Privacy Policy

Tereos Açúcar e Energia S.A. ("Tereos", "we", "us", or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we process personal information when you browse tereosa.com, subscribe to communications, download documents, submit contact forms, or otherwise interact with our digital services.

This policy applies to visitors and users worldwide. Depending on your location, additional rights may apply under applicable data protection laws, including the EU General Data Protection Regulation (GDPR), the UK GDPR, Brazil's Lei Geral de Proteção de Dados (LGPD), and Thailand's Personal Data Protection Act (PDPA).

The data controller responsible for personal data processed through this website is Tereos Açúcar e Energia S.A., [Thailand Office Placeholder Address] | [Brazil Office Placeholder Address]. Company Registration No. 0107536000123 (Thailand).

For privacy-related enquiries, data subject requests, or complaints, contact us at sales@tereosa.com or write to the address above, marked "Data Protection".

We may collect the following categories of personal data:

• Identity and contact data: name, email address, phone number, company, job title, and country.
• Communication data: messages, attachments metadata, and correspondence sent through contact forms or email.
• Subscription data: email address and communication preferences for newsletters or investor alerts.
• Download and gating data: email address and document access records when you request gated files.
• Technical and usage data: IP address, browser type, device identifiers, pages viewed, referral URLs, and approximate location derived from IP.
• Cookie and consent data: cookie identifiers and your analytics consent choice stored locally in your browser.

We collect personal data directly from you when you fill in forms, subscribe to updates, request downloads, or contact us. We collect technical data automatically through cookies, server logs, and analytics tools when you browse the site. We do not purchase personal data from data brokers for this website.

We use personal data for the following purposes:

• Responding to enquiries and providing customer or stakeholder support (legitimate interests / contract performance).
• Sending newsletters and corporate communications where you have opted in (consent).
• Providing access to gated documents you request (legitimate interests / contract performance).
• Operating, securing, and improving our website, including aggregated analytics (consent for non-essential analytics; legitimate interests for security).
• Complying with legal obligations, regulatory requests, and defending legal claims (legal obligation / legitimate interests).
• Managing recruitment enquiries submitted through careers channels (legitimate interests / pre-contractual steps).

We use cookies and similar technologies to enable core site functionality, remember your cookie preferences, and—only with your consent—measure website traffic and performance. For detailed information on the cookies we use and how to manage them, see our Cookie Policy.

We do not sell your personal data. We may share data with trusted service providers who process information on our behalf under contractual safeguards, including:

Where data is transferred outside your country, we implement appropriate safeguards such as standard contractual clauses or equivalent mechanisms required by applicable law.

• Website hosting and content delivery (e.g. Vercel).
• Analytics providers (Google Analytics / Google Tag Manager), only if you accept analytics cookies.
• Email and communication platforms used to respond to enquiries or send subscribed content.
• Professional advisers, auditors, or authorities where required by law.

We retain personal data only for as long as necessary for the purposes described in this policy, including to satisfy legal, accounting, or reporting requirements. Contact form submissions are typically retained for up to 24 months unless a longer period is required for ongoing correspondence. Newsletter data is retained until you unsubscribe. Server logs are retained for up to 12 months. Analytics data retention follows the settings configured in our analytics tools.

Depending on your jurisdiction, you may have the right to access, rectify, erase, restrict, or object to processing of your personal data, to data portability, and to withdraw consent at any time where processing is based on consent. You may also lodge a complaint with your local data protection authority.

To exercise your rights, email sales@tereosa.com. We may need to verify your identity before fulfilling a request. We aim to respond within 30 days, or within the timeframe required by applicable law.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These include HTTPS encryption, access controls, rate limiting on public forms, and regular security reviews. No method of transmission over the Internet is completely secure; we cannot guarantee absolute security.

This website is intended for business and general audiences and is not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us so we can delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. The "Last updated" date at the bottom of this page indicates when the policy was last revised. Material changes will be highlighted on this page.