This Privacy Policy explains how Tandom, operated by Fintora Ltda, registered under CNPJ no. 58.554.099/0001-53, with offices in São Paulo, SP, Brazil (“Tandom”, “we”), handles personal data collected through the tandom.com.br website and through the sourcing and import services we provide. Processing follows Brazilian Law no. 13.709/2018 (the General Data Protection Law, “LGPD”).
1. Who the controller is
Tandom is the controller of personal data processed through this site and through the commercial relationship with clients and prospective clients. To exercise your rights or ask questions, use the channels in section 10.
2. What we collect
2.1. Data you give us
- Contact form: name, work email, company and whatever you write in the message.
- Supplier report: work email and your company website (domain).
- Guide update notices: the e-mail you voluntarily provide to receive new versions of the selected material.
- Purchase items: the description of the items you enter when using the sourcing tool.
- Commercial relationship: professional contact details of the people involved in the operation, technical specifications, volumes and the information needed for quoting, supplier qualification, importing and logistics.
2.2. Data collected automatically
Minimal technical records for the operation and security of the site, generated by our hosting infrastructure (for example access date and time and browser information).
We use audience analytics to understand and improve how the site is used: Google Analytics 4 (Google LLC) and PostHog (PostHog, Inc.). These tools use cookies and identifiers to measure pages visited, acquisition source and contact-form submissions. IP addresses are anonymised, Google advertising and signals features are disabled, and we do not use the data for targeted advertising or marketing profiling. The legal basis is our legitimate interest (art. 7, IX of the LGPD) in maintaining and improving the site. Processing may involve international data transfers (art. 33 of the LGPD), subject to the provider's contractual safeguards.
To measure use of our guides, the site also creates a first-party random identifier in the browser. In a limited set of fields it records a page view, the button or preview selected, a download, and returns through contextual links in the PDF or AI-assistant edition. Direct requests for the AI editions may record the format and a broad client class (browser, search crawler, training crawler, user-directed agent or other); the raw browser user agent is discarded. These records receive no e-mail, name, IP address or free text. If you later submit a form voluntarily, the same identifier may accompany the contact to connect the earlier journey to the enquiry and evaluate the material's usefulness. Tandom does not receive the content of or questions asked in a Project. These data are not used for advertising, data enrichment or device fingerprinting.
PostHog also records navigation within the site (pages, clicks and scrolling) and may record a browsing session for usability diagnosis. Content typed into form fields is masked and is not recorded. PostHog data is hosted in the United States, which is also an international transfer under art. 33 of the LGPD, subject to the provider's contractual safeguards.
You may block these cookies and remove the first-party identifier by clearing this site's data in your browser settings, or install the Google Analytics opt-out add-on. The site will continue to work normally. We do not use advertising cookies or third-party tracking for marketing purposes.
2.3. Data we do not want to receive
We do not request sensitive personal data (art. 5, II of the LGPD) or data about children and adolescents. Please do not include that kind of information in the free-text fields on this site.
3. Why we use the data, and on what legal basis
- Responding to enquiries and conducting commercial discussions — legal basis: preliminary steps related to a contract at the data subject's request (art. 7, V) and legitimate interest (art. 7, IX).
- Delivering the contracted service (sourcing, quoting, supplier qualification, importing, financing and logistics) — legal basis: performance of a contract (art. 7, V).
- Sending the supplier report you requested — legal basis: consent (art. 7, I), which you may withdraw at any time.
- Notifying you about new versions of a guide — legal basis: consent (art. 7, I), which you may withdraw at any time.
- Complying with legal and regulatory obligations, including customs, tax and fraud-prevention requirements — legal basis: compliance with a legal obligation (art. 7, II).
- Security and service improvement — legal basis: legitimate interest (art. 7, IX).
We do not sell personal data, and we do not use your data to train third-party AI models.
4. Commercial confidentiality
Technical specifications, prices and the identity of suppliers associated with your operation are treated as confidential information and are never shared with other clients.
5. Who we share with
We share only what is necessary, with:
- Processors providing us infrastructure services (hosting, database, email delivery) and AI language processing, always under contract and on our instructions;
- Operational partners, where indispensable to execute your order: quoted suppliers, inspection companies, customs brokers, carriers and financial institutions;
- Public authorities, where required by law or court order.
6. International transfers
Part of our infrastructure and some operational partners (for example suppliers and providers abroad) are outside Brazil. In those cases the transfer takes place under the safeguards set out in arts. 33 and following of the LGPD, including contractual protection clauses.
7. How long we keep it
We keep data for as long as necessary for the purposes above. Events associated with the guides' random identifier are deleted or anonymised within 12 months. Commercial contacts that do not progress are deleted or anonymised within 24 months. Data from executed operations is kept for the applicable legal periods (tax, customs and limitation periods).
8. Security
We apply technical and administrative measures to protect the data, such as encrypted transmission (HTTPS), need-to-know access control and credential segregation. No system is entirely immune: in the event of an incident carrying relevant risk, we will notify data subjects and the ANPD under art. 48 of the LGPD.
9. Your rights
Under art. 18 of the LGPD you may request: confirmation that processing exists; access to the data; correction of incomplete or outdated data; anonymisation, blocking or deletion of unnecessary data or data processed unlawfully; portability; information about sharing; information about the consequences of refusing consent; and withdrawal of consent.
10. How to reach us
To exercise your rights or ask about this Policy, write to privacidade@tandom.com.br or use the contact form. We reply within the statutory period.
Data protection officer under art. 41 of the LGPD: [officer name to be filled in], reachable at privacidade@tandom.com.br.
11. Changes
We may update this Policy. The last-updated date at the top indicates the version in force; material changes will be communicated through the contact channels you gave us.