Privacy and LGPD

EngageXP LTDA is the controller of personal data processed through this website. This policy covers the pages you visit, contact and newsletter forms, and the measurement and advertising technologies described in the cookie policy.

It does not describe processing carried out under a separate agreement, such as a signed client engagement. Those are governed by their own contract.

Only what a form asks for, plus what the site measures. There are no accounts on this site, and we do not ask for a date of birth, a photograph, a postal address, or payment details.

What you type into a form

• Name, and where the longer form asks separately, first and last name
• Email address
• Company and organisation type
• WhatsApp phone number, optional, on the contact page and in the popup contact forms; the home audience card does not ask for it
• Your message, and any notes you add
• Subject, campaign objective, budget range and intent, where the form offers them

What the site records alongside it

• The language version you used and the page you submitted from
• The version of the notice in force and the moment you recorded your choice
• A one-time key that stops a double submission creating two records
• IP address and email are used to prevent form abuse, independently of your analytics choice. The IP limit counts submissions over a 60-second window; the email limit uses a 10-minute window. These are counting periods, not guaranteed record-deletion deadlines

Website usage measurement

Google Analytics 4 measurement may include pages visited, device and browser information, and interactions with the site. PostHog measurement covers pages visited and the page you came from, each reduced to its site and path; the type of device and the size of the browser window; steps in the contact forms; the cookie choice you record; and which call-to-action button was clicked, named only by the page section and the button, without its text or link address. Before an event leaves your browser, the site removes your browser’s identification string, its language, your time zone, the names and versions of the browser and operating system, the screen size, campaign parameters and advertising click identifiers. The policy adopted by EngageXP states legitimate interest under LGPD Article 7, IX for Google Analytics 4 and PostHog. PostHog may start before a choice. Analytics signals start enabled, and Google Tag Manager loads with the default signals and follows your choice; Google Analytics depends on that loading. The stated basis requires necessity, an assessment of individual rights, and safeguards; publishing it does not establish that those requirements have been met. Refusing analytics disables the category in this site’s controls.

PostHog is set to discard the IP address that reaches it with each event. PostHog is set not to look up a location from that address. This site’s PostHog data is kept in a PostHog project that EngageXP also uses for other properties, and that project copies the events it receives to Google BigQuery once an hour.

Commercial enquiries

Precontractual steps at your request, where you seek to enter into a contract. Use is limited to the commercial subject you provided. On the contact page and in the popup contact form, we ask for your email, first and last name, subject, company, organisation type, campaign objective and budget range, with optional notes; a WhatsApp phone number is optional on both. In the popup, if you decline those questions and choose the call, only your email, first and last name, the subject you chose, and the WhatsApp number if you gave one, are sent from what you filled in.

Job applications

Precontractual steps relating to possible employment, at your request, to assess the application you submitted. An application does not authorize marketing. On the contact page and in the popup contact form, we ask for your email, first and last name, subject and message; a WhatsApp phone number is optional on both. The forms on this site do not accept a CV or attachments.

Support

Performance of a contract, where necessary to fulfil a contract with you. Other requests are handled according to their subject and the applicable legal basis. On the contact page and in the popup contact form, we ask for your email, first and last name, subject and message; a WhatsApp phone number is optional on both.

Press

Responding to the press request. Legitimate interest depends on necessity, your expectations, and safeguards; the contact does not authorize advertising. On the contact page and in the popup contact form, we ask for your email, first and last name, subject and message; a WhatsApp phone number is optional on both.

General enquiries

Responding to the selected subject. Legitimate interest depends on necessity, your expectations, and safeguards; the contact does not authorize advertising. On the contact page and in the popup contact form, we ask for your email, first and last name, subject and message; a WhatsApp phone number is optional on both.

Sending the newsletter

Your specific consent, which you can withdraw.

Google Analytics 4

The policy adopted by EngageXP states legitimate interest under LGPD Article 7, IX for audience measurement on this site. Category signals start enabled, but Google Analytics depends on Google Tag Manager, which loads with the default signals and follows your choice. The Google Analytics property that receives this site’s data also receives data from other websites and is linked to Google Ads, with ad personalization enabled on those links. Google Signals, User-ID and data retention have not been verified and are not described here. Necessity, individual rights, and safeguards require their own assessment; the statement is not legal certification.

PostHog

The policy adopted by EngageXP states legitimate interest under LGPD Article 7, IX for website usage measurement. Under the opt-out model, analytics signals start enabled and measurement may begin before a choice; refusing analytics stops it. PostHog keeps its identifier in the browser tab’s session storage, not in a cookie, so it lasts only as long as that tab’s browsing session. In the PostHog project, session recording, surveys and exception capture are turned off. The site’s PostHog setup turns off heatmaps, page-performance measurement, page-leave and scroll-depth measurement, dead-click and rage-click capture, and feature-flag requests. EngageXP recorded its assessment of necessity, individual rights and safeguards on 13 September 2026; some of the measures it requires are still being put in place, and the statement is not legal certification.

