Privacy Policy

Website Visitors

Data processed

Server access logs generated automatically: IP address, user agent (browser type and version, operating system), pages requested, date and time, referring address and response code. This site sets no cookies and uses no audience measurement, behavioural tracking or advertising tools. Your language preference is written to your browser's local storage, stays on the device and is never transmitted to us.

Purposes

Deliver the pages requested and keep the site available; identify, investigate and respond to security incidents, attempted abuse and operational failures; and diagnose technical errors.

Legal basis

Legitimate interest (article 7, IX of Law 13.709/2018), limited to what is strictly necessary to operate and secure the site; the corresponding balancing assessment can be made available to the supervisory authority on request. No processing in this category rests on consent, for the plain reason that there is no cookie or tracker that would require it.

Retention

Access logs are retained for 30 days and then deleted automatically. Logs relating to a security incident under investigation may be preserved beyond that period, for as long as the investigation and any legal obligation require. The site is hosted on Google Cloud infrastructure in the São Paulo region, acting as processor on Nodexa's instruction; browsing data from this site is not transferred internationally.

Customers and Prospective Customers

Data processed

Name, job title, company, professional email address, professional phone number, communication records, support history and, for contracted customers, the registration and tax data required to formalise and perform the contract.

Purposes

Responding to enquiries, preparing proposals, formalising and performing contracts, providing technical support, issuing tax documents, exercising rights in legal or administrative proceedings, and communicating about contracted services.

Legal basis

Performance of a contract and preliminary procedures; compliance with legal and regulatory obligations, notably tax and accounting; regular exercise of rights; legitimate interest for institutional communication and B2B outreach.

Retention

For the duration of the relationship and, after it ends, for 5 years in view of applicable limitation periods, or for any longer period required by tax legislation.

Suppliers and Partners

Data processed

Name, job title, professional email address, professional phone number, bank details where required for payment, and registration data of legal representatives for contracting purposes.

Purposes

Assessing and approving suppliers, formalising and performing contracts, making payments, complying with tax and accounting obligations, and keeping a record of commercial relationships.

Legal basis

Performance of a contract and preliminary procedures; compliance with legal and regulatory obligations; regular exercise of rights.

Retention

For the duration of the relationship and, after it ends, for 5 years, or for any longer period required by tax legislation.

Job Applicants

Data processed

Name, contact details, curriculum vitae, professional and academic background, salary expectations, interview and technical assessment results, and any information the applicant chooses to provide. We do not request sensitive personal data, and we ask that none be sent.

Purposes

Running selection processes, assessing fit for the role, communicating with the applicant, and, subject to specific consent, keeping the profile in a talent pool for future opportunities.

Legal basis

Preliminary procedures relating to a contract, at the request of the data subject; consent, exclusively for retention in the talent pool.

Retention

Data of applicants who are not selected is deleted within 6 months of the process closing. Where consent to the talent pool is given, retention extends for up to 2 years from that consent, which may be withdrawn at any time, with deletion following.

Users of Solutions Hosted by Nodexa

Where a customer chooses a solution hosted on Nodexa infrastructure, we process, as processor and on the customer instruction, the user identifiers, interaction content and access records required for the solution to function and to be audited. Nodexa does not use this data for its own purposes, does not sell it, and does not use it to train artificial intelligence models.

Sharing and Disclosure

We share personal data only where necessary, in the following circumstances:

• With service providers acting on our behalf, such as cloud infrastructure, email delivery and business management tools, always under contracts imposing data protection obligations equivalent to this Policy.
• With public authorities, where required by law, court order or a competent authority request.
• With legal, accounting and audit advisers, for the regular exercise of rights and compliance with legal obligations.
• In a corporate reorganisation, merger, acquisition or sale of assets, in which case data is transferred subject to this Policy.

We do not sell personal data and we do not share it for third-party advertising.

International Transfers

Part of our corporate infrastructure is operated by cloud providers processing outside Brazil. In those cases the transfer follows article 33 of Law 13.709/2018, under contracts establishing protection safeguards compatible with Brazilian legislation. For solutions deployed on customer infrastructure there is no international transfer carried out by Nodexa; the controlling customer determines where processing takes place and which integrations are used.

Information Security

We apply technical and administrative measures to protect personal data against unauthorised access, loss, alteration or improper disclosure, including:

• Centralised authentication with role-based access control and least privilege.
• Encryption in transit over TLS, with obsolete protocol versions rejected, and encryption at rest.
• Additional application-level encryption of credentials and integration secrets.
• Segregation between development, test and production environments.
• Logging of administrative activity and of access.
• Mandatory code review and automated verification prior to release.

Where a security incident may create relevant risk or harm to data subjects, the measures set out in article 48 of Law 13.709/2018 apply, with notification to the national data protection authority and to the affected data subjects where Nodexa acts as controller, and notification to the controlling customer, within contractual deadlines, where it acts as processor.

Your Rights

Under article 18 of Law 13.709/2018, you may request:

• Confirmation that processing exists
• Access to your data
• Correction of incomplete, inaccurate or outdated data
• Anonymisation, blocking or deletion of unnecessary or excessive data, or data processed unlawfully
• Portability to another provider, subject to commercial and industrial secrecy
• Deletion of data processed on the basis of consent
• Information about the entities with which we share data
• Information about the option not to consent and the consequences of refusal
• Withdrawal of consent
• Review of decisions taken solely on automated processing, under article 20

Requests should be sent to lgpd@nodexa.com.br and are answered within 15 days of receipt. Additional information may be requested to confirm the identity of the requester. Where the data concerned is under the control of a Nodexa customer, the request is forwarded to the responsible controller, with notice to the data subject, the decision resting with whoever determines the purposes of the processing.

Cookies and browser storage

This site does not use cookies. It sets none of its own, loads no third-party script that would set any, and employs no audience measurement, behavioural tracking or advertising tool. Two items are written to your browser's local storage and never transmitted to us: your language preference, and — once you decide — the record of your privacy choices. The preference panel available on the site governs optional measurement, which is switched off and, at present, not in use; the setting exists so that a choice made now is honoured the moment any measurement is introduced. You may withdraw or change your decision at any time through that panel.

Changes to This Policy

This Policy may be updated to reflect legal, technical or operational changes. The current version is always available on our websites, with its effective date. Material changes are communicated through our usual relationship channels.