Introduction
This Privacy Policy is issued by BELAGO TECHNOLOGIES INFORMATICA LTDA, a company incorporated under Brazilian law, registered under CNPJ 22.738.953/0001-94, with its registered address at Avenida Doutor Victor do Amaral, 588, Sala 3 Pav. Sala 33, Centro, Araucária – PR, Brazil (hereinafter "Belago Technologies", "we", "us" or "our").
We operate the website at belago.site and provide a range of IT services including managed infrastructure, cloud solutions, cybersecurity consulting, and enterprise software development. In the course of operating our business and running this website, we collect and process certain personal data. We are committed to handling that data lawfully, fairly and transparently in accordance with:
- The General Data Protection Regulation (GDPR) — Regulation (EU) 2016/679, which may apply when we process data of individuals located in the European Economic Area.
- Brazil's Lei Geral de Proteção de Dados (LGPD) — Law No. 13,709/2018, which governs the processing of personal data of natural persons located in Brazil.
- Any other applicable national or international data-protection legislation.
By visiting our website, submitting a contact or quote request form, or otherwise engaging with our services, you acknowledge that you have read this policy and understand how your data is processed. If you do not agree with any part of this policy, please discontinue use of our website and refrain from submitting personal data to us.
Controller identity: For the purposes of applicable data-protection law, Belago Technologies Informatica Ltda is the data controller in respect of personal data collected through this website and through the delivery of our professional services.
Information We Collect
We only collect personal data that is adequate, relevant and necessary for the specific purposes described in this policy. The categories of data we collect fall into two groups: information you provide to us directly and information collected automatically when you browse our website.
Information You Provide Directly
When you fill in our contact form, request a quote, ask about a partnership, or otherwise reach out to us through the website or by email, you may provide us with:
- Full name — to address you correctly and personalize our response.
- Corporate email address and/or personal email address — as the primary channel for our reply.
- Phone number — if you prefer or consent to a follow-up call.
- Company name and role/title — to understand the context of your enquiry and assess how we can best help.
- Message content — the details of your project, question or service request, which may incidentally include other personal or technical information you choose to share.
- Consent records — the date, time and method by which you provided consent to be contacted, where applicable.
We do not request or collect sensitive categories of personal data (such as health data, racial or ethnic origin, political opinions, or financial account details) through this website. If you inadvertently include such information in a message, please let us know and we will delete it promptly.
Information Collected Automatically
When you visit our website, our servers and third-party analytics tools automatically collect certain technical information about your visit. This may include:
- IP address — used to identify your approximate geographic region and to help detect and prevent abusive traffic or security threats. IP addresses are pseudonymized where technically feasible.
- Browser type, version and operating system — for compatibility analysis and to improve user experience across devices.
- Pages visited and navigation path — which sections of the site you viewed, the order in which you navigated, and time spent on each page.
- Referring URL — the web address of any site or advertisement that directed you to ours.
- Date, time and duration of visit — aggregated to understand traffic patterns and peak usage periods.
- Device identifiers and screen resolution — to optimize responsive design and performance.
- Cookie identifiers and session data — see Section 04 (Cookies & Tracking Technologies) for full detail.
Much of this automatically collected data is either anonymized or aggregated before analysis, meaning it cannot on its own identify you personally. Where it can identify you, we apply the protections described in this policy.
How We Use Your Information
We process your personal data only for lawful purposes and only where we have a valid legal basis to do so. Below we describe each purpose, the categories of data involved, and the legal basis relied upon.
Responding to Enquiries and Delivering Services
When you contact us through our website or by email, we use your name, contact details and message content to evaluate your needs and provide an appropriate, tailored response. If an engagement results, we use the same data — along with any additional information collected during project onboarding — to perform our contractual obligations. Legal basis: Performance of a contract or pre-contractual steps taken at your request (LGPD Art. 7(V); GDPR Art. 6(1)(b)).