Advertising

Signals for this category start enabled, but advertising tags depend on Google Tag Manager, which loads with the default signals and follows your choice. As reviewed on 2026-10-12, the container loads a Google Ads tag and a Meta pixel, which run only while the advertising signals are enabled; LinkedIn Insight and a TikTok pixel stay paused until one of our campaigns runs on that platform. The Google Ads remarketing audience also needs the personalization signals, and the Meta pixel uses Limited Data Use. Meta's automatic advanced matching is on for this pixel: when you fill in a form on this site, the pixel may take what you type into fields such as your name, email address or phone number, hash it in your browser and send the hash to Meta, which uses it to match the visit to a Meta account. When you send the contact form with the analytics and advertising signals enabled, our server-side tag processing also sends that lead to Meta; that copy carries no name, email address or phone number, hashed or not. Google Ads can also receive data through the Google Analytics links described above. Enabled signals are not consent and do not establish a valid legal basis. Legal validation remains pending; the analytics basis does not automatically extend to advertising.

Personalization

No content-personalization use case is active on this site. This category's signals, ad personalization and personalization storage, start enabled; ad personalization relates to advertising, which that statement does not cover. Technologies delivered by Google Tag Manager depend on the container, which loads with the default signals and follows your choice. The language preference cookie NEXT_LOCALE, listed in the cookie policy, is not governed by this category's preference. Enabled signals are not consent and do not establish a valid legal basis. Legal validation remains pending; the analytics basis does not automatically extend to personalization.

HubSpot tracking

The policy adopted by EngageXP states legitimate interest under LGPD Article 7, IX, and, where the GDPR applies, its Article 6(1)(f), for HubSpot's tracking code: to see which pages bring enquiries. It runs on every visit as part of how this site works and is not turned off by your cookie choices. It records the pages you visit and, as measured on 9 October 2026, each link you click, with its text and address, using HubSpot's own cookies. HubSpot also uses what its tracking code collects here (the IP address, the pages viewed and when, an identifier while a visitor has not identified themselves, and the company's domain once they do) to improve its products and services and to share time-based visit and intent insights with its customers. EngageXP's team uses those insights (HubSpot's buyer intent) to see which companies, identified from the IP address, visit this site. This site does not let HubSpot's ads pixel, chat or collected forms run, and HubSpot shows no cookie banner on it. You can object by writing to the privacy contact in section 11. EngageXP's assessment of necessity, individual rights and safeguards was signed on 2026-10-13, before HubSpot's own uses described above were added, which await its next review; the statement is not legal certification.

Security and abuse prevention

IP address and email limit submission frequency to protect the site and its forms. Legitimate interest requires necessity, proportionality, and safeguards demonstrated for this processing.

Recording choices and requests

Documenting your instructions and meeting applicable legal obligations.

What happens after we reply. What you send through a contact form is used to answer that subject and to carry it forward (scheduling a call, preparing the proposal or audit you asked for, or resolving your request) until the matter is closed or twelve months pass, whichever comes first. It is not added to the newsletter, to a marketing sequence, to an advertising audience or to a talent pool, and sending a form is never treated as consent to any of those. Using it for anything else means asking you first.

You can change tracking preferences in cookie settings. To withdraw newsletter consent or exercise other rights, write to the privacy contact in section 11. Changing cookies does not cancel a newsletter subscription. Refusing optional processing does not prevent access to the pages or submission of an enquiry.

Processing involves the categories of recipients described below. Sharing for advertising must be assessed according to its purpose, settings, and applicable law.

Providers that run the site

• Our hosting provider, which serves every page and runs the form endpoints
• Our database provider, which stores form submissions
• The error-monitoring service, which processes technical information about failures

The system that handles your enquiry

• HubSpot, our customer relationship manager, which receives what you submit through a contact or newsletter form so the team can reply to you and keep track of the request

Submitting a form initiates the handling of your enquiry. Your cookie choices control PostHog, Google Analytics and advertising tags. HubSpot's tracking code is different: it runs on every visit as part of how this site works, records the pages you visit, and is not turned off by your cookie choices.

Measurement and advertising technologies

• Product analytics, to understand how the site is used
• Google, through Tag Manager and Analytics
• Google Ads and Meta, for campaign measurement, and Google Ads also for remarketing; TikTok and LinkedIn, only while one of our campaigns runs there

The cookie policy describes configured technologies and available controls. A domain permitted by the security policy does not, by itself, demonstrate that data was collected.

When the law requires it

We may disclose information where we are legally obliged to, or to establish, exercise or defend a legal claim.

Contact submissions

In our own records, for 12 months from the date you sent the form; after that the submission is deleted. The copy sent to our CRM is kept for up to twelve months after the last contact, and for the period needed to respond and follow up on the subject. Both are subject to legal obligations and the exercise of legal rights.

Newsletter

While the subscription is active. Unsubscribing ends the sending purpose; we keep a limited record of the refusal, to prevent further messages and document your instruction, until you ask us to delete it.

Choice records

According to the record’s purpose and applicable obligations. The cookie policy explains how long the browser record lasts.

Technical and security logs

According to the security purpose, service configuration, and applicable legal obligations.

