Privacy Policy

Introduction

Core Soluções em Informática e Tecnologia Ltda — registered under CNPJ 45.856.266/0001-79 and trading under the name CORE TI Expert — operates this website at coretiexpert.site. We provide managed IT services, systems integration, cloud infrastructure and cybersecurity consulting to businesses across Brazil and beyond.

We take privacy seriously, not as a compliance exercise but as a core business value. As a technology company, we understand the sensitivity of data better than most, and we hold ourselves to a high standard when handling any personal information entrusted to us — whether by website visitors, prospective clients, or service partners.

This policy governs personal data processing activities associated with our website and institutional communications. It has been prepared in line with Brazil's Lei Geral de Proteção de Dados Pessoais (LGPD — Law No. 13,709/2018) and, where applicable, the General Data Protection Regulation (GDPR) of the European Union. Additional consumer rights under the Brazilian Consumer Protection Code (CDC) are also respected.

By visiting this website, you acknowledge that you have read and understood how we handle data as described below. If you have any questions, our contact details are provided at the end of this document.

Information We Collect

We collect only what is genuinely necessary for the purposes described in this policy. We do not buy, rent or trade personal data lists. The categories below outline what may be collected and the circumstances in which each type arises.

2.1 Information You Provide Directly

When you reach out to us through the contact details published on this website — by email, telephone or in person — you may voluntarily share personal information such as:

• Your full name and job title or role
• Business email address and telephone number
• Company name, sector and approximate size
• A description of the IT challenge or project you wish to discuss
• Any other information you choose to include in your message

We do not operate a contact form on this website. All direct data sharing happens through channels you initiate — email to contato@coretiexpert.site or calls to our published number — and you retain full control over what you share.

2.2 Information Collected Automatically

When you visit our website, certain technical data is collected automatically by our servers and third-party analytics tools. This may include:

• IP address (stored in truncated, anonymised form where technically feasible)
• Browser type and version, operating system and device category
• Referring URL — the page you came from before landing on ours
• Pages viewed, time spent on each page and navigation path through the site
• Date and time of access, and approximate geographic region derived from IP
• Screen resolution and preferred language setting

This information is collected in aggregate to understand how visitors interact with our site so we can improve its content and structure. It is not used to identify you personally.

2.3 Information From Business Contexts

When we enter into a service engagement or partnership, we may process additional personal data belonging to our clients' authorised contacts — such as contract signatories, project managers and technical leads. That processing is governed by a separate data processing agreement entered into with the relevant organisation, and falls outside the scope of this website-focused policy.

How We Use Your Information

We process personal data only where we have a valid legal basis to do so under the LGPD and, where relevant, the GDPR. The table below maps each purpose to its corresponding legal basis.

Purposes and Legal Bases

• Responding to enquiries and pre-sales conversations — Processing is necessary for legitimate interests (preparing to enter into a contract with you or your organisation). We have balanced this against your interests and found no undue prejudice.
• Providing and managing contracted IT services — Processing is necessary for the performance of a contract to which you or your employer is a party, and to comply with our legal obligations as a service provider.
• Sending service-related communications — Status updates, security advisories and renewal notices relevant to active engagements are sent on the basis of contractual necessity and legitimate interests.
• Analysing website performance and improving content — Aggregate, anonymised analytics data is processed on the basis of our legitimate interest in operating an effective institutional website. No individual profiling occurs.
• Compliance with legal and regulatory obligations — We retain certain records as required by Brazilian fiscal, labour and regulatory law. The legal basis is compliance with a legal obligation (LGPD Art. 7, VI).
• Fraud prevention and information security — Server logs and access records may be examined in response to a security incident. The basis is legitimate interests in protecting our systems and those of our clients.

Cookies & Tracking Technologies

Cookies are small text files placed on your browser by a website to remember preferences or gather behavioural data. We use a minimal set of cookies consistent with operating a modern corporate website and measuring its performance.

4.1 Strictly Necessary Cookies

These cookies are essential for the website to function and cannot be switched off. They do not collect personal data in any identifiable form and do not require your consent under current guidelines. They typically exist only for the duration of your browser session.

