Privacy Policy

1. Introduction and Commitment

TRADEXA, headquartered in Florianópolis, Santa Catarina, Brazil ("TRADEXA", "we", "our"), is committed to protecting the privacy and personal data of its Users ("you", "data subject"), in compliance with the Brazilian General Data Protection Law — LGPD (Law No. 13,709/2018), the Brazilian Internet Bill of Rights (Law No. 12,965/2014), the Brazilian Consumer Protection Code (Law No. 8,078/1990), and other applicable laws.

This Privacy Policy describes in a transparent, clear, and detailed manner: (a) which personal data and information we collect; (b) how and for which purposes we use it; (c) with whom we share it; (d) how we store and protect it; (e) how long we keep it; (f) what your rights are as a data subject; and (g) how you can exercise those rights.

By using the TRADEXA Platform (www.tradexa.com.br and subdomains), creating an account, purchasing our services, filling out forms, interacting with our tools, or otherwise providing your personal data, you declare that you are aware of and agree to the terms of this Privacy Policy, expressly authorizing the processing of your personal data as described herein.

If you do not agree with any provision of this Policy, do not use the Platform and do not provide your personal data. This Privacy Policy integrates and supplements the TRADEXA Terms of Use, available at www.tradexa.com.br/en/termos.

2. Definitions and Concepts

For the purposes of this Policy, the definitions set out in Article 5 of Law 13,709/2018 (LGPD) apply, notably:

• Personal Data: Any information relating to an identified or identifiable natural person.
• Sensitive Personal Data: Personal data concerning racial or ethnic origin, religious belief, political opinion, union membership or membership in a religious, philosophical, or political organization, data concerning health or sex life, genetic or biometric data.
• Data Subject: The natural person to whom the personal data undergoing processing refers.
• Controller: The natural or legal person responsible for decisions regarding the processing of personal data. For the purposes of this Policy, the Controller is TRADEXA.
• Processor: The natural or legal person that processes personal data on behalf of the Controller.
• Data Protection Officer (DPO): The person appointed by the Controller to act as a communication channel between the Controller, data subjects, and the Brazilian Data Protection Authority (ANPD).
• Processing: Any operation performed with personal data, such as collection, production, receipt, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, deletion, evaluation, control of information, modification, communication, transfer, dissemination, or extraction.
• Anonymization: The use of reasonable technical means by which data loses the possibility of direct or indirect association with an individual.

3. Data We Collect

TRADEXA collects only the data strictly necessary to provide, operate, maintain, improve, and personalize our services. Collection takes place transparently, with consent or on the legal bases provided by the LGPD.

3.1. Data You Actively Provide

When you interact with the Platform, we may collect:

• Registration Data: Full name or business name, email address, phone number, job title/role (optional), company name (optional), CNPJ (optional), industry (optional), country of origin (optional), language preferences.
• Professional Profile Data: Information about operation type (importer, exporter, both, service provider), shipping modes used (ocean, air, road, courier), regions of operation, products of interest, NCM ranges searched, company size, approximate operation volume.
• Payment Data: To process paid subscriptions, we collect billing data (cardholder name, billing address). Full credit card data (number, CVV, expiration date) is processed directly by payment providers (Mercado Pago, Stripe) and is not stored by TRADEXA.
• Communication Data: Content of messages sent through contact forms, emails to [www.tradexa.com.br/en/contato](https://www.tradexa.com.br/en/contato), interactions with our support team and sales consultants, including conversation history, requests, complaints, and feedback.
• Service Data: Information provided in the context of consulting services, such as product lists, NCMs to be audited, detailed descriptions of goods, export/import volumes, target countries, and trade documentation.
• Resumes and Professional Data: If you apply for openings through the "Work With Us" link, we will collect the data provided in your resume and application form.

