Privacy notice

The Made in Bangladesh Expo in São Paulo, Brazil, is organised by the Brazil Bangladesh Chamber of Commerce & Industry (BBCCI), a joint chamber licensed by the Ministry of Commerce, Government of Bangladesh.

BBCCI decides how and why personal data is used on this website and in the participant portal, and is responsible for that use. Under Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018), BBCCI is therefore the controller of that data.

Address: Shanta Skymark, Level 12, 18 Gulshan Avenue, Gulshan, Dhaka-1212, Bangladesh. E-mail for privacy questions: [email protected]

This notice explains how BBCCI handles personal data when you:

• use this website, including its forms for exhibitor applications, visitor registration, enquiries and press accreditation
• use the participant portal as an exhibitor, delegate, buyer, visitor, speaker or journalist
• receive newsletters, e-mails, WhatsApp or SMS messages from BBCCI about the expo
• attend the expo, where badges are scanned at the entrance and the event is photographed and filmed

Brazil's LGPD applies to personal data collected in Brazil or used to offer services to people in Brazil, even though BBCCI is based in Bangladesh (LGPD, Art. 3). Bangladesh's Personal Data Protection Act, 2026 applies to BBCCI's handling of the personal data of participants in Bangladesh.

The website and the portal are meant for business participants. They are not directed at children, and BBCCI does not knowingly collect children's personal data. If you believe a child has sent us personal data, tell us and we will delete it.

Other websites linked from this site, such as an embassy's or a partner's, have their own privacy notices.

If you apply to exhibit or to join the business delegation, BBCCI collects:

• company details: legal name, address, sector, products, website, profile and logo
• contact persons: names, designations, e-mail addresses and mobile or WhatsApp numbers of the owner and of the people who handle the application
• company documents: for example the trade licence, TIN and VAT certificates, certificate of incorporation, export and import licences and the owner's profile
• representatives: names, designations and passport details of the people who will attend, where needed for badges and visa-support letters
• visa documents: if you use the visa desk in the portal, the documents from the embassy's checklist that you choose to upload, such as a passport copy, national ID, photographs, bank statements, tax certificates and police clearance
• hotel requests: names and dates of stay, if you ask BBCCI to request rooms for you
• acceptance of the terms: the date, time, IP address, browser and version of the terms when you accept them

If you add colleagues to your company's account, request badges for your team or register a co-exhibitor, please make sure they know about this notice.

If you register as a Brazilian buyer or trade visitor, BBCCI collects your name, company, CNPJ, the company's legal name (razão social) and trade name (nome fantasia), your job title, e-mail address and mobile or WhatsApp number. The form may also ask about the sectors that interest you and about your company's import activity, as you declare it.

When you enter a CNPJ, the form fills in your company's details from Brazil's public CNPJ register. BBCCI does not ask for your CPF when registration is free.

If you apply for press accreditation, BBCCI collects your name, the outlet you work for, your role, your contact details and the credentials you send, such as a press card or a letter from your editor.

If you speak at the expo, BBCCI collects your name, title, organisation, photograph and a short biography, which are published on the programme and speaker pages.

If a colleague or a group coordinator registers you, they give BBCCI your details and should tell you about this notice.

Whatever your role, BBCCI may also collect:

• Payments: proforma and final invoices, deposit slips, receipts, and the payer's name and bank reference. If online payment is enabled, you enter card or mobile-wallet details on the payment gateway's own pages; BBCCI does not see or store them and receives only the result, amount, date and reference of the transaction.
• Enquiries and newsletters: what you send through the contact, stall-booking and sponsorship forms, and the e-mail address and language you give for newsletters.
• Portal account: your sign-in e-mail and password, and a record of each sign-in, such as the date, time and device.
• Technical data: IP address, browser and device type, pages visited, the link or campaign that brought you to the site, and security logs. BBCCI's e-mails may record whether they were delivered and opened. Cookies are explained in the cookie policy.
• At the expo: the time your badge is scanned at the entrance, and photographs and video of the event, which may show participants and visitors.

To run your participation: reviewing applications, issuing invoices and receipts, registering visitors, issuing badges, allocating stalls, publishing your company's directory listing as agreed in the terms, preparing the visa-support letters you ask for, sending reminders about deadlines and payments, and answering your questions. Legal basis: performing a contract with you, or steps you asked for before one (LGPD, Art. 7, V).

With your consent: each of the following has its own box, never pre-ticked, so you can agree to one and refuse another (LGPD, Art. 7, I and Art. 8):

• sharing a buyer's contact details with exhibitors, so that they can propose a meeting during the B2B sessions BBCCI organises at the expo
• e-mail updates and newsletters about the expo
• messages by WhatsApp or SMS
• analytics and marketing cookies

To comply with the law: for example accounting and tax records, and requests from authorities that BBCCI must answer (LGPD, Art. 7, II), and to establish or defend legal claims (LGPD, Art. 7, VI).

