Privacy Policy — Raiar Orgânicos

01Who we are

Raiar Orgânicos S.A., Brazilian tax ID (CNPJ) 36.204.525/0001-02, is an organic protein producer based in Avaré, São Paulo, Brazil. In this document, “Raiar”, “we” and “our” refer to it.

This policy covers the website raiarorganicos.com.br, in Portuguese and English, and the contact channels listed on it (WhatsApp and e-mail). For this processing Raiar is the controller: it decides why and how the data is used.

We follow Privacy by Design and by Default: we collect only what is needed, the site uses no tracking tools, and any optional feature starts switched off.

02What data we process and why

The site has no sign-up, login, online store or contact form of its own. Personal data reaches us in the situations below.

Situation	Data	Purpose	Legal basis (art. 7)
Visiting the site	Technical data logged by the server: IP address, date and time, page visited and browser type.	Keep the site running and secure, prevent fraud and comply with Brazil's Internet Civil Rights Framework.	Legal obligation (II) and legitimate interest (IX)
Privacy notice	Random identifier, choice made, notice version, page, date and time.	Remember and prove your choice.	Legal obligation (II) and legitimate interest (IX)
Contact via WhatsApp or e-mail	Name, phone, e-mail, company or city and the message content.	Reply, point you to stores, handle sales and press requests.	Pre-contractual steps (V) and legitimate interest (IX)
Customers, distributors and suppliers	Representatives' contact details and registration and tax data.	Onboarding, contracts, invoicing, deliveries and payments.	Performance of contract (V) and legal obligation (II)
Business prospecting	Name, role and business contact of retail and distribution buyers.	Introduce our products to companies. You can ask us to stop contacting you.	Legitimate interest (IX)
Marketing actions (giveaways, partnerships)	Name, contact and delivery address.	Taking part in the action and shipping products, under each action's rules.	Consent (I) or performance of contract (V)
Data subject requests	Name, e-mail and, if you choose, tax ID (CPF) and phone, plus the request description.	Confirm your identity and handle the request.	Legal obligation (II)

Sensitive data. We do not ask for sensitive data (health, religion, racial origin, biometrics, etc.) on the site or through our contact channels. If you send any on your own, it will be used only to answer your request and then discarded.

Children and teenagers. The site is not aimed at people under 18 and we do not knowingly collect their data.

03Cookies and similar technologies

The site does not use advertising, analytics or social media cookies, nor tracking pixels. It stores only two technical items in your browser, needed to remember your choice about the privacy notice:

raiar_consent_vid: a random identifier that does not reveal who you are;
raiar_consent_decisao: the choice you made and the notice version.

These items live in your browser's local storage (localStorage), are not shared with third parties, and you can delete them at any time by clearing your browsing data. If we ever start using optional cookies, they will only be enabled with your permission, and this policy will be updated.

Third-party content. The “In the media” page reads a public spreadsheet hosted by Google to list press coverage. To do so, your browser connects to Google's servers, which receive technical connection data (such as your IP address), as with any website visit. Links to WhatsApp, Instagram, LinkedIn, Facebook and YouTube take you to platforms with their own policies, which apply once you visit them.

Cookie preferences

04Who we share data with

We do not sell or rent personal data. We share only what is necessary, and only with:

Service providers (processors): website and systems hosting, e-mail and cloud storage, our ERP system, accounting, logistics and legal advisors. All of them process data on our behalf, under contract, with confidentiality and security obligations;
Messaging platforms: when you talk to us on WhatsApp, the conversation is also processed by Meta, under its own policy;
Public authorities: when required by law, regulation or court order.

05International transfers

Some technology providers (cloud services, e-mail and WhatsApp) may store or process data outside Brazil. In those cases the transfer follows the grounds in art. 33 of the LGPD, especially contractual clauses ensuring a level of protection consistent with Brazilian law.

06How long we keep data

We keep data only for as long as the purpose requires or the law demands. After that, it is deleted or anonymised.

Data	How long
Website access logs	6 months (art. 15 of the Internet Civil Rights Framework).
Record of your privacy notice choice	While the notice is in force and up to 5 years afterwards, as proof.
Contacts with no business relationship	Up to 2 years after the last contact.
Customer, distributor and supplier data	For the contract term and 5 years after it ends, per tax and legal deadlines.
Data subject requests	5 years after the reply, to demonstrate compliance.

07How we protect it

We apply technical and organisational measures to protect data against unauthorised access, loss, alteration or leaks, including: encrypted connections (HTTPS), role-based access with least privilege, backups, data protection clauses in supplier contracts, staff training and an incident response plan.

If a security incident may cause you significant risk or harm, we will notify Brazil's National Data Protection Authority (ANPD) and the affected data subjects, as required by art. 48 of the LGPD.

08Your rights

The LGPD (art. 18) gives you, at any time and free of charge, the right to:

confirm whether we process your data and access it;
correct incomplete, inaccurate or outdated data;
request anonymisation, blocking or deletion of unnecessary or excessive data, or data processed unlawfully;
request portability of your data to another provider;
request deletion of data processed on the basis of your consent;
know who we share your data with;
know that you may refuse consent and what that implies;
withdraw consent;
object to processing based on another legal ground if it breaches the law;
request review of decisions made solely by automated processing.

How to ask. Use the data subject form or write to lgpd@raiarorganicos.com.br. To protect you, we confirm your identity before releasing or changing any data. We reply within 15 days (art. 19). If you are not satisfied, you may also complain to the ANPD at gov.br/anpd.

Open the data subject form (in Portuguese)

09Data Protection Officer (DPO)

Raiar's Data Protection Officer is the point of contact between you, the company and the ANPD.

João Dourado
Data Protection Officer

E-mail: lgpd@raiarorganicos.com.br
Form: Data subject rights (in Portuguese)

10Changes to this policy

This policy may be updated, for example if we change how we process data or if the law changes. The version and update date are always shown at the top of this page. Relevant changes will be highlighted on the site and, when needed, the privacy notice will be shown again.

11Applicable law

This policy follows Brazil's General Data Protection Law (Law 13,709/2018), the Brazilian Civil Rights Framework for the Internet (Law 12,965/2014) and ANPD regulations.

↑ Back to top

privacypolicy