Privacy Policy

1. Introduction

This Privacy Policy describes how the Rodada de Negócios platform collects, uses, shares and protects personal data, in accordance with Brazilian Law No. 13,709/2018 (LGPD, the General Data Protection Law) and the Brazilian Civil Rights Framework for the Internet (Marco Civil da Internet).

The data controller is PROJETO DIÁRIO CONSULTORIA E TREINAMENTO LTDA, CNPJ No. 12.118.354/0001-14, headquartered in Diadema/SP, Brazil. Contact of the Data Protection Officer (DPO): [email protected].

2. Data Collected

The following categories of data are processed:

• Registration data: name, email, phone number and password (stored in encrypted form);

• Company data: legal or trade name, industry, description, website, city, state, products and services, and business objectives;

• Participation data: registrations, attendance, meetings held, interests expressed and connections made;

• Contract data: plan purchased, payment history and records of acceptance of legal documents;

• Technical data: IP address, browser and operating system identification, date and time of access and activity logs, also collected for security purposes and as proof of electronic acceptances.

2-A. Data Specific to the Investment Module

For users who join the Investment Module, the following are also processed:

• From the investor: CNPJ of the investing legal entity, legal name and registration status obtained from the Brazilian Federal Revenue Service, data of the legal representative (name, CPF, position, email and phone number), declared investment criteria, professional affiliation, professional reference and the investor profile declaration;
• From the company: CNPJ, legal name, registration status, opening date and main CNAE code obtained from the Brazilian Federal Revenue Service, in addition to the qualitative information and the declared reference ranges;
• From both: records of conversations scheduled, held, cancelled and not attended; expressions of interest; conduct reports filed, identifying who filed the report and its content; and records of acceptance of the specific terms, with date, time, IP address, device identification and the language in which the text was displayed.

The legal basis for processing this data is the performance of a contract and, as regards consultations of public databases and the recording of reports, the legitimate interest in preventing fraud and keeping the environment safe. The formal identification and contact data of one party are only disclosed to the other upon mutual expression of interest.

3. Purposes and Legal Bases

• Performance of a contract: creation and maintenance of the account, participation in events, pairing and provision of the contracted service;

• Compliance with a legal or regulatory obligation: retention of access logs, issuance of tax documents and responses to authorities;

• Legitimate interest: fraud prevention, information security, measurement of indicators and improvement of the service;

• Consent: sending marketing communications and sharing contacts upon mutual interest, revocable at any time.

4. Data Sharing

Data is shared only when necessary, in the following cases:

• Between users: contact data is only disclosed to the other party when there is a mutual expression of interest at the end of a meeting;

• With organizers: the event organizer has access to the registration data of the participants in their own events, for the purpose of managing and communicating about the event;

• With processors: providers of cloud infrastructure, email delivery, video conferencing and payment processing, contractually bound to process the data according to instructions and security standards;

• By legal requirement: upon request by a competent authority.

Personal data is not sold, rented or transferred to third parties for advertising purposes.

5. International Transfer

Some processors may process data outside Brazil. In such cases, the safeguards required by the LGPD are adopted, through appropriate contractual clauses and verification of the level of protection provided by the destination country.

6. Retention and Deletion

Data is kept for as long as necessary to fulfill the purposes above and legal obligations. Access logs are kept for at least 6 (six) months, as required by the Marco Civil da Internet; records of acceptance of legal documents and tax data are kept for the applicable limitation periods, even if the account is closed.

The CNPJ of the company that used the first-round courtesy is kept even after the account is closed, together with the date and the round in which the courtesy was used, to prevent the same CNPJ from receiving the courtesy again. The CNPJ identifies the company, not the person who created the account.

Once the retention period ends, the data is securely deleted or anonymized.

7. Data Subject Rights

The data subject may, at any time, request: confirmation that processing exists; access to the data; correction of incomplete or outdated data; anonymization, blocking or deletion of unnecessary data or data processed in non-compliance; portability; information about sharing; and revocation of consent.

Requests must be sent to the Data Protection Officer, at the address given in Clause 1, and will be answered within the legal deadlines; proof of identity may be required.

8. Automated Decisions and Right to Review

The Platform uses automated processing in two situations, both disclosed to the data subject:

• Pairing in networking rounds: the pairs in each round are formed by an algorithm that considers the declared profile of the companies, the history of meetings in the event and the waiting time, and may use natural language processing to estimate how complementary the businesses are.
• Compatibility in the Investment Module: the match between investors and companies is determined exclusively by the intersection of objective criteria self-declared by both parties (industry, region, stage, size, revenue range and conversation format). There is no grade, ranking, quality score or value judgment about the companies.

Under article 20 of Law No. 13,709/2018, the data subject may request a review of decisions made solely on the basis of automated processing that affect their interests, as well as clear and adequate information about the criteria used. The request must be sent to the Data Protection Officer, at the address given in clause 1, and is answered within the legal deadline.

9. Information Security

Technical and administrative measures are adopted to protect data against unauthorized access and accidental or unlawful situations, including encryption of passwords and traffic, role-based access control, logging of sensitive administrative operations and continuous monitoring.

In the event of a relevant security incident, the national authority and the affected data subjects will be notified as required by law.

10. Cookies

Cookies and equivalent technologies are used that are strictly necessary for authentication, security and the operation of the Platform, as well as cookies intended to measure usage and improve the experience, whose use can be controlled in the browser settings.

11. Data of Minors

The Platform is intended exclusively for people over 18 (eighteen) years of age, and data from children and adolescents is not knowingly collected. If a non-compliant registration is identified, the account will be closed and the data deleted.

12. Changes to this Policy

This Policy may be updated to reflect legal, technical or business changes. The current version will always be available on the Platform, with its number and publication date, and relevant changes will be communicated to users.

13. Jurisdiction

Brazilian law applies, and the courts of the district of Diadema/SP are elected, except that, in consumer relationships, the consumer may bring proceedings in the courts of their place of residence.