For legitimate interests: keeping the website and portal secure, preventing fraud and misuse, keeping records accurate (for example by merging duplicate registrations) and reporting on the expo with photographs and video. BBCCI weighs these interests against your rights, and you can object (LGPD, Art. 7, IX).

BBCCI does not sell personal data. It shares data only in the cases below, and only what each recipient needs:

• Brazil-side partners that BBCCI names for each edition, for tasks such as visitor registration, logistics and on-site services
• the Brazilian company or person that signs an invitation letter for your visa, only if you ask for one; they receive the details the letter must show, such as your name and passport number
• exhibitors, who receive a buyer's contact details only with that buyer's separate consent
• hotels, if you ask BBCCI to request rooms for you
• service providers working for BBCCI under contract, such as hosting, security, e-mail, messaging and payment providers, which may use the data only on BBCCI's instructions
• authorities, where the law requires it

Whatever your company publishes in the public exhibitor directory, including any contact details on its profile, can be seen by anyone.

BBCCI is based in Bangladesh and the expo takes place in Brazil, so personal data moves between the two countries. BBCCI's service providers may also store data in other countries, with the safeguards the law requires.

When BBCCI collects data directly from you in Brazil, this is not an international transfer, but the LGPD still applies. When a Brazilian partner passes your data to BBCCI in Bangladesh, that is an international transfer under the LGPD; it is protected by the standard contractual clauses approved by Brazil's National Data Protection Authority (ANPD) or by another mechanism allowed by Article 33 of the LGPD.

Under Bangladesh's Personal Data Protection Act, 2026, passport, national ID and tax numbers are sensitive personally identifiable data when they are sent abroad. BBCCI sends them to Brazil only when this is needed for something you asked for, such as an invitation letter.

BBCCI keeps personal data only as long as it needs it for the edition you took part in, the follow-up after that edition, and its legal, accounting and tax duties. After that, the data is deleted or anonymised.

Passport copies, national ID copies and other visa documents are deleted automatically once the edition is over and they are no longer needed. Records of the consents you gave or withdrew are kept as proof of your choices.

If your company agreed to appear in the archive of a past edition, it can ask BBCCI at any time to remove its listing.

BBCCI protects personal data with technical and organisational measures suited to the data, such as encrypted connections, encryption of passport details and identity documents, access limited to the staff who need it, secure staff sign-in, activity logs and protected backups.

No system is entirely free of risk. If a security incident may cause you significant risk or harm, BBCCI will notify the competent authorities and the people affected, as the law requires.

Under the LGPD you can ask BBCCI, free of charge, to:

• confirm whether it processes your personal data, and give you access to it
• correct data that is incomplete, inaccurate or out of date
• anonymise, block or delete data that is unnecessary, excessive or not processed in line with the law
• transfer your data to another provider, under the rules set by the ANPD
• delete data processed with your consent, except where the law allows BBCCI to keep it
• tell you which public and private bodies it has shared your data with
• tell you that you may refuse consent, and what happens if you do
• withdraw your consent

You can also object to processing based on another legal ground if it does not comply with the law.

To make a request, write to [email protected]. BBCCI may first ask you to confirm your identity. Under the LGPD, BBCCI gives a complete reply within 15 days of your request.

If you are in Bangladesh, you can use the rights that Bangladesh's Personal Data Protection Act, 2026 gives you by writing to the same address.

Consent is always your free choice, given for a specific purpose. Bangladesh's Personal Data Protection Act, 2026 also requires consent to be voluntary, specific, clear and revocable. Saying no to an optional purpose does not affect your registration.

You can withdraw consent at any time, free of charge: use the unsubscribe link in any newsletter, change your cookie choices through the “Cookie settings” link in the footer, or write to [email protected]. Withdrawal applies from that moment and does not affect what was done before.

If you withdraw consent to share your details with exhibitors, BBCCI stops sharing them. Exhibitors that received them earlier are responsible for their own use of them, and you can also ask them directly to delete your details.

This website uses necessary cookies so that it works, and analytics and marketing cookies only if you allow them. The cookie policy explains each category and how to change your choice at any time through the “Cookie settings” link in the footer.

For questions or requests about your personal data, write to [email protected] or to BBCCI at Shanta Skymark, Level 12, 18 Gulshan Avenue, Gulshan, Dhaka-1212, Bangladesh. A Portuguese-speaking contact for people in Brazil will be added to this notice.

You also have the right to complain to Brazil's National Data Protection Authority (ANPD) or to the competent authority in your country.

BBCCI may update this notice, for example when the services on this site change. The date at the top shows the current version. If a change affects how your data is used, BBCCI will also inform registered participants by e-mail or in the portal.