Privacy Policy

1. Who this policy applies to

This Policy applies to website visitors, people who contact us by form, email or WhatsApp, clients and users of the Client Portal, and representatives of suppliers, partners and public authorities.

2. Who the data controller is

The data controller is ROMERA JR CONSULTORIA E ADMINISTRAÇÃO LTDA, CNPJ 49.855.595/0001-56, located at R. Cel. José Eusébio, 95 – Conj. 13 – Higienópolis – São Paulo/SP, Brazil.

Our affiliates in Madrid and Singapore follow this Policy.

3. Data we collect

• Forms and enquiries: name, company, job title, email, telephone/WhatsApp, industry and message.
• Engagements: company and representative registration details, powers of attorney, corporate records and documents relating to regulatory proceedings.
• Client Portal: credentials, usage logs and documents.
• Browsing: IP address, device, browser, pages visited, date/time and cookies.
• Due diligence: publicly available information, as set out in POL-001.

We do not request sensitive personal data.

4. Purposes and legal bases

• Responding to enquiries and proposals: steps prior to entering into a contract (item V).
• Delivering services and operating the Portal: performance of a contract (item V).
• Proceedings before authorities: legal obligation (item II) and contract (item V).
• Due diligence, fraud prevention and security: legitimate interests (item IX) and legal obligation (item II).
• Sending studies and communications: consent (item I).
• Non-essential cookies: consent (item I).
• Exercising rights: item VI.

These legal bases are set out in Article 7 of Law No. 13,709/2018 (LGPD — Brazilian General Data Protection Law).

5. Data sharing

• Public authorities — MAPA (Brazilian Ministry of Agriculture and Livestock), ANVISA (Brazilian Health Regulatory Agency), Receita Federal (Brazilian Federal Revenue Service) and foreign authorities — solely to deliver the services and through official channels, in accordance with POP-001.
• Hosting, email and cloud providers, subject to confidentiality obligations.
• Affiliates in Madrid and Singapore.
• Authorities, where required by law.

We do not sell or rent personal data.

6. International transfers

International transfers may take place to affiliates and cloud providers. We comply with Article 33 of the LGPD through contractual clauses and security measures.

7. Cookies

We use essential cookies and features, such as language preferences. Measurement or third-party cookies are used only with consent.

8. Retention

• Enquiries that do not result in an engagement: up to 2 years.
• Clients and proceedings: throughout the contract and for at least 5 years after it ends, or for a longer statutory period.
• Access logs: 6 months, under Law No. 12,965/2014 (Brazilian Civil Rights Framework for the Internet).

After the applicable periods, data is deleted or anonymised.

9. Security

We apply access controls, Portal authentication, encryption and confidentiality commitments. Relevant incidents are reported to data subjects and the Brazilian National Data Protection Authority (ANPD).

10. Data subject rights

• Confirmation of processing and access to data.
• Correction of data.
• Anonymisation, restriction or deletion.
• Portability.
• Information about data sharing.
• Withdrawal of consent.
• Lodging a complaint with the ANPD.

These rights are provided for in Article 18 of the LGPD.

11. Privacy contact

Contact contato@romerajr.com with the subject line “Privacidade” (Privacy). We may verify the data subject's identity.

12. Children and adolescents

Our services are intended for companies and professionals. We do not intentionally collect personal data from minors.

13. Changes

The current version of this Policy will always be available at romerajr.com, together with its revision date.