Legal documents
Last updated: September 19, 2026
Policy
01
Fortunne Capital S/A, enrolled with the Brazilian CNPJ under No. 21.214.245/0001-91, headquartered at Av. Presidente Juscelino Kubitschek, 1327, Suite 41, Vila Nova Conceição, São Paulo/SP, ZIP 04543-011, is the controller of the personal data processed through this website, under Law No. 13,709/2018 — the Brazilian General Data Protection Law (LGPD).
02
Fortunne Capital’s Data Protection Officer is Dra. Laura Lucia Mendes de Almeida (OAB nº 18.267), who may be contacted by email at compliance@fortunne.com.
03
This policy applies to every person who accesses fortunne.com, completes forms available on the website, subscribes to the house’s publications, requests contact with Fortunne Club, signs up for Educa+ tracks or communicates with Fortunne through the channels indicated here.
04
| Source | Data |
|---|---|
| Confidential diagnostic form | Name, email, phone, city and state, profile, subject, preferred office and message |
| Project submission form | Responsible person’s name, company, CNPJ, email, phone, city and state, project type, stage, capital need, target timeline and project description |
| Fortunne Club contact form | Name, email, phone, city and state, profile and contact source |
| Publication subscription | Name, email and profile |
| Educa+ track registration | Name, email and profile |
| Communication by email, phone or WhatsApp | Identification data and communication content |
IP address, access date and time, browser type and version, operating system, device type, language, pages visited, time spent and access origin.
Through this website, Fortunne does not collect CPF numbers, identity-document numbers, bank details, card numbers, income information, wealth values or sensitive personal data as defined by article 5, II, of the LGPD.
05
| Method | Description |
|---|---|
| Direct provision | Completion of forms and communication with Fortunne |
| Automatic collection | Cookies and similar technologies, as described in section 10 |
| Public sources and third parties | Data obtained from public sources or provided by partners, when applicable to an existing relationship |
06
| Purpose | Description |
|---|---|
| Contact response | Responding to requests, scheduling diagnostics and conducting service |
| Preliminary project review | Assessing projects submitted by companies and developers |
| Institutional relationship | Conducting relationships with investors, companies, families and Fortunne Club members |
| Sending publications | Sending analyses, insights and educational content to data subjects who requested them |
| Access to educational content | Making Educa+ tracks available to registered data subjects |
| Website improvement | Measuring audience, understanding navigation and improving content and performance |
| Security | Preventing fraud, misuse and security incidents |
| Legal compliance | Meeting legal and regulatory obligations and requests from competent authorities |
Data is not used for automated decisions with legal effects on the data subject or for credit profiling.
07
| Purpose | Legal basis — LGPD, art. 7 |
|---|---|
| Contact response and service | Pre-contractual procedures related to a contract, at the data subject’s request (item V) |
| Preliminary project review | Pre-contractual procedures related to a contract, at the data subject’s request (item V) |
| Institutional relationship | Legitimate interest (item IX) |
| Sending publications and educational content | Consent (item I) |
| Website improvement and audience measurement | Legitimate interest (item IX) |
| Security and fraud prevention | Legitimate interest (item IX) |
| Compliance with legal or regulatory obligation | Legal obligation (item II) |
| Regular exercise of rights | Regular exercise of rights (item VI) |
Where processing is based on consent, the data subject may revoke it at any time through the channels indicated in section 13.
08
Personal data may be shared with:
| Recipient | Purpose |
|---|---|
| Technology service providers | Hosting, email sending, storage and service tools |
| Regulated institutions and partners | Execution of regulated acts related to a transaction, when applicable and with the data subject’s awareness |
| Legal, accounting and audit advisers | Compliance with legal obligations and regular exercise of rights |
| Public authorities | Compliance with legal or regulatory obligation or court order |
| Companies in the same economic group | Conducting the institutional relationship |
Fortunne does not sell, rent or assign personal data to third parties for commercial or advertising purposes.
09
Part of the technology services used by Fortunne Capital S/A is hosted outside Brazil, which may involve international data transfer. Fortunne entities in the United Kingdom, United States, Portugal and Switzerland may receive data when the relationship involves internationalization transactions.
Every international transfer observes the requirements of articles 33 to 36 of the LGPD, through contractual safeguards equivalent to those provided by Brazilian law.
10
| Category | Function | Consent |
|---|---|---|
| Necessary | Website operation, security and form submission | Exempt |
| Performance | Audience measurement and navigation analysis | Required |
| Functional | Language and display preferences | Required |
| Marketing | Campaign measurement and remarketing | Required |
The cookie banner is displayed on first access, with options to accept, reject and manage by category. Non-necessary cookies are only activated after acceptance. Preferences can be changed at any time through the “Cookie preferences” link in the footer.
The map on the Contact page and embedded videos are loaded only after the user clicks, without activating third-party cookies before consent.
11
| Data | Period |
|---|---|
| Contacts that did not evolve into a relationship | Up to 24 months from the last contact |
| Active relationship data | For the duration of the relationship and for applicable legal periods after termination |
| Submitted and unapproved projects | Up to 24 months from submission |
| Publication and Educa+ registrations | Until consent is revoked |
| Website access records | 6 months, under article 15 of Law No. 12,965/2014 |
| Data subject to legal or regulatory obligation | For the period required by the applicable rule |
After the period ends, data is deleted or anonymized, except in the cases provided by article 16 of the LGPD.
12
Fortunne adopts technical and administrative measures to protect personal data, including encrypted-connection transmission, role-based access control, environment segregation, access logging, backups and confidentiality commitments with employees and providers.
No system is entirely immune to incidents. In the event of a security incident involving relevant risk to data subjects, Fortunne will notify Brazil’s National Data Protection Authority and the affected data subjects under article 48 of the LGPD.
13
Under article 18 of the LGPD, the data subject may request:
How to exercise rights: by email at compliance@fortunne.com. Fortunne responds within 15 days and may request additional information to confirm the requester’s identity.
The data subject may also file a complaint with Brazil’s National Data Protection Authority.
14
This policy may be changed at any time. The date of the last update appears at the top of the page.
