Privacy Policy
Last updated: October 21, 2026
1. Introduction and scope
This Privacy Policy (“Policy”) describes how personal data is collected, used, shared, stored and protected in connection with the website branchier.com and its pages (the “Website”), in accordance with Brazilian Law No. 13,709/2018 (the General Data Protection Law, “LGPD”), Law No. 12,965/2014 (the Brazilian Internet Civil Framework) and the regulations issued by the Brazilian National Data Protection Authority (“ANPD”).
This Policy applies to everyone who accesses or interacts with the Website, including through the contact form and the email address published on it.
2. Definitions
For the purposes of this Policy, the terms below have the meaning given to them in Article 5 of the LGPD:
- Personal data
- information relating to an identified or identifiable natural person.
- Data subject
- the natural person to whom the personal data being processed refers.
- Processing
- any operation performed on personal data, such as collection, receipt, access, transmission, storage, erasure and sharing.
- Controller
- the person responsible for decisions regarding the processing of personal data.
- Processor
- the natural or legal person that processes personal data on behalf of the Controller.
- International transfer
- a transfer of personal data to a foreign country or international organization.
3. Controller and data subject contact channel
The Controller of the personal data processed through the Website is João Victor Branchier da Silveira, the natural person responsible for the Branchier brand and the branchier.com domain.
As a small-scale processing agent, the Controller is not required to appoint a data protection officer under Article 11 of ANPD Resolution No. 2/2022, and provides the following contact channel for data subjects: contato@branchier.com, with the subject line “Privacy”.
4. Categories of personal data processed
The Controller processes only the personal data strictly necessary for the purposes described in this Policy, in line with the principles of purpose limitation, adequacy and necessity (Article 6, I to III, of the LGPD).
- Browsing data and technical logs: IP address, date and time of access, requested URL, HTTP headers, browser identification (user agent) and connection metadata, automatically generated with every request to the Website.
- Data provided by the data subject: name, email address, telephone or WhatsApp number with the corresponding country code, and the content of the message, voluntarily provided through the contact form or in an email sent to the Website’s address.
- Security verification data: technical signals from the browser and device, assessed by the Cloudflare Turnstile service when the form is submitted, and the IP address, used to limit the number of submissions per period (rate limiting).
- Audience measurement data: aggregated visit metrics, such as pages viewed, country of origin, device type, browser and referring page, collected by Cloudflare Web Analytics without cookies and without individually identifying the visitor.
The Website does not request or intentionally process sensitive personal data, as defined in Article 5, II, of the LGPD. Data subjects are advised not to include such data in their messages.
5. Purposes and legal bases
Each processing operation is tied to a legitimate, specific and explicit purpose and is based on one of the legal grounds set out in Article 7 of the LGPD:
| Purpose | Data involved | Legal basis |
|---|---|---|
| Making the Website’s pages available and ensuring their operation | Browsing data and technical logs | Legitimate interest (Art. 7, IX) |
| Preventing fraud, abuse and automated access, and protecting the Website’s infrastructure | Browsing data and security verification data | Legitimate interest (Art. 7, IX) |
| Measuring the Website’s audience in aggregate, for statistical and improvement purposes | Audience measurement data | Legitimate interest (Art. 7, IX) |
| Receiving, reviewing and answering messages sent by the data subject | Data provided by the data subject | Pre-contractual steps taken at the data subject’s request (Art. 7, V) and legitimate interest (Art. 7, IX) |
| Complying with legal and regulatory obligations and exercising rights in judicial, administrative or arbitration proceedings | Data provided by the data subject and technical logs, where necessary | Compliance with a legal or regulatory obligation (Art. 7, II) and regular exercise of rights (Art. 7, VI) |
Processing based on legitimate interest is limited to the data strictly necessary and respects the rights and legitimate expectations of the data subject (Article 10 of the LGPD). Personal data is not used for advertising, behavioral profiling or decisions based solely on automated processing that affect the data subject’s interests, except for the automated security verification described in Section 4.
