Privacy Policy

1. Introduction

IES Brasil Consultoria Ltda. ("IesBrazil", "we", "us" or "our") respects the privacy and protection of personal data.

This Privacy Policy explains how we collect, use, store, share, protect and manage personal information when individuals visit our website, contact us, request demonstrations, inquire about training programs or interact with SEIS, our AI-powered Industry Solutions Advisor.

Our processing activities are subject to applicable data protection legislation, including Brazil's General Personal Data Protection Law (Law No. 13,709/2018), commonly known as the LGPD.

This Policy applies to the IesBrazil institutional website and the SEIS service. Additional privacy terms may apply to specific contractual relationships or services.

2. Data controller

The entity responsible for decisions about the personal data processing covered by this Policy (the controller) is:

Legal entity

IES Brasil Consultoria Ltda.

Brazilian company registration (CNPJ)

05.769.233/0001-77

Registered address

Praça Quinze de Novembro, 20, Sala 502, Centro, Rio de Janeiro, RJ, 20010-010, Brazil

Website

https://iesbrazil.com.br

Privacy contact

privacy@iesbrazil.com.br

Individuals may write to privacy@iesbrazil.com.br with questions about personal data protection, this Policy or requests to exercise their rights.

2.1 Data Protection Officer

For the purposes of Article 41 of the LGPD, IesBrazil identifies Rodrigo Eiras, its Chief Technology Officer (CTO), as its Data Protection Officer (Encarregado), the person responsible for communications with data subjects and with Brazil's National Data Protection Authority (ANPD) regarding the processing of personal data.

Data Protection Officer

Rodrigo Eiras

Corporate position

Chief Technology Officer (CTO)

Contact

privacy@iesbrazil.com.br

3. Personal data we collect

Depending on how you interact with our website and services, we may process the following categories of information.

3.1 Contact, Request Demo and Training Inquiry forms

• Full name
• Email address
• Company or organization name
• Information submitted through the Contact, Request Demo and Training Inquiry forms, such as the subject, product, course or message
• Business interests, technical questions and service requirements you choose to share
• Records of the consent confirmation included in those forms

3.2 SEIS identification and conversations

Before using SEIS, visitors must provide their full name, email address and company or organization name, complete a security check and acknowledge this privacy notice.

When you use SEIS, we process:

• Identification information submitted by the visitor
• Questions and messages sent to SEIS
• Responses generated by SEIS
• Conversation identifiers, message order, timestamps and language information
• Session information required to maintain secure access to conversations
• Expressed interests in IesBrazil solutions, technologies, services and training programs
• Commercial-interest classifications and supporting statements from the conversation, where applicable
• The privacy notice version and time of acknowledgement, and your optional marketing preference
• Your follow-up preference (email or WhatsApp), when SEIS identifies a specific commercial inquiry
• Your WhatsApp number, only if you choose WhatsApp and authorize contact through it, with the consent wording, its version and the time of your decision

Providing a WhatsApp number is optional. It is never requested in the identification form, and you may choose email or skip the question without affecting your use of SEIS. If you decline WhatsApp authorization, the number is not stored.

A corporate email address is requested, but recognized personal email addresses may also be accepted. Providing an email address does not verify an individual's identity or employment relationship.

3.3 Technical and security information

We process limited technical information necessary to operate and protect our website and services, including:

• Network and request information, including pseudonymized network identifiers used for request limits
• Security verification results
• Session identifiers
• Security-related timestamps
• Information needed to detect abuse, automated traffic or excessive requests

SEIS uses Cloudflare Turnstile to help distinguish legitimate visitor interactions from automated or abusive activity.

4. Purposes of processing

We process personal data for specific and legitimate purposes, including:

Responding to inquiries

Answering questions and processing requests submitted through our website.

Providing SEIS

Identifying visitors, generating relevant answers, maintaining conversations and supporting continuity within authorized sessions.

Commercial assistance

Understanding visitor interest in IesBrazil offerings and supporting appropriate business follow-up.

