Privacy Policy

This policy explains, in plain language, which data CLW CONSULTORIA EM TI LTDA processes when you visit the website, contact us or use the platform and the portal, for what purpose, for how long, and how to exercise your rights under the Brazilian General Data Protection Law (Law No. 13,709/2018, the LGPD).

Last updated: September 28, 2026 · version 2026-09-20

1. Who we are

CLW CONSULTORIA EM TI LTDA, CNPJ 51.897.487/0001-98 ("CLW" or "we"), is the controller of the personal data processed under this policy.

The registration status of the company can be checked at any time on the REDESIM portal of the Brazilian Federal Revenue Service (Receita Federal): https://solucoes.receita.fazenda.gov.br/Servicos/cnpjreva/

Contact with our data protection officer (DPO) and the exercise of your rights under the LGPD are handled exclusively through the e-mail dpo@clwork.com.br. For any other matter, write to contato@clwork.com.br.

2. What data we process, why, and on what legal basis

Situation Data Purpose Legal basis (LGPD)
You fill in the contact form Name, job title, company, email, description of the process, number of people involved and tools used Reply to you and assess whether we can help Preliminary procedures at the data subject's request (art. 7, V)
Together with the form Origin of the visit (campaign parameters or referring site), entry page and language Understand which channels bring contacts Legitimate interest (art. 7, IX)
You contact us by email or WhatsApp Your contact details and the content of the message Handle your request Preliminary procedures at the data subject's request (art. 7, V)
You browse the website Anonymous counters of page views, contact button clicks and calculator use, with no cookies, no IP address and nothing that identifies you Improve the website Anonymized data (art. 12), with the option to refuse
Security and abuse prevention IP address and browser when the form is submitted; technical session data (IP and browser) during the visit Protect the website from abuse and fraud Legitimate interest (art. 7, IX)
You choose your cookie preferences A random code of your browser, your choice, policy version, date, language and the page where you chose. No IP address and no browser data Prove your consent and respect your choice Regular exercise of rights (art. 7, VI; art. 8, par. 2)
Platform and portal users (clients) Name, email, company, language, password (stored only in encrypted form, a "hash"), access records and the history of changes made by each user Authenticate, grant access, keep things secure and provide the contracted service Performance of a contract (art. 7, V) and legitimate interest (art. 7, IX)
System emails (invitations, password setup, alerts) Recipient name and email Send service communications Performance of a contract (art. 7, V)
You create a trial account on the self-service platform Name, work email, company name, language, chosen plan, password (only the "hash") and the acceptance of the Terms of Use (date and version). Before you confirm the email, what you typed travels encrypted inside the link we send and is not stored Create and run the account and prove the acceptance of the Terms of Use Performance of a contract and preliminary procedures (art. 7, V) and regular exercise of rights (art. 7, VI)
You subscribe to a plan CPF or CNPJ, company name, email and mobile phone (optional), sent to Asaas to issue the charge. We keep here only the identifier of the customer and of the subscription at Asaas, and the status and dates of payments: the CPF or CNPJ and the payment data are not in our database Charge the subscription and issue tax documents Performance of a contract (art. 7, V) and compliance with a legal obligation (art. 7, II)
Payment notifications from Asaas Identifiers of the charge and of the subscription, amount and payment status Keep the subscription status up to date and reconcile payments Performance of a contract (art. 7, V)
You record processes and measurements on the platform Name and description of the process, tools, number of runs, times, hourly cost, error rate, improvements and the responsible user. This is company data; we ask you not to include personal data of third parties Provide the contracted service Performance of a contract (art. 7, V)
You ask for consultancy from a process Your name and email, the company name and the summary of the process (baseline numbers, potential and your message), which become a commercial contact in our pipeline Answer your request and assess whether we can help Preliminary procedures at the request of the data subject (art. 7, V)
Business prospecting (B2B) Data from the public CNPJ registry of the Brazilian Federal Revenue: legal and trade name, activity, city, size, share capital, opening date, and the registered email and phone. When the email is in the name of a person, it is personal data Offer our services to companies in the Porto Alegre metropolitan region by email, sent one by one by a person on our team. The selection uses objective registry criteria and is reviewed by a person. Every message states where the contact came from and how to stop receiving them Legitimate interest (art. 7, IX), on data made public (art. 7, par. 4)

We do not use the data collected on the website for automated decisions or advertising, and we do not sell personal data.

