Privacy and Data Protection Policy

This Policy describes the privacy practices for struckel.com.br and the electronic forms maintained by Struckel Consulting, Brazilian registration CNPJ 54.252.977/0001-25. It applies when a person visits the website, requests contact, asks for information or shows interest in consulting, training, projects or other Struckel solutions.

Specific proposals, contracts and projects may contain additional confidentiality and data protection provisions. Those provisions complement this Policy when applicable.

For the processing described here, Struckel Consulting acts as controller when it determines the essential purposes and means of processing.

• Identification: Struckel Consulting — CNPJ 54.252.977/0001-25.
• Institutional and documentation contact: contato@struckel.com.br.
• Privacy and data-subject requests: dpo@struckel.com.br.
• Security and incident reports: noc@struckel.com.br.

Information you provide

• Name, business e-mail, phone or WhatsApp, company, role and location.
• Company registration or tax ID when provided to facilitate preparation of a proposal.
• Industry, area of interest, desired timing, business context, challenge and other information voluntarily submitted in forms.
• Messages and subsequent communications through corporate channels.

Technical and security information

• IP address, request date/time, basic browser/device information and technical logs needed for operation and security.
• Session identifiers and CSRF protection tokens used to secure forms.
• Campaign/origin parameters (UTM) when they are present in the URL.
• Anti-abuse verification signals when Cloudflare Turnstile is enabled.

Public forms do not request passwords, banking credentials, card data or complete personal documents. Please do not submit sensitive personal data or confidential information that is not necessary for an initial enquiry.

• Respond to enquiries and understand the stated need.
• Prepare initial assessment, lead qualification, proposal, quotation or routing to the appropriate team.
• Take steps requested before a potential contract and continue commercial discussions.
• Manage commercial or contractual relationships when applicable.
• Protect the website and prevent abuse, fraud, spam and security incidents.
• Maintain records needed for governance, audit, legal compliance and the establishment, exercise or defence of rights.
• Improve website experience, content and performance using strictly necessary or properly authorised technical information.

Depending on the context, processing may rely on steps requested before entering into a contract, performance of a contract, legitimate interests, compliance with legal obligations, exercise of legal rights and consent when consent is the appropriate basis.

Where consent is used, it may be withdrawn subject to applicable law without affecting previous lawful processing or retention supported by another lawful basis.

Struckel limits sharing to what is needed to operate the website, communicate with interested parties, secure the infrastructure and deliver requested services. Providers may act as processors or independent controllers depending on the activity.

• Hosting, infrastructure, security, DNS and anti-abuse providers.
• Google Workspace, used for Struckel corporate e-mail infrastructure.
• Cloudflare when security or Turnstile features are enabled.
• Technical providers required to deliver libraries, fonts or website components.
• Professional advisers, partners or suppliers involved in a proposal or project when necessary and compatible with the stated purpose.
• Public authorities or third parties when required by law, valid order or the exercise of legal rights.

Struckel does not sell personal data to advertisers.

Some technology and communication providers may process data in infrastructure located outside Brazil. Where international transfers occur, Struckel seeks to use providers and safeguards compatible with applicable data protection rules.

Data is kept for as long as needed for the purpose for which it was collected, ongoing negotiations or contracts, legal and regulatory duties, security, fraud prevention and the exercise of legal rights. When no longer required, information may be deleted, anonymised or retained where the law permits or requires.

Struckel applies technical and administrative measures appropriate to the website context, including HTTPS when correctly deployed, server-side validation, CSRF protection, honeypot, rate limiting, server-side e-mail credentials and optional Cloudflare Turnstile anti-abuse verification.

No environment is completely risk-free. Suspected vulnerabilities, exposure or incidents involving personal data may be reported to noc@struckel.com.br.

Individuals may exercise rights available under applicable data protection law, including confirmation of processing, access, correction, information on sharing, deletion or restriction where appropriate, portability subject to regulation, objection, review of automated decisions when applicable and other statutory rights.

Requests may be sent to dpo@struckel.com.br. To protect the requester, Struckel may reasonably verify identity and authority before fulfilling a request.

The institutional website and commercial forms are not specifically directed to children. If processing involving children or teenagers is identified in a context requiring special protection, applicable legal safeguards will be observed.

This Policy may be updated when the website, services, providers, data flows or applicable rules change. The current version is identified by the update date shown on this page.