Privacy Policy

Section 01

Introduction

TNT SOLUCOES EM TECNOLOGIA LTDA ("TNT", "we", "us", or "our") is a Brazilian technology company registered under CNPJ 00.000.000/0001-00, with registered offices in Brazil. We develop and deliver enterprise software, ERP systems, cloud infrastructure services, and digital portals to businesses across multiple sectors.

This Privacy Policy governs the collection, processing, storage, and disclosure of personal data obtained through our institutional website at tnttec.site and any related digital touchpoints operated by TNT. It applies to all visitors, prospective clients, existing clients, and business contacts who interact with our online presence, regardless of where in the world they are located.

We are committed to full compliance with Brazil's Lei Geral de Proteção de Dados Pessoais (LGPD — Law No. 13,709/2018), the European Union's General Data Protection Regulation (GDPR — Regulation 2016/679), and all other applicable national and international privacy regulations. When you use this website, you acknowledge that you have read and understood this policy. If you have any questions, the contact details of our responsible party are provided in Section 11.

Section 02

Information We Collect

We collect information in two principal ways: data you actively provide to us, and data collected automatically during your interaction with our website. We practice data minimisation — we only collect what is genuinely necessary for the purposes described in this policy.

2.1 Information You Provide Directly

When you use our static contact channels (telephone, direct email, or in-person meetings arranged through published contact details), you may share personal information such as your name, company name, professional title, telephone number, email address, and the content of your inquiry or message. We collect and retain this information in order to respond to your business enquiry and to build a legitimate professional relationship with you.

2.2 Information Collected Automatically

Like most modern websites, ours automatically collects certain technical and behavioural data when you visit. This data helps us understand how people use the site and identify technical issues. It includes:

• Your device's IP address (stored in anonymised or pseudonymised form where possible)
• Browser type, version, and language preference
• Operating system and device category (desktop, tablet, mobile)
• The URL of the page you visited before arriving on our site (referrer URL)
• Pages visited within our site, time spent on each page, and navigation path
• Date and time of each page request, and the HTTP response code returned
• Aggregated analytics data on session duration and bounce rate

This technical data is collected via server logs and analytics cookies (see Section 4). It does not, on its own, identify you personally, but in combination with other data it could constitute personal data under applicable law, and we treat it accordingly.

2.3 Business Contact Data

In the normal course of our B2B commercial activities, we may receive and record the professional contact details of representatives of client companies, supplier organisations, and partner businesses. This data (name, business email, phone, job role) is used exclusively for managing our commercial relationship and is not used for unsolicited marketing purposes.

Section 03

How We Use Your Information

Every use of personal data at TNT is grounded in a lawful basis as required by both the LGPD and the GDPR. The following table summarises our processing activities and their corresponding legal bases.

Purposes of Processing

• Responding to inquiries and pre-sales communication — We use contact information you provide in order to respond to your questions, provide product or service information, and progress a potential commercial relationship. Legal basis: legitimate interest (LGPD Art. 7, VI; GDPR Art. 6(1)(f)) and, where applicable, pre-contractual steps (LGPD Art. 7, V; GDPR Art. 6(1)(b)).
• Delivering contracted services — If you or your organisation becomes a client of TNT, we process necessary personal data to fulfil our contractual obligations, including onboarding, software configuration, technical support, and invoicing. Legal basis: contract performance (LGPD Art. 7, V; GDPR Art. 6(1)(b)).
• Website analytics and performance optimisation — We analyse aggregated and pseudonymised traffic data to identify which sections of our website are most useful, to detect technical errors, and to improve overall user experience. Legal basis: legitimate interest (LGPD Art. 7, IX; GDPR Art. 6(1)(f)), provided no override of your fundamental rights.
• Compliance with legal and regulatory obligations — We may process and retain data to comply with applicable laws, respond to lawful governmental or regulatory requests, and to establish, exercise, or defend legal claims. Legal basis: legal obligation (LGPD Art. 7, II; GDPR Art. 6(1)(c)).
• Security monitoring and fraud prevention — Server logs and access records are reviewed to identify and mitigate security threats, unauthorised access attempts, and abuse of our systems. Legal basis: legitimate interest and legal obligation.

We do not use personal data for automated profiling or automated individual decision-making that produces legal or similarly significant effects. We do not sell, rent, or lease personal data to any third party under any circumstances.

Section 04

Cookies & Tracking Technologies

Our website uses cookies and similar tracking technologies to provide core site functionality, to measure site performance, and — where you have given consent — to support marketing activity. A cookie is a small text file that a website stores on your device when you visit. Cookies cannot execute code or deliver viruses, and they do not access files stored on your device beyond what was placed there by the site.

