Privacy policy

1. Who controls the data

Heuristik, a digital product consultancy based in Fortaleza, Ceará, Brazil, is the controller of the personal data processed on this website, under Article 5, item VI, of Law No. 13,709/2018 (LGPD).

For any matter concerning personal data, the dedicated channel is privacidade@heuristik.com.br.

2. What data is collected

This website only collects the data you voluntarily provide in the contact form:

• Name
• Email address
• Company name, if provided (optional field)
• Selected subject
• Content of the message sent

We do not collect sensitive data, we do not request identification documents and we do not create user accounts. There is no logged-in area on this website.

3. How the data is used

The data provided in the form is used solely to reply to your message and, if there is mutual interest, to carry on the resulting business conversation.

We do not use the data to send unsolicited marketing communications, we do not enrich it with third-party databases and we do not use it to build behavioral profiles.

4. Legal basis for processing

Processing relies on two legal bases set out in Article 7 of the LGPD: the data subject's consent, given when the form is submitted (item I), and preliminary procedures related to a contract to which the data subject is a party, carried out at their request (item V).

5. Who the data is shared with

Form data is transmitted through a transactional email service, which acts as a processor and handles the data only to deliver the message to Heuristik's mailbox.

We do not sell, rent or transfer personal data to third parties for any commercial purpose.

6. Cookies and measurement technologies

This website uses Google Tag Manager, a tag manager provided by Google, to organize the audience measurement tools used on the page. When the tag manager loads, your browser connects to Google servers, which receive your IP address and technical data about the request, such as your browser and operating system.

The tag manager itself does not set profiling cookies. Those are set by the tools it triggers, currently two:

• Google Analytics 4, provided by Google, which measures in aggregate how pages are found and navigated, which content gets the most attention and how many people reach the contact form
• Microsoft Clarity, provided by Microsoft, which records interface usage metrics, such as scrolling and clicks, to identify friction points in navigation

Neither tool is used for targeted advertising, and we do not cross-reference this data with what you write in the contact form. The content of the form fields is not sent to these tools.

The applicable legal basis is legitimate interest in improving the website, under Article 7, item IX, of the LGPD. You can refuse measurement by blocking third-party cookies in your browser settings, using private browsing mode or installing a blocking extension. No feature of the website depends on these tools.

Fonts are still served by the application itself, with no requests to third-party servers. If other tools are adopted, this policy will be updated before they are activated, identifying the tool, its purpose and how to opt out.

7. How long the data is kept

Messages received are kept for as long as necessary to handle the contact and any resulting business relationship. Once that purpose has been fulfilled, the data is deleted, except where retention is required by a legal or regulatory obligation, or for the regular exercise of rights.

8. Your rights as a data subject

Article 18 of the LGPD grants you the following rights, at any time and upon request:

• Confirmation that your data is being processed
• Access to the data we hold about you
• Correction of incomplete, inaccurate or outdated data
• Anonymization, blocking or deletion of unnecessary or excessive data
• Portability of the data to another service provider
• Deletion of data processed on the basis of your consent
• Information about who the data has been shared with
• Withdrawal of consent at any time

To exercise any of these rights, write to privacidade@heuristik.com.br. We reply within 15 days, in line with the deadline set by law.

9. Information security

All traffic on this website is served exclusively over an encrypted connection (HTTPS). We adopt technical and administrative measures to protect data against unauthorized access, accidental loss and destruction, including restricted access to the mailboxes that receive messages.

No system is completely immune to breaches. In the event of a security incident that may pose a relevant risk to data subjects, notice will be given as provided in Article 48 of the LGPD.

10. Changes to this policy

This policy may be updated to reflect changes to the website, the services or applicable law. Relevant changes will be flagged on this page, along with the date of the update.