Privacy Policy

Last updated: October 12, 2026

1. Who we are and who this Policy applies to

This Privacy Policy explains how TCP Partners Consultoria Ltda. ("TCP Partners", "we", "us"), registered with the Brazilian corporate taxpayer number (CNPJ) 39.457.424/0001-15, with its registered office at Rua Minas de Prata, 1726, conjunto 152 (Spazio JK), Vila Olímpia, São Paulo/SP, CEP 04552-080, processes the personal data of people who use the website site.tcp-partners.com.

For the purposes of the Brazilian General Data Protection Law (Law No. 13,709/2018, "LGPD"), TCP Partners is the controller of the personal data processed on this website, that is, the party that decides how and why the data is used.

This Policy applies to the website site.tcp-partners.com, in its Portuguese and English versions, and to the addresses that redirect to it. It does not apply to third-party websites we link to.

The use of cookies and of the browser's local storage is described in our Cookie Policy, which is part of this Policy.

If you have any questions, please contact our Data Protection Officer through the channel in section 12.

2. Definitions

• Personal data: information relating to an identified or identifiable natural person, such as name, e-mail address, phone number or IP address.
• Data subject: the natural person to whom the personal data refers, that is, you.
• Processing: any operation performed on personal data, such as collection, use, storage, transmission, sharing and deletion.
• Controller: the party that makes the decisions about the processing. On this website, TCP Partners.
• Processor: a party that processes personal data on behalf of the controller, such as hosting and e-mail providers.
• Data Protection Officer (DPO): the person appointed by the controller to act as the communication channel with data subjects and with the National Data Protection Authority (in the LGPD, the "Encarregado").
• ANPD: the Brazilian National Data Protection Authority, which enforces the LGPD.

3. What data we process, why, and on what legal basis

We only process the data described below. This website does not use third-party audience analytics tools (such as Google Analytics), does not display ads, does not use social media pixels and does not sell personal data. Visit statistics are counted by the website itself, anonymously and without cookies (section 3.2). Nor do we use your data to build a behavioral profile.

3.1. Contact form

When you use the "Get in Touch" form (on the home page and on the Contact page) or the form on the services and news pages, we process:

• Data you type in: name, e-mail, phone number or subject (depending on the form) and your message.
• Data added by the website: the language and page from which the message was sent, the date and time it was sent and the originating IP address.

Why: to reply to your message, to your request for a meeting or for a proposal. The message is stored in the website's database and sent by e-mail to our team, with your e-mail address as the reply-to address.

Legal basis: preliminary procedures related to a contract, at your request (LGPD, art. 7, V). When the message is not related to hiring our services (for example, press or other matters), our legitimate interest in replying to those who contact us (art. 7, IX).

3.2. Access logs and security

When you visit the website, the server automatically records the IP address, the date and time of access, the address requested (including the link parameters), the address of the page you came from (referer), the browser used (user agent) and the result of the request. On the forms, we also use automated anti-bot and anti-flooding mechanisms, which use the IP address and the time taken to fill in the form.

Why: to comply with the legal obligation to keep access logs of internet applications, to protect the website against attacks and abuse, to investigate failures and, if necessary, to defend our rights.

Legal basis: compliance with a legal obligation (LGPD, art. 7, II, together with art. 15 of the Brazilian Civil Rights Framework for the Internet, Law No. 12,965/2014), legitimate interest in the security of the website (art. 7, IX) and the regular exercise of rights (art. 7, VI).

Access statistics: the website itself counts, per day, the pages viewed, the language, the source of the visit (only the name of the website you came from, such as "google.com", or the campaign source stated in the link, provided it is on a fixed list of names, such as "linkedin" or "newsletter"), the type of device (mobile phone, tablet or computer) and the submissions of the contact forms.

In the statistics, only these daily totals are stored, without the time of day: the address you came from and the browser identification (user agent) are read at the time of access and discarded right away — all that remains of them is the name of the source website (or a generic category, such as "IP address", "local network" or "other sources") and the type of device. This applies to the statistics; the server's access log, described at the beginning of this section, is separate and follows the period in section 6. The statistics do not use cookies or local storage and do not store IP addresses or identifiers: they cannot identify you or follow your browsing and, therefore, are not personal data (LGPD, art. 12). To the extent that reading the access data at that moment involves personal data, the legal basis is our legitimate interest in understanding how the website is used and improving it (art. 7, IX). The totals are kept for 25 months.