4.2 Analytics Cookies

We use Google Analytics (operated by Google LLC, a company subject to Standard Contractual Clauses for international data transfers) to understand aggregate traffic patterns. Google Analytics places first-party cookies on your browser to distinguish unique visits, measure session duration and identify popular content. We have activated IP anonymisation, meaning your full IP address is never transmitted to Google's servers.

The data collected through analytics cookies is aggregated and does not allow us — or Google — to identify you personally from website visits alone. Retention within Google Analytics is set to 14 months.

4.3 Marketing and Advertising Cookies

If we run Google Ads campaigns, Google may set a conversion cookie to measure whether a visitor who clicked an advertisement subsequently performed a meaningful action on our site (such as visiting our contact page). This cookie contains no personally identifiable information and expires within 30 days of the last interaction. We do not use remarketing lists based on personally identifiable data.

4.4 Managing Cookies

You can instruct your browser to refuse all cookies or to alert you when a cookie is being placed. The help section of most browsers explains how to do this. You may also opt out of Google Analytics tracking specifically by installing the Google Analytics Opt-out Browser Add-on available at tools.google.com/dlpage/gaoptout. Blocking cookies does not prevent you from reading or navigating this website, as we do not gate any content behind a cookie wall.

Sharing With Third Parties

We do not sell, rent, or exchange personal data. We share it only in the limited circumstances described below, and only to the minimum extent necessary in each case.

5.1 Service Providers (Data Processors)

We engage carefully selected technology partners to support our operations. These companies act as data processors under our instruction and are contractually prohibited from using your data for their own purposes. Current categories include:

• Hosting and infrastructure providers — Our website is hosted on servers subject to ISO 27001-aligned security standards.
• Analytics platforms — Google LLC processes aggregated, anonymised website metrics as described in the Cookies section above.
• Email infrastructure — Business email communications are routed through enterprise-grade mail servers. Your email address is used solely to reply to your enquiry.
• Accounting and legal advisors — Where required by Brazilian fiscal or contractual law, our accountants and legal counsel may access data strictly limited to what their mandate requires.

5.2 Legal Compulsion

We may disclose personal data if compelled to do so by a valid order from a Brazilian court, the ANPD (Autoridade Nacional de Proteção de Dados), a public prosecutor's office, or another competent regulatory authority. In such cases we will seek to notify affected individuals wherever legally permissible and practically feasible.

5.3 Business Transfers

In the event of a merger, acquisition, or sale of substantially all of our assets, personal data held by us may form part of the transferred assets. Any successor entity would be required to honour the commitments in this policy or provide advance notice of any material changes.

5.4 International Data Transfers

Some of our service providers (including Google) process data outside Brazil. Where this occurs, we ensure that appropriate transfer mechanisms are in place — including Standard Contractual Clauses or adequacy decisions recognised under LGPD Art. 33 — to maintain a level of protection equivalent to Brazilian law.

Data Retention

We keep personal data only for as long as is necessary to fulfil the purpose for which it was collected, or as required by law. The following retention criteria guide our practices:

• Pre-sales enquiry records — Retained for up to 24 months following the last substantive communication, reflecting the typical sales cycle for IT infrastructure projects. If no engagement materialises, records are deleted or anonymised at the end of this period.
• Service-related data — Retained for the duration of the contractual relationship and for a further five years thereafter, in compliance with Brazilian fiscal and commercial record-keeping obligations (Lei 10.406/2002 and RFB requirements).
• Website server logs — Retained for a maximum of 90 days for security and diagnostic purposes, in accordance with the Marco Civil da Internet (Lei 12.965/2014, Art. 15).
• Analytics data — Aggregated and anonymised within 14 months via Google Analytics settings; no identifiable residue is retained beyond that window.
• Legal holds — Where data is subject to a pending legal claim, regulatory investigation, or court order, retention will be extended until the matter is fully resolved.

When retention periods expire, data is either securely deleted (using methods that prevent recovery) or irreversibly anonymised so that it can no longer be associated with an individual.

