PRIVACY POLICY - KALVELAGE
COMPANY IDENTIFICATION
INDÚSTRIA E COMÉRCIO DE BEBIDAS KALMAE LTDA, owner of the KALVELAGE brand, a private legal entity registered under CNPJ number 15.264.747/0002-05, with a branch office located at Rua Indaial, number 115, Victor Konder neighborhood, ZIP code 89012-060, in the city of Blumenau, State of Santa Catarina, Brazil, hereinafter referred to simply as “Kalvelage,” “company,” or “we,” is fully committed to protecting the privacy and personal data of all its users, customers, suppliers, and business partners.
LEGAL FOUNDATION AND COMMITMENT
This Privacy Policy has been developed in strict compliance with the General Personal Data Protection Law, Federal Law number 13.709, dated August 14, 2018, known by the acronym LGPD, as well as other applicable regulations for personal data protection in Brazilian territory. This policy is an integral part of the company’s comprehensive compliance program with data protection legislation and represents our firm commitment to transparency, security, and respect for fundamental privacy rights.
SCOPE OF APPLICATION
This Privacy Policy applies broadly and without restriction to all personal data collected, processed, stored, or handled by Kalvelage through any means, channels, or platforms, including but not limited to: our official website and its related pages, mobile applications developed or licensed by the company, physical and digital forms used in our commercial operations, social media platforms where we maintain an official presence, direct communications conducted via email, telephone, instant messaging, or other communication means, commercial events, industry fairs, corporate presentations, and any other forms of in-person or virtual interaction between the company and data subjects.
AGE RESTRICTION
It is important to note that all products commercialized by Kalvelage are distilled alcoholic beverages, whose sale and consumption are legally restricted to individuals over eighteen years of age. Consequently, our services, website, applications, and other communication channels are intended exclusively for individuals who have reached the age of majority. The company does not intentionally collect personal data from minors and, should we become aware of such accidental collection, we will immediately proceed to delete such data from our systems.
TECHNICAL AND CONCEPTUAL DEFINITIONS
For clarity and precision in interpreting this policy, we establish the following definitions: When we use the terms “Kalvelage,” “company,” “we,” “our,” or “us,” we are referring to INDÚSTRIA E COMÉRCIO DE BEBIDAS KALMAE LTDA and its operations. The terms “you,” “your,” “data subject,” “user,” or “customer” refer to natural persons whose personal data are subject to processing by our company, including actual customers, potential customers, website visitors, application users, individual suppliers, employees, service providers, and any other persons who interact with us.
Personal data is defined as any information related to an identified or identifiable natural person, including but not limited to full name, document numbers such as CPF and ID, email address, telephone numbers, residential or commercial address, date of birth, professional information, and any other data that allows direct or indirect identification of the data subject.
Personal data processing comprises any and all operations performed with personal data, such as collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, elimination, evaluation, control, modification, communication, transfer, dissemination, or extraction of information.
CATEGORIES OF DATA COLLECTED
Kalvelage collects different categories of personal data, always observing the principles of necessity, adequacy, and proportionality. Registration data includes full name, identification document numbers such as CPF and ID, date of birth, gender, marital status, information about parentage, and other personal identification information that may be necessary for establishing commercial relationships or complying with legal obligations.
Contact data encompasses complete residential or commercial address, including street, number, complement, neighborhood, city, state, and ZIP code, personal or professional email addresses, landline and mobile telephone numbers, as well as other means of communication that the data subject may voluntarily provide.
We also collect commercial data related to product preferences, purchase and transaction history, area of commercial interest, information about participation in events or promotions, feedback on products and services, and other information relevant to improving our commercial offering.
Navigation data includes technical information automatically collected when you interact with our digital channels, such as IP address, browser type used, operating system, pages visited, time spent, access origin, cookies, and other similar tracking technologies.
DATA COLLECTION METHODS
Personal data collection by Kalvelage occurs through active and passive methods. Active collection happens when you voluntarily provide your information through filling out forms on our website, creating an account or registering in our systems, sending messages through our contact channels, participating in events, fairs, or commercial presentations, subscribing to newsletters or distribution lists, participating in satisfaction surveys or market studies, and establishing direct commercial relationships.
Passive collection occurs automatically through technologies implemented in our digital channels, including cookies, web beacons, tracking pixels, and other similar technologies that record your interaction with our websites and applications. These technologies allow us to improve user experience, personalize content, analyze navigation patterns, and optimize the performance of our digital platforms.
COOKIES AND SIMILAR TECHNOLOGIES POLICY
We use cookies and similar technologies to enhance your experience on our digital channels. Cookies are small text files stored on your device that allow us to recognize your preferences, improve website functionality, personalize presented content, analyze traffic and browsing behavior, facilitate authentication and login processes, and maintain personalized settings.
You have full control over cookie usage through your browser settings, being able to disable or restrict their use. However, it is important to note that disabling cookies may affect the functionality and user experience of our websites and applications.
PURPOSES OF DATA PROCESSING
All personal data collected by Kalvelage is used for specific, legitimate, and clearly defined purposes. The main purposes include presenting and commercializing our distilled beverage products, executing sales contracts and service provision, processing orders and commercial transactions, commercial and institutional communication with customers and prospects, customer service and technical support, developing and improving products and services, conducting market research and commercial analyses, complying with legal and regulatory obligations, exercising rights in administrative or judicial processes, preventing fraud and illicit activities, and maintaining the security of our systems and operations.
LEGAL BASES FOR PROCESSING
Personal data processing by Kalvelage is always based on valid legal bases as established by the LGPD. We use free, informed, specific, and unequivocal consent from the data subject when necessary, especially for marketing communications and use of data for purposes not essential to the commercial relationship.
