Privacy Policy

This Privacy Policy is issued by MUTAGEX LTDA, a company duly incorporated under Brazilian law, registered under CNPJ 68.386.839/0001-43, with its principal place of business at Avenida Doutor José Marques Penteado, 201, Flora Ville, Boituva — SP, Brazil (referred to in this document as "MUTAGEX", "we", "us", or "our").

We operate the website located at mutagexusa.com (the "Site") and any associated digital communications. This policy applies to all visitors, prospective clients, and any other individuals who interact with our Site or contact us directly.

We have drafted this policy to comply with Brazil's Lei Geral de Proteção de Dados Pessoais (LGPD — Law No. 13,709/2018) and, to the extent applicable, the European Union's General Data Protection Regulation (EU 2016/679 — GDPR). We also align with Google's advertising and landing-page policies to ensure transparency about how data is handled in the context of digital marketing.

By continuing to browse this Site, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of it, please discontinue your use of the Site. We encourage you to review this document periodically, as it may be updated to reflect changes in our practices or applicable law.

We collect personal information in two principal ways: information you actively provide to us, and information collected automatically when you navigate our Site. We apply the principle of data minimization — we collect only what is genuinely necessary for a defined, legitimate purpose.

Every use of your personal data is grounded in a recognized legal basis under the LGPD and, where applicable, the GDPR. The following table summarizes our processing activities and the corresponding legal basis for each.

• Responding to inquiries and communications: When you contact us, we use the information you provide to understand your request and provide a relevant, timely response. Legal basis: legitimate interest (LGPD Art. 7, VI) and, under GDPR, Article 6(1)(f).
• Operating and improving the Site: Technical and analytics data allow us to monitor Site performance, identify and resolve errors, and develop improvements that make our content more useful and accessible. Legal basis: legitimate interest.
• Security and fraud prevention: Log data and certain technical signals help us detect unauthorized access, abusive behavior, or security threats. Legal basis: legitimate interest and compliance with legal obligations.
• Compliance with legal obligations: We may process and retain data to the extent required by Brazilian tax law, corporate regulations, or judicial orders. Legal basis: compliance with a legal obligation (LGPD Art. 7, II; GDPR Art. 6(1)(c)).
• Measuring advertising effectiveness: Where you arrive at our Site via a paid advertisement (e.g., Google Ads), aggregated data helps us understand whether our marketing is reaching the right audience. No individual profiling takes place beyond what is disclosed under Section 4. Legal basis: legitimate interest, with appropriate disclosures.

We do not use your personal information for automated decision-making that produces legal or similarly significant effects on you. We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.

Cookies are small text files placed on your device when you visit a website. They allow the site or a third-party service to recognize your browser on subsequent visits and can store information about your browsing session. We use cookies strictly for the purposes outlined below. No cookie on this Site is used to build individual advertising profiles for resale to data brokers.

MUTAGEX does not sell your personal data. We share information with third parties only in the specific, limited circumstances described below, and only to the extent necessary to accomplish the stated purpose.

• Google LLC: We use Google Analytics 4 and Google Ads. As a consequence, usage data is transmitted to Google's servers, which may be located in the United States or other countries outside Brazil and the EU. Google LLC participates in the EU-U.S. Data Privacy Framework and provides Standard Contractual Clauses for cross-border data transfers. For more information, see policies.google.com/privacy.
• Hosting & infrastructure providers: Our Site is hosted on servers operated by our web infrastructure provider. This provider processes technical data on our behalf under a data processing agreement that obligates them to protect your data with at least the same safeguards we apply.
• Professional advisors: We may share data with lawyers, accountants, or auditors where necessary to comply with legal obligations or to protect our legitimate business interests. Such parties are bound by strict confidentiality obligations.
• Legal authorities: We will disclose personal data to governmental or judicial authorities if required to do so by a valid court order, subpoena, or applicable law, or where we believe in good faith that disclosure is necessary to protect public safety, prevent fraud, or enforce our legal rights.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of our assets, personal data held by us may be transferred to the successor entity. We would notify affected individuals via a notice on this Site before any such transfer takes effect under materially different terms.

