1. Who the controller is
ETX Personalizados Ltda., CNPJ (Brazilian company ID) 51.452.087/0001-79, headquartered in Vitória, Espírito Santo, Brazil, responsible for the website and for customer service under the Customiza027® brand.
ETX is the controller: it decides how and why the data is processed, under Brazil's General Data Protection Law (Law 13,709/2018, "LGPD").
2. Summary
- The website does not use advertising or analytics cookies and stores nothing in your browser when it loads.
- The "Write your message" form does not send data to the website. It only drafts the text and opens your WhatsApp or email app; nothing is sent until you confirm.
- The ZIP code (CEP) search on the partners page runs in your browser, querying the public BrasilAPI or ViaCEP services. We do not store the code.
- We use technology providers, some of them outside Brazil, with the safeguards required by the LGPD.
- You can request access, correction, deletion and other measures by emailing contato@customiza027.com.br.
3. What data we process, where it comes from and why
| Situation | Data | Purpose | Legal basis (LGPD) |
|---|---|---|---|
| Visiting the website | Technical access logs generated by the hosting provider: IP address, date and time, page visited and browser. | Operation, security and abuse prevention. | Legitimate interest (art. 7, IX) and compliance with a legal obligation, where applicable (art. 7, II). |
| Partner search by ZIP code | The ZIP code you type. The service queried also receives your IP address. | Show the city and estimate the distance to partners. Done in your browser, nothing stored. | Legitimate interest, at your request (art. 7, IX). |
| "Write your message" | Nothing is sent to the website. If you send the message via WhatsApp or email: name, company, service of interest and project description. | Reply to your inquiry and prepare a proposal. | Pre-contractual steps at your request (art. 7, V) and legitimate interest (art. 7, IX). |
| Phone number, WhatsApp name and profile photo, message content, voice notes and timestamps. | Respond, answer questions, understand your request, schedule meetings, route the conversation within the team and improve service quality. | Pre-contractual steps (art. 7, V) and legitimate interest (art. 7, IX). | |
| Name, email address, job title, company and message content. | Respond, send proposals and manage the relationship. | Pre-contractual steps or performance of a contract (art. 7, V) and legitimate interest (art. 7, IX). | |
| Online meetings | Name, email, image and voice during the meeting. Recording or transcription only with notice before it starts. | Hold the meeting and record next steps. | Performance of a contract or pre-contractual steps (art. 7, V). Recording or transcription: consent (art. 7, I) or legitimate interest with prior notice (art. 7, IX), as applicable. |
| Clients | Contact details of representatives, billing details and access to media and social accounts provided by the client. | Deliver the contracted services, invoice and meet tax obligations. | Performance of a contract (art. 7, V) and legal obligation (art. 7, II). |
| Partner companies (directory) | Company name, logo, business address, WhatsApp, email and social profiles, only with written authorization. | Display the partner on the partners page. | Consent (art. 7, I) or performance of a contract (art. 7, V). |
| Business-to-business outreach | Business name, job title, email and phone, obtained from the company's own public sources. | Introduce our services to companies. Every message includes a way to opt out. | Legitimate interest (art. 7, IX), with a documented assessment. |
| Privacy requests | Data needed to confirm your identity and handle the request. | Fulfil the rights provided by the LGPD. | Legal obligation (art. 7, II). |
We do not intentionally process sensitive data (health, religion, biometrics, etc.). Please do not send it. If you do, it will be used only to the minimum extent needed to reply, or deleted.
The website is not intended for anyone under 18.
6. International transfers
Some providers process data outside Brazil, mainly in the USA. These transfers rely on the mechanisms of art. 33 of the LGPD, such as the standard contractual clauses approved by the ANPD (Brazil's data protection authority, Resolution CD/ANPD No. 19/2024) or the need to perform a contract or pre-contractual steps at your request.
You can ask for more information about these transfers through the channel in section 10.
7. How long we keep data
| Data | Period |
|---|---|
| Service conversations (text and audio) that did not lead to a contract | As long as needed to answer and follow up on your request. You can ask for deletion sooner. |
| Client and contract data | For the duration of the contract and then for the periods required by law (for example tax and accounting). |
| Website access logs | For the hosting provider's retention period and, where required, the legal period (Brazilian Internet Civil Framework, art. 15). |
| "Do not contact" list (opt-out requests) | As long as needed to honor your request. |
| Partner authorizations | While the partnership lasts and for the legal period to defend rights. |
After that, the data is deleted or anonymized.
8. Security
We adopt technical and organizational measures to protect data:
- website served only over a secure connection (HTTPS with HSTS) and with security headers;
- access restricted by person and need;
- access control on company accounts;
- providers with security commitments.
No system is 100% secure. If an incident may cause relevant risk or harm, we will notify the ANPD and the people affected, as the law requires.
9. Your rights
Under the LGPD (art. 18), you may request, free of charge:
- confirmation that we process your data and access to it;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of unnecessary or excessive data, or data processed unlawfully;
- portability, under ANPD regulations;
- deletion of data processed based on your consent, and withdrawal of that consent;
- information about who we share the data with;
- information about the possibility of not consenting and its consequences;
- objection to processing based on legitimate interest;
- review of decisions made solely on automated processing (we do not make such decisions).
Visitors in the European Union and the United Kingdom: where the GDPR or UK GDPR applies, you also have the rights in articles 15 to 22 of the GDPR (access, rectification, erasure, restriction, portability and objection) and the right to lodge a complaint with the data protection authority of your country. The corresponding legal bases are performance of a contract and pre-contractual steps (art. 6(1)(b)), legitimate interests (art. 6(1)(f)) and legal obligation (art. 6(1)(c)). Transfers outside the European Economic Area follow the safeguards of Chapter V of the GDPR.
10. Data subject channel and data protection officer
- Data protection officer (encarregado): Gustavo Schaeffer
- Email: contato@customiza027.com.br (write "Privacy" in the subject line)
We will reply within the time limits set by the LGPD and ANPD regulations. We may ask for information to confirm your identity before acting, to protect your data.
You may also file a complaint with Brazil's National Data Protection Authority (ANPD): gov.br/anpd.
11. How to stop receiving messages
- Email: reply "STOP" or use the unsubscribe link, when available.
- WhatsApp: send "STOP".
We will keep only what is necessary to avoid contacting you again.
12. Changes to this policy
We may update this policy. The last-updated date is shown at the top of the page, and material changes will be announced on the website. See also the Terms of Use.