Privacy Policy

1 Introduction

Brasoftware Informatica Ltda ("Brasoftware", "we", "us", or "our") is a technology distribution and services company registered in Brazil under CNPJ 57.142.978/0001-05, with registered offices at Rua Marina La Regina, 227, 3rd Floor, Centro, Poá – SP. We operate as a value-added reseller and solutions integrator, supplying software licenses, cloud infrastructure services, cybersecurity solutions, and managed IT services to businesses of all sizes across Brazil.

We are deeply committed to handling personal data responsibly, transparently, and securely. This Privacy Policy describes the personal data we collect when you visit our website, submit an enquiry, engage with our marketing communications, or otherwise interact with us — and it explains precisely what we do with that data, your rights as a data subject, and how to exercise them.

This policy applies to all individuals whose personal data we process, including website visitors, prospective customers, clients, partners, and job applicants. It covers data processing activities carried out through our website at brasoftware.site and any related subdomains, as well as offline interactions where we refer you to this document.

2 Information We Collect

We only collect personal data that is genuinely necessary for the purpose it is being collected. The categories below cover the full scope of what we may hold about you.

2.1 — Information you give us directly

When you fill in a contact form, request a quote, subscribe to our newsletter, register for a webinar, download a white paper, or apply for a job with us, you may provide some or all of the following:

• Full name and job title
• Corporate or personal email address
• Telephone number (landline or mobile)
• Company name, CNPJ (Brazilian business registration number), and company size
• Billing and shipping addresses
• Details of the products or services you are enquiring about
• Any additional information you choose to include in a free-text message field
• For job applicants: CV, professional history, qualifications, and references

Submission of these forms is always voluntary. Where a field is marked as mandatory, it is because we genuinely cannot respond to your request without that piece of information.

2.2 — Information collected automatically

When you browse our website, our web servers and analytics tools automatically collect certain technical data. This information does not typically identify you as an individual but may constitute personal data under applicable law when combined with other identifiers:

• IP address and approximate geographic location derived from it
• Browser type, version, and language settings
• Operating system and device type (desktop, mobile, tablet)
• Pages visited, time on page, scroll depth, and navigation path
• Referral source (the website or search query that brought you to us)
• Date, time, and duration of each visit session
• Clicks on links, buttons, and downloadable assets

This data is collected through first-party server logs, cookies, and third-party analytics platforms (see Section 4 for details).

2.3 — Information from third parties

Occasionally we receive information about you from third-party sources. This may include:

• Data from advertising platforms such as Google Ads, where we receive aggregated conversion signals when you interact with one of our paid advertisements
• Business contact data from technology partners (for example, Microsoft, VMware, or Fortinet) when they refer a mutual client to us as part of a joint go-to-market programme — in all such cases the referring partner is required to confirm they have a lawful basis for sharing your data
• Publicly available professional information such as LinkedIn profiles, where relevant to a commercial discussion you have initiated

3 How We Use Your Information

We process your personal data only when we have a valid legal basis to do so. The table below maps each primary use of your data to the specific legal basis that justifies it under the LGPD and GDPR.

• Responding to your enquiries and providing quotes — processed on the basis of your consent (given by submitting the form) and, where a commercial relationship follows, on the basis of performance of a contract.
• Delivering purchased products, licences, and services — necessary for the performance of our contract with you, including licence key delivery, account provisioning, invoicing, and after-sales technical support.
• Sending marketing communications — only where you have expressly opted in to receive them, or where we have a legitimate interest in contacting existing clients about closely related products or services. You can withdraw consent or object at any time (see Section 8).
• Improving our website and digital content — based on our legitimate interest in understanding how visitors use our website so we can make it more useful, faster, and easier to navigate.
• Running targeted advertising campaigns — based on your consent where cookies are used to personalise ads, and on legitimate interest for aggregated audience analysis. We use Google Ads conversion tracking and remarketing lists to measure campaign effectiveness.
• Complying with legal and regulatory obligations — for example, retaining transaction records for tax purposes under Brazilian fiscal law, or responding to lawful requests from courts or authorities.
• Preventing fraud and maintaining security — based on our legitimate interest and legal obligations to protect our systems, customers, and staff from unauthorised access, fraud, and cybersecurity threats.
• Processing job applications — based on your consent (by submitting an application) and, if an offer is made, on steps taken at your request prior to entering into a contract of employment.

