Privacy Policy

1. Who controls your data

The controller of the personal data processed on this website is Planton Soluções Sustentáveis Ltda., a Brazilian Certified B Corporation headquartered in Porto Alegre, RS, Brazil. For any matter related to personal data, including exercising your rights, contact us at [email protected].

2. What data we collect

Data you provide directly: • First and last name • Business email • Phone / WhatsApp number • Company and job title, when provided • The content of messages sent through the website forms Data collected automatically while you browse: • IP address and approximate location • Device type, browser, and operating system • Pages visited, time on page, and traffic source • Page interactions (clicks, scrolling, and form submissions) • Cookie identifiers and similar technologies We do not intentionally collect sensitive personal data or data from individuals under 18.

3. What we use your data for

We process your personal data for the following purposes: • Responding to contact requests and sending commercial proposals • Starting and conducting WhatsApp conversations when you request support • Sending our newsletter and communications about our content, products, and events, when you opt in • Analyzing website usage to improve navigation, content, and performance • Measuring the effectiveness of our marketing and advertising campaigns • Complying with applicable legal and regulatory obligations

4. Legal bases for processing

Each purpose relies on a legal basis set out in Article 7 of the LGPD: • Consent — non-essential cookies, newsletter, and marketing communications • Performance of a contract or pre-contractual steps — responding to contact requests and preparing proposals • Legitimate interest — website usage analysis, security, and service improvement, always weighed against the impact on your rights • Compliance with a legal or regulatory obligation — where required by law You may withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

5. Third-party services and sharing

We use third-party services that may process personal data on our behalf. We do not sell your data. Customer relationship and communications • HubSpot — stores data submitted through the website forms and manages the commercial relationship • ActiveCampaign — newsletter and email communications Usage and performance analytics • Google Analytics 4 — traffic and browsing behavior metrics • Microsoft Clarity — heatmaps and anonymized session recordings • Vercel Speed Insights — technical performance metrics Advertising and campaign measurement • Google Ads — conversion measurement and remarketing • Meta Pixel (Facebook/Instagram) — conversion measurement and audiences • LinkedIn Insight Tag — conversion measurement and audiences Infrastructure and content • Vercel — website hosting • Sanity — blog content management • Google Fonts and Adobe Typekit — typefaces • YouTube — embedded videos • WhatsApp (Meta) — support channel initiated by you Some of these providers are located outside Brazil. In those cases, the international transfer relies on the safeguards set out in Article 33 of the LGPD and on the contractual clauses adopted by each provider. We may also share data with public authorities where there is a legal obligation, a court order, or a need to defend our rights.

6. Cookies and tracking technologies

We use essential, performance, functionality, and advertising cookies. Non-essential cookies are only activated after you consent through the notice shown on your first visit. Details on each category, the providers involved, and how to manage your preferences are described in our Cookie Policy.

Cookie Policy

7. How long we keep your data

We keep personal data only for as long as necessary for the purposes described in this policy: • Business contact data — for the duration of the relationship and for up to 5 years after the last contact, for record-keeping and legal defense • Newsletter subscriptions — until you unsubscribe • Browsing and analytics data — according to each tool's retention period, generally between 2 and 26 months • Records required by law — for the applicable statutory periods Once the period ends, data is deleted or anonymized.

8. Your rights as a data subject

The LGPD grants you the following rights: • Confirmation that we process your data • Access to the data we hold about you • Correction of incomplete, inaccurate, or outdated data • Anonymization, blocking, or deletion of unnecessary or excessive data • Portability of your data to another provider • Deletion of data processed on the basis of consent • Information about who we share your data with • Withdrawal of consent at any time • Objection to processing based on legitimate interest To exercise any of these rights, email [email protected]. We will respond as soon as possible and, as a rule, within 15 days. You may also file a complaint with Brazil's National Data Protection Authority (ANPD).

9. Information security

We adopt technical and administrative measures to protect your data against unauthorized access, loss, alteration, or improper disclosure. These include encrypting website traffic (HTTPS), restricting access to information, and selecting providers that meet appropriate security standards. No system is completely immune to incidents. Should a significant security incident occur, we will notify the affected data subjects and the ANPD, as required by the LGPD.

10. Changes to this policy

We may update this Privacy Policy to reflect changes in our practices, in the services we use, or in applicable law. The date of the last update is always shown at the top of this page. We recommend reviewing it periodically.

11. Contact

For questions, requests, or complaints about privacy and data protection, contact us at [email protected].