1. Data controller
Flowing Digital LTDA ("Flowing Assessoria"), CNPJ 37.142.898/0001-42, headquartered at Rua Príncipe Humberto, 112, Conj. 44, Centro, São Bernardo do Campo - SP, Brazil, 09725-200, is the controller of the personal data processed through this site.
Data protection officer (DPO): [to fill in: data protection officer (DPO) name], reachable at juridico@agenciaflowing.com.br.
2. Applicable laws
We process personal data in accordance with Brazil's General Data Protection Law (Law No. 13.709/2018 — LGPD). Since we serve companies in other countries, where applicable we also observe the EU General Data Protection Regulation (GDPR), the UK GDPR, and the Swiss Federal Act on Data Protection (nLPD/FADP).
3. What data we collect
We only collect what's necessary:
- "Talk to Flowing" form: the name, email and WhatsApp number you provide, plus the campaign parameters present in the page address (such as utm_source, utm_campaign, gclid and fbclid), so we know where the contact came from.
- WhatsApp messages: when you click to talk to us, the content of the message (which may include diagnosis answers or calculator figures, if you choose to send them) and your phone number.
- Quick diagnosis and ROI calculator: the answers and figures you enter are processed only in your browser and are not sent to or stored by us, unless you choose to send them via WhatsApp.
- Technical data: like any website, the hosting server may automatically log data such as IP address, access date and time, and browser type, for security and operation purposes.
4. What we use the data for, and the legal basis
- Responding to your contact and sending information or proposals you requested — preliminary steps to a contract (art. 7, V, LGPD; art. 6(1)(b) GDPR).
- Understanding which channels and campaigns generate contacts, to improve our marketing — legitimate interest (art. 7, IX, LGPD; art. 6(1)(f) GDPR).
- Sending marketing communications by email, when you have consented — consent (art. 7, I, LGPD; art. 6(1)(a) GDPR), which can be withdrawn at any time.
- Keeping the site secure and complying with legal obligations — legitimate interest and compliance with a legal obligation (art. 7, II and IX, LGPD).
5. Who we share data with
We do not sell personal data. We share data only with vendors who help us operate, under contract and to the extent necessary:
- CRM and forms platform (Yollo I.A / CRM system), which receives and stores the contact form's data;
- WhatsApp (Meta), when you start a conversation with us;
- The site's hosting provider;
- Public authorities, when required by law or court order.
6. International transfer
Some vendors may store or process data outside the country you are in. In those cases, we adopt the safeguards provided for in the LGPD (art. 33) and, where applicable, the GDPR, such as standard contractual clauses.
7. How long we keep it
Contact and negotiation data is kept for as long as there is a business relationship or a legitimate interest in resuming it, and for up to 5 years after the last contact, unless a different legal deadline applies or you request deletion. Data used on the basis of consent is deleted when you withdraw it.
8. Your rights
At any time, you can: confirm whether we process your data, access it, correct it, request anonymization, blocking or deletion, request portability, find out who we share it with, withdraw consent, and object to processing based on legitimate interest. If you are in the European Union, the United Kingdom or Switzerland, you can also file a complaint with your local data protection authority.
See how to exercise your rights on the GDPR / LGPD and data subject rights page, or write to juridico@agenciaflowing.com.br.
9. Security
We use encrypted connections (HTTPS), access control on our systems, and vendors with recognized security practices. No system is 100% secure; if a significant incident occurs, we will notify those affected and the relevant authorities as required by law.
10. Cookies
Details about cookies and similar technologies are in our Cookie policy.
11. Children and teenagers
The site is aimed at businesses and professionals and is not intended for anyone under 18. We do not knowingly collect data from children or teenagers.
12. Changes
We may update this Policy. The version in effect is always the one published on this page, with the last-updated date shown at the top.