Privacy Policy

1. Who is the data controller

NexUnio Tecnologia Ltda. is the controller of personal data collected through the nexunio.com website and its pages (including the scheduling form for our free business diagnostic, "diagnóstico").

To exercise your rights as a data subject or ask questions about this policy, contact us at contato@nexunio.com.

2. What data we collect

Data you actively provide when filling out the scheduling form at /agendar:

• Full name
• Company name
• Industry
• Annual revenue range
• Company size (number of employees)
• Phone number (WhatsApp)
• Contact e-mail
• Main current business challenge
• Outcome you're looking to achieve
• Free-text message with additional details (optional)

Technical data collected automatically when you submit the form:

• Source IP address of the submission (used for security and abuse/spam control)
• Browser user-agent (device model, operating system, browser)
• Date and time of submission

We use the Google Ads tag (Google LLC) to measure conversions and optimize our advertising campaigns. This technology may set cookies on your device. Details are described in our Cookie Policy.

3. Why we collect data and our legal bases

We process your personal data for the following purposes, with the respective legal bases set out in art. 7º of the LGPD:

• Responding to your contact and scheduling the diagnóstico: based on preliminary procedures related to a contract (art. 7º, V) and on your consent (art. 7º, I), given when you submit the form.
• Maintaining a history of leads and prospects: based on NexUnio's legitimate interest (art. 7º, IX) in developing and improving its services, always respecting your rights and expectations.
• Complying with legal or regulatory obligations applicable to NexUnio's activity, when required (art. 7º, II).

4. Who we share data with

We do not sell your data. We share it only with technology vendors that act as data processors, under contract and in compliance with the LGPD:

• Neon (Neon Inc., USA): the database where form submissions are stored. Servers in the São Paulo (sa-east-1) region.
• Amazon Web Services / SES (Amazon.com Inc., USA): transactional e-mail delivery service used to notify our team about new contacts.
• Vercel (Vercel Inc., USA): the site's hosting and CDN provider.
• Google Workspace (Google LLC, USA): NexUnio's corporate e-mail provider, where our team receives contacts.
• Google Ads / Google Tag Manager (Google LLC, USA): conversion measurement and advertising campaign optimization. May receive browsing data and conversion events through cookies, as described in our Cookie Policy.

Any international data transfers take place with safeguards compatible with art. 33 of the LGPD (standard contractual clauses and/or recognized certifications).

5. How long we keep data

We keep your data for as long as necessary for the purposes described above. In general:

• Contacts with no commercial follow-up: up to 24 months after the last contact, unless deletion was requested earlier.
• Contacts who became clients: for the contractual term and for the period legally required to keep tax and accounting records (generally 5 years after the relationship ends).
• Technical data (IP, user-agent, timestamp): for the same period as the record it is linked to.

6. How we protect it

We adopt reasonable technical and organizational measures to protect your data against unauthorized access, loss, alteration, or improper disclosure. These include:

• Encrypted connections (HTTPS/TLS) across the entire site
• A database with restricted access and authentication via individual credentials
• Internal communication in authenticated corporate environments
• Access to data limited to authorized personnel, on a need-to-know basis

Even so, no system is 100% secure. In the event of an incident that may create a relevant risk or harm to data subjects, we will notify the ANPD (Autoridade Nacional de Proteção de Dados, Brazil's National Data Protection Authority) and the affected data subjects, as required by art. 48 of the LGPD.

7. Your rights as a data subject

The LGPD guarantees you, at any time, the following rights (art. 18):

• Confirmation that processing is taking place
• Access to your data
• Correction of incomplete, inaccurate, or outdated data
• Anonymization, blocking, or deletion of unnecessary, excessive, or non-compliant data
• Portability of data to another provider
• Deletion of data processed based on consent
• Information about the entities with which we share your data
• Information about the possibility of not giving consent and the consequences of doing so
• Withdrawal of consent, where applicable

8. How to exercise your rights

To exercise any of the rights above, send an e-mail to contato@nexunio.com stating:

• Your name and the e-mail used to contact NexUnio
• The right you wish to exercise
• Additional information that helps identify the record

We will respond within 15 business days. In some cases, we may request additional information to confirm your identity and prevent improper access to third-party data.

9. Updates to this policy

This policy may be updated periodically to reflect changes in our services, in applicable law, or in data protection best practices. The "last updated" date shown at the top will always be the reference for the version in force.

We recommend reviewing this document from time to time. Material changes will be actively communicated when applicable.

10. Governing law and jurisdiction

This policy is governed by Brazilian law, in particular Lei nº 13.709/2018 (LGPD) and the Marco Civil da Internet (Brazil's Internet Bill of Rights, Lei nº 12.965/2014). The courts of the judicial district (comarca) where NexUnio is headquartered, in Brazil, are elected to settle any disputes, except where a mandatory legal provision establishes the consumer's domicile as the competent forum.