Privacy Policy

BASE RURAL SOLUCOES AGRICOLAS LTDA (hereinafter "Base Rural", "we", "our", or "us"), registered under CNPJ 67.887.178/0001-77 and headquartered at Avenida Tancredo Neves, 002539, Edifício CEO Salvador Shopping — Torre Londres, Caminho das Árvores, Salvador, Bahia, Brazil, operates the website and digital channels through which it offers agricultural consulting, rural property management, and agribusiness intelligence services.

We are fully committed to protecting the privacy and security of any personal data you share with us. This Privacy Policy describes the categories of information we collect when you visit our website, communicate with us, or engage with our services; the lawful bases on which we process that information; how we use and protect it; and the rights you may exercise with respect to your personal data under applicable law — including the European Union General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), Brazil's Lei Geral de Proteção de Dados Pessoais (LGPD, Lei nº 13.709/2018), and any other applicable privacy legislation.

By accessing and using our website or otherwise providing us with your personal data, you acknowledge that you have read and understood this Policy. If you do not agree with any part of it, please do not use our website or submit your personal data through our channels.

This Policy applies to all visitors, prospective clients, existing clients, and third parties who interact with Base Rural through our website, email correspondence, telephone, or in-person meetings. It does not govern the data practices of third-party websites that may be linked from our pages — we encourage you to read their respective privacy policies independently.

We collect personal data through several channels and only to the extent necessary for the specific purpose being served. Below are the main categories of data we may hold about you.

Data submitted via contact channels. When you reach us by email at [email protected] or by telephone, we record the information you voluntarily provide — your name, contact details, and the nature of your inquiry. This is the primary means by which we receive personal data directly from you, and we process only what is strictly necessary to respond to and fulfil your request.

Data collected automatically. Like virtually all modern websites, ours automatically receives certain technical data each time a browser loads a page. This includes your IP address, the browser and device you are using, and basic behavioural signals such as which pages were visited and in what order. This data is collected passively and is used solely for website security, performance optimisation, and aggregate analytics.

No sensitive personal data. We do not intentionally collect or solicit sensitive categories of personal data — such as health information, political opinions, religious beliefs, racial or ethnic origin, genetic or biometric data, or financial account details — through our website. If you inadvertently include such data in a message to us, we will handle it with additional care and delete it as soon as it is no longer necessary for the purpose for which it was sent.

We process personal data only for defined, explicit, and legitimate purposes. Every processing activity has a lawful basis under GDPR Article 6 and under the equivalent grounds established by the LGPD (Article 7). The table below maps our principal uses to their corresponding legal bases.

Legitimate interest balancing. Where we rely on legitimate interests as our lawful basis, we have assessed that our interests are not overridden by your rights and interests. In particular, we use aggregate, anonymised or pseudonymised analytics data to improve the website experience for all visitors, and we maintain server security logs to protect both Base Rural and our site's users from threats. You may object to processing on legitimate interest grounds — see Section 8 for how to do so.

We do not sell your data. We do not sell, rent, trade, or otherwise transfer your personal data to third parties for their own commercial or marketing purposes. Any sharing of data with third parties occurs strictly within the scope described in Section 5.

Cookies are small text files placed on your device by a website you visit. They are widely used to make websites function correctly, to remember your preferences, and to provide website operators with information about how visitors use their site. Base Rural uses cookies in a controlled and transparent manner, as described below.

Base Rural does not sell your personal data, and we share it with third parties only to the extent required to operate our business, comply with our legal obligations, or provide the services you have requested. Any third party that receives personal data from us is bound by contractual obligations at least as protective as those described in this Policy.

Service providers and data processors. We engage specialist companies to help us operate our website and internal systems. These include:

• Google LLC — for website analytics (Google Analytics 4), advertising (Google Ads), email infrastructure (Google Workspace), and cloud services. Google operates under the EU Standard Contractual Clauses and is certified under applicable adequacy frameworks for international data transfers. See Google's Privacy Policy.
• Web hosting provider — our website is hosted on a commercial cloud platform with servers operating within Brazil and/or the European Economic Area. The provider processes access logs and caches on our behalf under a data processing agreement.
• Email service provider — outbound and inbound business email may be routed through third-party mail infrastructure. Message content necessary to respond to your inquiry may be stored within these systems subject to the provider's security standards.

Professional advisers. We may share personal data with lawyers, accountants, auditors, or insurers on a need-to-know basis where required for compliance, dispute resolution, or professional advice. These parties are subject to obligations of professional confidentiality.

Legal and regulatory requirements. We may disclose personal data to competent public authorities, courts, or law enforcement bodies when required to do so by applicable law, court order, or governmental regulation — including, without limitation, the Brazilian Receita Federal, the Autoridade Nacional de Proteção de Dados (ANPD), or equivalent EU/EEA supervisory authorities. In such cases we will, where legally permissible, notify you of the disclosure.

Business transfers. If Base Rural undergoes a merger, acquisition, restructuring, or asset sale, personal data held by us may form part of the transferred assets. In that event, the successor entity would be bound by this Policy or an equivalent replacement policy, and we would notify affected individuals as required by law.

International transfers. Some of our third-party service providers, particularly Google, operate globally and may process personal data outside Brazil or outside the European Economic Area. Where such transfers occur, we ensure that appropriate safeguards are in place — such as the European Commission's Standard Contractual Clauses or an adequacy decision — to provide a level of protection equivalent to that offered by Brazilian and EU law.

