Privacy Policy

This Privacy Policy applies to the website and digital communications operated by H G DE OLIVEIRA EMPREENDIMENTOS, trading under the brand name Hgo Tech Solucoes e Transportes, a Brazilian legal entity registered under CNPJ 68.426.622/0001-10, with registered offices at Avenida Menelick de Carvalho, 54, Flavio Marques Lisboa, Belo Horizonte — MG, Brazil (hereinafter referred to as "we", "us", "our" or "the Company").

We are committed to protecting the personal data of every visitor and business partner who interacts with our website. This policy describes our practices in accordance with Brazil's Lei Geral de Proteção de Dados (LGPD) — Federal Law No. 13,709/2018 — and, where applicable to users located in the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR) and its successor legislation.

By accessing or using our website, you acknowledge that you have read and understood this policy. If you do not agree with how we handle personal data, please refrain from using our website and contact us directly for any enquiries.

This policy does not govern the internal handling of employee or contractor data, which is subject to separate internal protocols. It applies exclusively to data collected through our public-facing website and related digital communications.

We collect personal data only to the extent necessary to operate our website, respond to legitimate business enquiries, and improve the quality of our services. We do not sell, rent, or trade personal data under any circumstances. The categories of data we may collect are outlined below.

Information You Provide Directly

When you contact us by email or telephone — details of which are displayed as static text on this website — you may provide us with personal data such as your name, job title, company name, email address, telephone number, and the content of your message or enquiry. We collect only what you choose to share with us, and we use it solely to respond to and manage that communication.

Technical & Usage Data Collected Automatically

When you visit our website, our hosting infrastructure and analytics tools automatically record certain technical information, including:

• Your IP address (which may be truncated or anonymised where required by law)
• The type, version, and language of your browser
• Your device type and operating system
• The pages you view on our site, the order in which you view them, and the time you spend on each page
• The URL of the page that referred you to our site (referrer URL)
• The date and time of each request your device makes to our server
• Search terms entered if you use any on-site search functionality

This technical data is used in aggregate or pseudonymous form to understand website performance and visitor behaviour. It does not, on its own, identify you as a specific individual, though when combined with other data it may constitute personal data under applicable law.

Cookie & Analytics Data

We use first-party and third-party cookies as well as similar tracking technologies (pixels, local storage) to collect data about how visitors interact with our website. The specifics of these tools, the data they collect, and how to control them are described in Section 04 of this policy.

Data We Do Not Collect

We do not collect payment card data, government-issued identification numbers, or sensitive personal data as defined under the LGPD and GDPR (such as racial or ethnic origin, health data, biometric data, or political opinions) through this website. We have no login portal, member area, or application feature that would prompt submission of such information.

We process personal data only where there is a valid legal basis for doing so. Under the LGPD, those bases include the performance of a contract or pre-contractual steps, compliance with a legal obligation, the protection of legitimate interests, and the data subject's freely given consent. Under the GDPR, equivalent bases apply. We rely on the following:

• To respond to enquiries (legitimate interest / pre-contractual): When you contact us by email or phone, we use the information you provide to reply to your enquiry, assess whether we can help, and maintain a record of the communication for service continuity and quality assurance.
• To operate and improve our website (legitimate interest): Aggregated technical and usage data helps us diagnose technical issues, optimise page performance, identify which content is most valuable to visitors, and make informed decisions about our digital presence.
• To measure advertising effectiveness (legitimate interest / consent): Where advertising tags or analytics pixels are deployed — including those from Google — we use aggregated data to assess how visitors arrive at our site and which channels generate the most relevant traffic. We do not use this data to build individual behavioural profiles for targeting.
• To comply with legal obligations: We may retain and disclose certain data where required by Brazilian law, a court order, or the direction of a competent regulatory authority.

We do not use personal data for automated decision-making that produces legal or similarly significant effects on individuals. We do not engage in profiling for the purpose of targeted advertising directed at identifiable natural persons.

Cookies are small text files placed on your device by websites you visit. They are widely used to make websites work efficiently, to remember user preferences, and to provide information to website operators about how their sites are used.

