1. Who we are and who processes your data
The controller of the personal data processed on this website is RKO ALIMENTOS LTDA, registered under Brazilian company number (CNPJ) 20.122.197/0001-49, with its head office at Alameda Grajaú, 614 - sala 502, Alphaville Industrial, Barueri (SP), postal code 06454-050, Brazil.
The controller is the party that decides why and how the data is used. Grupo RKO is the trade name used on this website for the company's set of brands and units.
Contact channel for any matter related to personal data: contato@gruporko.com.br. Head office telephone: (67) 2525-5500.
This policy applies to the public pages of gruporko.com.br. The internal management system, served under the /erp/ path of the same domain, is for corporate use, has its own access rules and is not covered by this document.
2. What data we collect
a) Data you send us through the contact form
The form on the contact page is the only point on the website where you type in data. It collects:
- name (required) and e-mail (required);
- telephone (optional, you may leave it blank);
- subject, chosen from Sales, Suppliers, Human Resources, Press and Other;
- message, the free text you write;
- the authorization checkbox, which must be ticked for the message to be sent.
Along with these fields, the form sends two technical anti-abuse signals: an invisible field that only bots fill in (a honeypot) and the time at which the page was loaded in your browser, used to discard instant submissions. They serve only to block automated submissions and do not identify you.
Based on those signals, the service discards the submission without forwarding the message in four situations: the invisible field came back filled in, the form was submitted in under 3 seconds, the page had been open for more than a day before submission, or the message carries more than four links. In those cases the screen still shows the usual confirmation, deliberately, so that a bot cannot learn what was blocked. The discarded content is not stored anywhere: the technical log of the service keeps only the reason for the discard and the IP address. If you sent a genuine message and heard nothing back, write directly to contato@gruporko.com.br or call (67) 2525-5500.
We do not ask for tax or identity numbers, banking details or sensitive data (health, biometrics, religious belief, political opinion). We also ask that you do not write that kind of information in the body of the message, because it is not needed for us to reply to you.
b) Data collected automatically
- IP address on form submission. When you send a message, the IP address the submission came from is appended to the footer of the e-mail that reaches our team, together with the date and time. In other words, whoever reads your message also sees your IP address.
- IP address in the submission limit. The form service keeps an in-memory count per IP address to limit how many messages can be sent per hour. It is a measure against spam and bulk submissions, and that count is not written to disk.
- Technical service logs. When a submission is blocked by the rate limit or discarded as automated, the IP address is noted in the technical log of the service. For normal submissions, the log records only the chosen subject.
- Server access logs. The infrastructure that serves the website automatically generates a record of each request, with date, time, IP address, requested address and browser identification.
- Market rate lookup. The home page and the news page display a band with US Dollar and Euro rates. It is your own browser that fetches those values, directly from the AwesomeAPI service. In that request your IP address becomes visible to that third party. Details in section 6.
c) Data you send us by e-mail
If you prefer not to use the careers area, you can send your résumé by e-mail, to contato@gruporko.com.br. When you write to us, you send whatever you choose to attach or type, usually your name, e-mail, telephone, city, area of interest and your résumé as a PDF, with your professional and academic history.
We do not ask for tax or identity numbers, a photograph, marital status or sensitive data in order to apply. Please avoid including that kind of information in your résumé, because it is not needed to assess the application.
The careers area (Trabalhe Conosco) has a candidate login, a form and a résumé upload. What it collects, why and for how long is in the candidate privacy policy (in Portuguese), which applies to it instead of this one. Outside it, the site has no sign-up, no employee area and no newsletter.
3. What we use it for
- To reply to your message. To read it, forward it to the relevant area of the group and get back to you through the channel you provided.
- To assess your job application. To read the résumé you sent by e-mail, consider it for open positions and keep it in our talent pool for the period given in section 7, for upcoming opportunities.
- To prevent abuse and spam. To block automated submissions, limit how often messages can be sent from one origin and keep the website available.
- To display the market rates strip. To show the US Dollar and Euro rates on the home page and on the news page. It is your browser that fetches those values, and in that request your IP address becomes visible to the external service.
- To comply with a legal obligation. To keep access logs for the period required by law and to respond to requests from competent authorities.
We do not use your data for advertising, we do not build behavioral profiles and we do not sell or commercially transfer data. The only automation that decides anything here is the form's anti-spam filter, described in section 2, which merely tells a human submission from an automated one. It does not score, classify or profile anyone.
