Privacy Policy
Effective as of October 17, 2026
This English text is a translation provided for convenience only. In the event of any discrepancy, the Portuguese version shall prevail.
This Policy explains how the company identified below processes personal data, in compliance with Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018).
It applies to tieafins.com.br and to the company's addresses on that domain, including news.tieafins.com.br, links.tieafins.com.br and apps.tieafins.com.br.
Data Protection Officer: José Mário da Silva Vieira Filho.
Channel for exercising your rights and asking questions: contato@tieafins.com.br.
1. Two different roles
The distinction below matters because it determines who is responsible for the data:
- As controller. With respect to visitors to this website, people who get in touch and its own clients, TI & Afins decides what data it collects and for what purpose. That is what this Policy describes.
- As processor. When it develops, hosts, maintains or supports a client's system, TI & Afins processes personal data of third parties (for example, the client's users, members or patients) following the client's instructions, since the client is the controller of that data. In those cases, the applicable privacy policy is the client's, the processing is governed by the contract with that client, and TI & Afins does not use the data for its own purposes, does not sell it and does not share it beyond what the contract provides.
2. Data we collect as controller
| Situation | Data | Purpose | Legal basis |
|---|---|---|---|
| Contact through the website, email or messaging | Name, email, phone number, company and the content of the message | To respond, prepare a proposal and keep a record of the interaction | Preliminary steps toward a contract (Art. 7, V) and legitimate interest (Art. 7, IX) |
| Engagement of services | Name or legal name, CPF (individual taxpayer ID) or CNPJ, address, email, phone number and legal representative | To issue the contract and invoice, bill for and provide the service | Performance of a contract (Art. 7, V) and legal and tax obligations (Art. 7, II) |
| Payment | Transaction and payment method data, processed by the payment processor | To receive and reconcile payments and prevent fraud | Performance of a contract (Art. 7, V) |
| Website access | IP address, date and time of access, browser and operating system, pages visited and aggregate browsing data | Security, abuse prevention and audience measurement | Legal obligation under Brazil's Internet Civil Framework, the Marco Civil da Internet (Art. 7, II), and legitimate interest (Art. 7, IX) |
We do not collect sensitive data (racial origin, religious belief, political opinion, union membership, health data, biometrics) in our capacity as controller, and the website is not directed at anyone under 18.
We do not store credit card data. Card payments take place directly in the environment of the payment processor engaged by us, which is the party that processes that data.
3. Cookies and audience measurement
The main website, tieafins.com.br, does not use Google Analytics or any other measurement cookie. Its audience is measured by Cloudflare Web Analytics, described below, without cookies.
The news.tieafins.com.br portal and the links.tieafins.com.br page use Google Analytics, a Google service, which sets cookies in the browser (_ga and similar) to measure visits, traffic sources and the most visited pages. This measurement is used in aggregate, to understand how those addresses perform, and not to identify you individually or for targeted advertising.
Legal basis: legitimate interest (Art. 7, IX of the LGPD), to the extent necessary to evaluate and improve the service. You may object at any time by blocking cookies in your browser or by using the Google Analytics opt-out browser add-on.
This website does not use advertising cookies or cross-site tracking cookies.
The website is served through Cloudflare infrastructure, which sets technical cookies needed for security, abuse protection and the anti-bot verification on the contact form.
Cloudflare also provides its own audience measurement (Cloudflare Web Analytics), without cookies and without identifying the visitor, used to monitor performance and availability.
There is also aggregate, cookie-free measurement based on the access logs described in section 2, used for security and to monitor infrastructure performance.
You can block or delete cookies in your browser settings. Blocking technical cookies may prevent the contact form from being submitted.
4. Who we share data with
We do not sell personal data. We share only what is necessary, with:
- Cloudflare, for hosting, website delivery, security, anti-bot verification and cookie-free audience measurement;
- Google, for the email service used to handle inquiries and for audience measurement (Google Analytics) on the News portal and the links page;
- Payment processors, to process card, PIX or boleto payments;
- Our accountants and government agencies, when necessary to issue invoices and comply with tax obligations;
- Authorities, when there is a legal request or a court order.
Some of these providers maintain servers outside Brazil. International transfers take place under Articles 33 et seq. of the LGPD and are limited to what is necessary to provide the service.
5. How long we keep data
- Contact messages that did not lead to a contract: up to 2 years, to resume conversations and maintain a commercial record;
- Contract and tax data: for the period required by tax and civil law, generally 5 years after the relationship ends;
- Website access logs: 6 months, as required by Article 15 of the Marco Civil da Internet, unless otherwise ordered;
- Data processed as processor: for the period defined by the client acting as controller; at the end of the contract, the data is returned or deleted according to the client's instructions.
Once the retention period ends, the data is deleted or anonymized, unless the law requires a longer retention period.
6. Security
We adopt technical and administrative measures appropriate to the size of our operation, including: HTTPS-encrypted traffic, access control through individual credentials, two-factor authentication on administrative accounts, the principle of least privilege, environment segregation, access logging, backup routines on the systems we manage, dependency updates and periodic vulnerability scanning.
No system is completely immune. If a security incident occurs that may pose a significant risk to data subjects, we will notify those affected and Brazil's National Data Protection Authority (ANPD), as required by Article 48 of the LGPD.
7. Your rights
The LGPD guarantees you, as the data subject, the right to obtain: confirmation that we process your data; access to it; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of data that is unnecessary or processed in violation of the law; portability; information about who we share it with; information about the possibility of not giving consent and the consequences of doing so; and withdrawal of consent, when the processing is based on it.
To exercise any of these rights, write to contato@tieafins.com.br. We respond within 15 days. We may ask for additional information to confirm your identity, solely to avoid disclosing your data to someone else.
If the request concerns data we process as processor, within a client's system, we will forward the request to the client acting as controller and let you know, because the client is the one who makes decisions about that data.
You may also file a complaint with the National Data Protection Authority (gov.br/anpd).
8. Changes to this Policy
This Policy may be updated. The current version is always the one published on this page, with the effective date at the top. Material changes are communicated to active clients by email.