Privacy Policy

1 – Introduction

Alvean Sugar Intermediação e Agenciamento Ltda., a limited liability company, located at Avenida das Nações Unidas, 14,261, Wing A-1, 12th floor, Part A, Vila Gertrudes, São Paulo/SP, Brazil, 04794-000, registered with CNPJ/ME under No. 20.530.554/0001-08, hereinafter referred to as (“Alvean”), through this Personal Data Privacy Policy (“Privacy Policy” or “Policy”), reaffirms its commitment to the security and protection of Personal Data (as defined below), always in compliance with legislation on information security, privacy, and Personal Data protection, observing, where applicable, the General Data Protection Law, the Brazilian Internet Civil Framework, and other related regulations. This Policy aims to provide transparency to the Personal Data subject regarding how Alvean collects, uses, shares, and protects such information.

The processing of personal data carried out by Alvean is directly related to its business activities of intermediation and brokerage in the sugar-energy sector, involving clients, suppliers, business partners, and national and international service providers.

2 – Applicable Definitions

2.1. For the purposes of this Policy, the following definitions apply:

Personal Data Subject: a natural person to whom the personal data being processed refers.

Personal Data: information related to an identified or identifiable natural person.

Sensitive Personal Data: personal data concerning racial or ethnic origin, religious belief, political opinion, membership in a trade union or organization of a religious, philosophical, or political nature, data related to health or sexual life, genetic or biometric data.

Controller:. a natural or legal person responsible for decisions regarding the processing of personal data.

Processor: a natural or legal person that processes personal data on behalf of the controller.

Data Protection Officer (DPO): person appointed by ALVEAN as the communication channel between the controller, personal data subjects, and the National Data Protection Authority (ANPD).

Consent: a free, informed, and unequivocal expression by the data subject authorizing the processing of their personal data for a specific purpose.

Anonymization: use of reasonable and available technical means at the time of processing, through which data loses the possibility of being associated, directly or indirectly, with an individual.

Blocking: temporary suspension of any processing operation, by storing the personal data or the database.

Erasure: deletion of data or a set of data stored in a database, regardless of the procedure used.

Data Sharing: communication, dissemination, international transfer, interconnection of personal data, or joint processing of databases by public or private entities.

International Data Transfer: sending personal data to a foreign country or to an international organization of which Brazil is a member.

Personal Data Security Incident: Confirmed adverse event related to a personal data security breach that may cause significant risk or harm to data subjects.

Legal basis for processing: the legal foundation that authorizes the processing of personal data (e.g., contract execution, legal obligation, legitimate interest, data subject consent, among others provided for in the LGPD).

Processing of personal data: any operation carried out with personal data, such as collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, deletion, evaluation, information control, modification, communication, transfer, dissemination, or extraction.

Purpose of processing: a legitimate, specific, explicit, and informed objective communicated to the data subject for which personal data is processed.

Rights of the Data Subject: Set of prerogatives guaranteed by the LGPD to the data subject, including, among others, confirmation of the existence of processing, access, correction, anonymization, portability, deletion, information about sharing, objection, and withdrawal of consent.

3 – Principles Applicable to the Processing of Personal Data

3.1. ALVEAN complies with the principles established by the General Data Protection Law (LGPD) in all its activities involving the processing of personal data. These principles guide and direct how the company conducts its operations. In practice, ALVEAN:

Purpose: processes personal data only for legitimate, specific, and informed purposes communicated to the data subject.
Adequacy: ensures that the processing carried out is compatible with the purposes previously informed in a clear and transparent manner.
Necessity: collects and uses only the data strictly necessary to achieve the informed purpose.
Free Access: guarantees that data subjects can easily and freely consult all information the company holds about them.
Data Quality: keeps personal data accurate, clear, relevant, and up to date, as needed and for fulfilling the purpose.
Transparency: provides clear, precise, and accessible information about how personal data is processed.
Security: applies technical and administrative measures to protect personal data against unauthorized access, loss, destruction, or other forms of improper processing.
Prevention: adopts practices aimed at preventing the occurrence of harm resulting from the processing of personal data.
Non-Discrimination: does not process personal data for discriminatory, abusive, or unlawful purposes.
Accountability: demonstrates, whenever necessary, the adoption of effective measures to comply with personal data protection regulations and prove its compliance.

