Privacy Policy

1. Scope and data controller

This Policy explains how personal data is processed on CityCorp’s institutional website and through the contact channels related to InduXdata and CityCorp USA. CityCorp is responsible for decisions concerning the processing of data received through these channels, in accordance with Brazil’s General Personal Data Protection Law — LGPD (Law No. 13,709/2018).

For information about this Policy or to exercise your rights, email comercial@citycorp.com.br. Contracted services may be subject to specific privacy and confidentiality provisions in their proposals and agreements.

2. Data we receive

Our forms may request your first and last name, job title, business email, phone number, company, website, location and industrial sector. Depending on the inquiry, we also receive information about your portfolio, customer profile, revenue and employee ranges, international experience, objectives and planned investment capacity.

We also record privacy and optional communications permissions, the version of the notice presented, the submission date and information about the inquiry’s source, such as the landing page, referring page and campaign parameters.

The website infrastructure and protection mechanisms may process technical connection information, browser information and IP addresses for operation, diagnostics and abuse prevention. The forms do not request personal documents, banking information or sensitive personal data; please avoid including them in free-text fields.

3. Purposes and legal bases

We use data to respond to inquiries, understand a company’s context, assess whether an inquiry is a fit, arrange qualification conversations and prepare proposals when appropriate. This processing may rely on the consent presented in the form and on preliminary procedures related to an agreement requested by the data subject.

We may also process data to comply with legal obligations, exercise rights and protect the security and operation of the website. Where applicable, reliance on legitimate interests considers the necessity of the processing, the data subject’s expectations and their rights.

Receiving content and commercial communications requires specific, optional permission. This permission is separate from the response to your inquiry and may be withdrawn at any time.

4. Storage and access

Inquiries submitted through the forms are recorded in WordPress and the Flamingo messaging system, depending on the channel used, and may be forwarded by email to the service team. Access is intended for administrators and authorized commercial staff as needed for their roles.

Your evaluation form answers remain on the page while you move forward, go back or review the steps. They are sent when you submit the request; the website does not save answers in your browser for you to resume later.

5. Service providers and sharing

Data may be processed by providers required for hosting, maintenance, email delivery, storage and spam prevention. Sharing takes into account the purpose of the service and the need for access. Email communications may create records in the mail services used to respond to inquiries.

When configured, Google reCAPTCHA may process technical information to identify automated interactions. Google’s policies, available at policies.google.com/privacy and policies.google.com/terms, also apply.

If a project requires the participation of specialists or other recipients, sharing will be limited to what is necessary and must comply with the stated purpose and applicable legal basis. Submitting a form does not make your personal data publicly available.

6. Cookies, session data and metrics

The website and its services may use cookies and technical resources necessary for the operation and protection of forms. Your browser keeps source and campaign information during the session to associate it with your submitted inquiry; this feature does not store your form answers.

When measurement or marketing tools are enabled, their use must respect the available preferences and the applicable legal basis. The commercial events implemented by the theme do not include form answers, contact details or individual investment amounts.

You can manage cookies and session data in your browser settings. Blocking them may affect navigation, protection features or form submission.

7. Retention and deletion

CityCorp USA evaluation form records have a default retention period of 24 months from submission. This period may be adjusted according to service needs, a contractual relationship or an applicable legal obligation.

Other inquiries and operational records are retained for as long as needed for their purposes. Email records and backups follow the cycles of the respective services and may not be deleted immediately when the main record is removed.

When retention is no longer necessary, data will be deleted or anonymized, except where retention is provided for by law.

8. Security and international transfers

We adopt technical and administrative measures to protect data, including access controls and mechanisms to prevent abuse. No system fully eliminates the risk of incidents; any incidents will be handled in accordance with applicable legislation and responsibilities.

Infrastructure and related service providers may operate in other countries. Any international transfer of data must comply with the conditions and safeguards required by the LGPD and applicable regulations.

9. Rights and communications

Under the LGPD, you may request confirmation of processing, access, correction, information about sharing, anonymization, blocking or deletion where applicable, portability in accordance with regulations, and withdrawal of consent. You may also object to processing in the circumstances provided for by law and submit a petition to Brazil’s National Data Protection Authority.

Send your request to comercial@citycorp.com.br, specifying the right you wish to exercise and the information needed to locate your inquiry. We may request proportionate information to verify your identity and protect third-party data.

Withdrawing permission for optional communications does not prevent us from responding to an ongoing business inquiry. Deletion may be limited by legal obligations, the exercise of rights or another legitimate basis for retention.

10. Updates

This Policy may be updated to reflect changes in services and data processing. The current version and its update date are available on this page. Changes requiring new permission will be handled in accordance with the applicable legal basis.