Privacy

Privacy Policy

Last updated: 21 July 2026

The Hill Capital respects your privacy. This Policy explains, in plain language, what personal data this website collects, why it is collected, who it is shared with and how you can exercise your rights under the Brazilian General Data Protection Law (Law No. 13,709/2018 — “LGPD”).

We wrote this document describing only what this website actually does. If something is not mentioned here, it is because we do not do it: there is no login area, no user registration, no online store, no newsletter, no advertising pixel and no remarketing.

Who controls your data

The controller of the personal data processed through this website — that is, the party who decides what is collected and why — is:

The Hill Capital Assessor de Investimento e Corretora de Seguros Ltda

Company tax ID (CNPJ) 42.858.685/0001-51

São Paulo

Rua Bandeira Paulista, 275
3rd floor — Itaim Bibi
São Paulo/SP — Brazil

Franca

Av. Paulo VI, 805
Jardim Alvorada
Franca/SP — Brazil

contato@thehill.capital

We are an investment advisory firm registered with the Brazilian Securities and Exchange Commission (CVM) under CVM Resolution 178, operating in the financial market as an agent of Banco BTG Pactual S/A.

Data Protection Officer (DPO). You can reach our Data Protection Officer at contato@thehill.capital, using the subject line “LGPD — Data Protection Officer”.

What this Policy covers

This Policy applies to the website www.thehill.capital — the institutional page in Portuguese (/) and its English version (/en/) — and to this page itself.

It does not apply to: (i) third-party websites reached through our links — BTG Pactual, Instagram, LinkedIn, Facebook, ANCORD, the Brazilian Central Bank —, each governed by its own policy; or (ii) the processing carried out by Banco BTG Pactual S/A within the banking and custody relationship, which is governed by that institution's own privacy policy.

What data we collect

3.1 · Data you send us

The website has only two forms, and each one collects exactly the fields below — nothing else:

  • “Contact us” form — name and e-mail (required), phone, city and message (optional).
  • “Join our team” form (job application) — name, phone/WhatsApp and e-mail. We do not ask for a résumé, photo, identity documents or salary expectations in this form.

Both forms include a hidden anti-spam field (a honeypot) that is invisible to and never filled in by people; its only purpose is to block automated submissions.

Please do not include in your message sensitive personal data (art. 5, II of the LGPD), account numbers, passwords, copies of documents or a detailed description of your assets. Those subjects are handled through an appropriate channel, once we have securely identified you.

3.2 · Data collected automatically

  • Audience measurement (Google Analytics 4). Only if you accept analytics cookies in the banner, GA4 records pages visited, time on page, traffic source, device type, browser, operating system, language and approximate location (city/country, derived from the IP address, which Google truncates). If you decline, the Analytics script is simply not loaded.
  • Hosting technical logs. Regardless of the banner, the server that delivers this website records access logs (IP address, date and time, page requested and user agent) for as long as needed to operate the site, keep it secure and prevent abuse. These records are not used to build advertising profiles.

We do not use advertising pixels, remarketing, heatmaps, session recording, or data enrichment from third-party databases. We do not buy and do not sell personal data.

Purposes and legal bases

Every processing activity requires a specific purpose and a legal basis set out in art. 7 of the LGPD. Ours are:

Replying to the message you sent through the form and assessing, together with you, a possible advisory relationship.

Legal basisPreliminary procedures related to a contract, at the data subject's request (art. 7, V).

Following up during the commercial process and keeping a record of that conversation.

Legal basisLegitimate interest (art. 7, IX). You may object at any time — simply ask us to stop.

Assessing your job application and getting back to you about selection processes.

Legal basisPreliminary procedures related to a contract, at the data subject's request (art. 7, V).

Measuring website audience with Google Analytics 4, to understand what is useful and improve the content.

Legal basisConsent (art. 7, I), collected through the cookie banner and revocable at any time.

Keeping the website online and secure, recording logs and preventing spam, fraud and abuse.

Legal basisLegitimate interest (art. 7, IX).

Retaining records required by capital markets regulation and by anti-money-laundering legislation, once the contact evolves into an actual relationship.

Legal basisCompliance with a legal or regulatory obligation by the controller (art. 7, II).

We do not use your data for automated decisions affecting your interests, nor to build risk or credit profiles.

Cookies and similar technologies

This website uses very little. Here is the complete list:

  • Your choice in the banner — your decision (accept or decline) is stored locally in your browser, solely so the banner does not reappear on every visit. It does not identify you and is not sent to third parties.
  • Google Analytics cookies (_ga and _ga_<ID>) — created only after you accept. They distinguish visitors in a pseudonymised way and measure sessions. They expire within up to 2 years, per Google's default.