4. Personal Data We Collect

4.1. The personal data we may collect varies according to the nature of the relationship established with ALVEAN. Below are the main groups of data subjects and the data collected in each situation:

Employees: we collect personal data to comply with labor and contractual legal obligations. Examples: full name, CPF (Brazilian individual taxpayer registry), address, phone number, email, bank details, job title, employment history, and other information required by law.

Dependents of employees: we collect personal data only when necessary for voluntary enrollment in benefits offered by the company. Examples: name, date of birth, CPF (Brazilian individual taxpayer registry), and family relationship.

Directors: we collect personal data necessary for the legitimacy of corporate acts and compliance with legal and regulatory requirements. Examples: name, CPF (Brazilian individual taxpayer registry), RG (identity document), contact details, and corporate information.

Visitors: at the reception of our facilities, we collect identification data for security and access control purposes. Examples: name, identification document, represented company, entry and exit time.

Commercial operations: Alvean collects personal data necessary for logistics, transportation, and delivery of goods, as well as for validating sugar purchase and sale contracts, reflecting the nature of its.

Drivers, shippers, and cargo recipients: due to the services provided, data is collected for logistics, security, and fulfillment of contractual obligations. Examples: full name, identification document, driver’s license (CNH), phone number, represented company, and information about cargo delivery or receipt.

Legal representatives of legal entities: personal data necessary for the validation of contracts and business acts are collected. Examples: name, CPF (Brazilian individual taxpayer registry), email, phone number, and, when applicable, bank details for payment confirmation.

Credit applications: in the event of loan requests, we may collect registration data and other information necessary for analysis and approval.

4.2. The personal data processed by ALVEAN includes: registration data (name, CPF, RG, address, email, phone number), professional data (job title, company), financial data (bank details when applicable), digital identification data (IP, cookies, access logs), and other information necessary to fulfill the purposes described herein, always in compliance with applicable legislation.

5- Purpose of Processing

5.1. The personal data collected by ALVEAN is processed to meet the following purposes:

Execution of business and contracts: carrying out commercial operations, fulfilling contractual obligations and providing services provided for in our corporate purpose, including purchase and sale, intermediation and transportation of products, as well as communication with customers and partners in Brazil and abroad.
Registration and updating of records: maintenance of information of employees, directors, legal representatives, partners, suppliers and customers.
Institutional communication and marketing: sending institutional information, about products and services, marketing communications, questionnaires and forms, always within contractual and legal limits.
Internal improvement: improvement of internal processes and the way ALVEAN operates, aiming at greater efficiency in serving customers, suppliers, partners and employees.
Campaign evaluation: analysis of communications performance and personalization of marketing messages, according to user profile and preferences.
Maintenance and technical improvement: correction of failures, solution of technical problems, improvement of the browsing experience on websites and applications, ensuring proper functioning on different devices and browsers.
Financial processing: making payments and receiving services, including validating bank details from suppliers and partners, when applicable.
Legal and regulatory compliance: compliance with legal and regulatory obligations or arising from subpoenas from public or judicial authorities.
Regular exercise of rights: acting in administrative, judicial or arbitration proceedings, including to propose or defend actions.
Information security and fraud prevention: risk mitigation, prevention of abuse and unauthorized access, detection of security incidents and use of technical records (such as IPs, access logs, device type and browser), always in compliance with the law.
Protection of life or physical integrity: adoption of necessary measures to protect data subjects or third parties.
Administrative, financial and accounting management: support for internal management, ensuring compliance with audits and regulatory standards applicable to the sector.