3. Cookies and similar technologies

We only use what is necessary for the website and the client area to work. We do not use advertising cookies or cross-site tracking.

Name Type What it is for Duration
clwork-session Essential · first-party cookie Keeps your session and protects the form and the logged-in area 120 minutes
XSRF-TOKEN Essential · first-party cookie Protection against forms being submitted by third parties (CSRF) 120 minutes
remember_web_… Essential · first-party cookie, client area only Keeps you signed in when you tick "Remember me" at login Up to 400 days, or until you sign out
clw_consent Essential · browser local storage Stores your choice about anonymous counting and a random code of your browser, so we do not ask again Until you clear browser data or the policy changes
clw_attr Tab storage (sessionStorage) Keeps the origin of the visit while the tab is open, to send it with the form you decide to fill in. Only used if you allow anonymous counting Until the tab is closed

Third-party services: the website fonts are delivered by Google Fonts, and Google receives your IP address and browser data in that delivery; the WhatsApp button takes you to Meta's service, which has its own policy. We do not control cookies these services may set.

How to manage: you can change anonymous counting at any time in "Cookie preferences", in the footer of any page. You can also block or delete cookies in your browser, but without the essential ones the form and the client area stop working. We respect the browser's "Do Not Track" (DNT) and "Global Privacy Control" signals: with them, anonymous counting stays off until you allow it.

4. Automation Governance Portal: what it never processes

The Governance Portal is exclusively for automation execution data: status (running, success or failure), start and end date and time, duration, number of items processed and technical error messages. The portal never processes personal data or sensitive personal data contained in the registered automations: automations do not send such data to the portal, and the portal does not request, store or display it.

As an additional safeguard, email addresses and CPF or CNPJ numbers that appear by mistake in error messages are automatically masked before being saved. This protection does not replace each automation's duty not to include personal data in what it reports.

The only personal data processed in the portal is that of its own users, described in the "Platform and portal users" row of item 2.

CLW staff with administrative access can see, in the portal, the run data of the automations of any company, to operate and support the service. The processes, measurements and improvements of a self-service company do not appear in the CLW administration panel: the team only receives the summary of a process when the company itself makes a consultancy request.

5. Who we share data with

We do not sell personal data or share it for advertising. We only share it with those who help us operate the website and the service, to the extent necessary:

Some of these providers may store or process data outside Brazil. In those cases, the international transfer takes place under the situations set out in art. 33 of the LGPD.

6. How long we keep data

Data Period
Form and business contact For as long as needed to reply and keep the business relationship. We delete on request, unless the law requires us to keep it
Anonymous website counters 400 days
IP and browser from form submissions 90 days
Technical browser session Expires after 120 minutes of inactivity and is cleared by an automatic routine
Proof of cookie consent 5 years
Platform and portal user account While access is active. Afterwards, we delete account data at your request or the client company's, unless the law requires us to keep it
Automation execution data For as long as the automation exists in the portal; it is deleted together with it. The audit trail (which holds no personal data from the automations) is kept for security and accountability
Account and data of the self-service platform (processes, measurements, improvements, automations) As long as the account exists. When you delete the account from your profile, the company and this data are erased; on request, we also erase it. There is no automatic deletion period for inactive accounts
Acceptance of the Terms of Use As long as the account exists
Billing and subscription The identifier and status of the subscription stay while the account exists. Asaas and tax records keep billing data for the periods set by law
Payment notifications from Asaas 90 days
Consultancy request Like other commercial contacts: for as long as needed to answer and keep the relationship
Business prospecting Companies discarded, without an answer or that asked to stop: 365 days after the last change. The address of whoever asked to stop is kept on a block list, only to make sure it is not contacted again

7. Your rights

Under art. 18 of the LGPD, you may ask at any time for:

To exercise these rights, write to dpo@clwork.com.br. So that we can find your cookie preferences, tell us the code shown in "Cookie preferences". We reply within 15 days.

If you believe your rights were not respected, you may complain to the Brazilian National Data Protection Agency (ANPD) at www.gov.br/anpd.

8. Security

No system is completely immune to incidents. If an incident occurs that may cause relevant risk or harm, we will notify the data subjects and the ANPD, as the LGPD requires.

9. Children and teenagers

The website and the portal are aimed at companies and are not intended for people under 18. We do not intentionally collect data from children and teenagers.

10. Changes to this policy

We may update this policy. The date and version appear at the top of this page. If a change is relevant to your cookie choices, we will ask for your choice again.