PRIVACY POLICY
1. 1. PRIVACY AND PERSONAL DATA PROTECTION POLICY
1.1. This Policy, inspired by current legislation and by the values practiced by Master Indústria e Comércio Ltda., registered under CNPJ No. 18.627.195/0001-60 (“Master”), referred to as the “Privacy and Personal Data Protection Policy,” sets forth the mandatory privacy and personal data protection rules. Its purpose is to demonstrate Master’s commitment to transparency, information security, and compliance with applicable legal obligations, especially within its commercial relationships and public procurement processes.
2. 2. PURPOSE AND SCOPE
2.1. This Policy applies to all individuals and legal entities that maintain, directly or indirectly, a relationship with Master, including clients, suppliers, business partners, employees, and representatives of public bodies. It covers any operations involving privacy and personal data protection, regardless of the medium used (physical or digital).
3. LEGAL FOUNDATIONS AND COMMITMENT
3.1. Master strictly complies with the provisions of Law No. 13.709/2018 and all related applicable regulations, reaffirming its commitment to privacy protection and the ethical and responsible processing of personal data, in strict observance of the principles of purpose, adequacy, necessity, free access, data quality, security, prevention, and accountability.
3.2. Master adopts technical and administrative security measures to protect personal data from unauthorized access and from accidental or unlawful situations of destruction, loss, alteration, disclosure, or any form of improper or unlawful processing.
4. PRIVACY PROTECTION
4.1. Master recognizes privacy as a fundamental right of individuals and an essential value of its organizational culture. It adopts technical, administrative, and behavioral measures to safeguard the intimacy, privacy, honor, and image of all those with whom it maintains relationships, in compliance with current legislation.
4.2. All internal activities involving the collection, recording, storage, communication, or any form of personal data use are structured to minimize processing and ensure confidentiality, guaranteeing that information is accessed only by authorized individuals and for legitimate purposes.
4.3. Master commits to promoting a work environment governed by digital ethics, confidentiality, and respect for the privacy of employees, clients, and partners, reinforcing the duty of confidentiality even after contractual relationships end.
5. ESSENTIAL DEFINITIONS
5.1. For the purposes of this Policy, the definitions established in Law No. 13.709/2018 apply, including:
(i) database: a structured set of personal data stored in one or several locations, in electronic or physical format;
(ii) data subject: the natural person to whom the processed personal data refers;
(iii) controller: the natural or legal person responsible for decisions regarding the processing of personal data;
(iv) processor: the natural or legal person who processes personal data on behalf of the controller;
(v) data protection officer (DPO): the person appointed to ensure compliance with applicable legislation and serve as a communication channel between the controller, data subjects, and the Brazilian National Data Protection Authority (ANPD);
(vi) National Data Protection Authority (ANPD): the public body responsible for overseeing, implementing, and monitoring compliance with applicable legislation nationwide.
6. GENERAL PRINCIPLES
6.1. Master’s actions will always be guided by good faith and legitimate purpose, respecting data subject rights and the legal bases provided in Articles 7 and 11 of Law No. 13.709/18. All data collection and use will occur only to the extent necessary for contract execution, compliance with legal obligations, the regular exercise of rights, or upon the data subject’s consent.
7. PERSONAL DATA AND AUTHORIZATION FOR ITS USE
7.1. Master may collect personal data only when necessary for the execution of its business and contractual activities, including name, CPF, RG, email, telephone, address, job title, banking information, and registration data. Such data is used exclusively for legitimate purposes such as contractual compliance, participation in public tenders, institutional communication, and adherence to legal and regulatory obligations.
7.2. Master commits to processing personal data only when there is an appropriate legal basis, transparently and proportionally to the intended purpose, under the following circumstances:
(i) with the free, informed, and unambiguous consent of the data subject;
(ii) when necessary for the execution of a contract or preliminary procedures involving the data subject;
(iii) for compliance with a legal or regulatory obligation;
(iv) for the regular exercise of rights in judicial, administrative, or arbitration proceedings;
(v) to meet legitimate interests of the company, provided fundamental rights and freedoms of the data subject are respected.
7.3. Consent will be obtained in writing or by any means that demonstrates the data subject’s intention, always linked to specific, explicit, and legitimate purposes.
7.4. For sensitive data, consent must be highlighted and specific, and its use for purposes other than those informed to the data subject is prohibited.
7.5. Master does not collect personal data on a large scale nor sells such data, limiting its processing strictly to what is necessary for contract execution, participation in tenders, and maintenance of business and institutional relationships.