Types of Cookies We Use

Cookie / Provider	Category	Purpose	Duration
_tntsess	Essential	Maintains session state so navigation between pages works correctly. Contains no personal identifiers.	Session (deleted on browser close)
cookie_consent	Essential	Records your cookie consent preference so we do not ask again on every visit.	12 months
_ga, _ga_* (Google Analytics 4)	Analytics	Counts unique visitors, tracks page views, session duration, and general navigation behaviour in pseudonymised form. IP anonymisation is enabled.	Up to 24 months
_gid (Google Analytics)	Analytics	Distinguishes users across a 24-hour period for aggregate reporting.	24 hours
Google Ads (_gcl_au)	Marketing	Used by Google Ads to measure advertisement effectiveness and conversion events. Only active if you have consented to marketing cookies.	90 days

Your Cookie Choices

When you first visit our website, a consent banner gives you the opportunity to accept all cookies, accept only essential cookies, or customise your preferences. You may change your preferences at any time through the cookie settings link in the footer. Please note that disabling certain cookies may affect the functionality and performance of the site.

Additionally, you can control cookies directly through your browser settings. Most major browsers (Chrome, Firefox, Safari, Edge) allow you to view, block, or delete cookies. For detailed guidance, visit www.aboutcookies.org. To opt out of Google Analytics specifically, you may install the Google Analytics Opt-out Browser Add-on available at tools.google.com/dlpage/gaoptout.

For opting out of Google's advertising personalisation, visit adssettings.google.com. For broader interest-based advertising opt-outs across the industry, visit youronlinechoices.eu (EU) or networkadvertising.org (international).

Section 05

Sharing With Third Parties

TNT does not sell, trade, or transfer your personal data to outside parties for their own commercial use. We share data only in the limited circumstances described below, and always with appropriate safeguards in place.

5.1 Technology and Infrastructure Providers

We engage carefully vetted third-party technology companies that assist us in operating our website and delivering our services. These include cloud hosting providers, content delivery network (CDN) services, and web analytics platforms. These parties act as data processors under our instruction and are contractually prohibited from using your data for any purpose other than providing services to TNT. Current significant sub-processors include:

• Google LLC (Google Analytics 4, Google Ads) — Provides audience analytics and advertising measurement. Google's privacy policy is available at policies.google.com/privacy.
• Cloudflare, Inc. — Provides DNS resolution, CDN, and DDoS protection for our website infrastructure.
• Cloud hosting infrastructure providers that host our website servers, maintained within data centres with ISO 27001 certification where applicable.

5.2 Legal and Regulatory Disclosure

We may disclose personal data to courts, law enforcement agencies, regulatory authorities, or government bodies where we are legally required to do so, or where such disclosure is necessary to protect the rights, property, or safety of TNT, our clients, or others. We will, to the extent permitted by law, notify affected individuals of such disclosures.

5.3 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of TNT's business assets, personal data held by TNT may be transferred as part of that transaction. In such circumstances, we will notify affected individuals before their data is transferred to a new controller and becomes subject to a different privacy policy.

5.4 International Data Transfers

Some of our third-party service providers (notably Google LLC, headquartered in the United States) process data in countries outside Brazil and outside the European Economic Area. Where such transfers occur, we ensure appropriate safeguards are in place — including Standard Contractual Clauses (SCCs) approved by the European Commission, and contractual commitments aligned with LGPD Article 33. You may request further information about the specific safeguards in place by contacting us as described in Section 11.

Section 06

Data Retention

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following retention periods apply to the main categories of data we process:

• Business inquiry and pre-sales communications — Retained for up to 3 years from the date of last contact, in order to manage ongoing commercial relationships and respond to future inquiries from the same organisation.
• Client contractual data — Retained for the duration of the contractual relationship plus 5 years thereafter, in accordance with Brazilian commercial law (Lei 10.406/2002) and tax legislation requirements.
• Website server logs — Retained for up to 12 months for security and diagnostic purposes, then securely deleted.
• Google Analytics data — Retained in Google Analytics for up to 14 months, in accordance with our account configuration. Aggregated reports may be retained indefinitely.
• Cookie consent records — Retained for 3 years as evidence of the consent given, in compliance with LGPD and GDPR accountability requirements.
• Legal and compliance records — Retained for the period required by the specific legal obligation, which may extend to 10 years for certain financial and tax records under Brazilian legislation.