We will never sell your personal data to third parties. We will never use your data for purposes that are incompatible with the purposes for which it was originally collected without informing you and obtaining a new legal basis.

4 Cookies & Tracking Technologies

Our website uses cookies — small text files stored on your device — and similar tracking technologies (pixels, local storage, session tokens) to make the site work properly and to help us understand how it is being used. Below is a plain-language breakdown of each category.

Strictly necessary cookies

These cookies are essential for the website to function and cannot be switched off. They are set in response to actions you take — such as setting your privacy preferences or filling in a form — and do not store any personally identifiable information. No consent is required for these cookies.

Analytics & performance cookies

We use Google Analytics 4 (GA4) to measure website performance. GA4 collects anonymised data about how visitors interact with our pages — which pages are most popular, where users drop off, and how long sessions last. IP addresses are anonymised before being stored. These cookies are set only with your consent.

Marketing & advertising cookies

We use Google Ads conversion tracking and Google Remarketing tags. These cookies allow us to track whether a visit to our site followed from clicking one of our Google Ads, to measure the effectiveness of our campaigns, and to show relevant Brasoftware advertisements to users who have previously visited our site. The Google Ads privacy policy governs how Google processes data collected via these tags. These cookies are set only with your consent.

Functional cookies

Functional cookies remember your preferences (such as language or region) to provide a personalised experience. They may be set by us or by third-party providers whose services we have embedded. These cookies require your consent.

Managing your cookie preferences

When you first visit our website you will be presented with a cookie consent banner that lets you accept or decline each non-essential category. You can change your preferences at any time by clicking the "Cookie Settings" link in the footer. You may also manage or delete cookies through your browser settings; note, however, that disabling certain cookies may affect the functionality of the site. For more information on how to manage cookies across different browsers, visit aboutcookies.org.

5 Sharing With Third Parties

Brasoftware does not sell, rent, or trade personal data. We share data with the following categories of third parties only to the extent necessary, and always under contractual obligations that require them to protect your data at least as well as we do:

• Technology vendors and service providers — companies that host our website, operate our CRM (customer relationship management) system, send our transactional emails, or provide customer support tooling. These vendors act as data processors on our behalf and may only process your data according to our documented instructions.
• Software and hardware manufacturers — when fulfilling an order for a Microsoft, VMware, Fortinet, Veeam, or other vendor product, we must share the minimum data necessary (typically your name, email, and company details) with that vendor to provision licences or activate warranties.
• Payment processors and financial institutions — for the secure processing of transactions. We do not store full payment card data on our own systems.
• Professional advisers — accountants, legal counsel, and auditors, who are bound by professional confidentiality obligations.
• Government authorities and regulators — where we are required by law, court order, or regulatory direction to disclose information. We will notify you where legally permitted to do so.
• Analytics and advertising platforms — as described in Section 4, data is shared with Google LLC for analytics and advertising purposes under their own privacy policies and our consent-based data-sharing agreements.

Where third parties are located outside Brazil or the EEA, we ensure appropriate safeguards are in place — such as Standard Contractual Clauses, adequacy decisions, or equivalent LGPD transfer mechanisms — before transferring any personal data internationally.

6 Data Retention

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, and in compliance with our legal and regulatory obligations. Our default retention periods are:

• Contact form enquiries that did not lead to a sale — up to 24 months from the date of your last interaction with us, after which the record is deleted or anonymised.
• Customer and client records (orders, contracts, invoices) — 10 years from the end of the commercial relationship, in accordance with Brazilian fiscal and commercial legislation (including Lei 10.406/2002 and Lei 9.430/1996).
• Marketing consent records — retained for the duration of the consent and for up to 5 years after you withdraw it, as evidence that we acted lawfully during the period the consent was active.
• Job applications (unsuccessful) — up to 12 months, after which they are securely deleted unless you have consented to us retaining your details for future vacancies.
• Website analytics data — aggregated and anonymised data may be retained indefinitely; session-level data is retained for no longer than 26 months.
• Cookie consent logs — 3 years, for audit and compliance purposes.

