Privacy Policy

Effective date: July 12, 2026 · Last updated: July 12, 2026

Daravus Advisory LLC (EIN 42-4341541) ("Daravus," "we," "us," or "our") respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy explains what information we collect through our website located at daravus.com and its subdomains (the "Site"), how we use and share that information, how we protect it, and the rights and choices available to you.

This Policy applies to information collected through the Site and in connection with our advisory, Fractional CFO, and M&A intermediation services (the "Services"). It does not apply to information collected through channels not owned or controlled by Daravus, or to the practices of third parties we do not control.

Because Daravus serves clients across the Brazil–United States corridor, this Policy is designed to address, where applicable, the Brazilian *Lei Geral de Proteção de Dados* (Law No. 13.709/2018, "LGPD"), the EU/UK General Data Protection Regulation ("GDPR"), and applicable United States state privacy laws, including the California Consumer Privacy Act as amended ("CCPA/CPRA").

---

1. Who We Are (Controller / Controlador)

The entity responsible for processing your personal information is:

Daravus Advisory LLC (EIN 42-4341541) A Texas limited liability company Mailing/contact address: 17304 Preston Road, Suite 800, Dallas, Texas, 75252, United States Email: privacy@daravus.com

For matters relating to the protection of personal data, including any request from a data subject, you may contact our Data Protection point of contact / *Encarregado (DPO)* at dpo@daravus.com.

---

2. Information We Collect

a) Information you provide directly. This includes information you submit when you: - complete a contact, engagement, or newsletter form; - request or complete a diagnostic assessment (such as our "Raio-X de Valor" session), which may include business and financial information relating to you or your company; - correspond with us by email, WhatsApp Business, or other channels; - engage us as a client and provide information necessary to deliver the Services.

Depending on the interaction, this may include your name, email address, phone number, company name and role, and any content you choose to share, including commercial or financial information.

b) Information collected automatically. When you visit the Site, we and our providers may automatically collect technical data such as your IP address, browser type, device identifiers, pages viewed, referring/exit pages, and interaction timestamps, through cookies and similar technologies. See Section 9 (Cookies).

c) Information from analytics, advertising, and CRM services. We use third-party technologies for marketing and analytics purposes, including Google Analytics, Google Ads, Meta Ads, and the Outreachr CRM. These technologies help us measure Site usage, understand the performance of our campaigns, and deliver relevant advertising to you across other websites and platforms. Each provider processes data under its own privacy terms. Where we integrate with social platforms (e.g., LinkedIn, Instagram, Facebook), information may be exchanged with those platforms according to their policies and your settings.

Note: We do not knowingly collect special categories of data (e.g., racial or ethnic origin, health, biometric data) through the Site. Do not submit such information through our forms.

---

3. How We Use Your Information and Legal Bases

We use personal information to: 1. respond to inquiries and provide requested information or assessments; 2. deliver, administer, and improve the Services and our client relationships; 3. send communications, newsletters, and marketing you have requested or that are permitted by law; 4. operate, secure, and improve the Site; 5. comply with legal, regulatory, tax, and professional obligations; and 6. establish, exercise, or defend legal claims.

Where the LGPD or GDPR applies, we rely on one or more of the following legal bases (*bases legais / lawful bases*): your consent; the performance of a contract or preliminary steps at your request; compliance with a legal or regulatory obligation; the legitimate interests of Daravus or a third party (balanced against your rights); and, where relevant, the regular exercise of rights in proceedings. Under the LGPD, these correspond to Article 7 of Law No. 13.709/2018.

We do not sell your personal information in exchange for money. However, because we use advertising technologies such as Google Ads and Meta Ads (see Section 9), some processing may qualify as a "sale" or as "sharing" for cross-context behavioral advertising under certain U.S. state privacy laws. Where this applies, you may opt out as described in Section 8 and through our cookie consent banner.

---

4. How We Share Information

We share personal information only as described here: - Service providers (e.g., hosting, email delivery, analytics, CRM, professional advisors) that process data on our behalf under contractual confidentiality and data-protection commitments; - Legal and safety disclosures, where required to comply with law, legal process, or a lawful request, or to protect the rights, property, or safety of Daravus, our clients, or others; - Business transfers, in connection with a merger, acquisition, financing, or sale of assets, in which case personal information may be among the assets transferred, subject to this Policy; - With your consent, or at your direction.

We may share aggregated or de-identified information that cannot reasonably be used to identify you.

[If Daravus processes payments online, name the processor(s) and link their policies here. If invoicing is done directly/offline, delete this note.]

---

5. International Data Transfers

Daravus operates across Brazil and the United States. Your personal information may be transferred to, stored in, and processed in the United States or other jurisdictions that may have data-protection rules different from those of your country of residence.

