Privacy Policy

Last updated: January 1, 2026 | Version 3.2

1. Introduction

Concessionária do Aeroporto Internacional de Guarulhos S.A. (CNPJ: 15.578.569/0001-04), herein referred to as "GRU Airport", "we" or "us", is committed to protecting the privacy and personal data of our customers, employees, partners, candidates and visitors.

This Privacy Policy describes how we collect, use, store, share and protect personal information, in compliance with the Brazilian General Data Protection Law - LGPD (Law No. 13.709/2018), the GDPR (where applicable), and other applicable regulations.

2. Personal Data We Collect

2.1 Information you provide directly

Identification data: full name, CPF/SSN, ID, date of birth, nationality
Contact information: residential/business addresses, phones, personal and corporate emails
Professional data: company, position, area of expertise, education
Payment data: bank information, credit card data (processed by PCI-DSS certified gateway)
Digital identifiers: login, encrypted password, security question answers

2.2 Automatically collected information

Navigation data: IP address, browser type and version, operating system, pages visited, time spent
Cookies and similar technologies: essential, performance, functional, analytics and marketing
Device data: unique identifiers, device type, screen resolution
Geolocation: approximate, based on IP (only if explicitly authorized)

3. Purposes of Processing

We use your personal data for the following purposes:

Service delivery and contractual obligations
Customer support and communication
Recruitment and talent acquisition
Marketing communications (with prior consent, with opt-out available)
Legal and regulatory compliance
Analytics, product improvement and user experience
Fraud prevention, AML and anti-terrorism financing
Legal defense in judicial, administrative or arbitration proceedings

4. Data Sharing

GRU Airport does not sell, rent or trade personal data. We only share information in the following cases:

Service providers: hosting, payment processing, analytics, customer support (all under strict confidentiality agreements and LGPD-compliant DPAs)
Public authorities: upon court order or legal request
Credit protection agencies: when applicable
Corporate restructuring: in case of merger, acquisition or spin-off
With your explicit consent: for any other specific purpose

International Transfer

Some of our service providers may be located outside Brazil. In such cases, we ensure transfers occur to countries with adequate data protection levels, or through standard contractual clauses approved by ANPD.

5. Information Security

We adopt rigorous technical and organizational measures to protect your data:

Encryption in transit (TLS 1.3) and at rest (AES-256)
Multi-factor authentication (MFA) for critical systems
24/7 monitoring by SOC (Security Operations Center)
Role-based access control (RBAC) with least privilege principle
Regular penetration testing and bug bounty program
Multi-region encrypted backups
ISO 27001, ISO 27701 and SOC 2 Type II certifications
Incident response plan with ANPD notification within 72h as required by LGPD

6. Data Retention

Your data will be retained for the time necessary for the purposes it was collected, respecting:

Legal deadlines (e.g., tax data must be kept for 5 years)
Contractual deadlines plus statute of limitations
Legitimate interest for fraud prevention and legal defense
Consent until revoked by the holder

7. Your Rights as Data Subject (LGPD)

Under Article 18 of LGPD, you have the right to:

Confirmation of processing
Access to your data
Correction of incomplete, inaccurate or outdated data
Anonymization, blocking or deletion of unnecessary or excessive data
Portability to another provider
Deletion of data processed with consent
Information about data sharing
Information about consequences of refusal
Revocation of consent at any time
Petition to ANPD (National Data Protection Authority)

8. Cookies

We use the following cookie categories:

Essential: required for basic site operation
Performance: anonymous usage analytics (Google Analytics)
Functional: personalization (language, preferences)
Marketing: targeted advertising (Meta Pixel, Google Ads)

9. Data Protection Officer (DPO)

To exercise your rights or clarify questions about personal data processing:

Email: [email protected]
Phone: +55 (11) 2445-2945
Address: Rodovia Hélio Smidt, s/nº - Guarulhos/SP - 07190-100

10. Policy Changes

This policy may be updated periodically. Substantial changes will be communicated by email or site notice. We recommend periodic review.