Privacy Policy

01 Who processes your data

The controller of the personal data processed through this website is:

Legal name

DMX Design e Desenvolvimento Ltda.

CNPJ

21.946.075/0001-30

Address

Av. Nossa Sra. de Fátima, 240, 4º andar — Vila Israel, Americana/SP, Brazil

General e-mail

contato@dmxdesign.com.br

Phone / WhatsApp

(19) 99921-4663

Website

dmxdesign.com.br

Throughout this document, “DMX”, “we” and “our” refer to this company. “You” and “data subject” refer to the natural person to whom the personal data relate.

02 Data Protection Officer (DPO)

In compliance with art. 41 of the LGPD (Brazilian General Data Protection Law), DMX maintains a channel to receive communications from data subjects and from the National Data Protection Authority (ANPD).

03 Who this policy applies to

This policy applies to the processing of personal data of:

• Visitors to this website, including those who fill out contact forms or strategic diagnosis request forms;
• Representatives of clients and prospective clients with whom DMX interacts in the course of its business activities;
• Suppliers, partners and service providers, with respect to the data of their representatives;
• Job applicants, when they submit a résumé through DMX channels.

This policy does not apply to the processing of data that DMX carries out as a processor, on behalf and by order of its clients, within the platforms it develops and maintains. That scenario is addressed in section 16.

04 Personal data we collect

4.1. Data you provide to us

When you fill out the strategic diagnosis request form or contact us through our channels, we collect:

• Full name;
• Corporate e-mail;
• Phone / WhatsApp;
• Company and job title;
• Main challenge selected and, when filled in, the free-text field of context about your operation;
• Consent record: date, time and content of the text accepted.

4.2. Data collected automatically

As you browse this website, we collect, through our own and third-party technologies:

IP address and access logs

IP address, date and time of each access to the application, kept under the terms of art. 15 of Law No. 12.965/2014 (Brazilian Internet Civil Framework).

Device and browser data

Type and version of browser, operating system, screen resolution and configured language.

Source and campaign data

Source page and referral URL (referrer), as well as the campaign parameters present in the access address: utm_source, utm_medium, utm_campaign, utm_term and utm_content.

Page interaction data

Pages visited, time spent, scroll depth, button clicks and form completion steps.

Cookie and advertising identifiers

Identifiers stored on your device by the tools described in section 06.

4.3. Data from public and third-party sources

To qualify business opportunities, we may supplement the information you provided with data from public and professional sources — such as your company's institutional website, professional social networks and public CNPJ databases. We use only professional-context data, under the legal basis of legitimate interest.

05 Purposes and legal bases

The LGPD requires that all processing have a defined purpose and a specific legal basis (arts. 6 and 7). The table below shows this correspondence.

When processing is based on legitimate interest, DMX assesses in advance whether the purpose is legitimate, whether the processing is necessary and whether your expectations and fundamental rights are preserved. You may request information about this assessment through the Data Protection Officer channel.

06 Cookies and tracking technologies

Cookies are small files stored on your device. We use the following categories:

Analytics and advertising cookies are triggered only after your consent, expressed in the cookie notice shown on first access. You may review or withdraw that consent at any time, without prejudice to browsing.

6.1. Typefaces

This website loads fonts hosted on Google Fonts (fonts.googleapis.com and fonts.gstatic.com). In this process, your IP address is transmitted to Google. We disclose this transparently because it involves communication with a third party, even without storing a cookie.

6.2. Management through the browser

In addition to the cookie notice, you can block or delete cookies in your browser settings. Blocking essential cookies may compromise website features, such as form submission.

07 Who we share your data with

DMX does not sell personal data and does not transfer them to third parties for those third parties' own use. Sharing occurs only with processors who provide services to us, under contract and instruction, and in the legal cases below.

In the event of corporate reorganization, merger, acquisition or sale of assets, personal data may be transferred to the successor, who will be subject to this policy. We will notify data subjects whenever there is a relevant change in the purpose of the processing.

08 International data transfer

Some of our suppliers are based in or operate servers outside Brazil. This constitutes an international data transfer, permitted by arts. 33 to 36 of the LGPD.

In these situations, we adopt at least one of the following safeguards:

• Transfer to countries or bodies with an adequate level of protection recognized by the ANPD;
• Entering into specific or standard contractual clauses for data protection with the supplier;
• Verification of the supplier's certifications, policies and technical measures before contracting;
• Specific and prominent consent of the data subject, when it is the only applicable basis.

You may request information about the safeguards adopted for a specific supplier through the Data Protection Officer channel.

09 How long we keep your data

We keep personal data only for as long as necessary to fulfill the stated purposes, observing the legal time limits.