For data subjects in Brazil (LGPD): international transfers are carried out in accordance with Chapter V of the LGPD, relying on an applicable legal basis (such as your consent, contractual necessity, or other mechanisms recognized by the *Autoridade Nacional de Proteção de Dados* — ANPD).
For data subjects in the EEA/UK (GDPR): where we transfer data outside the EEA/UK, we rely on appropriate safeguards, such as Standard Contractual Clauses, or another lawful transfer mechanism.

We apply the protections described in this Policy regardless of where your information is processed.

---

6. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes described in this Policy. As a general rule, client and engagement records are retained for the duration of the applicable contract and for 12 months after its termination, in order to respond to potential audits or government inspections and to comply with legal, tax, accounting, and professional-obligation requirements, and to resolve disputes. Certain information may be retained for a longer period where a longer retention is required or permitted by applicable law. When information is no longer needed, we delete or anonymize it.

---

7. How We Protect Your Information

We implement reasonable technical and organizational measures designed to protect personal information against unauthorized access, loss, misuse, or alteration. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping any credentials you use confidential.

In the event of a security incident affecting your personal information, we will notify affected individuals and the competent authority (including the ANPD, where the LGPD applies) as required by applicable law.

---

8. Your Rights and Choices

Subject to applicable law, you may have the following rights. To exercise them, contact us at privacy@daravus.com. We will respond within the timeframes required by law and may need to verify your identity.

a) Data subjects in Brazil (LGPD, Article 18). You may request: confirmation of the existence of processing; access to your data; correction of incomplete, inaccurate, or outdated data; anonymization, blocking, or deletion of unnecessary or excessive data or data processed in noncompliance with the LGPD; portability; deletion of data processed with consent; information about entities with which we shared your data; information about the possibility of denying consent and its consequences; and revocation of consent. You may also petition the ANPD.

b) Data subjects in the EEA/UK (GDPR). You have rights of access, rectification, erasure, restriction, portability, and objection (including to processing based on legitimate interests and to direct marketing), and the right not to be subject to solely automated decisions with significant effects. You may lodge a complaint with your local supervisory authority.

c) California residents (CCPA/CPRA). You have the right to know, access, correct, and delete personal information, the right to opt out of the "sale" or "sharing" of your personal information for cross-context behavioral advertising, and the right not to be discriminated against for exercising these rights. You can exercise your opt-out through our cookie consent banner or by contacting us at privacy@daravus.com.

All users may also decline to submit information (which may limit our ability to provide certain Services), unsubscribe from marketing emails via the link in each message, and manage cookies as described below.

---

9. Cookies and Similar Technologies

We use cookies and similar technologies to operate the Site, remember your preferences, measure performance, and support our marketing. When you first visit the Site, we present a cookie consent banner that lets you accept or reject non-essential cookies by category:

Strictly necessary cookies, required for the Site to function (always active);
Analytics cookies, including Google Analytics, used to understand how visitors use the Site;
Marketing / advertising cookies, including Google Ads and Meta Ads, used to measure campaign performance and deliver relevant advertising, and cookies associated with our Outreachr CRM.

Analytics and marketing cookies are activated only after you provide consent through the banner, and you may change or withdraw your choices at any time. You can also control cookies through your browser settings. Disabling certain cookies may affect Site functionality.

Our Site [does / does not] currently respond to browser "Do Not Track" signals, as there is no common industry standard for these signals.

---

10. Children's Privacy

The Site and Services are intended for business professionals and are not directed to children. We do not knowingly collect personal information from children. Where the LGPD applies, we do not process the personal data of children and adolescents except in their best interest and in accordance with Article 14 of the LGPD. If you believe a minor has provided us personal information, please contact privacy@daravus.com and we will take appropriate steps to delete it.

---

11. Links to Third-Party Websites

The Site may link to third-party websites and services that we do not control. This Policy does not apply to those third parties, and we are not responsible for their practices. Please review their privacy policies before providing personal information.

---

12. Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where required by law, provide additional notice. Continued use of the Site after changes take effect constitutes acknowledgment of the revised Policy.

---

13. How to Contact Us

For questions about this Policy or our privacy practices, or to exercise your rights, contact:

Daravus Advisory LLC (EIN 42-4341541) 17304 Preston Road, Suite 800, Dallas, Texas, 75252, United States privacy@daravus.com

Data Protection point of contact / *Encarregado (DPO)*: dpo@daravus.com

Consent basis and withdrawal

Analytics and advertising cookies are set only after you accept them in the consent banner. Until then, Google Analytics runs with storage denied and no identifiers are written. You may withdraw consent at any time by clearing this site’s local storage in your browser or by writing to info@daravus.com, and the banner will be shown again on your next visit.