Follow-up through your chosen channel

Contacting you about your specific inquiry by email or, only with your explicit authorization, by WhatsApp. SEIS does not send WhatsApp messages; any follow-up is carried out by IesBrazil personnel.

Training and demonstrations

Responding to requests concerning training programs, technical demonstrations and potential engagements.

Security and abuse prevention

Protecting website services, preventing unauthorized access, managing request limits and controlling misuse of AI resources.

Service administration

Maintaining operational records, investigating technical problems and supporting lawful privacy requests.

Legal and regulatory compliance

Meeting applicable obligations and responding to lawful requests.

Optional marketing communications

Sending promotional communications where a valid legal basis exists and applicable requirements are satisfied. Optional marketing consent requested through SEIS is separate from the acknowledgement required to use the service.

We do not treat acknowledgement of this Privacy Policy as blanket consent for every processing activity.

5. Legal bases for processing

Depending on the specific purpose and circumstances, processing may rely on one or more lawful bases established in Article 7 of the LGPD, including:

• Performance of a contract or preliminary procedures related to a contract, at the data subject's request (Art. 7, V) — for example, answering inquiries and providing SEIS
• Legitimate interests of IesBrazil or third parties (Art. 7, IX), where applicable and subject to the required assessment and safeguards — for example, security, service quality and relevant commercial follow-up
• Compliance with legal or regulatory obligations (Art. 7, II)
• Consent (Art. 7, I), where specifically required or selected as the appropriate legal basis — for example, optional marketing communications and contact via WhatsApp about a specific inquiry
• Regular exercise of rights in judicial, administrative or arbitration proceedings (Art. 7, VI), where applicable

IesBrazil determines the appropriate legal basis for each processing purpose, considering necessity, proportionality, transparency and the rights and legitimate expectations of individuals. Where commercial qualification and follow-up rely on legitimate interests, IesBrazil assesses those interests against the rights and expectations of the individuals concerned.

Consent, where used, may be withdrawn at any time in accordance with applicable law. WhatsApp authorization applies only to the specific inquiry for which it was given; each new inquiry requires a new authorization. You may withdraw WhatsApp authorization at any time by writing to privacy@iesbrazil.com.br; the IesBrazil team records the withdrawal and stops WhatsApp contact. Choosing email in a later SEIS conversation also removes the saved number. WhatsApp authorization is separate from optional marketing consent.

6. SEIS — AI-powered Industry Solutions Advisor

SEIS is an artificial intelligence assistant designed to help visitors understand IesBrazil's institutional activities, industry solutions, technologies, specialized services and training offerings, within IesBrazil's scope of activities.

6.1 How SEIS processes conversations

When you submit a message, the service sends the relevant conversation context to the OpenAI API to generate a response. The content you submit may therefore be processed by OpenAI as a technology service provider, subject to the applicable service terms, contractual arrangements and data processing conditions.

Identification form fields are not intentionally added to the information sent for AI processing. Any personal information you type into a message may, however, be processed by OpenAI as part of that message.

6.2 Conversation storage

Accepted visitor messages and completed SEIS responses are stored in IesBrazil's application database, hosted by Supabase, and associated with identified visitor records. Records may include questions, responses, timestamps, session references and information relevant to understanding a visitor's stated business interests.

Stored conversations may be reviewed by authorized IesBrazil personnel for service-related and relevant commercial purposes. Complete transcripts are not automatically emailed.

Please do not submit confidential business information, passwords, financial credentials, sensitive personal data or information you are not authorized to disclose.

6.3 Commercial-interest classification

SEIS may analyze conversation content to identify potential commercial interest in IesBrazil products, services, training programs, technologies or professional engagements. The system distinguishes between an identified contact and a potential commercial lead; identification alone does not make a visitor a lead. Classifications may include:

• Area of interest
• Relevant offering
• Business or technical challenge described by the visitor
• Indications of commercial intent
• Supporting statements quoted from the conversation

These classifications are AI-derived, may be inaccurate and are subject to authorized human review. They are stored separately from the information you explicitly provide. IesBrazil does not intend to use SEIS classifications as the sole basis for decisions producing legal or similarly significant effects on individuals. Where applicable, individuals may request review of decisions made solely through automated processing under Article 20 of the LGPD.

