Privacy Policy

1. Who we are

Ennexa Labs is the trading name of 68.762.654 FERNANDA MULLER ENNES, registered under CNPJ number 68.762.654/0001-96, with its registered office in the Centro I district of Brusque, Santa Catarina, Brazil. The full address is available on request through the channels named in this policy.

We are the controller of the personal data processed on this site, under Law 13.709/2018, the Brazilian General Data Protection Law (LGPD).

2. Data protection officer

The contact for anything concerning the protection of personal data is contact@ennexalabs.com.

3. What we collect

Data you give us.

When you fill in the contact form or the diagnosis, we collect your name, work email, company, sector, role, telephone number and the content of your message. Role and telephone are optional.

When the submission comes from the diagnosis, the body of the message includes the answers you selected and the recommended path shown on screen. The diagnosis runs entirely in your browser: no answer reaches us until you fill in and send the form.

Data from contact by WhatsApp.

When contact happens over WhatsApp, we process your telephone number, the display name your account shows and the content of the messages exchanged.

Data collected automatically.

Our infrastructure records IP address, browser type, operating system, pages visited, date and time of access and country of origin. These records exist for security and operational reasons. The country, derived from the IP address by Cloudflare, also decides the language the page opens in, and only when your browser names none of the site three languages. That reading happens at the moment of access, is not stored for that purpose, and your own choice in the language switcher takes precedence over it.

Audience measurement data.

Only if you consent, Google Analytics collects the pages visited, the time spent on each, where the visit came from, the device type, the browser and an approximate location derived from the IP address. As declared by Google, the IP address is used for that derivation and is neither logged nor stored by Google Analytics 4. This data describes how the site is used and is not combined with what you send us through the form or over WhatsApp.

Data we do not collect.

We neither ask for nor store identity documents, financial data, health data or any category of sensitive personal data.

4. Why we use the data

Audience measurement and advertising are the only purposes in this table based on consent, and each stands apart from the other and from the rest. Refusing one or both does not affect your ability to use the site, to send the form or to receive a reply, and it changes none of the other purposes, which do not depend on your choice.

We do not sell your data and we do not transfer it to third parties for commercial purposes beyond what this policy describes. When you consent, measurement data is sent to Google for usage statistics and to Meta Platforms to measure and target advertising, each for its own purpose and neither beyond it. The processing each company carries out also follows that company own terms and privacy policy, over which we have no control.

5. Cookies, audience measurement and advertising

Cookies are small files written by the browser. This site uses four, in three categories.

Necessary. Always on, not subject to consent.

NEXT_LOCALE

Stores the language you chose, so your preference survives between visits. It does not identify you and does not follow your browsing on other sites.

ennexa_consent

Stores your own choice about the category below, so the question is not repeated on every page. It contains only the version of the purposes and one flag per category, with no identifier of any kind. It lasts twelve months.

Audience measurement. Only with your consent.

_ga and _ga_ followed by the property identifier

Written by Google Analytics 4 on this site own domain and read by Google. They tell one visit from another and recognise a browser that has been here before, so that we can learn which pages are read and where people leave the site. They last two years.

Advertising. Only with your consent, and separate from audience measurement: you can accept one and refuse the other.

_fbp and, when you arrive through an ad, _fbc

Written by the Meta Pixel on this site own domain and read by Meta Platforms. They connect your visit to the ad that brought you here and let us show advertising to people who have already visited the site. _fbc only exists when the visit arrives through a Meta ad link. They last ninety days.

Nothing from Google Analytics or the Meta Pixel loads before your explicit acceptance, each for its own purpose: not the script, not any request. While there is no consent for a purpose, the content security policy served with each page does not let your browser reach the corresponding company domains at all.

Consent is given per purpose, in the notice shown on your first visit, and refusing carries exactly the same weight and takes exactly the same effort as accepting. You can revisit your choice at any time through the "Cookie preferences" link in the footer of every page. Withdrawal takes effect from the moment it is made and does not undo processing already carried out.

Data collected by Google Analytics is retained according to the property configuration, currently 14 months, after which it is deleted or kept only in aggregate form that does not allow identification. Data processed by the Meta Pixel follows Meta Platforms own retention period, described in that company privacy policy.

6. Who we share with

We engage providers that act as processors, handling data solely on our instruction and for the purposes described in this policy:

Cloudflare, Inc.

Hosting the site and protecting it against abuse.

Resend (Plus Five Five, Inc.)

Delivering form messages to our inbox.

Google LLC

Receiving and storing messages in the corporate email service and, subject to your consent, audience measurement through Google Analytics 4. These are two distinct roles: the first does not depend on your choice, the second exists only if you consent.

Meta Platforms, Inc.

Two distinct roles, neither dependent on the other. First, as WhatsApp LLC, it is the communication channel when contact happens over WhatsApp, and processing inside the platform also follows the privacy policy of WhatsApp itself. Second, subject to your consent, it measures the result of paid advertising campaigns and lets us show ads to people who have already visited the site, through the Meta Pixel installed on this page. The first role does not depend on your choice; the second exists only if you consent.

We may also share data when required by a competent authority, by legal determination or for the regular exercise of rights.

7. International transfer

The providers above, Google and Meta Platforms included, are based in the United States, and the infrastructure may process and store data outside Brazil. This applies to every purpose in this policy, audience measurement and advertising included, when you consent to them.

The transfer is made on the basis of article 33 of the LGPD and relies on contractual safeguards agreed with each provider, including data protection clauses.

8. How long we keep it

Audience measurement data is retained according to the Google Analytics property configuration, currently 14 months. Advertising data processed by Meta Platforms follows that company own retention period.

Messages received through the form, conversations over WhatsApp, and the corresponding contact data, are kept for 24 months from our last contact with you, and are then deleted.

Technical access logs are kept for a shorter period, in line with the infrastructure provider policy, and serve security purposes only.

Longer periods may apply where there is a legal retention obligation or where data is needed to exercise rights in proceedings.

9. Your rights

At any time and free of charge, the LGPD gives you the right to:

• confirm whether we process data about you, and access that data
• correct incomplete, inaccurate or out of date data
• request the anonymisation, blocking or deletion of data that is unnecessary or processed contrary to the law
• request the portability of your data to another supplier
• be told who we share your data with
• withdraw consent, where processing rests on it
• object to processing grounded in legitimate interest

To exercise any of these rights, write to contact@ennexalabs.com. We will reply as quickly as we can, within the periods the law sets. We may ask for further information to confirm your identity before acting on a request.

If you consider that your request was not properly dealt with, you may complain to the Autoridade Nacional de Proteção de Dados, the Brazilian data protection authority.

10. Security

We apply technical and administrative measures to protect personal data, including encrypted transmission, a strict content security policy, anti-automation verification on the form, rate limiting on submissions, and restricted access to the messages received.

No system is entirely immune to incidents. Should a security incident occur with material risk to data subjects, we will notify those affected and the Autoridade Nacional de Proteção de Dados as the law requires.

11. Minors

This site is intended for professionals and companies. We do not knowingly collect data from anyone under 18. If we identify collection of that kind, the data will be deleted.

12. Changes

This policy may be updated. The date of the last update is at the top of the document. Material changes will be announced prominently on the site.

13. Contact

contact@ennexalabs.com