Marketing Communications
With your explicit, freely given consent, we may occasionally send you information about our services, technology insights, case studies, or promotional offers that we believe may be of professional interest. You may withdraw consent at any time, at no cost, by clicking the unsubscribe link in any email we send or by writing to contato@belago.site. Withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal. Legal basis: Consent (LGPD Art. 7(I); GDPR Art. 6(1)(a)).
Website Analytics and Performance Improvement
We analyze aggregated and pseudonymized data about how visitors interact with our website to identify areas for improvement, fix technical issues, measure the effectiveness of content, and ensure the site performs well across devices and connection speeds. Legal basis: Legitimate interests (LGPD Art. 7(IX); GDPR Art. 6(1)(f)) — specifically, our interest in operating a functional, secure and competitive online presence, which we have assessed as not overriding your interests or fundamental rights.
Security, Fraud Prevention and Legal Compliance
We process certain technical data, including IP addresses and access logs, to detect, investigate and prevent unauthorized access, fraudulent activity, and other security incidents. We may also process personal data to comply with a legal obligation — for example, responding to a court order, regulatory request or applicable tax legislation. Legal basis: Legal obligation and legitimate interests (LGPD Art. 7(II), 7(IX); GDPR Art. 6(1)(c), 6(1)(f)).
We do not use your personal data for automated individual decision-making or profiling in any manner that produces legal or similarly significant effects on you.
Cookies & Tracking Technologies
Our website uses cookies and similar technologies (such as local storage and web beacons) to ensure the site works correctly, to measure performance, and — where you have consented — to understand how visitors discover and engage with us. A cookie is a small text file placed on your device by a web server. It cannot execute code or transmit viruses.
You can control and manage cookies through your browser settings. Most browsers allow you to refuse all cookies, accept only certain cookies, or delete cookies that have already been set. Note that disabling certain cookies may affect site functionality. You can also use opt-out tools provided directly by analytics vendors, as described in the table below.
| Type | Purpose | Duration | Legal Basis |
|---|---|---|---|
| Strictly Necessary | Ensure the website loads and functions correctly; manage session state; prevent cross-site request forgery. These cannot be disabled without breaking core functionality. | Session / up to 24 hours | Legitimate interests; strictly necessary |
| Performance & Analytics | Google Analytics (GA4) is used to collect pseudonymized data on page views, session duration, traffic sources and user journeys. Data is transferred to Google LLC servers. IP anonymization is enabled. You may opt out via Google's opt-out browser add-on. | Up to 13 months | Consent (where required) / Legitimate interests |
| Functional | Remember your language or display preferences and any settings you configure while navigating the site, so you don't have to re-enter them on subsequent visits. | Up to 12 months | Consent |
| Advertising / Remarketing | Where Google Ads campaigns are active, Google Ads conversion tracking may place cookies to measure whether a visit to our site resulted from one of our ads. This allows us to evaluate the effectiveness of our advertising spend. No personal profiles for third-party advertising are built from this data. | Up to 90 days | Consent |
On your first visit to our website, a cookie consent banner will be displayed offering you granular control. Only strictly necessary cookies are activated before you make a choice. If you previously consented and wish to change your preferences, you may do so by clearing your browser cookies and revisiting the site, or by contacting us directly.
Sharing With Third Parties
We do not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. We share data only in the circumstances described below, and only to the extent necessary for each purpose.
Service Providers and Data Processors
We engage a limited number of carefully vetted third-party service providers who process personal data on our behalf, strictly according to our written instructions and bound by data-processing agreements. These include:
- Website hosting and infrastructure providers — who store website files and databases on servers located in Brazil and/or the European Union.
- Email delivery platforms — used to transmit enquiry notifications and, where you have consented, commercial communications.
- Analytics platforms — primarily Google Analytics (Google LLC, USA), used under standard contractual clauses and with IP anonymization enabled.
- CRM and project management tools — used internally to manage client relationships and project delivery. Access is restricted to Belago Technologies staff on a need-to-know basis.
