Privacy Policy

Rukam respects the privacy of its customers, users and other individuals who interact with our digital channels. This Privacy Policy explains which personal data may be processed, for what purposes, with whom it may be shared, how long it may be retained and what rights data subjects have.

Personal data is processed in accordance with applicable law, especially Brazilian Law No. 13,709/2018 — the Brazilian General Data Protection Law (LGPD).

1. Who is the data controller

For personal data processing activities in which it determines the purposes and essential means of processing, the controller is:

WINSLEY DE OLIVEIRA EPP
Trade name: RUKAM Informática
CNPJ: 04.013.594/0001-26
São Paulo — SP — Brazil

Requests related to privacy and personal data protection may be sent to:

Email: [email protected]
Subject: Dados LGPD

To help us identify and correctly route the request, please use “Dados LGPD” in the email subject line.

2. What are personal data and processing

Personal data means information related to an identified or identifiable natural person, such as name, CPF, telephone number, address, email address and other information that, alone or together, may allow identification.

Processing of personal data includes operations such as collection, use, access, storage, sharing, updating, organization and deletion of personal data.

3. Personal data we may process

Depending on how the data subject uses the website or interacts with Rukam, the following data may be processed:

• registration and identification data: name, CPF, telephone number, email address, address and information required for registration;
• data related to legal entities: information about representatives, responsible persons, purchasers, contacts and other natural persons linked to the transaction;
• commercial and order data: purchased products, values, order history, shipping method, delivery address and communications related to the purchase;
• tax data: information required to issue and maintain tax documents and comply with tax obligations;
• payment-related data: information required to identify, approve and reconcile the transaction, according to the payment method used;
• customer service data: messages, emails, requests, support records, warranty matters and other communications with Rukam.

4. Data processed by the e-commerce platform

Rukam's online store uses the technological infrastructure provided by Nuvemshop. In connection with those services, the platform may process personal data, technical records, cookies and other information required for the operation of the online store, in accordance with its applicable policies and terms.

Rukam does not have direct access to all technical data or information processed exclusively through the platform's infrastructure.

5. How data is obtained

Personal data may be obtained:

• directly from the data subject during registration, purchase, customer service, quotation requests, support or warranty service;
• from companies and representatives involved in a commercial transaction;
• from service providers used for payments, logistics or other activities necessary for the operation;
• from public databases and officially available sources when consultation is necessary and legally permitted, including registration, tax or commercial validations.

6. How we use personal data

Rukam may process personal data to:

• create registrations and manage customer information;
• process orders, payments, invoicing, picking, dispatch and delivery;
• issue and retain tax documents and comply with legal, tax, accounting and fiscal obligations;
• perform registration, tax and commercial checks necessary for the transaction;
• provide customer service, technical support, warranty service, exchanges and returns;
• respond to requests, questions and communications submitted by customers;
• maintain records necessary in connection with purchases, payments, deliveries, customer service and warranties.

Rukam's processing of personal data will be carried out in accordance with the legal grounds permitted under the LGPD and other applicable rules.

7. Data sharing

Rukam does not sell personal data as a business activity. However, certain data may be processed or shared, to the extent necessary for the relevant transaction, with:

• Nuvemshop, as the provider of the technological platform used by the online store;
• financial institutions, acquirers, payment intermediaries and payment service providers;
• carriers, logistics operators and service providers involved in delivery;
• accounting, tax or technology service providers necessary for the operation;
• public authorities, tax authorities, regulators or judicial authorities when required by law, a valid request or an applicable order.

Sharing will be limited to the information necessary for the relevant purpose and transaction.

8. Payment methods and intermediaries

Available payment methods and their respective intermediaries may change over time and will be identified among the payment options presented on the website.

Data processing related to each payment method will follow the conditions applicable to the relevant transaction and service provider.

Rukam may receive and retain information related to payment identification and reconciliation, transaction status and records required for customer service, invoicing and compliance with legal obligations.

9. Google Analytics and YouTube Studio

Rukam uses services such as Google Analytics and YouTube Studio. These services may carry out their own processing of data and technical information in accordance with their respective privacy policies and terms.

Rukam has access to the metrics and information made available by these services, but does not have direct access to all technical data or identifiers processed by the respective providers.

10. Cookies and platform technologies

The e-commerce platform used by Rukam may use cookies and similar technologies required for online store functionality, session maintenance, shopping cart functions, security and other platform resources.

Nuvemshop may also perform other processing related to the use of its infrastructure in accordance with its own privacy policies and terms.

Rukam does not have direct access to all technical data, identifiers or information processed through Nuvemshop's infrastructure.

When accessing the online store, the user may see the cookie notice provided by the platform.

11. Data retention and deletion

Personal data will be retained for the period necessary to fulfil the purposes that justified its processing and thereafter for the periods required for legal, regulatory, tax or contractual obligations and other situations permitted by law.

When there is no longer a lawful basis for retaining the data, it may be deleted, anonymized or otherwise retained as permitted by applicable law.

12. Information security

Rukam adopts technical and administrative security measures compatible with the nature of its operations, seeking to protect personal data against unauthorized access and accidental or unlawful destruction, loss, alteration, disclosure or improper processing.

Information transmitted through the website uses security resources made available by the platform and applicable technology providers. No digital environment can be considered completely risk-free.

Users should also contribute to the security of their accounts by keeping credentials confidential and informing Rukam of any suspected unauthorized access.

13. Data subject rights

Under the LGPD and subject to applicable legal requirements and limitations, the data subject may request, among other rights:

• confirmation of the existence of processing;
• access to personal data;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed data;
• data portability, when applicable and subject to current regulations;
• information about public and private entities with which data has been shared;
• information about the possibility of refusing consent and the consequences, where consent is the applicable legal basis;
• withdrawal of consent, when applicable;
• deletion of data processed on the basis of consent, subject to statutory retention requirements;
• objection to processing carried out in violation of the LGPD, where applicable;
• review of decisions made solely on the basis of automated processing that affect the data subject's interests, when applicable;
• petitioning the Brazilian National Data Protection Authority, subject to applicable procedures.

14. How to exercise your rights

Requests related to personal data processing must be sent to [email protected] using “Dados LGPD” as the email subject.

To protect the data subject's own information and prevent fraudulent requests, Rukam may request sufficient information to confirm the identity and legitimacy of the requester before responding to certain requests.

Requests will be reviewed and answered within the time limits and conditions established by applicable law.

15. International transfers and processing

Some technology providers used by Rukam may process or store personal data on infrastructure located outside Brazil. Where an international transfer of personal data occurs, the requirements and mechanisms permitted under Brazilian data protection law will be observed.

16. Security incidents

If a security incident involving personal data occurs, Rukam will adopt assessment, containment and response measures appropriate to the incident and, where legal or regulatory requirements are met, will make the applicable notifications to data subjects and the Brazilian National Data Protection Authority.

17. Changes to this Policy

This Privacy Policy may be updated to reflect changes in legislation, services, technologies used or Rukam's internal procedures. The current version will always be available on this page.

Last updated: September 15, 2026.