Analytics data

Duration depends on each service’s configuration. For PostHog, the project that receives this site’s data reported an event retention period of 84 months when read on 13 September 2026, and that period was not being enforced, so PostHog was not deleting events by age. You can request information from the privacy contact.

You can request deletion, anonymisation, or blocking in the circumstances provided by the LGPD. Retention must have a valid purpose and legal basis. Cancelling a subscription does not automatically delete every record, including evidence of requests and records needed to prevent further messages.

• Everything travels over an encrypted connection
• Access to submissions is limited to people who need it to reply to you
• Data protection measures also apply to technical error logs
• A strict content security policy limits what the site is allowed to load

When a security incident may cause relevant risk or damage to data subjects, we will notify the ANPD and affected people under Brazilian regulations. The ordinary deadline is three business days from learning that the incident affected personal data, subject to any deadline established by specific legislation.

In Brazil, you can exercise the rights provided by the LGPD, subject to the requirements of each right. Other laws may provide additional rights where they apply to the processing.

• Confirmation that we hold your data, and a copy of it
• Correction of anything inaccurate or incomplete
• Deletion, where we have no overriding reason to keep it
• Withdrawal of consent, without affecting what was lawful before
• Objection to processing carried out without consent where it fails to comply with the LGPD
• Portability under the applicable regulations, subject to commercial and industrial secrecy

In Brazil, under the LGPD

• Anonymisation or blocking of data processed beyond what is necessary
• Information about the public and private bodies we have shared data with
• Review of decisions taken solely by automated processing
• The right to petition the ANPD directly

Where the GDPR or UK legislation applies

• Restriction of processing while a dispute is resolved
• The right to lodge a complaint with your supervisory authority

Where the CCPA applies

• The right to know what is collected, from where, and why
• The right to opt out of sale or sharing, under the definitions and requirements of that legislation
• The right not to be treated differently for exercising a right

Confirmation of processing or access to data will be provided immediately in simplified form or in a clear, complete declaration within 15 days of the request. Other requests follow the applicable deadlines and requirements. If we cannot take the requested action immediately, we will explain why. Exercising these rights is free of charge.

Some of this site's providers process data outside Brazil. The list below records where each one runs, as verified read-only on 2026-09-12. It does not establish which transfer mechanism applies to each: using a foreign provider does not by itself show that a specific safeguard has been adopted. You can request information about recipients, destinations, and transfer conditions from the privacy contact.

• Form submissions: stored in Brazil, in a Supabase database in the São Paulo region (sa-east-1).
• Website hosting, form processing and page-performance measurement: Vercel, in the United States (Washington, D.C. region, iad1). A submitted form passes through it before it is stored. Performance measurement reports page-loading timings for this site and stores no cookie and no identifier in your browser.
• Server-side tag processing: Stape, in Brazil (SA East), at events.engagexp.gg. It forwards Google Analytics hits to Google and, when you send the contact form with the analytics and advertising signals enabled, that lead to Meta.
• Product analytics: PostHog, in the United States, in a project EngageXP also uses for other properties. That project copies the events it receives to Google BigQuery once an hour; where that BigQuery dataset runs has not been verified.
• Error monitoring: Sentry, in the United States.
• Customer relationship management: HubSpot, in its North America data centre (na1).
• Google (Tag Manager, Analytics, and Ads), Meta, LinkedIn, and TikTok: outside Brazil; where each processes this site's data has not been verified.

International transfers must rely on a valid mechanism under the LGPD, such as an applicable adequacy decision or contractual safeguards accepted by the ANPD. The existence of a foreign provider or a privacy policy does not, by itself, demonstrate that those safeguards have been adopted.

The cookie policy describes configured technologies, their purposes, preference controls, and browser storage duration. Your cookie choices control PostHog, Google Analytics and advertising tags. HubSpot's tracking code is different: it runs on every visit as part of how this site works, records the pages you visit, and is not turned off by your cookie choices. Requests about forms and newsletters should go to the privacy contact.

On visits from the EU 27, Iceland, Liechtenstein, Norway, the UK, Switzerland and the EU territories with their own country codes, every optional category stays off until you choose: Google Tag Manager does not load and PostHog does not start before a choice. The site learns the country from its hosting provider's reading of your connection and keeps only the result, in the essential cookie engage_consent_region that the cookie policy lists.

This is a business website and is not directed at children or adolescents. There is no account or profile to create. If you believe a child or adolescent submitted data through a form, write to the privacy contact so the situation can be assessed and appropriate action taken, considering the person’s best interests.

A new purpose requires approval by Thiago Bueno (Kaiser), following legal validation of the purpose, legal basis, and safeguards. Before the new processing begins, the material change must be highlighted on this page and in notices at affected collection points, with the update date. Continuing to browse does not constitute consent to a new purpose. Where consent is required, the corresponding information and choice must precede processing.

Controller

EngageXP LTDA

Privacy contact

privacy@engagexp.gg

Data protection officer (encarregado)

Thiago Bueno, privacy@engagexp.gg

Address

Av. das Nações Unidas 12495, São Paulo, SP 04578-000, Brazil

CNPJ

21.395.994/0001-62