When data reaches the end of its retention period, it is either securely deleted (using methods that render recovery impossible) or permanently anonymised so that it can no longer be associated with any individual.

7 Data Security

As a company whose core business is technology and cybersecurity solutions, we take the protection of personal data extremely seriously. We have implemented a layered security framework that addresses technical, organisational, and physical risks:

• All data transmitted between your browser and our website is encrypted in transit using TLS 1.2 or higher (HTTPS).
• Data at rest in our databases and cloud storage is encrypted using AES-256 encryption.
• Access to personal data is granted on a strict least-privilege basis — only staff members who need the data to perform their role may access it, and all access is logged and audited.
• Our internal systems are protected by multi-factor authentication, endpoint detection and response (EDR) tools, and next-generation firewall solutions.
• We conduct regular vulnerability assessments and penetration tests on our internet-facing systems.
• Our staff undergo annual privacy and data security training and are contractually bound by confidentiality obligations.
• We maintain a documented incident response plan. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the Brazilian Autoridade Nacional de Proteção de Dados (ANPD) within 72 hours of becoming aware of the incident, and affected individuals without undue delay.

Despite these measures, no internet transmission or electronic storage system is completely secure. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately at contato@brasoftware.site.

8 Your Rights

Under the LGPD (Article 18) and, where applicable, the GDPR (Articles 15–22), you hold a comprehensive set of rights regarding your personal data. We take these rights seriously and will respond to any valid request within 15 days (LGPD) or one calendar month (GDPR), free of charge.

How to exercise your rights

To exercise any of the rights described above, please send a written request to contato@brasoftware.site with the subject line "Data Subject Request". To protect your privacy, we may need to verify your identity before processing the request — we will ask only for the minimum information necessary for this purpose. If you are making a request on behalf of another person, please provide evidence of your authority to act on their behalf.

9 Children's Privacy

Our website and services are directed exclusively to business professionals and are not intended for use by children. Under the LGPD, a child is defined as a person under the age of 12; under the GDPR, the relevant age is typically 16 (or lower depending on member state law).

We do not knowingly collect personal data from children. If you are a parent or guardian and have reason to believe that your child has submitted personal data to us, please contact us immediately at contato@brasoftware.site and we will take prompt action to delete that data from our systems.

10 Changes to This Policy

Data protection law evolves, our services develop, and technology changes — so we review and update this Privacy Policy periodically to keep it accurate and complete. When we make material changes (those that significantly affect how we process your data or your rights), we will take reasonable steps to inform you, which may include:

• Displaying a prominent notice on our website home page and this policy page for at least 30 days
• Sending an email notification to customers and newsletter subscribers where we hold a valid email address
• Updating the "Last updated" date at the top of this document

Minor editorial changes — such as clarifications of existing practices, corrections of typographical errors, or updated contact details — will be made without specific notification, though the "Last updated" date will always reflect the most recent revision.

We encourage you to review this policy periodically. Continued use of our website or services after a change has been published constitutes your acknowledgement of the updated terms. If you disagree with the changes, you should discontinue use of our services and exercise your right to deletion (see Section 8).

11 Contact & Data Controller

The data controller responsible for your personal data is Brasoftware Informatica Ltda. If you have any questions, concerns, or complaints about this Privacy Policy or about how we handle your personal data — or if you wish to exercise any of the rights described in Section 8 — please reach out to us using the details below. We aim to respond to all privacy-related correspondence within 5 business days and to fully resolve requests within the statutory deadlines.

If you are not satisfied with our response, you have the right to escalate your complaint directly to the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd, or to the relevant supervisory authority in your country of residence.