Privacy Policy.

This Policy applies to all personal data processed in connection with our milk preparation and dairy activities — direct consumer clients, commercial buyers (markets, cooperatives, food businesses), institutional buyers (schools, government agencies, PNAE programmes), website visitors and any person whose data we process. Our operation is based on a rural property (Sítio Recanto Feliz) in the Zona Rural of Colméia, TO. Most of our commercial clients are legal entities (CNPJs); however, individual consumers who purchase dairy directly and individual rural producers from whom we may source raw milk are natural persons whose data is directly protected by the LGPD.

A. Commercial client data (buyers of milk and dairy):

• Institutional and commercial clients (CNPJ): Company name, CNPJ, delivery address, contact name and WhatsApp — for order management, delivery scheduling and NF-e issuance. The company itself is not a data subject under the LGPD, but the natural person who is the ordering contact is.
• Individual direct consumers (CPF): Name, CPF, address and WhatsApp for direct consumer orders. These individuals are natural persons directly protected by the LGPD.
• Purchase and delivery history: Products ordered, quantities, delivery dates and delivery addresses — retained as part of the commercial relationship and for NF-e traceability.

B. Mandatory dairy traceability data (regulatory — not personal data in most cases):

• Lot numbers and production records: Each batch of pasteurised milk is assigned a lot number with production date, quantity, processing temperature records and quality test results. This data relates to the product, not to individual people.
• Herd health records: Brucellosis and tuberculosis testing results, vaccination records and animal health documentation required by ADAPTO and MAPA — these relate to the cattle herd, not to any natural person, and are not personal data under the LGPD.
• Delivery traceability: If a delivery is associated with a named buyer (for PNAE or institutional supply), the lot number is linked to that buyer's order — connecting product traceability data with buyer identification data.

C. Website and contact data:

• Name, WhatsApp and order description when submitting an order or enquiry via the website.
• IP address, browser type and pages visited.

• SEFAZ-TO / Receita Federal: NF-e data transmitted electronically per delivery — buyer CNPJ or CPF as required.
• MAPA / SIE-TO / ADAPTO: Product inspection, lot traceability and herd health records — in routine inspection or in the event of a food safety incident. Buyer personal data shared only if formally required and documented.
• PNAE / Municipal nutrition offices: Delivery records and documentation required for institutional supply accountability — under the formal contractual and regulatory framework of the school meal programme.
• Refrigerated transport / logistics (where applicable): Delivery address and order reference for cold-chain transport — under a data processing agreement.
• PROCON-TO / Senacon: When required under the CDC or commercial dispute resolution.
• Legal authorities: When required by court order or administrative authority.

Our operation is based in Colméia, TO. All client data is processed in Brazil. Tax records (NF-e) are processed exclusively in systems certified by the Receita Federal and SEFAZ-TO. Any communication platforms operating on international servers do so under the guarantees of Art. 33 of the LGPD.

• NF-e and fiscal documentation (SEFAZ-TO): Minimum 5 years as required by Brazilian federal and Tocantins state tax legislation.
• Mandatory dairy traceability records (MAPA/SIE-TO): Minimum 6 months after the lot expiry date, or as specifically required by MAPA regulations for the product type — typically 1–2 years for pasteurised milk lots.
• Herd health records (ADAPTO — brucellosis/TB): Minimum 5 years as required by MAPA animal health regulations — these relate to the herd, not to buyer personal data.
• Active client data (commercial relationship): Retained for the duration of the supply relationship and for 5 years after the last delivery — consistent with tax retention and commercial statute of limitations.
• Individual consumer contact data without repeat order: Up to 6 months from the date of the last contact.
• Website analytics: Aggregated and anonymised after 12 months.

• Client purchase data and delivery records stored in access-controlled systems on the rural property — not accessible to third parties;
• Lot traceability records maintained in a dedicated production log separate from buyer personal data — linked by order number rather than buyer name in operational documentation;
• NF-e issued using a certified digital certificate (A1/A3) approved by the Receita Federal;
• WhatsApp order communication handled with discretion;
• Website encrypted (HTTPS);
• Incident response procedures in accordance with LGPD Art. 48.

• Confirmation and Access (Art. 18, I–II): Confirm what personal data we hold and receive a copy.
• Correction (Art. 18, III): Request correction of inaccurate personal data (e.g., address or contact changes).
• Deletion (Art. 18, IV): Request deletion — subject to mandatory fiscal retention (NF-e: 5 years) and mandatory dairy traceability retention under MAPA.
• Portability (Art. 18, V): Receive your data in a structured format.
• Complaint to the ANPD (Art. 18, §1º): Lodge a complaint at www.gov.br/anpd.

We respond within 15 business days.

Our website may use cookies for essential functionality and aggregated performance analytics. We do not use behavioural tracking or advertising cookies. Cookie preferences can be managed through your browser settings.

Our milk and dairy products are food items appropriate for all ages. Direct consumer sales may include family households with children. We process only the data of the adult buyer responsible for the order. School supply through PNAE involves institutional contracts with the municipal government — student personal data is never processed by us; the contracting party is the municipal nutrition office. We do not collect or process data from minors directly.

PNAE (Programa Nacional de Alimentação Escolar): Supply to the school meal programme requires the rural producer to hold a valid DAP (Declaração de Aptidão ao PRONAF) or CAF (Cadastro Nacional da Agricultura Familiar), SIE-TO inspection registration and CNPJ. The PNAE contracting process involves documentation of the rural producer (including CNPJ and rural producer registration) — this is institutional documentation about Débora Silva de Souza Ltda, not personal data about individual students or families in the school meal programme. Student and family data is never processed by us; the municipal nutrition office is responsible for that data under its own LGPD obligations.

This Policy may be updated to reflect changes in our activities, in the LGPD, in ANPD guidance, in MAPA dairy inspection or traceability regulations, in ADAPTO or SIE-TO requirements, or in the tax legislation of the State of Tocantins. Material changes will be communicated via our website and by WhatsApp to regular commercial clients.

All privacy requests should be directed to our Data Protection Officer (LGPD Art. 41):