RIOBAIANO GLOBAL PRIVACY POLICY

Last Updated: October 1, 2026

RIOBAIANO INDÚSTRIA DE CONFECÇÕES LTDA. (“RIOBAIANO”, “we”, “us” or “our”) is a Brazilian limited liability company registered under CNPJ No. 29.122.464/0001-52.

RIOBAIANO respects your privacy and is committed to protecting your personal information and Personal Data.

This Privacy Policy explains how RIOBAIANO collects, uses, stores, discloses, transfers and protects Personal Data when you visit or use our website, create an account, purchase our products, contact us, subscribe to our communications, interact with our advertising or otherwise interact with RIOBAIANO.

Because RIOBAIANO may sell and ship products internationally, this Privacy Policy is intended to address applicable privacy and data-protection requirements in Brazil and, where applicable, other jurisdictions in which our customers are located, including the European Economic Area, the United Kingdom, Switzerland, the United States and other countries.

The rights and obligations described in this Privacy Policy may vary depending on the laws applicable to you.

Where applicable law requires consent, we will obtain such consent through an appropriate mechanism. This Privacy Policy does not itself constitute consent where applicable law requires separate affirmative consent.

1. WHO IS RESPONSIBLE FOR YOUR PERSONAL DATA?

The entity responsible for the processing of your Personal Data is:

RIOBAIANO INDÚSTRIA DE CONFECÇÕES LTDA.

CNPJ: 29.122.464/0001-52

Country: Brazil

Privacy and Data Protection Contact / Data Protection Officer (DPO):
Daniel Ribeiro

Email: contato@danielribeiro.adv.br

If you have questions, requests or concerns regarding the processing of your Personal Data, you may contact us through the email address above.

2. WHAT IS PERSONAL DATA?

For purposes of this Privacy Policy, “Personal Data” or “Personal Information” means information relating to an identified or identifiable individual, or information that can reasonably be associated or linked with an individual, depending on applicable law.

Personal Data may include:

* name;
* email address;
* telephone or mobile number;
* billing address;
* shipping address;
* country, state, city or postal code;
* tax identification information;
* government identification information where required by law;
* date of birth where provided and legally permitted;
* account information;
* login information;
* order information;
* purchase history;
* payment-related information;
* delivery information;
* customer-service communications;
* returns, refunds and exchanges;
* reviews and feedback;
* social-media account information;
* IP address;
* browser information;
* device information;
* online identifiers;
* browsing information;
* approximate location information;
* cookie and similar technology information; and
* other information that you voluntarily provide to us.

We do not intentionally collect Sensitive Personal Data unless it is necessary, legally permitted and processed for an appropriate purpose under applicable law.

3. HOW WE COLLECT PERSONAL DATA

We may collect Personal Data:

1. directly from you;
2. automatically when you use our website;
3. through cookies and similar technologies;
4. from payment providers;
5. from shipping and logistics providers;
6. from fraud-prevention and security services;
7. through marketing and advertising technologies;
8. through social-media platforms;
9. through customer-service communications; and
10. from other third parties where permitted by applicable law.

4. PERSONAL DATA YOU PROVIDE DIRECTLY

We may collect Personal Data when you:

* create an account;
* place an order;
* complete checkout;
* request a return or exchange;
* request a refund;
* contact customer service;
* contact us through WhatsApp;
* subscribe to our newsletter;
* request promotional communications;
* participate in a promotion or survey;
* submit a product review;
* communicate with us through social media;
* request information about our products;
* apply to become a reseller or commercial partner;
* participate in collaborations or influencer activities; or
* otherwise voluntarily provide information to us.

5. HOW WE USE YOUR PERSONAL DATA

We may use Personal Data for the following purposes.

5.1 Processing and fulfilling orders

We may process Personal Data to:

* create and manage customer accounts;
* process orders;
* process payments;
* confirm purchases;
* issue invoices and receipts;
* calculate applicable taxes;
* arrange shipping;
* provide tracking information;
* deliver products;
* communicate regarding an order;
* process returns and exchanges;
* process refunds;
* provide customer support; and
* resolve problems relating to purchases.

5.2 Payment processing

Payments made through our website may be processed by third-party payment providers, including PayPal.

