1 Introduction
This Privacy Policy applies to all digital properties operated by Devvo Tecnologia Ltda — including our website at tech-us.site and any associated subdomains, landing pages, or campaign microsites — as well as to the services we provide to our clients. It governs how we collect, process, store, and protect personal data belonging to visitors, prospective clients, current clients, and any other individuals who interact with us online or off.
Devvo Tecnologia Ltda (CNPJ 45.814.193/0001-52), headquartered at Setor SCN Quadra 4 Bloco B Sala 702 Parte, 860, Asa Norte, Brasília — DF, Brazil, acts as the data controller for the personal data described in this document. We are committed to processing personal data only in ways that are lawful, fair, and transparent, consistent with both LGPD (Lei 13.709/2018) and the European Union's General Data Protection Regulation (EU 2016/679) where applicable.
By using our website, submitting any form, or otherwise engaging with our digital channels, you acknowledge that you have read and understood this policy. If you do not agree with any part of it, please refrain from providing your personal data and contact us for further guidance.
2 Information We Collect
We collect personal data through several channels and mechanisms. The categories below describe each type in detail, including what we collect, when, and on what legal basis (as required by LGPD Art. 7 and GDPR Art. 6).
2.1 — Data You Provide Directly (Contact & Enquiry Forms)
When you fill out any contact form, quote-request form, or callback form on our website, we collect the information you submit. This typically includes your full name, professional email address, phone number, company name, and the message or project description you provide. Submitting this data is entirely voluntary; however, without it we cannot respond to your enquiry. The legal basis for processing this data is the execution of pre-contractual measures taken at your request (LGPD Art. 7, VI; GDPR Art. 6(1)(b)) and, where necessary, our legitimate interest in responding to business enquiries (LGPD Art. 7, IX; GDPR Art. 6(1)(f)).
2.2 — Usage & Technical Data (Collected Automatically)
When you visit our website, our servers and analytics tools automatically record certain technical information. This includes your IP address (anonymised where technically feasible), browser type and version, operating system, referring URL, the pages you visit and time spent on each, device type and screen resolution, and approximate geographic location (country/city level). This data is collected primarily through first-party server logs and third-party analytics platforms and is used solely to understand how visitors navigate our site and to improve performance and user experience.
2.3 — Cookie & Tracking Technology Data
Cookies, pixel tags, and similar tracking technologies place small files or identifiers on your device that allow us or our partners to recognise your browser across sessions. This may include advertising identifiers used by platforms such as Google Ads to measure campaign performance and, where you have given consent, to personalise ads. Full details are provided in Section 4 below.
2.4 — Business-Context Data (Client Relationships)
If you become a Devvo client or a named contact at a client company, we additionally process data such as your job title, billing and invoice details, contractual correspondence, and project-specific information shared during delivery. This data is processed for contract performance and legitimate business operation purposes.
We do not intentionally collect sensitive personal data (such as racial or ethnic origin, health data, biometric data, or financial account credentials) through any of our standard online channels. If you believe you have accidentally shared such information, please contact us immediately so we can delete it.
3 How We Use Your Information
Every use of your personal data is tied to a specific, documented purpose. We do not repurpose data in ways that would be incompatible with the reason it was originally collected. Below are the purposes for which we process your personal data, together with the legal basis that authorises each.
- Responding to enquiries and pre-sales communication. When you contact us through any form or channel, we use your contact details and message content to respond promptly and accurately. Legal basis: pre-contractual measures / legitimate interest.
- Delivering contracted services. For active clients, we process personal data of key contacts to manage projects, issue invoices, coordinate deliverables, and communicate project status. Legal basis: performance of contract (LGPD Art. 7, V; GDPR Art. 6(1)(b)).
- Website analytics and performance optimisation. We analyse aggregated usage data to identify underperforming pages, improve site structure, and enhance the user experience for all visitors. Legal basis: legitimate interest (LGPD Art. 7, IX; GDPR Art. 6(1)(f)).
- Advertising measurement and campaign optimisation. We use conversion tracking tools (such as Google Ads conversion tags) to measure whether visits originating from paid advertisements result in form submissions or other meaningful actions. This helps us allocate our marketing budget responsibly. Legal basis: consent (where required) or legitimate interest.
