1. Who we are and what this policy covers
Grupo Baggio respects your privacy and handles personal data only for clear, legitimate purposes. This policy explains what we collect, why, who we share it with, and the rights you have.
“Grupo Baggio”, “we” and “us” refer to the group of companies that operate under the Baggio brand in Brazil and the United States. For the purposes of Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018) and the EU General Data Protection Regulation (GDPR), the data controller is:
- Legal name: Grupo Baggio Ltda
- Registration: CNPJ 39.057.351/0001-74
- Address: Avenida Brig. Faria Lima, 1572, Sala 1022/381, Edifício Barão de Rothschild, Jardim Paulistano, São Paulo, SP, 01451-917, Brazil
- Privacy contact (Data Protection Officer / Encarregado): WhatsApp +1 305 306 2700
This policy applies to this website, our messaging communications, and the consulting services we provide in Brazil and the United States. It does not cover third-party websites linked from our pages, which have their own policies.
If you engage us under a signed agreement, that agreement and any confidentiality terms in it also apply and take precedence where they are more specific.
2. Personal data we collect
We collect only the data we need to answer you, deliver our services and meet our legal obligations.
| Category | Examples | Source |
|---|---|---|
| Contact and identification | Name, company, job title, phone, country | You, through forms, messages, calls or meetings |
| Engagement and project data | Information about your company, shareholders, managers, projects and the products or technology involved | You or your authorized representatives |
| Compliance and due-diligence data | Identity documents, corporate records, ownership details, end-use and end-user information | You, public registries and official databases, when required by law or by a regulator |
| Billing data | Billing address, tax ID, payment records | You and our payment providers |
| Technical and usage data | Pages visited, approximate country, browser, operating system and device type, time on page | Collected automatically when you use our website, without cookies |
We do not ask for sensitive personal data (such as health, religious or biometric data) through our website. If a regulatory process requires it, we will tell you why, collect only what that process requires, and handle it under the stricter rules that apply to it.
Please do not send us personal data about other people unless you are authorized to do so and they have been informed.
3. How we use your data and our legal bases
Every use of personal data relies on a legal basis under LGPD Article 7 and, where it applies, GDPR Article 6.
| Purpose | Legal basis |
|---|---|
| Responding to inquiries and preparing proposals | Steps prior to a contract at your request; legitimate interest |
| Delivering consulting, structuring, licensing and project services | Performance of a contract |
| Filings and applications with government agencies and regulators in Brazil and the United States | Compliance with legal or regulatory obligations; performance of a contract |
| Know-your-customer, export-control and sanctions screening | Compliance with legal or regulatory obligations; legitimate interest in lawful operations |
| Invoicing, accounting and tax records | Compliance with legal obligations |
| Website security, fraud prevention and performance | Legitimate interest |
| Website analytics (anonymous, cookie-free measurement) | Legitimate interest |
| Establishing, exercising or defending legal claims | Regular exercise of rights in judicial, administrative or arbitration proceedings |
When we rely on legitimate interest, we weigh it against your rights and expectations, and you can object at any time (see section 8). We do not use your data for purposes incompatible with those listed here without informing you first.
4. Website analytics and browser privacy signals
This website sets no cookies and stores nothing on your device.
We use Lovable's visitor analytics to understand how the site is used. It uses no cookies, stores nothing on your device, does not keep IP addresses and does not identify visitors. Lovable collects this data for us. Lovable's privacy policy (https://lovable.dev/privacy) explains how it handles it.
For every visitor it records: the pages visited, where visitors came from, their country, browser, operating system and device type, how long they stay, how fast pages load, errors, and which buttons and links they click. Detailed data is kept for 90 days and daily summaries for one year.
Global Privacy Control (GPC). If your browser sends the Global Privacy Control signal, click recording is not performed for your visit.
5. Who we share data with
We do not sell your personal data, and we do not share it for cross-context behavioral advertising without your consent. We share it only as follows:
- Government agencies and regulators, in Brazil, the United States or elsewhere, when a filing, license, registration or approval you asked us to handle requires it, or when the law requires it.
- Professional partners we engage for your matter, such as attorneys, accountants, customs brokers, certification bodies and translators, under confidentiality obligations.
- Service providers that host our website, email and files or support billing, analytics and communications. They process data only on our instructions, under contracts with data protection terms.
