Who is responsible
HCX, a consulting firm for strategy, AI agents and process automation, is the controller of the personal data processed on this website.
Contact for personal data and security matters: henrique.cardozo@hcxconsultoria.com.
Data we collect
- Contact form. Name, email, company and, if you wish, phone number and a description of the process that takes the most time. This is the only personal data you provide on the website.
- Audience measurement. Vercel Web Analytics counts visits in aggregate, without cookies. It records the page viewed, where the visit came from, approximate country and city, device type, operating system and browser. The visitor is recognized by a code generated from the connection, which is discarded within 24 hours.
- Technical logs. As with any website, the hosting provider receives technical data from each request, such as IP address, date and time, used to deliver the pages and protect the website.
What we use it for
- To reply to your message and discuss the need you bring to us.
- To understand, in aggregate numbers, which content on the website is viewed.
- To keep the website running and secure.
We do not sell personal data or use it for any other purpose.
Legal bases
- To reply to your message: preliminary procedures related to a contract, at the request of the data subject (art. 7, V, of the LGPD).
- For aggregate measurement and website security: legitimate interest (art. 7, IX, of the LGPD), with the minimum data necessary.
Who we share it with
The data passes only through the services that make the website work, which act as processors:
- Vercel (United States): website hosting and audience measurement.
- FormSubmit: delivery of form messages by email.
- Google Workspace: the email inbox that receives the messages.
These services may store data outside Brazil. The transfer is necessary to fulfill your contact request (art. 33, IX, of the LGPD).
How long we keep it
Form messages stay in the HCX email inbox for as long as needed to reply and follow up on the conversation. Where there is no business relationship, they are deleted within 12 months. Audience measurement does not keep data that identifies you.
Your rights
Under the LGPD (art. 18), you may request at any time:
- confirmation that we process your data, and access to it;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of unnecessary data;
- data portability;
- information about who we share data with;
- deletion of the data and withdrawal of consent, where applicable.
Write to henrique.cardozo@hcxconsultoria.com. We reply within 15 days. You may also file a complaint with the Brazilian National Data Protection Authority (ANPD). The same contact applies to anyone accessing the website from outside Brazil.
Cookies
The website does not use cookies or third-party trackers.
Website security
- Always-encrypted connection (HTTPS with TLS 1.2 or 1.3), with HSTS, which prevents unencrypted access.
- Certificates issued by Let’s Encrypt and renewed automatically. CAA records limit who can issue certificates for the domain.
- Domain protected by DNSSEC and a transfer lock.
- A Content Security Policy (CSP) that only allows resources from the website itself and form submissions to FormSubmit. The website does not load third-party scripts, fonts or trackers.
- Security headers recommended by OWASP, including protection against the website being displayed inside other pages.
- The website has no database or login area, and does not store personal data on its own servers.
Found a vulnerability? Write to the contact above. The security.txt file (RFC 9116) lists the same contact.
Changes to this policy
When this policy changes, the date at the top of the page is updated.