- Legal and regulatory compliance. We may retain and disclose personal data where required by Brazilian law, court orders, or regulatory obligations. Legal basis: legal obligation (LGPD Art. 7, II; GDPR Art. 6(1)(c)).
- Prevention of fraud and abuse. Technical and usage data may be used to identify and block malicious activity or automated attacks against our systems. Legal basis: legitimate interest / legal obligation.
- Service communications and follow-up. With your consent or within the scope of an existing business relationship, we may send follow-up messages relevant to your enquiry or project. We do not send unsolicited promotional emails without a valid consent basis.
5 Sharing With Third Parties
We share personal data with third parties only where strictly necessary, where you have given explicit consent, or where we are legally required to do so. Every third-party processor we engage is bound by a data processing agreement (DPA) that mirrors our own data protection obligations. Below is a transparent account of the categories of third parties who may receive your data:
- Cloud hosting and infrastructure providers — Our website is hosted on infrastructure that may be operated by providers based in Brazil, the European Union, or the United States. Where data is transferred internationally, appropriate safeguards are in place, including Standard Contractual Clauses where required by GDPR.
- Google LLC — For Google Analytics, Google Ads conversion tracking, and related advertising measurement services. Google is subject to its own privacy policy and participates in the EU–US Data Privacy Framework.
- Email service providers — We use professional email infrastructure to send responses to your enquiries and project-related communications. These providers process only the data necessary to deliver the message.
- CRM and project management tools — Contact and client data may be stored in CRM or collaboration platforms used internally by our team. Access is restricted on a need-to-know basis.
- Legal, accounting, and compliance advisors — Where required by law or for the defence of legal claims, we may share data with our legal counsel, accountants, or Brazilian regulatory authorities such as the ANPD (Autoridade Nacional de Proteção de Dados).
- Business transfers — In the event of a merger, acquisition, or sale of all or part of Devvo Tecnologia Ltda, personal data held by us may be transferred to the successor entity, subject to equivalent privacy protections. Affected individuals will be notified in advance.
6 Data Retention
We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by applicable law. Our general retention schedule is as follows:
Enquiry and contact form submissions
Retained for up to 24 months after the last interaction associated with the enquiry, to allow for follow-up and relationship management. If no contract arises, data is deleted or fully anonymised at the end of this period.
Active client data
Retained throughout the duration of the service contract and for a period of 5 years following contract termination, consistent with Brazilian civil law obligations (Código Civil, Art. 206) and accounting requirements.
Analytics and usage data
Google Analytics data is retained for 14 months in our analytics account, after which it is automatically aggregated or deleted by Google. Server access logs are purged after 90 days unless an active security investigation requires otherwise.
Cookie consent records
Records of your consent choices are retained for 12 months, sufficient to demonstrate compliance and to honour your preferences on return visits.
Legal and tax records
Financial documents and contracts may be retained for up to 10 years as required by Brazilian tax law (Lei 9.430/1996) and accounting standards.
When retention periods expire, personal data is securely deleted, anonymised, or archived in a form that no longer permits identification of the individual. You may at any time request earlier deletion — see Section 8 for details on exercising your rights.
7 Data Security
Devvo Tecnologia Ltda implements a layered set of technical and organisational security measures designed to protect your personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction.
- Encryption in transit: All data transmitted between your browser and our servers is protected by TLS 1.2 or higher (HTTPS). Our contact forms transmit data over encrypted connections exclusively.
- Access controls: Internal access to personal data is restricted to team members who genuinely need it to perform their roles. Access rights are reviewed periodically and revoked upon change of role or departure from the company.
- Third-party vetting: We vet all sub-processors for adequate security practices before granting them access to any personal data.
- Incident response: We maintain an internal data breach response plan. In the event of a breach that poses a risk to your rights and freedoms, we will notify the ANPD (Brazil) and, where applicable, the relevant EU supervisory authority within 72 hours, and affected individuals without undue delay, as required by LGPD Art. 48 and GDPR Art. 33–34.