Strictly Necessary Cookies

These cookies are essential for the website to function. They enable basic features such as page navigation and access to secure areas. The website cannot operate properly without them. They do not collect any information about you that could be used for marketing or to track your activity across other websites. No consent is required for strictly necessary cookies under applicable law.

Analytics & Performance Cookies

We use Google Analytics (provided by Google LLC, or Google Ireland Limited for EEA users) to collect aggregated data about how visitors use our website. Google Analytics sets cookies that record which pages you visit, how long you stay, and how you arrived at our site. We have configured Google Analytics with IP anonymisation enabled, which means your IP address is truncated before it is stored. The data collected is used solely by us to improve website content and navigation. Google may transfer this data to servers in the United States, subject to Standard Contractual Clauses or equivalent safeguards.

Advertising & Conversion Cookies

Where we run advertising campaigns through Google Ads, Google may set cookies or use pixels to record that a visitor clicked on one of our advertisements and subsequently visited our website. This data is used in aggregate form to measure campaign performance — for example, how many users visited our site after seeing an advertisement. We do not use this information to target you with personalised advertising. Google's data processing in connection with advertising is governed by Google's own Privacy Policy at policies.google.com/privacy.

Your Cookie Choices

You may refuse or withdraw consent for non-essential cookies at any time. Most modern browsers allow you to control cookies through their settings menus — you can block all third-party cookies, delete existing cookies, or set your browser to alert you before a cookie is placed. Blocking certain cookies may affect the functionality of our website or reduce the accuracy of analytics reporting. You may also opt out of Google Analytics measurement by installing the Google Analytics Opt-out Browser Add-on, available at tools.google.com/dlpage/gaoptout. For opt-out from Google's interest-based advertising more broadly, visit adssettings.google.com.

We do not sell, lease, rent, or otherwise transfer your personal data to third parties for their own commercial purposes. Data may be shared in a limited number of specific circumstances, described below, and always subject to appropriate contractual and technical safeguards.

• Service providers acting as data processors: We engage carefully selected third-party companies to host our website infrastructure, process communications, and provide analytics services. These parties act on our instructions and are contractually prohibited from using your data for any purpose other than providing the service to us. Examples include our web hosting provider and Google LLC in its capacity as analytics processor.
• Legal and regulatory compliance: We may disclose personal data if required to do so by Brazilian law, by order of a competent court, or by a government or regulatory authority. We will endeavour to notify affected individuals where legally permissible to do so.
• Protection of rights and safety: In exceptional circumstances, we may share data where we believe it is necessary to prevent fraud, protect the safety of any person, or defend the legal rights and interests of the Company.
• Business transfers: If the Company undergoes a merger, acquisition, restructuring, or sale of all or part of its assets, personal data held by us may be transferred to the acquiring entity. We will take reasonable steps to notify affected individuals and ensure that comparable privacy protections remain in place.

Where personal data is transferred outside of Brazil to countries that may not offer an equivalent level of data protection, we ensure that such transfers are covered by appropriate safeguards — such as Standard Contractual Clauses approved by the competent authority — in accordance with Article 33 of the LGPD and, where applicable, Chapter V of the GDPR.

We retain personal data only for as long as is necessary to fulfil the purpose for which it was collected, unless a longer retention period is required or permitted by law. Our standard retention periods are as follows:

• Email and telephone enquiry records: Correspondence and any personal data contained within business enquiries are retained for up to 5 years from the date of the last interaction. This period reflects Brazilian civil limitation periods and allows us to maintain adequate records of business dealings.
• Website analytics data: Aggregated and pseudonymised analytics data is retained for up to 26 months within Google Analytics, in line with Google's standard data retention settings and our configuration.
• Server log files: Technical access logs generated by our hosting infrastructure are retained for up to 12 months for security monitoring and diagnostics, after which they are securely deleted or anonymised.
• Legal and compliance records: Where we are required by law to retain records for a defined period — for instance, under Brazilian tax law or corporate governance obligations — we will retain relevant data for the period prescribed by the applicable legislation, even if this exceeds the periods stated above.

Once the applicable retention period expires, personal data is permanently deleted from our active systems or anonymised so that it can no longer be associated with an identifiable individual. Anonymised data may be retained indefinitely for statistical and research purposes.