3.2. Data Collected Automatically

When you access and use the Platform, we may automatically collect:

• Usage and Browsing Data: Pages visited, time spent on each page, features and tools used, clickstream, queries performed (NCMs, HS codes, countries, products searched), filters applied, reports generated, documents downloaded.
• Technical and Device Data: IP (Internet Protocol) address, browser type and version, operating system, screen resolution, browser language, time zone, device identifiers, device type (desktop, mobile, tablet).
• Approximate Geographic Location Data: Country, state/region, and city inferred from the IP address, for statistical analysis, fraud prevention, and compliance with regional legal requirements. We do not collect precise location (GPS) data.
• Traffic Source Data: Referrer URL, search terms used in search engines to reach the Platform, marketing campaigns that originated the visit, traffic source (organic, paid, direct, social, email).
• Cookies and Similar Technologies: As detailed in Section 6 of this Policy.

3.3. Data We Do NOT Collect

TRADEXA does not intentionally collect: (a) sensitive personal data (racial origin, religious beliefs, political opinions, health data, biometric data, genetic data); (b) data of children and adolescents under 18; (c) full credit card data (number, CVV); (d) browsing data from third-party sites unrelated to the Platform; (e) precise geolocation (GPS) data. If any such data is inadvertently collected, it will be deleted immediately.

4. How We Use Your Data — Purposes and Legal Bases

All personal data processing performed by TRADEXA is grounded in one of the legal bases set out in Article 7 of the LGPD, as detailed below:

4.1. Contract Performance and Preliminary Procedures (Art. 7, V)

• Create, manage, and maintain your Platform account.
• Process subscription payments and manage billing cycles.
• Provide access to the features and limits of the purchased plan.
• Monitor resource usage and enforce per-plan query limits.
• Deliver the contracted trade services (Market Research, Buyer Research, Freight Quotes, Customs Clearance, Fulfillment, Commercial Representation, Tax Audit).
• Issue invoices, bills, and payment receipts.
• Send essential transactional communications (registration confirmation, plan changes, security notifications, expiration alerts).

4.2. Consent (Art. 7, I)

• Sending newsletters, industry briefings, educational materials, and marketing content about foreign trade.
• Sending promotional communications about new services, tools, plans, and special offers.
• Invitations to take part in satisfaction surveys, market research, and testing of new features (beta testing).
• Using usage and browsing data to personalize the Platform experience (tool and content recommendations).
• Processing resumes and application data for recruitment and selection purposes.

4.3. Legitimate Interest (Art. 7, IX)

• Platform Improvement: Analyzing usage patterns, browsing behavior, and interactions to identify improvement opportunities, fix bugs, optimize the user interface, and develop new features.
• Trade Intelligence and Market Analysis: Using aggregated and anonymized data from User queries, searches, and preferences to generate market insights, identify foreign trade trends, develop industry benchmarks, and publish market studies and reports.
• AI Model Training: Using query and classification data to train, validate, and improve our artificial intelligence algorithms, including the AI NCM Classifier, intelligent search systems, and recommendation models.
• Security and Fraud Prevention: Monitoring Platform activity to detect, investigate, and prevent unauthorized access, fraud, abuse of the Terms of Use, automated data scraping, and other unlawful or violating activities.
• Rights Protection: Using data for the regular exercise of rights in judicial, administrative, or arbitration proceedings, including defense against claims and disputes.
• Business Analysis: Producing aggregate statistical analyses on Platform usage, service performance, retention, and growth metrics for strategic and operational decision-making.
• Marketing and Commercial Prospecting: Identifying potential Users and customers based on public market data, performing profile analyses for campaign segmentation and targeting, and measuring the effectiveness of marketing actions.

4.4. Legal and Regulatory Obligation (Art. 7, II)

• Complying with tax, accounting, and fiscal obligations (issuing and keeping invoices, bookkeeping).
• Responding to requests from competent judicial, administrative, law enforcement, and regulatory authorities.
• Complying with determinations of the Brazilian Data Protection Authority (ANPD).
• Keeping access records and logs as required by the Brazilian Internet Bill of Rights (Art. 15 of Law 12,965/2014) and the LGPD.
• Reporting security incidents involving personal data to competent authorities and affected data subjects, as required by Article 48 of the LGPD.

