Privacy Policy

This is a translation provided for convenience. The Portuguese-language version is the official one and prevails for all legal purposes.

This Privacy Policy describes how Awarenox (operated by BOCCHI COMPANY LTDA, registered under CNPJ 66.060.363/0001-20, headquartered at Rua Pais Leme, 215, Conjunto 1713, Pinheiros, São Paulo — SP, CEP 05.424-150) collects, uses, stores and protects the personal data of visitors to the website awarenox.com, in compliance with Lei nº 13.709/2018 — the Brazilian General Data Protection Law (LGPD).

1. Scope of this policy

This policy applies exclusively to the Awarenox institutional website. The Awarenox platform is still in private alpha, with no contracting clients. A specific data processing policy for the product will be published before the commercial launch.

2. Data controller

The controller, under the terms of art. 5º, VI, of the LGPD, is BOCCHI COMPANY LTDA. To exercise the rights provided for in art. 18 of the LGPD or to ask questions, the data subject may get in touch via the e-mail privacidade@bocchi.company.

Data Protection Officer (DPO) for the processing of personal data, in accordance with art. 41 of the LGPD: Wagner Bocchi (interim), until an outsourced officer is hired.

3. What data we collect

We collect only the data strictly necessary for the purposes described in this policy. They are:

• Contact form: name, business e-mail, company name, free-form message and consent record.
• Waitlist form: name, business e-mail, company name, company size range, job title and consent record.
• Automatic technical data: truncated IP address, browser type, operating system, pages visited and referrer, collected by our cookieless analytics solution (Umami) for the sole purpose of measuring aggregate site usage.

We do not use tracking cookies. We do not carry out advertising profiling. We do not sell personal data.

4. Legal bases for processing

• Consent (art. 7º, I): for sending communications about the Awarenox alpha, technical materials and product updates.
• Performance of preliminary procedures related to a contract (art. 7º, V): to respond to commercial contact requests and to qualify waitlist candidates.
• Legitimate interest (art. 7º, IX): for the aggregate and anonymized measurement of site traffic, with the purpose of improving content.

5. Sharing with third parties

To operate the site, we use the following processors, all selected for their public commitment to privacy and security:

• Formspree (Formspree, Inc., USA) — receipt and forwarding of forms by e-mail. Servers in the United States.
• Umami (Umami Software, Inc., USA) — aggregate analytics without cookies. Does not collect data that allows direct identification of the visitor.
• Hostinger (Hostinger International Ltd., Lithuania) — hosting of the static site.
• Google Fonts (Google LLC, USA) — typography delivery. Fonts are loaded via Google's CDN, which may record the visitor's IP for technical operation purposes.

International data transfers, when they occur, are carried out on the basis of contractual clauses and in compliance with art. 33 of the LGPD.

6. Retention periods

• Contact form data: up to 24 months after the last contact, or until the data subject requests deletion.
• Waitlist data: until conversion into a client or discard (rejection or withdrawal), with a maximum period of 24 months.
• Aggregate technical data: up to 12 months, in a format that does not allow re-identification.

7. Data subject rights

Under the terms of art. 18 of the LGPD, the personal data subject has the right to:

• Confirmation of the existence of processing;
• Access to the data;
• Correction of incomplete, inaccurate or outdated data;
• Anonymization, blocking or deletion of unnecessary, excessive data or data processed in non-compliance;
• Data portability to another service provider, upon express request;
• Deletion of data processed with consent;
• Information about public and private entities with which the controller carried out shared use;
• Information about the possibility of not providing consent and about the consequences of refusal;
• Revocation of consent, at any time.

To exercise any of these rights, simply send a request to the e-mail privacidade@bocchi.company. We respond within 15 calendar days.

8. Information security

We adopt reasonable technical and administrative measures to protect personal data against unauthorized access, loss, alteration or destruction. Among them: TLS encryption in transit, access restriction based on the principle of least privilege, and a cycle of periodic supplier review.

9. Changes to this policy

This policy may be updated periodically. The current version is always available on this page, with the date of the last update at the top. Material changes will be communicated to registered data subjects with a minimum of 15 days' notice.

10. Applicable law and jurisdiction

This policy is governed by the laws of the Federative Republic of Brazil. The courts of the Judicial District of São Paulo, Capital, are elected to settle any questions arising from it, with waiver of any other, however privileged it may be.

This is an initial version and will be reviewed by a specialized attorney before the product opens to the public.