7.6. Personal data will be deleted after processing ends, respecting technical and operational limits, except when retention is necessary for:
(i) compliance with a legal or regulatory obligation;
(ii) the regular exercise of rights;
(iii) transfer to third parties under legal requirements; or
(iv) exclusive use by Master, provided the data is anonymized and inaccessible to third parties.
7.7. Data subjects may request, at any time, information regarding the processing of their data, including confirmation of processing, access, correction, deletion, portability, or other rights provided under Law No. 13.709/2018.
7.8. Master maintains updated records of its processing activities, especially those based on legitimate interest, and may provide reports to the ANPD upon request, containing descriptions of the types of data collected, methodologies used, security measures applied, and risk mitigation mechanisms adopted.
8. DATA SHARING AND ACCESS
8.1. Master may share personal data with public authorities, partners, and suppliers only when necessary to fulfill the purposes of this Policy or legal obligations, ensuring that all third parties receiving such data are equally committed to data protection and confidentiality standards.
9. INFORMATION SECURITY
9.1. Master adopts technical and administrative measures to protect personal data against unauthorized access or incidents, storing it in a secure environment and restricting access to trained and authorized employees.
10. DATA SUBJECT RIGHTS
10.1. Data subjects may exercise, at any time, their rights under Law No. 13.709/2018, including:
(i) confirmation of processing;
(ii) access to data;
(iii) correction of incomplete, inaccurate, or outdated data;
(iv) anonymization, blocking, or deletion of unnecessary data;
(v) portability;
(vi) deletion of data processed with consent;
(vii) information about data sharing;
(viii) withdrawal of consent.
10.2. Requests must be sent to Master’s Data Protection Officer via the official channel indicated in this Policy.
11. PUBLIC PROCUREMENT AND TENDERS
11.1. Master declares full compliance with Law No. 13.709/2018 and related regulations in public procurement and tenders, ensuring that all personal data processed during such procedures is used exclusively for the specific purpose of the process. Master also commits to immediately reporting any security incidents involving personal data to the competent authorities and to data subjects.
11.2. Master acknowledges that participation in tenders and public contracts involves handling information and documents that may contain personal data of legal representatives, partners, employees, and third parties. In line with its corporate integrity culture and legal requirements, the company adopts specific governance and data protection practices aimed at transparency and information security.
11.3. Personal data provided to Public Administration is processed exclusively for purposes related to the respective procedure, and any other use is prohibited. Master maintains internal controls, processing records, and traceability procedures ensuring appropriate storage, use, and disposal of information in accordance with the best practices of compliance and public-sector integrity.
11.4. All employees involved in activities related to tenders and public contracts undergo periodic training on confidentiality and personal data protection, ensuring balance between transparency and respect for individual privacy. The company also follows the guidelines of Law No. 14.133/2021 (Public Procurement Law) and oversight bodies, cooperating fully with public authorities and audits when required.
11.5. Master reaffirms its institutional commitment to ethics, legality, and information protection, ensuring that required transparency in administrative acts does not result in undue exposure of personal data, applying anonymization techniques and access restrictions when appropriate.
12. DATA PROTECTION OFFICER (DPO) AND CONTACT CHANNEL
12.1. The Data Protection Officer (DPO) is responsible for ensuring compliance with this Policy and acting as the communication channel with data subjects and the ANPD.
12.2. Contact email: julia@produtosmaster.com.br
13. INTERNAL SANCTIONS AND DISCIPLINARY MEASURES
13.1. Failure to comply with this Policy by employees, service providers, or business partners may result in disciplinary measures, including warnings, suspension, contract termination, and other applicable sanctions, without prejudice to applicable civil and criminal liabilities.
14. FINAL PROVISIONS
14.1. This Policy is fully aligned with Law No. 13.709/2018, other privacy and data protection regulations, and Master’s internal policies, reflecting the company’s commitment to ethics, transparency, and legal compliance in its business activities and public contracts.
14.2. Any exceptions, doubts, violations, or omissions shall be submitted to the Data Protection Officer (DPO) and, when necessary, to the Board of Directors for deliberation and appropriate action.
14.3. This Policy may be supplemented by internal rules, technical procedures, and specific notices detailing operational aspects of privacy and data protection, provided they comply with the principles established herein.
14.4. Master reserves the right to review, update, or revoke this Policy at any time without prior notice, whenever legal, regulatory, or technological changes justify adjustments. Any modifications will be published on its institutional website, reflecting the company’s most recent security and data governance practices.
14.5. The reproduction, distribution, or disclosure of this Policy, in whole or in part, without Master’s prior and express authorization, is strictly prohibited.
14.6. This Policy was approved by Master’s Board of Directors and shall remain in force for an indefinite period.
- Phone: +55 (11) 2589-0111
- Social media: @produtosmasterbr
- Email: julia@produtosmaster.com.br