Privacy Policy

Last updated: October 12, 2026

1. Who we are and who this Policy applies to

This Privacy Policy explains how TCI Securitizadora S.A. ("TCI", "we", "us"), registered with the Brazilian corporate taxpayer number (CNPJ) 63.862.447/0001-90, with its registered office at Rua Minas de Prata, 1726, conjunto 152 (Spazio JK), Vila Olímpia, São Paulo/SP, CEP 04552-080, processes the personal data of people who use the website site.tci-br.com.

For the purposes of the Brazilian General Data Protection Law (Law No. 13,709/2018, "LGPD"), TCI is the controller of the personal data processed on this website, that is, the party that decides how and why the data is used.

This Policy applies to the website site.tci-br.com, in its Portuguese and English versions, and to the addresses that redirect to it. It does not apply to third-party websites we link to.

The use of cookies and of the browser's local storage is described in our Cookie Policy, which is part of this Policy.

If you have any questions, please contact our Data Protection Officer through the channel in section 12.

2. Definitions

• Personal data: information relating to an identified or identifiable natural person, such as name, e-mail address, phone number or IP address.
• Data subject: the natural person to whom the personal data refers, that is, you.
• Processing: any operation performed on personal data, such as collection, use, storage, transmission, sharing and deletion.
• Controller: the party that makes the decisions about the processing. On this website, TCI.
• Processor: a party that processes personal data on behalf of the controller, such as hosting and e-mail providers.
• Data Protection Officer (DPO): the person appointed by the controller to act as the communication channel with data subjects and with the National Data Protection Authority (in the LGPD, the "Encarregado").
• ANPD: the Brazilian National Data Protection Authority, which enforces the LGPD.

3. What data we process, why, and on what legal basis

We only process the data described below. This website does not use third-party audience analytics tools (such as Google Analytics), does not display ads, does not use social media pixels and does not sell personal data. Visit statistics are counted by the website itself, anonymously and without cookies (section 3.2). Nor do we use your data to build a behavioral profile.

3.1. Contact form

When you use the "Schedule a conversation" form, we process:

• Data you type in: name, e-mail, company, phone number, the subject, if you choose one (an optional field with a fixed list of options), and your message.
• Data added by the website: the language and page from which the message was sent, the date and time it was sent and the originating IP address.

Next to the form there is also a link to talk to our team on WhatsApp. In that case, nothing you write goes through the form or through our website (the website only counts the click, without identifying you), and section 3.5 applies.

Why: to reply to your message, to your request for a meeting or for a proposal. The message is stored in the website's database and sent by e-mail to our team, with your e-mail address as the reply-to address.

Legal basis: preliminary procedures related to a contract, at your request (LGPD, art. 7, V). When the message is not related to hiring our services (for example, press or other matters), our legitimate interest in replying to those who contact us (art. 7, IX).

3.2. Access logs and security

When you visit the website, the server automatically records the IP address, the date and time of access, the address requested (including the link parameters), the address of the page you came from (referer), the browser used (user agent) and the result of the request. On the forms, we also use automated anti-bot and anti-flooding mechanisms, which use the IP address and the time taken to fill in the form.

Why: to comply with the legal obligation to keep access logs of internet applications, to protect the website against attacks and abuse, to investigate failures and, if necessary, to defend our rights.

Legal basis: compliance with a legal obligation (LGPD, art. 7, II, together with art. 15 of the Brazilian Civil Rights Framework for the Internet, Law No. 12,965/2014), legitimate interest in the security of the website (art. 7, IX) and the regular exercise of rights (art. 7, VI).

Access statistics: the website itself counts, per day, the pages viewed, the language, the source of the visit (only the name of the website you came from, such as "google.com", or the campaign source stated in the link, provided it is on a fixed list of names, such as "linkedin" or "newsletter"), the type of device (mobile phone, tablet or computer), the clicks on WhatsApp links and the form submissions (only the fact that a form was sent, not what you typed).

In the statistics, only these daily totals are stored, without the time of day: the address you came from and the browser identification (user agent) are read at the time of access and discarded right away — all that remains of them is the name of the source website (or a generic category, such as "IP address", "local network" or "other sources") and the type of device. This applies to the statistics; the server's access log, described at the beginning of this section, is separate and follows the period in section 6. The statistics do not use cookies or local storage and do not store IP addresses or identifiers: they cannot identify you or follow your browsing and, therefore, are not personal data (LGPD, art. 12). To the extent that reading the access data at that moment involves personal data, the legal basis is our legitimate interest in understanding how the website is used and improving it (art. 7, IX). The totals are kept for 25 months.

