How we handle your data.

This website is operated by GRICCO International (United States) on behalf of GRICCO Group. Depending on the entity that contracts with you, the controller of your data may be GRICCO International, EKJ, LLC (United States) or GRICCO Soluções Integradas Ltda. (Macaé/RJ, Brazil, CNPJ 53.765.584/0001-52). The same principles apply to all three.

• Data you provide: name, company, business email, phone and the context you describe in the contact form, the Ethics Channel form or by email.
• Navigation data: IP address, device type, browser and pages visited, collected in aggregate by privacy-preserving analytics (no cookies, no individual identifiers).

We do not collect sensitive personal data through this website, and we ask that you not include such data in open form fields.

• Respond to contact requests and prepare proposals — preliminary procedures prior to a contract, at your request.
• Receive and investigate reports submitted to the Ethics Channel — compliance with legal obligations and legitimate interest in the integrity of the group.
• Measure and improve the website — legitimate interest, with balancing and minimisation.
• Comply with legal and regulatory obligations.

• Among the entities of GRICCO Group, when needed to answer your request or to contract the project.
• Operators and technology providers (email, hosting, analytics), bound by contract with data protection clauses.
• Public authorities, upon a legitimate request or legal requirement.

We do not sell personal data. No operator is allowed to use the data for its own purposes or to train AI models.

GRICCO Group operates in the United States and Brazil, and its providers may store data in other countries. When data crosses borders we require adequate safeguards — contractual clauses and, for data subjects in Brazil, the mechanisms of Article 33 of the LGPD.

• Commercial requests: for the duration of the relationship and the applicable legal periods after the last contact.
• Ethics Channel reports: for the period required to investigate and for the retention periods set in the Code of Ethics and applicable law.
• Navigation data: in aggregate form, for limited periods defined in the analytics tool.

Once the purpose ends, data is deleted or anonymised, except where legal retention applies.

This website uses no advertising or tracking cookies. Analytics is cookieless and does not identify you individually. Essential technical storage may be used for the website to function.

• Confirm the existence of processing and access your data.
• Correct incomplete, inaccurate or outdated data.
• Request the anonymisation, blocking or deletion of unnecessary or excessive data.
• Request data portability, where applicable.
• Withdraw consent and be informed about the sharing of your data.

To exercise your rights, contact our Data Protection Officer. The service is free and answered within 15 days.

We adopt technical and administrative measures to protect data, including encryption in transit (TLS), least-privilege access control and segregation of duties. Incidents with relevant risk are contained, assessed and notified to the competent authority and affected data subjects as required by law.

We may update this policy to reflect legal, technological or operational changes. The date at the top indicates the current version.