PRIVACY AND DATA PROTECTION POLICY

Last updated: January 2026

1. INTRODUCTION

TOOLKIT respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect your information in compliance with the Brazilian General Data Protection Law (LGPD — Law No. 13.709/2018) and other applicable legislation.

2. DEFINITIONS

For the purposes of this Policy, the following definitions apply:

PERSONAL DATA
information relating to an identified or identifiable natural person.
SENSITIVE PERSONAL DATA
personal data concerning racial or ethnic origin, religious belief, political opinion, trade union membership or membership of a religious, philosophical, or political organization, data relating to health or sex life, genetic or biometric data.
DATA SUBJECT
the natural person to whom the personal data that are subject to processing refer.
PROCESSING
any operation carried out with personal data, such as collection, production, receipt, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, deletion, evaluation or control of information, modification, communication, transfer, dissemination, or extraction.
CONTROLLER
a natural or legal person, of public or private law, who is responsible for decisions regarding the processing of personal data. Under this Policy, Toolkit is the controller.
PROCESSOR
a natural or legal person, of public or private law, who processes personal data on behalf of the controller.
DPO / DATA PROTECTION OFFICER
the person designated by the controller to act as a communication channel between the controller, data subjects, and the Brazilian National Data Protection Authority (ANPD).
ANPD
National Data Protection Authority — the body responsible for overseeing, implementing, and enforcing compliance with the LGPD in Brazil.

3. WHAT DATA WE COLLECT

Toolkit collects and processes the following categories of personal data:

3.1 DATA YOU PROVIDE DIRECTLY

  • Identification data: name, email, phone
  • Contact data: address, city, state, postal code
  • Professional data: company, job title, area of activity
  • Communication data: messages sent through contact forms

3.2 DATA COLLECTED AUTOMATICALLY

  • Browsing data: IP address, browser type, operating system, pages visited, time on site, referrer URL
  • Cookies and similar technologies: as described in our Cookie Policy
  • Device data: device model, screen resolution, language

3.3 SENSITIVE DATA

Toolkit does not collect sensitive personal data except when strictly necessary and with your specific, explicit consent.

4. HOW WE USE YOUR DATA

Toolkit uses your personal data for the following purposes:

4.1 PRIMARY PURPOSES

  • Provide the services you request
  • Respond to your inquiries and questions
  • Process and manage contracts
  • Send communications related to our services
  • Improve the user experience on our website
  • Conduct statistical and performance analyses

4.2 SECONDARY PURPOSES (with your consent)

  • Send newsletters and marketing communications
  • Conduct satisfaction surveys
  • Offer personalized content and offers

4.3 LEGAL BASES FOR PROCESSING

Toolkit processes personal data on the following legal bases:

  1. CONSENT: when you expressly authorize the use of your data for specific purposes
  2. CONTRACT PERFORMANCE: when processing is necessary to perform a contract to which you are a party
  3. LEGAL OBLIGATION: when processing is necessary to comply with legal or regulatory obligations
  4. LEGITIMATE INTEREST: when processing is necessary to pursue Toolkit’s legitimate interests, provided they do not override the data subject’s fundamental rights and freedoms
  5. REGULAR EXERCISE OF RIGHTS: when necessary for the regular exercise of rights in judicial, administrative, or arbitral proceedings

5. DATA SHARING

Toolkit may share your personal data in the following situations:

5.1 WITH SERVICE PROVIDERS

  • Hosting and IT infrastructure providers
  • Email marketing tools (when applicable)
  • Data analytics and metrics services (Google Analytics, etc.)
  • Payment processors (when applicable)
  • CRM and relationship management tools

5.2 WITH PUBLIC AUTHORITIES

When required by law or to comply with court orders.

5.3 CONDITIONS FOR SHARING

  • All partners and service providers are contractually required to maintain confidentiality and data security
  • Sharing is limited to the minimum necessary for the specific purpose
  • LGPD compliance checks are performed before sharing

TOOLKIT DOES NOT SELL YOUR PERSONAL DATA TO THIRD PARTIES.

6. INTERNATIONAL DATA TRANSFERS

Some of our service providers may be located outside Brazil. When international data transfers occur, Toolkit ensures that:

  • The destination country offers an adequate level of protection under the LGPD
  • Specific contractual clauses guarantee data protection
  • Appropriate security measures are adopted
  • You will be informed in advance of such transfers

7. DATA RETENTION

7.1 RETENTION PERIODS

  • Contract data: for the term of the contract + 5 years (or as required by law)
  • Communication data: until the purpose is achieved or upon your request for deletion
  • Marketing data: until consent is withdrawn
  • Access logs: 6 months (under the Brazilian Internet Civil Framework)

7.2 AFTER RETENTION PERIODS

Data will be deleted or anonymized, except when:

  • There is a legal obligation to retain them
  • There is a court order
  • Retention is necessary for the regular exercise of rights

8. YOUR RIGHTS AS A DATA SUBJECT

You have the following rights regarding your personal data:

8.1 RIGHT OF CONFIRMATION AND ACCESS

You may confirm whether we process your data and request access to them.