Depending on the payment method, the payment provider may process information such as:

* name;
* email address;
* billing address;
* shipping address;
* transaction amount;
* order information;
* payment information;
* transaction identifiers;
* fraud-prevention information; and
* authentication information.

Payment information may be processed directly by the relevant payment provider rather than by RIOBAIANO.

Payment providers may process Personal Data according to their own privacy policies and applicable legal requirements.

5.3 Shipping and delivery

To fulfill orders, we may share relevant information with shipping and logistics providers, including DHL and Correios, as well as other logistics, customs or delivery providers where necessary.

Information may include:

* recipient name;
* shipping address;
* telephone number;
* email address;
* order number;
* package information;
* customs information;
* tax information; and
* other information required to complete delivery.

For international orders, certain information may also be provided to customs authorities, tax authorities, postal authorities, customs brokers and other governmental or logistics entities when required to import or export the order.

5.4 Customer service

We may process your Personal Data when you contact us through:

* email;
* our website;
* WhatsApp;
* social-media channels;
* customer-service forms; or
* other communication channels made available by RIOBAIANO.

This information may be used to:

* respond to your request;
* investigate complaints;
* provide support;
* resolve problems;
* process returns or refunds;
* verify transactions; and
* maintain records of customer-service interactions.

6. CART ABANDONMENT AND CHECKOUT RECOVERY

Our website may use technologies that allow us to identify incomplete shopping carts or incomplete checkout sessions.

Where permitted by applicable law, we may use information associated with an incomplete purchase, such as your email address and cart information, to send communications relating to the incomplete purchase.

These communications may include reminders regarding products placed in your shopping cart.

Where required by applicable law, we will obtain the necessary consent before sending marketing or other non-essential communications.

You may opt out of promotional or cart-recovery communications through the unsubscribe mechanism provided in the communication or by contacting us.

7. MARKETING AND PROMOTIONAL COMMUNICATIONS

Where permitted by applicable law, we may use your Personal Data to send:

* product announcements;
* new collection announcements;
* promotions;
* discounts;
* special offers;
* restock notifications;
* newsletters;
* personalized recommendations;
* abandoned-cart communications;
* advertising communications; and
* other communications relating to RIOBAIANO.

Where consent is required, we will request your consent before sending the relevant marketing communications.

You may withdraw your consent or unsubscribe from marketing communications at any time.

Unsubscribing from marketing communications will not necessarily prevent us from sending essential transactional or service communications, such as order confirmations, payment confirmations, shipping notifications, delivery notifications, security notifications, account-related communications or legally required notices.

8. COOKIES AND SIMILAR TECHNOLOGIES

RIOBAIANO uses cookies and similar technologies on its website.

Cookies are small files or identifiers that may be stored on or accessed from your device when you visit a website.

We may use cookies, pixels, tags, scripts, local storage and similar technologies for purposes including:

* website functionality;
* shopping-cart functionality;
* authentication;
* security;
* fraud prevention;
* language preferences;
* currency preferences;
* analytics;
* website performance;
* advertising;
* conversion measurement;
* personalization; and
* marketing.

9. TYPES OF COOKIES

9.1 Strictly necessary cookies

These cookies are necessary for the operation, security and basic functionality of the website.

They may be used to:

* maintain your shopping cart;
* maintain your session;
* authenticate your account;
* protect the website against fraud;
* maintain security;
* remember essential settings; and
* provide functionality requested by you.

Because these cookies may be technically necessary, they may not require consent where permitted by applicable law.

9.2 Preference and functionality cookies

These technologies may remember preferences such as:

* language;
* currency;
* region;
* display preferences; and
* other functionality choices.

9.3 Analytics cookies

Analytics technologies may allow us to understand:

* how visitors use the website;
* which pages are visited;
* how users navigate the website;
* website performance;
* traffic patterns; and
* aggregated usage information.

Where required by applicable law, analytics technologies will only be activated after obtaining the required consent.

9.4 Advertising and marketing technologies

We may use advertising technologies, including technologies provided by third parties, to:

* measure advertising campaigns;
* measure conversions;
* understand interactions with advertisements;
* create or use advertising audiences;
* provide relevant advertising;
* limit repetitive advertising; and
* improve advertising performance.

