Transparency in every data point.

Personal data we may process

The data involved varies according to your relationship with WWD and the services used. We apply the principle of necessity to limit processing to relevant information.

Purposes and legal bases

Processing may be based on performance of a contract or pre-contractual procedures, compliance with a legal or regulatory obligation, the regular exercise of rights, legitimate interests, fraud prevention, and, when appropriate, consent.

The legal basis used depends on the context and specific purpose. When consent is the applicable basis, it may be withdrawn at any time without affecting prior processing carried out lawfully.

Who personal data may be shared with

We do not sell personal data. Sharing occurs only when necessary and with controls appropriate to the risk, including with:

• infrastructure, technology, hosting, communications, payment, and support providers;
• consultants, auditors, legal and accounting advisors, and other specialized service providers;
• clients, partners, and manufacturers involved in performing agreements and projects;
• public authorities, regulatory bodies, or courts when required or permitted by law;
• parties involved in a corporate reorganization, acquisition, or similar transaction, subject to appropriate safeguards.

Service providers that process data on our behalf must comply with confidentiality, security, purpose limitation, and data protection obligations appropriate to their role.

International data transfers

Some technology providers or services may store or process data outside Brazil. When an international transfer occurs, WWD will use a mechanism permitted under the LGPD and ANPD regulations, together with contractual, technical, and organizational safeguards appropriate to the circumstances.

Retention and deletion

We retain personal data for as long as necessary to fulfill the disclosed purposes, perform agreements, meet legal and regulatory obligations, preserve evidence, exercise rights, or respond to audits. Once the purpose and applicable retention period end, data will be deleted or anonymized unless continued retention is authorized or required by law.

Business inquiries that do not develop into a contractual relationship will be reviewed and, as a general rule, deleted or anonymized within 24 months of the last interaction, unless a legitimate need requires a different period. Consent and service-reference records may be retained for as long as necessary to demonstrate compliance and exercise legal rights.

Security and incident response

We adopt technical and administrative measures proportionate to the nature of the data, context, and processing risks. These may include access controls, credential management, backups, system updates, logging, segregation of duties, confidentiality measures, and workforce guidance.

No environment is entirely risk-free. If an incident may create significant risk or harm, we will take containment and assessment measures and notify authorities and affected individuals when required by law.

Your rights as an individual

Under the LGPD, you may request the following, as applicable:

To protect you and others, we may request additional information to verify your identity and the legitimacy of the request. Responses will follow applicable legal deadlines and limitations.

Cookies and similar technologies

The website may use cookies that are strictly necessary for operation and security. If analytics, functionality, or marketing cookies are introduced, we will provide information and controls appropriate to the purpose and applicable legal basis.

You may also configure your browser to block or delete cookies. Disabling strictly necessary cookies may affect essential website features. Links to external services, including third-party forms, are also subject to those providers’ privacy policies.

Children and adolescents

Our business services are not directed to children. If processing the data of a child or adolescent is necessary in a specific context, it will be carried out in their best interests and with the authorizations and protections required by law.

Updates to this Policy

This Policy may be updated to reflect legal, regulatory, technological, or operational changes. The current version will always be available on this page with its update date. Material changes may also be communicated through additional channels when appropriate.