4.5. Commercial Use of Aggregated and Anonymized Data

TRADEXA expressly reserves the right to use, reproduce, adapt, compile, analyze, publish, license, market, and commercially exploit aggregated, anonymized, statistical data and insights derived from usage data and queries performed on the Platform, without any burden or obligation toward Users.

This commercial use of aggregated and anonymized data includes, for example: (a) publishing foreign trade industry reports; (b) developing and marketing market indexes and indicators; (c) providing market intelligence to corporate and institutional clients; (d) creating comparative benchmarks by industry, country, and product; (e) analyzing import and export trends; (f) market feasibility studies. Under no circumstances will an individual User be identified or identifiable to third parties in this context.

5. Sharing Data with Third Parties

TRADEXA does not sell, rent, or trade identifiable personal data of its Users. Data sharing occurs only in the situations and for the purposes described below, always observing LGPD principles:

5.1. Service Providers and Processors

We share data with third-party service providers acting as Processors, exclusively to enable the provision of Platform services:

• Supabase Inc.: Database infrastructure, user authentication, and data storage. Data is hosted on servers located in the United States (AWS us-east-1 region), with standard contractual clauses ensuring an adequate level of protection under Article 33 of the LGPD.
• Vercel Inc.: Hosting and content delivery (CDN) for the Platform. Browsing data (IP, user-agent) may be processed for content delivery and security purposes.
• Mercado Pago / Stripe: Subscription payment processing, with no TRADEXA access to full credit card data.
• Resend: Transactional email and notification service (registration confirmations, plan changes, security communications).
• Analytics Platforms: Platform usage analysis tools, with aggregated and anonymized data to understand browsing behavior and continuously improve.

5.2. Business Partners and Integrated Services

For certain services, we may share data with business partners to enable delivery of the contracted service:

• Customs Brokers: To perform the Customs Clearance service, operation data and trade documents are shared with the responsible broker.
• Carriers and Freight Agents: For Freight Quotes, cargo data (type, volume, origin, destination, NCM) is shared to obtain quotes.
• Logistics Operators and Distribution Centers: For Fulfillment services, product and volume data is shared with partner logistics operators.
• Consultants and Specialists: For market research and tax audit services, data is shared with specialists to prepare analyses and reports.

5.3. Authorities and Legal Obligations

We may share personal data when required by law, court order, request from a competent administrative authority, or to: (a) comply with a legal or regulatory obligation; (b) protect the rights, property, or safety of TRADEXA, its Users, or the general public; (c) detect, prevent, or investigate fraud, security issues, or illegal activities; (d) defend claims in judicial, administrative, or arbitration proceedings.

5.4. Corporate Transactions

In the event of a corporate reorganization, merger, acquisition, incorporation, spin-off, joint venture, asset sale, financing, or similar transaction involving TRADEXA, personal data under our control, including User databases, may be transferred as part of the company's assets, safeguarding data subjects' rights under Brazilian law and notifying Users of the transfer and the identity of the new Controller.

6. Cookies and Tracking Technologies

Cookies are small text files stored in your browser that recognize your device, remember preferences, and analyze browsing patterns. TRADEXA uses cookies for the following purposes:

6.1. Strictly Necessary (Essential) Cookies

These cookies are indispensable for the operation of the Platform and cannot be disabled in our systems. They include session cookies for authenticating logged-in users, maintaining state while browsing, protection against CSRF (Cross-Site Request Forgery) attacks, and load balancing. They do not store personally identifiable information beyond what is strictly necessary for session security and operation.

6.2. Performance and Analytics Cookies

We use analytics cookies to understand how Users interact with the Platform, including most-visited pages, time on site, most-used features, and browsing patterns. This data is collected in aggregate and anonymous form, and helps us measure and improve Platform performance.

6.3. Functionality and Preference Cookies

These cookies remember choices you make on the Platform, such as language preferences, region, display settings, and interface personalization, providing a more personalized experience.