Where required by applicable law, these technologies will only be activated after the required consent has been obtained.

10. COOKIE CONSENT

Depending on your location and applicable law, you may be presented with a cookie-management interface allowing you to:

* accept non-essential cookies;
* reject non-essential cookies; and
* manage cookie preferences.

Where applicable law requires prior consent, RIOBAIANO will not rely solely on continued browsing as consent to non-essential cookies.

You may also control or delete cookies through your browser settings.

Disabling strictly necessary cookies may affect certain website functions.

11. GOOGLE TAG MANAGER

RIOBAIANO uses Google Tag Manager to manage and deploy certain website tags and technologies.

Google Tag Manager is a tag-management system. Depending on the tags configured in our Google Tag Manager container, additional third-party technologies may process information about website visitors.

The specific technologies deployed through Google Tag Manager may change over time.

Where applicable law requires consent for a particular tag or technology, we will use the appropriate consent mechanism before activating it.

12. TIKTOK

RIOBAIANO may use TikTok technologies in connection with our website, advertising and marketing activities.

Depending on the technologies and configurations enabled on our website, TikTok may receive information relating to website interactions, device information, browsing activity, advertising interactions and conversion events.

Such information may be used for purposes including:

* advertising measurement;
* conversion measurement;
* audience creation;
* campaign optimization;
* fraud prevention; and
* advertising personalization.

Where required by applicable law, non-essential TikTok tracking technologies will only be activated after the required consent has been obtained.

TikTok may process Personal Data in accordance with its own privacy policies and applicable terms.

13. WHATSAPP

Our website may provide a button or link allowing you to contact RIOBAIANO through WhatsApp.

If you choose to interact with WhatsApp, information may be processed by WhatsApp and its affiliated entities according to their applicable terms and privacy policies.

RIOBAIANO does not control the processing carried out by WhatsApp after you interact with the WhatsApp service.

14. WOOCOMMERCE

Our online store is operated using WooCommerce and WordPress technologies.

WooCommerce may process information necessary to:

* operate the online store;
* manage customer accounts;
* process orders;
* manage shopping carts;
* process checkout;
* maintain order records;
* calculate shipping;
* calculate taxes;
* manage products; and
* provide e-commerce functionality.

The specific Personal Data processed depends on the functions and extensions enabled on our website.

15. MULTI-CURRENCY AND INTERNATIONAL SALES

RIOBAIANO may display prices in different currencies, including Brazilian reais, United States dollars and euros.

Our website may process information relating to:

* selected currency;
* country or region;
* shipping destination;
* transaction currency; and
* information necessary to provide localized pricing and payment or shipping functionality.

Currency conversion and display may be supported by third-party software or services used by our website.

Currency display does not necessarily mean that a transaction will be processed in the displayed currency. The applicable currency ultimately charged may depend on the payment method and transaction configuration.

16. TRANSLATION AND LANGUAGE FUNCTIONALITY

Our website may use translation technologies to provide content in different languages.

Translation functionality may process information necessary to display translated versions of website content.

17. JETPACK AND WEBSITE TECHNOLOGIES

RIOBAIANO uses certain WordPress and Jetpack technologies to support website functionality, security, performance and related services.

Depending on the features enabled, these technologies may involve processing technical information such as:

* IP address;
* browser information;
* device information;
* website activity;
* security information;
* diagnostic information; and
* other technical information required for the relevant functionality.

The specific information processed depends on the Jetpack and WordPress features enabled on our website.

18. THIRD-PARTY SERVICE PROVIDERS

RIOBAIANO may use third-party providers to operate and support its business.

These providers may include:

* payment providers, including PayPal;
* shipping providers, including DHL and Correios;
* customs and logistics providers;
* website hosting providers;
* cloud-service providers;
* cybersecurity providers;
* fraud-prevention providers;
* marketing and advertising platforms;
* analytics providers;
* communication providers;
* WhatsApp;
* TikTok;
* Google Tag Manager and technologies deployed through it;
* WordPress and related service providers;
* customer-support providers; and
* professional advisers.

Third-party providers may process Personal Data either on our behalf or independently, depending on the nature of their services and their legal role.