6 – Applicable Legal Bases

6.1. The processing of personal data by ALVEAN is carried out based on legal hypotheses provided for in the LGPD, including, mainly:

Execution of contract or related preliminary procedures;
Compliance with a legal or regulatory obligation;
Regular exercise of rights in judicial, administrative or arbitration proceedings;
Legitimate interest of the controller, respecting the fundamental rights and freedoms of the data subject;
Consent of the holder, when required by law.

7 – Sharing of Personal Data

7.1. ALVEAN may share Personal Data with its subsidiaries and parent companies, as well as with suppliers and partners, whenever necessary to carry out its operations and/or fulfill contractual obligations, such as:

Providers of administrative support services necessary for the operationalization of activities;
Business partners and logistics suppliers that act directly in the transportation, loading, unloading and receipt of cargo;
Providers of technology infrastructure services necessary for the maintenance and operation of activities;
Providers of marketing and advertising services; ev. Payment processing companies.

7.2. Personal Data may also be shared with judicial, police or regulatory authorities, upon formal request or whenever necessary to comply with legal obligations.

7.3. The sharing of data with third parties will strictly observe the applicable privacy and data protection legislation. These third parties will be bound by contractual obligations of confidentiality, information security, and purpose limitation.

7.4. ALVEAN requires suppliers, partners and operators who have access to personal data within the scope of their contractual activities to maintain practices compatible with Brazilian data protection legislation and ANPD guidelines. All will be subject to contractual clauses that guarantee confidentiality, information security, purpose limitation and, where applicable, specific safeguards for international transfers. In international operations, data sharing may include foreign entities involved in the execution of Alvean’s commercial and logistics contracts, always in accordance with applicable law.

Alignment with ISO/IEC 27701: This Privacy Policy has also been structured in line with practices suggested by the international standard ISO/IEC 27701 – Privacy Information Management System (PIMS). In this way, the topics presented address in an integrated manner aspects such as the definition of roles and responsibilities, purposes of processing, information security, risk management, controlled sharing, international transfer with safeguards and rights of the holders, reinforcing ALVEAN’s commitment to recognized standards of privacy governance.

8 – The security of your data

8.1. ALVEAN adopts appropriate technical and administrative measures to protect personal data against unauthorized access, accidental or unlawful situations of destruction, loss, alteration, communication or any form of inappropriate or unlawful processing. In the processing of personal data, ALVEAN implements security measures such as:

access controls by profile and credentials;
encryption of sensitive data;
segregation of environments;
monitoring and recording of access;
backup management; and
incident response plan, including communication to data subjects and the ANPD when required by law.

8.2. In addition, ALVEAN maintains internal information security policies, which are periodically reviewed, conducts training with its employees and strategic suppliers, and adopts risk prevention and mitigation procedures, in order to reduce the probability of incidents and ensure the continuity of essential services.

9 – Rights of the Data Subject

9.1. ALVEAN assures personal data subjects of all the rights provided for in the General Data Protection Law (LGPD), in relation to the information it processes as a result of its activities.

9.2. The data subject may, at any time and upon request to the official ALVEAN channel, exercise the following rights:

Confirmation of the existence of processing: obtain confirmation that ALVEAN processes your personal data.
Access to data: request access to personal data that is under the company’s responsibility.
Correction of incomplete, inaccurate, or outdated data.
Anonymization, blocking or deletion of unnecessary, excessive or processed data in non-compliance with the legislation.
Portability of personal data to another service or product provider, in accordance with ANPD regulations.
Deletion of personal data processed with consent, except in legal cases that authorize or require its conservation.
Information on sharing: obtain information about the public or private entities with which ALVEAN shares personal data.
Revocation of the consent previously granted, upon express and free manifestation, without prejudice to the validity of the treatments carried out until then.
Opposition to the processing carried out based on legal hypotheses other than consent, in case of non-compliance with the LGPD.

