Further information for Brazilian residents
Last update – 2nd December 2025
(a) Lawful Basis of Processing
Article 7 of the LGPD sets out 10 legal grounds for data processing. You can't collect personal data unless you can justify it under one of these grounds:
Only use your personal information when the law allows us to. This means we Must have one or more legal basis to use your personal information. Most of these will be self-explanatory. The most common legal basis which will apply to our use of your personal information or set out below:
Article 7 of the LGPD sets out 10 legal grounds for data processing. You can't collect personal data unless you can justify it under one of these grounds:
- Individual consent
- Performance of a contract with the individual
- Complying with your legal obligations
- Protecting a credit score
- Legitimate interest
- Public health
- The individual's safety
- Performing public statutory duties
- Research
- Legal proceedings
Only use your personal information when the law allows us to. This means we Must have one or more legal basis to use your personal information. Most of these will be self-explanatory. The most common legal basis which will apply to our use of your personal information or set out below:
- We need to perform the contract we have entered into with you, which covers your relationship with us, or to take steps to enter into the contract.
- Where we need to comply with a legal obligation which applies to us
- Where it is necessary for legitimate interest pursued by us or third party, and your interests and fundamental rights do not override those interests.
- Where you have given your consent.
(b) Legitimate Interests Details
| Legitimate Interest | Managing Our Business |
|---|---|
| When we rely on this, we will carry out a Legitimate Interests Assessment to ensure we consider and balance any potential impact on you (both positive and negative), and your rights under Data Protection Law. Our legitimate business interests do not automatically override your interests – we will not use your Personal Data for activities where our interests are overridden by the impact on you unless we have your consent or are otherwise required or permitted to by law. | We process Personal Data for our own legitimate business interest. This relates to us managing our business to enable us to maintain and monitor the performance of our website and to constantly look to improve the website and the services it offers to our users, including when we respond to your queries and complaints, where you are not a client or supplier, or a potential client or supplier. We may use the following personal data: Identity data Contact data. Technical data Marketing and communications data Provide and maintain our websites. To provide and maintain our website, including to monitor the usage of these, troubleshooting, data analysis, network security and system testing necessary for our legitimate interests in maintaining the useability, security and integrity of our website We may use the following personal data: Identity data Location data Transaction data Technical data Recommendations and marketing To make recommendations to you about services that may interest you. We may use the following personal data: Identity data Contact data Technical Data Marketing and communications data Usage data To measure and analyse the effectiveness of the advertising we serve you. We may use the following personal data: Identity data Contact data Location data Technical Data Marketing and communications data Usage data To make suggestions and recommendations to you about goods or services that may be of interest to you and necessary for our legitimate interests (to develop our products/services and grow our business). We may use the following personal Identity data Contact data Location data Technical Data Marketing and communications data Usage data Rights and claims To enforce or apply our Website terms of use, our policy terms and conditions, or other contracts. To exercise our rights, to defend ourselves from claims and to keep to laws and regulations that apply to us and the third parties we work with. We may use the following personal data: Identity data Contact data Transaction data Technical data Profile data Usage Data Data subject rights Verifying your identity when you exercise your data subject rights. Fulfilling data subject rights requests. We may use the following personal data: Identity data Contact data Location data Technical data Usage Data Candidate Data Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud, and in the context of a business reorganisation or group restructuring exercise. |
(c) Details about sharing
More details about who we share your personal data with and why are set out in the table below. In most circumstances, you do not need to pay any charge for exercising your rights. We have one month to respond to you.
To exercise your rights or get more information about exercising them, please contact us at, [email protected]. giving us enough information to identify you.
The transfer of personal data to other jurisdictions is allowed only subject to compliance with the requirements of the LGPD. Prior specific and informed consent is needed for such transfer, unless:
More details about who we share your personal data with and why are set out in the table below. In most circumstances, you do not need to pay any charge for exercising your rights. We have one month to respond to you.
To exercise your rights or get more information about exercising them, please contact us at, [email protected]. giving us enough information to identify you.
The transfer of personal data to other jurisdictions is allowed only subject to compliance with the requirements of the LGPD. Prior specific and informed consent is needed for such transfer, unless:
(d) Data Transfers out of Brazil
We will only transfer personal data to other countries where allowed to do so by the LGPD where:
We will only transfer personal data to other countries where allowed to do so by the LGPD where:
- The transfer is to countries or international organizations with an adequate level of protection of personal data
- There are adequate guarantees of compliance with the principles and rights of data subject provided by LGPD, in the form of
- Specific contractual clauses for a given transfer
- Standard contractual clauses
- Global corporate norms, or
- Regularly issued stamps, certificates and codes of conduct
- The ANPD has provided authorization
- The transfer is necessary for compliance with a legal or regulatory obligation, execution of a contract or preliminary procedures related to a contract, or the regular exercise of rights in judicial, administrative or arbitration procedures
(e) Rights of Brazilian Residents
That said, you may exercise to protect your personal data. You may access those rights at anytime by contacting us at [email protected].
You have several rights under Data Protection Law (Brazilian Data Protection Law (LGPD) (As amended by Law No. 13,853/2019) including (but not limited to);
That said, you may exercise to protect your personal data. You may access those rights at anytime by contacting us at [email protected].
You have several rights under Data Protection Law (Brazilian Data Protection Law (LGPD) (As amended by Law No. 13,853/2019) including (but not limited to);
- Right to be informed. Data subjects are entitled to be informed in detail, in a simple, express, and unequivocal manner, prior to the collection of their personal data, of all the relevant aspects of the processing according to the consent requirements.
- Right to access. Data subjects have the right to access information about themselves that is processed in private or public administration databanks, the manner in which their personal data was collected, the reasons for its collection and at whose request it was collected, as well as transfers made or planned to be made.
- The right to prevent disclosure of personal data. Data subjects have the right to prevent the disclosure of personal data to third parties especially when it impacts their fundamental rights. This right does not apply to disclosure to managers of personal data banks.
- The right to update, include, rectify, or delete personal data. Data subjects have the right to update, include, rectify, or delete personal data (including your biological samples), when (1) the data is partially or totally inaccurate, incomplete, false. there is an omission or error; (2) the data is no longer necessary or relevant for its collection purpose; or (3) the expiration date established for the data processing occurs.
- Right to object/opt-out - Data subjects may object to personal data processing for legitimate reasons relating to the individual. The controller, and the manager of a personal data bank must then delete the personal data. Data subjects have the right to object when:
- there is no law that forces to carry out the act of data processing objected.
- there are legitimate and grounded reasons, due to a specific personal situation; or
- Personal data was obtained from public sources, and the data subject did not consent to such collection.
- The right to be indemnified. The holder of personal data has the right to be indemnified or to claim compensation for any damages that a data protection law infringement cause,
- Consent Withdrawal. If you wish to withdraw your consent no further personal data will be collected about you
- Right to lodge a complaint with the Data Protection Authority of Brazil.
(f) Details of the Data Protection Authority of Brazil
National Data Protection Authority (ANPD) https://www.gov.br/anpd/pt-br
National Data Protection Authority (ANPD) https://www.gov.br/anpd/pt-br