4. Legal basis for processing
The processing described above relies on the legal bases set out in article 7 of Lei nº 13.709/2018, the Lei Geral de Proteção de Dados (Brazil's General Data Protection Law, LGPD):
- Consent (item I), for the contact form: you tick the authorization box before submitting, and you may withdraw that consent at any time through the e-mail address given in this policy.
- Compliance with a legal obligation (item II), for keeping the access logs, which the Marco Civil da Internet (Brazil's Internet Civil Rights Framework) requires from application providers.
- Preliminary procedures related to a contract (item V), for the résumé you send by e-mail: the application is assessed at your own request and precedes any hiring.
- Legitimate interest (item IX), for website security and the prevention of fraud and abuse, which includes recording the IP address the submission came from and limiting how often messages can be sent; for keeping your résumé in the talent pool once a position is closed, for the period given in section 7; and for displaying the market rates strip, which your own browser fetches from a third-party service.
Whenever processing relies on legitimate interest, you may object to it, as explained in section 8. If you object, we assess the request and stop the processing, unless another legal basis supports it, in which case we tell you which one.
What happens if you do not consent. The authorization checkbox is required only to send the contact form. Without ticking it, the message is not sent, and that is the only consequence: you keep browsing the entire website normally and you can still reach us by e-mail, at contato@gruporko.com.br, or by telephone, at (67) 2525-5500.
No content on this website sits behind consent, and refusing it creates no restriction of access.
5. Access logs
Article 15 of Lei nº 12.965/2014, the Marco Civil da Internet (Brazil's Internet Civil Rights Framework), requires application providers to keep application access logs confidential, in a controlled and secure environment, for 6 months.
We comply with that period. Those logs are restricted to the technical team and are only provided to third parties under a court order or a lawful request from a competent authority.
6. Who we share data with
We do not sell, rent or transfer personal data for commercial purposes. Internally, access is restricted to the people in the group who need the data in order to reply to you.
Beyond that, the data only passes through the providers that keep the website running, which act as processors and follow our instructions:
- Microsoft. The form message is forwarded by e-mail through Microsoft 365 (Microsoft Graph API). Microsoft processes and stores the content of that e-mail, which includes name, e-mail, telephone, subject, message and the originating IP address. A copy remains in the sent items folder of the sending account.
- Cloudflare. The website is delivered through the Cloudflare network, which works as a CDN and a security layer in front of the server. Cloudflare receives, for each visit, the IP address, the browser headers and the requested address, may keep its own access logs for security and performance purposes and may set technical protection cookies such as __cf_bm and cf_clearance.
- AwesomeAPI. On the pages that display the US Dollar and Euro rate band, your own browser queries the address economia.awesomeapi.com.br. That request carries your IP address and the usual browser headers. Nothing you type on the website is sent there. If the request fails, the band simply does not appear and the rest of the website keeps working. The details are in the Cookie Policy.
We may also share data where there is a legal obligation, an order from a competent authority or a need to defend ourselves in administrative or judicial proceedings.
7. How long we keep it
Retention period for each type of data, with the reason for each period| Data | Period | Why |
|---|
| Contact form messages | Up to 24 months | Counted from the last interaction, a period in which the matter may still be resumed. |
|---|
| Résumés sent by e-mail | Up to 12 months | Counted from receipt, so they can be considered for new positions. You may ask for deletion before that, at any time. |
|---|
| Website access logs | 6 months | The period set out in article 15 of the Marco Civil da Internet. |
|---|
| Technical log of the contact form service | Up to 6 months | Kept alongside the access logs. It only records an IP address when a submission is blocked by the rate limit or discarded as automated. |
|---|
| Submission count per IP address | 1 hour | Held in the service memory only. Once the window passes it is discarded and nothing is written to disk. |
|---|
Once these periods end, the data is deleted, except where retention is required by law or necessary for the regular exercise of rights.
The processors named in section 6 keep copies and logs of their own while they provide the service, for the periods set in their own retention policies: Microsoft, the e-mail carrying your message; Cloudflare, the access logs of the network that protects the website. When you ask for your data to be deleted, the request also reaches those copies held under our account.
8. Your rights
Article 18 of the LGPD grants you, as the data subject, the following rights over your personal data:
- Confirmation that processing exists, that is, to know whether we process any data about you (item I).
- Access to the data we hold about you (item II).
- Correction of incomplete, inaccurate or outdated data (item III).
- Anonymization, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law (item IV).
- Portability of the data to another service or product provider (item V).
- Deletion of data processed on the basis of consent (item VI), except in the retention situations set out in the law itself.
