Privacy Policy

1 Introduction

This Privacy Policy is issued by ATLAS DADOS PORTAIS DE CONTEUDO NA INTERNET LTDA, a Brazilian limited liability company registered under CNPJ, operating its digital content portals and services under the Atlas Inovações brand (referred to throughout this document as "Atlas", "we", "us", or "our").

This policy applies to all websites, sub-domains, and digital content portals owned or operated by Atlas, including but not limited to atlasinovacoes.site and any associated properties. It governs the collection, use, storage, sharing, and protection of personal data relating to visitors, prospective clients, and any individual who interacts with our online presence ("you" or "the user").

We are committed to processing personal data in full compliance with Brazil's Lei Geral de Proteção de Dados (LGPD — Law 13,709/2018) and, to the extent applicable to individuals located in the European Economic Area, the General Data Protection Regulation (GDPR — EU 2016/679). We also adhere to the advertising and landing-page data-handling standards required by Google Ads policies.

By accessing or using any of our websites, you acknowledge that you have read and understood this policy. If you disagree with any part of it, we kindly ask that you discontinue use of our sites and contact us at the details provided in Section 11 so we can address your concerns.

2 Information We Collect

We collect personal data through several distinct channels. We are specific about each category because we believe you deserve to know exactly what enters our systems — not a vague catch-all description.

2.1 Data you provide directly

When you reach out to us by email, telephone, or any other direct communication channel listed on our Contact page, you may share information such as:

• Your full name and professional title
• Business or personal email address
• Phone number, if provided voluntarily
• Company name and sector
• The content of your message or enquiry
• Any attachments or documents you choose to send us

We receive only what you actively choose to share. We do not run profiling exercises on inbound communications beyond what is necessary to respond meaningfully to your enquiry.

2.2 Data collected automatically when you browse

Like virtually every website on the internet, our servers and analytics tools collect certain technical data automatically whenever a browser loads one of our pages:

• IP address (stored in truncated or anonymised form where technically feasible)
• Browser type, version and language settings
• Operating system and device type (desktop, tablet, mobile)
• Referring URL — the address of the page that brought you here
• Pages visited, time spent per page, scroll depth and click paths
• Date and time of each request to our server
• HTTP response codes and error logs

This technical data is collected primarily for security monitoring, server performance optimisation, and aggregate audience analysis. It is not used to build individual behavioural profiles for commercial sale.

2.3 Data collected through cookies and similar technologies

We use first-party and third-party cookies, as described in detail in Section 4. Through these technologies we may collect identifiers associated with your browser session, advertising click identifiers (such as Google click IDs — GCLIDs), and aggregated behavioural signals used to measure advertising performance. Please see Section 4 for a full breakdown and instructions on how to manage these preferences.

3 How We Use Your Information

Every use of your data is grounded in one of the lawful bases recognised by the LGPD (Art. 7) and GDPR (Art. 6): your consent, the performance of a contract or pre-contractual steps taken at your request, compliance with a legal obligation, or our legitimate interests where these do not override your fundamental rights.

3.1 Responding to enquiries

When you contact us, we use the information you supply — your name, email, the content of your message — solely to craft a relevant, accurate response and to follow up if you have requested it. Lawful basis: performance of a pre-contractual relationship / legitimate interest.

3.2 Website analytics and performance improvement

We analyse aggregated, anonymised traffic data to understand which content is most useful to visitors, identify technical errors, and prioritise improvements to site navigation and load times. Individual users are not singled out in this analysis. Lawful basis: legitimate interest.

3.3 Advertising measurement and campaign optimisation

We use advertising platforms, principally Google Ads, to promote our services. Data such as page visits and, where applicable, conversion signals help us measure whether our advertising spend is effective and to optimise bids and targeting so our ads reach the most relevant audiences. We do not engage in retargeting based on sensitive personal data. Lawful basis: legitimate interest / consent (where a consent mechanism is presented).

3.4 Legal compliance and fraud prevention

We retain server logs and may process personal data as required by Brazilian law, tax regulation, or a court order. We also analyse traffic patterns to detect and block malicious activity against our infrastructure. Lawful basis: compliance with a legal obligation / legitimate interest.