3.3. Cookies and local storage

This website only uses strictly necessary cookies and local storage items: form protection, member login, confirmation messages and a record that you have already seen the cookie notice. The full list is in our Cookie Policy.

3.4. Links to other websites

The website may contain links to third-party websites, which have their own privacy policies. Data you provide on those websites does not pass through ours.

3.5. Member registration (sector analysis area)

To download our sector analyses, you need to create a member account. At registration, we process:

• Data you provide: username (login), e-mail, company, job title and password.
• Data added by the website: language, IP address, date and time of registration, account status and the record that you stated you have read this Policy.

Your password is never stored as plain text: we only keep a cryptographic digest (hash) that allows us to check it but not to recover it. No one on our team can see your password.

When you complete your registration, we send you a welcome e-mail and send our team an internal notice with the new member's login, e-mail, company, job title and language.

If you had an account on the previous TCP Partners website, it was transferred to this website with the same data, including your name, if you provided it in the old registration. Your old password remains stored only as a hash and is converted to the current format the first time you log in.

Why: to create and maintain your account and give you access to the analyses.

Legal basis: performance of the membership agreement to which you are a party (art. 7, V). The IP address is processed on the basis of legitimate interest, for the security of the registration (art. 7, IX). Registration does not depend on your consent: the checkbox on the form only records that you have read this Policy.

3.6. Login, Account and password recovery

• Login: we check the login or e-mail and the password you enter. After you log in, a cookie keeps your account identification, encrypted, so you do not have to log in again on every page. We record the date and time of your last login (only the most recent one).
• Account: you can change your e-mail, company, job title and password at any time.
• Forgot password: if you enter a registered login or e-mail, we send you a link to create a new password. The link is valid for 24 hours and stops working as soon as the password is changed. For security reasons, the message shown on screen is the same whether or not the account exists.

Why: to authenticate you, keep your session and allow you to update your data.

Legal basis: performance of a contract (art. 7, V). The record of your last login is processed on the basis of legitimate interest, for account security (art. 7, IX).

4. Who we share data with

We do not sell or rent personal data. We only share data to the extent necessary, with:

• Amazon Web Services (AWS): hosting of the website and its database, on servers in the United States. Acts as a processor.
• Google (Google Workspace): sending and receiving the e-mails generated by the website (contact messages, notices to our team and e-mails sent to you). Acts as a processor; data may be processed in the United States and in other countries where Google has infrastructure.

• Public authorities: when there is a legal obligation or a court or administrative order, such as a request for access logs under the Brazilian Civil Rights Framework for the Internet.
• Professional advisers: lawyers and auditors, when necessary to exercise or defend rights, always under a duty of confidentiality.
• In corporate transactions: in the event of a merger, acquisition, consolidation or sale of assets, data may be transferred to the successor, who will be bound by this Policy.

Within TCP Partners, only the people who need the data to serve you or to keep the website running have access to it.

5. International data transfers

Because the website is hosted on AWS in the United States and e-mails go through Google Workspace, your personal data is transferred outside Brazil.

These transfers comply with art. 33 of the LGPD. Where the transfer is necessary to handle your contact request or to perform a contract with you, it relies on art. 33, IX, of the LGPD; in other cases, on the contractual data protection safeguards offered by these providers, including, where applicable, the standard contractual clauses approved by the ANPD (ANPD Resolution CD/ANPD No. 19/2024).

You may ask our Data Protection Officer (section 12) for more information about these transfers, including the safeguards adopted.

6. How long we keep data

We only keep data for as long as necessary for the purposes described, to comply with legal obligations or to exercise rights. The retention periods are:

At the end of the period, data is deleted or anonymized, unless the law allows or requires it to be kept (LGPD, art. 16). Database backups may contain this data for a limited additional period, until they are replaced by newer copies.

