Privacy Policy

EnzRossi Software Solutions LTDA ("EnzRossi" or "Company"), registered with CNPJ no. 54.763.387/0001-67, headquartered at Av. Bento Munhoz da Rocha Netto, 632, Rooms 201 and 204, Ed. Torre Norte SLJ 2, Industrial Zone, CEP 87030-010, Maringá-PR, Brazil, has prepared this Privacy Policy ("Policy") to explain how we handle personal data.

EnzRossi is the controller of the personal data described in this Policy. That means we decide why and how it is processed. Our Data Protection Officer (encarregado) is the channel for questions and requests about it (Section 12).

This Policy describes how personal data from visitors to enzrossi.com, prospective and current clients, service providers, and third parties is collected, accessed, stored, used, protected, and shared. EnzRossi is committed to transparency and ethics in all its operations, including with the entities it interacts with.

When a client hires us and we handle personal data on its behalf as part of the services, the client's agreement with us governs that processing.

This Policy may be updated over time to reflect changes in internal procedures or legal requirements (Section 13).

Processing

Any operation performed with personal data, such as collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, elimination, evaluation, modification, communication, transfer, dissemination, or extraction.

Cookies

Small files sent by websites, saved on your device, that store preferences and other information to personalize your browsing experience.

Holder / User

The natural person to whom the personal data being processed belongs, such as customers, visitors, and others who interact on the website.

Personal Data

All information related to an identified or identifiable natural person.

Pseudonymous Data

Data that cannot be linked to a person without additional information kept separately, such as a random identifier assigned by an analytics tool. Unlike anonymized data, it is still personal data.

Anonymization

Use of reasonable technical means by which data loses the possibility of direct or indirect association with an individual.

Purpose

The reason personal data will be processed. Must be legitimate, specific, explicit, and communicated to the holder.

Controller

The natural or legal person responsible for decisions about the processing of personal data. For this Policy, the controller is EnzRossi.

Operator

The natural or legal person that processes personal data on behalf of the controller, such as the service providers in Section 8.

Data Protection Officer (encarregado)

Person appointed by the controller to act as a communication channel between the controller, data subjects, and the National Data Protection Authority (ANPD).

International Transfer

Transfer of personal data to a foreign country or to an international organization.

LGPD

Law No. 13,709 of August 14, 2018 (General Personal Data Protection Law). Governs the processing of personal data in Brazil to protect fundamental rights of freedom and privacy.

The data we collect depends on how you interact with us. Below are the categories, the purposes we use them for, and the legal basis under the LGPD (Law No. 13,709/2018) for each one. Fields marked as optional on our forms can be left blank.

Our multi-step forms save each step as you complete it, so we may receive what you typed in earlier steps even if you do not finish the form. Please do not send sensitive personal data (such as health, religious, or political information) through our forms or AI tools. We do not ask for it.

When you visit the website, we and our service providers also receive some data automatically:

• Technical data such as IP address, browser and device type, operating system, language, and the page that referred you
• Usage data such as the pages you view and when, collected as described in Section 6
• Server and security logs kept by our hosting provider

We use this data to run and secure the website and, depending on your cookie choices, to measure how it is used. The legal basis is our legitimate interest in operating a secure and working website (art. 7, IX, LGPD), or your consent for analytics and marketing cookies (art. 7, I, LGPD).

Regardless of the category, we may also process personal data to:

• Comply with legal or regulatory obligations, court orders, or requests from competent authorities (art. 7, II, LGPD)
• Exercise our rights in judicial, administrative, or arbitration proceedings (art. 7, VI, LGPD)

Cookies are small files sent by websites and saved on your device. We also use similar technologies, such as your browser's local storage. The full list is in our Cookie Policy.

Analytics and marketing cookies are off until you turn them on. We only set them if you accept them in the cookie banner. If you reject them or close the banner, they stay off. You can change your choice at any time with the "Cookie settings" link in the website footer.

6.1 Necessary Cookies

Required for the website to work: they remember your cookie choices and your language, and protect our forms (Section 6.5). They do not need your consent and rely on our legitimate interest in providing the website you asked to use (art. 7, IX, LGPD).

