Privacy Policy and Data Protection

1. Who we are

We are GDM INDÚSTRIA E COMÉRCIO DE PLÁSTICOS LTDA, registered under CNPJ No. 07.955.100/0001-10, headquartered at Rod. SC 108 Km 331.5 – S/N – Murialdo, Orleans – SC, ZIP Code 88870-000, hereinafter referred to as "GDM."

GDM considers the privacy and protection of personal data of users ("Data Subjects") who access its websites, landing pages, and other digital channels to be of utmost importance.

This Privacy Policy and Data Protection ("Policy") aims to explain, in a simple, transparent, and objective manner, how personal data may be collected, used, stored, shared, and protected in accordance with the General Data Protection Law – LGPD (Law No. 13,709/2018).

2. What is the LGPD?

The General Personal Data Protection Law (LGPD), established by Federal Law No. 13,709/2018, governs the processing of personal data in both physical and digital environments, with the aim of protecting the fundamental rights of freedom, privacy, and the free development of the personality of natural persons.

3. What data we collect, how we collect it and for what purpose

3.1 Data provided directly by the Data Subject

We collect personal data provided voluntarily by the Data Subject through the completion of forms or contact through our digital channels, such as:

• Full name (company or individual);
• CNPJ or CPF (tax ID);
• E-mail;
• Telefone;
• Address and/or ZIP code;
• Resume (when applicable);
• Messages sent through contact forms.

Purpose of processing:

• Contact to respond to requests;
• Present GDM products and services;
• Send institutional, informational, or commercial communications, with consent, when applicable;
• Comply with legal or regulatory obligations.

3.2 Automatically collected data

We also collect data automatically during browsing, such as:

• IP address (with date and time);
• Browser and device information;
• Pages accessed;
• Access origin;
• Site interactions;
• Cookies and similar technologies.

This data is used to:

• Improve user experience;
• Statistical analysis;
• Security;
• Site performance and functionality.

4. Legal bases for data processing

GDM processes personal data based on the following legal bases provided in the LGPD, as applicable:

• Consent of the Data Subject, when required;
• Execution of a contract or preliminary procedures;
• Compliance with legal or regulatory obligations;
• Legitimate interest, respecting the fundamental rights and freedoms of the Data Subject.

5. Third-party integrations and data sharing

GDM may share personal data, when necessary, with partners and suppliers, always in accordance with applicable legislation and security criteria.

We may use integrations with third parties, such as:

• Google Analytics (browsing analysis and statistics);
• Meta / Facebook (when applicable, for campaigns and metrics);
• CRM systems;
• Email marketing platforms;
• Hosting and technology service providers.

These third parties process data according to their own privacy policies and through contracts that ensure the protection of information.

Sharing may also occur in situations such as:

• Compliance with legal obligations or court orders;
• Defense of GDM's rights;
• Corporate operations (merger, acquisition, or incorporation).

6. How long we retain your data

Personal data will be stored:

• For the time necessary to fulfill the purposes for which they were collected;
• As long as there is valid consent;
• Or as long as there is a legal or regulatory obligation.

The Data Subject may request deletion of data at any time, subject to legal retention requirements.

7. Data Subject rights (LGPD)

Under the LGPD, the Data Subject has the right to request, at any time:

• Confirmation of the existence of data processing;
• Access to their personal data;
• Correction of incomplete, inaccurate, or outdated data;
• Request for deletion of personal data, when applicable;
• Revocation of consent, when processing is based on this legal basis;
• Information about data sharing.

8. Channel for exercising Data Subject rights

To exercise their rights, the Data Subject may contact us through the following channel:

E-mail: [email protected]

Requests will be answered within the timeframes provided by the LGPD.

For security purposes, we may request additional information to confirm the identity of the Data Subject.

9. How we protect your data

GDM adopts appropriate technical, administrative, and organizational measures to protect personal data, including:

• Protection against unauthorized access;
• Restricted access to information;
• Commitment to confidentiality by employees and partners;
• Privacy governance program.

Despite all efforts, no digital environment is completely secure. In the event of security incidents that may pose a risk or relevant harm to Data Subjects, GDM undertakes to notify those affected and competent authorities, when applicable.

10. Use of Cookies

We use cookies and similar technologies to improve user experience, analyze performance, and personalize content.

Types of cookies used:

• Essential cookies: necessary for the functioning of the site;
• Statistical cookies: for browsing analysis (e.g., Google Analytics);
• Marketing cookies, when applicable.

The use of non-essential cookies depends on the consent of the Data Subject, which may be granted, refused, or configured through the cookie banner available on the site.

The Data Subject may, at any time, change their preferences or block cookies directly in their browser, aware that some functionalities may be affected.

11. Changes to this Privacy Policy

This Policy may be updated at any time.

Whenever there are relevant changes, GDM will inform users through appropriate means, such as notice on the website, email, or other communication channels.

Continued use of the site does not replace consent, when required by law.