Privacy and Cookie Policy

1. Purpose

ServiceInfo Soluções em TI Ltda. respects the privacy and personal data protection rights of its customers, users, corporate representatives, suppliers, business partners and website visitors.

This Privacy and Cookie Policy explains how personal data is collected, used, stored, protected and, where applicable, shared when individuals use the serviceinfo.com.br website, contact our service channels or engage ServiceInfo’s services.

Personal data is processed in accordance with Brazilian Federal Law No. 13,709/2018, the Brazilian General Data Protection Law («LGPD»), and other applicable Brazilian laws and regulations.

Where processing activities are subject to the laws of the European Union or the European Economic Area, including because services are offered to individuals in those territories or their behaviour is monitored there, ServiceInfo will also comply with Regulation (EU) 2016/679, the General Data Protection Regulation («GDPR»), without prejudice to the application of the LGPD.

2. Data controller identification

For the processing activities described in this Policy, the data controller is:

ServiceInfo is responsible for making the primary decisions regarding the purposes and means of processing personal data covered by this Policy.

In connection with certain technology services, ServiceInfo may also act as a data processor by processing information on behalf of and in accordance with the instructions of its customers. In such cases, each party’s responsibilities will be defined by contract and under the applicable data protection legislation.

3. Personal data we may process

Depending on how a data subject interacts with ServiceInfo, we may process:

• Identification and contact details, such as name, company, job title, telephone number, WhatsApp number, email address and postal address;
• Information voluntarily provided through forms, messages, requests, quotations, complaints or customer service interactions;
• Data provided when subscribing to blog content, such as name, email address, communication preferences, subscription date and time, consent records and unsubscribe requests;
• Messages, questions, responses, prompts, ratings and other information deliberately entered by the data subject into any conversational interface or assistant powered by a large language model («LLM»);
• Data required to prepare quotations and to enter into or perform service agreements;
• Registration, contractual, financial, banking, tax and billing information;
• Information relating to tax invoices, invoices, collections and payments;
• Technical support records, service tickets, communications and customer service history;
• Technical and browsing data, such as IP address, access date and time, device type, browser, pages visited and event logs;
• Technical data transmitted when external resources are loaded, such as fonts, images and files supplied by third parties, including IP address, browser and device information, date, time, requested URL and referring page, depending on the technical configuration and the relevant provider’s practices;
• Data collected through cookies and similar technologies;
• Other data required to meet legal, regulatory, contractual or security obligations.

ServiceInfo does not request sensitive personal data or excessive information through its general contact form. Data subjects should not submit such data unless it is strictly necessary and has been expressly requested.

Data subjects should also refrain from entering passwords, private keys, authentication codes, full banking information, trade secrets, third-party information without authorisation or sensitive personal data that is not essential to the request into conversational tools.

4. How personal data is collected

Personal data may be collected:

• Directly from the data subject through contact forms, WhatsApp, telephone, email or other customer service channels;
• Through the subscription or “Subscribe” feature available on blog pages;
• Through any conversational interface, chatbot or LLM-powered assistant made available for customer service, guidance or improving the user experience;
• When a quotation is requested or a service is contracted or delivered;
• During technical support and customer relationship activities;
• Through platforms used for tax invoicing, billing, collection, management and customer service;
• Automatically during website browsing through technical logs, cookies and similar technologies;
• Through statistical measurement and usage analytics tools, subject to the configuration adopted and the visitor’s consent preferences;
• When fonts supplied by Google Fonts and images or other resources hosted or distributed by Unsplash are loaded directly from the relevant provider’s servers;
• From corporate customers, suppliers, partners or duly authorised representatives;
• From public or legitimate sources where necessary and permitted by law.

5. Purposes and legal bases

Personal data may be processed to:

• Respond to enquiries, requests, suggestions and complaints;
• Prepare and submit commercial quotations;
• Take steps prior to entering into a contract;
• Perform contracts and provide technology management, support and customer service;
• Maintain communications with customers, representatives, suppliers and partners;
• Register customers and manage commercial relationships;
• Manage blog subscriptions and send new articles, corporate content or communications requested by the data subject, with the option to unsubscribe at any time;
• Operate any LLM-powered conversational interface or assistant, understand requests, generate responses, perform initial triage, route enquiries and improve the experience and quality of digital channels;
• Record consent statements, preferences, withdrawals and other evidence required for accountability and the exercise of rights;
• Provide fonts, images and other elements required for the website’s visual presentation and operation;
• Issue tax invoices, invoices, collection notices and related documents;
• Process payments and maintain accounting and financial records;
• Meet legal, tax, regulatory and administrative obligations;
• Prevent fraud, security incidents, unauthorised access and other unlawful activities;
• Maintain the availability, integrity and security of systems and services;
• Establish, exercise or defend legal claims in judicial, administrative or arbitral proceedings;
• Produce statistics and improve the website, services and customer experience;
• Send corporate or commercial communications where permitted by law;
• Fulfil other purposes disclosed to the data subject at the time of collection.

