This Privacy Policy explains how Tandom, operated by Fintora Ltda, registered under CNPJ no. 58.554.099/0001-53, with offices in São Paulo, SP, Brazil (“Tandom”, “we”), handles personal data collected through the tandom.com.br website and through the sourcing and import services we provide. Processing follows Brazilian Law no. 13.709/2018 (the General Data Protection Law, “LGPD”).
1. Who the controller is
Tandom is the controller of personal data processed through this site and through the commercial relationship with clients and prospective clients. To exercise your rights or ask questions, use the channels in section 10.
2. What we collect
2.1. Data you give us
- Contact form: name, work email, company and whatever you write in the message.
- Supplier report: work email and your company website (domain).
- Purchase items: the description of the items you enter when using the sourcing tool.
- Commercial relationship: professional contact details of the people involved in the operation, technical specifications, volumes and the information needed for quoting, supplier qualification, importing and logistics.
2.2. Data collected automatically
Minimal technical records for the operation and security of the site, generated by our hosting infrastructure (for example access date and time and browser information). We do not use advertising cookies or third-party marketing trackers on this site.
2.3. Data we do not want to receive
We do not request sensitive personal data (art. 5, II of the LGPD) or data about children and adolescents. Please do not include that kind of information in the free-text fields on this site.
3. Why we use the data, and on what legal basis
- Responding to enquiries and conducting commercial discussions — legal basis: preliminary steps related to a contract at the data subject's request (art. 7, V) and legitimate interest (art. 7, IX).
- Delivering the contracted service (sourcing, quoting, supplier qualification, importing, financing and logistics) — legal basis: performance of a contract (art. 7, V).
- Sending the supplier report you requested — legal basis: consent (art. 7, I), which you may withdraw at any time.
- Complying with legal and regulatory obligations, including customs, tax and fraud-prevention requirements — legal basis: compliance with a legal obligation (art. 7, II).
- Security and service improvement — legal basis: legitimate interest (art. 7, IX).
We do not sell personal data, and we do not use your data to train third-party AI models.
4. Commercial confidentiality
Technical specifications, prices and the identity of suppliers associated with your operation are treated as confidential information and are never shared with other clients.
5. Who we share with
We share only what is necessary, with:
- Processors providing us infrastructure services (hosting, database, email delivery) and AI language processing, always under contract and on our instructions;
- Operational partners, where indispensable to execute your order: quoted suppliers, inspection companies, customs brokers, carriers and financial institutions;
- Public authorities, where required by law or court order.
6. International transfers
Part of our infrastructure and some operational partners (for example suppliers and providers abroad) are outside Brazil. In those cases the transfer takes place under the safeguards set out in arts. 33 and following of the LGPD, including contractual protection clauses.
7. How long we keep it
We keep data for as long as necessary for the purposes above. Commercial contacts that do not progress are deleted or anonymised within 24 months. Data from executed operations is kept for the applicable legal periods (tax, customs and limitation periods).
8. Security
We apply technical and administrative measures to protect the data, such as encrypted transmission (HTTPS), need-to-know access control and credential segregation. No system is entirely immune: in the event of an incident carrying relevant risk, we will notify data subjects and the ANPD under art. 48 of the LGPD.
9. Your rights
Under art. 18 of the LGPD you may request: confirmation that processing exists; access to the data; correction of incomplete or outdated data; anonymisation, blocking or deletion of unnecessary data or data processed unlawfully; portability; information about sharing; information about the consequences of refusing consent; and withdrawal of consent.
10. How to reach us
To exercise your rights or ask about this Policy, write to privacidade@tandom.com.br or use the contact form. We reply within the statutory period.
Data protection officer under art. 41 of the LGPD: [officer name to be filled in], reachable at privacidade@tandom.com.br.
11. Changes
We may update this Policy. The last-updated date at the top indicates the version in force; material changes will be communicated through the contact channels you gave us.