Data Security

As an IT services company, information security is at the centre of what we do professionally — and that expertise extends to how we protect the data we hold. Our security measures include, but are not limited to:

• TLS 1.2 or higher encryption for all data transmitted between your browser and our web server
• Access controls ensuring that internal staff can only access personal data relevant to their specific role (principle of least privilege)
• Multi-factor authentication for all administrative systems and email accounts that may process personal data
• Regular security assessments and vulnerability scanning of our public-facing infrastructure
• Vendor due diligence — all third-party processors are evaluated for security posture before engagement and are contractually required to maintain appropriate technical and organisational measures
• An internal incident response procedure aligned with LGPD Art. 48, which sets out how we identify, contain, and report data security incidents to the ANPD and affected individuals within the required timeframes

No transmission over the internet and no digital storage medium is guaranteed to be 100% secure. However, we take every reasonable precaution to protect personal data from unauthorised access, disclosure, alteration or destruction, and we continuously review and improve our security controls.

Your Rights

Brazilian law (LGPD Chapter III) and, where applicable, the GDPR grant individuals a meaningful set of rights over their personal data. We are committed to honouring these rights promptly and without unnecessary bureaucracy. Your rights include:

Right of Access (Art. 18, I & II — LGPD)

You may request confirmation of whether we hold personal data about you, and if so, receive a copy of that data in a clear and readable format, along with information on where it came from, with whom it has been shared, and for how long it will be retained.

Right of Correction (Art. 18, III — LGPD)

If any personal data we hold about you is inaccurate, incomplete or out of date, you have the right to request correction. We will update records promptly upon verification of the request.

Right to Deletion / Erasure (Art. 18, VI — LGPD)

You may request the deletion of personal data we hold about you where it is no longer necessary for the original purpose, where you withdraw consent (if consent was the basis), or where we have processed it unlawfully. Please note that certain data must be retained to comply with legal obligations and cannot be deleted on request — we will explain clearly if this applies in your case.

Right to Object to Processing (Art. 18, IX — LGPD)

Where we process your data on the basis of legitimate interests, you have the right to object. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or unless processing is necessary for legal claims.

Right to Data Portability (Art. 18, V — LGPD)

You may request that we transfer your personal data to you or to another provider in a structured, commonly used and machine-readable format, where technically feasible.

Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Right to Lodge a Complaint

If you believe we have violated your rights under the LGPD, you have the right to lodge a complaint with Brazil's national data protection authority: Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.

How to Exercise Your Rights

To exercise any of the above rights, send a written request to contato@coretiexpert.site with the subject line "Privacy Rights Request." Please include sufficient information for us to identify you (such as your full name, company affiliation and the email address used in prior correspondence). We will respond within 15 business days, in line with LGPD requirements. We will not charge a fee for reasonable requests, though we reserve the right to decline or charge a reasonable administrative fee for requests that are manifestly unfounded or excessive.

Children's Privacy

This website is directed exclusively at business professionals and organisations seeking IT services. It is not intended for, nor does it knowingly target, children under the age of 18. We do not knowingly collect personal data from minors.

If you are a parent or guardian and believe that a child under your care has submitted personal information to us without your consent, please contact us at contato@coretiexpert.site and we will take steps to delete the relevant information as promptly as possible. Where the collection of data from a minor is identified, we will treat it as processing requiring specific parental consent in accordance with LGPD Art. 14.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our business practices, the services we offer, applicable law, or regulatory guidance from the ANPD. When we make material changes, we will update the "Last updated" date at the top of this document.

For significant changes that affect your rights or the way we process your data in a meaningful way, we will take additional steps to bring the update to your attention — for example, by placing a prominent notice on our homepage or by direct notification where we hold your contact details and it is appropriate to use them.

We encourage you to review this policy periodically. Your continued engagement with our website or services after a revision has been posted constitutes acknowledgement of the updated terms, to the extent permitted by applicable law. If any change is unacceptable to you, you retain the right to cease using our website and to request deletion of your data as described above.

Contact Us

For any questions, concerns, or rights requests relating to this Privacy Policy or our data processing practices, please contact us using the details below. We aim to acknowledge all privacy-related correspondence within two business days and to resolve enquiries fully within fifteen business days.

When submitting a rights request, please include your full name, the email address associated with any prior communications with us, and a clear description of the right you wish to exercise. This helps us locate your records accurately and respond without unnecessary delay.