8. International data transfers
Because of where the infrastructure of the processors listed in Section 7 is located, personal data may be transferred to and stored outside Brazil, particularly in the United States.
These transfers are carried out to perform the contracted services and comply with Article 33 of the LGPD and the International Data Transfer Regulation approved by ANPD Resolution No. 19/2024, including through the contractual safeguards offered by the processors, which ensure a level of protection consistent with Brazilian law.
9. Storage and retention
The Website does not keep its own database of the messages it receives. Content submitted through the contact form is transmitted in encrypted form and delivered directly to the contato@branchier.com mailbox, with no intermediate storage by the Controller.
Messages are kept for as long as needed to handle the request and, afterwards, for the period required to comply with legal and regulatory obligations or to exercise rights, and are erased at the end of processing, under Articles 15 and 16 of the LGPD. Technical logs are kept by the processors for the periods defined in their own policies.
10. Information security
The Controller adopts technical and administrative measures designed to protect personal data against unauthorized access and against accidental or unlawful destruction, loss, alteration, disclosure or dissemination (Article 46 of the LGPD), including:
- encryption in transit using the TLS protocol (HTTPS) on every page of the Website and when messages are transmitted to the email server;
- HTTP security headers, including HTTP Strict Transport Security (HSTS) and a Content Security Policy (CSP), which enforce encrypted connections and restrict script execution to authorized origins;
- storage of service access credentials in an encrypted secrets vault, separate from the source code;
- strong authentication for administrative accounts and application-specific passwords;
- submission rate limiting, automation-detection fields and Cloudflare Turnstile security verification on the contact form;
- access to personal data restricted to what is strictly necessary, under the principle of least privilege.
No system is entirely free of risk. In the event of a security incident that may result in relevant risk or harm to data subjects, the Controller will notify the ANPD and the affected data subjects, as required by Article 48 of the LGPD and applicable regulations.
11. Data subject rights
Under Article 18 of the LGPD, data subjects may request from the Controller, at any time:
- confirmation that processing takes place;
- access to their data;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or erasure of unnecessary or excessive data, or data processed in breach of the LGPD;
- portability of their data to another service provider, subject to commercial and industrial secrets;
- erasure of data processed with their consent, except in the cases provided for in Article 16 of the LGPD;
- information about the public and private entities with which the Controller has shared data;
- information about the possibility of withholding consent and the consequences of doing so;
- withdrawal of consent, where applicable.
Data subjects may also object to processing carried out on a legal basis other than consent in the event of non-compliance with the LGPD (Article 18, § 2).
Requests should be sent to contato@branchier.com. For the data subject’s own protection, information confirming their identity may be requested. Access requests will be answered within 15 (fifteen) days of the request, under Article 19, II, of the LGPD. Data subjects also have the right to file a petition with the ANPD (Article 18, § 1). Where other data protection laws apply to a data subject, the Controller will honor the rights they grant.
12. Children and adolescents
The Website is not directed at children or adolescents, and the Controller does not intentionally process their personal data. If data of individuals under 18 is found to have been processed inadvertently without the safeguards of Article 14 of the LGPD, it will be erased.
13. Links to third-party websites
The Website may contain links to third-party websites and platforms, such as LinkedIn. When accessing them, data subjects become subject to the privacy policies and terms of use of those third parties, for which the Controller is not responsible.
14. Updates to this Policy
This Policy may be reviewed periodically to reflect changes in data processing activities, applicable law or ANPD guidance. Material changes will be announced through a prominent notice on the Website. The version in force is the one published on this page, identified by the date of its latest update.
15. Governing law
This Policy is governed by the laws of the Federative Republic of Brazil, in particular the LGPD and the Brazilian Internet Civil Framework. In the event of any discrepancy in interpretation, the Portuguese version prevails over translations.