Privacy Policy

1. Data controller

FF Tech Consulting LTDA, registered with the Brazilian corporate taxpayer registry (CNPJ) under no. 58.000.008/0001-38, headquartered in Maringá (PR), is the controller of the personal data processed on this website, under the terms of Brazil's General Data Protection Law (LGPD, Law No. 13.709/2018). The channel for privacy matters and for the exercise of your rights is the email privacidade@fftech.com.br.

2. Data collected and purpose

• Contact form: name, email, company, message and, when you arrive from the maturity assessment, the origin of the contact. They are used to respond to your request.
• Maturity assessment: during the questionnaire, your answers and the company context (industry, size and stage) remain in your browser until you request the report; at that point the answers go to our server only to recalculate the result and are not stored. If you request the full report, we send the FFTech team the result and the data you provide: name, business email, company, job title, phone (optional) and when it makes sense to talk. We also send the origin of the visit (UTM parameters, referring site and landing page). We use this data to generate the report, send you a confirmation email with the summary and contact you about the result. The sales team also receives an internal lead classification (fit based on the size and industry provided, interest based on timeframe, and suggested service area), used only to prioritize contact. To prevent repeated submissions, we keep for 24 hours a hash code (SHA-256) of your email, without the address itself. We do not ask for credentials, IP addresses, system names, logs or documents.
• Audience measurement (Google Analytics 4): we use Google Analytics 4 with Google's Consent Mode. Before your choice in the banner, the Google tag loads in restricted mode: we do not store analytics cookies and ad storage is disabled, but Google receives basic visit signals (page visited, date and time, browser type and IP address) for aggregate measurement. If you accept, analytics cookies are used (pages visited, time on page and traffic source), along with the assessment usage events (the step you are on, duration and score range, never the answers). Before acceptance, these events are not sent. If you decline, the tag remains in restricted mode and no analytics cookie is stored.
• Access data: IP address and browser information, collected automatically for site security, request rate limiting and abuse prevention.

3. Legal basis (LGPD)

The processing of personal data is based on the following legal bases provided for in Brazil's General Data Protection Law (Law No. 13.709/2018):

• Consent (Art. 7, I): for analytics cookies and identifiers, chosen in the cookie banner, and for sending the assessment report and the subsequent contact about the result, authorized in the form. You may withdraw your consent at any time.
• Legitimate interest (Art. 7, IX): to respond to contact requests, to measure audience in aggregate form in restricted mode (without cookies, before your choice in the banner) and to ensure site security and abuse prevention.

4. Data sharing

We do not sell or rent your personal data. To operate the site and the assessment, we rely on service providers that process data on our behalf and under contract: Cloudflare (hosting, network and storage of the shareable report), Resend (email delivery) and Google (Google Analytics 4). These providers may operate with infrastructure outside Brazil; when there is an international data transfer, it complies with Art. 33 of the LGPD. The shareable report link contains a random code and does not expose your contact details.

5. Data retention

Data from the contact form and from the maturity assessment report (name, email, company and job title) is retained only for the duration of the cycle of responding to the request. The copy of the result, without contact data, available at the report link, is deleted after 180 days. Answers stored in the browser remain only there, until you clear the site data. Analytics data is retained according to the Google Analytics retention policy (maximum 14 months).

6. Data subject rights

Under the LGPD, you have the right to:

• Confirm the existence of processing and access your personal data
• Correct incomplete, inaccurate or outdated data
• Request anonymization, blocking or deletion of unnecessary data or data processed with consent
• Request data portability
• Obtain information about the parties with whom we share your data
• Withdraw consent at any time
• Petition the Brazilian National Data Protection Authority (ANPD)

To exercise your rights, send an email to privacidade@fftech.com.br. We will respond within 15 business days.

7. Security

We implement technical and organizational measures to protect your data, including encryption in transit (HTTPS/TLS), access controls, server-side data validation, request rate limiting, security headers and a content security policy (CSP). No method of transmission or storage is completely secure: in the event of an incident involving relevant risk, we will notify data subjects and the ANPD, in accordance with the LGPD.

8. Changes to this policy

We may update this policy. The date of the last update is at the end of this page and, in the event of relevant changes, the cookie banner will ask for your choice again.