There are no advertising cookies, social-media cookies or any third-party cookies beyond those listed above. Declining analytics cookies does not limit any functionality of the website: everything keeps working, including the forms.

How to withdraw consent

Who we share data with

We share data only with those necessary to run the website and to serve you. The list is short and complete:

  • Netlify, Inc. — hosts the website and receives form submissions (Netlify Forms). Responses are stored in The Hill Capital's account on the platform and forwarded by e-mail to our team. Netlify acts as a processor, following our instructions.
  • Google LLC — provides Google Analytics 4, triggered only with your consent.
  • Microsoft Corporation — provider of Microsoft 365 / Exchange Online, our corporate e-mail service — needed for us to receive and reply to the messages sent through the forms.
  • Banco BTG Pactual S/A — only if and when the relationship evolves into opening an account or contracting products. At that stage, the necessary data also comes to be processed by BTG, as the financial institution responsible for custody and for executing transactions, under its own privacy policy. Simply submitting the contact form does not, by itself, transmit any data to BTG.
  • Public authorities and regulators — CVM, the Brazilian Central Bank, COAF, the Federal Revenue Service and the Judiciary, where there is a legal request or a regulatory duty.

We do not sell, rent or otherwise transfer personal data for third-party advertising purposes, under any circumstances.

International transfers

Netlify, Google and Microsoft process data on servers located outside Brazil, primarily in the United States. This means that information sent through the forms and browsing data measured by Analytics and the messages we receive by e-mail may be stored abroad.

These transfers are made under art. 33 of the LGPD and rely on the contractual data protection commitments offered by those suppliers — in particular their data processing addenda and the standard contractual clauses they apply, which require a level of protection compatible with Brazilian law.

How long we keep it

We keep data only for as long as the purpose that justified it requires:

  • “Contact us” messages — for up to 24 months from the last contact, if the relationship does not progress.
  • Job applications — for up to 12 months, so we can consider you for new openings; after that, they are deleted.
  • Hosting technical logs — for the retention period practised by the hosting provider, typically under 12 months.
  • Google Analytics data — according to the retention configured in the account, following Google's default for event-level data (14 months).
  • Records of a relationship actually started — for the minimum periods required by capital markets regulation and anti-money-laundering legislation (as a rule, at least 5 years after the relationship ends), plus any period needed for the regular exercise of rights in judicial, administrative or arbitration proceedings.

Once the applicable period ends, data is irreversibly deleted or anonymised.

Information security

We adopt technical and administrative measures that are reasonable and proportionate to the size of the operation: the website is served exclusively over an encrypted connection (HTTPS/TLS); access to form responses is restricted to the team members who need to handle them; and we work with well-established hosting and analytics providers that maintain their own security programmes.

Even so, no system is entirely immune. Should a security incident occur with relevant risk to your rights, we will notify the Brazilian Data Protection Authority (ANPD) and you, as required by art. 48 of the LGPD.

Your rights and how to exercise them

Art. 18 of the LGPD grants you the right, at any time and free of charge, to request:

  • Confirmation of whether or not we process your data.
  • Access to the data we hold about you.
  • Correction of incomplete, inaccurate or outdated data.
  • Anonymisation, blocking or deletion of data that is unnecessary, excessive or processed in breach of the law.
  • Portability to another service provider, upon express request.
  • Deletion of data processed on the basis of your consent.
  • Information about the public and private entities with which we share data.
  • Information about the possibility of not giving consent and about the consequences of refusing.
  • Withdrawal of consent, at any time, by express statement.
  • Objection to processing based on legitimate interest, where the law has not been complied with.

To exercise any of them, write to

contato@thehill.capital

Use the subject line “LGPD — Data Subject Rights”. We will reply within 15 days. We may ask for additional information to confirm your identity — this protects you, so that nobody can access your data by impersonating you. There is no charge.

If you believe your request was not properly addressed, you may file a complaint with the Brazilian Data Protection Authority — gov.br/anpd.

Children and teenagers

This website is aimed at people aged 18 or over who are interested in investment advisory services and in professional opportunities. We do not knowingly collect data from children or teenagers. If we identify that we have received data from a minor without the specific, prominent consent of a parent or legal guardian, we will delete the record.

Changes to this Policy

We may update this Policy to reflect changes to the website, to the providers we use or to applicable legislation. The “last updated” date at the top of the page always indicates the version in force. Where a change is significant, we will flag it visibly on the website before the new version takes effect.

Contact us

Questions about this Policy, about how we handle your data or about any point above? Talk to us directly at contato@thehill.capital, or at our offices: Rua Bandeira Paulista, 275, 3rd floor, Itaim Bibi, São Paulo/SP; and Av. Paulo VI, 805, Jardim Alvorada, Franca/SP — Brazil.