7. How we protect data

We take technical and administrative measures to protect personal data against unauthorized access, loss and improper alteration, including:

• an always-encrypted connection (HTTPS), with HSTS, which forces the browser to use the secure connection;
• passwords stored only as hashes, never as plain text;
• cookies that cannot be read by page scripts (HttpOnly) and protection against cross-site request forgery (CSRF) on all forms;
• a limit on submissions per IP address and automated anti-bot filters on the forms;
• access to the server and the database restricted to authorized people.

No system is completely immune to failures. If a security incident occurs, we will follow the procedure in section 11.

8. Your rights as a data subject

Your personal data belongs to you. The LGPD (art. 18) gives you the right to request, at any time:

1. confirmation that we process your data;
2. access to your data;
3. correction of incomplete, inaccurate or outdated data;
4. anonymization, blocking or deletion of data that is unnecessary, excessive or processed in breach of the LGPD;
5. portability of your data to another provider, in accordance with ANPD regulations;
6. deletion of data processed on the basis of your consent, where applicable;
7. information about the public and private entities with which we share your data;
8. information about the possibility of not giving consent and the consequences of refusing, when processing depends on consent;
9. withdrawal of consent, when processing is based on it;
10. objection to processing carried out on another legal basis, in the event of non-compliance with the LGPD;
11. review of decisions made solely on the basis of automated processing (see section 9).

Please provide us with true and up-to-date data. If any of your data is wrong, you may ask us to correct it at any time.

If you are a member, you can correct your e-mail, company and job title directly on the Account page. To delete your account, send your request from your registered e-mail address to lgpd@tcp-partners.com.

How to exercise your rights: send your request to lgpd@tcp-partners.com. There is no charge. To protect your data, we may ask for information to confirm your identity before handling the request.

Response times: confirmation that we process your data and access to it in simplified form are provided immediately. A complete statement, including the origin of the data, the criteria used and the purpose of the processing, is provided within 15 days of your request (LGPD, art. 19). Other requests are answered within 15 days.

If we cannot fulfill a request, for example because the law requires us to keep certain data, we will explain why. If the request involves documents containing other people's data, we will only provide your data.

You may also file a petition with the ANPD (www.gov.br/anpd) or with consumer protection bodies (LGPD, art. 18, paragraphs 1 and 8). We encourage you to contact us first: we want to resolve your request.

9. Automated decisions

We do not make decisions affecting your interests based solely on automated processing of personal data. The only automated screening on the website is the anti-bot filtering on the forms: a message flagged as suspicious is recorded in the website's database but is not automatically forwarded by e-mail to our team. If you sent a message and did not receive a reply within a few days, please write to lgpd@tcp-partners.com and we will check the record.

10. Children and adolescents

This website is aimed at companies and professionals and is not intended for anyone under 18. We do not knowingly collect data from children or adolescents. If we learn that we have received data from a minor without the authorization required by law, we will delete it.

11. Security incidents

If a security incident involving personal data occurs that may cause significant risk or harm to data subjects, we will notify the ANPD and the affected data subjects within 3 business days of becoming aware of the incident, as required by art. 48 of the LGPD and ANPD Resolution CD/ANPD No. 15/2024. The notice will describe what happened, which data was affected, the risks and the measures taken.

12. Data Protection Officer and contact channel

The Data Protection Officer of TCP Partners can be contacted by e-mail at lgpd@tcp-partners.com (LGPD, art. 41, and ANPD Resolution CD/ANPD No. 18/2024).

Use this channel for questions about this Policy, to exercise your rights or to report any suspected misuse of your data.

Postal address: TCP Partners Consultoria Ltda., Rua Minas de Prata, 1726, conjunto 152 (Spazio JK), Vila Olímpia, São Paulo/SP, CEP 04552-080, attention: Data Protection Officer.

13. Changes to this Policy

We may update this Policy to reflect changes to the website, our services or the law. The date of the last update is always shown at the beginning of the document.

When a change is significant, we will notify registered members by e-mail before it takes effect.

If a change requires your consent, we will ask for it specifically before the new processing begins.

14. Governing law

This Policy is governed by Brazilian law, in particular the LGPD and the Brazilian Civil Rights Framework for the Internet. You always retain the right to bring any dispute before the courts of your place of residence, where the law so provides.

This Policy is also available in Portuguese. In the event of any discrepancy between the versions, the Portuguese version prevails.

If any provision of this Policy is held invalid, the remaining provisions remain in effect.