Information Security and Privacy Policy

1. Purpose and scope

This policy sets out the guidelines SpiritShop (CNPJ 19.982.591/0001-78) follows to protect the confidentiality, integrity and availability of the information it processes. It applies to all employees, contractors and partners with access to SpiritShop systems or data, and covers the corporate website, the e-commerce platform, integrations with marketplaces, ERPs and social commerce platforms, and all supporting infrastructure.

2. Governance and responsibilities

• Company leadership approves this policy and appoints a person responsible for information security and data protection, who coordinates the program, assesses risks and oversees incidents.
• The policy is reviewed at least once a year or whenever there is a significant change in systems, legislation or risks.
• All employees and contractors are bound by confidentiality obligations and are responsible for complying with this policy. Non-compliance is subject to disciplinary and contractual measures.

3. Data classification and protection

• Information is classified as public, internal or confidential. Personal data, integration credentials and customers' business data are always treated as confidential.
• All traffic between users, stores and APIs uses encryption in transit (HTTPS/TLS 1.2 or higher).
• Passwords are stored only as strong salted hashes; third-party tokens and API keys are stored encrypted and are never exposed in source code or repositories.
• We collect only the data strictly necessary for the stated purpose (data minimization).

4. Access control

• Access to systems and data follows the principles of least privilege and need-to-know: each person receives only the permissions required for their role.
• Multi-factor authentication (MFA) is mandatory for admin panels, infrastructure, corporate email, code repositories and partner integration accounts.
• Accounts are individual and non-transferable; credentials are never shared.
• Access rights are reviewed periodically and revoked immediately upon termination or change of role.

5. Network and infrastructure security

• Production, staging and development environments are segregated; real production data is not used in test environments.
• Administrative services and databases are not publicly exposed and are protected by firewalls and source-restricted access rules.
• We apply network threat protections such as a web application firewall, rate limiting, malicious traffic blocking and anti-spam/anti-bot filters on forms.
• Servers and dependencies receive security updates continuously, with critical patches prioritized.

6. Endpoint protection and daily security baseline

• Company computers run active, up-to-date anti-virus/anti-malware software, operating systems with automatic updates, and encrypted disks.
• Automatic screen locking after inactivity and strong passwords (managed with a password manager) are mandatory.
• We follow a clear-desk and clear-screen policy: confidential information is never left exposed, printed or unlocked unattended.
• Lost or stolen devices must be reported immediately so access can be revoked.

7. Secure development

• All code goes through version control and review before reaching production.
• We follow application security best practices (such as OWASP recommendations): input validation, protection against injection, XSS and CSRF, and safe error handling.
• Secrets and credentials are never committed to version control; they are kept in protected configuration files or secret vaults.
• Third-party libraries and dependencies are kept up to date and checked for known vulnerabilities.

8. Backup and business continuity

• We perform regular backups of databases and files, stored securely and separately from the primary environment.
• Restore procedures are tested to ensure services can be recovered after a failure or incident.

9. Logging and monitoring

We keep access and security event logs across systems and infrastructure, protected against tampering and retained for as long as necessary for investigations and legal compliance. Alerts on anomalous behavior are followed up by the responsible team.

10. Incident management

• We have an incident response process covering identification, containment, eradication, recovery and post-incident review.
• Incidents involving personal data that may result in relevant risk or harm to data subjects are reported to Brazil's National Data Protection Authority (ANPD) and to affected data subjects, as required by the LGPD and applicable regulations.
• Affected customers and integration partners (such as marketplaces and commerce platforms) are notified without undue delay, in line with contractual obligations.

11. Vendors and partner integrations

• Vendors with access to data (hosting, email, payments, analytics) are assessed for their security and privacy practices before being engaged.
• When integrating with marketplaces, social networks and commerce platforms, we request only the minimum access scopes needed, store tokens encrypted, and use the data received solely to operate the merchant's orders, catalog and customer service.
• We do not sell, rent or share data received from partners for unauthorized purposes, and we comply with the data policies of every integrated platform.

12. Privacy and personal data protection (LGPD)

Data we collect on this website: name, email, phone/WhatsApp, company and message voluntarily submitted through the contact and newsletter forms, plus browsing data collected by analytics cookies (Google Analytics).

Purposes and legal bases: responding to sales and support requests (pre-contractual steps), sending newsletter content (consent, which may be withdrawn at any time), improving the website (legitimate interest) and meeting legal obligations.

Data processed on the platform: for the stores we operate, SpiritShop acts as a processor of end consumers' data, following the instructions of the merchant (controller) and this policy.

Retention: we keep data only for as long as needed for its purpose or as required by law, after which it is deleted or anonymized.

Your rights: you may request confirmation of processing, access, correction, anonymization, portability, deletion, information about sharing and withdrawal of consent by writing to contato@spiritshop.com.br.

Cookies: we use essential cookies (such as language preference) and analytics cookies. Analytics cookies are used only with your consent. Details and preference management in our Cookie Policy.

13. Awareness and training

Employees are briefed on this policy during onboarding and receive periodic training on phishing, social engineering, safe password use and data protection.

14. Contact

Questions, data subject requests or security vulnerability reports can be sent to contato@spiritshop.com.br. Vulnerability reports made in good faith are handled confidentially.

SpiritShop · CNPJ 19.982.591/0001-78 · Curitiba – PR, Brazil.