8.2 RIGHT OF CORRECTION

You may request correction of incomplete, inaccurate, or outdated data.

8.3 RIGHT OF DELETION

You may request deletion of your data, except where there is a legal obligation to retain them.

8.4 RIGHT OF PORTABILITY

You may request portability of your data to another service provider.

8.5 RIGHT TO WITHDRAW CONSENT

You may withdraw your consent at any time, without affecting processing carried out before withdrawal.

8.6 RIGHT TO OBJECT

You may object to processing based on legitimate interest.

8.7 RIGHT TO INFORMATION

You may request information about with whom we share your data.

8.8 HOW TO EXERCISE YOUR RIGHTS

To exercise any of these rights, contact us at: dpo@toolkit.digital

RESPONSE TIME: up to 15 business days from receipt of the request.

9. INFORMATION SECURITY

Toolkit adopts technical and administrative measures to protect your personal data against unauthorized access and situations of destruction, loss, alteration, or unlawful communication or dissemination.

9.1 SECURITY MEASURES IMPLEMENTED

  • Encryption of data in transit (SSL/TLS)
  • Role- and permission-based access control
  • User authentication with strong passwords
  • Firewall and intrusion detection systems
  • Regular, secure backups
  • Antimalware and antivirus tools
  • Monitoring of suspicious activity
  • Periodic employee training

9.2 SECURITY INCIDENTS

In the event of a security incident that may entail relevant risk or harm, Toolkit will:

  • Notify you within an appropriate timeframe
  • Notify the ANPD as required by the LGPD
  • Take measures to reverse or mitigate the effects of the incident

IMPORTANT: Despite all efforts, no system is 100% secure. Toolkit cannot guarantee absolute security against all threats.

10. CHILDREN’S AND ADOLESCENTS’ DATA

Toolkit does not intentionally collect personal data from children and adolescents under 18 without the consent of parents or legal guardians.

If we identify that we have collected data from minors without proper authorization, we will take steps to delete such information as quickly as possible.

11. COOKIES AND SIMILAR TECHNOLOGIES

Toolkit uses cookies and similar technologies to improve the user experience. For detailed information, see our Cookie Policy.

11.1 TYPES OF COOKIES USED

  • Essential cookies: necessary for basic site operation
  • Performance cookies: collect information about how you use the site
  • Functional cookies: allow personalization of your experience
  • Marketing cookies: used to display relevant ads (with consent)

You can manage your cookie preferences through our consent banner.

12. CHANGES TO THIS POLICY

Toolkit may update this Policy periodically to reflect changes in our practices or for legal reasons.

NOTIFICATION OF CHANGES

  • Substantial changes will be communicated by email or prominent notice on the site
  • The date of the last update will always be indicated at the top of this document
  • We recommend that you review this Policy regularly

13. CONTACT AND DATA PROTECTION OFFICER (DPO)

For questions related to this Policy or the processing of your personal data, contact our Data Protection Officer:

Email: dpo@toolkit.digital
Subject: Personal Data Protection

13.1 WHAT YOU MAY REQUEST

  • Clarifications about the processing of your data
  • Exercise of your rights as a data subject
  • Information about data sharing
  • Complaints about the processing of your data

13.2 HANDLING PROCESS

  1. Verification of the data subject’s identity
  2. Analysis of the request
  3. Response within 15 business days
  4. Resolution and closure

YOU MAY ALSO FILE COMPLAINTS WITH THE ANPD through the website: www.gov.br/anpd

14. GOVERNING LAW AND JURISDICTION

This Policy is governed by Brazilian law, in particular the LGPD (Law No. 13.709/2018) and the Brazilian Internet Civil Framework (Law No. 12.965/2014).

In the event of disputes, the courts of [CITY] shall have exclusive jurisdiction, to the exclusion of any other, however privileged.

15. PRINCIPLES WE FOLLOW

In all data processing operations, Toolkit observes the following principles:

  • PURPOSE: we process data for legitimate, specific, and informed purposes
  • ADEQUACY: processing is compatible with the purposes communicated
  • NECESSITY: we collect only the minimum necessary
  • FREE ACCESS: we ensure facilitated consultation about your data
  • QUALITY: we keep data accurate, clear, and up to date
  • TRANSPARENCY: we provide clear information about processing
  • SECURITY: we protect data against unauthorized access
  • PREVENTION: we adopt measures to prevent harm
  • NON-DISCRIMINATION: we do not process data for discriminatory purposes
  • ACCOUNTABILITY: we demonstrate compliance with data protection rules