LGPD
Privacy policy
Version 1.0 · effective as of 10/27/2026
This is a courtesy translation. In case of any discrepancy, the Portuguese version prevails.
This policy explains how RB Infraenergia processes the personal data of everyone who deals with the company: website visitors, clients and their contacts, suppliers, carriers, online store buyers and employees. It follows Brazil's General Data Protection Law (Law No. 13,709/2018, "LGPD").
1. Data controller
RB Comércio e Distribuição de Materiais Elétricos Ltda. (RB Infraenergia), CNPJ (Brazilian company registration number) 11.781.800/0001-03, Rua da Mooca, 4407 – Mooca – São Paulo/SP – CEP 03165-003, Brazil.
2. Data protection officer and data subject channel
- Data protection officer (DPO): Jessé Henrique de Oliveira, jessehenrique@yahoo.com.
- Channel to exercise your rights: renato@rbinfraenergia.com.br. Please use the subject "LGPD – data subject request".
3. What data we process and why
| Situation | Data | Purpose | Legal basis (LGPD) |
|---|---|---|---|
| Website quote form | First name, last name, e-mail, phone, company, subject and message | Reply to the request and prepare a quote | Preliminary procedures to a contract (art. 7, V) |
| Service by phone, e-mail or WhatsApp | Name, contact details and conversation content | Sales and after-sales service | Art. 7, V, and legitimate interest (art. 7, IX) |
| Business clients and their contacts | Company data (legal name, CNPJ, state registration, address) and contact data (name, phone, mobile, e-mail) | Commercial proposals, orders, deliveries and invoicing | Performance of a contract (art. 7, V) and legitimate interest (art. 7, IX) |
| Invoices and tax obligations | Registration data of clients, suppliers and carriers, including the individual taxpayer number (CPF) when the issuer or recipient is an individual | Issuing, receiving, checking and keeping tax documents | Compliance with a legal obligation (art. 7, II) |
| Suppliers and carriers | Company and sales contact data | Quotes, purchases and logistics | Performance of a contract (art. 7, V) |
| Online store | Name or legal name, CPF or CNPJ, state registration, e-mail, phone, delivery address and items purchased | Process the order, issue the invoice, deliver, handle returns and warranty | Art. 7, V, and art. 7, II |
| Internal system users | Name, login, e-mail, access profile, access and action logs (audit trail) | Access control and information security | Legitimate interest (art. 7, IX) and performance of a contract (art. 7, V) |
| Employees | Registration, employment, social security and banking data | Management of the employment contract and legal obligations | Art. 7, II and V; occupational health data under art. 11, II, "a" |
We do not sell personal data and do not use it for advertising without your authorization. We do not make decisions about you based solely on automated processing.
4. Who we share data with
Only with those who need the data for the service to happen, and only to the extent necessary:
- Technology providers (processors): Oracle Cloud (hosting of the internal system, São Paulo region), Microsoft 365 (corporate e-mail), Cloudflare (hosting of the website, the store and the contact form), Resend (delivery of notification e-mails for the form and orders), the electronic invoice (NF-e) issuing service and public CNPJ lookup services;
- Operational partners: carriers (delivery), accounting firm (tax and labor obligations) and Mercado Pago (store payments — card, account or Pix data goes directly to them, and RB does not receive it);
- Public authorities, when required by law.
International transfer: some providers (for example, Cloudflare, Resend and Microsoft) may store data outside Brazil. In these cases, the transfer relies on the contractual safeguards of these providers, under art. 33 of the LGPD.
5. How long we keep data
- Tax and accounting documents: 5 years from the first day of the following fiscal year, or longer if there is an ongoing audit or legal proceeding;
- Proposals, orders and contacts of clients and suppliers: during the business relationship and for up to 5 years after the last negotiation;
- Website requests that do not result in business: up to 2 years;
- Internal system user accounts: while active and for up to 5 years after deactivation; audit trail: for the entire operation of the system, as it is a security record that cannot be altered; technical access logs: automatic rotation;
- Employee data: for the periods set by labor and social security law;
- Backups: automatically replaced in cycles of up to 30 days.
At the end of the period, data is deleted or anonymized, unless the law allows or requires it to be kept (art. 16 of the LGPD).
6. How we protect data
- Access to the internal system only with individual logins, least-privilege profiles and a server-side permission check on every operation;
- Passwords stored only as cryptographic hashes, automatic lockout after invalid attempts and sessions that expire;
- An audit trail that cannot be altered or deleted;
- Traffic always encrypted (HTTPS), database not accessible from the internet and a restrictive firewall;
- Daily backups with restore tests;
- An incident response procedure, including notification of the ANPD (Brazilian Data Protection Authority) and data subjects when there is relevant risk or harm.
7. Your rights
Under art. 18 of the LGPD, you may request: confirmation that we process your data; access; correction; anonymization, blocking or deletion of unnecessary or excessive data; portability; deletion of data processed based on consent; information about who we share data with; and withdrawal of consent, when consent is the basis for processing. You may also object to processing and file a petition with the Brazilian Data Protection Authority (ANPD).
Send your request to renato@rbinfraenergia.com.br. We may ask for information to confirm your identity. Confirmation and simplified access are answered immediately; the full statement, within 15 days (art. 19). If any data must be kept due to a legal obligation, we will explain why.
8. Cookies and browser storage
The website does not use advertising or tracking cookies. The store keeps the shopping cart in your own browser (local storage), only with product codes and quantities. The internal system uses a session cookie, which is necessary to keep the user securely signed in.
9. Changes
This policy may be updated. The version in force is always available on this page, with the date of the last change.