6.4. Third-Party Cookies

We do not use third-party advertising network cookies, behavioral tracking cookies for marketing purposes, or social media cookies for building advertising targeting profiles. We do not integrate tracking pixels from Facebook, Google Ads, LinkedIn, or other advertising platforms that track users across sites.

6.5. Managing Cookies

Most browsers let you manage cookies through privacy settings, including options to: block all cookies, accept only first-party cookies, delete cookies when closing the browser, or browse in incognito/private mode. Note that blocking essential cookies may prevent the Platform from working properly, including the inability to log in and access account features.

7. Storage, Security, and International Transfer

Your personal data is stored on secure Supabase cloud infrastructure, hosted on servers located in the United States (AWS us-east-1 region), with redundancy, automatic backup, and disaster recovery mechanisms. Supabase Inc. holds SOC 2 Type II and ISO 27001 certifications, demonstrating compliance with international information security standards.

We implement technical and organizational security measures to protect your data against unauthorized access, accidental or unlawful destruction, loss, alteration, communication, or any form of improper processing, including: (a) encryption of data in transit (TLS 1.3); (b) encryption of data at rest (AES-256); (c) password hashing with robust algorithms (bcrypt/scrypt); (d) role-based access control (RBAC); (e) two-factor authentication (2FA) for administrative access; (f) continuous security monitoring and intrusion detection; (g) periodic penetration testing and vulnerability scanning; (h) internal security policies and team training; (i) confidentiality agreements with all service providers with data access.

In the event of a security incident that may pose a relevant risk or harm to data subjects, TRADEXA will notify affected subjects and the Brazilian Data Protection Authority (ANPD) within a reasonable timeframe, as defined by the ANPD, including the nature of the data affected, information about the subjects involved, the security measures used to protect the data, the risks related to the incident, and the measures taken to mitigate its effects.

Considering that the internet is not a fully secure environment and that no security system is infallible, TRADEXA cannot guarantee absolute security. Users also play a key role in protecting their data: (a) use a strong, unique password for your TRADEXA account; (b) do not share your credentials with third parties; (c) keep your devices and software up to date; (d) log out of the Platform when using shared devices; (e) immediately notify TRADEXA of any unauthorized access or suspicious use of your account.

8. Data Retention and Deletion

TRADEXA keeps personal data only for the period strictly necessary to fulfill the purposes for which it was collected, observing the LGPD principles of necessity, adequacy, and purpose, and respecting legal retention periods.

Active Account Data: While your account remains active on the Platform, your registration, profile, and usage history data is kept to enable service delivery.

After Cancellation: After account cancellation or termination: (a) registration and profile data is kept for 90 (ninety) days, during which you may request reactivation or export of your data; (b) usage and browsing data (IP logs, access records) is kept for 6 (six) months, as required by the Brazilian Internet Bill of Rights (Art. 15 of Law 12,965/2014); (c) accounting, tax, and payment records are kept for 5 (five) years, as required by the Brazilian Tax Code and tax law; (d) aggregate, anonymized, statistical data already incorporated into TRADEXA's intelligence databases is kept indefinitely.

Application Data (Work With Us): Resumes and application data are kept for 12 (twelve) months after receipt for future selection processes, unless the data subject objects.

Newsletter and Marketing: Data for marketing communications is kept while active consent exists. Every communication offers an immediate unsubscribe link.

Once the applicable periods expire, personal data will be permanently deleted from our primary databases, backups, and systems using secure deletion methods (overwriting, logical and physical deletion), except for legally permitted retention cases.

9. Your Rights as a Data Subject (LGPD)

The LGPD (Law 13,709/2018) grants you, as a personal data subject, the following rights, which may be exercised by request through the channels indicated in Section 11:

