Privacy Policy

Introduction

This Privacy Policy is published by the Associação para Promoção da Excelência do Software Brasileiro — Softex (CNPJ 01.679.152/0001-25), a Brazilian non-profit association headquartered at Setor SAUS, Quadra 01, Bloco M, Sala 1404, Edifício Libertas, Asa Sul, Brasília — DF, Brazil (hereinafter "Softex," "we," "our," or "us").

Softex operates programs that strengthen the Brazilian software and technology industry on the global stage, including export promotion, market-access initiatives, innovation support, and international partnership development. When you interact with our website, register for an event, submit a contact form, or engage with our digital materials, you entrust us with personal information. We take that responsibility seriously.

This policy applies to all personal data processed through our website (softex-us.site) and related digital properties, and it is designed to comply with the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados — LGPD, Law No. 13,709/2018) and, where applicable to data subjects located in the European Economic Area, the General Data Protection Regulation (EU) 2016/679 (GDPR). Depending on your jurisdiction, additional rights and obligations may apply.

Information We Collect

We collect personal information only when there is a specific, legitimate reason to do so. The categories below describe what we collect and the circumstances in which we collect it.

Information you provide directly

When you fill out a contact form, submit an inquiry, register for a Softex program or event, or sign up to receive our newsletter or publications, you voluntarily provide personal data. This may include:

• Full name and professional title
• Business or personal email address
• Phone number (when provided)
• Company or organization name, sector, and size
• Country and, where relevant, state or city of residence
• The content of your messages, inquiries, or feedback submissions
• Any additional information you voluntarily include in free-text fields — for example, a description of your company's export readiness or the specific program you are interested in

Providing this data is voluntary, but some fields are required to allow us to respond to your inquiry or process your registration. Required fields are clearly marked on our forms.

Information collected automatically

When you visit our website, our servers and third-party analytics services automatically record certain technical information. This includes:

• IP address (which may be truncated or anonymized before storage)
• Browser type, version, and language preferences
• Operating system and device type
• Referring URL (the page or source that brought you to our site) and exit URL
• Pages visited, time spent on each page, and click-path data
• Date and time of access
• Aggregated behavioral data used to understand how visitors interact with our content — for example, which program pages attract the most attention

This technical data is generally not linked to your identity unless you have also submitted a form or logged in to a program portal. For details about the technologies used to collect this data, see Section 4 (Cookies & Tracking Technologies).

Information from third-party sources

On occasion, we may receive information about you from third parties — for instance, if a partner organization refers you to a Softex program, or if you engage with our content via a social media platform and that platform shares interaction data with us under its own terms. We handle such data with the same care as data collected directly, and we use it only for the purposes described in this policy.

How We Use Your Information

Every use of personal data at Softex is tied to a defined purpose and a lawful basis under applicable privacy law. We do not use your data for automated decision-making that produces legal or similarly significant effects, and we never sell personal information to third parties.

• Responding to inquiries and managing contact requests. When you submit a contact form, we use your name, email address, and message content to respond to you in a timely and relevant manner. Lawful basis: performance of a contract or pre-contractual steps (LGPD Art. 7(V); GDPR Art. 6(1)(b)) and our legitimate interest in providing responsive service (LGPD Art. 7(IX); GDPR Art. 6(1)(f)).
• Program registration and participant management. If you apply to or register for a Softex program — such as an export acceleration initiative or a capacity- building workshop — we process your information to manage your participation, communicate program details, and report outcomes to institutional funders in aggregated or anonymized form. Lawful basis: performance of a contract or legitimate interest.
• Sending communications you have opted into. With your explicit consent, we may send newsletters, event invitations, and updates about Softex programs relevant to your industry or professional interests. You can withdraw this consent at any time using the unsubscribe link in any email or by contacting us directly. Lawful basis: consent (LGPD Art. 7(I); GDPR Art. 6(1)(a)).
• Website analytics and improvement. Aggregated and pseudonymized usage data helps us understand which content is valuable, identify technical issues, and improve the user experience for everyone who visits our site. Lawful basis: legitimate interest.
• Compliance with legal obligations. We may process and retain certain data when required to do so by Brazilian law, tax regulation, court order, or regulatory authority. Lawful basis: legal obligation (LGPD Art. 7(II); GDPR Art. 6(1)(c)).
• Prevention of fraud and abuse. We may use technical data to detect, investigate, and prevent malicious activity, unauthorized access, or violations of our terms. Lawful basis: legitimate interest and legal obligation.

We will not use your personal data for any purpose that is incompatible with the purposes stated above without first obtaining your consent or establishing a fresh lawful basis.

Cookies & Tracking Technologies

Our website uses cookies — small text files stored on your device — along with similar technologies such as web beacons, pixel tags, and local storage, to support website functionality and gather analytics data. Below is a plain description of each category of technology we use.

Managing your cookie preferences

When you first visit our website, you will be presented with a cookie consent banner that allows you to accept all categories, accept only necessary cookies, or customize your choices. You can change your preferences at any time by clicking the "Cookie Settings" link in the footer of any page.

You can also control cookies through your browser settings. Most browsers allow you to refuse all cookies, delete existing cookies, or be notified when a cookie is being set. Please note that disabling certain cookies may affect the functionality of the website. Guidance for major browsers is available at allaboutcookies.org.

To opt out of Google Analytics tracking specifically, you may install the Google Analytics Opt-out Browser Add-on.

Sharing With Third Parties

Softex does not sell, rent, or trade your personal information. We share data only in the limited circumstances described here, and only with parties that are bound by appropriate data-protection obligations.

