Privacy Policy

1. Introduction

Brasporto Logistica e Assessoria Aduaneira Ltda. ("Brasporto", "we", "us" or "our"), a Brazilian company headquartered at Alameda Terracota, 215 - Torre Union - Cj 1213, Espaco Ceramica, ZIP Code 09531-190, Sao Caetano do Sul/SP, registered under CNPJ No. 22.084.878/0001-95, is responsible for processing the personal data collected through the website www.brasporto.com.

This Privacy Policy aims to clarify, in a transparent and accessible manner, which personal data are collected, how they are used, stored, shared and protected, as well as the rights of data subjects, in compliance with the Brazilian General Data Protection Law (Lei n. 13.709/2018 - LGPD) and other applicable regulations.

By accessing and using our website, you declare that you have read, understood and agreed to the terms of this Privacy Policy. If you do not agree with the provisions set forth herein, we ask that you do not use the website or provide any personal data to Brasporto.

2. Data Controller

For the purposes of this Policy and the LGPD, the controller of your personal data is:

Company Name: Brasporto Logistica e Assessoria Aduaneira Ltda.

CNPJ: 22.084.878/0001-95

Address: Alameda Terracota, 215 - Torre Union - Cj 1213, Espaco Ceramica, ZIP Code 09531-190, Sao Caetano do Sul - SP - Brazil

Phone: +55 (11) 2376-3596

Email: brasporto@brasporto.com

Website: www.brasporto.com

For specific questions regarding data protection, please contact us at the email address above with the subject line "Data Protection".

3. Personal Data Collected

3.1. Data provided directly by the data subject

When interacting with the website, especially through the job application form ("Join Our Team"), we may collect the following personal data:

• Full name;

• Email address;

• Phone number;

• Position of interest;

• Resume (CV) URL;

• LinkedIn profile URL;

• Free-form message written by the data subject.

3.2. Automatically collected data

While browsing the website, we may automatically collect technical and usage information, including:

• IP address and approximate geolocation data;

• Browser type and version, and operating system;

• Pages visited and time spent on the website;

• Date and time of access;

• Cookies and similar tracking technologies (see Section 8).

3.3. Third-party data

In some situations, we may receive personal data from third parties, such as recruitment agencies or resume platforms, always in compliance with the legal bases and purposes set out in this Policy.

4. Purposes of Data Processing

The personal data collected are processed for the following purposes:

4.1. Recruitment and Selection

Data provided in the job application form are used exclusively for professional profile evaluation, contact regarding the selection process and potential employment relationship.

4.2. Customer Service and Communications

Contact data may be used to respond to requests submitted through the website, WhatsApp or email, provide support and supply information about our foreign trade services.

4.3. Website Improvement and User Experience

Browsing data and cookies are used for statistical analysis of website usage, identification of technical issues and enhancement of the visitor experience.

4.4. Compliance with Legal Obligations

When required by applicable legislation, including in matters of foreign trade, labor, tax or customs law, data may be processed to fulfill a legal or regulatory obligation.

4.5. Legitimate Interest

Brasporto may process personal data when necessary for the conduct of its business activities, always balancing its legitimate interest against the rights and expectations of data subjects.

5. Legal Bases for Processing

The processing of personal data by Brasporto is carried out based on the following legal grounds set forth in Art. 7 of the LGPD:

• Consent (Art. 7, I): when the data subject voluntarily provides their data, especially in contact and application forms;

• Performance of a contract (Art. 7, V): to enable the provision of contracted services or pre-contractual negotiations;

• Compliance with a legal or regulatory obligation (Art. 7, II): when the law requires the storage or disclosure of certain data;

• Legitimate interest of the controller (Art. 7, IX): for purposes related to the regular operation of the company, provided they do not override the fundamental rights of the data subject;

• Credit protection (Art. 7, X): where applicable in the company's commercial relationships.

6. Sharing of Personal Data

Brasporto does not sell personal data. Data may be shared only in the circumstances below, always in a necessary and proportionate manner:

• Service providers and technology partners: companies that support our operations (website hosting, email platforms, management and recruitment systems), acting as processors and subject to confidentiality obligations;

• Partner offices and branches: in connection with logistics operations for imports and exports carried out at Brazilian ports (Itajai, Viracopos, Guarulhos, Curitiba, Suape, Santos, Rio de Janeiro, Paranagua, Rio Grande, Fortaleza, Vitoria, Salvador and Uberlandia);

• Public authorities and regulatory bodies: when required by law, court order, decree, customs regulation or request from a competent authority;

• Third parties in corporate transactions: in the event of a merger, acquisition, spin-off or other corporate restructuring of Brasporto, with prior notice to data subjects of any changes to processing.

Brasporto requires all third parties that receive personal data to respect security and privacy standards, prohibiting their use for purposes other than those agreed upon.

7. International Data Transfers

Due to the nature of its activities in international trade, Brasporto may occasionally transfer personal data to foreign countries, in cases where the foreign supplier, freight forwarder or authority is part of the logistics process.

Such transfers will only take place when the destination country offers an adequate level of protection, or through the adoption of contractual safeguards compatible with the provisions of Art. 33 of the LGPD and the regulations of the National Data Protection Authority (ANPD).

8. Cookies and Tracking Technologies

8.1. What are cookies

Cookies are small text files stored on your device when you visit a website. They allow the website to recognize your browser and, in some cases, store preferences and usage information.