6.4 AI limitations

SEIS responses are generated using artificial intelligence and may contain errors or incomplete information. SEIS does not send emails, schedule meetings or establish contractual commitments, binding commercial offers, pricing, warranties or service availability on behalf of IesBrazil. Formal commercial arrangements require confirmation through authorized IesBrazil representatives.

7. Technology providers and data sharing

IesBrazil uses technology service providers to operate its website, AI assistant, data storage, security and communications. Depending on the interaction, providers include:

Supabase

Application database services, including storage of website inquiries, SEIS contact records, conversations, classifications and related operational information.

OpenAI

Processing of SEIS requests through the OpenAI API to generate AI-assisted responses.

Cloudflare

Turnstile security verification and bot prevention before SEIS identification.

Resend

Transactional email notifications sent to IesBrazil when a website inquiry form is submitted or a SEIS conversation is completed.

WhatsApp (Meta)

Messaging service IesBrazil personnel may use to follow up on a specific inquiry, only when you have authorized contact through WhatsApp. Messages exchanged through WhatsApp are also processed by Meta under its own terms.

Website hosting and application providers

Infrastructure and software services required to operate the website and SEIS.

We seek to limit the information shared with providers to what is reasonably necessary for the relevant services. Provider access, processing responsibilities, subprocessor arrangements, security commitments and contractual protections are assessed as part of IesBrazil's vendor governance.

We may also disclose personal data when required by applicable law, a valid legal process or a competent authority. We do not sell personal data.

8. International data processing and transfers

Some of our technology providers may process, access or store personal data outside Brazil, including OpenAI, Cloudflare, Resend and, when you authorize WhatsApp follow-up, Meta. We do not represent that all providers process data exclusively in Brazil.

Where processing constitutes an international transfer subject to the LGPD, IesBrazil seeks to rely on an applicable legal basis and a valid transfer mechanism, such as adequacy decisions, standard contractual clauses approved by Brazil's National Data Protection Authority (ANPD) or other mechanisms permitted under Brazilian law, including ANPD Resolution CD/ANPD No. 19/2024.

You may request information about the countries involved and the applicable transfer arrangements by writing to privacy@iesbrazil.com.br.

9. Data retention

IesBrazil retains personal data only for as long as reasonably necessary to fulfil legitimate processing purposes, comply with legal obligations, resolve disputes or protect lawful interests.

9.1 SEIS records

SEIS contact and conversation records become eligible for retention review 365 days after the last relevant interaction. This period is a review threshold, not automatic deletion: records are not deleted automatically on the 365th day.

Deletion is carried out through a controlled procedure that requires authorized review. After review, records may be deleted unless continued retention is justified by a documented lawful purpose or legal obligation. A deletion may leave a minimal audit reference that contains no conversation content.

9.2 Website inquiries and commercial records

Information submitted through website inquiry forms and records relating to business relationships may be retained according to their purpose, applicable legal requirements and approved internal retention schedules.

9.3 Backups and provider records

Deletion from the active database may not immediately remove information held in infrastructure backups or in independent provider systems, such as those of OpenAI, Cloudflare, Resend or Meta (WhatsApp). These records follow their own retention schedules, backup lifecycles, contractual arrangements and lawful retention obligations.

10. Security measures and session management

IesBrazil applies technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, loss and misuse. Measures implemented for SEIS include:

• Server-side access controls and restricted database permissions
• Secure, HttpOnly browser sessions that limit visitors to conversations created within their own session; supplying another person's email address does not grant access to their history
• Session expiry, after which identification may be required again
• Security verification before conversations begin, using single-use verification records
• Rate limiting, usage limits and abuse prevention
• Controlled access to stored conversations
• Secure handling of service credentials, kept on the server only
• Procedures for controlled deletion
• Separation between visitor-facing functionality and privileged database operations

Although we take reasonable security precautions, no internet-based service can guarantee absolute security.

