Privacy Policy for supria.com

1. Scope

This Policy applies to supria.com, its forms, contact channels and digital interactions directly connected to the website.

2. Responsible entity and Data Protection Officer

For markets outside Brazil, the processing described in this Policy is carried out under the responsibility of the entity below, subject to the purpose and applicable law.

3. Personal data we may process

We process only data connected to features and purposes actually used on the website. This may include:

• Data you provide: information submitted through forms, requests and communications, according to the fields presented at the time of the interaction.
• Relationship data: information needed to record, route, respond to and follow up on a commercial, institutional or support request initiated through the website.
• Technical data: information generated by infrastructure and security mechanisms needed to deliver, protect and troubleshoot the website.
• Cookies and similar technologies: as described in the Cookie Policy and in the preferences available on the website.

4. How we use personal data

Personal data may be processed, as applicable, to:

• receive, record, route and respond to requests;
• continue commercial or institutional interactions initiated by you or your organization;
• operate, maintain, protect and troubleshoot the website and digital channels;
• manage communication preferences and unsubscribe requests;
• comply with applicable legal obligations and valid government requests;
• prevent fraud, abuse, security incidents and misuse of digital channels.

If new features require additional purposes, we will assess the applicable requirements and update this Policy when needed.

5. Legal requirements

We process personal data in accordance with the laws that apply to the relevant activity and individual. Depending on the circumstances, processing may be necessary to respond to a request, operate or secure our services, comply with law, protect legal rights, or support legitimate business purposes. Where consent is legally required, we will rely on consent for the relevant activity.

6. Service providers and disclosures

We may use service providers needed to operate the website, host infrastructure, receive forms, maintain relationship systems, protect services and support communications.

When a provider has relevant access to systems or data, we apply security and data-protection requirements proportionate to the service and, where appropriate, contractual obligations addressing confidentiality, security and use limited to the contracted purpose.

Access or disclosure is limited to what is necessary for the corresponding purpose, compliance with law, or protection of rights. This Policy does not describe data sales, behavioral advertising or profiling practices that have not been confirmed in the actual operation of the website.

7. International processing

Technology providers may process personal data in more than one country. Where cross-border processing is subject to specific legal requirements, we will use the mechanisms required by applicable law.

8. Retention

We retain personal data for the period needed to fulfill the purpose for which it was processed, comply with legal requirements, maintain necessary security records, and establish or defend legal rights.

The applicable period varies by record type, purpose, system and legal obligation.

9. Security

We use administrative and technical measures appropriate to the risks and nature of the data processed. These controls include, as applicable, access management, infrastructure protection, monitoring and incident-response processes.

Where an incident involving personal data creates a legal notification obligation, Supria will follow the analysis, containment and notification procedures required by applicable law.

10. Your privacy rights

Depending on applicable law, you may have rights to request access, correction, deletion or other actions regarding your personal data. We will honor rights that apply to the specific request and jurisdiction.

Send privacy requests to dpo@supria.com. We may request reasonable information to verify your identity and protect personal data from unauthorized access.

11. Cookies

Our use of cookies and similar technologies on supria.com is described in the Cookie Policy.

12. Updates and contact

We may update this Policy to reflect legal, operational or technical changes. Material updates will be identified by a new revision date and, where appropriate, additional notice.