Integrity is part of the process.

In brief

In Brazil, a company answers for an act of corruption committed in its interest or benefit even if no one in management ordered it: Law 12,846/2013 adopts strict liability (art. 2), and the fine runs from 0.1% to 20% of gross revenue for the last financial year (art. 6, item I). An integrity programme that works in practice lowers that bill: Decree 11,129/2022 requires up to 5% to be deducted from the fine’s calculation base (art. 23, item V).

This page gathers the policies that apply to every group company, to those who work in them and to those who work with them. Each section says what the rule requires, in plain terms, and what the group adopts on that basis. Where something does not yet exist or is not published, the page says so too, in the section What we do not claim.

The text of the laws and decrees cited was checked on 4 October 2026 on the official pages listed under References. This page informs and does not replace legal advice.

What the Anti-Corruption Law requires

Law 12,846/2013 deals with the liability of legal entities. It applies to business and simple partnerships, foundations, associations and foreign companies with a seat, branch or representation in the country (art. 1, sole paragraph). Its central points:

• Strict liability. The company answers, in administrative and civil terms, for harmful acts committed in its interest or benefit, exclusively or not (art. 2). Strict means that the debate over the company’s fault stops being the centre of the case.
• Individuals answer too. Punishing the company does not exclude punishing directors, managers and anyone who took part in the act; directors answer to the extent of their culpability (art. 3, main provision and § 2).
• The group is in the calculation. Parent companies, subsidiaries, affiliates and, within the contract, consortium members are jointly liable for the fine and for full reparation of the damage (art. 4, § 2). In practice, one company’s risk reaches the others.
• What counts as a harmful act (art. 5). Promising, offering or giving an undue advantage to a public official or to a person connected to them; financing or sponsoring such acts; using an intermediary to hide real interests; defrauding tenders and contracts (rigging bids, driving off a bidder, fraudulently creating a company to bid, obtaining an undue advantage from extensions and amendments, manipulating a contract’s economic and financial balance); and hindering the investigation or inspection work of public bodies.
• Administrative sanctions (art. 6). A fine of 0.1% to 20% of gross revenue for the last financial year before the proceeding was opened, excluding taxes, and never lower than the advantage obtained when it can be estimated; and extraordinary publication of the decision, which includes a notice posted for at least 30 days at the company’s own premises and on its website. Full reparation of the damage remains due (§ 3).
• Judicial sanctions (art. 19). Forfeiture of assets representing the advantage obtained; partial suspension or interdiction of activities; compulsory dissolution; and a ban on receiving incentives, subsidies, grants, donations or loans from public bodies and institutions for 1 to 5 years.
• Time limit. Infringements lapse after five years, counted from awareness of the infringement or, if continuing, from the day it ceased (art. 25).
• Leniency agreement (art. 16). A company that genuinely cooperates with the investigation may sign an agreement with the authority: it identifies the others involved and promptly hands over information and documents proving the wrongdoing. The agreement exempts it from the extraordinary publication and from the ban on receiving incentives and reduces the fine by up to two thirds (§ 2).

Integrity counts when the sanction is calculated. Among the factors the law requires to be considered are internal integrity mechanisms, audit and encouragement of reporting, and the effective application of codes of ethics and conduct (art. 7, item VIII). Decree 11,129/2022 turns that into numbers: from the fine calculation, up to 5% of the base is subtracted for having and applying an integrity programme, up to 1.5% for cooperating with the investigation and up to 2% for voluntarily admitting liability (art. 23). The 5% maximum applies only if the programme predates the harmful act (art. 23, sole paragraph, item III). A programme built after the problem is worth less.

Integrity programme

An integrity programme is the set of internal integrity mechanisms and procedures, audit and encouragement of reporting of irregularities, plus the effective application of codes of ethics and conduct, used to prevent, detect and correct misconduct against the public administration and to maintain a culture of integrity (Decree 11,129/2022, art. 56). The decree adds that the programme must be structured, applied and updated according to each company’s characteristics and risks. Law 12,846/2013 and Decree 11,129/2022 are the standard we adopt.