Where required by applicable law, we seek to establish appropriate contractual, technical and organizational safeguards with service providers that process Personal Data on our behalf.

19. WHEN WE SHARE PERSONAL DATA

We may share Personal Data where necessary for legitimate business purposes, to provide products and services, to comply with legal obligations or where otherwise permitted by applicable law.

This may include sharing Personal Data with:

* payment processors;
* banks and financial institutions;
* shipping companies;
* logistics providers;
* customs brokers;
* tax authorities;
* government authorities;
* fraud-prevention providers;
* technology providers;
* hosting providers;
* advertising providers;
* analytics providers;
* communication providers;
* professional advisers;
* insurers;
* legal advisers;
* accountants;
* auditors; and
* other service providers necessary to operate our business.

We do not disclose more Personal Data than reasonably necessary for the applicable purpose.

20. LEGAL OBLIGATIONS AND GOVERNMENT AUTHORITIES

We may disclose Personal Data when reasonably necessary to:

* comply with applicable laws;
* comply with tax obligations;
* comply with customs requirements;
* comply with court orders;
* respond to lawful governmental requests;
* cooperate with competent authorities;
* prevent fraud;
* investigate unlawful activity;
* protect our rights;
* protect our customers;
* protect our employees;
* protect our property; or
* establish, exercise or defend legal claims.

21. INTERNATIONAL DATA TRANSFERS

Because RIOBAIANO is based in Brazil and operates an international e-commerce business, Personal Data may be transferred to, stored in or accessed from countries other than the country in which you reside.

Recipients may include payment providers, technology providers, advertising platforms, hosting providers, logistics providers and other business partners.

Where applicable law requires safeguards for international transfers, RIOBAIANO will use an appropriate legally recognized transfer mechanism.

For Personal Data subject to Brazilian law, international transfers will be carried out in accordance with the LGPD and applicable regulations issued by the Brazilian Data Protection Authority (ANPD), including applicable adequacy decisions, contractual safeguards or other lawful mechanisms.

For Personal Data subject to the GDPR, transfers outside the European Economic Area will be carried out using an appropriate mechanism recognized under applicable data-protection law, such as an adequacy decision, appropriate safeguards or another lawful transfer mechanism.

For Personal Data subject to UK data-protection law, international transfers will be carried out using applicable UK transfer mechanisms and safeguards.

Where required by applicable law, we will provide additional information concerning relevant destination countries, recipients and transfer safeguards.

22. DATA RETENTION

RIOBAIANO retains Personal Data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by applicable law.

The retention period may depend on:

* the purpose for which the information was collected;
* the nature of the information;
* the customer relationship;
* legal requirements;
* tax requirements;
* accounting requirements;
* regulatory requirements;
* contractual obligations;
* fraud prevention;
* dispute resolution;
* enforcement of agreements; and
* the establishment, exercise or defense of legal claims.

When Personal Data is no longer necessary, we may delete, anonymize or securely dispose of it, subject to applicable legal and regulatory requirements.

23. DATA SECURITY

RIOBAIANO adopts technical, administrative and organizational measures designed to protect Personal Data against unauthorized access, accidental loss, destruction, alteration, disclosure and other unlawful or unauthorized processing.

Depending on the circumstances, these measures may include:

* access controls;
* authentication;
* restricted access to Personal Data;
* encryption and other security technologies where appropriate;
* monitoring;
* backups;
* security procedures;
* confidentiality obligations;
* technical controls;
* organizational controls; and
* incident-response procedures.

However, no system, network, transmission or method of electronic storage can be guaranteed to be completely secure.

Therefore, while we take reasonable measures to protect Personal Data, we cannot guarantee absolute security.

24. SECURITY INCIDENTS AND DATA BREACHES

If RIOBAIANO becomes aware of a security incident involving Personal Data, we will assess the incident and take reasonable measures to contain, investigate and remediate it.

Where applicable law requires notification, we will notify the relevant authorities and/or affected individuals within the time and in the manner required by applicable law.

25. CHILDREN AND MINORS

Our website and products are primarily intended for adults.

We do not knowingly collect Personal Data from children in violation of applicable law.

Different countries and jurisdictions establish different age thresholds and requirements for processing children’s Personal Data.

