← Back to the website

This is a translation provided for convenience. The Portuguese version is the legally binding one and prevails in case of any conflict. Read the Portuguese version.

Privacy Notice

Ortu Agro Platform

Last updated: October 15, 2026 · Effective: from the date of acceptance by the user

1. Introduction

This Privacy Notice ("Notice") describes how Ortu Agro LTDA ("Company", "we") collects, uses, stores, shares and protects the personal data of the users ("you", "user") of the digital livestock management platform ("Platform").

This Notice was prepared in compliance with the LGPD (Brazil's General Data Protection Law, Law No. 13,709/2018) and other applicable rules.

By using the Platform, you declare that you have read and understood this Privacy Notice.

2. Data Controller

2.1. The controller of the personal data processed through the Platform is:

Ortu Agro LTDA
CNPJ (Brazilian company registration number): 66.273.065/0001-19
Headquarters: Avenida Paulista, 302, CEP 01310-000, São Paulo/SP, Brasil
Contact email for privacy matters: dpo@ortuagro.com

2.2. The Data Protection Officer (DPO) may be contacted at the email address indicated above for any matters related to the processing of personal data.

3. Personal Data Collected

The Company collects the following categories of personal data:

Data provided by the user

Category	Data collected	Purpose
Identification data	Full name, email, telephone number, CPF (Brazilian individual taxpayer number) or CNPJ, gender, date of birth	Registration, user identification and communications
Location data	Farm name, municipality, state, billing address	Personalization of the service, weather data and billing
Payment data	Credit/debit card data, PIX (Brazil's instant payment system), billing address	Processing of payments and recurring charges
Production and operational data	Herd data, indicators, financial and operational records entered by the user	Provision of the livestock management service

Data collected automatically

Category	Data collected	Purpose
Usage and browsing data	IP address, device type, operating system, browser, pages visited, access logs	Security, improvement of the Platform and usage analysis
Registration source	Parameters of the link through which you arrived at the website (for example, the originating campaign or ad) and the domain of the site that referred you, recorded together with your registration	To find out which promotional efforts bring in new customers. This data stays only with the Company and is not sent to advertising platforms

3.1. The production and operational data entered by the user is the user's sole responsibility, as provided for in the Terms of Use of the Platform.

4. Legal Bases for Processing

The processing of personal data is carried out on the basis of the following legal bases provided for in the LGPD:

Performance of a contract (Article 7, V): to provide the services contracted by the user, including registration, access to the Platform and payment processing;
Consent (Article 7, I): for sending marketing communications, satisfaction surveys and the use of non-essential cookies, where applicable;
Legitimate interest (Article 7, IX): for improvement of the Platform, statistical analyses with anonymized and aggregated data, fraud prevention and identification of the registration source (which promotional effort brought in the account);
Compliance with a legal obligation (Article 7, II): for data retention required by tax, accounting or regulatory legislation;
Regular exercise of rights (Article 7, VI): for defense in judicial, administrative or arbitration proceedings.

5. Data Sharing

5.1. The Company may share the user's personal data with third parties in the following cases:

Essential service providers: cloud infrastructure providers, payment processors, transactional email delivery services and artificial intelligence services, exclusively for the operation of the Platform;
Legal obligation: when required by law, regulation, court order or request of a competent authority;
Protection of rights: to protect the rights, safety or property of the Company, its users or the public.

5.2. The Company does not trade, sell or rent its users' personal data to third parties.

5.3. For artificial intelligence-based features to work, certain data entered by the user may be sent to third-party providers for processing. The Company adopts measures to limit sharing to the minimum necessary and requires its providers to comply with appropriate security and privacy standards.

5.4. All third-party service providers are subject to contractual confidentiality and data protection obligations consistent with the LGPD.

5.5. The up-to-date list of active subprocessors (infrastructure providers, payment processing, email delivery, AI and messaging) is available on the Subprocessors page, updated whenever a vendor is added or replaced.

6. Data Storage and Retention

6.1. Personal data is stored on secure servers, which may be located in Brazil or abroad, always in compliance with the LGPD and with the security standards adopted by the Company.