Article 57 of the decree lists fifteen parameters for assessing a programme. What the group adopts corresponds to them:

• Commitment from management, which follows the same rules it demands.
• Periodic assessment of each development’s risks.
• A code of conduct and policies, extended to suppliers and partners.
• Due diligence before hiring third parties and supervision during the contract.
• Complete accounting records and internal controls.
• An ethics line open to employees and the public, protecting those who report in good faith.
• Investigation of reports and proportionate measures.
• Continuous review of the programme itself.

The Office of the Comptroller General (CGU) organises the subject into five pillars, in the guide it published for private companies. The table shows each pillar and where it appears here.

The CGU guide is, in the document’s own words, guidance without normative or binding force, and it reminds readers that there is no ready-made formula: each programme is built for the company. The decree also requires the programme to be assessed considering the company’s size and specifics, such as sector, headcount, use of intermediaries and degree of contact with government (art. 57, § 1).

This programme has no third-party certification. It is applied and reviewed by the group’s own management.

Code of conduct

The code of conduct is the text that turns the law into day-to-day rules. The decree asks for standards of conduct applicable to all employees and managers, whatever their position, and extended to third parties where necessary (art. 57, items II and III). In the group, seven rules apply:

• Comply with the law, including when it delays the schedule.
• Treat everyone with respect: harassment and discrimination are not tolerated.
• Keep information about owners, investors, partners and residents confidential.
• Record decisions, with the reason, where everyone can check them.
• Use the development’s resources only for the development’s purpose.
• Safety before deadlines, on site and off it.
• Report any deviation through the Ethics line.

The decree calls the consequences of violating the programme disciplinary measures (art. 57, item XI). In the group, a breach of the rules is investigated and leads to proportionate measures.

Anti-corruption policy

The Brazilian Criminal Code punishes active corruption, which is offering or promising an undue advantage to a public official so that they perform, omit or delay an official act, with imprisonment of 2 to 12 years and a fine (art. 333). Law 12,846/2013 punishes the company for the same kind of conduct, direct or indirect (art. 5, item I). The United Nations Convention against Corruption, promulgated in Brazil by Decree 5,687/2006, asks countries to criminalise promising, offering or granting an undue benefit to a public official, domestic or foreign (arts. 15 and 16). The group’s policy starts there:

• It is forbidden to offer, promise, give, request or accept any undue advantage, directly or through an intermediary, to a domestic or foreign public official, or to a person connected to them.
• There are no facilitation payments: no “urgency fee” for a licence, inspection or filing, whatever the amount.
• Dealings with public bodies are filed and, whenever possible, in writing; meetings that address decisions about the development include at least two team members and a record of what was discussed.
• In public tenders and contracts, no price-fixing, fraud or steering.
• The group makes no donations to parties or candidates, which Brazilian electoral law prohibits for legal entities. Sponsorships and social donations require recorded approval.
• Intermediaries who act before public bodies, such as filing agents and licensing consultants, undergo due diligence and sign a contract with an anti-corruption clause.

Two explanations help anyone new to the subject. First, a “facilitation payment” is a small sum paid to speed up an act the public body should perform anyway. Article 5, item I, speaks of an undue advantage and distinguishes neither amount nor purpose, which is why the policy makes no exception. Second, the intermediary matters: the law reaches an advantage given “directly or indirectly” and the use of an intermediary to hide the real interests (art. 5, items I and III). The decree, for its part, asks for specific procedures for any interaction with the public sector, even through third parties, such as paying taxes, undergoing inspections and obtaining licences, permits and certificates (art. 57, item VIII), and for risk-based due diligence when hiring filing agents and consultants (art. 57, item XIII, sub-item a).

