C de Calvo

C de Calvo Privacy Policy

Effective date: September 15, 2026

Hamlet Arencibia Casanova LTDA, doing business as C de Calvo, CNPJ 61.473.482/0001-91, located at Rua Pais Leme #215 Conj 1713, Pinheiros, São Paulo, 05424-150, Brazil ("C de Calvo," "we," "us," or "our"), explains in this Privacy Policy how we process personal data through cdecalvo.com, cdecalvo.com.br, and our business-contact channels.

For privacy or data-rights requests, contact us at privacy@cdecalvo.com.

1. Scope

This Policy applies to personal data that C de Calvo processes as controller for its own websites, contact requests, sales conversations, and business communications.

It does not govern personal data that we process solely on behalf of a website-services client. That processing is addressed in the applicable client agreement and Data Processing Addendum.

2. Information we process

When you use our contact form, we process the name, email address, and message you choose to provide.

Please do not send passwords, payment credentials, health information, government identification numbers, or other sensitive or confidential information through an initial inquiry.

We may also process limited technical, operational, security, and website-performance information necessary to operate, protect, and improve the website and contact form, including information used to detect spam, automated traffic, abuse, security threats, page views, navigation/referrer patterns, and website performance.

When you visit the website, Cloudflare Web Analytics (real-user monitoring, or RUM) may process page-view and navigation/referrer information, browser and device/environment information, and website-performance metrics, including Core Web Vitals. We use this information to understand aggregate website use and performance. It is separate from contact-form data and from Cloudflare Turnstile.

C de Calvo uses Google Analytics 4 on cdecalvo.com and cdecalvo.com.br. When you visit either website and choose to allow analytics, Google Analytics 4 may process limited information about your use of that website. This may include page views, page paths and titles, referring pages, browser and device information, approximate geographic information, and the interactions we have specifically enabled for measurement. Google Analytics uses first-party analytics cookies and pseudonymous identifiers, including the _ga cookie, to distinguish browsers and sessions. We do not intentionally send Google Analytics your name, email address, contact-form message, or other information that directly identifies you.

3. Why we process personal data

We process personal data for the following purposes and, where the Brazilian General Data Protection Law (LGPD) applies, on the corresponding legal bases:

  • to respond to inquiries, discuss requested services, prepare proposals, and take steps requested before entering into a contract;
  • to perform and administer an agreed client relationship;
  • to protect our websites, contact forms, systems, and users against fraud, spam, abuse, and security threats, based on our legitimate interests where applicable;
  • to measure aggregate page views and website performance and improve site reliability and usability, based on our legitimate interests where applicable;
  • to measure aggregate use of our websites and improve them through Google Analytics 4, but only after you choose to allow analytics; we use this information for measurement, not advertising, profiling, or remarketing;
  • to comply with legal or regulatory obligations; and
  • to establish, exercise, or defend legal rights where necessary.

We do not rely on consent as the legal basis for every processing activity.

4. Marketing

At launch, we use contact-form information only to respond to the inquiry and manage the related business conversation.

We do not automatically add contact-form users to newsletters, promotions, or other marketing campaigns.

If we introduce marketing communications in the future, we will update this Policy and provide the choices required by applicable law before using personal data for that purpose.

5. Service providers and disclosures

We use service providers to host and secure our websites, prevent form abuse, transmit contact requests by email, route business messages, and manage business communications.

Cloudflare

Cloudflare provides infrastructure used to host and operate our websites and receive contact-form requests. A Cloudflare Worker temporarily processes information submitted through the contact form in order to validate the request and transmit it to our email service provider.

Cloudflare also processes limited technical, operational, and security information associated with requests. Operational and security logs may be retained according to the configuration and retention periods applicable to our Cloudflare service.

We intentionally use Cloudflare Web Analytics (RUM) to understand page views and website performance. Its beacon collects performance information from browser performance APIs, which may include page-view and navigation/referrer information, browser and device/environment information, and metrics such as Core Web Vitals. According to Cloudflare's current documentation, its RUM beacon does not use analytics cookies or access or store data in localStorage, sessionStorage, IndexedDB, or similar persistent client-side analytics storage. Cloudflare states that it discards the source IP address at its edge and does not store it in RUM core databases or logs. The beacon may generate a page-load ID for the current page view; Cloudflare describes its RUM/Vitals analytics as not fingerprinting individual visitors through IP address, user-agent, or other data.

Google Analytics 4

We use Google Analytics 4 only to understand aggregate use of cdecalvo.com and cdecalvo.com.br after a visitor allows analytics. Google Analytics may receive the measurement information described in Section 2, including a pseudonymous cookie or identifier used to distinguish browsers and sessions.

Our GA4 measurement configuration is limited to page views. We do not use Google Signals, Google Ads linking, remarketing, advertising personalization, User-ID, data import, Measurement Protocol, or contact-form data with Google Analytics. We configure allow_ad_personalization_signals as false. We also do not intentionally configure GA4 to collect information from form fields or URL parameters that could identify you.

Our GA4 data-sharing settings also permit Google to use Analytics data to improve Google products and services, and to use aggregated and de-identified measurement data for modeling and business insights. Google technical-support personnel may access Analytics data and our account when necessary to provide support. Google may also use account usage and configuration information to provide business recommendations. These settings do not link our property to Google Ads, and Google states that the Google products and services setting does not permit Google to use our Analytics data for its own advertising personalization or ad targeting.