Contract execution or pre-contractual procedures constitutes a legal basis for processing data necessary to fulfill contractual obligations assumed with the data subject. Compliance with legal or regulatory obligations justifies processing when required by regulations applicable to our sector of activity.
Regular exercise of rights in judicial, administrative, or arbitral processes supports processing necessary for defending rights or complying with official determinations. We also use legitimate interest as a legal basis, always preceded by careful evaluation that weighs our legitimate commercial interests against the rights and expectations of data subjects, ensuring no harm to fundamental privacy rights.
DATA SHARING AND TRANSFER
Kalvelage adopts a restrictive policy regarding personal data sharing, doing so only when necessary and always with appropriate safeguards. We share data with specialized service providers who act as processors on our behalf, including data hosting and storage providers, information technology companies, marketing and communication service providers, financial institutions for payment processing, and other suppliers essential to our operations.
All service providers are carefully selected and contractually obligated to maintain the same level of data protection that we apply internally. Sharing with public authorities occurs exclusively when required by law or judicial determination.
Some of our service providers may be located in other countries, resulting in international data transfer. In such cases, we ensure that the destination country has an adequate level of data protection or we implement appropriate contractual safeguards, such as standard contractual clauses approved by competent authorities.
DATA SECURITY AND PROTECTION
Personal data security is an absolute priority for Kalvelage. We implement robust technical and organizational measures to protect data against unauthorized access, alteration, disclosure, or destruction. Our security measures include encryption of sensitive data in transit and at rest, strict access controls based on the need-to-know principle, continuous monitoring of systems and networks, implementation of firewalls and intrusion detection systems, regular and secure backups, continuous employee training on information security, and periodic security audits.
We maintain a security incident response plan that establishes clear procedures for identifying, containing, evaluating, and notifying potential data breaches. In case of an incident that may result in risk to the rights and freedoms of data subjects, we will proceed to notify the National Data Protection Authority and affected data subjects within the legal timeframes established.
DATA RETENTION AND DELETION
Personal data is retained by Kalvelage only for the time necessary to fulfill the purposes for which it was collected or as required by legal obligations. We establish clear criteria for data retention: contractual data is maintained during the contract term and for additional periods required by applicable legislation, marketing data is retained until consent revocation by the data subject, data necessary for legal obligation compliance is maintained for periods established by law, and unnecessary or excessive data is immediately deleted.
Data deletion is performed securely and irreversibly, using methods that prevent information recovery. We maintain records of deletion activities for audit purposes and compliance demonstration.
DATA SUBJECT RIGHTS
The LGPD grants data subjects a comprehensive set of rights that Kalvelage commits to fully respect. Data subjects have the right to confirmation of the existence of processing of their personal data, access to personal data processed by the company, correction of incomplete, inaccurate, or outdated data, anonymization, blocking, or deletion of unnecessary data or data processed in non-compliance with the law, portability of data to another service provider according to ANPD regulation, deletion of personal data except in cases of retention provided for by law, information about public and private entities with which data has been shared, information about the possibility of not providing consent and its consequences, and revocation of consent at any time.
EXERCISING RIGHTS
To exercise any of the rights provided for in the LGPD, data subjects must contact us through the official channel established for data protection matters: lgpd@kalmae.com.br. Requests must include clear identification of the data subject, specific description of the right they wish to exercise, and documentation proving the identity of the requester.
We commit to responding to all requests within a maximum period of fifteen business days, which may be extended for an equal period with express justification. The exercise of data subject rights is always free, except in cases of manifestly unfounded or excessive requests.
COMMUNICATION CHANNEL AND DATA PROTECTION OFFICER
Kalvelage has designated a specific channel for handling matters related to personal data protection. The email address lgpd@kalmae.com.br serves as the official channel for exercising rights, clarifying doubts, receiving complaints, and communicating with our data protection officer.
The data protection officer acts as a communication bridge between the company, data subjects, and the National Data Protection Authority, being responsible for receiving communications, providing clarifications, and taking measures as determined by the ANPD.
EXTERNAL LINKS AND RESPONSIBILITIES
Our website may contain links to third-party sites, including business partners, suppliers, or other companies. We clarify that we have no control over the privacy practices of these external sites and are not responsible for their data protection policies. We strongly recommend that users read the privacy policies of all sites they visit through links on our platforms.
POLICY CHANGES
This Privacy Policy may be updated periodically to reflect changes in our practices, changes in applicable legislation, or improvements in our data protection processes. Significant changes will be communicated to data subjects through our usual communication channels, including email notification when appropriate.
The most current version of this policy will always be available on our website, with clear indication of the last update date. We recommend that users periodically review this policy to stay informed about our data protection practices.
APPLICABLE LAW AND JURISDICTION
This Privacy Policy is governed entirely by Brazilian legislation, especially the General Personal Data Protection Law and other applicable regulations. Any controversies arising from the interpretation or application of this policy will be submitted to the jurisdiction of the competent courts of the district of Blumenau, State of Santa Catarina, with express waiver of any other forum, however privileged it may be.
FINAL PROVISIONS
Kalvelage reaffirms its commitment to protecting the privacy and personal data of all individuals who interact with our company. We maintain a continuous program for improving our data protection practices, including regular employee training, updating security measures, and periodic review of our processes.
For additional clarification on technical terms or concepts related to data protection, we recommend consulting the official glossary provided by the National Data Protection Authority on its institutional website.
This policy takes effect immediately and remains valid until eventual replacement by a new version duly publicized.
Last updated: January 2025
Version: 2.0
Contact for privacy matters: lgpd@kalmae.com.br