Where applicable law requires parental or legal-guardian authorization, RIOBAIANO will take reasonable measures to obtain or verify such authorization where appropriate.

If you believe that a child has provided Personal Data to us in circumstances where such collection was not permitted, please contact us.

26. AUTOMATED DECISION-MAKING AND PROFILING

RIOBAIANO may use automated technologies for purposes such as:

* fraud prevention;
* security;
* advertising measurement;
* analytics;
* personalization;
* product recommendations; and
* marketing.

We do not intend to make decisions producing legal or similarly significant effects concerning individuals solely through automated processing unless such processing is permitted by applicable law and appropriate safeguards are implemented.

Where applicable law grants rights concerning automated decision-making or profiling, you may exercise those rights through the contact information provided in this Privacy Policy.

27. YOUR PRIVACY RIGHTS

Depending on where you live and the laws applicable to you, you may have certain rights concerning your Personal Data.

These rights may include:

* the right to know whether we process Personal Data about you;
* the right to access your Personal Data;
* the right to request correction of inaccurate or incomplete information;
* the right to request deletion of Personal Data;
* the right to request restriction of processing;
* the right to object to certain processing;
* the right to data portability;
* the right to withdraw consent;
* the right to request information regarding data sharing;
* the right to object to certain direct marketing;
* the right to opt out of certain targeted advertising or data sharing where required by applicable law;
* the right to request review of certain automated decisions; and
* the right to lodge a complaint with a competent data-protection authority.

Not all rights are available in every jurisdiction, and some rights may be subject to legal exceptions.

28. BRAZIL — LGPD

If the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados Pessoais — “LGPD”) applies to you, you may have rights provided under the LGPD, including, subject to applicable legal conditions:

* confirmation of the existence of processing;
* access to Personal Data;
* correction of incomplete, inaccurate or outdated Personal Data;
* anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed Personal Data;
* data portability, subject to applicable regulations and protection of commercial and industrial secrets;
* information regarding public and private entities with which Personal Data has been shared;
* information regarding the possibility of refusing consent and the consequences of refusal;
* withdrawal of consent;
* objection to processing where legally applicable;
* review of decisions based solely on automated processing that affect your interests, where applicable; and
* other rights provided by applicable law.

You may exercise applicable rights by contacting:

contato@danielribeiro.adv.br

Where applicable, you may also submit a complaint or petition to the Brazilian Data Protection Authority (ANPD), subject to applicable procedures.

29. EUROPEAN ECONOMIC AREA — GDPR

If you are located in the European Economic Area and the General Data Protection Regulation (“GDPR”) applies to our processing of your Personal Data, you may have rights including:

* the right to be informed;
* the right of access;
* the right to rectification;
* the right to erasure;
* the right to restriction of processing;
* the right to data portability;
* the right to object;
* the right to withdraw consent;
* rights concerning automated decision-making and profiling, where applicable; and
* the right to lodge a complaint with a competent supervisory authority.

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

30. UNITED KINGDOM

If you are located in the United Kingdom and applicable UK data-protection law applies, you may have rights including:

* access;
* rectification;
* erasure;
* restriction;
* data portability;
* objection;
* withdrawal of consent; and
* rights concerning automated decision-making and profiling where applicable.

UK privacy and electronic-communications laws may also impose requirements concerning cookies, electronic marketing and similar technologies.

31. CALIFORNIA PRIVACY RIGHTS

If you are a California resident and the California Consumer Privacy Act, as amended (“CCPA”), applies to RIOBAIANO, you may have certain rights under California law.

Depending on the circumstances, these rights may include:

* the right to know about Personal Information collected, used or disclosed;
* the right to request access to Personal Information;
* the right to request deletion;
* the right to request correction;
* the right to opt out of certain sales or sharing of Personal Information;
* the right to limit certain uses and disclosures of Sensitive Personal Information where applicable; and
* the right not to receive discriminatory treatment for exercising applicable privacy rights.

RIOBAIANO does not sell Personal Information in the ordinary sense of selling customer databases for monetary consideration.

However, certain California laws define “sale” and “sharing” broadly. Certain online advertising or analytics activities may therefore constitute “sharing” or another regulated disclosure even when RIOBAIANO does not receive money directly in exchange for Personal Information.