On election donations: Law 9,504/1997 had its art. 81, which provided for company donations to campaigns, repealed (repeal by Law 13,165/2015, noted in the consolidated text of Law 9,504 itself), and art. 24 continues to list sources prohibited from donating to parties and candidates. The group’s policy is simple and broader than the question: no donation to any party or candidate.

Tenders, competition and public contracts

Anyone who contracts with the public sector, or depends on it for licences, is subject to three sets of rules that add up:

The sanctions of ban and unsuitability go into public registers: the National Register of Unsuitable and Suspended Companies (CEIS, Decree 11,129/2022, art. 58) and the National Register of Punished Companies (CNEP, Law 12,846/2013, art. 22), the latter created to give publicity to sanctions applied under the Anti-Corruption Law. That is why a sanction stops being a private matter: it becomes visible to anyone about to hire the company.

The group’s policy for this ground fits in one sentence: in public tenders and contracts, no price-fixing, fraud or steering, and every dealing with a public body filed and recorded, as described in the Anti-corruption policy.

Conflicts of interest

A conflict of interest exists when a personal interest may weigh on a decision that should be made on merit alone. Anyone with a personal interest, their own, a relative’s or a partner’s, in a decision, contract or supplier declares it beforehand and does not take part in the decision, which passes to another seat. The declaration is recorded. Outside activity that competes with the group requires prior authorisation.

For example, if a relative of the person deciding were a partner in a company invited to quote, the rule above would call for the link to be declared before the quotation, for that person to step out of the decision, and for another seat to decide. Recording the declaration is what allows anyone to check afterwards that the rule was followed. The same logic appears under Governance: executing, inspecting and auditing are different seats, and no one checks their own work.

Gifts and hospitality

A gift is a common way for an undue advantage to look like courtesy. The law covers an advantage given directly or indirectly (Law 12,846/2013, art. 5, item I), and the decree asks for due diligence in carrying out and supervising sponsorships and donations (art. 57, item XIII, sub-item c). The group’s rules:

• Only institutional gifts of symbolic value, with no expectation of anything in return, are accepted.
• Never cash or equivalents, such as vouchers and gift cards.
• Nothing from anyone in an ongoing quotation, negotiation or decision with the group.
• Travel or hospitality paid by a third party only for a technical purpose and with recorded approval.
• When in doubt, decline politely and record it.

Two of the rules look at context, not at value: the expectation of something in return, and whether a quotation, negotiation or decision is under way.

Privacy and personal data

We process personal data in accordance with Brazil’s General Data Protection Law (Law 13,709/2018) and collect only what each purpose requires. Data subjects may request access, correction, deletion and portability, and withdraw consent at any time. The data protection officer can be reached at privacidade@inncorporate.com.br. The full policy is under Privacy, and cookie consent can be reviewed through the Consent link in the footer.

What the law says, in simple terms:

• Personal data is information relating to an identified or identifiable natural person; sensitive data concerns racial or ethnic origin, religious belief, political opinion, trade-union membership, health, sex life, genetic or biometric data (art. 5, items I and II).
• Principles (art. 6): purpose, adequacy, necessity, free access, data quality, transparency, security, prevention, non-discrimination, and accountability. Necessity means limiting processing to the minimum for the purpose.
• Legal bases (art. 7): processing is allowed only in the cases the law lists, such as the data subject’s consent, compliance with a legal obligation, performance of a contract at the data subject’s request and legitimate interest, which does not prevail where the data subject’s rights require protection.
• Data subject rights (art. 18): confirm whether processing takes place, access, correct, request anonymisation, blocking or deletion of unnecessary or excessive data, portability, know with whom data was shared, know they may refuse consent and withdraw it. Requests are handled free of charge, within the deadlines set by regulation (art. 18, § 5).
• Data protection officer (art. 41): the controller appoints a person who receives complaints from data subjects and communications from the national authority, and whose identity and contact are made public. Here, the contact is the e-mail above.
• Security incident (art. 48): where there is relevant risk or harm to data subjects, the controller notifies the national authority and the data subject, describing the data affected, the risks and the measures taken.
• Sanctions (art. 52): warning, a fine of up to 2% of revenue in Brazil in the last financial year, capped at R$ 50 million per infringement, daily fine, publicising the infringement, blocking or deletion of the data and suspension or prohibition of processing.