6.2. Personal data will be retained for the period necessary to fulfill the purposes described in this Notice, subject to the following:

during the term of the user's account: all data necessary to provide the service;
after cancellation of the account: 30 (thirty) days for operational data available for export, as provided for in the Terms of Use. Data present in automated backups may remain for up to 90 (ninety) additional days before being purged, a period necessary for the technical retention cycle and which does not constitute a breach of the LGPD, unless there is a legal obligation to retain it for a longer period;
financial and tax data: for the period required by the applicable tax legislation;
access records: for a minimum period of 6 (six) months, in accordance with the Marco Civil da Internet (Brazil's Civil Rights Framework for the Internet, Law No. 12,965/2014).

7. Data Security

7.1. The Company adopts appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, alteration, disclosure or destruction, including:

encryption of data in transit and at rest;
role-based access control;
access monitoring and audit records;
internal information security policies.

7.2. No system is completely secure. The Company does not guarantee absolute security, but undertakes to adopt best market practices and to notify users and the ANPD (Brazil's National Data Protection Authority) in the event of a significant security incident, as required by the LGPD.

8. Cookies and Tracking Technologies

8.1. The Platform may use cookies and similar technologies for:

essential cookies: necessary for the operation of the Platform, such as session maintenance and authentication;
preference cookies: to remember the user's settings and preferences.

8.2. Essential cookies do not require consent. For non-essential cookies, the Company will request the user's consent before activation.

8.3. In the Ortu Agro mobile app (iOS and Android), equivalent local storage technologies, such as AsyncStorage, are used to maintain the authenticated session and the app's preferences. The same rules of this Section apply to these technologies.

8.4. The user may manage or disable cookies through their browser settings. Disabling essential cookies may compromise the operation of the Platform. For more information, see the Cookie Policy.

9. Rights of the Data Subject

Under the LGPD, the user has the following rights with respect to their personal data:

Confirmation of the existence of processing of their personal data;
Access to the personal data processed by the Company;
Correction of incomplete, inaccurate or outdated data;
Anonymization, blocking or deletion of unnecessary or excessive data;
Portability of the data to another service provider, in accordance with the regulations of the ANPD;
Deletion of data processed on the basis of consent;
Information about the public and private entities with which the Company has shared their data;
Information about the possibility of not providing consent and the consequences thereof;
Revocation of consent at any time.

9.1. To exercise any of these rights, the user may get in touch through the privacy email address indicated in Section 2 of this Notice.

9.2. The Company will respond to requests within 15 (fifteen) business days, as provided for in the LGPD.

9.3. The Company may request proof of the data subject's identity before fulfilling requests for access, correction or deletion of data, as a security measure.

10. International Data Transfer

10.1. Due to the use of third-party services (cloud infrastructure, artificial intelligence processing, among others), the user's personal data may be transferred to and processed on servers located outside Brazil.

10.2. In such cases, the Company ensures that the transfer is carried out in compliance with the LGPD, adopting appropriate safeguards, such as:

standard contractual data protection clauses;
transfer to countries or international organizations that provide an adequate level of protection, as assessed by the ANPD;
specific consent of the data subject, where applicable.

11. Data of Minors

11.1. The Platform is not intended for minors under 18 (eighteen) years of age, as provided for in the Terms of Use.

11.2. The Company does not intentionally collect personal data of minors. If it becomes aware that a minor's data has been collected inadvertently, the Company will take measures to delete it promptly.

12. Changes to this Notice

12.1. The Company may update this Privacy Notice periodically to reflect changes in its data processing practices or as a result of new legal requirements.

12.2. The user will be notified of material changes at least 30 (thirty) days in advance, by a communication sent to the registered email address or by a prominent notice on the Platform.

12.3. It is recommended to consult this Notice periodically to stay informed of any updates.

13. Contact and Complaints

13.1. For questions, requests or complaints related to this Notice or to the processing of personal data, the user may get in touch with the Data Protection Officer (DPO) by email: dpo@ortuagro.com.

13.2. If the user believes that their rights have not been adequately addressed, they may file a complaint with the ANPD (Brazil's National Data Protection Authority), through its official website: www.gov.br/anpd.

14. Applicable Law

14.1. This Privacy Notice is governed by the laws of the Federative Republic of Brazil, in particular by the LGPD (Law No. 13,709/2018), the Marco Civil da Internet (Law No. 12,965/2014) and the Código de Defesa do Consumidor (Brazil's Consumer Protection Code, Law No. 8,078/1990), where applicable.

14.2. The courts of the judicial district of São Paulo/SP are chosen as the venue to settle any disputes arising out of this Notice, without prejudice to the right of the user who is a consumer to opt for the courts of their domicile.

Questions: contato@ortuagro.com. Data protection matters: dpo@ortuagro.com.