1. Who We Are
This Privacy Policy applies to the website auriuscorporate.com, owned by Aurius Serviços e Soluções Corporativas Ltda., enrolled with the CNPJ under No. 34.643.772/0001-63, as controller of the personal data processed through this website, headquartered at Rua Líbero Badaró, 158, 22nd floor, Historic Center of São Paulo, São Paulo/SP, ZIP 01008-904, with a branch at Rua Santa Luzia, 651, 25th floor, Centro, Rio de Janeiro/RJ, ZIP 20030-041 (“Aurius”, “we”).
This policy explains what personal data we collect when you visit our website or interact with our forms, the purposes for which we use this data, with whom we may share it, and what your rights are as a data subject, under the Brazilian General Data Protection Law (Law No. 13,709/2018 – LGPD).
2. What Data We Collect
2.1 Data You Provide Directly
· Contact form: name, email, company and message.
· Careers page: job applicant data, including résumé and contact information.
2.2 Data Collected Automatically While Browsing
· Browsing and device data (IP address, browser type, pages visited, time spent), collected via cookies and similar technologies.
· Audience and behavioral data collected by third-party tools: Google Analytics (site usage metrics), Meta Pixel and LinkedIn Ads Insight Tag (campaign and ad measurement), and RD Station Marketing (marketing automation and lead relationship management).
More details about the cookies used are available in our Cookie Policy, which forms an integral part of this Privacy Policy.
This website is aimed at professional and business audiences and is not intended for children or minors under 18 (eighteen) years of age. We do not intentionally collect personal data from minors in this age group. If we identify that data of this nature was inadvertently collected, we will take appropriate steps to delete it, under Art. 14 of the LGPD.
If a hiring process published on the Careers page requires providing sensitive personal data (for example, health information for accessibility purposes in
interviews), such data will be processed based on specific and highlighted consent from the data subject or their legal guardian, under Art. 11, I, of the LGPD, or under other applicable legal grounds.
3. What We Use Your Data For
- Responding to contacts, proposals and requests submitted through the website.
- Evaluating applications for positions posted on the Careers page.
- Sending commercial and institutional communications, when there is consent or a legitimate relationship with the data subject (e.g., via RD Station).
- Measuring the performance of the website and marketing campaigns (Google Analytics, Meta Pixel, LinkedIn Ads Insight Tag).
- Complying with legal and regulatory obligations applicable to Aurius.
- Aurius does not use the personal data processed through this website to make decisions based solely on automated processing that produce legal effects or significantly affect data subjects, under Art. 20 of the LGPD.
4. Legal Bases for Processing
We process personal data based mainly on:
· Consent of the data subject (Art. 7, I, LGPD) – for non-essential cookies and marketing communications.
· Performance of preliminary procedures related to a contract (Art. 7, V, LGPD) – for responses to commercial proposals.
· Legitimate interest of the controller (Art. 7, IX, LGPD) – for website improvement and security.
· Compliance with a legal or regulatory obligation (Art. 7, II, LGPD) – when applicable.
For processing based on the legitimate interest of the controller, Aurius carries out a proportionality assessment between that interest and the data subject’s fundamental rights and freedoms, documentation of which is available upon request to the Data Protection Officer.
5. Who We Share Your Data With
We may share personal data with service providers acting on our behalf, such as:
• Google (Google Analytics) – measurement of website traffic and usage. By default, Google acts as a processor of the data handled for this purpose; if the “Data Sharing Settings” (Google Signals, benchmarking, technical support or account specialists) are enabled in Aurius’s Google Analytics account, Google then acts as an independent
controller with respect to the data shared in this way, processing it for its own purposes (improving its own products and services), under the Google Measurement Controller-Controller Data Protection Terms.
• Meta (Meta Pixel) – measurement and optimization of Facebook/Instagram campaigns. Aurius and Meta are joint controllers for the purpose of ad targeting and delivery, under the Controller Addendum that forms part of the Meta Business Tools Terms; Meta also processes the data independently, for its own commercial purposes of improving its advertising services.
• LinkedIn (Ads Insight Tag) – measurement and optimization of LinkedIn campaigns. LinkedIn also processes the data collected for its own purposes (ad optimization and building advertising audiences), which constitutes joint control with Aurius for this purpose, rather than merely acting as a processor.