Two examples of how the necessity principle appears in practices described on this page: the Ethics line does not store the reporter’s IP address, and the text of a report never travels by e-mail or WhatsApp, only the notice of the protocol number and date.

Third-party code of conduct

Third parties are where responsibility most easily slips out of control: the decree asks for the code of conduct and integrity policies to be extended to suppliers, service providers, intermediaries and associates (art. 57, item III) and for their hiring and supervision to follow risk-based due diligence (item XIII, sub-item a). Suppliers, service providers, consultants and partners who work with the group undertake to:

• comply with labour, social security, tax, environmental and safety legislation;
• neither practise nor tolerate corruption, fraud or cartels;
• not use child, forced or slave-like labour, and not discriminate;
• comply with the Brazilian occupational health and safety regulations (NRs) on site;
• hold the licences for their own activity and dispose of waste correctly;
• protect the information and personal data received, using them only for the contract;
• declare conflicts of interest;
• subcontract only with authorisation and pass these rules on to any subcontractor;
• accept the document checks and audits provided for in the contract;
• report deviations through the Ethics line.

Non-compliance leads to suspension from the supplier base and to the measures in the contract, up to termination, without prejudice to legal action.

How the rule reaches the contract: at registration, the company goes through screening; at approval, documents, regularity and integrity are checked and, for on-site services, occupational safety too; the contract carries integrity, personal data and safety clauses, and payment is conditional on the checked measurement. No one is authorised to charge for registration, approval or invitation. The full steps, the documents requested and the criteria are under Become a supplier.

On slave-like labour, the Criminal Code defines it in art. 149: reducing someone to that condition, whether through forced labour, exhausting working hours, degrading conditions or restriction of movement because of a debt, with imprisonment of 2 to 8 years and a fine, in addition to the penalty for any violence. The third-party clause repeats the prohibition because a building site brings together many contractors and subcontractors, and the duty to avoid the problem goes beyond the first layer of contracts.

Respect at work: harassment and discrimination

The code of conduct tolerates neither harassment nor discrimination, and the Ethics line has its own categories for moral or sexual harassment and for discrimination. Brazilian law deals with the subject, among other rules, in Law 14,457/2022. Its art. 23 requires companies with an Internal Commission for the Prevention of Accidents and Harassment (Cipa) to adopt measures against sexual harassment and other forms of violence at work, among them:

• rules of conduct on the subject in internal regulations, widely communicated to employees;
• procedures to receive and follow up complaints and investigate the facts, with anonymity guaranteed to the person reporting;
• training, guidance and awareness actions, at least every 12 months, for employees at every level.

The law clarifies that receiving a complaint within the company does not replace criminal proceedings when the conduct amounts to a crime, such as sexual harassment under art. 216-A of the Criminal Code (art. 23, § 1). What this page states is what is in the code of conduct and in the line: the rule prohibits, the line receives, without requiring identification, and whoever investigates cannot be involved in the facts. Art. 23 applies to companies that have a Cipa.

How to report

Anyone may report, including anonymously, through the Ethics line. No one suffers retaliation for a report made in good faith, even if the investigation does not confirm the facts.

What happens after a report, step by step: on submitting, the person receives a protocol number and a secret code, which appear only once, on screen; whoever investigates cannot be involved in the facts; the first progress update is given within 10 business days; and with the protocol number and code it is possible to check whether the report is received, under investigation, concluded or closed. The line does not store the reporter’s IP address, and the content sits in a restricted-access record, read only by those who investigate.

