Legal
Data Protection: LGPD and GDPR
How N1 Global complies with Brazil's General Data Protection Law (Law No. 13,709/2018, "LGPD") and the European Union's General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"). The full details are in the Privacy Policy.
This is a courtesy translation. The Portuguese (pt-BR) version is the binding document; in case of any discrepancy, the Portuguese text prevails.
1. Why both laws
NN1 GB LLC is a United States company that serves sellers in Brazil and Latin America and delivers orders to consumers in the European Union. The LGPD applies because we offer services to people in Brazil and process data collected in Brazil. Because we also process data of people in the European Union to deliver products sold to them, we observe the GDPR.
Where the two laws differ, we follow the rule that is more protective of the data subject.
2. Data subjects and the data we process
N1 is the controller of the data of sellers, affiliates, team members and website visitors. End consumer data is processed to carry out delivery and support for the sellers' orders.
| Seller, affiliate and team member | Registration, login (including with Google), payout bank details and platform usage. Where to send requests: N1. |
|---|---|
| Website visitor | Browsing, analytics cookies (with consent) and messages sent to us. Where to send requests: N1. |
| Seller's end consumer | Name, address, phone number, email, items and amount to be collected for the order; tracking. Where to send requests: the store where you bought or N1, which forwards and supports the request. |
| End consumer contacting support | Messages, refund form and bank details for refunds. Where to send requests: the store where you bought or N1. |
3. Legal bases
Legal bases applied to the data of sellers, affiliates, team members and visitors. We do not intentionally process sensitive personal data.
| Performance of a contract (LGPD, art. 7, V; GDPR, art. 6(1)(b)) | Account, platform, payouts and support for sellers and affiliates. |
|---|---|
| Legal or regulatory obligation (LGPD, art. 7, II; GDPR, art. 6(1)(c)) | Tax and accounting records, orders from authorities. |
| Legitimate interest (LGPD, art. 7, IX; GDPR, art. 6(1)(f)) | Security, fraud prevention, auditing and guidance emails to sellers, with an unsubscribe option. |
| Consent (LGPD, art. 7, I; GDPR, art. 6(1)(a)) | Analytics cookies (Google Analytics 4). |
4. Sharing
- Partner logistics operators and carriers in Europe: receive the order data needed to store, ship, deliver, collect payment and handle returns.
- Stores and platforms connected by the seller (Shopify, CartPanda, Digistore24, API and webhooks): receive status and tracking back.
- Technology providers: hosting (Railway), database (Supabase), network and file storage (Cloudflare), email (Mailgun), artificial intelligence (OpenAI and Google Gemini), login and analytics (Google), shipment tracking (17TRACK) and address geocoding (OpenCage), as detailed in the Privacy Policy.
- Authorities, when required by law.
- We do not sell personal data.
5. International transfers
Data flows between Brazil, the United States and the European Union: our technology infrastructure is located outside Brazil, and the consumer's address needs to reach the warehouse and the carrier in the country of delivery.
We limit these transfers to what is necessary to carry out delivery and operate the platform.
6. Your rights
You may also lodge a complaint with the ANPD (Brazil) or with the data protection authority of your country in the European Union.
- Confirmation and access
- Correction
- Anonymization, blocking or deletion
- Portability
- Information about sharing
- Withdrawal of consent
- Objection to processing based on legitimate interest
- Review of automated decisions
7. How to exercise your rights
- Write to us — Send an email to [email protected] with "Data Protection" in the subject line.
- Tell us who you are — Seller, affiliate, visitor or consumer of a store. If you are a consumer, include the order number and the store.
- Identity confirmation — We may ask for additional information to confirm your identity.
- Reply — We reply within the legal deadlines. When the request also depends on the store where you bought, we forward it to the store and let you know.
8. Retention
We keep data for as long as necessary for the purposes for which it was collected and to comply with legal obligations, in particular tax and accounting obligations related to the operations. After that, it is deleted or anonymized.
9. Security and incidents
Access control by role and by operation, individual authentication, hashed passwords, encryption in transit, approval for changes to bank details and audit logging.
In an incident involving relevant risk or harm, we notify the ANPD, the competent European authority and the data subjects within the legal deadlines, and we inform the sellers whose orders are affected.
10. Contact
Privacy channel: [email protected].
Controller of the data of sellers, affiliates, team members and visitors: NN1 GB LLC, EIN 39-2521930, 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, US.
Want to exercise a right or ask a question?
Write to [email protected] with “Data Protection” in the subject line.