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. The following general retention periods apply:

• Contact and correspondence data: Retained for up to 5 years from the date of your last communication with us. This period reflects standard commercial relationship management practices and the applicable statute of limitations for contract claims under Brazilian law.
• Web server logs: Retained for 12 months for security monitoring and then permanently deleted or anonymized.
• Google Analytics data: Aggregated analytics data is retained within Google Analytics for 14 months, as configured in our account. Event-level data is automatically deleted by Google thereafter.
• Cookie consent records: Stored in your browser for up to 12 months, after which you will be prompted to confirm your preferences again.
• Legally mandated records: Certain records required by Brazilian fiscal or corporate law (e.g., accounting documents) are retained for the period mandated by law, which may be up to 10 years.

Once a retention period expires, data is either permanently and securely deleted from our systems or irreversibly anonymized so that it can no longer be attributed to any identifiable individual. If you request deletion before a retention period expires, we will comply promptly unless a legal obligation requires us to retain it.

MUTAGEX takes the security of your personal data seriously. We have implemented a range of technical and organizational measures designed to protect information against unauthorized access, accidental loss, alteration, or disclosure. These measures include:

• Transport encryption: All data transmitted between your browser and our Site is encrypted using TLS 1.2 or higher (HTTPS). We enforce HSTS to prevent protocol downgrade attacks.
• Access control: Access to personal data is restricted to MUTAGEX personnel who have a legitimate need to process it in connection with their role. Access credentials are managed under a least-privilege policy and reviewed periodically.
• Vendor due diligence: Third-party service providers that process data on our behalf are assessed for their security practices before engagement and are contractually required to maintain appropriate safeguards.
• Incident response: We maintain an internal procedure for identifying, assessing, and responding to data security incidents. In the event of a breach that poses a risk to your rights and freedoms, we will notify the relevant data protection authority (the Brazilian ANPD and/or the relevant EU supervisory authority, as applicable) within the legally prescribed timeframe, and we will notify affected individuals directly where required.

Despite these measures, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security, and we encourage you to exercise caution when sharing sensitive information via email or other electronic channels.

Depending on your location and the applicable legal framework, you may hold a range of rights with respect to your personal data. MUTAGEX honors these rights for all individuals, regardless of whether the LGPD or GDPR is the primary applicable law. A summary of your rights is set out below.

Our Site and services are directed exclusively toward businesses and professionals. We do not knowingly collect, solicit, or process personal data from individuals under the age of 18. If you believe that a minor has provided us with personal data without appropriate parental or guardian consent, please contact us immediately at [email protected] and we will take prompt steps to delete that information from our records.

Under both the LGPD (Art. 14) and the GDPR (Art. 8), processing of children's data is subject to heightened requirements, including verified parental consent. Since our services are not intended for minors, we have no legitimate basis for collecting such data, and any data found to have been collected from a child will be deleted without delay.

We may update this Privacy Policy from time to time to reflect changes in our processing activities, new legal requirements, or improvements in how we explain our practices. When we make material changes, we will update the "Last updated" date at the top of this page and, where the changes are significant, we may draw attention to them through a notice on our homepage or via direct communication where we hold your contact details.

We encourage you to review this page periodically. Your continued use of the Site following the posting of changes constitutes your acknowledgment of those changes. If you disagree with any revised version of this policy, you should discontinue use of the Site and may contact us to request deletion of any personal data we hold.

Previous versions of this Privacy Policy are available on request by contacting us at the address provided in Section 11. We retain archived versions for at least 5 years to ensure transparency about our historical data practices.

If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data, please contact us directly. We are committed to addressing your inquiry promptly and transparently. Under the LGPD, our designated Data Protection Officer (Encarregado de Dados) can be reached through the same contact details below.