Where required by applicable California law, RIOBAIANO will provide appropriate opt-out mechanisms and honor valid privacy preference signals, including Global Privacy Control where legally applicable.

California residents may submit privacy requests by contacting:

contato@danielribeiro.adv.br

We may take reasonable steps to verify your identity before fulfilling certain requests, as permitted or required by law.

Where permitted by law, you may use an authorized agent to submit a request on your behalf.

We will not discriminate against you for exercising rights protected by applicable California law.

32. DIRECT MARKETING RIGHTS

You may opt out of promotional communications at any time.

For email communications, you may use the unsubscribe link included in the communication.

For other communication channels, you may contact us directly.

Opting out of marketing communications does not necessarily prevent transactional, security or legally required communications.

33. THIRD-PARTY WEBSITES

Our website may contain links to third-party websites, applications, social-media platforms or services.

RIOBAIANO is not responsible for the privacy practices, security or content of third-party websites or services.

When you leave our website or interact directly with a third-party service, that third party may process your information under its own privacy policy and terms.

We encourage you to review the applicable privacy policies before providing Personal Data to third parties.

34. INFORMATION YOU PROVIDE ABOUT OTHER PEOPLE

If you provide Personal Data relating to another person, you represent that you are authorized to provide such information and, where required, that you have provided the relevant person with appropriate information regarding the disclosure.

For example, if you purchase a product as a gift and provide another person’s name, address or telephone number for delivery, you should ensure that you are permitted to provide that information to us.

35. INTERNATIONAL ORDERS, CUSTOMS AND TAXATION

When you place an international order, your Personal Data may be processed in connection with:

* international shipping;
* customs clearance;
* import requirements;
* export requirements;
* taxes;
* duties;
* customs declarations;
* delivery;
* fraud prevention; and
* compliance with applicable laws.

Depending on the destination country, information may be provided to customs authorities, tax authorities, postal operators, carriers, customs brokers and other entities involved in international trade and delivery.

36. BUSINESS TRANSFERS

If RIOBAIANO is involved in a merger, acquisition, restructuring, financing, sale of assets, change of control, bankruptcy or similar transaction, Personal Data may be transferred as part of that transaction where permitted by applicable law.

Any such transfer will be subject to applicable privacy and data-protection requirements.

37. YOUR RESPONSIBILITY FOR ACCOUNT SECURITY

If you create an account with RIOBAIANO, you are responsible for maintaining the confidentiality of your login credentials.

You should:

* use a strong password;
* avoid sharing your password;
* use unique passwords;
* log out from shared devices; and
* notify us if you suspect unauthorized access.

RIOBAIANO will never ask you to disclose your password through an unsolicited communication.

38. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time.

Changes may be made to reflect:

* changes to our business;
* changes to our website;
* new technologies;
* new services;
* changes to third-party providers;
* changes to our data-processing practices;
* changes in applicable laws or regulations; or
* changes in regulatory guidance.

When we update this Privacy Policy, we will change the “Last Updated” date shown at the beginning of this document.

Where required by applicable law, we will provide additional notice or obtain consent before implementing material changes.

39. CONTACT US

If you have any questions, comments, complaints or requests regarding this Privacy Policy or the processing of your Personal Data, please contact:

RIOBAIANO INDÚSTRIA DE CONFECÇÕES LTDA.

CNPJ: 29.122.464/0001-52

Privacy / Data Protection Contact:
Daniel Ribeiro

Email:
contato@danielribeiro.adv.br

We will handle privacy requests in accordance with applicable law and the procedures and deadlines established by the applicable legal framework.

40. GOVERNING LAW AND APPLICABLE RIGHTS

This Privacy Policy is intended to operate together with the mandatory privacy and data-protection laws applicable to the individual concerned.

Nothing in this Privacy Policy is intended to limit or exclude any mandatory rights that you may have under applicable law.

Where a provision of this Privacy Policy conflicts with a mandatory requirement of applicable data-protection law, the mandatory legal requirement will prevail to the extent of the conflict.

RIOBAIANO INDÚSTRIA DE CONFECÇÕES LTDA.
CNPJ 29.122.464/0001-52
Last Updated: October 1, 2026