Privacy Policy (LGPD)

Last updated: August 30, 2025

Controlling company in Brazil: Importa Coletiva Soluções Tecnológicas Ltda., CNPJ 46.661.126/0001-0, headquarters: Rua Verbo Divino, 2001, 3rd floor – Room 305, São Paulo/SP.

Data Protection Officer (DPO) Channel: dpo@importacoletiva.com.br 

1. Scope and legal basis

This Policy describes how we handle personal data of individuals who interact with Importa Coletiva's B2B SaaS and e-commerce platform, including leads, customer representatives, registered users, suppliers, and other third parties. We comply with Law No. 13.709/2018 (LGPD) and complementary regulations of the ANPD (National Data Protection Authority). This document is an integral part of the Terms of Use and applies to all products, services, and official channels (website, app, WhatsApp Business, email, and authorized integrations).

2. Roles (Controller/Operator)

Importa Coletiva acts as a Controller when it defines the purposes and means of processing (e.g., account registration, invoicing, security, analytics, B2B marketing). In certain marketplace flows and integrations (e.g., modules operated by partners, customs inspection/clearance, APIs), Importa may act as a Processor on behalf of a business Client, according to documented instructions. In cases of joint responsibility with partners (e.g., anti-fraud, payment services), responsibilities will be defined contractually.

3. Personal data processed

We collect and process, in a manner necessary and proportionate to the purposes:

• Account and identification data: name, CPF (when applicable), corporate email, phone/WhatsApp, position, company (CNPJ), tax and billing information.
• Platform usage data: accesses, pages viewed, account actions, technical logs, device identifiers, IP address, and date/time.
• Communications and support: message content, voluntarily sent attachments, contact preferences, and ticket history.
• Contractual and order data: products of interest, quotations, cost spreadsheets, Incoterms, logistics data (tracking, booking), receipts and related documents.
• Compliance and risk: information for tax classification (NCM), licenses (LPCO) and certifications (e.g., Inmetro/Anvisa, when required by law); identity/representation validation.
• B2B marketing and events: content preferences, interactions with newsletters, webinars, and downloaded materials.
• Cookies and similar technologies: as described in the Cookie Policy (preferences, analytics and, where applicable, opt-in/opt-out advertising).

We do not intentionally collect data from children and adolescents. Our audience is exclusively business-to-business (B2B).

4. Purposes and legal basis

We process personal data for:

• Creating and managing accounts and the contractual relationship: contract execution and preliminary procedures (LGPD, art. 7, V).
• Billing, collection and legal obligations (tax, consumer and regulatory): compliance with legal/regulatory obligation (art. 7, II).
• Responding to requests and providing support: contract execution (Article 7, V) and legitimate interest (Article 7, IX), with balance and reasonable expectations.
• Information security and fraud/abuse prevention: legitimate interest (Article 7, IX) and regular exercise of rights (Article 7, VI).
• Analytics and product improvement: legitimate interest (art. 7, IX), with privacy controls and data minimization.
• B2B marketing and institutional communications: consent (art. 7, I), when required, or legitimate interest (art. 7, IX), with simple and free opt-out.
• Customs compliance and certifications (e.g., Inmetro/Anvisa): legal/regulatory obligation (art. 7, II) and contract execution (art. 7, V).
• Financial and exchange integrations: contract execution (art. 7, V) and legal/regulatory obligation (art. 7, II).

When treatment is based on consent, you may revoke it at any time through our channels, without affecting treatment already carried out based on prior authorization.

5. Cookies and privacy preferences

We use strictly necessary cookies (website operation and security), analytics cookies (audience measurement and improvements), and, where applicable, marketing cookies (personalization and campaigns). You can manage preferences in the banner or in your account settings; strictly necessary cookies cannot be disabled in the system as they are essential to the service. Details about categories, purposes, and retention will be in the Cookie Policy and the website's Preference Center.

6. Sharing with third parties

We may share personal data, in a proportionate and minimized manner, with:

• Technology providers (cloud, hosting, backups, monitoring, CDN, email/WhatsApp, analytics).
• Operational partners (quality inspection, international logistics, courier, airlines/shipping companies, customs brokers).
• Financial institutions, payment methods and foreign exchange providers.
• Auditors and consultants (legal, accounting, compliance), under confidentiality.
• Public authorities, when required by law or valid order.

Service providers process data as Operators, under contracts with clauses guaranteeing data protection, security, and confidentiality.

7. International transfers

Since we operate between Brazil and China and other countries, international data transfers may occur. We will use the mechanisms provided for in articles 33 to 36 of the LGPD (Brazilian General Data Protection Law), such as contractual clauses (specific/standard), global corporate rules, specific consent, or other applicable legal bases, limiting transfers to the minimum necessary and adopting appropriate safeguards.

8. Information security

We have adopted technical and organizational measures compatible with the nature of the operations and the risks involved, such as profile-based access control, encryption in transit, environment segregation, audit trails, credential policies, vulnerability management, and continuity/backups. Despite these efforts, no environment is 100% secure; in the event of incidents that may cause significant risk or damage, we will fulfill our notification obligations to data subjects and the ANPD (Brazilian National Data Protection Authority) and adopt containment and remediation measures.

9. Rights of data subjects

You (or your representative) can exercise, through our channels, the rights provided for in the LGPD, including: confirmation of processing; access; correction; anonymization, blocking or deletion; portability; information about sharing; information about the possibility of not consenting and its consequences; revocation of consent; opposition to processing based improperly on legitimate interest. We will respond quickly and simply or, when applicable, with a complete statement within fifteen (15) days. It is also possible to petition the ANPD.

10. Automated decisions and profiles

We may use algorithms to assist in order classification, logistics estimates, and ticket prioritization. We do not make decisions that produce legal or significant effects solely through automated means without providing mechanisms for human review and adequate explanations, where applicable.

11. Retention and disposal

We retain data for the time necessary to fulfill the stated purposes, comply with legal/regulatory deadlines, and preserve rights (applicable limitation periods). Once the purposes and deadlines have expired, we will delete, anonymize, or block the data, in accordance with the LGPD (Brazilian General Data Protection Law) and our internal policies.

12. Data Protection Officer (DPO) Channels

To exercise your rights, revoke consent, report incidents, or ask questions, contact: DPO@importacoletiva.com.br. For formal communications, you can also use our headquarters address.

13. Updates to this Policy

This Policy may be updated to reflect legal, technological, or operational changes. We will communicate materially relevant changes through official channels. The current version will always be available on the website, with the date of the last update.

Cookie Policy (summary on the website)

• Categories: (i) Strictly necessary; (ii) Analytics; (iii) Marketing.
• Management: consent banner and Preference Center; the user can accept, refuse (when applicable) or select by category.
• Retention: varies by purpose and provider; details in the Preference Center.
• Opt-out: available at any time; blocking strictly necessary cookies may affect essential functionalities.
• Contact: dpo@importacoletiva.com.br