Privacy Policy.

This Policy applies to all personal data processed by our sales promotion consultancy — including business clients who engage our strategy and campaign management services, individual consumers who participate in promotional campaigns we manage on behalf of our clients, website visitors and anyone whose data is processed in connection with our consulting activities.

Our primary relationship is B2B — we work with businesses, not directly with end consumers. However, the promotional campaigns and trade programmes we design and manage on behalf of clients may involve data collection from individual consumers or channel partners, which this Policy also addresses.

In our consulting and campaign management activities, we process data across three distinct groups of data subjects:

• Business client data (primary): Company name, CNPJ, address, and the name, phone number, email and role of the client's responsible contact or commercial director — collected when clients engage our consulting or campaign management services.
• Campaign participant data (on behalf of clients): Where we manage promotional campaigns on behalf of a client, individual consumer participants may submit data including name, CPF, contact details and purchase or participation records. In these cases, the commissioning client is the primary data controller; we act as data processor (operador) under LGPD Art. 39. We collect and process this data only as instructed by the client and within the scope of the campaign brief.
• Channel partner data (trade promotion): For trade promotion programmes targeting distributors, resellers or sales teams — name, CNPJ or CPF, contact details and sales or participation performance data — collected within the programme structure agreed with the client.
• Billing data: Company name and CNPJ (or individual name and CPF) for NFS-e issuance — in compliance with SEFAZ-SC and ISS/Prefeitura de Joaçaba requirements.
• Contact and enquiry data: Messages via WhatsApp, telephone or online form.
• Technical website data: IP address, browser type, pages visited and access times.

We do not sell or commercially exploit client or campaign participant data. Sharing occurs only in the following situations:

• Client businesses (campaign results): Campaign performance data, participant statistics and results reports are shared with the commissioning client — this is the purpose for which campaign management was engaged. Individual participant data is shared with the client only to the extent required for campaign validation, prize fulfilment or regulatory compliance.
• SEFAZ-SC / Receita Federal: Tax data for NFS-e issuance and applicable federal and state tax compliance.
• Prefeitura de Joaçaba (ISS): For ISS/ISSQN obligations on applicable promotional services activities.
• PROCON-SC: When required in a consumer dispute mediation under the CDC — including complaints relating to promotional campaigns.
• Legal authorities: When required by a competent judicial or administrative order.

Our consulting and campaign management activities operate primarily within Brazil. Primary storage of client, campaign and contact data is in Brazil. Any technology platforms used for campaign management, analytics or communication that operate on international servers do so only under the guarantees of Art. 33 of the LGPD or recognised adequacy mechanisms.

• NFS-e and fiscal records: Minimum 5 years under federal and state tax legislation (CTN, Art. 174; SEFAZ-SC).
• Business client project and contract records: Duration of the client relationship plus 5 years — for contractual, fiscal and service dispute documentation.
• Campaign data processed as operador: Retained for the period specified in the data processing agreement with each client. On termination of the campaign or client relationship, campaign participant data is returned to the client or deleted as instructed, unless a longer period is required by applicable law.
• Trade promotion programme records: Duration of the programme plus 5 years — for fiscal compliance and dispute documentation.
• Contact and enquiry data: Up to 1 year from last interaction if no project was commissioned.
• Website analytics: Aggregated and anonymised after 12 months.

• Access to client project records and campaign data restricted to consulting principals and authorised project staff — not shared externally beyond those required for campaign delivery;
• Campaign participant data handled under documented data processing protocols and, where applicable, a data processing agreement (DPA) with the commissioning client;
• Commercial strategy information and campaign mechanics treated as strictly confidential — not disclosed to any third party without client written consent;
• Encryption in transit (HTTPS) for website and digital communications;
• PCI-DSS certified payment platforms — card data never retained by the company;
• As a Ltda, formal internal data handling and access control protocols are maintained;
• Incident response procedures and breach notification in accordance with LGPD Art. 48.

Both our business clients and, where applicable, individuals whose data we process in our role as operador have the following rights under the LGPD:

• Confirmation and Access (Art. 18, I–II): Confirm whether we hold your data and receive a copy.
• Correction (Art. 18, III): Request correction of inaccurate data.
• Anonymisation / Blocking / Deletion (Art. 18, IV): Request restriction or deletion — subject to fiscal retention and contractual obligations.
• Portability (Art. 18, V): Receive your data in a structured format.
• Deletion of consent-based data (Art. 18, VI): Request deletion of data processed by consent.
• Information on sharing (Art. 18, VII): Find out which entities your data has been shared with.
• Withdrawal of Consent (Art. 8º, §5º): Withdraw consent at any time.
• Complaint to the ANPD (Art. 18, §1º): Lodge a complaint at www.gov.br/anpd.

We respond within 15 business days. For requests relating to campaign participant data where Executiva acts as operador, we will direct your request to the relevant client controller as appropriate under LGPD Art. 39.

Our website may use cookies for essential functionality and aggregated performance analysis. We do not use behavioural tracking cookies for advertising without prior consent. Preferences can be managed through browser settings.

Our consulting services are engaged by businesses — adults acting in a professional capacity. We do not intentionally collect personal data from children under 13 in our own right. For promotional campaigns we manage on behalf of clients that involve or may reach minors, we require the commissioning client to ensure that all required parental or guardian consent is obtained and that the campaign complies with CDC Art. 37 and applicable regulations on promotional communications directed at minors. Executiva does not design or execute campaigns targeting children without explicit client authorisation and appropriate safeguards.

In the ordinary course of sales promotion consulting, we do not collect or process sensitive personal data as defined in LGPD Art. 5º, II (race, health, biometrics, religion, political affiliation, etc.) in our own right. Campaign participant data processed on behalf of clients may in exceptional cases involve sensitive categories — in such cases, we require the client to provide documented legal basis and we comply with the heightened obligations of LGPD Art. 11.

CDC Art. 37 requires that all promotional activity comply with transparency, honesty and non-deception principles. As a sales promotion consultancy, we are committed to designing and managing campaigns that fully comply with these obligations and applicable CONAR guidelines.

This Policy may be updated to reflect changes in our activities, the LGPD, ANPD guidance, CDC promotional regulations or applicable tax legislation. Material changes will be communicated via our website or directly to active clients by email or WhatsApp.

All privacy requests, questions and complaints should be directed to our Data Protection Officer (Encarregado — LGPD Art. 41):