Privacy Policy

Section 01

Introduction

FLUX TECNOLOGIA E SERVICOS LTDA ("Flux", "we", "our", or "us") is a Brazilian technology company providing professional telecommunications, connectivity, and managed IT infrastructure services. We are registered under CNPJ and operate in compliance with Brazilian and international applicable law.

This Privacy Policy explains how we collect, use, store, share, and protect personal information when you visit our website at flux-us.site (the "Site"), communicate with us by email or telephone, or otherwise interact with our company. It applies to all visitors, prospective clients, partners, and any other individuals whose data we may process in the course of our institutional and commercial activities.

We are committed to protecting your personal data and to being fully transparent about our practices. This policy has been drafted to meet the requirements of Brazil's Lei Geral de Proteção de Dados (LGPD — Law 13,709/2018) and, where applicable to data subjects located in the European Economic Area, the General Data Protection Regulation (GDPR — Regulation 2016/679). It also satisfies the landing-page transparency requirements of Google's advertising policies.

By accessing or using our Site, you acknowledge that you have read and understood this policy. If you do not agree with any part of it, you should discontinue use of the Site.

Section 02

Information We Collect

We collect personal information in different ways and for different purposes, depending on how you interact with us. The categories below describe the data we may hold about you.

Information you provide to us directly

When you reach out to Flux via email, telephone, or any direct written communication, you may voluntarily provide personal information such as:

• Your full name and professional title
• Your business email address and telephone number
• The name, CNPJ, or other identifiers of your organisation
• The nature of your enquiry, including any technical or business requirements you describe
• Any additional information you choose to include in your message

We do not operate any online contact forms, registration portals, or account-creation features on this Site. All personal data submitted voluntarily reaches us through external communication channels (email, phone) at your own initiative.

Information collected automatically when you visit the Site

When you browse flux-us.site, our web server and third-party analytics tools automatically collect certain technical and behavioural data, including:

• Your device's IP address (which may be partially anonymised before storage)
• Browser type, version, and operating system
• Pages visited, time spent on each page, and navigation path through the Site
• Referring URL (the page or advertisement that brought you to our Site)
• Date and time of each visit
• Screen resolution and device category (desktop, mobile, tablet)
• Cookie identifiers and similar tracking tokens, as described in Section 04

Information received from third parties

Occasionally, we may receive basic contact or firmographic information from our commercial partners, resellers, or industry referral networks in the course of facilitating a business introduction. When we receive such data, we treat it under the same standards described in this policy and will not use it for any purpose unrelated to the context in which it was shared.

Section 03

How We Use Your Information

Every use we make of your personal data is grounded in a clear, lawful basis as defined by both the LGPD and the GDPR. Below we describe each purpose, the data involved, and the corresponding legal basis.

• Responding to enquiries and pre-sales communication. When you contact us, we use your name, email, phone number, and the details of your enquiry to respond accurately and promptly. Legal basis: legitimate interests (LGPD Art. 7, X; GDPR Art. 6(1)(f)), or performance of pre-contractual steps at your request.
• Service delivery and contract performance. Where you are an existing client, we use contact and organisation data to manage your account, deliver contracted services, and communicate operationally. Legal basis: contract performance (LGPD Art. 7, V; GDPR Art. 6(1)(b)).
• Website analytics and performance optimisation. Aggregated, anonymised usage data helps us understand which parts of the Site are most useful and where we can improve content and navigation. Legal basis: legitimate interests.
• Advertising measurement and campaign effectiveness. We use advertising cookies and conversion tracking (see Section 04) to measure the performance of our Google Ads campaigns. This helps us allocate marketing resources responsibly and ensures prospective clients see relevant content. Legal basis: consent (LGPD Art. 7, I; GDPR Art. 6(1)(a)).
• Legal, regulatory, and security obligations. We may process and retain data to fulfil obligations imposed by Brazilian law (e.g. Marco Civil da Internet, tax legislation) or to defend against legal claims. Legal basis: compliance with legal obligation (LGPD Art. 7, II; GDPR Art. 6(1)(c)).

We do not make automated decisions that produce legal or similarly significant effects on individuals. We do not use your personal data for profiling purposes unrelated to the provision of our services, nor do we sell, rent, or otherwise commercially exploit your personal information to any third party.

Section 04

Cookies & Tracking Technologies

Our Site uses cookies and similar technologies to function correctly and to help us understand how visitors interact with our content. A cookie is a small text file stored in your browser when you visit a website. We use the following categories:

Strictly necessary cookies

These cookies are essential for the Site to load and navigate correctly. They do not collect any personally identifiable information and cannot be disabled without breaking core site functionality. No consent is required for these cookies, and they are never used for advertising.

Analytics cookies

We use Google Analytics 4 (GA4) to collect aggregated, pseudonymous data about how visitors use the Site — pages viewed, session duration, device type, and general geographic region. GA4 is configured with IP anonymisation enabled, meaning the final octet of each visitor's IP address is masked before any data is stored. This data is retained by Google under their own privacy policy and is used exclusively to help us improve the quality and relevance of our content. Analytics cookies are only placed after we have obtained your consent through our cookie consent mechanism.

Advertising and conversion-tracking cookies

We run campaigns through Google Ads. When you arrive at our Site via a Google advertisement and subsequently take an action we define as a conversion (such as clicking our email address or spending a defined minimum time on a page), Google's conversion-tracking cookie records that event and reports it back to our Google Ads account. This allows us to measure campaign return on investment without any personally identifiable information being transmitted to us directly. These cookies are only set with your consent.