1. Confirmation of Processing (Art. 18, I): Right to obtain confirmation of whether TRADEXA processes your personal data.
2. Access to Data (Art. 18, II): Right to access your personal data under our control, upon request.
3. Data Correction (Art. 18, III): Right to request correction of incomplete, inaccurate, or outdated personal data.
4. Anonymization, Blocking, or Deletion (Art. 18, IV): Right to request anonymization, blocking, or deletion of unnecessary, excessive data, or data processed in violation of the LGPD.
5. Portability (Art. 18, V): Right to request portability of your data to another service or product provider, upon express request, respecting trade and industrial secrets.
6. Deletion of Consent-Based Data (Art. 18, VI): Right to request deletion of personal data processed on the basis of consent, except for legally permitted retention cases.
7. Information on Sharing (Art. 18, VII): Right to obtain information about the public and private entities with which TRADEXA has shared data.
8. Information on the Right to Withhold Consent (Art. 18, VIII): Right to be informed about the possibility of withholding consent and the consequences of refusal.
9. Withdrawal of Consent (Art. 18, IX): Right to withdraw consent at any time by express request, with prior consent-based processing remaining valid until a deletion request is made.
10. Objection (Art. 18, § 2): Right to object to processing performed on a legal basis other than consent, in case of LGPD violation.
11. Review of Automated Decisions (Art. 20): Right to request review of decisions made solely on the basis of automated processing of personal data affecting your interests, including decisions defining personal, professional, consumer, and credit profiles.
12. Petition the ANPD (Art. 18, § 1): Right to petition the Brazilian Data Protection Authority regarding your data against the controller.

Response Time: TRADEXA undertakes to respond to data subject requests within 15 (fifteen) calendar days of receipt, extendable in justified cases as provided by the LGPD. Complex requests or those requiring additional verification may take longer, always communicated to the data subject.

Free of Charge: Exercising data subject rights is free. TRADEXA may only charge reasonable administrative costs in the cases provided in Article 18, § 2 of the LGPD (manifestly unfounded or excessive requests), with prior justification to the data subject.

Identity Verification: For your security, before fulfilling requests involving personal data, we may ask for additional information to confirm your identity and prevent fraud. We will refuse requests when the requester's identity cannot be verified or when fulfillment could violate third-party rights.

10. General Provisions

10.1. Changes to this Policy. TRADEXA reserves the right to update this Privacy Policy periodically to reflect changes in services, legislation, market practices, or data processing structure. Material changes will be communicated by email at least 15 (fifteen) days in advance and published prominently on the Platform.

10.2. Consent to Changes. If a change to this Policy implies a new processing purpose not originally contemplated or a legal basis other than consent, TRADEXA will request new specific consent from affected data subjects before implementing the change.

10.3. Minors. The TRADEXA Platform is not directed at anyone under 18 (eighteen) years old. We do not intentionally collect personal data from children or adolescents. If we learn that we have inadvertently collected data from minors without parental consent, we will take steps to delete that information as quickly as possible.

10.4. Integration with the Terms of Use. This Privacy Policy integrates the TRADEXA Terms of Use, forming a single contractual instrument with them. Violation of any provision of this Policy constitutes a violation of the Terms of Use, subjecting the offender to the sanctions provided therein.

10.5. Governing Law and Venue. This Privacy Policy is governed by the laws of the Federative Republic of Brazil. The courts of Florianópolis, State of Santa Catarina, are elected to settle any disputes arising from this policy, with express waiver of any other venue, however privileged.

10.6. Language. This Policy was drafted in Portuguese. In case of any conflict between that version and any translations, the Portuguese version shall prevail.

11. Contact, Data Protection Officer (DPO), and ANPD

To exercise your rights as a personal data subject, ask questions about this Privacy Policy, report security incidents, or file complaints about the processing of your data, use the channels below:

The Data Protection Officer (DPO) is the channel designated by TRADEXA to act as the point of contact between the Controller, data subjects, and the Brazilian Data Protection Authority (ANPD). Their duties include: (a) accepting complaints and communications from data subjects; (b) providing clarifications and taking action; (c) receiving communications from the ANPD and taking action; (d) guiding TRADEXA employees and contractors on data protection practices; (e) performing other duties assigned by the Controller or established in supplementary rules.

Brazilian Data Protection Authority (ANPD):

If you believe your data subject rights have not been adequately addressed by TRADEXA, you may file a complaint directly with the ANPD through the official website www.gov.br/anpd.