should an event require such data, it will be collected separately under a specific notice and consent (Art. 11, I).

4. Identity documents

Uploaded documents are stored in a private, encrypted storage bucket and are accessible only through links that expire after five minutes. The original file name is not stored. Documents are reviewed by club administrators; they are not processed by any automated recognition or verification system, and your CPF is not checked against external databases.

Uploading a replacement document creates a new version; earlier versions remain on file until your account is deleted or you ask for their removal.

5. Legal bases

Processing is based primarily on the performance of the contract governed by the Terms of Use (Art. 7, V): your account, event registrations and their requirements, your garage and listings, and your sessions. Security measures, operational logs and the safety of events that require a licence rest on legitimate interest (Art. 7, IX); you may object to this processing at dpo@200dev.com. Where an event organiser legally requires a document or tax ID, or where the law requires records to be kept, the basis is compliance with a legal obligation (Art. 7, II). We do not currently process personal data on the basis of consent.

Acceptance of this policy is required to create an account and is enforced by the server. The account creation date is the record of acceptance; the version of the text accepted is not stored.

6. Sharing of personal data

We do not sell personal data and do not share it for advertising purposes.

Club administrators. Administrators access account data, including uploaded documents, through the administration panel, to review registrations, events and listings. Status changes and edits to account details are recorded with the administrator who made them, and document views are logged.

Amazon Web Services (AWS). AWS hosts the database, file storage, API and logs in the sa-east-1 region (São Paulo, Brazil) and delivers the app’s e-mails through Amazon SES in the same region. AWS processes data on our instructions and under contractual terms that protect it to at least the standard of this policy. The app sends the following e-mails: password-reset code; decision on an account registration; decision on an event registration, with the event’s title and date. Each contains your name (except the reset code) and no other personal data.

WhatsApp (Meta). The “Contact the club” option opens a WhatsApp conversation with the club’s number and, on a vehicle page, prefills it with the vehicle concerned. Its use is optional and subject to WhatsApp’s privacy policy.

Google. The web version of the app loads its rendering engine and a fallback font from Google servers (gstatic.com). Your browser’s IP address therefore reaches Google when the web version loads. The mobile apps make no such request.

Partner businesses. A partner that reads your digital card obtains only your member number, the sole content of its QR code. The code does not change.

Other users. Users cannot see one another’s profiles, documents, vehicles or registrations. Vehicle listings are presented as the club’s; the submitting user is not shown.

Authorities. Personal data is disclosed where required by law or by a competent authority.

International transfers. Account data is stored and processed in Brazil. The website is delivered through a global content delivery network, and the web version of the app makes the requests to Google described above.

7. Cookies and tracking

The website sets no cookies, runs no analytics or third-party scripts and keeps no access logs.

The app contains no analytics, crash-reporting or advertising software, uses no advertising identifiers, sends no push notifications and offers no social login. Location is requested only for Nearest first and distance filters, through the operating system’s permission prompt, at approximate precision and while the app is in use (section 3). The web version keeps your sign-in session in the browser’s local storage and uses no cookies.

8. Children and adolescents

The app is intended for adults. Events that require a driving licence presuppose, in Brazil, being at least 18 years old. The app does not collect date of birth; each registration is reviewed by club administrators before access is granted. If you believe a minor holds an account, write to dpo@200dev.com and the account and its data will be deleted.

9. Retention

Data	Retention period
Server access logs	At least 6 months (Marco Civil da Internet, Art. 15). No automatic expiry
Database backups	7 days
All other data	While your account exists. Afterwards, only for as long as required by law or for the exercise of rights in legal proceedings (for example during limitation periods), after which it is deleted or anonymised

While your account exists no data is deleted automatically, including superseded document versions and cancelled registrations.

10. Security

Passwords and reset codes are stored only in irreversibly hashed form. Reset codes expire after ten minutes, are invalidated after five incorrect attempts and are rate-limited. Sign-in sessions use tokens that are stored hashed, renewed on each use and revoked on all devices after a password reset or suspected misuse; on mobile devices they are kept in the platform’s secure storage. All traffic uses HTTPS. Files are stored with public access blocked and encryption at rest; the database is encrypted at rest and protected against deletion. Service credentials are kept in a managed secrets store. Logs contain request metadata and record identifiers, never request bodies or documents.