Legal Requirements and Protection of Rights
We may disclose personal data to government authorities, law-enforcement agencies, courts or regulators when required to do so by law, or when we reasonably believe disclosure is necessary to: (a) comply with a legal obligation; (b) protect the vital interests of you or another natural person; (c) establish, exercise or defend a legal claim; or (d) prevent or investigate suspected unlawful activity, fraud or a serious security incident.
Business Transfers
In the event that Belago Technologies undergoes a merger, acquisition, sale of assets, or other corporate reorganization, personal data held by us may be disclosed to the prospective counterparty as part of due diligence, and subsequently transferred as part of that transaction. Any such transfer would be subject to strict confidentiality obligations and the protections set out in this policy. We would notify you of any material change in controller identity.
International Transfers
Where personal data is transferred to recipients located outside Brazil or the European Economic Area — for example, to U.S.-based technology providers such as Google — we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, or equivalent mechanisms recognized under the LGPD, to ensure your data receives an equivalent level of protection regardless of where it is processed.
Data Retention
We retain personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law. The following general retention periods apply:
- Contact form submissions and email enquiries — retained for up to 3 years from the date of the last meaningful interaction, allowing us to reference prior conversations if you contact us again in the future. Where no commercial relationship develops, we review and purge enquiry data at 12-month intervals.
- Active client records — retained for the duration of the contractual relationship and for a period of 5 years thereafter, to comply with Brazilian tax and accounting obligations (Lei No. 10.406/2002 — Código Civil; Lei No. 9.430/1996) and to respond to any potential legal claims within statutory limitation periods.
- Website analytics data — aggregated and pseudonymized analytics data is retained for 13 months in line with Google Analytics' default data-retention settings, after which it is automatically deleted or de-identified beyond recovery.
- Cookie consent records — retained for 3 years as evidence of valid consent, in accordance with the requirements of both LGPD and GDPR.
- Marketing consent records — retained for as long as the consent is active, and for a further 3 years after withdrawal, to document that we acted lawfully.
When personal data is no longer required, we securely delete or anonymize it so that it cannot reasonably be attributed to any identified or identifiable individual. We do not retain data merely because deletion has not been actively requested.
Data Security
As an IT services and technology company, information security is embedded in how we operate — not treated as an afterthought. We implement a layered set of administrative, physical and technical safeguards designed to protect personal data against unauthorized access, accidental loss, alteration, disclosure, or destruction.
Our security measures include, but are not limited to:
- Encryption in transit — all data exchanged between your browser and our web servers is encrypted using TLS 1.2 or higher (HTTPS). Contact form submissions are never transmitted over unencrypted connections.
- Access controls — personal data is accessible only to Belago Technologies staff and authorized processors who require it for legitimate business purposes. Role-based access controls limit internal exposure to the minimum necessary.
- Secure hosting infrastructure — our servers are hosted in data centers that maintain ISO/IEC 27001-aligned physical security, redundant power systems, and environmental controls.
- Regular security assessments — we periodically review our systems, code base and third-party integrations to identify and remediate vulnerabilities.
- Staff awareness — all personnel who handle personal data receive appropriate training on data-protection obligations and secure handling practices.
- Incident response plan — in the event of a data breach that is likely to pose a risk to the rights and freedoms of affected individuals, we will notify the relevant supervisory authority (ANPD in Brazil; the competent EU supervisory authority where applicable) within the timeframes mandated by law, and will communicate directly with affected individuals where required.
Important note: No system connected to the internet can guarantee absolute security. While we work hard to protect your data, the transmission of information over the internet carries inherent risks. We encourage you to keep your own devices and accounts secure, and to contact us immediately at contato@belago.site if you suspect any unauthorized use of your information in connection with our services.
Your Rights
Under the LGPD and, where applicable, the GDPR, you have a robust set of rights with respect to your personal data. We are committed to honoring these rights promptly and without unnecessary obstacles. The rights available to you are summarized below.
Right of Access
You may request confirmation of whether we hold personal data about you and, if so, obtain a copy of that data together with information about how and why it is being processed.