We retain personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by applicable law and regulatory obligations. When personal data is no longer needed, it is securely deleted, anonymised, or — where deletion is not immediately possible, such as when data is held in backup archives — isolated from further active processing until deletion is feasible.

The following retention periods reflect our standard practices:

• Inquiry and contact records — retained for up to 3 years from the date of last contact, to allow us to respond to follow-up questions, maintain a record of the relationship, and comply with any pre-contractual obligations. If the inquiry results in a formal service engagement, the record is merged into the client file and retained for the duration of the contract plus 5 years for legal and tax compliance purposes.
• Client service records — retained for a minimum of 5 years after the conclusion of the service engagement, consistent with Brazilian civil and tax law requirements (including the Civil Code and Lei das Sociedades por Ações).
• Website analytics data — Google Analytics retains raw event data for 14 months by default; aggregate and anonymised reports may be retained indefinitely for trend analysis. Cookie identifiers stored locally on your device expire according to the individual cookie duration (typically 13 months for GA4 identifiers).
• Server and security logs — access logs are retained for up to 12 months and are used solely for security investigation and to comply with requirements under Brazil's Marco Civil da Internet (Lei nº 12.965/2014), which mandates retention of connection logs for a minimum of 1 year.
• Cookie consent records — retained for up to 3 years to demonstrate compliance with consent obligations under applicable law.

At the end of any applicable retention period, data is destroyed using industry-standard methods appropriate to the medium on which it is stored — for example, secure overwrite for digital files and cross-cut shredding for any physical documents.

We take the security of your personal data seriously. Base Rural has implemented a range of technical and organisational measures designed to protect personal data from unauthorised access, accidental loss, disclosure, destruction, or alteration. These measures include, but are not limited to:

• Transport Layer Security (TLS/HTTPS): All data in transit between your browser and our web server is encrypted using current TLS standards. Our website operates exclusively over HTTPS, enforced by HTTP Strict Transport Security (HSTS).
• Access controls: Access to systems holding personal data is restricted to authorised Base Rural personnel on a strict need-to-know basis, protected by strong password policies and, where available, multi-factor authentication.
• Vendor security standards: All third-party processors we engage must maintain security standards commensurate with their role. We review the security documentation of key vendors — including Google Workspace and our hosting provider — on a periodic basis.
• Regular reviews: We periodically review our information security practices to identify vulnerabilities and areas for improvement, consistent with our obligations under LGPD Article 46 and GDPR Article 32.
• Incident response: We maintain a documented data breach response procedure. In the event of a personal data breach, we will notify the relevant supervisory authority (ANPD and/or the applicable EU/EEA Data Protection Authority) within 72 hours where required, and will inform affected individuals without undue delay if the breach is likely to result in high risk to their rights and freedoms.

Despite these measures, no data transmission over the internet or method of electronic storage is 100% secure. While we strive to use commercially reasonable means to protect your personal data, we cannot guarantee absolute security. We encourage you to use strong, unique passwords for any accounts and to keep your devices and software up to date.

Depending on your location and the applicable law, you hold a number of rights with respect to personal data that Base Rural processes about you. We are committed to facilitating the exercise of these rights promptly and without undue complication.

Our website and services are directed exclusively to adults operating in professional, commercial, or agribusiness contexts. We do not knowingly market to, or intentionally collect personal data from, individuals under the age of 18.

If you are a parent or guardian and believe that a minor has provided us with personal data without your consent, please contact us immediately at [email protected]. We will promptly investigate and, if confirmed, delete the data in question from our systems without undue delay. We will also cooperate fully with any request from a responsible adult or legal authority concerning the protection of a child's personal data.

Under LGPD, the processing of children's personal data must be carried out in the best interests of the child and requires the consent of a parent or legal guardian. We treat this obligation with the utmost seriousness and have no operational reason to process such data in the course of our normal business activities.

We may update this Privacy Policy from time to time to reflect changes in our practices, in applicable law, or in the technical environment in which we operate. When we make material changes — that is, changes that significantly affect how we collect, use, or share your personal data — we will take reasonable steps to notify affected individuals. This may include updating the "Last updated" date at the top of this page and, where appropriate, publishing a notice on our website or contacting you directly.

We encourage you to review this page periodically so that you remain informed of the current version of our Privacy Policy. The version displaying the most recent "Last updated" date is the currently operative version. Your continued use of our website after a change becomes effective constitutes your acknowledgment of the updated Policy.

If you have concerns about any changes we make, please contact us using the details in Section 11 below. Where a change requires renewed consent under applicable law, we will obtain it before applying that change to your data.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please do not hesitate to get in touch. We are committed to resolving privacy-related matters promptly and fairly.

You may also contact us if you wish to exercise any of your rights described in Section 8, to update or correct personal data we hold about you, or simply to understand more about how we protect your information. Our Data Protection Officer oversees our compliance with LGPD and GDPR and is the designated point of contact for all data privacy matters.

We will acknowledge all privacy-related correspondence within 5 business days. For formal data subject rights requests, please refer to the process described in Section 8. If you are not satisfied with our response, you retain the right to escalate your complaint directly to the Autoridade Nacional de Proteção de Dados (ANPD) in Brazil or to the competent Data Protection Authority in your country of residence.