3.3. Cookies and local storage

This website only uses one strictly necessary cookie, which protects the contact form, and one local storage item that records that you have already seen the cookie notice. Both are first-party: no third-party service stores cookies when our pages load. The full list is in our Cookie Policy.

3.4. Links to other websites

The website may contain links to third-party websites, which have their own privacy policies. Data you provide on those websites does not pass through ours.

This is the case of the "Customer Area" link, which leads to a partner's receivables platform operated by a third party, and of the WhatsApp and Instagram links, services of Meta Platforms.

3.5. WhatsApp service (website links and Shift Advance page)

The website has links that open a conversation with TCI on WhatsApp: next to the form on the home page, in the footer of every page and on the Shift Advance page. When you click, you leave our website: the link opens the WhatsApp app or web page (wa.me). The links on the home page and in the footer come with a short message already written ("Hi! I found you on the TCI website."), which you can change or delete before sending. The website only records, for the statistics in section 3.2, that a WhatsApp link was clicked, without identifying you.

The data you enter in the form on the Shift Advance page is not sent to our website either: when you click send, your browser composes a message with that data (name, company, phone number, e-mail, subject and message) and opens a WhatsApp link (wa.me) with that text ready to go. When the link opens, the text already passes through WhatsApp's servers, but the message only reaches our team if you confirm sending it in WhatsApp itself. The website only records, for the statistics in section 3.2, that a form was sent, without its content.

When you send the message, our team receives, besides what you wrote, your phone number and your WhatsApp profile name and photo (according to your privacy settings in the app). The conversation stays in TCI's WhatsApp account, outside the website and the website's database.

From then on, the conversation takes place on WhatsApp, a service of Meta Platforms, which has its own privacy policy and also processes the data for its own purposes. The first reply may be an automated message from our WhatsApp account.

Because the text is placed in the address of the WhatsApp link, it may be recorded in your browser history.

Why: to start and carry on the conversation you requested.

Legal basis: preliminary procedures related to a contract, at your request (art. 7, V). Where the conversation is not related to engaging our services, our legitimate interest in replying to those who contact us (art. 7, IX).

4. Who we share data with

We do not sell or rent personal data. We only share data to the extent necessary, with:

• Amazon Web Services (AWS): hosting of the website and its database, on servers in the United States. Acts as a processor.
• Google (Google Workspace): sending and receiving the e-mails of the contact form (the message the website sends to our team and our team's replies to you). Acts as a processor; data may be processed in the United States and in other countries where Google has infrastructure.

• WhatsApp (Meta Platforms): only if you use one of the website's WhatsApp links or the form on the Shift Advance page. The text passes through WhatsApp when the link opens and reaches our team if you confirm sending it. WhatsApp processes the data under its own policy.

• Public authorities: when there is a legal obligation or a court or administrative order, such as a request for access logs under the Brazilian Civil Rights Framework for the Internet.
• Professional advisers: lawyers and auditors, when necessary to exercise or defend rights, always under a duty of confidentiality.
• In corporate transactions: in the event of a merger, acquisition, consolidation or sale of assets, data may be transferred to the successor, who will be bound by this Policy.

Within TCI, only the people who need the data to serve you or to keep the website running have access to it.

5. International data transfers

Because the website is hosted on AWS in the United States and e-mails go through Google Workspace, your personal data is transferred outside Brazil.

WhatsApp may also process data outside Brazil.

These transfers comply with art. 33 of the LGPD. Where the transfer is necessary to handle your contact request or to perform a contract with you, it relies on art. 33, IX, of the LGPD; in other cases, on the contractual data protection safeguards offered by these providers, including, where applicable, the standard contractual clauses approved by the ANPD (ANPD Resolution CD/ANPD No. 19/2024).

You may ask our Data Protection Officer (section 12) for more information about these transfers, including the safeguards adopted.

6. How long we keep data

We only keep data for as long as necessary for the purposes described, to comply with legal obligations or to exercise rights. The retention periods are:

At the end of the period, data is deleted or anonymized, unless the law allows or requires it to be kept (LGPD, art. 16). Database backups may contain this data for a limited additional period, until they are replaced by newer copies.