6.2 Analytical Cookies

Help us understand how visitors use the website. We use Google Analytics 4 and Microsoft Clarity, only with your consent (art. 7, I, LGPD). This data is pseudonymous, not anonymous: these tools assign a random identifier to your browser, and your IP address reaches the provider when the tools load. Clarity also records sessions (clicks, scrolling, mouse movement, and the pages you view) and builds heatmaps from them. We use this data only for statistics and to improve the website.

Google Analytics runs in Consent Mode. Before you accept analytics cookies, it sets no cookies on your device but still sends Google basic signals about the page view (such as the time, the page, and browser information, with your IP address as part of the request). Google uses these signals to produce aggregate, modeled statistics. We rely on our legitimate interest in measuring the use of the website for this (art. 7, IX, LGPD).

We also use Vercel Web Analytics, Vercel Speed Insights, and Cloudflare Web Analytics to measure traffic and page performance. They set no cookies, do not fingerprint your browser, and do not track you across sites, so they run for every visitor regardless of your cookie choices. They report to us only as aggregate numbers. The legal basis is our legitimate interest in measuring and improving the website (art. 7, IX, LGPD).

6.3 Functionality Cookies

Save your preferences and what you typed in a form (such as your name and email) in your browser, so the form can be filled in for you next time. They are saved only after you use the related form and stay on your device. You can clear them in your browser at any time, which may affect these features. The legal basis is our legitimate interest in making the website easier to use (art. 7, IX, LGPD). Details are in the Cookie Policy.

6.4 Marketing Cookies

Help us identify the companies visiting our website so our team can reach out to businesses that may be interested in our services. We use Apollo.io for this, only if you accept marketing cookies in the cookie banner. The legal basis is your consent (art. 7, I, LGPD), which you can withdraw at any time through "Cookie settings".

When active, Apollo sets a first-party cookie and receives your IP address, browser and device data, referral source, and the pages you view. Apollo matches this data against its own database to identify the company you work for and, for some visitors based in the United States, the individual and their business contact details. Our sales team may use this information to contact that company. Apollo also processes this data under its own privacy policy.

With the same consent, we use OpenAI's ChatGPT Ads Measurement Pixel to learn whether our ads in ChatGPT lead to contact and quote requests. When you send one of those requests, we tell OpenAI that it came in, with the reference of the ad you clicked, a SHA-256 hash of your email address and name, your IP address, and your browser details. We never send your email address in readable form or the content of your message. If you arrived through a campaign link, we also save its source (UTM tags) with your request so we know which campaign brought it in. See our Cookie Policy for full details.

6.5 Bot Protection on Our Forms

Our forms are protected by Cloudflare Turnstile, which tells real visitors apart from automated bots. It runs in invisible mode, so you will not see a puzzle or a checkbox. To do its job, Turnstile reads limited technical data from your browser (such as your IP address, user agent, and basic device and browser signals) and may store a token on your device. This is a necessary security measure, so it runs on every form submission regardless of your cookie choices. We do not use it for advertising or tracking. Cloudflare processes this data as our service provider under the Cloudflare Turnstile Privacy Addendum. The legal basis is our legitimate interest in protecting the website and preventing fraud (art. 7, IX, LGPD).

6.6 Managing Your Cookie Preferences

You're not required to accept non-essential cookies, and rejecting them does not stop you from using the website. You can change your choice at any time with the "Cookie settings" link in the website footer. You can also block or delete cookies directly in your browser:

• Firefox
• Chrome
• Safari
• Microsoft Edge

We never sell your personal data. We share it only as described here:

• Service providers that run parts of the website and our operations on our behalf, such as hosting, database, email, and analytics. They receive data on an ongoing basis, only for the services they provide to us. The current list is in Section 8.
• Apollo.io, if you accept marketing cookies, as described in Section 6.4
• OpenAI, if you accept marketing cookies and send a contact or quote request, as described in Section 6.4
• Clients, when you are a professional working with us: we share the professional profile and contract information needed to present you to a client or to carry out the engagement
• Professional advisers, such as accounting, legal, and auditing firms that support our operations, under a duty of confidentiality
• Judicial or governmental authorities, when required by law, court order, or a request from a competent authority, and only to the extent necessary

We store the personal data we collect through the website in the United States. Our service providers process it there, and some of them, or their subcontractors, may also process it in other countries where they operate. This is an international transfer of personal data under art. 33 of the LGPD. These are the providers that receive personal data from the website today:

We carry out these transfers under the mechanisms allowed by art. 33 of the LGPD, such as standard contractual clauses and the data protection terms each provider offers its customers, and we require providers to protect the data and use it only to provide their services to us. Where the European Union or United Kingdom General Data Protection Regulation applies, transfers rely on standard contractual clauses or other safeguards the provider offers, as applicable. You can ask us for more information about these safeguards through the channel in Section 12.