We do not sell, rent, or licence your personal data to third parties for their own marketing purposes. We do not use your data to make automated decisions that produce legal or similarly significant effects on you.

4 Cookies & Tracking Technologies

Cookies are small text files placed on your device by a website. They serve a variety of purposes — from keeping a site functional to measuring audience behaviour. Below we explain each category we use and how you can control them.

4.1 Strictly necessary cookies

These cookies are essential for our website to function correctly. They manage security tokens, session continuity, and basic page rendering. They cannot be disabled without breaking core site functionality, and no personal data processed through them is used for marketing purposes.

4.2 Analytics and performance cookies

We use Google Analytics 4 (GA4) to collect pseudonymous usage data — page views, session duration, bounce rate, and traffic sources. GA4 is configured with IP anonymisation enabled, meaning the final octet of your IP address is masked before being stored. Data is aggregated for reporting and retained in accordance with our retention schedule (see Section 6). Google acts as a data processor under a Data Processing Agreement with Atlas.

4.3 Advertising and measurement cookies

When you arrive at our site via a Google Ads campaign, Google's conversion-tracking tag fires a cookie (typically named _gcl_aw) that records the click identifier. This allows us to attribute a subsequent enquiry to the correct advertising campaign. The data is shared with Google for conversion reporting. We do not use this data to build cross-site behavioural profiles beyond what Google's own policies permit.

4.4 Managing your cookie preferences

You have several options for controlling cookies:

• Browser settings — All major browsers (Chrome, Firefox, Safari, Edge) allow you to block or delete cookies via their privacy or settings menus. Note that disabling certain cookies may reduce site functionality.
• Google Analytics opt-out — Install the official Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout to prevent GA4 from collecting your visit data across all sites.
• Google Ads personalisation — Manage your ad preferences at adssettings.google.com or opt out of interest-based advertising at optout.aboutads.info.
• Do Not Track — We respect the DNT browser signal where technically feasible, though no universal standard for its enforcement currently exists.

5 Sharing With Third Parties

We share personal data with third parties only in the limited circumstances described below. We never sell data, and we require all third-party processors to provide at minimum the same level of protection we apply ourselves.

5.1 Service providers acting as data processors

• Google LLC — Analytics (GA4) and advertising measurement (Google Ads). Data may be transferred to and stored on Google's servers in the United States under Standard Contractual Clauses.
• Web hosting providers — Our hosting infrastructure processes server logs that may contain IP addresses. Providers are contractually bound to process this data only on our instructions.
• Email service providers — Inbound enquiry emails are handled through standard email protocols. Where we use a managed email platform, that provider acts as a processor.

5.2 Legal disclosure

We may disclose personal data if required to do so by Brazilian federal or state law, a binding court order, a formal request from a competent regulatory authority, or to protect the vital interests of an individual or the legal rights of Atlas.

5.3 Business transfers

In the event of a merger, acquisition, or sale of all or part of Atlas's business assets, personal data may be transferred to the acquiring entity, provided that entity agrees to honour this privacy policy or provide a substantially equivalent level of protection. We will notify affected individuals via a prominent notice on our website at least 30 days before any such transfer takes effect, where legally possible.

5.4 International transfers

Some of our service providers — notably Google — operate servers outside Brazil and the EEA. Where such transfers occur, we ensure they are covered by appropriate safeguards: Standard Contractual Clauses approved by the European Commission, adequacy decisions, or equivalent mechanisms recognised by Brazil's ANPD. You may request a copy of the applicable safeguards by writing to us at the address in Section 11.