Once the period ends, the data are securely deleted or anonymized irreversibly, in which case they cease to be personal data and may be kept for statistical purposes.

10 Information security

DMX adopts technical and administrative measures to protect personal data against unauthorized access, loss, alteration and improper disclosure. Among them:

• Encryption in transit via TLS on all pages and form submissions;
• Role-based access control, granted under the principle of least privilege;
• Multi-factor authentication in corporate systems and cloud environments;
• Segregation of environments for development, staging and production;
• Audit logging of accesses and changes to databases;
• Supplier assessment and data protection clauses in contracts;
• Backup routine and restoration tests;
• Periodic training of the team in data protection and security.

11 Your rights as a data subject

Art. 18 of the LGPD guarantees you the rights below, exercisable free of charge and at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before it, nor does it prevent the retention of data whose keeping is required by law or necessary for the exercise of rights.

12 How to exercise your rights

1. Send your request to privacidade@dmxdesign.com.br, describing which right you wish to exercise.
2. We confirm receipt and, if necessary, request additional information to confirm your identity — an essential step so as not to disclose data to the wrong person.
3. We respond within 15 days from receipt, the period under art. 19, II of the LGPD. For requests to confirm existence or for simplified access, we respond immediately, in a simplified format, when possible.
4. If the request cannot be fulfilled, we inform you of the reasons of fact or law that justify the denial.

13 Automated decisions and profiles

DMX does not make decisions solely by automated means that produce legal effects or significantly impact your interests.

We use automated rules only to organize service — for example, to direct your request to the specialist with the appropriate technical profile, based on the job title and challenge you provided. All commercial and technical evaluation is conducted by people. Should there be any automated decision with a relevant effect, you may request review under the terms of art. 20 of the LGPD.

14 Data of children and adolescents

This website and DMX's services are intended for professionals and organizations, not for those under 18 years of age. We do not intentionally collect data from children or adolescents.

If we identify or are informed that we have received data from minors without the specific and prominent consent of at least one of the parents or legal guardian — a requirement of art. 14 of the LGPD —, we will delete such data. Communications to this effect should be sent to the Data Protection Officer channel.

15 Security incidents

DMX maintains a response plan for incidents involving personal data. Upon confirming the occurrence of an incident that may result in relevant risk or harm to data subjects, we will notify the ANPD and the affected data subjects within a reasonable time, in accordance with art. 48 of the LGPD, informing:

• the nature of the personal data involved;
• the information about the affected data subjects;
• the technical and security measures adopted to protect the data;
• the risks related to the incident;
• the reasons for any delay in the communication;
• the measures adopted or that will be adopted to reverse or mitigate the effects.

16 Data processed in client projects

In developing and maintaining platforms for its clients, DMX acts as a processor (art. 5, VII of the LGPD): it processes personal data on behalf of and according to the instructions of the client, who is the controller of that data.

In this scenario:

• Processing is governed by the contract and the data processing agreement signed with the client, not by this policy;
• DMX does not use this data for its own purposes, does not commercialize it and does not transfer it to third parties without the controller's authorization;
• The team's access is restricted to what is strictly necessary to perform the service, logged and revoked at the end of the activity;
• Preferably, we work in the client's own repository and cloud account, so that code, infrastructure and data remain under the client's control;
• Once the contract ends, the data are returned or deleted as instructed by the controller.

If you are a user of a platform developed by DMX and wish to exercise rights over your data, the request should be addressed to the controlling organization of that platform. We can guide you on the correct routing, if you prefer to write to us first.

17 Changes to this policy

This policy may be updated to reflect legislative changes, ANPD guidance, new services or new suppliers. With each revision, we change the version number and the last updated date shown at the top of this page.

In the event of a relevant change in the purposes or legal bases of the processing, we will notify data subjects through the available contact channels and, when the legal basis is consent, we will request a new expression of it.

We recommend consulting this page periodically.

18 Contact and National Authority

Questions, requests and complaints about privacy and data protection should be addressed to the Data Protection Officer channel:

You may also file a complaint with the National Data Protection Authority (ANPD), the body responsible for enforcing compliance with the LGPD, through the website gov.br/anpd. Even so, we prefer to resolve the matter directly with you — our channel is open.

Governing law and jurisdiction

This policy is governed by Brazilian law, in particular by Law No. 13.709/2018 (LGPD) and by Law No. 12.965/2014 (Brazilian Internet Civil Framework). The courts of the District of Americana, State of São Paulo, are elected to settle disputes arising from it, without prejudice to the jurisdictions provided by law in favor of the data subject or the consumer.