We take the security of personal data seriously and implement technical and organisational measures appropriate to the nature of the data we hold and the risks associated with its processing. These measures include:

• Encryption in transit: Our website is served exclusively over HTTPS using current TLS protocols. Any data transmitted between your browser and our servers — including contact information sent by email — is encrypted in transit.
• Access controls: Access to systems that store or process personal data is restricted to authorised personnel on a need-to-know basis. Staff with access to personal data are subject to confidentiality obligations.
• Hosting security: We use reputable hosting providers that operate secure data centres with physical access controls, redundancy, and regular security auditing. Our infrastructure is maintained to current security standards.
• Software updates: We maintain our website software and dependencies with timely security patches to reduce vulnerability to known threats.

Despite these measures, no method of data transmission or storage is completely secure. While we strive to protect personal data using commercially reasonable means, we cannot guarantee absolute security against all threats. In the event of a data breach that poses a risk to individuals' rights and freedoms, we will notify the competent Brazilian data protection authority (ANPD) and, where required, affected individuals, within the timeframes prescribed by the LGPD.

Under the LGPD and, where applicable, the GDPR, you have a number of specific rights in relation to personal data that we hold about you. We are committed to honouring these rights promptly and without unnecessary burden to you.

To exercise any of these rights, please contact us using the details provided in Section 11 of this policy. We will respond to all verifiable requests within 15 days in accordance with LGPD requirements, and within 30 days for GDPR requests (extendable by a further two months where the request is complex). We may need to verify your identity before processing a request to ensure we do not disclose personal data to an unauthorised party. We will not charge a fee for reasonable requests.

Our website is a corporate information resource intended exclusively for business professionals and adult members of the public. We do not knowingly collect, solicit, or process personal data relating to children under the age of 18. Our services are not directed at, marketed to, or designed for use by minors.

If we become aware that personal data has been submitted to us by or on behalf of a child under the age of 18 without verifiable parental or guardian consent, we will take prompt steps to delete such data from our records. If you are a parent or guardian and believe that your child has provided us with personal information, please contact us immediately at the address set out in Section 11.

Where the processing of children's data is at issue under the LGPD, we recognise that such processing must be carried out in the best interest of the child, with specific consent from a parent or legal guardian, and that the standard for compliance is elevated. No functionality of this website is designed to capture data from children.

We review this Privacy Policy periodically and will update it whenever our data processing practices change in a material way, or when required by changes in applicable law — including legislative updates to the LGPD, GDPR implementing regulations, or decisions by the ANPD or equivalent supervisory authorities.

When we make significant changes to this policy, we will update the "Last Updated" date displayed at the top of this page and in the sidebar of this document. For changes that are particularly material — for instance, changes in the categories of personal data we collect, or changes in the legal bases on which we rely — we will take additional steps to communicate the update, such as publishing a notice on our website homepage.

We encourage you to review this page periodically to stay informed of how we are protecting your information. Your continued use of our website following the publication of any updated version of this policy constitutes your acknowledgement that you have reviewed it. If any version of this policy is unacceptable to you, you should discontinue use of our website and direct any questions to us by email.

Previous versions of this policy are available on request from our data protection contact, identified in Section 11 below.

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact us directly using the details below. We aim to acknowledge all data-related enquiries within 48 business hours and to resolve them fully within the statutory timeframes described in Section 08.

Under Article 41 of the LGPD, controllers are encouraged to appoint a Data Protection Officer (DPO) — also referred to in the LGPD as "Encarregado". All privacy-related correspondence should be addressed to our privacy contact at the details shown below.

When submitting a privacy request by email, please include your full name and a clear description of your request so that we can address it efficiently. Where we need to verify your identity, we will explain what information is required at the time of your request. We will never ask you for sensitive personal data — such as financial details or government identification numbers — by email to verify identity.

If you are not satisfied with our response to a privacy complaint, you have the right to escalate the matter to the Autoridade Nacional de Proteção de Dados (ANPD), Brazil's national data protection authority, reachable at gov.br/anpd. Residents of the European Union or United Kingdom may also contact the supervisory authority in their country of habitual residence.