Depending on the circumstances, processing may be based on the performance of a contract or steps taken prior to entering into a contract, compliance with a legal or regulatory obligation, the regular exercise of rights, credit protection, legitimate interests or the data subject’s consent.

Where the GDPR applies, processing will be based, as appropriate, on consent, the performance of a contract or pre-contractual measures, compliance with a legal obligation, protection of vital interests, performance of a task carried out in the public interest, or the legitimate interests pursued by ServiceInfo or a third party, provided that such interests are not overridden by the data subject’s fundamental rights and freedoms.

Where consent is relied upon, it may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.

ServiceInfo will assess necessity, suitability, proportionality and impact whenever it intends to use data obtained through conversational interactions for a new or incompatible purpose, or for a purpose that may have significant effects on the data subject. Data provided in a conversation will not be used to train proprietary or third-party models without specific notice and a valid legal basis.

6. Contact forms and WhatsApp

Data submitted through contact forms and WhatsApp will be used to respond to requests, provide assistance, prepare quotations and maintain direct communication with the data subject.

When using WhatsApp, the data subject is also subject to the terms and privacy practices of the company responsible for the platform. ServiceInfo recommends that users do not send unnecessary information, passwords or confidential information that has not been requested.

The use of WhatsApp may involve processing telephone numbers, profile names, profile photographs, message content, submitted files, customer service records and metadata made available by the platform. The platform is operated by a Meta group company and may process information in other countries in accordance with its own terms, policies and international data transfer mechanisms.

The use of these channels does not authorise indiscriminate advertising. Data subjects may request that commercial communications be discontinued at any time.

Blog content subscriptions

When a visitor uses the “Subscribe” feature, the data provided will be processed to register the subscription and deliver new articles or communications relating to the requested content. Communications will be sent on the basis of consent or another valid legal basis, depending on the context, and each communication must provide a simple unsubscribe mechanism.

ServiceInfo may retain minimum records of the subscription, consent and unsubscribe request to demonstrate compliance, prevent improper resubmission and meet legal obligations, without using those records to resume unauthorised communications.

Conversational interfaces and language models

ServiceInfo may in the future provide LLM-powered conversational assistants to answer questions, assist navigation, perform initial triage or improve the user experience. In such cases, ServiceInfo will process the data that the data subject chooses to enter into the conversation, as well as technical records required for operation, security, auditing and service improvement.

Automatically generated responses may contain inaccuracies and do not replace a professional assessment, formal quotation, contract or human decision where technical, commercial, legal or security analysis is required. Where applicable, the data subject may request human assistance and review of a decision based solely on automated processing.

Where external artificial intelligence providers are used, data may be transmitted to and processed by those providers, including outside Brazil, subject to the contracted settings, security safeguards, purpose limitations and applicable legal mechanisms for international data transfers.

7. Management, billing and support platforms

ServiceInfo uses platforms and systems for technology management, tax invoicing, billing, collection, customer relationship management and customer support.

Access to such data is limited to authorised persons and only to the extent required to perform their duties. Personal data is not sold, made publicly available or used for purposes incompatible with those described in this Policy.

Where technology providers process data on ServiceInfo’s behalf, ServiceInfo will adopt contractual, organisational and security measures appropriate to the nature of the service and the applicable legislation.

8. Data sharing

ServiceInfo may share personal data on a limited and need-to-know basis with:

• Hosting, storage, information security, support and technology infrastructure providers;
• Management, tax invoicing, billing, collection, communication and customer service platforms;
• Email, content distribution and blog subscription management providers;
• Communication and messaging providers, including WhatsApp and Meta group companies, when the data subject uses that channel;
• Artificial intelligence, language processing, conversational automation, conversation storage and technical monitoring providers when those features are made available;
• Font, image and content delivery providers, including Google Fonts and Unsplash, when the relevant resources are loaded directly from external servers;
• Statistical measurement and website usage analytics providers, subject to the configuration adopted and the visitor’s consent preferences;
• Financial institutions, banks, payment acquirers and payment service providers;
• Accounting firms, auditors, law firms and professional advisers;
• Tax, administrative, regulatory, judicial or law enforcement authorities where required by law or a valid order;
• Companies involved in a corporate reorganisation, merger, acquisition or similar transaction, subject to appropriate safeguards;
• Other third parties authorised by the data subject or required to deliver a requested service.

