This Privacy Policy describes how Br Lux Ltda ("we," "our" or "the Company") collects, uses, stores and protects personal data of our clients, website visitors and all persons whose data we process in connection with our wholesale electrical materials distribution activities in Guapiaçu, São Paulo, Brazil.
As a registered limited liability company (Ltda) operating in the wholesale electrical materials trade sector, we are committed to full compliance with the LGPD (Lei nº 13.709/2018), the Brazilian Consumer Protection Code (CDC — Lei nº 8.078/1990) where applicable to our commercial relationships, and the tax obligations of SEFAZ-SP and ICMS-SP. As a wholesale distributor (comércio atacadista), our primary clients are legal entities (electricians, construction companies, contractors and resellers) rather than individual consumers — which shapes the nature of the personal data we process and the legal framework that applies.
Introduction and Scope
This Policy applies to all personal data processed in connection with our wholesale electrical materials distribution — clients who purchase materials, prospective clients who request quotes, website visitors and any person whose data we process. Our primary client base consists of legal entities (companies, MEIs and firms) rather than individual consumers. Personal data we process relates primarily to the natural persons who are the legal representatives, contacts and beneficial owners of these companies — not to the companies themselves, which are legal persons not directly protected by the LGPD. However, sole traders (MEIs), individual electricians and sole proprietors are natural persons and are directly protected by the LGPD with respect to their personal data.
Identity of the Controller
Type: Sociedade Limitada (Ltda)
CNPJ: 48.279.035/0001-38
Activity (CNAE): Comércio Atacadista de Material Elétrico
Address: R. Leonardo Comar, 117, Residencial Leonor, Guapiaçu — SP, CEP 15110-000, Brazil
Email: privacy@brlux.com.br
Personal Data We Collect
A. Business client registration and purchase data:
- Company clients (CNPJ): Company name, CNPJ, billing address, delivery address, name and contact details of the procurement or purchasing contact. The company itself is not a data subject under the LGPD, but the natural person who is the contact is.
- Individual professional clients (MEI / CPF): Name, CPF, address, WhatsApp and email of electricians, sole-trader contractors and individual professionals who purchase wholesale from us. These individuals are natural persons directly protected by the LGPD.
- Purchase and order history: Records of materials purchased, quantities, order dates and delivery addresses — retained as part of the commercial relationship and required for NF-e documentation.
B. Quote and prospecting data:
- Name, WhatsApp, company name and material description when prospective clients request a wholesale quote via our website or WhatsApp.
C. Technical website data:
- IP address, browser type and pages visited when a visitor accesses our website.
Purpose and Legal Basis
| Purpose | Legal Basis (LGPD) |
|---|---|
| Wholesale order management and commercial relationship | Contract performance (Art. 7º, V) |
| Client registration and credit assessment | Contract performance; Legitimate interest |
| Issuing NF-e per wholesale order | Contract performance; Legal obligation (Art. 7º, II) |
| ICMS-SP — fiscal bookkeeping (SEFAZ-SP) | Legal obligation (Art. 7º, II) |
| Sped Fiscal / EFD contributions (SEFAZ-SP) | Legal obligation (Art. 7º, II) |
| Purchase history and client account management | Contract performance; Legitimate interest |
| Website analytics and improvement | Legitimate interest; Consent (cookies) |
Sharing of Data
- SEFAZ-SP / Receita Federal: NF-e data — client CNPJ or CPF on every invoice, transmitted electronically as required. SPED Fiscal / EFD obligations transmitted to SEFAZ-SP.
- Logistics / transport partners (where applicable): Delivery address and order reference shared with transport companies for physical delivery of materials. Governed by a data processing agreement.
- Financial institutions / credit assessment (where applicable): For credit limit assessments on commercial accounts — only with the client's prior knowledge as part of the commercial account opening process.
- PROCON-SP / Senacon: When required under the CDC or commercial dispute resolution.
- Legal authorities: When required by court order or administrative authority.
International Transfers
Our wholesale distribution operation is based in Guapiaçu, SP. All client data is processed in Brazil. Tax records (NF-e, SPED Fiscal) are processed exclusively in systems certified by the Receita Federal and SEFAZ-SP. Any communication platforms operating on international servers do so under the guarantees of Art. 33 of the LGPD.
Retention Periods
- NF-e and fiscal documentation (SEFAZ-SP): Minimum 5 years as required by Brazilian federal and São Paulo state tax legislation. SPED Fiscal / EFD retained for the same period.
- Active client data (CNPJ / CPF, contact, purchase history): Retained for the duration of the commercial relationship and for 5 years after the last purchase — consistent with tax retention and commercial statute of limitations.
- Quote requests without order: Up to 1 year from the date of the quote — to follow up on project timelines and respond to reactivated enquiries.
- Website analytics: Aggregated and anonymised after 12 months.
Security Measures
- Client purchasing data and pricing agreements stored in access-controlled commercial management systems — not accessible to unauthorised staff;
- NF-e issued using a certified digital certificate (A1/A3) approved by the Receita Federal;
- Client contact data handled via WhatsApp and email with discretion — not shared within the team beyond what is necessary to process each order;
- Website encrypted (HTTPS);
- Incident response procedures in accordance with LGPD Art. 48.
Your Rights under the LGPD
Natural persons in our client base — individual electricians, MEIs, sole-trader contractors and individual purchasing contacts at companies — have the following rights:
- Confirmation and Access (Art. 18, I–II): Confirm what personal data we hold and receive a copy.
- Correction (Art. 18, III): Request correction of inaccurate personal data (e.g., address changes, contact updates).
- Deletion (Art. 18, IV): Request deletion — subject to mandatory fiscal retention (NF-e: 5 years; SPED Fiscal: 5 years) and commercial statute of limitations.
- Portability (Art. 18, V): Receive your personal data in a structured format.
- Complaint to the ANPD (Art. 18, §1º): Lodge a complaint at www.gov.br/anpd.
We respond within 15 business days.
Cookies and Tracking
Our website may use cookies for essential functionality and aggregated performance analytics. We do not use behavioural tracking or advertising cookies. Cookie preferences can be managed through your browser settings.
Minors
Our wholesale electrical materials distribution is directed exclusively at professional buyers — registered companies, MEIs and individual professionals operating in the electrical installation and construction sectors. We do not sell to or process data of minors. If a minor contacts us, we ask them to have an adult business representative manage any commercial enquiry.
Wholesale Trade, NF-e and ICMS-SP
Updates to this Policy
This Policy may be updated to reflect changes in our activities, in the LGPD, in ANPD guidance, or in the tax legislation of the State of São Paulo. Material changes will be communicated by email or WhatsApp to active clients.
Contact and Data Protection Officer
All privacy requests should be directed to our Data Protection Officer (LGPD Art. 41):
Privacy — Br Lux Ltda
ANPD — Autoridade Nacional de Proteção de Dados
www.gov.br/anpd