• RD Station (Resultados Digitais) – marketing automation and lead relationship management.
• Website infrastructure and hosting providers.
We may also share personal data with public authorities, pursuant to a legal obligation, court order or duly justified regulatory request, subject to the limits of items II, III and VI of Art. 7 of the LGPD.
Since Google, Meta and LinkedIn process part of this data for their own purposes, and not solely under Aurius’s instructions, Aurius may be held jointly and severally liable for any damage to the data subject arising from such processing, under Arts. 42 and 44 of the LGPD. For this reason, the collection of this data depends on the consent of the data subject (Art. 7, I, of the LGPD), as described in the Cookie Policy, and Aurius maintains, or must maintain, documentation equivalent to Meta’s Controller Addendum with Google and LinkedIn as well.
Some of the providers mentioned above – Google, Meta and LinkedIn – may, as part of their own operations, process data on servers located outside Brazilian territory, which constitutes an international transfer of personal data under Art. 5, XV, of the LGPD. This transfer is carried out based on the grounds set out in Art. 33 of the LGPD, through Standard Contractual Clauses approved by ANPD Resolution CD/ANPD No. 19/2024.
6. How Long We Keep Your Data
We keep personal data for as long as necessary to fulfill the purposes described in this Policy, subject to the following periods and criteria:
• Contact form data: kept for 12 months after the last contact, after which it is deleted or anonymized, unless there is an ongoing business relationship.
• Applicant data (Careers page): kept for 12 months after the hiring process closes, and may be deleted sooner at the data subject’s request.
• Browsing and cookie data: kept for the periods indicated in the Cookie Policy table, not exceeding 24 months.
• Application access logs (IP address, date and time of access): kept in a controlled, restricted-access environment for at least 6 (six) months, under Art. 15 of Law No. 12,965/2014 (Brazilian Internet Bill of Rights – Marco Civil da Internet).
• Data processed based on a legal or regulatory obligation (e.g., tax, labor): kept for the periods set out in the legislation applicable to each matter.
Once the retention period ends, personal data is deleted or anonymized, except in the cases set out in Art. 16 of the LGPD, which allows retention for compliance with a legal or regulatory obligation, for use by public administration, for transfer to a third party within the limits of the law, or for the controller’s exclusive use, provided third-party access is prohibited and the data is anonymized.
7. Your Rights as a Data Subject
Under Art. 18 of the LGPD, you may request, at any time:
· Confirmation of whether your data is being processed.
· Access to the data.
· Correction of incomplete, inaccurate or outdated data.
· Anonymization, blocking or deletion of unnecessary data or data processed in violation of the law.
· Portability of data to another service provider.
· Deletion of personal data processed with consent.
· Information about the entities with which we share data.
· Information about the possibility of not providing consent and the consequences of that refusal.
· Withdrawal of consent, when applicable.
Your requests will be answered in simplified form, immediately, or, when they involve a clear and complete statement about the origin of the data, within up to 15 (fifteen) days, under Art. 19 of the LGPD. You may also petition directly to the National Data Protection Authority (ANPD) or to consumer protection agencies, under Art. 18, §§1 and 8, of the LGPD.
To exercise these rights, please contact our Data Protection Officer (DPO) through the channels indicated in Section 9.
8. Information Security
We adopt reasonable technical and organizational measures to protect the personal data under our responsibility against unauthorized access and accidental or unlawful destruction, loss, alteration, disclosure, or any other form of improper or unlawful processing.
In the event of a security incident that could result in significant risk or harm to data subjects, Aurius will notify the National Data Protection Authority (ANPD) within the period established under current regulations – currently, within 3 (three) business days of becoming aware of the incident, under ANPD Resolution CD/ANPD No. 15, of April 24, 2024 – and will notify affected data subjects without undue delay, informing them of the nature of the data involved, the measures taken to contain the incident, and relevant security recommendations
9. Data Protection Officer (DPO)
Aurius has appointed Tatiana Davanso as Data Protection Officer (DPO). To exercise your rights as a data subject or to clarify questions about this policy, please contact dpo@auriuscorporate.com.
10. Changes to This Policy
This Privacy Policy may be updated periodically to reflect changes in our practices or in legal requirements. The current version will always be available on this page, with the date of the last update. Material changes to the purposes of non-essential cookies will be communicated through a new consent notice on the website.