ServiceInfo does not sell personal data.

Data sharing will be limited to data that is adequate, relevant and necessary for each purpose. Where a third party acts as a data processor, ServiceInfo will seek to establish obligations relating to confidentiality, security, purpose limitation, assistance to data subjects, deletion or return of data, and control of sub-processors.

9. International data transfers

Certain technology, cloud, communication or customer service providers may store or process personal data outside Brazil.

This may occur, for example, in connection with hosting, backups, content delivery, WhatsApp communications, loading Google Fonts and Unsplash images, sending emails, support, security, analytics or processing by an LLM provider. The relevant servers and teams may be located in the Americas, Europe, Asia or other regions, depending on the infrastructure used by the relevant provider.

Where personal data is transferred internationally, ServiceInfo will adopt the mechanisms and safeguards required under the LGPD and the regulations issued by Brazil’s National Data Protection Authority (ANPD), taking into account the nature of the operation and the provider involved.

Depending on the operation, safeguards may include an adequacy decision, standard contractual clauses approved by the ANPD, specific contractual clauses, binding corporate rules, certifications, seals, codes of conduct or another mechanism permitted by law. Where the GDPR applies, the transfer will also comply with the mechanisms set out in Articles 44 to 49, including adequacy decisions, standard contractual clauses, supplementary safeguards and derogations applicable to specific situations.

ServiceInfo will take reasonable measures to assess the level of protection in the destination country, the nature of the data, the risks associated with the transfer and the available technical, contractual and organisational measures. Data subjects may request information about the countries, providers and safeguards applicable to the processing of their data, subject to trade and industrial secrecy and applicable legal limitations.

10. Storage and retention

Personal data will be retained only for as long as necessary to fulfil the stated purposes, perform contracts, meet legal or regulatory obligations, prevent fraud, maintain security records and establish, exercise or defend legal rights.

Once processing has ended, personal data will be deleted or anonymised, unless retention is authorised or required by law.

Retention periods may vary depending on the category of data, the purpose of processing, the contractual relationship and applicable statutory retention and limitation periods.

Data used to deliver content will be retained while the subscription remains active. Following an unsubscribe request, ServiceInfo may retain minimum records of consent, objection and unsubscription for as long as necessary to demonstrate compliance, meet legal obligations and prevent further unauthorised communications.

Conversations conducted through any LLM-powered assistant will be retained only for as long as necessary for customer service, security, auditing, legitimate service improvement and compliance with applicable obligations, subject to the conditions of the provider used and to deletion or anonymisation mechanisms where appropriate.

11. Information security

ServiceInfo adopts technical and administrative measures designed to protect personal data against unauthorised access and accidental or unlawful destruction, loss, alteration, disclosure or otherwise improper processing.

These measures may include access controls, permission management, system protection, backups, monitoring, technology updates, confidentiality obligations and guidance for employees and service providers.

For LLM-enabled features, controls may include data minimisation, restricted access, activity logging, content filtering, limited retention, human review and settings designed to prevent uses that are incompatible with the stated purpose.

No digital environment is entirely risk-free. If a security incident occurs that may pose a relevant risk or cause harm to data subjects, ServiceInfo will take appropriate action and make the notifications required by law.

12. Data subject rights

Under the LGPD, data subjects may request, where applicable:

• Confirmation that processing is taking place;
• Access to personal data;
• Correction of incomplete, inaccurate or outdated data;
• Anonymisation, blocking or deletion of unnecessary, excessive or unlawfully processed data;
• Data portability, subject to applicable regulations and the protection of trade secrets;
• Deletion of data processed on the basis of consent, subject to statutory retention requirements;
• Information about public and private entities with which personal data has been shared;
• Information about the option to withhold consent and the consequences of doing so;
• Withdrawal of consent;
• Objection to processing carried out in breach of the LGPD;
• Review of decisions made solely on the basis of automated processing, where applicable;
• Submission of a complaint to Brazil’s National Data Protection Authority and consumer protection bodies.

Where the GDPR applies, data subjects may also exercise, as applicable, the rights to restriction of processing, objection on grounds relating to their particular situation, objection to direct marketing, data portability in a structured, commonly used and machine-readable format, withdrawal of consent and submission of a complaint to the competent supervisory authority in the Member State of their habitual residence, place of work or place of the alleged infringement.

