Privacy Policy

1. Who is responsible

The controller of the personal data collected through aprwebs.com is Alejandro de Jesus Molina Suarez, trading as AprWebs, a sole practitioner registered under CPF 802.284.579-55, with address at Rua Santa Catarina, 2348, Floresta, Joinville — Santa Catarina, CEP 89212-212, Brasil. Contact for any matter relating to this policy: [email protected].

2. Scope

This policy covers aprwebs.com and the messages sent through the contact form on this site. It does not cover the data that clients process inside their own projects: in those cases the client is the controller and AprWebs acts only as an operator, under the specific contract that governs the service.

3. What data we process

• Contact form: name, email address, optional phone or WhatsApp number, area of interest, subject and the message you write.
• Verification code: to confirm the message comes from a real person, we send a six-digit code to the address you give us. The code expires after 10 minutes and the pending record is discarded.
• IP address: recorded with date and time to prevent abuse of the form, which is limited to a maximum of 3 verified submissions per IP address per day. Records older than 24 hours are no longer used for this control.
• Server logs: the web server keeps standard access and error records, including IP address, date, time, requested file and user agent, for security and fault diagnosis. They are rotated weekly and kept for around five weeks.
• Technical log of the form: failures and successful deliveries of notification emails are logged, so that no message is lost silently.

4. What we do not do

• We use no analytics or advertising cookies, and the site does not load Google Analytics, Meta Pixel or similar tools.
• We do not build commercial profiles and we do not use your data to show you advertising.
• We do not sell, rent or hand over personal data to third parties for commercial purposes.
• We do not request or process sensitive data, and the site is not directed at children or adolescents.

5. What we use the data for

• Replying to your enquiry and answering questions about our services.
• Preparing proposals and technical or commercial documentation.
• Delivering the services you contract and communicating about the progress of the project.
• Complying with legal, tax, accounting and consumer-protection obligations.
• Protecting the site against spam, abuse and unauthorised access.
• Sending commercial communications, only if you expressly consent, and always with a way to opt out.

6. Legal basis

Processing relies on the following grounds of article 7 of the LGPD: your consent, given when you submit the form, and which can be withdrawn at any time (items I and IX); the performance of a contract or of preliminary procedures, when you request a proposal or contract a service (item V); compliance with a legal or regulatory obligation, in particular tax and accounting duties (item II); and our legitimate interest in protecting the site and in answering business enquiries (item IX).

7. How long we keep it

• Verification code: 10 minutes, or until it is used.
• Message submitted through the form: for as long as needed to answer it and, if it turns into a contract, for the legal periods applicable to commercial and tax records.
• IP address used to limit submissions: 24 hours for the purpose of the limit.
• Server logs: around five weeks, on weekly rotation.
• Technical log of the form: kept for diagnosing delivery failures.
• Data processed with your consent for marketing: until you withdraw it.

8. Who it is shared with

Data is not sold or given to third parties. To operate the site it is processed by service providers that act on our instructions and only for the purposes described above: the hosting infrastructure where the site runs; Cloudflare, for content delivery and protection against attacks; the transactional email provider (SendPulse), used to send the reply and the verification code; and Google (Gmail), because a copy of every message sent through the form is delivered to a Gmail mailbox in addition to the ${OWNER.formInbox} mailbox of this domain.

9. International transfer

Processing may involve providers located outside Brazil, which means an international data transfer under articles 33 to 36 of the LGPD. The recipients are Cloudflare (content delivery and protection), SendPulse (sending of the verification code) and Google LLC, which stores the copy of the notification in a Gmail mailbox. All of them are providers with contractual and technical protection guarantees, and the transfer is limited to what is necessary for the purposes described. The site typography is served from our own server: opening a page sends no data to Google.

10. Your rights

Under article 18 of the LGPD you can, at any time and at no cost, ask us to:

• confirm that we process your data and obtain access to it;
• correct incomplete, inaccurate or out-of-date data;
• anonymise, block or delete unnecessary or excessive data, or data processed unlawfully;
• transfer your data to another provider, under the applicable rules;
• delete data processed with your consent;
• tell you which entities we have shared your data with;
• tell you about the possibility of not giving consent, and about the consequences of refusing;
• withdraw your consent, at any time.

To exercise any of these rights, write to [email protected] stating what you need. We answer requests for confirmation and access within the period set by the LGPD.

11. Data protection contact

The communication channel for data protection matters, including requests from data subjects and communications from the Brazilian Data Protection Authority (ANPD), is [email protected]. You may also write to [email protected], which is the mailbox that receives the messages sent through the contact form.

12. Complaints

If you consider that your request was not handled properly, you may file a complaint with the ANPD, the Brazilian data protection authority, through its official channels at www.gov.br/anpd.

13. Security

We adopt technical and administrative measures to protect personal data: encrypted connections throughout the site (HTTPS with HSTS), a hardened server with access control, security headers in every response, single-use verification codes with a 10-minute expiry, limits on submissions per IP address, and periodic backups of the site.

14. Security incidents

If a security incident occurs that may create relevant risk or harm to data subjects, we will notify the ANPD and the affected data subjects, describing what happened, the data involved, the technical and security measures applied and the risks involved, as required by article 48 of the LGPD.

15. Automated decisions

The form applies automatic anti-spam filters that silently discard submissions that look like bots. These filters produce no legal effect on you and there is no automated decision-making or commercial profiling of your personal data.

16. Changes to this policy

This policy may be updated to reflect changes in the site, in the services offered or in the law. The version in force is always the one published on this page, with the date of the last update shown at the top.