Privacy Policy

Source document: October 12, 2026 · English edition v39

This policy explains how DACABRA processes personal data to fulfil orders, assess business applications and provide secure access for retailers and distributors.

1. Who is responsible for your data

The controller is DACABRA ALIMENTOS E BEBIDAS LTDA, identified in the footer. Send requests for information, corrections or the exercise of rights to comercial@dacabra.net with “Privacy” as the subject.

2. Data collected and its purposes

Orders: name or business name, Brazilian tax identifier (CPF/CNPJ), email, phone number, address, products, quantities, payment method and indication of an in-person sale. This information is used to fulfil the purchase, arrange payment and delivery, provide support and meet tax obligations.

Partners: CNPJ, company and contact details, address, retailer or distributor profile and, where applicable, territory, warehouse and fleet. These details support application assessment, contact confirmation and management of the commercial relationship.

International applications: contact name, company, email, international phone number, country, city, state/province/region, business address, postal code, local tax or company registration number, business type, territory and business message are required. Website is optional. The language, submission date, privacy acknowledgement and internal review records are also recorded. Approved international companies may receive an email link to create or reset their password and access authorized catalogues and price lists. Product lines of interest and authorized lines are recorded. The optional WhatsApp checkbox records whether the supplied phone number uses WhatsApp; it does not verify the number or authorize automatic messages.

Access: account identifiers, authentication data, confirmation of registered contact details, and technical and security records are used for login, password recovery, delivery of the authorised catalogue and prevention of unauthorised access.

Support: messages and information submitted through support channels are used to resolve requests.

Provide only necessary information. We do not request banking passwords or complete card details in forms. Account access uses authentication and credential protection mechanisms.

3. Grounds for processing

Depending on the purpose, processing relies on requested pre-contractual steps, contract performance, legal obligations or legitimate interests such as security and fraud prevention. Where consent is required, it is requested specifically and may be withdrawn. Reading this notice is not blanket permission for any use of data.

4. Service providers and sharing

DACABRA does not sell, rent or pass customer data to third parties for advertising, marketing, prospecting or commercial exploitation of data.

Sharing is limited to what is strictly necessary to operate the website, fulfil the customer’s own requests and comply with the law, including processing requested orders, payments, deliveries and tax obligations. Providers are not authorised to use received data for their own marketing.

Where necessary, data is made available to providers of operational support, customer service, order processing, payments, delivery, tax, accounting or legal services. Each provider must use only relevant data for the contracted purpose, subject to protection and confidentiality obligations. Information may also be supplied to authorities when required by law or a valid order.

Automatic completion of Brazilian registration details may use company and address lookups, sending only necessary identifiers. Review and correct outdated information before submitting. The international application does not use Brazilian company or postal-code lookups.

You may request the identity of entities with which your data was actually shared through the privacy contact, under Brazil’s General Personal Data Protection Law (LGPD).

5. Storage, retention and security

Data is retained for as long as necessary for the stated purposes. Registrations and access records are used during the commercial relationship; order and support records may be retained for tax, accounting, fraud prevention and the exercise of rights. When no longer necessary and no retention grounds remain, data must be deleted or anonymised.

We use technical and administrative safeguards, including access controls, credential protection and protected communications. DACABRA is responsible for processing purposes and responding to data subjects; providers must protect data and limit its use to contracted operations.

International transfers: currently configured operations include electronic processing in the United States of data needed for the website and orders. The purpose is to enable support, secure access and fulfilment of customer requests. Processing occurs while these services are used, with retention governed by this policy and applicable obligations. Transfers must rely on the mechanisms and safeguards required by the LGPD and regulations. Further information and, where applicable, relevant clauses may be requested through the privacy contact.

6. Your rights and how to make a request

You may request confirmation of processing, access, correction, information and identification of entities with which data was shared, anonymisation, blocking or deletion of unnecessary or improperly processed data, and other rights under the LGPD. You may also withdraw consent and request deletion where applicable. Mandatory legal retention may limit immediate deletion of some records.

Email your request to us. We may request proportionate information to verify your identity and protect your data. We will respond within legal deadlines and explain any limitations. You may contact Brazil’s National Data Protection Authority through its official channels.

7. Cookies, technical storage and third parties

The website uses authentication resources and browser storage to maintain sessions, enable essential features and remember acknowledgement and acceptance of terms on later visits. The current code has no dedicated behavioural advertising or audience analytics integration. Resources used for website presentation and operation may receive technical data strictly necessary for connection and security.

After express confirmation, a first-party cookie stores only the accepted document version for up to 365 days in that browser and device. If cookies are blocked, local storage with the same duration, or session storage when necessary, may be used. This record contains no name, email or other personal data and is not used for advertising. The notice may reappear after expiry, deletion of website data, a change of browser or device, or a new document version. If all storage is blocked, confirmation lasts only for the open page.

You can manage storage through your browser settings; blocking essential resources may prevent login. If optional trackers are introduced, their purposes and controls must be explained before activation, with consent where required.

8. Updates

This notice may be updated to reflect actual operational changes. The date and version appear on this page. Material changes will be communicated appropriately without prejudice to existing rights.

International access and phone details

Approved companies can create a password using a link sent by email and download materials authorized by product line, language and business type. Requested and authorized product lines are recorded. The WhatsApp checkbox is optional and informational: it does not verify ownership of the number or activate automatic messages.

The administrator receives an email notice for each new international registration to review the application. After approval, personal links are used to confirm the email and create or recover the password. Partners can manage their username and password in their access area.