Google explains how it uses information from sites and apps that use its services at How Google uses information from sites and apps that use its services.

We also use Cloudflare Turnstile to help distinguish legitimate visitors from automated or abusive traffic. Turnstile processes browser and security signals and a verification token for that purpose. We do not intentionally provide the name, email address, or message entered in the contact form to Turnstile as part of the Turnstile verification process.

Resend

We use Resend to transmit contact-form submissions by email. Resend may process the information included in the submission, such as name, email address, message, reply-to address, and delivery metadata.

Resend retains delivery-related data according to the retention periods applicable to our service plan and maintains backups according to its applicable security and retention practices.

Email routing and Gmail

We use Cloudflare Email Routing and Google Gmail to receive and manage business communications. Access to business communications is restricted to authorized personnel.

We do not sell personal data.

We may disclose information where required by law, legal process, or a valid governmental request, or where reasonably necessary to protect people, rights, property, or security.

6. International processing and transfers

Some of our service providers operate or store information outside Brazil, including in the United States. As a result, personal data submitted through our contact channels and limited technical/analytics data generated when the website is used may be processed internationally.

International processing may occur in order to receive, secure, transmit, store, and respond to requests submitted to us, operate and measure the performance of our websites, prevent abuse, and maintain business communications.

Where the LGPD applies, C de Calvo uses international-transfer mechanisms permitted by applicable law. This may include transfers necessary for contractual or pre-contractual procedures requested by the data subject, as permitted by the LGPD, together with contractual, technical, and organizational safeguards appropriate to the processing.

The principal providers currently involved in these flows include Cloudflare, Resend, Google Gmail, and, when you allow analytics, Google Analytics. Google Analytics data may be processed outside Brazil, including in the United States. Where the LGPD applies, C de Calvo uses international-transfer mechanisms permitted by applicable law and maintains appropriate contractual, technical, and organizational safeguards for the processing.

7. Retention

If an inquiry does not become a client relationship, we may retain the related correspondence for up to 12 months after the last meaningful interaction so that we can respond to follow-up questions, preserve relevant business history, or address disputes or questions concerning the inquiry.

For Google Analytics 4, we retain event data for two months and user-level data for 14 months. Aggregate reports may remain available after those periods because they no longer identify a browser or session in the same way. We may adjust these periods only by updating this Policy before or when the change takes effect where required.

We may delete information earlier when it is no longer necessary.

Records connected to a client relationship, billing, taxes, contracts, disputes, security matters, or legal obligations may be retained for a longer period when justified by that separate purpose or requirement.

8. Your rights and choices

Where the LGPD or another applicable privacy law applies, you may have rights regarding your personal data, including rights to request confirmation of processing, access, correction, anonymization, blocking or deletion where applicable, portability where applicable, information about certain disclosures, and review or objection in situations provided by law.

You may also have the right to file a complaint with the Brazilian National Data Protection Authority (ANPD) or another competent data-protection authority.

To exercise a privacy right, contact privacy@cdecalvo.com. We may need to verify your identity before completing a request and may retain information where applicable law permits or requires us to do so.

You may accept or reject analytics through our cookie and privacy settings on either website, and you may change your choice later through the same settings. Rejecting analytics does not prevent you from using the website or submitting a contact request. You can also manage or delete cookies through your browser settings and use Google's browser add-on to opt out of Google Analytics. These controls do not affect necessary security or anti-abuse technologies.

9. Security

We use technical and organizational measures appropriate to the nature and scale of our processing. These measures include access controls, account-security protections, abuse-prevention mechanisms, and safeguards for application secrets and service credentials.

No internet transmission, system, or storage method is completely secure, and we cannot guarantee absolute security.

10. Children

Our websites are intended for business audiences and are not directed to children. We do not knowingly request children's personal data through the contact form.

11. Cookies and similar technologies

We intentionally use Cloudflare Web Analytics (RUM) for privacy-oriented page-view and website-performance measurement. As described in Section 5, Cloudflare states that its RUM beacon does not use analytics cookies or persistent client-side analytics storage.

We use Google Analytics 4 on cdecalvo.com and cdecalvo.com.br, but only after you actively allow analytics through our cookie and privacy settings. Google Analytics uses first-party analytics cookies and pseudonymous identifiers, including the _ga cookie, to measure aggregate website use. We do not use Google Analytics for advertising, cross-site behavioral tracking, session replay, or remarketing.

You can accept, reject, or later change your analytics choice through our cookie and privacy settings on either website. Analytics is off by default. Necessary security and abuse-prevention technologies may use cookies, tokens, or similar browser storage where required for their function.

If we change our analytics, advertising, or other tracking technologies, we will update this Policy and implement any consent or notice mechanisms required by applicable law.

12. Changes to this Policy

We may update this Policy from time to time. When we do, we will publish the revised version with a new effective date and provide additional notice where required by law or appropriate because of the nature of the change.

13. Contact

Hamlet Arencibia Casanova LTDA (C de Calvo)
Rua Pais Leme #215 Conj 1713
Pinheiros, São Paulo, 05424-150, Brazil
privacy@cdecalvo.com