Privacy Policy

1. Who is responsible for your data

The controller is Evorigo Consultoria em TI Ltda, CNPJ 68.382.071/0001-30, Rua Visconde do Rio Branco, 1488, Curitiba/PR, CEP 80420-210, Brazil ("Evorigo", "we").

Our channel for data subjects, under LGPD art. 41 and ANPD Resolution 18/2024, is privacy@evorigo.com.

2. What we collect

This website has no forms, accounts or advertising. We handle only:

• Messages you send us by email: your name, email address, company and whatever you choose to write.
• Access logs kept by our hosting provider: IP address, date and time, requested page, browser and device type.
• Aggregated audience and performance metrics: pages viewed, referrer, country, device type and load times. These metrics are collected without cookies and do not identify individual visitors.

We do not use advertising cookies, tracking pixels or fingerprinting, and we do not sell or rent personal data.

3. Why we use it and on what legal basis

• Answering your message and preparing a proposal: steps prior to a contract at your request (LGPD art. 7, V; GDPR art. 6(1)(b)), or our legitimate interest in replying to business contacts (LGPD art. 7, IX; GDPR art. 6(1)(f)).
• Keeping access logs: legal obligation under the Brazilian Internet Civil Framework (Law 12,965/2014, art. 15) (LGPD art. 7, II; GDPR art. 6(1)(c)).
• Measuring audience and performance and protecting the website against abuse: legitimate interest, using only aggregated or minimal data (LGPD art. 7, IX and art. 10; GDPR art. 6(1)(f)).
• Exercising or defending rights in legal proceedings: LGPD art. 7, VI; GDPR art. 6(1)(f).

We do not make decisions about you based solely on automated processing.

4. Who we share it with

We share personal data only with providers that help us run the website and our communications, under contracts that require them to protect it:

• Hosting and infrastructure providers, which keep access logs and audience metrics.
• Email and communication providers, to receive and store messages.
• Public authorities, when required by law or court order.

5. International transfers

Our providers may store data outside Brazil. These transfers follow LGPD art. 33 and ANPD Resolution 19/2024, relying on the standard contractual clauses approved by the ANPD or another mechanism that the law accepts.

For visitors in the European Union, Brazil has been recognised by the European Commission as providing adequate protection (2026), and transfers from Evorigo to providers in other countries rely on the safeguards in GDPR chapter V, such as standard contractual clauses.

6. How long we keep it

• Access logs: 6 months, as required by Law 12,965/2014, or longer if a court or authority orders it.
• Email messages: while the conversation or business relationship lasts, and up to 5 years after it ends to meet legal and tax duties and defend our rights.
• Aggregated metrics: kept by the provider in a form that does not identify you.

When the period ends, we delete or anonymise the data.

7. Your rights

Under LGPD art. 18 and, where applicable, GDPR articles 15 to 22, you may ask us to:

• confirm whether we process your data and give you access to it;
• correct incomplete, inaccurate or outdated data;
• anonymise, block or delete data that is unnecessary, excessive or processed unlawfully;
• port your data to another provider;
• delete data processed on the basis of consent, and withdraw that consent;
• tell you who we share your data with;
• object to processing based on legitimate interest;
• restrict processing while a request is being reviewed (GDPR).

Send your request to privacy@evorigo.com. We may ask for information to confirm your identity and will reply within 15 days (LGPD art. 19), or within one month for requests under the GDPR.

You can also file a complaint with the ANPD (gov.br/anpd) or, in the EU, with the data protection authority of your country.

8. Security and incidents

We adopt technical and administrative security measures appropriate to the risk, as required by LGPD art. 46, and keep only the data we need.

If an incident may cause relevant risk or harm to you, we will notify the ANPD and the people affected as required by LGPD art. 48 and ANPD Resolution 15/2024.

9. Children

This website is meant for businesses and adults. We do not knowingly collect data from children or teenagers. If you believe a minor has sent us personal data, write to us and we will delete it.

10. Changes to this policy

We may update this policy when the website, our providers or the law change. The date at the top shows the latest version. Significant changes will be highlighted on this page.