Signato Gestão de Documentos e Serviços Ltda., registered under CNPJ No. 47.758.769/0001-37 (“Signato”, “we”), respects your privacy and processes personal data in accordance with Brazilian Law No. 13,709/2018 — the General Data Protection Law (“LGPD”) — and other applicable regulations.
This Policy explains which personal data we collect through the signato.com.br website and our service channels, for what purposes, with whom we share it, how long we keep it and how you can exercise your rights.
This English version is provided for convenience. In case of any discrepancy, the Portuguese version prevails.
1. Who the controller is and how to reach us
For data processed on this website and in our business relationships, Signato acts as controller. Questions, requests and complaints about personal data may be sent to our Data Protection Officer (DPO) at privacidade@signato.com.br or by phone at +55 11 5198-5190.
When we provide BPO, e-signature, document management, storage and identity verification services to our clients, we process personal data on behalf of and according to the instructions of those clients, who are the controllers. In such cases we act as processor, and processing is governed by the contract with the client and by the client’s privacy policy. If you are a data subject in that context, we recommend contacting the responsible company directly — and if you contact us, we will forward your request to them.
2. What data we collect
- Data you provide: name, business email, phone, company, job title, company size, area of interest and the content of messages sent through the contact form or our service channels.
- Browsing and technical data: IP address, date and time of access, browser, operating system, pages visited, referring page and campaign parameters (UTM).
- Security data: technical device and browser signals collected by the anti-bot tool (Cloudflare Turnstile) used on the contact form and in the administrative area.
- Cookies and similar technologies: as described in our Cookie Policy.
We do not request sensitive personal data through this website. Please do not include it in the message field.
3. How we use data and on which legal bases
- Responding to your inquiry, preparing proposals and conducting negotiations — preliminary procedures related to a contract (art. 7, V, LGPD) and legitimate interest (art. 7, IX).
- Sending content, invitations and marketing communications — consent (art. 7, I), which may be withdrawn at any time via the unsubscribe link or the DPO email.
- Ensuring website security and preventing fraud and abuse — legitimate interest (art. 7, IX).
- Measuring audience and improving the experience — consent collected in the cookie banner (art. 7, I).
- Complying with legal and regulatory obligations and exercising rights in proceedings — art. 7, II and VI, including keeping application access logs for the period required by the Brazilian Internet Civil Framework (Law No. 12,965/2014).
4. Who we share data with
We do not sell personal data. We may share it only to the extent necessary with:
- Technology service providers acting as processors — cloud hosting and infrastructure, email delivery, bot protection (Cloudflare) and, with consent, audience measurement tools (Google);
- Professional advisors, such as law and accounting firms, bound by confidentiality;
- Public authorities, when required by law, regulation or court order;
- A potential successor in case of corporate reorganization, with the guarantees of this Policy maintained.
5. International transfers
Some providers may store or process data outside Brazil. In such cases we adopt the safeguards set out in art. 33 of the LGPD and in ANPD regulations, such as standard contractual clauses and providers with adequate levels of protection.
6. How long we keep data
We keep data for as long as necessary for the stated purposes: business contact data for up to 5 (five) years after the last interaction, or until consent is withdrawn for marketing; access logs for at least 6 (six) months, as required by the Internet Civil Framework; and data needed to comply with legal obligations or exercise rights for the applicable limitation periods. After these periods, data is deleted or anonymized.
7. Your rights
Under art. 18 of the LGPD, you may request, at any time and free of charge: confirmation of processing and access to data; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary or excessive data; portability; deletion of data processed based on consent and withdrawal of consent; information about the entities with which we share data; review of decisions made solely on automated processing; and objection to processing that does not comply with the law.
To exercise your rights, write to privacidade@signato.com.br. We may request information to confirm your identity. You may also file a petition with the Brazilian National Data Protection Authority (ANPD).
8. Security
We adopt technical and administrative measures to protect data from unauthorized access and accidental or unlawful destruction, loss, alteration or disclosure, including encryption in transit, role-based access control, authentication for restricted areas, processing records and confidentiality agreements. In the event of a security incident that may cause relevant risk or harm, we will notify the ANPD and affected data subjects as required by regulation.
9. Children and adolescents
This website is intended for businesses and professionals. We do not knowingly collect data from children or adolescents.
10. Changes to this Policy
This Policy may be updated to reflect legal, regulatory or practice changes. The date of the last update is shown at the top of this page.