Privacy Policy

1.Data Controller

Party Responsible for Processing

• LoPrestiSec acts as the Controller of the personal data collected through this website, under Law No. 13.709/2018 (LGPD, Lei Geral de Proteção de Dados, Brazil's data protection law).
• Personal data is processed in a transparent and lawful manner, appropriate to the purposes described in this policy.
• For questions about privacy or to exercise the rights provided for under the LGPD, please contact us at [email protected].

2.Information We Collect

Information You Provide Voluntarily

• Name and contact information.
• Corporate email and phone/WhatsApp number.
• Company name.
• Information submitted through contact forms.
• In the Web Pentest form: the application's website, company size and the environment to be assessed.
• The content of messages sent to us for commercial or technical review.

Information Collected Automatically

• Technical access records (such as IP address, date and time, requested page and browser), generated by the hosting servers and by Cloudflare when serving each request.
• While it is active, Cloudflare Web Analytics records aggregated visit and performance metrics, without setting cookies and separately from Google Analytics.
• Only if you accept analytics cookies: browsing data collected by Google Analytics, such as pages visited, interactions, browser and device type and approximate location.

3.Legal Basis for Processing

Legal Bases We Rely On

• Performance of a contract or preliminary procedures related to the provision of services.
• The data subject's consent, where required.
• Compliance with legal and regulatory obligations.
• Legitimate interest in improving our services and the security of the site.
• The regular exercise of rights in judicial, administrative or arbitration proceedings.

4.How We Use the Information

Purposes of Processing

• Responding to contact requests and commercial proposals.
• Delivering offensive security and consulting services.
• Issuing technical reports and project-related communications.
• Improving the website's features, performance and security.
• Complying with legal, tax and regulatory obligations.

5.Sharing of Information

Limited Sharing

• LoPrestiSec does not sell personal data.
• Data may be shared only with service providers that are essential to the operation of the site and the services.
• Sharing may also occur to comply with a legal obligation or an order from a competent authority.
• Providers currently used: HostGator (website hosting); Cloudflare (DNS, content delivery, protection against automated traffic and, while active, Cloudflare Web Analytics); Formspree (receiving the messages and proposal requests sent through the forms, which are forwarded by email to LoPrestiSec); Titan (the email service where LoPrestiSec receives those messages and emails sent to [email protected]); and Google (Google Analytics, only with your consent).
• The website offers links to start a conversation on WhatsApp. The website sends no data to WhatsApp; if you choose to talk there, the conversation takes place in WhatsApp itself, under that service's terms.

6.International Data Transfers

Third-Party Services

• Some of the services we use may involve international transfers of data.
• Analytics and infrastructure tools may process information outside Brazil.
• We always seek to work with providers that adopt adequate protection and security standards.

7.Information Security

Security Measures

• Use of SSL/TLS encryption (HTTPS).
• Restricted access controls over information.
• Security monitoring and access logging.
• Adoption of information security best practices.
• Periodic security assessments for the continuous improvement of internal controls.

8.Data Retention

Storage Periods

• Data will be stored only for as long as necessary to fulfill the purposes described in this policy.
• Information related to tax and contractual obligations may be retained for the applicable legal periods.
• Once the retention period ends, data may be deleted, anonymized or stored securely where permitted by law.

9.Data Subject Rights

Rights Guaranteed by the LGPD

• Confirmation that data processing is taking place.
• Access to the personal data being processed.
• Correction of incomplete, inaccurate or outdated data.
• Requesting anonymization, blocking or deletion where applicable.
• Withdrawal of consent.
• Information about data sharing.
• Objection to processing carried out in breach of the law.

Requests

• Requests can be submitted by email to [email protected].
• Responses will be provided within the legally applicable deadlines.
• We may ask you to confirm your identity before fulfilling certain requests.

10.Cookie Policy

Use of Cookies

• We use one necessary cookie, set by Cloudflare, for the website's security.
• Google Analytics cookies are used only after your consent, to understand how the website is used.
• The use of non-essential cookies depends on the consent given through the banner displayed on the site.

Cookies We Use

• __cf_bm (Cloudflare): necessary cookie used to protect the website against automated traffic. It is set by the infrastructure on every visit, regardless of the choice made in the cookie notice, and expires after about 30 minutes.
• _ga and _ga_6NHR91VEH2 (Google Analytics): analytics cookies, created only after you accept and deleted when you decline or revoke consent. They may remain in the browser for up to 2 years (some browsers cap this period). This cookie expiry is not the same as the data retention period in the Google Analytics platform.
• Your cookie choice (cookieConsent and cookieConsentDate) and your chosen language (loprestisec:lang) are kept in the browser's local storage (localStorage), not in cookies. This data stays on your device and is not sent to the website's servers.

Managing Cookies

• You can accept or decline analytics cookies in the notice shown on your first visit and change or revoke your choice at any time under “Cookie preferences” in the footer.
• You can also disable cookies directly in your browser.
• Blocking Cloudflare's necessary cookie may make it harder to access the website when its protection against automated traffic is triggered.

11.Security Incidents

Procedures

• We take reasonable measures to prevent security incidents.
• In the event of a material incident involving personal data, containment, investigation and notification measures may be taken as required by applicable law.
• Where necessary, affected data subjects and the competent authorities may be notified.