Service providers and data processors

We work with carefully selected third-party vendors who process data on our behalf and under our documented instructions. These include:

• Web hosting and infrastructure providers that store the website and its associated data on secure servers.
• Email delivery services used to send transactional messages (e.g., confirmation of your form submission) and, where consented, newsletters.
• Analytics platforms (principally Google Analytics) that help us understand website traffic in aggregate, pseudonymized form.
• Customer relationship management (CRM) software used by our program and communications teams to track inquiries and follow up appropriately.
• Video-conferencing and webinar platforms used for remote events and workshops. If you register for such an event, the platform will receive the information you submit, and its own privacy policy will apply.

All our processors are required to enter into data-processing agreements and may only use your data for the specific, instructed purpose.

Institutional partners and funders

Softex activities are partially funded and governed by Brazilian federal institutions and international development organizations. We may share aggregated, anonymized, or statistical program data — such as the number of companies supported, industry sectors represented, or export results achieved — with these bodies as part of our reporting obligations. Individual personal data is shared with institutional partners only where expressly authorized by program rules and with your prior knowledge.

Legal requirements and safety

We may disclose personal data when required to comply with a legal obligation, court order, or official government request, or when disclosure is necessary to protect the rights, property, or safety of Softex, our users, or the public.

International transfers

Some of our service providers operate servers outside of Brazil and the European Economic Area. When transferring personal data internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (for transfers subject to GDPR), contractual data-protection obligations consistent with LGPD requirements, or transfers to countries recognized as offering an adequate level of protection by the relevant supervisory authority.

Data Retention

We keep personal data only for as long as necessary to fulfil the purpose for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. The following general retention periods apply:

• Contact form submissions: Data submitted via our contact forms is retained for up to 24 months from the date of submission, or for the duration of any ongoing correspondence or service relationship that arises from the inquiry.
• Program registration and participation records: Data related to Softex programs (participant names, company details, outcomes) is retained for as long as needed to administer the program and fulfil reporting obligations to funders — in most cases, five years from the close of the program cycle.
• Newsletter and marketing lists: Your details are held on our mailing list until you unsubscribe or withdraw consent. We perform regular list hygiene reviews and remove inactive contacts (no opens or clicks in 24 months) after notifying you.
• Analytics and server logs: Aggregated analytics data is retained for up to 26 months as configured in Google Analytics. Raw server logs are retained for up to 90 days for security purposes, then deleted.
• Financial and tax records: Where we are required by Brazilian tax or accounting law (particularly Lei n.º 9.430/1996 and related regulations) to retain records, we do so for the legally mandated period — generally five years.

At the end of the applicable retention period, personal data is securely deleted or anonymized so that it can no longer be linked to an identifiable individual.

Data Security

We implement organizational and technical measures designed to protect your personal data against unauthorized access, accidental loss, destruction, or disclosure. Our security program includes:

• Transmission of all data between your browser and our servers is encrypted using TLS (Transport Layer Security), indicated by the padlock icon in your browser's address bar.
• Access to systems containing personal data is restricted to authorized Softex staff and vetted service providers, and is controlled through role-based permissions and multi-factor authentication where appropriate.
• Our hosting and database infrastructure is maintained with regular security patches, firewall protection, and vulnerability scanning.
• Staff members who handle personal data receive regular training on data protection obligations and security best practices.
• We maintain an incident response procedure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority (the Autoridade Nacional de Proteção de Dados — ANPD, and the relevant EU supervisory authority where applicable) within the legally required timeframe and, where required, will notify affected individuals directly.

While we take every reasonable precaution, no method of internet transmission or electronic storage is 100% secure. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately at contato@softex-us.site.

Your Rights

Depending on your location and the applicable law, you have a number of rights regarding the personal data we hold about you. Whether you are covered by Brazil's LGPD or the EU/UK GDPR, the rights are substantively similar. We honor all of them.

How to exercise your rights

To exercise any of the above rights, please send a written request to contato@softex-us.site, with the subject line "Data Subject Request." Please include your full name, the email address associated with your contact with Softex, and a clear description of the right you wish to exercise. We may ask you to verify your identity before processing the request to protect against unauthorized access.

We will respond to your request within 15 days under the LGPD. For requests subject to the GDPR, we will respond within one month and may extend this by a further two months for complex or multiple requests, notifying you of the extension within the first month.

Children's Privacy

Softex's website and programs are directed exclusively at businesses, professionals, and adult individuals. We do not knowingly collect, solicit, or process personal data from children under the age of 18.

If you are a parent or guardian and believe your child has submitted personal information to us without your consent, please contact us at contato@softex-us.site and we will promptly delete the data. If we become aware that we have inadvertently collected data from a minor, we will take immediate steps to remove it from our records and, where required, notify the ANPD.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or the services we offer. When we make material changes, we will revise the "Last updated" date at the top of this page. For significant changes — particularly those that alter how we use data for which you have given consent — we will notify registered users by email or by displaying a prominent notice on our website before the change takes effect.

We encourage you to review this page periodically to stay informed about how we protect your information. Your continued use of our website after any updates constitutes your acknowledgment of the revised policy. If you disagree with any changes, you may contact us to discuss your options or exercise your right to erasure.

Previous versions of this policy are available on request by emailing contato@softex-us.site.

Contact & Data Protection Officer

If you have any questions about this Privacy Policy, wish to exercise a data subject right, or want to report a concern about how your information has been handled, please reach out to us through the details below. We aim to acknowledge all privacy-related inquiries within two business days and to resolve them fully within the statutory timeframes described in Section 8.

Under the LGPD, Softex has designated a Data Protection Officer (Encarregado de Proteção de Dados) responsible for overseeing compliance with the law and serving as the point of contact for data subjects and the ANPD. Privacy requests directed to the email address below are handled by the DPO's office.