11. Cookies and essential session technologies

Our website and SEIS use cookies and comparable browser technologies that are necessary for security, session continuity and service availability:

• An essential, secure SEIS session cookie that keeps your access to your own conversations within an authorized session
• Browser session storage that remembers, for the current browsing session only, that the SEIS invitation has already been shown; it contains no personal data
• Cloudflare Turnstile, which processes browser and technical signals to perform security verification

Any analytics, advertising or other non-essential tracking technologies will be assessed and disclosed before deployment. Where required by applicable law, appropriate notice and consent mechanisms will be provided.

12. Your privacy rights

Subject to applicable legal requirements and limitations, you may exercise the rights provided in Article 18 of the LGPD, including:

• Confirmation of the existence of processing
• Access to your personal data
• Correction of incomplete, inaccurate or outdated data
• Anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed data
• Data portability, where applicable and in accordance with relevant regulations
• Information about the public and private entities with which your data has been shared
• Information about the possibility of refusing consent and the consequences of refusal
• Withdrawal of consent, where processing relies on consent
• Deletion of personal data processed on the basis of consent, subject to lawful retention exceptions
• Opposition to processing where permitted by law
• Review of decisions made solely through automated processing, where applicable

You may also submit complaints or petitions to the ANPD in accordance with applicable law.

13. Access, correction and deletion requests

To submit a privacy request, including access, correction, deletion, withdrawal of marketing consent or withdrawal of WhatsApp authorization, write to privacy@iesbrazil.com.br. Please state that your request concerns privacy or SEIS, and do not include sensitive information or complete transcripts.

We may request reasonable information to verify the identity or authority of the requester before disclosing, correcting or deleting personal data. A matching email address alone may not be sufficient to authorize access to historical SEIS conversations.

Requests are evaluated and addressed in accordance with applicable legal requirements and regulatory deadlines. When deletion is approved, IesBrazil applies its controlled deletion procedure, subject to lawful retention requirements and the backup and provider limitations described in Section 9.

14. Marketing communications

IesBrazil may communicate with individuals about relevant products, services, technologies, training programs and business opportunities where an appropriate legal basis exists.

Optional marketing consent requested through SEIS is separate from the acknowledgement required to use SEIS, is not selected by default and is not required to use the service. You may withdraw it at any time by writing to privacy@iesbrazil.com.br or through the applicable communication channel.

Service-related communications and responses to specific inquiries are treated separately from optional marketing preferences.

15. Children's privacy

The website and SEIS are intended for professional and business-related interactions and are not designed for use by children. We do not intentionally collect personal data from children through SEIS. If we become aware that a child's personal data has been collected inappropriately, we will evaluate the situation and take appropriate measures in accordance with applicable law.

16. Third-party websites

Our website may contain links to external websites or services, which have their own privacy policies and data processing practices. IesBrazil is not responsible for the independent privacy practices of third parties operating outside our control.

17. Changes to this Policy

We may update this Policy to reflect changes in our services, processing activities, technology providers or applicable legal requirements. Each updated version will be published on this page with its version number and effective date. Material changes may require an updated notice and, where appropriate, a new acknowledgement or consent.

18. Contact

IES Brasil Consultoria Ltda. · CNPJ 05.769.233/0001-77

Praça Quinze de Novembro, 20, Sala 502, Centro, Rio de Janeiro, RJ, 20010-010, Brazil · https://iesbrazil.com.br

Data Protection Officer: Rodrigo Eiras, Chief Technology Officer (CTO).

Privacy contact: privacy@iesbrazil.com.br. For questions about this Policy or requests concerning your personal data, including communications intended for the Data Protection Officer, please write to this address.