Privacy Policy

Last updated: October 2026. This is an English translation of our Portuguese-language policy prepared under Brazil’s LGPD; the Portuguese version governs in the event of any discrepancy.

This website https://www.brunel-partners.com.br/ (the “Site”) is maintained and supported by Brunel Consultoria de Negócios e Investimentos Ltda. (“Brunel”).

Your privacy matters to us. This privacy policy explains Brunel’s personal data processes — how Brunel processes personal data and for what purposes.

We collect and use some of your personal data through our interactions with you and through our services.

Under Federal Law No. 13,709/2018, Brazil’s General Data Protection Law (“LGPD”), we act as the controller of your personal data.

This privacy policy provides relevant information about:

• What data we collect and how we use it;
• Your rights regarding your personal data; and
• How to contact us.

1. Data we collect and why

Our Site collects and uses some of your personal data, as set out in this section.

Your data is collected transparently and for the following purposes:

• Validating our clients’ registration information and keeping it up to date;
• Enabling us to provide our services in a customized and appropriate way, including registration, enabling transactions, and the ability to execute contracts;
• Responding to requests and contacts, receiving complaints, investigating reports, or responding to requests from our clients and any other parties involved in a transaction;
• Managing our client relationships;
• The legitimate exercise of our rights, including in connection with contracts and judicial, administrative or arbitration proceedings, as well as compliance with our legal and regulatory obligations; and
• Responding to government authorities, including but not limited to the Brazilian Securities and Exchange Commission (“CVM”), in connection with communications and judicial or administrative proceedings, in fulfillment of our legal, regulatory or other applicable duties.

1.1 Sensitive data

We do not collect sensitive data from our users, as defined in Article 5, II of the LGPD. Accordingly, we do not collect data on racial or ethnic origin, religious belief, political opinion, union or religious/philosophical/political organization membership, health or sex life data, or genetic or biometric data linked to a natural person.

1.2 Personal data you provide directly

We collect the following personal data that you provide directly to us:

when completing the contact form available on our Site:

• Full name; and
• Email address.

1.3 Collection of data not expressly listed

Other types of data not expressly listed in this Privacy Policy may occasionally be collected, provided they are given with your consent, or where collection is otherwise permitted on a legal basis.

We may collect information about you that is publicly available or made public by you, as well as information about mentions of or interactions with Brunel — for example, testimonials posted on social profiles and pages, or search results from:

• LinkedIn
• Google

1.4 Sharing personal data with third parties

To fulfill the purposes indicated in item 1.1 above, Brunel may also collect personal data with various third parties, which may include commercial partners (such as family offices), cybersecurity companies, bureaus, fraud-prevention companies, and others.

In any case, you may ask Brunel how it received your personal data.

Brunel does not use your personal data to sell it or share it for profit. However, we do share some of the personal data mentioned in this section with third parties. Your personal data may be shared:

• with competent judicial, administrative or governmental authorities, whenever there is a request, requisition or court order. Your data may also be shared with judicial and administrative authorities and entities whenever necessary for Brunel to present a defense or exercise a right, as well as to comply with legal or regulatory obligations;
• with data processors, which are partner companies that provide services to Brunel; and
• to fulfill the purposes of our activities, including but not limited to sharing data with fund managers.

You may ask Brunel to inform you which third parties it has shared your personal data with.

Whenever personal data is shared, we take every measure available to us to ensure that all information security standards are observed, strictly in line with the purposes described here.

2. How long is your personal data stored?

Following the guidelines established by the Brazilian Securities and Exchange Commission in CVM Resolution No. 50, of August 31, 2021, and in line with the legal purposes and justifications for processing the data, we inform you that the personal data we collect is stored and used for a period of 5 (five) years.

Note that, where there is a legal or regulatory justification, data may continue to be stored even after the purpose for which it was collected or processed has been fulfilled.

3. User rights

You may also make choices about the collection and use of your data, obtaining, at any time and upon request:

• Confirmation of the existence of processing;
• Access to the data;
• Correction of incomplete, inaccurate or outdated data;
• Anonymization, blocking or deletion of unnecessary or excessive data, or data processed in violation of the law;
• Deletion of personal data processed, except as provided by law;
• Information about the public and private entities with which we share data;
• Information about the possibility of not providing consent and the consequences of refusal; and
• Revocation of consent, where data processing was based on the data subject’s consent.

Under the LGPD, deleting your personal data generally only requires your consent, unless the data becomes unnecessary, excessive, or is processed in violation of the law.

3.1 How you can exercise your rights

We will facilitate the exercise of your rights whenever possible and to the fullest extent of the law. We maintain a specific communication channel to manage communications with data subjects and enable the exercise of rights. You may submit any complaint, request or information request related to the processing of your personal data through the channel listed in item 7 below.

To confirm that you are, in fact, the data subject making the request, we may ask for documents or other information to help verify your identity, in order to safeguard our rights and the rights of third parties. This will only be done where strictly necessary, and you will receive all related information.

4. Security measures in the processing of personal data

We employ technical and administrative security measures to protect personal data from unauthorized access and from destruction, loss, misplacement or alteration.

The measures we use take into account the nature of the data, the context and purpose of processing, the risks a breach could pose to your rights and freedoms, and current market standards among similar companies.

Among the security measures we have adopted:

• Storing only password hashes;
• Use of a password vault;
• Encryption;
• Access restricted to individuals who need it and who are duly authorized under applicable law – Multi-Factor Authentication (MFA) is an advanced security technique that requires users to prove their identity through two or more authentication methods before granting access to an account or system;
• All of our staff are subject to confidentiality obligations;
• Access monitoring – we block access to email accounts on the brunel-partners.com.br domain for users attempting to access them from outside Brazil. This measure is essential because, by restricting access exclusively to users located in Brazil, we can mitigate more than 90% of email-intrusion incidents;
• Vulnerability management – to access accounts under the brunel-partners.com.br domain, users’ devices must meet certain security prerequisites, including BitLocker activation, antivirus presence, Windows Firewall activation, and secure boot, among others. This adds an extra layer of protection to our network environment, helping ensure the integrity and confidentiality of corporate information.

We therefore follow high technical information-security standards, so that we can protect our users’ personal and non-personal data.

That said, even though we do everything within our power to prevent security incidents, a problem caused solely by a third party may still occur — for example, hacker attacks, or situations exclusively attributable to the user, such as when you yourself transfer your data to a third party. Accordingly, under Article 43 of the LGPD, while we are responsible for the personal data we process, we are not liable in exceptional situations of this kind that are outside our control.

In any case, should a security incident occur that could create a relevant risk or harm to any of our users, we will notify those affected and Brazil’s National Data Protection Authority (“ANPD”), in accordance with the LGPD.

5. Complaints to a supervisory authority

Without prejudice to any other administrative or judicial remedy, if you feel harmed in any way, you may file a complaint with the ANPD.

6. Updates and changes to this policy

This version of the Privacy Policy was last updated on: October 2026.

We reserve the right to modify this policy at any time, particularly to adapt it to any changes made to our Site, whether through the introduction of new features or the removal or modification of existing ones.

7. How to contact us

To clarify any questions about this Privacy Policy or the personal data we process, please contact us through the channel below:

• Email: adm@brunel-partners.com.br

← Back to the site