- Companies within Grupo Baggio, only for the purposes described in this policy.
- Authorities and courts, when we receive a valid legal request or must protect our rights, our clients or the public.
- A successor business, if we are involved in a merger, acquisition or sale of assets, subject to this policy.
We never share client project information with other clients.
6. International data transfers
Because we work between Brazil and the United States, your data may be stored or accessed in either country, and in other countries where our service providers operate.
- From Brazil: we transfer data abroad only under one of the mechanisms in LGPD Article 33 and ANPD Resolution CD/ANPD No. 19/2024. This usually means the ANPD's standard contractual clauses, used without changes, or a transfer necessary to perform a contract you requested. Transfers to the European Union rely on the ANPD's recognition of the EU as offering adequate protection (Resolution No. 32/2026).
- From the European Economic Area or the United Kingdom: we rely on an adequacy decision or on the European Commission's standard contractual clauses.
On request, we will tell you which countries your data goes to, why, and which safeguard applies, and we will provide a copy of the clauses used within 15 days.
7. How long we keep data and how we protect it
We keep personal data only as long as the purpose requires, and then delete or anonymize it.
| Data | Retention period |
|---|---|
| Inquiries that do not become an engagement | Up to 2 years after the last contact |
| Client engagement and project files | Length of the engagement, plus the period required by law or for legal claims, usually 5 to 10 years |
| Records required by regulators (licensing, import/export, controlled products) | The period set by the applicable rules, which may be 5 years or longer |
| Accounting and tax records | As required by Brazilian and US tax law, usually 5 to 7 years |
| Website analytics | Detailed data 90 days; daily summaries 1 year |
We protect data with measures suited to its sensitivity. These include encryption in transit and at rest, access limited to people who need it, multi-factor authentication, vetted service providers and staff confidentiality obligations. No system is completely secure. If a security incident creates a relevant risk to you, we will notify you and the competent authorities (including the ANPD) as the law requires.
8. Your rights
Depending on where you live, you have some or all of the following rights. We extend them to everyone who contacts us, wherever the law allows.
- Confirmation and access: to know whether we process your data and get a copy.
- Correction: to fix incomplete, inaccurate or outdated data.
- Deletion, anonymization or blocking: of data that is unnecessary, excessive or processed unlawfully.
- Portability: to receive your data in a structured format or have it sent to another provider.
- Information: about who we share your data with and what happens if you refuse consent.
- Withdrawing consent at any time, without affecting earlier processing.
- Objecting to processing based on legitimate interest, and to direct marketing.
- Opting out of the sale or sharing of personal data, targeted advertising and profiling, including through Global Privacy Control.
- Review of automated decisions that significantly affect you.
- Non-discrimination: we will not treat you differently for exercising your rights.
How to exercise them. Contact us on WhatsApp at +1 305 306 2700. We may ask you to confirm your identity before acting. An authorized agent can submit a request on your behalf with proof of authorization. We respond within 15 days under the LGPD, one month under the GDPR, and 45 days under US state laws. If we decline a request, we will explain why and tell you how to appeal.
Complaints. You can complain to Brazil's National Data Protection Authority (ANPD), to your EU supervisory authority, or to your state Attorney General in the United States. We would appreciate the chance to resolve your concern first.
9. Other important information
Children. Our website and services are meant for businesses and adults. We do not knowingly collect data from anyone under 18. If you believe a minor has sent us personal data, contact us and we will delete it.
Automated decisions. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
Accessibility. This policy is published in a format designed to meet the W3C Web Content Accessibility Guidelines (WCAG 2.2, level AA). If you need it in another format, contact us.
Changes to this policy. We review this policy at least once a year and whenever our practices or the law change. The date at the top shows the latest version. We will notify clients directly of any material change, and ask for new consent where the law requires it.
Languages. This policy is available in Portuguese, English and Spanish. For residents of Brazil, the Portuguese version prevails in case of any conflict.
Contact. For any question about this policy or your data: Data Protection Officer (Encarregado) — WhatsApp +1 305 306 2700. Address: Avenida Brig. Faria Lima, 1572, Sala 1022/381, Edifício Barão de Rothschild, Jardim Paulistano, São Paulo, SP, 01451-917, Brazil.