Privacy Policy

1. Purpose and scope

This policy applies to personal data processed by GBS PRIVATE LTDA as controller and, where so provided by contract, as processor on behalf of a counterparty. Processing complies with Brazilian Law No. 13,709/2018 and with the data protection law applicable in the markets where the company operates.

2. Data processed and its origin

The company processes: identification and contact data provided voluntarily through the contact form on this website, namely name, company, e-mail address, subject and message content; registration data of counterparties and their representatives, obtained during the admission process; and data of order recipients, received from originating platforms and limited to what is necessary for dispatch.

This website uses no analytics, advertising or third-party cookies and performs no visitor tracking, as set out in the Cookie Policy.

3. Purposes and legal bases

Data is processed in order to: respond to enquiries sent through the contact channels, on the basis of the legitimate interest of the company and of the data subject in the communication; perform the intermediation contract and process orders, on the basis of performance of a contract; comply with legal, regulatory, accounting and anti-money laundering obligations, on the basis of compliance with a legal or regulatory obligation; and exercise rights in judicial, administrative or arbitration proceedings, on the basis of the regular exercise of rights.

4. Sharing

Personal data is shared only to the extent necessary to perform the operation, with the players and warehouses involved in the order, with service providers engaged under obligations of confidentiality and equivalent security, and with public authorities where required by law or by order of a competent authority. The company does not sell personal data and does not share it for third-party advertising purposes.

International data transfers occur where the intermediated operation involves a counterparty located outside Brazil and are carried out with the safeguards required by applicable law.

5. Retention

Data is retained for as long as necessary to fulfil the purposes of this policy and, in any event, for the statutory retention periods applicable to tax, accounting and anti-money laundering records. Once those periods expire, data is deleted or anonymised.

6. Rights of the data subject

The data subject may request confirmation that processing is taking place, access to the data, correction of incomplete or outdated data, anonymisation, blocking or deletion of unnecessary data or data processed in breach of the law, portability, information on sharing, and withdrawal of consent where consent is the applicable legal basis.

Requests should be addressed to the e-mail address listed on the Contact page. The company responds within the periods set by applicable law and may request additional information to confirm the identity of the requester.

7. Security and incidents

The company adopts technical and administrative protection measures, including role-based access control, individual authentication, access logging and contractual security obligations imposed on service providers. Incidents that may entail relevant risk or damage are reported to the competent authority and to the affected data subjects as required by law.

8. Effectiveness and amendments

This policy takes effect on the date stated at the top of this document. Amendments receive a new version number and a new effective date, published on this same page.