Privacy Policy

1. Purpose

This Privacy Policy aims to establish clear, transparent, and accessible guidelines on the processing of personal data carried out by Rainbow Tecnologia e Consultoria Ltda., in accordance with the Brazilian General Data Protection Law (LGPD – Law No. 13.709/2018), as well as the information security and privacy best practices defined by ISO/IEC 27001 and ISO/IEC 27701 standards.

The organization acts as a Data Processor, carrying out the processing of personal data exclusively on behalf of and according to the documented instructions of the Data Controllers, adopting adequate technical and administrative measures to ensure the security, confidentiality, integrity, and availability of the information processed.

2. Scope

This Policy applies to:

• Visitors of the institutional website
• Clients, partners, suppliers, and employees whose personal data is processed by the organization

Processing activities performed in the context of contract execution, service delivery, technical support, and compliance with legal or regulatory obligations.

This Policy does not apply to personal data processing activities carried out directly by Data Controllers, who are responsible for defining the purposes and legal bases applicable to such processing.

3. Terms and Definitions

Personal Data: information related to an identified or identifiable natural person.

Sensitive Personal Data: genetic or biometric data.

Data Subject: the natural person to whom the personal data refers.

Controller: the natural or legal person responsible for decisions regarding the processing of personal data.

Processor: the natural or legal person who processes personal data on behalf of the Controller.

Processing: any operation performed with personal data, such as collection, use, access, storage, sharing, or deletion.

ANPD: the Brazilian National Data Protection Authority, responsible for overseeing personal data protection in Brazil.

4. Methodology

4.1 Acting as a Data Processor

• Processing is carried out strictly according to the Controller’s documented instructions
• The organization does not define its own purposes for the use of personal data
• Personal data is not used for purposes other than those contractually established.

4.2 Information Security and Privacy

The organization adopts technical and administrative measures aligned with ISO/IEC 27001 and ISO/IEC 27701 standards, including, when applicable:

• Logical and physical access control
• Segregation of duties
• Protection against unauthorized access
• Access monitoring and logging
• Incident management procedures
• Information security and privacy awareness and training.

4.3 Data Sharing

Personal data may be shared only when necessary for the execution of contracted activities, always following the Controller’s instructions and complying with security and confidentiality requirements.

4.4 Data Subject Rights

Requests related to data subject rights must be addressed to the Data Controller. The organization, as Processor, will provide technical and operational support as applicable.

4.5 Security Incidents

In the event of a security incident involving personal data, the organization will follow its internal procedures and notify the Controller, in accordance with the LGPD and the contractual agreements in place.

4.6 Cookies and measurement technologies

This website uses cookies and similar technologies to measure how its pages and RainbowTec's marketing campaigns perform. The technologies used are Google Analytics 4, Google Ads and the LinkedIn Insight Tag.

The purpose is (i) to measure how the pages of this website and RainbowTec's campaigns are reached and (ii) to show RainbowTec advertising to people who have already visited this website.

These technologies stay switched off until the visitor makes a choice in the notice shown on their first visit. Until consent is given, no measurement or advertising cookie is stored. The choice can be reviewed at any time under "Cookie preferences", in the footer of every page.

Data collected by Google Analytics 4 is retained for 14 months, after which it is deleted automatically.

For this activity RainbowTec relies on Google LLC and LinkedIn Corporation, which operate infrastructure outside Brazil. The international transfer follows the safeguards in articles 33 to 36 of Brazilian Law 13.709/2018 (LGPD, the Brazilian General Data Protection Law), through the contractual clauses adopted by those suppliers.

The rights described in section 4.4 also apply to this data and may be exercised through the channel given in section 6.

4.7 Data submitted through the website forms

The contact forms on this website collect name, company, work email, phone number, area of interest, industry and the message the visitor writes. This data is used solely to respond to the request and to conduct the commercial contact, on the basis of the consent given in the form itself.

The records are stored in the CRM platform of HubSpot, Inc., which acts as a data processor and maintains infrastructure outside Brazil. The international transfer follows the safeguards in articles 33 to 36 of Brazilian Law 13.709/2018 (LGPD). After submitting the form, the visitor is shown a confirmation page on this website.

The data subject may request access to, correction of or deletion of this data at any time through the channel given in section 6.

4.8 Protection against automated submissions

To prevent bots from submitting the forms on this website, RainbowTec uses reCAPTCHA v3, from Google LLC. The tool analyses browser signals and the way the page is used in order to tell a person apart from an automated submission, and it is triggered only when the visitor starts filling in a form — not when the other pages load.

In this verification Google receives the IP address and data about the browser and the interaction. The purpose is strictly security: no information from this verification is used for advertising or for audience measurement. The international transfer follows the safeguards in articles 33 to 36 of Brazilian Law 13.709/2018 (LGPD).

5. Records and Evidence

For legal, contractual, and regulatory compliance purposes, the organization maintains, when applicable:

• Records of processing activities performed as a Processor
• Evidence of information security controls
• System and information access logs
• Documented incident response procedures
• Contracts and data processing agreements with Controllers
• Training and awareness program records.

Records are kept for the period necessary to meet legal, regulatory, and contractual obligations, observing the principles of necessity and data minimization.

6. Contact

For questions related to this Privacy Policy or to personal data protection, please contact:

Company: Rainbow Tecnologia e Consultoria Ltda

Email: contact@rainbowtec.com

Phone: +55 11 2344-0350

By using this website, you acknowledge and agree to the terms of this Privacy Policy.