- Secure development practices: Our web properties are built following OWASP security guidelines. We conduct periodic vulnerability assessments and promptly patch identified risks.
8 Your Rights
Depending on your location and the applicable law, you hold meaningful rights over your personal data. Under Brazil's LGPD (Art. 18) and the GDPR (Arts. 15–22), these rights include:
Right of Access
You may request confirmation of whether we hold personal data about you, and if so, obtain a copy of that data along with information about how it is processed, where it is stored, and who it is shared with.
Right to Rectification
If any personal data we hold about you is inaccurate, incomplete, or out of date, you have the right to request that we correct it without undue delay.
Right to Erasure
Sometimes called the 'right to be forgotten,' you may request deletion of your personal data where it is no longer necessary for the purpose it was collected, you withdraw consent, or the processing is unlawful. Legal retention obligations may limit this right in some cases.
Right to Restriction
You may request that we restrict processing of your personal data in certain circumstances — for example, while a correction request is being assessed or where you have objected to processing based on legitimate interest.
Right to Data Portability
Where processing is based on consent or contract and is carried out by automated means, you may request that we provide your data in a structured, commonly used, machine-readable format.
Right to Object
You may object to processing carried out on the basis of legitimate interest, including profiling for direct marketing purposes. Where you object to direct marketing, we will cease processing immediately and without exception.
Right to Withdraw Consent
Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing that occurred before withdrawal.
Right to Lodge a Complaint
If you believe your data protection rights have been violated, you have the right to file a complaint with Brazil's national supervisory authority, the ANPD (anpd.gov.br), or your relevant EU data protection authority if you are located in the EU.
How to exercise your rights: To submit any request relating to your personal data rights, please email us at contato@tech-us.site with the subject line "Data Rights Request" and describe clearly what you are requesting. We will acknowledge receipt within 5 business days and respond substantively within 15 business days of verifying your identity, consistent with LGPD Art. 19 and GDPR Art. 12. We may request proof of identity before processing certain requests to protect your data against unauthorised access by third parties claiming to act on your behalf.
Exercising your rights is free of charge. If requests are manifestly unfounded or excessive — particularly due to their repetitive character — we reserve the right to charge a reasonable administrative fee or refuse to act, in which case we will inform you of our reasons.
9 Children's Privacy
Our website and services are directed exclusively at business professionals and corporate entities. We do not knowingly collect personal data from individuals under the age of 18. Our contact forms, enquiry submissions, and service offerings are not designed for, and are not intended to attract, children or minors.
If you are a parent or guardian and believe that a minor in your care has submitted personal data to us through our website, please contact us immediately at contato@tech-us.site. We will promptly investigate and delete any such data upon verification.
This commitment is consistent with LGPD Art. 14, which establishes specific protections for the processing of personal data belonging to children and adolescents, requiring parental or guardian consent for any such processing.
10 Changes to This Policy
Data protection laws, regulatory guidance, and our own practices evolve over time. We may update this Privacy Policy periodically to reflect changes in law, to describe new services or data processing activities, or to improve clarity. When we make changes, we will update the "Last updated" date at the top of this page and, where the changes are material, we will provide a more prominent notice — such as a banner on our website or a direct notification to active clients.
We encourage you to review this page periodically to stay informed about how we protect your information. Your continued use of our website after the publication of any revised version constitutes your acknowledgement of the updated terms. If you do not accept the revised policy, you should discontinue your use of our site and contact us regarding any active relationship.
11 Contact & Data Controller Details
If you have any questions, concerns, or requests relating to this Privacy Policy or to how Devvo Tecnologia Ltda processes your personal data, please reach out to us directly. We take every data-related communication seriously and are committed to resolving your queries promptly and transparently.
Devvo Tecnologia Ltda
Data controller for all personal data processed in connection with our website and services. For data rights requests, privacy concerns, or any question about this policy, contact us through the channels listed here. We aim to respond to all privacy-related enquiries within five business days.
When contacting us about a data rights request, please include sufficient information for us to verify your identity and locate your records — for example, the email address you used to contact us, or the approximate date of your interaction. This helps us handle your request securely and efficiently.