6 Data Retention

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law. The table below summarises our principal retention periods:

• Enquiry correspondence (email, written communication) — Retained for up to 5 years from the date of the last substantive exchange, in case a dispute or contractual relationship arises from the initial contact. After this period, messages are permanently deleted or fully anonymised.
• Google Analytics 4 data — We have configured GA4 with a maximum data retention period of 14 months, after which individual event data is automatically deleted from Google's servers. Aggregated, non-identifiable reports may be retained indefinitely.
• Google Ads conversion data — Conversion windows are set to a maximum of 90 days, consistent with Google Ads policy. Click identifiers are not retained on our own servers beyond the session.
• Server access logs — Retained for up to 12 months for security analysis and infrastructure troubleshooting, then deleted.
• Legal and regulatory records — Where a legal obligation requires us to retain documents containing personal data (e.g., tax records, contracts), we retain those records for the legally mandated period, typically 5–10 years under Brazilian commercial and tax law.

When the applicable retention period expires, data is securely deleted, anonymised, or rendered irreversibly inaccessible using methods appropriate to the sensitivity and volume of the data concerned.

7 Data Security

We take the security of your personal data seriously and implement a layered set of technical and organisational measures proportionate to the nature and volume of data we handle:

• Encryption in transit — All pages on our websites are served exclusively over HTTPS using TLS 1.2 or higher. Plain HTTP connections are redirected automatically.
• Access controls — Access to systems that store or process personal data is restricted to authorised Atlas personnel on a need-to-know basis, protected by strong authentication requirements.
• Vendor vetting — We select third-party processors that hold recognised security certifications (such as ISO 27001 or SOC 2) and review their security posture before engagement.
• Incident response — We maintain a documented data breach response procedure. In the event of a breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority (ANPD in Brazil; the competent DPA for EEA residents) within the timeframes required by law, and we will contact affected individuals without undue delay where the risk is deemed high.
• Employee awareness — Personnel with access to personal data receive regular training on data protection obligations and phishing/social engineering awareness.

8 Your Rights

Depending on your location and the applicable law, you are entitled to exercise one or more of the following rights in relation to your personal data. Brazil's LGPD (Art. 18) and the GDPR (Art. 15–22) both recognise a substantive set of individual rights, summarised below:

How to exercise your rights

To exercise any of the above rights, send a written request to contato@atlasinovacoes.site with the subject line "Data Subject Request". Please include your full name and a description of the right(s) you wish to exercise. We may ask you to verify your identity before processing the request — this is a security measure to ensure we do not disclose or modify data in response to an unauthorised party.

We will acknowledge your request within 5 business days and provide a substantive response within 15 business days (extendable by a further 15 days in complex cases, with prior notice to you). We do not charge a fee for exercising your rights under normal circumstances.

9 Children's Privacy

Our websites and services are intended exclusively for adults and for business-to-business or professional communication purposes. We do not knowingly target, market to, or collect personal data from children under the age of 18 (or under 13 where a lower threshold applies under local law).

If you are a parent or guardian and you believe that a minor has provided us with personal information without your knowledge or consent, please contact us immediately at contato@atlasinovacoes.site. We will promptly investigate and, where confirmed, delete the data in question from our systems.

In compliance with the LGPD's Chapter III provisions on special categories of data, we treat data relating to children as requiring heightened protection and will never process it for advertising or profiling purposes.

10 Changes to This Policy

The digital landscape, legal environment, and our own business evolve continuously. We may therefore update this Privacy Policy from time to time to reflect changes in applicable law, regulatory guidance, our data processing practices, or the introduction of new Atlas products and services.

When we make changes, we will update the "Last updated" date at the top of this page. For material changes — those that significantly alter how we collect or use your data, or that expand your obligations or reduce your rights — we will provide a more prominent notice, such as a notice on our homepage for a period of at least 30 days before the changes take effect.

Your continued use of our websites after the effective date of any updated Policy constitutes your acknowledgement of the revisions. If you do not agree to the updated terms, please discontinue use of our sites and, if you wish, contact us to discuss how any data we hold about you should be handled going forward.

We maintain an internal archive of previous policy versions. If you would like to review an earlier version of this policy, you may request it by contacting us at the details below.

11 Contact & Data Protection Officer

Questions, requests, complaints, and any other correspondence relating to the handling of your personal data under this policy should be directed to us using the contact details below. We aim to provide clear, helpful, and timely responses to every enquiry we receive.