Security incidents that may cause relevant risk or harm are notified to the ANPD and to affected data subjects as required by LGPD Art. 48. Security concerns may be reported to dpo@200dev.com.

11. Your rights

Under LGPD Art. 18 you may request confirmation of processing, access, correction, anonymisation, blocking or deletion of unnecessary or excessive data, portability, information on sharing, and information on the consequences of refusing data. Requests are made to dpo@200dev.com from the e-mail address registered on your account and are answered within 15 days (Art. 19, II), or immediately in simplified form (Art. 19, I). We may request confirmation of identity and never ask for your password.

In the app you can view your profile, documents, vehicles and event history, replace a document, cancel a pending registration and sign out. Name, e-mail and phone are changed by club administrators on request; CPF is corrected on request or when an event next requests it. Data export, editing or deleting vehicles, and account deletion are handled on request.

Complaints may be addressed to the Autoridade Nacional de Proteção de Dados (ANPD).

12. Account deletion

Account deletion is requested by e-mail to contato@p1trackclub.com from the address registered on your account and is carried out once the request is confirmed. The procedure, and the data deleted and retained, are set out at p1trackclub.com/policies#deletion. Uninstalling the app does not delete your account.

13. Changes

Changes to this policy are published at p1trackclub.com/policies with an updated date. Material changes to the processing of personal data are communicated to users through the club’s channels.

14. Contact

• Personal data and this policy: dpo@200dev.com (data protection officer, DPO EXPERT).
• App support, accounts, account deletion and events: contato@p1trackclub.com; WhatsApp +55 (11) 99210-7112 (https://wa.me/5511992107112); Instagram https://www.instagram.com/p1trackclub/ (general enquiries only).
• Post: 200DEV SVCS LTDA., CNPJ 42.364.275/0001-54, Alameda Rio Negro, 503, Sala 2020, Alphaville Centro Industrial e Empresarial, Barueri – SP, CEP 06454-000.

1. Acceptance

These Terms constitute a binding agreement between you and 200DEV SVCS LTDA., CNPJ 42.364.275/0001-54, Alameda Rio Negro, 503, Sala 2020, Alphaville Centro Industrial e Empresarial, Barueri – SP, CEP 06454-000. You accept them by creating an account in the app or by signing in to and using it. Browsing p1trackclub.com does not constitute acceptance. The Privacy Policy (p1trackclub.com/policies#privacy), accepted at registration, forms part of this agreement. If you do not agree with these Terms, do not create an account and discontinue use of the app.

2. The app

The app is a tool for P1 Track Club through which approved users register for the club’s events, view vehicles offered for sale through the club and hold a digital card. Accounts, events and listings are managed in the app by club administrators.

The app does not process payments, does not conclude sales, does not provide messaging between users and does not display advertising. Where an event has a price, the app only displays it.

These Terms cover the app and the website only. Club membership, the events themselves and their conditions, payments, vehicle sales and benefits granted by partner businesses take place outside the app, are the responsibility of the club, the event organiser, the parties to a sale or the partner, as the case may be, and are governed by their own terms. We are not a party to them.

3. Accounts

The app is free of charge. Use of it requires that you are at least 18 years old and that your account, created with your name, e-mail address, phone number and a password, has been approved by club administrators. Approval is at the club’s discretion and may be refused without stating reasons; until then the account can only view its own status. Access continues for as long as the club maintains it (section 9).

Accounts are personal: you may not create an account for another person or allow another person to use yours. You must provide accurate information and keep it up to date; name, e-mail and phone are changed on request. Keep your password confidential; you are responsible for all activity under your account while it is under your control, and must notify contato@p1trackclub.com if you suspect unauthorised access. Sessions may be terminated where there is reason to believe an account has been compromised or these Terms breached.

4. Using the app

Requests you make in the app, such as registering for an event or offering a vehicle for sale, are submitted to club administrators, who approve or reject them at the club’s discretion. The app records your request and the information you provide, which must be true and complete; it does not verify documents or other information, and approval does not confirm that you are licensed, insured or eligible for an event. Where an event has its own terms, the app requires their acceptance before registration.

