Privacy Policy
Last updated: 5 August 2026
Agência Primeira Página handles your personal data transparently and securely. This policy explains what data we collect on agenciaprimeirapagina.com.br, why, on what legal basis, how long we keep it and what your rights are. Regulation (EU) 2016/679 (GDPR) applies to residents of the European Economic Area and Law No. 13,709/2018 (LGPD) applies to residents of Brazil.
1. Who processes your data
- Data controller: Agência Primeira Página
- Email: raphaella@agenciaprimeirapagina.com.br
- Phone: +34 602 851 713
- Data protection officer (DPO) contact: raphaella@agenciaprimeirapagina.com.br, subject line "Privacy"
2. Scope of this policy
This policy covers the website agenciaprimeirapagina.com.br, including its Spanish (/es), French (/fr) and English (/en) versions, and any contact you start from it by form, email or WhatsApp. Our products with their own accounts — such as the webar.app.br platform — have separate terms and policy.
3. What data we process
| Category | Data | Source |
|---|---|---|
| Contact data | Name, email, phone, company, subject and message | Provided by you in the contact form |
| Technical data | IP address, date and time of access, browser, operating system and page requested | Collected automatically by server logs |
| Preferences | Chosen language and interface state | Stored in your own browser |
We neither ask for nor need special category data (health, religious or political beliefs, biometrics, racial origin). Please do not type such information into the message field.
4. Purposes and legal bases
| Purpose | Legal basis (GDPR) | Legal basis (LGPD) |
|---|---|---|
| Answering your enquiry and sending a quote or business proposal | Pre-contractual steps at your request — Art. 6(1)(b) | Preliminary contract procedures — Art. 7, V |
| Following up on the same enquiry you started | Legitimate interests — Art. 6(1)(f) | Legitimate interests — Art. 7, IX |
| Keeping the site available and protected from abuse, spam and attacks | Legitimate interests — Art. 6(1)(f) | Legitimate interests — Art. 7, IX |
| Meeting legal, tax and accounting obligations | Legal obligation — Art. 6(1)(c) | Compliance with a legal obligation — Art. 7, II |
We do not run behavioural advertising, we do not sell your data and we do not share it with third parties for marketing.
5. How long we keep it
- Contact message that did not lead to an engagement: 24 months from the last contact.
- Client data: for the duration of the business relationship and 5 years afterwards, to defend against possible claims.
- Tax and accounting records: for the period required by law.
- Server technical logs: up to 30 days.
Once the period ends, data is deleted or irreversibly anonymised. You may request deletion earlier, except where we are legally required to keep it.
6. Who else handles your data
We use providers acting as processors, handling data only on our instructions and under contract:
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Website hosting, CDN, abuse protection and temporary storage of your message until it is sent | Global network, under standard contractual clauses |
| Hostinger International Ltd. | Mail server and the server where the message is collected and forwarded to our inbox | European Union (application server in Paris, France) |
| Google Ireland Ltd. (YouTube) | Videos embedded on some pages, loaded only when you play them | European Union and United States |
| jsDelivr | Public library for 3D model viewing | Global network |
We may also disclose data to public authorities where the law requires it. Beyond that, no one else has access.
7. International transfers
The server that processes messages is in the European Union. Cloudflare and Google may process data outside the European Economic Area; those transfers rely on the European Commission's standard contractual clauses and, where applicable, on the EU-U.S. Data Privacy Framework adequacy decision. Data of Brazilian residents may be processed in the European Union under Art. 33 of the LGPD, in a country offering an adequate level of protection.
8. Cookies and browser storage
This site uses no analytics, advertising or social media cookies. There is no audience measurement and no visitor tracking.
We only use strictly functional storage, which is exempt from consent by law:
| What | Purpose | Duration |
|---|---|---|
| sidebar:state | Remembers whether an interface panel stays open or closed | 7 days |
| Language preference | Shows the site in the language you chose | Until you clear browser data |
| Admin area session | Keeps holders of an internal admin account signed in | Until you sign out |
If you play an embedded YouTube video, Google may write its own cookies to your browser, subject to Google's privacy policy. You can block or delete cookies in your browser settings.
9. Your rights
At any time and free of charge, you may exercise:
- Access to your data and a copy of it.
- Rectification of inaccurate or incomplete data.
- Erasure (the right to be forgotten).
- Restriction of processing.
- Portability to another provider.
- Objection to processing based on legitimate interests.
- Withdrawal of consent, where consent is the basis, without affecting processing already carried out.
- Under the LGPD, additionally: confirmation that processing exists, information on who we share your data with, and review of automated decisions.
To exercise any of these, email raphaella@agenciaprimeirapagina.com.br with the subject "Privacy". We reply within 30 days (GDPR) and within 15 days for the confirmation and access requests set out in the LGPD. We may ask you to prove your identity if there is reasonable doubt about who is making the request.
If our answer does not satisfy you, you may lodge a complaint with a supervisory authority: the ANPD in Brazil, the AEPD in Spain, the CNIL in France, or the authority of your country if you live elsewhere in the European Union.
10. Security
The site runs exclusively over HTTPS with a valid certificate. Access to received messages is restricted, protected by a strong password and authentication, and the servers receive regular security updates. If a personal data breach poses a risk to you, we notify the competent authority within 72 hours and inform you directly where the risk is high.
11. Automated decisions
We make no decisions based solely on automated processing that produce legal effects or significantly affect you, and we do not carry out profiling with the data collected on this site.
12. Minors
The site is aimed at businesses and professionals. We do not knowingly collect data from children under 16. If you know that a minor has sent us personal data, tell us and we will delete the record.
13. Changes to this policy
We may update this policy to reflect changes to the site or to the law. The date at the top shows the latest revision, and significant changes will be flagged on the site.