Version: July 2026
The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions is:
Itaberaba Contabilidade e Gestao Ltda
Josue Ribeiro, 124, Andar 2 Sala 2
Centro — Itaberaba/BA
CEP: 46880-000
Brazil
CNPJ: 49.755.699/0001-99
Manager: Mauricio Nunes Brandao
Email: [email protected]
Appointing a data protection officer is not required under Article 37 of the GDPR, as our activities do not fall under any of the cases that require one. For any questions regarding data protection, you may write to the email address given above at any time.
When you visit our website, the browser used on your device automatically sends the following information to our website's server, where it is temporarily stored in log files:
This data is processed for the following purposes: ensuring a smooth connection, ensuring convenient use of the website, evaluating system security and stability, and for other administrative purposes.
Legal basis: Article 6(1)(f) GDPR (legitimate interest). Our legitimate interest arises from the purposes of collection set out above, in particular the security and stability of our website.
Storage period: Data is deleted as soon as it is no longer needed for the purpose for which it was collected. For data collected to provide the website, this is the case when the respective session ends. Server log files are automatically deleted after 7 days at the latest.
When you send us an inquiry via the contact form, the information you enter, including your contact details, is stored in order to process your inquiry and answer any follow-up questions. The following data is collected:
We do not share this data without your consent.
Legal basis: Article 6(1)(b) GDPR (pre-contractual measures taken at the request of the data subject). If your inquiry is not related to the conclusion of a contract, the legal basis is Article 6(1)(f) GDPR (legitimate interest in effectively handling inquiries sent to us).
Storage period: Data entered in the contact form is retained until you ask us to delete it, withdraw your consent, or the purpose of storage no longer applies. Mandatory legal provisions — in particular statutory retention periods — remain unaffected.
Our website uses only technically necessary cookies. These are small text files that your browser automatically creates and that are stored on your device when you visit our website.
Strictly necessary cookies are exempt from consent under Article 82 of the French Data Protection Act (loi Informatique et Libertés), as they are essential for the website to function. These cookies cannot be disabled.
We do not place any tracking, audience measurement or advertising cookies without your prior, explicit consent. Where applicable, this consent is obtained via our cookie consent banner.
Legal basis for strictly necessary cookies: Article 82 of the French Data Protection Act (loi Informatique et Libertés), in conjunction with Article 6(1)(f) GDPR.
Legal basis for optional cookies: Article 6(1)(a) GDPR (consent).
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google”).
Purpose: We use Google Ads conversion tracking to measure the effectiveness of our advertising campaigns. When you click on an ad served by Google, a conversion tracking cookie is stored on your device. These cookies expire after 30 days and are not used to identify you personally.
If you visit certain pages of our website while the cookie has not yet expired, Google and we can recognize that you clicked on the ad and were redirected to that page. Each Google Ads customer receives a different cookie. The information obtained through conversion cookies is used to compile conversion statistics for Ads customers who have opted in to this tracking.
Legal basis: Article 6(1)(a) GDPR (consent). The conversion tracking cookie is only placed if you have given your consent via our cookie banner. You may withdraw this consent at any time with effect for the future.
Transfer of data to third countries: Google may transfer the collected data to the United States. This transfer is based on the EU–U.S. Data Privacy Framework. You can find more information in Google's privacy policy: https://policies.google.com/privacy.
If a payment obligation arises from the conclusion of the contract, we use an external payment provider. Your payment data (e.g. credit card number, bank details) is transmitted directly to this provider and processed by them.
At no time do we store complete bank or card data on our servers. The payment provider only sends us a confirmation of whether the payment succeeded or failed and, where applicable, a transaction ID for reconciliation.
Legal basis: Article 6(1)(b) GDPR (performance of a contract). Processing payment data is necessary for the performance of the contract concluded between you and us.
Since our company is headquartered in Brazil, personal data is transferred to a third country. Brazil is a third country outside the European Union. The transfer of personal data to Brazil is based on Article 49(1)(a) GDPR (explicit consent) or Article 49(1)(b) GDPR (performance of a contract). Brazil has its own data protection legislation, the Lei Geral de Proteção de Dados (LGPD).
Safeguards: When personal data is transferred to recipients in third countries not covered by an adequacy decision, we use appropriate measures to ensure that the rights of data subjects remain duly protected. To this end, we conclude European Union standard contractual clauses in accordance with Article 46(2)(c) GDPR.
In exceptional cases, the transfer may be based on your explicit consent under Article 49(1)(a) GDPR. In this case, you will be informed of any possible risks before the transfer.
You have the following rights vis-à-vis the controller regarding your personal data:
To exercise your rights, please write to us at the following address: [email protected]. We will process your request without undue delay and within one month at the latest.
Without prejudice to any other administrative or judicial remedy, you have the right under Article 77 GDPR to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes the GDPR.
You may exercise this right with the supervisory authority of the Member State of your habitual residence, your place of work or the place of the alleged infringement. In France, the competent authority is the CNIL: https://www.cnil.fr.
We reserve the right to adapt this Privacy Policy to reflect legal developments or changes to the service or to data processing. However, this applies only to statements regarding data processing. Where consent is required or where parts of the Privacy Policy govern the contractual relationship with users, changes will only be made with the users’ consent.
The current version can always be viewed on this page. We encourage you to review the content of our Privacy Policy regularly.
Version: July 2026