9.3. In the context of the business-to-business operations in which ALVEAN operates, all personal data processed is linked to the professional activities of employees, legal representatives, suppliers, drivers, partners and directors of contracting legal entities. In these situations, the rights of the holders will be met in order to preserve the balance between individual rights and the legal and contractual obligations assumed by the company.

9.4. To exercise their rights, the data subject must contact ALVEAN through the privacy channel available at: dpo@ALVEAN.com.br. (Personal Data Officer: Juliana Haddad Pereira Marrone)

10 – Cookies

10.1. Cookies are small data files that are stored on the device you use to access our services.

To make our website easier to use: We store our customers’ navigation and study the best layout of menus and links to promote continuous improvement in the browsing experience.
To provide you with personalized content: We store user preferences, language, device and browser information,
To improve our services: We use cookies to measure the use of our websites and referral data, as well as occasionally display different versions of content to you.
For security reasons: We use cookies to authenticate your identity in more sensitive features and to confirm that you are logged in to a website, application or any of our operating systems.
To obtain metrics about your experience on our websites and apps.

10.2. It is possible to view the cookies we use in the browser settings, being able to delete or block them.

Certain cookies and analysis tools may be used for statistical and continuous improvement purposes. Details of these mechanisms will be the subject of a specific Cookie Regulation, to be made available by ALVEAN.

11 – Minors Data

11.1. ALVEAN does not directly collect personal data from children or adolescents for its own purposes. However, it may process data of employees’ dependents, exclusively when necessary to comply with legal obligations and upon manifestation of the will of the legal guardians.

11.2. Outside of these specific situations, ALVEAN does not knowingly collect personal data from minors under the age of 16.

11.3. If parents or guardians identify that personal data of their children under 16 years of age have been provided to ALVEAN in an unauthorized manner, they may request its deletion by sending an e-mail: dpo@ALVEAN.com.br.

11.4. If ALVEAN becomes aware that it has collected personal data from minors under 16 years of age outside the legal hypotheses provided for, it will adopt reasonable measures to remove them from its records, ensuring safe deletion and notifying legal guardians, when applicable.

12 – International Data Transfer

12.1. In the event that the international transfer of Personal Data is necessary, ALVEAN will ensure that such operation occurs in accordance with the applicable legislation, in particular Law No. 13,709/2018 (LGPD) and ANPD Resolution No. 19/2024, ensuring that the recipient abroad adopts technical and organizational measures compatible with the principles and rights provided for in Brazilian law.

12.2. In these cases, ALVEAN may adopt appropriate safeguards, such as:

Use of the Standard Contractual Clauses approved by the ANPD, attached or incorporated into contracts signed with suppliers located abroad;
Preference for foreign suppliers that demonstrate the adoption of technical and organizational measures compatible with the LGPD, including information security and confidentiality standards;
Preservation of contractual evidence that proves the adoption of the safeguards required by applicable law.

12.3. ALVEAN will seek to relate exclusively to suppliers and operators that maintain practices in line with Brazilian data protection legislation, ensuring adequate and continuous protection of personal data transferred internationally.

13 – Storage of Personal Data

13.1. ALVEAN will store personal data for as long as the purposes of processing last or as long as there is a legal basis that justifies its maintenance. In such cases, the company guarantees that the data will be deleted, discarded or disused in a safe manner. To this end, it will maintain a communication channel accessible to data subjects, enabling them to exercise their rights and request the final destination of their data.

14 – Contact Channel

14.1. For further clarification on the processing of personal data, data subjects may contact ALVEAN’s DPO, through the following channels:

E-mail: dpo@ALVEAN.com.br
Officer/DPO: Juliana Haddad Pereira Marrone

15 – Changes to our Privacy Policy

15.1. We may occasionally make changes to our Privacy Policy.

Relevant changes will be communicated through ALVEAN’s official channels, such as the institutional website (https://alvean.com.br/ ) and, when applicable, communications directed to its customers, partners and suppliers.