7. How we protect data

We take technical and administrative measures to protect personal data against unauthorized access, loss and improper alteration, including:

• an always-encrypted connection (HTTPS), with HSTS, which forces the browser to use the secure connection;
• cookies that cannot be read by page scripts (HttpOnly) and protection against cross-site request forgery (CSRF) on all forms;
• a limit on submissions per IP address and automated anti-bot filters on the forms;
• access to the server and the database restricted to authorized people.

No system is completely immune to failures. If a security incident occurs, we will follow the procedure in section 11.

8. Your rights as a data subject

Your personal data belongs to you. The LGPD (art. 18) gives you the right to request, at any time:

1. confirmation that we process your data;
2. access to your data;
3. correction of incomplete, inaccurate or outdated data;
4. anonymization, blocking or deletion of data that is unnecessary, excessive or processed in breach of the LGPD;
5. portability of your data to another provider, in accordance with ANPD regulations;
6. deletion of data processed on the basis of your consent, where applicable;
7. information about the public and private entities with which we share your data;
8. information about the possibility of not giving consent and the consequences of refusing, when processing depends on consent;
9. withdrawal of consent, when processing is based on it;
10. objection to processing carried out on another legal basis, in the event of non-compliance with the LGPD;
11. review of decisions made solely on the basis of automated processing (see section 9).

Please provide us with true and up-to-date data. If any of your data is wrong, you may ask us to correct it at any time.

How to exercise your rights: send your request to lgpd@tci-br.com. There is no charge. To protect your data, we may ask for information to confirm your identity before handling the request.

Response times: confirmation that we process your data and access to it in simplified form are provided immediately. A complete statement, including the origin of the data, the criteria used and the purpose of the processing, is provided within 15 days of your request (LGPD, art. 19). Other requests are answered within 15 days.

If we cannot fulfill a request, for example because the law requires us to keep certain data, we will explain why. If the request involves documents containing other people's data, we will only provide your data.

You may also file a petition with the ANPD (www.gov.br/anpd) or with consumer protection bodies (LGPD, art. 18, paragraphs 1 and 8). We encourage you to contact us first: we want to resolve your request.

9. Automated decisions

We do not make decisions affecting your interests based solely on automated processing of personal data. The only automated screening on the website is the anti-bot filtering on the forms: a message flagged as suspicious is recorded in the website's database but is not automatically forwarded by e-mail to our team. If you sent a message and did not receive a reply within a few days, please write to lgpd@tci-br.com and we will check the record.

10. Children and adolescents

This website is aimed at companies and professionals and is not intended for anyone under 18. We do not knowingly collect data from children or adolescents. If we learn that we have received data from a minor without the authorization required by law, we will delete it.

11. Security incidents

If a security incident involving personal data occurs that may cause significant risk or harm to data subjects, we will notify the ANPD and the affected data subjects within 3 business days of becoming aware of the incident, as required by art. 48 of the LGPD and ANPD Resolution CD/ANPD No. 15/2024. The notice will describe what happened, which data was affected, the risks and the measures taken.

12. Data Protection Officer and contact channel

The Data Protection Officer of TCI can be contacted by e-mail at lgpd@tci-br.com (LGPD, art. 41, and ANPD Resolution CD/ANPD No. 18/2024).

Use this channel for questions about this Policy, to exercise your rights or to report any suspected misuse of your data.

Postal address: TCI Securitizadora S.A., Rua Minas de Prata, 1726, conjunto 152 (Spazio JK), Vila Olímpia, São Paulo/SP, CEP 04552-080, attention: Data Protection Officer.

13. Changes to this Policy

We may update this Policy to reflect changes to the website, our services or the law. The date of the last update is always shown at the beginning of the document.

If a change requires your consent, we will ask for it specifically before the new processing begins.

14. Governing law

This Policy is governed by Brazilian law, in particular the LGPD and the Brazilian Civil Rights Framework for the Internet. You always retain the right to bring any dispute before the courts of your place of residence, where the law so provides.

This Policy is also available in Portuguese. In the event of any discrepancy between the versions, the Portuguese version prevails.

If any provision of this Policy is held invalid, the remaining provisions remain in effect.