Right to Rectification
If personal data we hold about you is inaccurate or incomplete, you have the right to request that it be corrected or completed without undue delay.
Right to Erasure
You may request the deletion of your personal data where it is no longer necessary for the purposes it was collected, where you withdraw consent (and no other lawful basis exists), or where you successfully object to processing. Note that certain legal obligations may require us to retain some data despite such a request.
Right to Object
You may object at any time to processing based on our legitimate interests, including direct marketing. Where you object to direct marketing, we will cease processing for that purpose immediately and without requiring justification from you.
Right to Restriction
In certain circumstances — for example, while we verify the accuracy of data you have contested — you may request that we restrict processing so that we continue to store your data but do not actively use it.
Right to Data Portability
Where processing is based on consent or contract and is carried out by automated means, you may request that we provide your personal data in a structured, commonly used, machine-readable format, and transmit it to another controller where technically feasible.
Right to Withdraw Consent
Where processing relies on your consent, you may withdraw that consent at any time with immediate effect. Withdrawal does not affect the lawfulness of processing that occurred before the withdrawal.
Right to Lodge a Complaint
If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with Brazil's national supervisory authority, the ANPD (Autoridade Nacional de Proteção de Dados), or, for EEA residents, the competent data-protection authority in your country of residence.
How to Exercise Your Rights
To exercise any of the rights described above, please send a written request to contato@belago.site with the subject line "Data Subject Rights Request." Please include your full name and, if possible, the email address you used when contacting us, so we can locate your data accurately.
We aim to respond to all valid requests within 15 business days for LGPD requests and within one calendar month for GDPR requests. Where a request is complex or involves a large volume of data, we may extend this period by a further two months, in which case we will notify you promptly of the extension and the reasons for it. Requests will be handled free of charge, except where they are manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or decline to act on the request — and will provide written reasons for doing so.
We may need to verify your identity before fulfilling a request, to prevent unauthorized disclosure of another person's data. We will not retain any identity verification document beyond the time strictly required to process your request.
Children's Privacy
Our website and services are directed exclusively at businesses and professionals and are not designed for, or targeted at, children under the age of 18. We do not knowingly collect, use or disclose personal data from or about minors.
If we become aware that we have inadvertently received personal data from a person under the age of 18 without appropriate parental consent, we will take prompt steps to delete that data from our records. If you are a parent or guardian and believe your child has submitted personal data to us, please contact us at contato@belago.site so we can identify and remove the data as quickly as possible.
Changes to This Policy
We review this Privacy Policy regularly to keep it accurate and up to date with changes in our business practices, applicable technology, and evolving data-protection law. When we make material changes — meaning changes that substantially affect how we process your data or the rights available to you — we will:
- Update the "Last updated" date at the top of this page;
- Display a prominent notice on our website homepage for a reasonable period following the change;
- Where we hold your email address and the change is particularly significant, notify you by email.
We encourage you to revisit this page periodically to stay informed. Non-material changes — such as minor editorial corrections or clarifications that do not alter the substance of our processing activities — may be made without specific notice, though the updated date will always reflect the most recent revision.
Your continued use of our website after a material policy update, where you have been given adequate notice, constitutes your acknowledgment of the revised policy. If you do not agree with any change, you may exercise your rights as described in Section 08 or discontinue use of our services.
Contact & Data Controller
If you have any questions, concerns, or requests relating to this Privacy Policy or to the way we handle your personal data, we encourage you to contact us directly. We take every enquiry seriously and will do our best to address your concerns efficiently and clearly.
Get in Touch With Us
Our team is available to respond to data-protection enquiries Monday through Friday, 9:00 a.m. – 6:00 p.m. (Brasília Time, UTC-3). We aim to acknowledge all enquiries within one business day.
You also have the right to contact Brazil's national data-protection authority, the Autoridade Nacional de Proteção de Dados (ANPD), directly at www.gov.br/anpd, should you feel that your rights under the LGPD have not been adequately respected. EEA residents may additionally contact the data-protection authority in their country of habitual residence.