Privacy Policy

1. INTRODUCTION 

The companies comprising the corporate group formed by the holding company Gold Creek Investments S/A and its wholly owned subsidiaries Perfil Térmico Aquecimento e Isolamento Industrial Ltda. and Digimet Ltda., hereinafter jointly referred to as “Perfil Group”, process personal data responsibly, transparently and respectfully. Whenever you interact with us, whether as a customer, supplier, employee, partner or user of our websites, platforms or services, certain personal data may be required to enable this relationship, provide services, perform contracts and ensure the security of operations.

This Privacy Policy aims to clearly explain what data we collect, why we use this information and how it is protected. It also explains your rights and how you may exercise them.

The companies comprising Perfil Group may act either as Personal Data Controllers or Processors, depending on the nature of the activities performed, the services provided, the responsibilities contractually defined and the applicable legislation.

2. WHO ARE THE DATA SUBJECTS 

Perfil Group may process personal data of individuals who interact with the company in different day-to-day contexts. This includes, for example:

• Customers: individuals or legal entities that maintain a commercial relationship with Perfil Group, as well as the individuals responsible for their representation and contact

• Suppliers and their representatives: individuals linked to companies that supply products or services

• Employees (CLT): professionals hired by the company under an employment regime

• Service providers (PJ): professionals or companies contracted to perform specific activities

• Job applicants: individuals who participate in recruitment processes

• Website and tool users, such as simulator users: forms, simulators, digital platforms, systems or technological solutions made available by Perfil Group

• Visitors and event participants: individuals who participate in meetings, training sessions, trade fairs or events organized or supported by the company

• Other third parties: any individual who, in any way, interacts or maintains a relationship with Perfil Group

In each of these contexts, personal data is processed differently, always considering the type of relationship with Perfil Group and what is necessary for each situation.

3. PERSONAL DATA PROCESSED, PURPOSES AND LEGAL BASES 

The companies comprising Perfil Group conduct operations with distinct characteristics, including operational and commercial activities related to thermal insulation solutions, as well as technology operations, digital platforms and SaaS solutions. Personal data is processed according to the nature of each activity carried out.

The table below presents the main categories of personal data processed, with examples, purposes and their respective legal bases.

The categories and purposes above represent the most common situations involving the processing of personal data at Perfil Térmico. Other data may be processed as necessary for the development of the company’s activities, always limited to the minimum necessary, linked to a legitimate purpose and supported by an appropriate legal basis.

Perfil Group does not collect biometric data for identification or access-control purposes. Images that may be captured by monitoring systems are used exclusively for the security of people and facilities.

4. DATA SHARING 

Perfil Group may share personal data with third parties when necessary, including:

Sharing may also occur in connection with the use of technology platforms, cloud services, system operators and providers related to the technological activities and SaaS solutions made available by Perfil Group.

5. STORAGE, RETENTION AND SECURITY 

Perfil Group adopts measures to ensure that personal data is stored securely, used only when necessary and retained for an appropriate period according to its purposes.

1. Where data is stored 

The companies comprising Perfil Group may use their own infrastructure or third-party services for the storage, processing, monitoring, support and performance of administrative, industrial, commercial and technological activities.

Such storage may take place on servers located in Brazil or abroad, depending on the technology solutions used, with measures adopted to ensure adequate protection of the information.

2. How long data is retained 

Personal data is retained only for the time necessary to fulfill the purposes for which it was collected, taking into account criteria such as:

• compliance with legal and regulatory obligations

• performance of contracts and operational activities

• need for defense in judicial, administrative or arbitration proceedings

After the applicable period ends, the data is securely deleted or anonymized.

3. How data is protected 

Perfil Group adopts technical and organizational measures to protect personal data against unauthorized access, loss, alteration or any form of misuse.

The main measures include:

• access control based on role and need for use

• use of secure authentication for system access

• monitoring of access and activities (logs)

• use of controlled technology environments

• periodic backups

• employee training and awareness

These measures are continuously reviewed to ensure information security and the improvement of internal processes.

6. INTERNATIONAL DATA TRANSFERS 

Perfil Group may carry out international transfers of personal data, especially due to the use of technology services, cloud platforms, system operators and digital solutions used in its administrative, operational, commercial and technological activities.

In such cases, reasonable measures compatible with the applicable legislation will be adopted to ensure an adequate level of protection for the personal data processed.

7. DATA SUBJECT RIGHTS 

Perfil Group ensures that personal data subjects may exercise their rights, allowing you to have transparency and control over the use of your information.

Under the applicable legislation, you may request, at any time:

• confirmation of the existence of personal data processing

• access to your data

• correction of incomplete, inaccurate or outdated data

• anonymization, blocking or deletion of data, where applicable

• data portability, in accordance with applicable regulations

• information about data sharing

• withdrawal of consent, when consent is the legal basis

• objection to processing, in the cases provided for by law

1. How to exercise your rights 

To exercise their rights, the data subject must access the specific form (Data Subject Rights Request Form) made available by Perfil Group through the link available on the company’s website.

Requests will be reviewed in accordance with the applicable legislation and fulfilled within the statutory period.

To ensure information security and prevent unauthorized access, Perfil Group may request additional data or documents that allow the identity of the requester to be confirmed.

8. COOKIES AND BROWSING 

The use of cookies and similar technologies is addressed in a specific document available on the Perfil Group website. You can access our Cookie Policy on our website.

9. THIRD-PARTY LINKS (OTHER WEBSITES) 

The Perfil Group website may contain links to external pages, such as those of partners, suppliers or other companies. By clicking these links, you will be directed to environments that are not controlled by the companies comprising Perfil Group. Each of these websites has its own rules regarding the collection and use of personal data. Therefore, when accessing these websites, we recommend that you carefully read the Privacy Policies and Terms of Use available on those pages before providing any information.

Perfil Group is not responsible for the privacy practices adopted by these external websites.

10. CHANGES 

This Notice may be updated at any time, and periodic review is recommended.

11. CONTACT