- Information about sharing, that is, to know which public and private entities we share your data with (item VII).
- Information about the possibility of not giving consent and about the consequences of that refusal (item VIII).
- Withdrawal of consent at any time (item IX).
Beyond those nine, the same law also grants you:
- Objection to processing carried out under a legal basis that does not require consent, such as the legitimate interest described in section 4 (article 18, § 2).
- Petition against the controller before the ANPD (article 18, § 1), and also before consumer protection bodies (article 18, § 8). The channels are in section 15.
- Review of automated decisions that affect your interests (article 20). The only automated decision on this website is the form's anti-spam filter, which may discard a submission, as explained in section 2. If that happens to you, write to the address below and a person will read your message.
To exercise any of these rights, write to contato@gruporko.com.br describing your request. We may ask for additional information solely to confirm your identity and avoid disclosing data to the wrong person.
We reply within 15 days of receiving the request, in accordance with article 19, item II, of the LGPD. Where the answer can be given in simplified form, it is immediate.
Handling your request is free of charge, under article 18, § 5, of the LGPD. If we cannot meet the request, we explain the reasons of fact or of law within the same deadline, as article 18, § 4, requires.
9. Security
- The whole website is served over HTTPS. Form submissions travel encrypted between your browser and our service.
- Access to the messages we receive is restricted to the corporate accounts of the people who need to reply to you.
- The form service validates the fields, limits the size of the submission and limits how often messages can be sent from one origin, which reduces the surface for abuse.
- No system is entirely immune. If a security incident occurs with relevant risk to data subjects, we notify those affected and the ANPD, in accordance with article 48 of the LGPD.
10. Cookies
Outside the careers area, this website sets no cookies of its own. It has no Google Analytics, no social network pixel, no tag manager and does no audience profiling. In browser local storage it keeps only the fact that you have seen the cookie notice, without identifying you. In the careers area, after sign-in, a first-party cookie keeps the candidate signed in.
What may exist are the technical cookies set by Cloudflare, the security layer in front of the website, such as __cf_bm and cf_clearance, which serve to tell human traffic apart from automated traffic.
Those cookies and the external request that displays the market rates are detailed in the Cookie Policy.
11. Minors
This is an institutional website aimed at customers, suppliers, job applicants and the press. It is not directed at people under 16 years of age and we do not intentionally collect personal data from children and adolescents.
If we identify that we have received data from someone under 16 without the specific consent of a parent or legal guardian, we delete the record. If you are a guardian and believe this has happened, write to contato@gruporko.com.br.
12. International transfer
The providers named in section 6, in particular Microsoft and Cloudflare, run global infrastructure and may process or store data on servers located outside Brazil.
That transfer relies on article 33 of the LGPD, under item II, which allows the transfer where the controller offers guarantees of compliance with the principles and the rights of the data subject in the form of specific contractual clauses or standard contractual clauses (points "a" and "b"). In our case, those guarantees come from the data protection addenda of those providers, accepted when the services were contracted, which incorporate international transfer clauses.
The market rates strip in section 6 is a different case: we are not the ones sending the data. It is your own browser that calls the external service, which is why your IP address becomes visible to it. The Cookie Policy explains how to block that request, should you prefer to avoid it.
13. Data Protection Officer
Data Protection Officer: to be defined.
Article 41 of the LGPD requires the controller to appoint an officer, the person responsible for receiving communications from data subjects and from the ANPD. Until that formal appointment, requests concerning personal data should be sent to contato@gruporko.com.br and are handled by the responsible area of the group, within the same deadlines described in section 8.
Once the officer is appointed, their name and contact channel start to be published here, in this section, as article 41, § 1, of the LGPD requires.
14. Changes to this policy
This policy may be updated whenever there is a change in our practices, in the tools used by the website or in the applicable legislation. The version in force is always the one published on this page, identified by the date below.
If the change is significant, such as adopting an audience measurement tool, it is announced on this page before taking effect.
Last updated: October 28, 2026
15. How to complain
If you have any question or complaint about how your data is handled, write first to contato@gruporko.com.br. We would rather resolve it directly with you.
If the answer is not satisfactory, article 18, § 1, of the LGPD gives you the right to petition against the controller before the ANPD, Autoridade Nacional de Proteção de Dados (Brazil's National Data Protection Authority), through its official channels at gov.br/anpd. You do not have to talk to us first: petitioning the ANPD does not depend on a previous attempt.
The same right may be exercised before consumer protection bodies, such as the Procon of your state, under article 18, § 8, of the LGPD.
