Privacy notice (LGPD)

Last updated: 08/30/2025

Controller in Brazil: Rua Verbo Divino, 2001, 3rd Floor – Room 305, São Paulo/SP. to: Importa Coletiva Soluções Digitais Ltda

CNPJ 46.661.126/0001-08 -Av. das Nações Unidas, 14.401, Sala 1004 – CEP:04012-062

Ed. Turumã – Condomínio Parque da Cidade

Data Protection Officer (DPO) contact: dpo@importacoletiva.com.br 

1. Scope and legal basis
   This Policy describes how we process personal data of natural persons who interact with the Importa Coletiva B2B SaaS and e-commerce platform, including leads, client representatives, registered users, suppliers, and other third parties. We comply with Law No. 13,709/2018 (the LGPD) and complementary regulations issued by the ANPD (Brazilian Data Protection Authority). This document is part of our Terms of Use and applies to all products, services, and official channels (website, app, WhatsApp Business, email, and authorized integrations).

2. Roles (Controller/Processor)
   Importa Coletiva acts as a Controller when it defines the purposes and means of processing (e.g., account registration, billing, security, analytics, B2B marketing). In specific marketplace flows and integrations (e.g., modules operated by partners, inspection/Customs Clearance, APIs), Importa may act as a Processor on behalf of a business Client, following documented instructions. Where there is joint controllership with partners (e.g., anti-fraud, payment services), responsibilities will be defined in a contract.

3. Personal data processed
   We collect and process, as necessary and proportionate to the purposes:

• Account and identification data: name, CPF (when applicable), corporate email, phone/WhatsApp, job title, company (CNPJ), tax and invoicing details.
• Platform usage data: accesses, pages viewed, account actions, technical logs, device identifiers, IP address, and date/time.
• Communications and support: message content, attachments voluntarily submitted, contact preferences, and ticket history.
• Contract and order data: products of interest, quotes, cost spreadsheets, Incoterms, logistics data (tracking, booking), receipts and related documents.
• Compliance and risk: information needed for tariff classification (NCM), licenses (LPCO) and certifications (e.g., Inmetro/Anvisa, when required by law); identity/representation validation.
• B2B marketing and events: content preferences, interactions with newsletters, webinars, and downloaded materials.
• Cookies and similar technologies: as described in the Cookie Policy (preferences, analytics and, where applicable, advertising with opt-in/opt-out).

We do not intentionally collect data from children and adolescents. Our audience is exclusively business (B2B).

4. Purposes and legal bases
   We process personal data to: 

• Create and manage accounts and the contractual relationship: performance of a contract and pre-contractual procedures (LGPD, art. 7, V).
• Billing, collection, and legal obligations (tax, consumer, and regulatory): compliance with legal/regulatory obligations (art. 7, II).
• Handle requests and provide support: performance of a contract (art. 7, V) and legitimate interests (art. 7, IX), with balance and reasonable expectations.
• Information security and fraud/abuse prevention: legitimate interests (art. 7, IX) and regular exercise of rights (art. 7, VI).
• Analytics and product improvement: legitimate interests (art. 7, IX) with privacy controls and data minimization.
• B2B marketing and institutional communications: consent (art. 7, I) where required, or legitimate interests (art. 7, IX) with a simple, free opt-out.
• Customs compliance and certifications (e.g., Inmetro/Anvisa): legal/regulatory obligation (art. 7, II) and contract performance (art. 7, V).
• Financial and FX integrations: contract performance (art. 7, V) and legal/regulatory obligation (art. 7, II).

Where processing is based on consent, you may withdraw it at any time through our channels, without affecting processing already carried out on the basis of prior authorization.

5. Cookies and privacy preferences
   We use strictly necessary cookies (site operation and security), analytics cookies (audience measurement and improvements), and, where applicable, marketing cookies (personalization and campaigns). You can manage preferences in the banner or within your account settings; strictly necessary cookies cannot be disabled in the system as they are essential to the service. Details on categories, purposes, and retention will be provided in the Cookie Policy and in the site’s Preference Center.

6. Sharing with third parties
   We may share personal data, in a proportionate and minimized manner, with:

• Technology providers (cloud, hosting, backups, monitoring, CDN, email/WhatsApp, analytics).
• Operational partners (quality inspection, international logistics, courier, airlines/shipping lines, customs brokers).
• Financial institutions, payment methods, and FX providers.
• Auditors and advisors (legal, accounting, compliance) under confidentiality.
• Public authorities where required by law or a valid order.

Vendors process data as Processors under agreements containing data protection, security, and confidentiality clauses.

7. International transfers
   Because we operate across Brazil, China, and other countries, international data transfers may occur. We will use the mechanisms provided in the LGPD articles. 33 to 36, such as specific/standard contractual clauses, binding corporate rules, specific consent, or other applicable legal grounds, limiting transfers to the minimum necessary and adopting appropriate safeguards.

8. Information security
   We implement technical and organizational measures consistent with the nature of our operations and related risks, such as role-based access control, encryption in transit, environment segregation, audit logs, credential policies, vulnerability management, and continuity/backups. Despite our efforts, no environment is 100% secure. In the event of incidents that may cause risk or relevant harm, we will comply with notification duties to data subjects and the ANPD, and will take containment and remediation measures.

9. Data subject rights
   You (or your representative) may exercise, through our channels, the rights provided by the LGPD, including: confirmation of processing; access; correction; anonymization, blocking or deletion; portability; information about sharing; information about the possibility of not consenting and the consequences; withdrawal of consent; objection to processing unlawfully based on legitimate interest. We will respond promptly and in a simplified manner or, where applicable, with a complete statement within up to fifteen (15) days. You may also file a petition before the ANPD.

10. Automated decision-making and profiling
    We may use algorithms to assist with order classification, logistics estimates, and ticket prioritization. We do not take decisions that produce legal or similarly significant effects solely by automated means without offering human review mechanisms and appropriate explanations, where applicable.

11. Retention and disposal
    We retain data for as long as necessary to fulfill the informed purposes, comply with legal/regulatory deadlines, and preserve rights (applicable statute of limitations). Once purposes and deadlines have ended, we will delete, anonymize, or block data in accordance with the LGPD and our internal policies.

12. DPO (Encarregado) contact channels
    To exercise rights, withdraw consent, report incidents, or ask questions, contact: dpo@importacoletiva.com.br. For formal communications, you may also use our registered office address.

13. Updates to this Policy
    This Policy may be updated to reflect legal, technological, or operational changes. We will notify materially relevant changes through official channels. The current version will always be displayed on the site, with the last updated date.

Cookie Policy (site summary)

• Categories: (i) Strictly necessary; (ii) Analytics; (iii) Marketing.
• Management: consent banner and Preference Center; the user may accept, refuse (where applicable), or select by category.
• Retention: varies by purpose and provider; detailed in the Preference Center.
• Opt-out: available at any time; blocking strictly necessary cookies may affect essential features.
• Contact: dpo@importacoletiva.com.br