Events, vehicle listings and other content shown in the app are provided by the club. Prices, payment, refunds, conditions of participation, vehicle sales and any benefit granted by a partner business on presentation of your digital card are matters between you and the club or the other party, settled outside the app. The card is personal and non-transferable.

5. Your content

You retain ownership of the information you submit to the app (vehicle details, listing information and photographs, event-form answers and uploaded documents) and warrant that you have the right to provide it, that it is accurate and that its publication does not infringe third-party rights.

You grant us and the club a non-exclusive, worldwide, royalty-free licence to store, reproduce, adapt for display and publish that content solely to organise events and review registrations, to review, publish and promote a listing you submitted (in the app and on p1trackclub.com), and to operate, secure and support the app. The licence extends to the providers that host the app on our behalf. Uploaded documents are used solely to verify eligibility for events and are never published. Content that breaches these Terms, is believed to be inaccurate or unlawful, or that the club elects not to publish may be declined or removed.

6. Acceptable use

You must not: provide false, misleading or third-party information; impersonate another person; share your account, password or card; upload unlawful, offensive or infringing content, or files unrelated to the purpose of the field; attempt to access data that is not yours; scrape or bulk-download the app’s content or operate automated agents against it; reverse engineer or tamper with the app, or circumvent its approval, authentication or rate limits; or use the app for unlawful purposes or in a manner that harms the club, its users or its partners.

7. Intellectual property

The app, the website, their code, design, text, graphics and photographs, and the names, logos and visual identity of P1 Track Club belong to us, to the club or to their licensors and are protected by Law 9.610/1998 and Law 9.279/1996. Approved users receive a personal, non-exclusive, non-transferable and revocable licence to install and use the app on a device under their control for as long as their access lasts. You may not copy, modify, distribute, sell or create derivative works from the app or the website, remove proprietary notices, use the club’s name or logo without written permission, or use any part of the app to build a competing product. Third-party components remain subject to their own licences.

8. App store terms

The app is distributed through the Apple App Store (APP_STORE_URL — to be supplied) and Google Play (PLAY_STORE_URL — to be supplied). These Terms are concluded between you and us only; Apple and Google are not parties to them.

For the app obtained from the App Store: the licence in section 7 is limited to Apple-branded devices you own or control, as permitted by the App Store Terms of Service; we, and not Apple, are responsible for the app, its content, maintenance, support, warranties and any claim of non-conformity or infringement of third-party rights; Apple and its subsidiaries are third-party beneficiaries of these Terms and may enforce them; and you represent that you are not located in a country subject to a U.S. Government embargo or listed by the U.S. Government as a prohibited or restricted party. For the app obtained from Google Play, the Google Play Terms of Service apply to the distribution.

9. Suspension and termination

You may stop using the app at any time and request deletion of your account and data as described at p1trackclub.com/policies#deletion.

Access may be suspended or revoked where you breach these Terms or the law, where information you provided is false or your account is used by another person, where the club so decides, or where required by law or a competent authority. Where circumstances permit, notice and an opportunity to remedy will be given; where there is a risk to persons, property or the service, suspension may be immediate. Revocation ends access to the app and the validity of the card and permits club administrators to cancel pending registrations and withdraw listings you submitted; it does not affect arrangements made outside the app. Sections 5, 7, 10 and 11 survive termination.

10. Liability

The app is a registration and information tool. Events are organised by the club and governed by their own terms and liability waivers; approval of a registration in the app does not certify that you are fit, licensed or insured to drive or that your vehicle is safe. We are not responsible for the events, for vehicle sales, for benefits granted by partners, or for any other dealing that takes place outside the app.

We endeavour to keep the app and the website available and accurate but do not warrant uninterrupted or error-free operation, and may suspend access for maintenance, security or technical reasons. We give no warranty regarding content submitted by users or by the club.

This is a consumer relationship under Brazilian law. We do not exclude or limit our liability for defects in the app or for damage caused to consumers under Articles 12 to 25 of the Consumer Protection Code, for wilful misconduct or fault, or in any other case where exclusion is not permitted by law (Article 51). Our liability extends to loss that is a direct and immediate consequence of our acts or omissions (Civil Code, Art. 403). We are not liable for the acts of third parties, including the club in its activities outside the app, partners, buyers, sellers and event participants, except where provided by law. Neither party is liable for failures caused by events beyond its control.

11. Changes and governing law

Features of the app may be added, modified or withdrawn, with advance notice where a change materially reduces the service. Changes to these Terms that reduce your rights or impose new obligations take effect at least 30 days after notice by e-mail or in the app; you may close your account at no cost before they take effect, and continued use after that date constitutes acceptance. Changes do not apply retroactively to registrations, listings or rights already acquired. Other changes take effect on publication at p1trackclub.com/policies#terms.

These Terms are governed by the laws of the Federative Republic of Brazil, including the Consumer Protection Code (Law 8.078/1990), the Civil Code (Law 10.406/2002), the Marco Civil da Internet (Law 12.965/2014) and the LGPD (Law 13.709/2018). The courts of Barueri – SP have jurisdiction over disputes arising from these Terms, without prejudice to the consumer’s right to bring proceedings in the courts of their own domicile (Consumer Protection Code, Art. 101, I). Consumers may also use PROCON and consumidor.gov.br. If any provision is held invalid, the remaining provisions remain in force.

12. Contact

200DEV SVCS LTDA., CNPJ 42.364.275/0001-54, Alameda Rio Negro, 503, Sala 2020, Alphaville Centro Industrial e Empresarial, Barueri – SP, CEP 06454-000, operator of the app for P1 Track Club.

App support, accounts, account deletion, events and listings: contato@p1trackclub.com. Personal data and your rights: dpo@200dev.com. WhatsApp: +55 (11) 99210-7112 (https://wa.me/5511992107112). Instagram: https://www.instagram.com/p1trackclub/. Requests concerning your account must be sent from the e-mail address registered on it.

1. How to request deletion

Send an e-mail to contato@p1trackclub.com with the subject “Account deletion — P1 Track Club”, from the e-mail address registered on your account. If you no longer have access to that address, say so and include your full name and registered phone number; your identity will be confirmed by other means. Alternatively, message the club on WhatsApp at +55 (11) 99210-7112 (https://wa.me/5511992107112).

State whether a vehicle you submitted for sale should also be removed from the catalogue. Do not include your password; it is never requested.

Pending and rejected accounts are deleted by the same procedure.

2. Data deleted

• Account record: name, e-mail, phone, CPF, password hash, member number and account status.
• Documents, including all earlier versions and uploaded files.
• Vehicles in My Garage.
• Event registrations and form answers, subject to section 3.
• Sessions on all devices and password-reset records.

Your digital card ceases to be valid.

3. Data retained

Data	Reason	Period
Server access logs (IP address and user-agent per request; no name or member number)	Marco Civil da Internet, Art. 15	At least 6 months; no automatic expiry
E-mail delivery record	Troubleshooting delivery	As required by law or for the exercise of rights
Participation record of events that have taken place	Event records kept by the club	Indefinitely, in dissociated form: form answers are removed and the record is no longer linked to you (LGPD Art. 12)
Vehicle listing content (photos, description, price, mileage, city)	Part of the club’s catalogue	Until removed by the club; request removal together with deletion
Records required for legal, tax or accounting obligations	LGPD Art. 7, II and Art. 16	As required by law
Database backups	Disaster recovery	7 days

4. Timeline

Requests are answered within 15 days (LGPD Art. 19, II). Deletion is carried out once it has been confirmed that the request comes from the account holder, and you are notified on completion. A request may be refused, in whole or in part, only where the law so permits, and you will be informed of the reason.

Other requests concerning your personal data (access, correction, portability) follow the Privacy Policy, section 11.

5. Contact

Account deletion and app support: contato@p1trackclub.com. Personal data and your rights: dpo@200dev.com. WhatsApp: +55 (11) 99210-7112 (https://wa.me/5511992107112). Instagram: https://www.instagram.com/p1trackclub/. App stores: APP_STORE_URL — to be supplied · PLAY_STORE_URL — to be supplied.

Controller: 200DEV SVCS LTDA., CNPJ 42.364.275/0001-54, Alameda Rio Negro, 503, Sala 2020, Alphaville Centro Industrial e Empresarial, Barueri – SP, CEP 06454-000, operator of the app for P1 Track Club. Data protection officer: DPO EXPERT, dpo@200dev.com. Hosting and e-mail delivery: Amazon Web Services, sa-east-1 region (São Paulo, Brazil).