We may add or replace providers over time. When we do, we will update this list.

We keep personal data only as long as needed for the purpose it was collected for, or as required by law or contract. The criteria we use for each category:

• Contact, quote, partner, and referral forms, resource downloads, and meetings: while there is an active conversation or commercial relationship with you or your company, and afterward while we have a legitimate interest in following up, until you ask us to delete the data or object to its use
• Newsletter: until you unsubscribe or withdraw consent. We may keep a record that you unsubscribed so we do not email you again.
• AI tool usage: while needed to apply the usage limits of the tools and to follow up with you, until you ask us to delete it
• Blocked form submissions: for as long as needed to review them, recover genuine submissions blocked by mistake, and investigate abuse
• Service provider and financial data: for the duration of the contract and afterward for the periods required by tax, accounting, and labor laws and for the limitation periods in which claims can be brought
• Cookies and analytics: for the periods listed in the Cookie Policy, or until you withdraw consent or clear them, and in the analytics tools according to the retention settings of each tool

When the retention period ends, we delete or anonymize the data. Even after a deletion request, the LGPD (art. 16) allows us to keep data when necessary to:

• Comply with a legal or regulatory obligation
• Transfer to a third party in compliance with data protection law
• Keep anonymized data for our own internal use, with no third-party access

EnzRossi uses technical and administrative measures to protect your data from destruction, loss, alteration, or unauthorized access or disclosure. Our measures include:

• Protection against unauthorized access to internal systems and directories, with access limited to the people who need it
• Encrypted connections (HTTPS) between your browser and the website
• Physical access controls for locations where personal data is stored
• Requirements for partner companies and suppliers to comply with data protection law and maintain strict confidentiality

No system is completely secure. If a security incident may cause relevant risk or damage to you, we will notify you and the National Data Protection Authority (ANPD) as required by art. 48 of the LGPD and the ANPD's regulations, describing what happened, the data involved, the risks, and the measures we took.

Under art. 18 of the LGPD, you may request the following at any time through the channel in Section 12:

• Confirmation that your data is being processed
• Access to your personal data
• Correction of incomplete, inaccurate, or outdated data
• Anonymization, blocking, or deletion of unnecessary or excessive data, or data processed in breach of the LGPD
• Portability of your data to another service provider, subject to applicable regulations
• Deletion of data processed based on your consent (except where the law allows us to keep it)
• Information about the public and private entities with which we have shared your data
• Information about the possibility of not giving consent and the consequences of refusing
• Withdrawal of consent at any time, free of charge. Withdrawal does not affect processing carried out before it.
• Objection to processing based on a legal basis other than consent, if it does not comply with the LGPD (art. 18, §2)
• Review of decisions made solely on the basis of automated processing that affect your interests (art. 20). For example, if our bot protection blocked your form submission, you can ask us to review it.
• Filing a complaint about our handling of your data with the National Data Protection Authority (ANPD) (art. 18, §1)

We may ask you to confirm your identity before answering. We reply within the periods set by law, such as the 15-day period in art. 19 of the LGPD for a complete statement of your data. If we cannot meet a request, we will tell you why.

If the European Union or United Kingdom General Data Protection Regulation applies to you, you also have the rights it grants, including restriction of processing and the right to lodge a complaint with your local supervisory authority.

The controller of your data is EnzRossi Software Solutions LTDA. To exercise your rights or ask questions about how your personal data is handled, write to our Data Protection Officer (encarregado) at the privacy email below. This is our channel for privacy requests. Messages about privacy sent to contact@enzrossi.com are forwarded to the Data Protection Officer.

We may update this Policy. The version and date at the top of the page show when it last changed, and the revision history below describes each change. If a change is material, we will make it clear on the website and, where required by law, ask for your consent again.