Data subjects have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning them or similarly significantly affects them, except where permitted by law and subject to appropriate safeguards, including the right to obtain human intervention, express their point of view and contest the decision.

To protect data subjects and prevent fraud, ServiceInfo may request additional information to verify the requester’s identity. Requests will be handled free of charge, subject to the deadlines and limitations established by applicable law.

13. Cookie Policy

Cookies are small files stored on a visitor’s device to enable website operation, retain preferences, understand browsing activity and, where authorised, measure performance or support communication and marketing activities.

Non-essential cookies should be activated only after the visitor has made a choice through the cookie banner or preferences panel. Consent may be refused or changed at any time through the “Manage cookie consent” option available on the website.

Loading external resources, such as Google Fonts and images hosted by Unsplash, may generate network requests and transmit technical data even where no cookies are stored on the device. Where applicable law requires prior consent, those resources must remain blocked until the visitor has made a choice or must be hosted locally by ServiceInfo.

Statistical measurement or analytics tools that use cookies, identifiers, local storage or technologies that are not strictly necessary must respect the preferences recorded by the visitor. Anonymisation, data minimisation and reduced-retention settings may be used to reduce risk, but do not replace transparency or the required legal basis.

Visitors may also delete or block cookies through their browser settings. Doing so may affect certain website features.

The list of cookies, providers, purposes and respective retention periods must remain available and up to date in the website’s preferences panel.

14. Third-party websites and services

The website may contain links to third-party platforms, social networks or services. Those environments operate under their own terms and are responsible for their privacy practices.

ServiceInfo recommends reviewing the relevant privacy policies before providing personal data.

Google Fonts

The website may use fonts made available through Google Fonts. Where those fonts are loaded directly from Google’s servers, the visitor’s browser may connect to the provider’s infrastructure and transmit the technical data required to deliver the file, such as IP address, browser information and request data. Processing carried out by Google is governed by its own policies. Further information is available on the Google Fonts privacy page and in the Google Privacy Policy.

Unsplash

Certain images may be supplied by or loaded from Unsplash. Where an image remains externally hosted, the visitor’s browser may connect to Unsplash’s servers or content delivery network, enabling the processing of technical data such as IP address, device, browser, server logs and referring page. Further information is available in the Unsplash Privacy Policy.

WhatsApp

WhatsApp buttons and links direct visitors to an external service operated by WhatsApp and Meta group companies. Once the visitor accesses the service or sends a message, processing by the platform is governed by its own terms and policies. Visitors may review the WhatsApp Privacy Policy and the Brazil Privacy Notice.

Language model providers

If ServiceInfo implements an LLM-powered interface, the provider’s identity, data categories, purposes, retention periods, processing locations and available controls must be disclosed through the relevant channel, consent panel or an update to this Policy before processing begins whenever such information is required to ensure adequate transparency.

15. Children and adolescents

ServiceInfo’s services are primarily intended for companies and professionals and are not intentionally directed at children.

Where it is necessary to process the personal data of children or adolescents, ServiceInfo will adopt the measures required by applicable law and give primary consideration to their best interests.

Conversational tools must not be used by children to provide personal data without the participation and authorisation of a parent or legal guardian where required. If ServiceInfo identifies improper collection, it will take reasonable measures to stop the processing and delete or restrict the data, subject to applicable legal obligations.

16. Data Protection Officer (DPO)

The Data Protection Officer acts as a communication channel between ServiceInfo, data subjects and Brazil’s National Data Protection Authority.

Privacy enquiries and requests to exercise rights under the LGPD may be submitted through the channels above.

Data subjects covered by the GDPR may use the same channels to exercise their rights. If ServiceInfo becomes legally required to appoint a representative in the European Union or a specific Data Protection Officer under the GDPR, the relevant contact details will be added to this Policy before the activity giving rise to that obligation begins.

17. Changes to this Policy

This Policy may be updated to reflect legal, regulatory, technological or operational changes.

The current version will remain available on the website together with the date of its latest update. Where a change is material, ServiceInfo may use its communication channels to notify data subjects.

Before enabling a new analytics provider, subscription service, communication channel, external resource, language model or other technology that materially changes personal data processing, ServiceInfo must review this Policy, the consent preferences panel and the applicable contracts.

18. Contact

Questions, requests or complaints concerning this Policy or the processing of personal data may be submitted to: