This is a translation provided for convenience. The Portuguese version is the legally binding one.
1. Who we are
The data controller, that is, the party that decides how the data is handled, is IONICZ TECNOLOGIA LTDA, trading as IONICZ Segurança da Informação, Brazilian company registry (CNPJ) 50.779.543/0001-27, headquartered in São Paulo, SP, Brazil.
Our data protection officer (DPO), who handles requests from data subjects and from the Brazilian Data Protection Authority (ANPD), is Lucas Cravero, at [email protected].
2. Data, purposes and legal bases
We handle only what each situation below requires. The legal bases are those in article 7 of the Brazilian General Data Protection Law (LGPD, Law 13,709/2018).
| Situation | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Contact form | Name, email, company, phone, motivation, service of interest and message, together with the page, the language, the date and the version of this policy you accepted. | Reply to your message. | Consent (art. 7, I), given by ticking the box on the form. | 12 months from the last contact. |
| Proposal request | The contact data and what is exchanged during the negotiation. | Prepare and negotiate the proposal you asked for. | Preliminary steps to a contract, at the data subject's request (art. 7, V). | 24 months from the last contact. If a contract follows, the contract and legal periods apply. |
| Protection against bots and abuse | IP address and technical browser data. The IP is stored only as a code (a keyed hash) that cannot be turned back into the address. | Block automated submissions and repeated attempts on the form. | Legitimate interest in the security of the site (art. 7, IX). | The IP code is deleted within 48 hours. |
| Website access logs | IP address, date and time, page accessed and browser, recorded by the hosting server. | Comply with the mandatory retention of access logs and investigate incidents. | Legal obligation (art. 7, II), under article 15 of the Brazilian Internet Civil Framework (Law 12,965/2014). | 6 months. |
| Cookie choice | A random consent code, the accepted categories, the date, the language, the page and the version of this policy. No IP, name or email. | Remember your choice and prove it was made, as article 8, paragraph 2, of the LGPD requires. | Legal obligation (art. 7, II) and the regular exercise of rights (art. 7, VI). | 5 years. |
| Statistics and ads | Pages viewed, where the visit came from, interactions and cookie identifiers (see section 3). | Measure visits and the results of our ads on Google and Meta. | Consent (art. 7, I), given in the cookie notice. | As listed in the cookie table. |
| Data subject requests | The request, the data needed to confirm your identity and our reply. | Handle your request and prove that we did. | Legal obligation (art. 7, II) and the regular exercise of rights (art. 7, VI). | 5 years. |
We make no automated decisions about you and build no profiles from the form. We do not handle sensitive data: please do not include it in your message.
4. Who we share data with
We do not sell or rent data. It only goes through the providers below, which handle it on our behalf (processors) or, for Google and Meta with marketing accepted, also on their own account:
- Hostinger: hosting of the site, the access logs and the consent records (policy).
- Cloudflare: anti-bot check on the form and network protection for the site (policy).
- Notion: internal database where the contact is recorded for the team to reply (policy).
- Brevo: sends the email that tells the team about a new contact (policy).
- Microsoft: the team's business email, where the notice and the replies are handled (policy).
- Google and Meta: statistics and ads, only with your consent (section 3).
If you message us on WhatsApp, the conversation takes place in Meta's app and is also subject to its rules. We may also disclose data to authorities when the law or a court order requires it.
5. International transfers
Some providers store or process data outside Brazil: Notion, Cloudflare, Google, Meta and Microsoft in the United States and other countries, and Brevo in the European Union. These transfers follow article 33 of the LGPD. We choose providers that commit by contract to protecting the data, and we send each one only what its role requires.
6. How long we keep data
The retention period for each situation is in the table in section 2, and for cookies in section 3. When the period ends, or when you ask and there is no legal obligation to keep the data, it is deleted or anonymized. Provider backups are overwritten in their normal cycles.
7. Your rights
Under article 18 of the LGPD, you can ask at any time for:
- confirmation that we handle your data, and access to it;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of data that is unnecessary, excessive or handled against the law;
- portability of the data to another provider;
- deletion of the data handled on the basis of your consent;
- information about who we share the data with;
- information about the option of not giving consent and what happens if you do not;
- withdrawal of consent, free of charge and as easily as it was given;
- objection to processing done without consent, if it breaks the law.
To exercise any of them, write to [email protected]. We may ask for information to confirm the request is yours. We reply within 15 days. For cookies, withdrawal is immediate in Cookie preferences.
If you are not satisfied with our reply, you can file a petition with the Brazilian Data Protection Authority (ANPD).
8. Security
Information security is our job, and we apply here what we recommend to clients: an always encrypted connection (HTTPS with HSTS), a content security policy that only allows the sources listed on this page, credentials kept outside the public area of the server, an anti-bot check, a per-visitor submission limit with the IP stored only as a hash, each provider's access limited to what it needs (the Notion connection, for example, can only add contacts and cannot read the database) and technical logs without personal data.
If a security incident may bring you relevant risk or harm, we notify the ANPD and the people affected within the regulatory deadlines (article 48 of the LGPD). Found a vulnerability on the site? See our security contact.
9. Children and teenagers
The site is aimed at businesses and is not meant for people under 18. We do not knowingly collect data from children or teenagers. If that happens, write to [email protected] and we will delete the data.
10. Changes to this policy
When this policy changes, the new version and its date appear at the top of this page. Each contact and each cookie choice is linked to the version in force at that moment. If a change affects something that depends on your consent, such as a new statistics or ads tool, we ask for your choice again.