Managing your cookie preferences

You can withdraw or modify your cookie consent at any time through your browser settings or our cookie preference panel (if present on the Site). You may also opt out of interest-based advertising via Google's own opt-out tools at adssettings.google.com, or use the industry-wide opt-out available at youronlinechoices.eu. Disabling analytics or advertising cookies will not affect your ability to browse or read content on this Site.

Section 05

Sharing With Third Parties

Flux does not sell or rent personal data to third parties under any circumstances. We share personal information only in the limited and controlled circumstances described below:

Where we engage data processors located outside Brazil, we take appropriate safeguards to ensure your data receives equivalent protection — including the use of standard contractual clauses, adequacy decisions, or equivalent mechanisms recognised under LGPD Chapter V.

Section 06

Data Retention

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by law. Our default retention standards are as follows:

• General enquiry and pre-sales correspondence: retained for up to 24 months from the date of last contact. If an enquiry progresses to a commercial relationship, the relevant records are retained for the duration of that relationship plus 5 years thereafter, in line with Brazilian civil and tax law requirements.
• Active client data: retained throughout the contractual relationship and for a minimum of 5 years after contract termination, to satisfy fiscal and regulatory obligations under Brazilian law (e.g. Lei 9,613/1998, RFB requirements).
• Web server access logs: retained for up to 12 months, consistent with the minimum storage period required by the Marco Civil da Internet (Law 12,965/2014) for connection records. Anonymised aggregates may be retained longer for statistical purposes.
• Analytics data in Google Analytics: configured with a 14-month data-retention window, after which user-level and event-level data is automatically deleted by Google's systems.
• Advertising conversion data: retained in Google Ads for up to 90 days at the event level, after which only aggregated campaign-level statistics persist.

When personal data is no longer required, we ensure it is securely deleted or irreversibly anonymised so that it can no longer be attributed to any identifiable individual.

Section 07

Data Security

Flux takes the security of personal data seriously. As a technology and infrastructure company, information security is embedded in our operational culture and extended to the protection of data we hold about the individuals we work with. Our security programme includes:

• Encrypted data transmission: All pages on flux-us.site are served exclusively over HTTPS using current TLS protocols. Email communications with sensitive content are handled through encrypted channels wherever possible.
• Access controls: Access to any stored personal data is restricted on a strict need-to-know basis. Employees and contractors who can access personal data are subject to confidentiality obligations and receive periodic security training.
• Infrastructure security: Our website and any data systems are hosted on hardened cloud infrastructure with firewall protection, intrusion-detection monitoring, and regular security patching.
• Vendor assessment: Third parties that process data on our behalf are evaluated for their security posture and are required to maintain appropriate technical and organisational measures as a condition of engagement.
• Incident response: In the unlikely event of a data breach that poses a risk to the rights and freedoms of affected individuals, we will notify the relevant supervisory authority (Brazil's ANPD) within the timeframe required by LGPD, and will notify affected individuals directly where required.

No method of electronic transmission or storage is 100% secure. While we do everything reasonably practicable to protect your personal data, we cannot guarantee absolute security. If you have reason to believe that your interaction with us has been compromised, please contact us immediately at contato@flux-us.site.

Section 08

Your Rights

Under the LGPD and, where applicable, the GDPR, you have meaningful rights over your personal data. We are committed to making it easy to exercise those rights. The table below summarises what you are entitled to:

To exercise any of the rights described above, please send a written request by email to contato@flux-us.site with the subject line "Data Rights Request". Please include your full name and sufficient information to allow us to identify you in our records. We will respond within 15 business days (as required by the LGPD), and in any event no later than one calendar month from receipt of your request (as required by the GDPR for EEA residents). We will not charge a fee for reasonable requests. If your request is manifestly unfounded or excessive, we reserve the right to charge a reasonable administrative fee or decline the request, explaining our reasons in writing.

Section 09

Children's Privacy

This Site and our services are directed exclusively to business professionals and corporate entities. We do not knowingly collect, solicit, or process personal data from children under the age of 18. If you believe that a minor has provided us with personal information, please contact us immediately at contato@flux-us.site and we will take prompt steps to delete that information from our systems.

In accordance with the LGPD's specific provisions on children and adolescents (Articles 14 and 15), any processing of data belonging to persons under 18 years of age would require the specific and highlighted consent of at least one parent or legal guardian, and could only take place to the extent strictly necessary for the child's best interests. As our services are not designed for minors, we do not anticipate any such circumstance arising.

Section 10

Changes to This Policy

We review this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, and business operations. When we make material changes — for example, to the categories of data we collect, the third parties we share data with, or the rights available to you — we will update the "Last updated" date at the top of this page.

For significant changes that materially affect how we handle your personal data, we may take additional steps to notify you, such as displaying a notice on our homepage for a defined period. We encourage you to review this policy each time you visit the Site to stay informed about how we are protecting your data.

Your continued use of the Site after any changes to this policy have been published constitutes your acknowledgement of the updated terms. If you disagree with the changes, you should discontinue use of the Site and may exercise your data rights as described in Section 08 above.

Section 11

Contact & Data Controller Details

The data controller responsible for the personal information collected and processed via this Site is:

If you are located within the European Economic Area and have concerns about how we handle your personal data that we have been unable to resolve to your satisfaction, you have the right to lodge a complaint with your local data protection supervisory authority. A directory of EEA supervisory authorities is maintained at edpb.europa.eu. For complaints relating specifically to Brazilian data protection law, the competent authority is the Autoridade Nacional de Proteção de Dados (ANPD), accessible at gov.br/anpd.