Privacy Policy

1. Controller and scope

Arvoris, which is responsible for arvoris.com.br, acts as controller of personal data processed to operate this website, answer contacts, receive business enquiries, and handle privacy rights. This Policy applies to the website, forms, cookie preferences, and communications initiated through those channels. When performing activities for clients, Arvoris may also act as a processor under each client's instructions and contract.

The controller's privacy and contact channel is contato@arvoris.com.br. Data subject requests may also be submitted through the Data rights page.

2. Personal data we may process

Depending on your interaction, we may process:

• identity and contact details, such as name, email, and WhatsApp number;
• professional and business details, such as company, product or service, website, business social profile, sales model, objectives, estimated investment range, and meeting preference;
• content you provide, including messages, questions, business context, and privacy request details;
• navigation and security data, such as IP address, date and time, requested pages, source, UTM parameters, browser, device, and technical logs;
• consent data, including a pseudonymous browser identifier, selected categories, notice version, selection method, date, and source page; and
• protocols, service history, and records required to document our response.

3. How we obtain data

We receive data directly from you when you submit a form, contact us, request a meeting, change preferences, or exercise a right. Certain technical data is generated automatically to deliver pages, maintain security, and record operational events. When you provide a public business website or profile, we may review that address solely to understand the context of your request.

4. Purposes and legal grounds

We process data for specific purposes under an appropriate legal ground:

• answering messages, preparing meetings, and taking requested steps before a possible engagement: steps prior to entering into a contract and legitimate interests;
• preparing proposals, delivering services, and managing the client relationship: performance of a contract;
• operating, securing, and improving digital channels, preventing abuse, investigating failures, and keeping access records: legitimate interests and compliance with legal obligations;
• complying with tax, regulatory, judicial, or administrative duties and exercising or defending rights: legal obligations and the exercise of legal rights;
• recording and answering data subject requests: compliance with the LGPD and the exercise of legal rights;
• enabling analytics, campaign measurement, or advertising, when available: prior, specific, and revocable consent by category.

When relying on legitimate interests, we limit processing to what is necessary and consider the data subject's reasonable expectations, rights, and freedoms.

5. Required and optional information

Fields marked as required are needed to identify the request, prevent abuse, and provide a response. Without them, we may be unable to complete the submission or provide assistance. Unmarked fields are optional. Refusing optional cookies or technologies does not prevent access to content or form submission.

6. Sharing and processors

We may share strictly necessary data with providers supporting hosting, databases, security, backups, email, communications, technical support and, subject to consent where applicable, analytics and advertising measurement. Provider categories may include cloud infrastructure, email services, and platforms such as Google, Meta, and TikTok when their integrations are enabled.

Providers must follow instructions, contracts, and confidentiality and security duties. We may also share information with authorities or third parties when required by law, a valid order, or the need to exercise legal rights. Arvoris does not sell personal data.

7. International transfers

The website's primary infrastructure uses resources located in Brazil. Certain technology, communication, analytics, or advertising providers may store or access data in other countries. Where an international transfer occurs, we use a mechanism allowed by the LGPD and ANPD regulations, together with contractual and security safeguards appropriate to the risk and purpose.

8. Retention and deletion

We retain data only as long as necessary for the stated purpose and applicable legal or regulatory duties:

• application access logs: 6 months, subject to the Brazilian Civil Rights Framework for the Internet;
• enquiries and opportunities that do not result in an engagement: generally up to 24 months after the last interaction;
• client and contractual relationship data: for the relationship and applicable legal, tax, and limitation periods;
• consent, data subject request, audit, and legal defence records: for the period required to demonstrate compliance and protect rights, generally up to 5 years after the matter is closed;
• browser technologies: for the periods stated in the Cookie Policy.

Periods may be extended due to legal duties, authority orders, or the necessary preservation of evidence. Once the purpose ends and there is no lawful reason to retain data, it is deleted or anonymised. Backups remain isolated and cease to contain the data as they are securely replaced.

9. Cookies and similar technologies

The website uses local storage, session storage and, where applicable, cookies for operation, security, and preferences. Analytics and marketing remain disabled until an affirmative choice. Categories, identifiers, durations, and controls are described in the Cookie Policy and Cookie preferences page.

10. Information security

We use technical and organisational measures proportionate to the risks, including HTTPS, access restrictions, authenticated administration, service segregation, audit records, abuse controls, backups, and component updates. No environment is infallible; we therefore maintain procedures to investigate incidents and, where required, notify affected individuals and ANPD.

11. Children and teenagers

The website and Arvoris business services are intended for people with legal capacity to enter into contracts and are not directed to children. We do not knowingly request children's data. A parent or guardian who identifies an improper submission may request deletion through the privacy channel. Matters involving teenagers will be assessed under the best-interest principle and applicable law.

12. Automated decisions

Arvoris does not use data collected through these channels to make solely automated decisions that produce legal effects or significantly affect an individual's interests. If that practice is introduced, we will provide the required information and a way to request review and an explanation of the criteria used.

13. Data subject rights

Under the LGPD, you may request confirmation of processing, access, correction, anonymisation, blocking or deletion of improper data, portability when regulated, deletion of consent-based data where applicable, information about sharing and the consequences of refusing consent, withdrawal of consent, objection to unlawful processing, and review of solely automated decisions.

14. How to exercise rights

Use the Data rights page or email contato@arvoris.com.br. Requests are free and receive a protocol. To protect the individual, we may request further information through a secure channel where there is reasonable doubt about identity or authority. Confirmation and simplified access are provided immediately where possible; complete statements are provided within 15 days, and other requests follow applicable legal and regulatory periods. If an action cannot be taken immediately, we explain why.

15. Changes to this Policy

We may update this Policy to reflect legal, technical, or operational changes. The current version, update date, and any relevant notices will be published on this page. Where a change requires new consent, the previous choice will not be used for the new purpose.

16. Contact and applicable law

Questions, complaints, or data requests may be sent to contato@arvoris.com.br or through the Data rights page. Processing under this Policy is primarily governed by Brazil's General Data Protection Law (Law No. 13,709/2018), the Brazilian Civil Rights Framework for the Internet (Law No. 12,965/2014), and ANPD regulations. Individuals may also petition ANPD and, where applicable, consumer protection authorities. This English text is provided for accessibility; the Portuguese version prevails for interpretation under Brazilian law, without limiting mandatory rights under other applicable laws.