What the law and good practice say about those who report:

• The decree asks for reporting channels that are open and widely publicised to employees and third parties, with mechanisms to handle reports and to protect whistleblowers acting in good faith (Decree 11,129/2022, art. 57, item X).
• Law 13,608/2018, with the rules added by Law 13,964/2019, deals with protecting the informant: preservation of identity, which is revealed only in case of relevant public interest or concrete interest for the investigation and with the informant’s formal consent (art. 4-B); protection against retaliation, such as arbitrary dismissal, unjustified change of duties and withdrawal of benefits (art. 4-C); and an exception for anyone who knowingly presents false information or evidence (art. 4-A, sole paragraph). Those rules were written for the public sector: art. 4-A requires an ombudsman or internal-affairs unit in public bodies, agencies, foundations, state-owned companies and mixed-capital companies. For the private sector they are a reference, and it is as a reference that the line adopts them.
• The CGU guide recommends that channels be accessible to third parties and the external public and that the company guarantee protection to whistleblowers in good faith, for example by accepting anonymous reports and prohibiting retaliation.

Last review of these policies: October 2026.

Rule, requirement and reflection here

A summary of the rules cited on this page and where each appears in the group’s policies.

What we do not claim

Trust also depends on knowing where the information ends. In short:

• There is no third-party certification. The group’s integrity programme has not been certified or attested by any outside body.
• The ISO standards are a reference. ISO 37001 covers anti-bribery management systems and ISO 37301 covers compliance management systems. According to ISO’s own pages, the 2016 edition of ISO 37001 has been replaced by a 2025 one, and ISO 37301 dates from 2021. Here they appear only as a reference for good practice.
• The CGU guide is guidance. Following the five pillars is not the same as holding a seal, and the CGU says the document has no normative or binding force.
• This page is not legal advice. Laws change; the text cited was checked on 4 October 2026, and the current text on the official pages prevails.

Frequently asked questions

Does the group hold an integrity or compliance certification?

No. The programme is applied and reviewed by the group’s own management. The ISO standards appear here only as a reference for good practice.

Can I report without identifying myself? And what if I lose the code?

You can: identification is optional and the line does not store the IP address. The protocol number and code appear only once, on screen, and the code cannot be recovered; write both down.

How long does an investigation take?

The first progress update is given within 10 business days. The total duration depends on the case, and this page does not promise a final deadline.

I am a supplier and was asked for a fee or a gift to join the base. What do I do?

No one is authorised to charge for registration, approval or invitation, and contact outside the process gives no preference in a quotation. Report it through the Ethics line.

I represent a public body. How does the group record meetings?

Dealings with public bodies are filed and, whenever possible, in writing. A meeting that addresses decisions about the development includes at least two team members and a record of what was discussed.

I am a journalist or an investor. Where can I see how the group accounts for itself?

The monthly and quarterly accountability, with the independent audit and the review of the risk matrix, is described under Governance. For the press, there is the Press page.

How do I exercise my rights over personal data?

Write to the data protection officer at privacidade@inncorporate.com.br. The law guarantees access, correction, deletion, portability and withdrawal of consent, at no cost to the data subject (Law 13,709/2018, art. 18).

What happens to those who break the rules?

For suppliers and partners, suspension from the base and the measures in the contract, up to termination, without prejudice to legal action. For those who work in the group companies, the investigation leads to proportionate measures.

References

Official sources read for this page (accessed 4 October 2026):

• Law 12,846/2013 (Anti-Corruption Law)
• Decree 11,129/2022
• Law 14,133/2021 (Public Tenders and Contracts)
• Law 12,529/2011 (Competition Defence)
• Criminal Code (Decree-Law 2,848/1940), arts. 149 and 333
• Law 13,709/2018 (LGPD)
• Law 13,608/2018 and Law 13,964/2019 (arts. 4-A to 4-C)
• Law 14,457/2022
• Law 9,504/1997 (consolidated text, arts. 24 and 81)
• Decree 5,687/2006 (United Nations Convention against Corruption)
• CGU, Integrity Programme: guidelines for private companies (2015, in Portuguese)
• ISO 37001, anti-bribery management systems and ISO 37301, compliance management systems, as a reference only