8.2. Types of cookies used

• Essential cookies: necessary for the basic functioning of the website, such as navigation between pages and access to secure areas;

• Analytical cookies: collect information about how visitors use the website, helping to improve performance (e.g., Google Analytics);

• Functional cookies: allow the website to remember choices made by the user, such as language or region;

• Third-party cookies: placed by external platforms integrated into the website (e.g., social media such as Instagram and LinkedIn).

8.3. Cookie management

You can configure your browser to refuse all or some cookies, or to alert you when websites set or access cookies. However, disabling essential cookies may impair the functioning of the website.

Most browsers allow you to manage cookies in their privacy settings. For more information, please consult your browser's help section.

9. Data Retention and Deletion

Personal data collected by Brasporto will be retained for as long as necessary to fulfill the purposes for which they were collected, observing the following:

• Applicant data: retained for up to 24 (twenty-four) months after the conclusion of the selection process, for possible contact regarding future opportunities, unless the data subject requests earlier deletion;

• Client and partner data: retained for the contractual term plus the applicable statutory period (e.g., 5 years for tax purposes, in accordance with the Brazilian Tax Code);

• Browsing data and logs: retained for up to 6 (six) months, in accordance with the Brazilian Internet Civil Rights Framework (Lei n. 12.965/2014);

• Data subject to legal obligations: retained for the minimum period required by applicable legislation.

After the retention period expires, data will be securely deleted or anonymized so that they can no longer be associated with the data subject.

10. Information Security

Brasporto adopts appropriate technical and organizational measures to protect personal data against unauthorized access, destruction, loss, alteration, disclosure or any form of inappropriate processing, including:

• Restricted access controls for personal data, based on profiles and functional need;

• Use of secure connections (HTTPS protocol) on the website;

• System monitoring and access logs;

• Regular employee training on data protection;

• Internal information security policy.

In the event of a security incident that may cause relevant risk or harm to data subjects, Brasporto will notify the ANPD and, where applicable, the data subjects themselves, within the legally required timeframe, informing the nature of the incident, the categories of data affected and the measures taken.

11. Rights of Data Subjects

Under the LGPD (Art. 18), you, as a data subject, have the following rights, which may be exercised at any time:

• Confirmation: to find out whether Brasporto processes your personal data;

• Access: to obtain a copy of the personal data we process about you;

• Correction: to request the correction of incomplete, inaccurate or outdated data;

• Anonymization, blocking or deletion: of unnecessary, excessive or non-compliant data;

• Portability: to receive your data in a structured and interoperable format (subject to ANPD regulation);

• Deletion: to request the erasure of data processed on the basis of consent;

• Information on sharing: to know which public and private entities your data have been shared with;

• Information on the right to withhold consent: to be informed about the consequences of refusing consent;

• Withdrawal of consent: to withdraw consent at any time, without prejudice to the lawfulness of processing carried out prior to withdrawal;

• Objection: to object to processing carried out on other legal bases in case of non-compliance with the LGPD;

• Review of automated decisions: to request review of decisions made solely on the basis of automated processing that affect your interests.

To exercise any of the above rights, please contact us at brasporto@brasporto.com, with the subject line "Data Subject Rights - LGPD", providing your full name, registered email address and the right you wish to exercise.

Brasporto will respond to requests within up to 15 (fifteen) business days, extendable depending on the complexity of the request and within legal limits.

12. Data Protection Officer (DPO)

Brasporto will appoint, in accordance with the criteria set forth in the LGPD and ANPD regulatory acts, a Data Protection Officer (DPO).

Until a formal DPO is appointed, the contact channel for data protection matters is:

Email: brasporto@brasporto.com

Subject: Personal Data Protection

13. Social Media and External Links

The Brasporto website contains links to social media profiles (Instagram and LinkedIn) and to third-party platforms (such as WhatsApp). This Privacy Policy does not apply to these external services. We recommend reading the privacy policy of each platform before interacting with them.

Brasporto is not responsible for the privacy practices or content of third-party websites to which our site may link.

14. Data of Minors

The Brasporto website and its services are intended for legal entities and adult professionals. We do not intentionally collect personal data from children or adolescents under 18 (eighteen) years of age without the express consent of their legal guardians.

If we identify that data from minors has been collected without the appropriate safeguards, we will proceed to delete it immediately.

15. Changes to This Policy

Brasporto reserves the right to update this Privacy Policy at any time due to legal, technological or operational changes. The most recent version will always be available at www.brasporto.com.

Significant changes will be communicated in an appropriate manner. We recommend periodically reviewing this Policy. The effective date of the current version is indicated in the header of this document.

16. Governing Law and Jurisdiction

This Privacy Policy is governed by the laws of the Federative Republic of Brazil, in particular Lei n. 13.709/2018 (LGPD), the Brazilian Consumer Protection Code (Lei n. 8.078/1990) and the Brazilian Internet Civil Rights Framework (Lei n. 12.965/2014).

The courts of the District of Sao Caetano do Sul, State of Sao Paulo, are hereby elected as the exclusive venue for the resolution of any disputes arising from this Policy, with the express waiver of any other court, however privileged it may be.

17. Contact

For questions, suggestions or complaints regarding this Privacy Policy or the processing of your personal data, please contact us:

Brasporto Logistica e Assessoria Aduaneira Ltda.

Alameda Terracota, 215 - Torre Union - Cj 1213, Espaco Ceramica

ZIP Code 09531-190, Sao Caetano do Sul - SP - Brazil

Phone: +55 (11) 2376-3596

Email: brasporto@brasporto.com

Website: www.brasporto.com

Brasporto Logistica e Assessoria Aduaneira Ltda.

Version 1.0 - Effective date: March 30, 2026

All rights reserved.