Privacy Policy.

This Policy applies to all personal data processed in connection with our IT services — clients who engage us for helpdesk, maintenance, infrastructure, security or consulting services, website visitors who submit quote requests, and any person whose data we process. We distinguish between two types of data: (a) our own business data — data about our clients (as companies and individuals), for which we are the controller; and (b) client system data — personal data within client systems that our technicians may access during support — for which the client is the controller and we act as a processor/operator.

A. Client business data (we are the controller):

• Client identification: Company name, CNPJ or CPF, billing address, contact name, email and WhatsApp — for service engagement management, SLA tracking and NF-e issuance.
• Service history and IT environment documentation: Records of support tickets, maintenance jobs performed, IT assets serviced and infrastructure documentation — retained as part of the client relationship and for NF-e documentation.
• Remote access credentials (technical): Where remote support tools require, temporary access credentials or remote session tokens. These are operational access records, not personal data in themselves, but are handled with strict confidentiality.

B. Client system data (we are the processor / operator — LGPD Art. 39):

• When performing IT support — whether remote or on-site — our technicians may access client systems. Those systems may contain personal data about the client's own employees, customers, patients or other data subjects. This is the client's data, for which the client is the controller. We process this data solely and exclusively to perform the technical task requested — not for any other purpose.
• We do not copy, retain, analyse or share client system data beyond what is strictly necessary for the support task at hand. Access is logged per session and per technician.

C. Website and quote data:

• Name, company, WhatsApp and service description when submitting a quote request via the website.
• IP address, browser type and pages visited.

• SEFAZ-SP / Receita Federal: NF-e / RPS data — client CNPJ or CPF on service invoices, transmitted electronically.
• ISS / Prefeitura de São Paulo: ISS bookkeeping on IT services rendered in São Paulo.
• Legal authorities: When required by court order or administrative authority.
• PROCON-SP / Senacon: When required under the CDC or commercial dispute resolution.

Our operation is based in São Paulo, SP. Our own client data is processed in Brazil. For remote support tools and cloud management platforms, data may transit international servers — we use only platforms with adequate data protection standards under Art. 33 of the LGPD. Tax records (NF-e / RPS) are processed exclusively in systems certified by the Receita Federal and SEFAZ-SP. When performing support on client cloud environments (e.g., Microsoft 365, AWS, Google Cloud), the international data transfer obligations of those environments are governed by the client's own data processing agreements with those platforms — not by ours.

• Client system data accessed during support: Not retained beyond the support session. Remote access session logs (technician ID, date, duration, client) are retained for 1 year for security audit purposes and then deleted.
• Service history and IT asset documentation: Retained for the duration of the client relationship and for 5 years after the last engagement — for reference in ongoing support and consistent with the commercial statute of limitations.
• NF-e / RPS (ISS São Paulo / SEFAZ-SP): Minimum 5 years as required by Brazilian federal and São Paulo state tax legislation.
• Quote requests without engagement: Up to 1 year from the date of the request.
• Website analytics: Aggregated and anonymised after 12 months.

• All remote support sessions logged with technician ID, client, date, time and duration — audit trail maintained for 1 year;
• Remote access to client systems performed via industry-standard encrypted remote support tools — not via consumer-grade applications;
• Temporary access credentials for client systems deleted immediately after the support session is completed;
• Client IT environment documentation stored in access-controlled systems — not accessible to any party other than the assigned technician and the managing partner;
• NF-e / RPS issued using a certified digital certificate (A1/A3) approved by the Receita Federal;
• Website encrypted (HTTPS);
• Incident response procedures in accordance with LGPD Art. 48.

Our client business data:

• Confirmation and Access (Art. 18, I–II): Confirm what personal data we hold about you and receive a copy.
• Deletion (Art. 18, IV): Request deletion — subject to mandatory fiscal retention (NF-e: 5 years) and service history retention for ongoing support.
• Portability (Art. 18, V): Receive your data in a structured format.
• Complaint to the ANPD (Art. 18, §1º): Lodge a complaint at www.gov.br/anpd.

Personal data within client systems (you are the controller): If you are a client and wish to exercise LGPD rights on behalf of your own employees or customers whose data may have been accessed during support, you should contact us to review the session access log for the relevant engagement. We can confirm what systems were accessed, by which technician and at what time — so you can make an informed assessment of any data exposure.

We respond within 15 business days.

Our website may use cookies for essential functionality and aggregated performance analytics. We do not use behavioural tracking or advertising cookies. Cookie preferences can be managed through your browser settings.

Our IT support and technical services are directed exclusively at businesses and professional clients. We do not provide services directly to minors and do not collect data from minors. If a client's IT systems contain data about minors (e.g., a school's student management system), any support access to those systems is subject to our heightened care obligations as a processor — in particular, LGPD Art. 14 protections for children's data — and is documented in the session access log.

This Policy may be updated to reflect changes in our activities, in the LGPD, in ANPD guidance on IT service providers and processor obligations, or in the tax legislation of the Municipality of São Paulo or the State of São Paulo. Material changes will be communicated by email or WhatsApp to active clients.

All privacy requests — including requests to review session access logs, requests for a data processing agreement (DPA) under Art. 39 LGPD, or general LGPD enquiries — should be directed to our Data Protection Officer (LGPD Art. 41):