PRIVACY POLICY.

This Policy applies to all personal data processed by our sales promotion company — including business clients who commission promotional campaigns, marketing and trade contacts at those businesses, consumer participants in campaigns we manage, website visitors and anyone whose data is processed in connection with our activities. Our primary relationship is B2B — we work with brands and companies. However, sales promotion campaigns we design or manage may involve consumer data, which we address specifically below.

We process personal data across three distinct groups, with different roles and legal bases for each:

A. Business clients (contracting parties):

• Company name, CNPJ and the name, role, phone and email of the responsible commercial or marketing contact.
• Campaign and brand data provided for the promotional engagement — strategy documents, sales data, product information and commercial intelligence.
• Billing data for NFS-e issuance (CNPJ and contact).

B. Consumer participants in promotional campaigns (operador role):

• Where a client engages us to design or manage a promotional campaign that involves consumer participation — such as competitions, loyalty programmes, sampling registrations or promotional mechanics — consumer data (name, CPF, contact, purchase data) may be processed as part of campaign execution.
• In all such cases, the client brand is the data controller for consumer data; we act as operador under LGPD Art. 39, processing consumer data only on the client's documented instructions and within the campaign scope.

C. Website visitors:

• IP address, browser type, pages visited and access times — technical data for website performance analysis.
• Name, phone and message — when submitting an enquiry via our online form.

• Client businesses (campaign outputs): Promotional strategies, campaign results, performance data and all consulting deliverables are provided to the commissioning client — this is the core purpose of the service.
• Retail channels and media suppliers (client-instructed): Where a promotional campaign requires coordination with retail partners, distributors or media suppliers — minimum necessary data is shared as instructed by the client within the campaign scope.
• SEFAZ-MG / Receita Federal: Tax data for NFS-e issuance and applicable federal and state tax compliance.
• Prefeitura de Contagem (ISS): For ISS/ISSQN obligations on promotional consulting service activities.
• PROCON-MG: When required in a consumer dispute mediation under the CDC.
• Legal authorities: When required by a competent judicial or administrative order.

Our consulting activities operate primarily within Brazil and Minas Gerais. Primary storage of client and project data is in Brazil. Any technology platforms for communication or project management that operate on international servers do so only under the guarantees of Art. 33 of the LGPD or recognised adequacy mechanisms.

• NFS-e and fiscal records: Minimum 5 years under federal and state tax legislation (CTN, Art. 174; SEFAZ-MG).
• Client contract and project records: Duration of the client relationship plus 5 years for contractual, fiscal and dispute documentation.
• Consumer campaign data (operador): Retained only for the duration of the campaign and any post-campaign dispute period as specified by the client. Deleted or returned to the client on campaign conclusion per the data processing agreement.
• Contact and enquiry data (no project commissioned): Up to 1 year from last interaction.
• Website analytics: Aggregated and anonymised after 12 months.

• Client brand strategy, campaign data and commercial intelligence accessible only to the consulting team directly involved in the project;
• Consumer campaign data held in logically separated environments per client — never combined or accessible across different client projects;
• WhatsApp and email communications handled with discretion;
• Encryption in transit (HTTPS) for website and digital communications;
• PCI-DSS certified payment platforms — card data never retained;
• As a Ltda, formal internal data handling protocols maintained;
• Incident response procedures and breach notification per LGPD Art. 48.

• Confirmation and Access (Art. 18, I–II): Confirm whether we hold your data and receive a copy.
• Correction (Art. 18, III): Request correction of inaccurate data.
• Anonymisation / Blocking / Deletion (Art. 18, IV): Request restriction or deletion — subject to fiscal and contractual retention obligations.
• Portability (Art. 18, V): Receive your data in a structured format.
• Deletion of consent-based data (Art. 18, VI): Request deletion of data processed by consent.
• Information on sharing (Art. 18, VII): Find out which entities your data has been shared with.
• Withdrawal of Consent (Art. 8º, §5º): Withdraw consent at any time.
• Complaint to the ANPD (Art. 18, §1º): Lodge a complaint at www.gov.br/anpd.

We respond within 15 business days. For requests relating to consumer data processed as operador in a client campaign, we will forward the request to the relevant client controller as required by LGPD Art. 39.

Our website may use cookies for essential functionality and aggregated performance analysis. We do not use behavioural tracking cookies for advertising without prior consent. Preferences can be managed through browser settings.

Promotional campaigns directed at children and adolescents are subject to specific restrictions under CONAR, the CDC and the Brazilian Statute of the Child and Adolescent (ECA). We advise all clients on these requirements and will not design or manage promotional mechanics that violate CONAR's specific rules on advertising and promotion directed at minors. We never design mechanics that exploit children's inexperience or credulity to drive purchase behaviour. For any campaign that may reach or involve minors, CONAR guidelines and CDC Art. 37(2) are followed without exception.

In our own right, we do not collect sensitive personal data as defined in LGPD Art. 5º, II. Consumer campaign data processed as operador may in some cases involve sensitive categories — for example, in health-related promotional campaigns. In such cases, we apply LGPD Art. 11 heightened handling requirements and require the client to confirm the applicable legal basis before engagement.

All promotional activities we design comply with CONAR self-regulation and CDC Art. 37 on promotional transparency — all promotional conditions, eligibility rules and prize mechanics are clearly communicated to participants. We will not design campaigns that fail to meet these standards regardless of commercial pressure.

This Policy may be updated to reflect changes in our activities, the LGPD, ANPD guidance, CONAR regulations or applicable tax legislation. Material changes will be communicated via our website or directly to active clients by email or WhatsApp.

All privacy requests, questions and complaints should be directed to our Data Protection Officer (Encarregado — LGPD Art. 41):