Privacy Policy

1. General Information

Gestamp Brasil Industria de Autopecas S/A, registered under Tax ID No. 02.147.467/0005-18, headquartered at Av. Eurico Ambrogi Santos, 1800, Piracangaguá, Taubaté - SP, ZIP 12042-010, is committed to protecting the personal data of its customers, suppliers, employees, and website visitors, in compliance with the Brazilian General Data Protection Law (LGPD - Law No. 13.709/2018).

This Privacy Policy describes how we collect, use, store, and protect your personal information in the context of automotive parts manufacturing operations.

2. Data Collected

We may collect the following information:

• Identification data: Full name, Tax ID (CPF), Company Tax ID (CNPJ), company name
• Contact data: Email, phone number, commercial address
• Business data: Company information, industry sector, business relationship
• Commercial data: Purchase orders, technical specifications, product requirements
• Employee data: Employment information (for HR purposes)
• Payment data: Information necessary for transaction processing
• Browsing data: IP address, browser type, pages visited
• Contractual data: Supply agreements, contracts
• Quality data: Product specifications, quality certifications

3. Purpose of Data Processing

The collected data is used to:

• Manufacture and supply automotive parts
• Manage commercial relationships
• Process purchase orders
• Coordinate logistics and delivery
• Ensure quality control and certifications
• Manage supply chain
• Process payments
• Issue invoices and receipts
• Provide customer service
• Manage employee relations (HR)
• Comply with automotive industry regulations
• Comply with legal and fiscal obligations
• Improve our products and services

4. Legal Basis for Processing

Data processing is performed based on:

• Consent: When you expressly authorize the use of your data
• Contract execution: To fulfill supply and manufacturing contracts
• Legal obligation: To comply with fiscal, labor, and automotive regulatory obligations
• Legitimate interest: For business relationship management and supply chain coordination

5. Data Sharing

Gestamp Brasil does not sell or commercialize personal data. We may share data only with:

• Automotive manufacturers: For product supply coordination
• Suppliers: For raw materials and component procurement
• Logistics companies: For delivery coordination
• Quality certification bodies: For compliance verification
• Payment processors: For transaction processing
• Service providers: Manufacturing management systems, accounting
• Labor authorities: To comply with labor obligations
• Tax authorities: To comply with tax obligations
• Automotive regulatory bodies: For industry compliance
• Legal authorities: When required by law or court order

6. Data Security

We implement technical and organizational measures to protect your data:

• Encryption of payment and business data
• Access controls to commercial and employee information
• Secure manufacturing management systems
• Confidentiality agreements
• Security system monitoring
• Regular backups and secure storage
• Employee training on data protection
• Periodic security audits
• ISO compliance standards

7. Your Rights as Data Subject

Under LGPD, you have the following rights:

• Confirmation and access: Confirm the existence of processing and access your data
• Correction: Request correction of incomplete, inaccurate, or outdated data
• Anonymization, blocking, or deletion: Request removal of unnecessary data
• Portability: Request data portability
• Deletion: Request deletion of data processed with consent
• Information: Obtain information about data sharing
• Revocation: Revoke consent at any time
• Opposition: Object to the processing performed

8. Cookies and Similar Technologies

We use cookies to improve your browsing experience. You can configure your browser to refuse cookies.

9. Data Retention

We retain your data for the time necessary to:

• Fulfill the purposes described in this policy
• Duration of business relationships and contracts
• Manufacturing records: for quality and traceability purposes
• Legal prescription periods (generally 5 years for fiscal purposes)
• Labor obligations (when applicable)
• Automotive industry regulatory requirements
• Exercise of legal rights

After these periods, data will be securely deleted or anonymized.

10. International Data Transfer

As part of an international group, we may transfer data to other Gestamp entities for operational purposes, ensuring adequate protection in compliance with LGPD requirements.

11. Minors

Our services are intended for legal entities and professionals over 18 years of age. We do not intentionally collect data from minors.

12. Changes to This Policy

This Policy may be updated periodically. Significant changes will be communicated by email or website notice.

13. Data Protection Officer (DPO)

We have appointed a Data Protection Officer responsible for ensuring LGPD compliance.

14. Contact

To exercise your rights or clarify questions:

We will respond to your requests within 15 calendar days, extendable by another 15 days with justification.

15. Applicable Law and Jurisdiction

This Policy is governed by the laws of the Federative Republic of Brazil, especially Law No. 13.709/2018 (LGPD). The jurisdiction of Taubaté/SP is elected to resolve any disputes.

Last updated: December 2025