When personal data has reached the end of its applicable retention period and is no longer required for any other legitimate purpose, it is securely deleted or irreversibly anonymised, whichever is more appropriate given the medium in which it is stored.

Section 07

Data Security

As a technology company, data security is not merely a compliance obligation for us — it is central to how we operate and central to the trust our clients place in us. We implement a layered set of technical and organisational measures designed to protect personal data against unauthorised access, accidental loss, destruction, alteration, and disclosure.

Technical Measures

• All data transmitted between your browser and our website is encrypted using TLS 1.2 or TLS 1.3 (HTTPS). Our SSL/TLS certificates are maintained current and verified.
• Access to internal systems and databases containing personal data is restricted to authorised personnel on a strict need-to-know basis, enforced through role-based access controls.
• We apply network-level protections including firewalls, intrusion detection systems, and DDoS mitigation services provided by Cloudflare.
• Regular automated vulnerability scanning and periodic penetration testing are conducted on our internet-facing infrastructure.
• Data backups are encrypted at rest and stored in geographically separate locations to support business continuity.

Organisational Measures

• All staff with access to personal data receive mandatory privacy and security training and are bound by confidentiality obligations as part of their employment or contractor agreements.
• We maintain an internal data breach response procedure. In the event of a personal data breach, we will notify the relevant supervisory authority and affected individuals within the timeframes required by law (72 hours to the authority under GDPR; as soon as practicable under LGPD).
• Third-party service providers are vetted for their security practices before engagement, and data processing agreements are signed with all entities that process personal data on our behalf.

While we take every reasonable precaution, no system connected to the internet can guarantee absolute security. We therefore encourage you to use secure and updated browsers, and to be cautious about what personal information you share in any digital environment. If you believe your interaction with TNT has resulted in a security concern, please contact us immediately at contato@tnttec.site.

Section 08

Your Rights

Depending on your location and the applicable legal framework (LGPD or GDPR), you hold a meaningful set of rights with respect to your personal data. We take these rights seriously and commit to responding to all valid requests without undue delay — and in any event within 15 business days for LGPD requests, and within 30 calendar days for GDPR requests (extendable by a further 60 days in complex cases, with notification).

To exercise any of these rights, please submit your request in writing by email to contato@tnttec.site with the subject line "Data Subject Request". Please include sufficient information to allow us to verify your identity before processing the request. We will not charge a fee for reasonable requests. Manifestly unfounded or excessive requests may be subject to a reasonable administrative fee or refusal, in which case we will inform you of our reasons.

Section 09

Children's Privacy

The TNT SOLUCOES EM TECNOLOGIA LTDA website is directed exclusively at business professionals and organisations. Our services are enterprise-grade software and technology solutions intended for use by companies and their adult representatives. We do not market to, target, or knowingly collect personal data from children under the age of 18 (or the applicable age of digital consent in the relevant jurisdiction).

If you are a parent or guardian and believe that a person under 18 in your care has submitted personal data to our website without your consent, please contact us immediately at contato@tnttec.site. Upon verification, we will promptly delete the relevant data from our records. Under Article 14 of the LGPD, the processing of personal data of children requires the specific and highlighted consent of at least one parent or legal guardian — a principle we are fully committed to upholding.

Section 10

Changes to This Policy

The technology sector and the regulatory landscape around data protection both evolve continuously. As a result, we review this Privacy Policy at least once per year and update it whenever our data practices change, or whenever new legal requirements apply to our operations. The date of the most recent revision is always displayed prominently at the top of this page.

Where changes are material — meaning they significantly affect how we process your personal data, or affect your rights in a meaningful way — we will take reasonable steps to inform you of the change. For visitors who have provided us with contact details in the context of an existing commercial relationship, we may notify changes by email. For general visitors, the updated policy will be posted on this page with a clearly revised "Last Updated" date.

Your continued use of our website after the posting of changes constitutes your acknowledgement of the revised policy. If you do not agree with the updated terms, we encourage you to discontinue use of the site and to exercise any applicable data subject rights as described in Section 8. We will always maintain an archive of previous policy versions, available on request from our responsible party.

Section 11

Contact & Data Protection Officer

TNT SOLUCOES EM TECNOLOGIA LTDA has designated a responsible party (Encarregado de Dados) for matters relating to personal data protection, in accordance with Article 41 of the LGPD. If you wish to exercise your data subject rights, ask questions about this policy, raise a concern about our data practices, or simply understand more about how we handle your personal information, please reach out through the channels below. We are committed to acknowledging all privacy-related communications within 5 business days.