Privacy Policy.

1. Who we are

The data controller is [[Green Mining legal name — to be filled in GM-09]], registered under CNPJ [[CNPJ]], headquartered at [[corporate address]]. The Data Protection Officer (DPO) can be reached at privacidade@green-mining.com.

2. Data we process

We collect only data necessary for the purposes described. Main categories:

• Identification and contact: name, email, phone, organization, role, country.
• Professional: mandate type, investment ticket, commodity, asset volume, asset location.
• Free-form messages: text content submitted via forms.
• Browsing: technical logs (IP, browser, pages visited) and cookies per Cookies Policy.

3. Purposes and legal bases

We process data on the basis of (i) execution of pre-contractual procedures (LGPD art. 7, V; GDPR art. 6(1)(b)); (ii) legitimate interest in commercial operation and security (art. 7, IX; art. 6(1)(f)); (iii) consent for non-essential communications (art. 7, I; art. 6(1)(a)); (iv) compliance with legal obligation (art. 7, II; art. 6(1)(c)).

4. Sharing

We share data only with: contractually-bound processors (CRM provider, transactional email, hosting, digital signature), under Data Processing Agreement; competent authorities, under valid legal order; and, in the investor flow, with institutional counterparties under NDA.

5. International transfers

Some processors are based outside Brazil and the EU. International transfers follow adequate safeguards (Standard Contractual Clauses or equivalent), under LGPD art. 33 and GDPR arts. 44–49.

6. Retention

We retain data as long as necessary for the purpose, observing applicable legal periods. Investor candidacy data not converted into active engagement is deleted in 24 months. Tailings owner data in inactive pipeline: 36 months. Technical logs: 6 months. General messages: 12 months.

7. Your rights

Under LGPD (art. 18) and GDPR (arts. 15–22), you have the right to: confirmation of processing; access; correction; anonymization, blocking, or deletion; portability; information on sharing; consent withdrawal; objection. To exercise, send request to privacidade@green-mining.com. We respond within 15 days.

8. Security

We apply reasonable technical and organizational measures — encryption in transit (TLS 1.2+), role-based access control, audit logging, staff training, incident response. In case of a significant security incident, we notify the competent authority (ANPD/EU authorities) and affected data subjects within legal deadlines.

9. Minors

The site is directed at professionals. We do not intentionally collect data from children and adolescents. If improper collection is identified, the data is deleted immediately.

10. Changes

Updates to this policy are published on this page. Material changes are communicated to registered data subjects with reasonable notice.

11. Supervisory authorities

Brazil: ANPD (National Data Protection Authority) — gov.br/anpd. European Union: supervisory authority of your Member State.

12. Contact

Questions, exercise of rights, or information requests: privacidade@green-mining.com.