Privacy policy

This policy explains which personal data the Kitanderia website collects, why it collects them, who they are shared with, and what you can demand from us. It follows the Brazilian General Data Protection Law (Law 13.709/2018, LGPD).

Who the controller is

Kitanderia, CNPJ 55.266.410/0001-70, Avenida São Luís, 165, Conj. 7A, República, São Paulo/SP, CEP 01046-911. For any personal data matter, including the requests described here: atendimento@kitanderia.com.br.

What we collect, and when

When you request a quote. Name, company, e-mail, phone and whatever you write in the message, plus the briefing choices (occasion, quantity, budget and deadline). All of it typed by you.

When you subscribe to the newsletter. Only the e-mail address and the page where the subscription happened.

When you browse. We keep the page visited, the date and time, where you came from (referring site and campaign parameters such as utm_source and gclid), browser language, device type and a random visit identifier. We do not store your full IP address or your name in that measurement — it exists to tell which pages work, not to identify people.

Why we collect

• To answer your request and conduct the negotiation. This is the main reason, and the legal basis is preliminary steps taken at your request (art. 7, V).
• To send the newsletter, when you ask for it. Basis: your consent (art. 7, I), which you may withdraw at any time.
• To understand how the site is used and improve what does not work. Basis: legitimate interest (art. 7, IX), using data that do not identify you.
• To comply with legal obligations, such as keeping tax and access records where the law requires (art. 7, II).

Who we share with

We do not sell personal data. They pass through companies that provide services to us, each doing only what is necessary:

• Amazon Web Services (AWS) — hosting of the site and its files, in a Brazilian region (sa-east-1).
• Neon — the database where requests are stored.
• Google — sending the site's e-mails (Google Workspace) and aggregate audience measurement (Google Analytics, via Tag Manager).
• Cloudflare — anti-bot verification of the form (Turnstile).

We also share when the law or a court order requires it.

Transfers outside Brazil

Google and Cloudflare process part of the data on servers abroad. Those transfers rely on the contractual clauses and safeguards offered by those suppliers, under art. 33 of the LGPD.

How long we keep it

• Quote requests: 5 years from the last contact, the civil limitation period, because a request may become a contract.
• Newsletter subscription: until you unsubscribe. The record of the unsubscribe is kept precisely so we do not write to you again.
• Visit measurement: 24 months.

After that, we delete or anonymise.

Your rights

The LGPD gives you the right to know what we hold about you, to correct what is wrong, to request a copy, to request deletion, to withdraw consent and to know who we share with. Write to atendimento@kitanderia.com.br and we will answer within 15 days.

If you ask for deletion, we delete what we are not legally required to keep — and we say plainly what remained and why.

Security

The site runs entirely over HTTPS, access to the administration area is restricted to named accounts, and passwords are never sent by e-mail: whoever receives access chooses their own through a single-use link. No system is impenetrable, but we treat any incident with communication — to you and to the Brazilian data protection authority (ANPD) where applicable.

Children

This site is aimed at companies. We do not knowingly collect data from children or adolescents; if that happens by mistake, we delete it as soon as we know.

Changes

This policy may change. The date of the last update appears at the foot of this page.

Language

This is a courtesy translation. The Portuguese version is the one that prevails in any legal dispute.