Privacy Policy

Last updated: October 6, 2026
This is a translation of the original Portuguese version. In case of any discrepancy between versions, the Portuguese version prevails, as the language of the company’s jurisdiction (Brazil).

This Privacy Policy describes how Nexa Digital Ltda, registered with Brazil’s CNPJ under No. 57.542.168/0001-46 and operating under the institutional brand Grupo Nexa (“Nexa,” “we,” “us” or “our”), collects, uses, stores, shares and protects the personal information of visitors to this website (ogruponexa.com.br), in compliance with Brazil’s General Data Protection Law (Law No. 13,709/2018 — LGPD).

1. Who the data controller is

The controller of the personal data collected through this website is:

• Legal name: Nexa Digital Ltda
• CNPJ: 57.542.168/0001-46
• Address: R. Antonio Basil Schroeder, 37 · Barreiros · São José · SC · CEP 88.110-400 · Brazil
• Email: contact@ogruponexa.com

2. Data Protection Officer (DPO)

Pursuant to art. 41 of the LGPD, we designate the following person as the officer in charge of the processing of personal data (“Encarregado,” under the LGPD):

• Name: Gustavo Alves da Cruz
• Contact: contact@ogruponexa.com

3. Data we collect

3.1. Browsing data

When you visit this website, we automatically collect minimal technical information needed for the basic operation of the page and for aggregate audience statistics, including:

• IP address (recorded in aggregate/anonymized form)
• Browser type, operating system and language
• Pages visited and time spent on them
• Traffic source (previous referring URL)

3.2. Essential technical cookies

We use local storage that is strictly necessary for the website to work, including:

• Language preference (PT, ES or EN)

These preferences are stored locally in your browser (localStorage) and are not shared with third parties.

3.3. Data you provide voluntarily

If you contact us by email or through other official channels, we collect only the information you choose to provide voluntarily (name, email, phone number, company, message content), for the sole purpose of responding to your request.

4. Legal bases and purposes of processing

We process your personal data on the following legal bases set out in art. 7 of the LGPD:

• Consent (art. 7, I) — for non-essential cookies and communications;
• Compliance with a legal or regulatory obligation (art. 7, II) — when required by law;
• Performance of a contract (art. 7, V) — to handle commercial requests;
• Legitimate interest (art. 7, IX) — for information security and aggregate statistical analysis.

5. Data sharing

We do not sell, rent or trade personal data under any circumstances. We may share strictly necessary data with:

• Infrastructure providers (website hosting);
• Public authorities, upon a court order or an express legal requirement;
• Operational partners, only when necessary to respond to your request and under a confidentiality agreement.

6. International data transfers

Because we operate in more than one market and some of the providers we use (infrastructure, web fonts and advertising) are based abroad, certain operations may involve international data transfers. When this happens, we will ensure that such transfers comply with the requirements of Chapter V of the LGPD, including specific contractual clauses and adequacy to the level of protection required by the Brazilian authority.

7. Retention period

Data is kept for as long as necessary to fulfill the purposes for which it was collected, subject to the applicable legal periods, in particular:

• Browsing data: up to 12 months;
• Voluntary contact data: up to 5 years from the last interaction;
• Records required by law: for the corresponding legal period (e.g., Brazil’s Internet Civil Rights Framework — Marco Civil da Internet — 6 months).

8. Your rights as a data subject

Under art. 18 of the LGPD, you may at any time exercise the following rights regarding your personal data:

• Confirmation that processing takes place;
• Access to the data;
• Correction of incomplete, inaccurate or outdated data;
• Anonymization, blocking or deletion of unnecessary data or data processed in breach of the LGPD;
• Data portability;
• Deletion of data processed on the basis of consent;
• Information about the entities with which we share data;
• Information about the possibility of withholding consent and its consequences;
• Withdrawal of consent, at any time.

To exercise any of these rights, contact us by email at contact@ogruponexa.com. We will respond to your request within 15 (fifteen) days from the date of your request (art. 19 of the LGPD); confirmation of existence or access in simplified form is provided immediately (art. 19(I)).

9. Information security

We adopt appropriate technical and organizational measures to protect your data against unauthorized access, accidental loss, alteration or destruction. These include encryption in transit (HTTPS/TLS), role-based access control, audit logs and periodic security reviews.

Despite these efforts, no system is completely invulnerable. If we identify any security incident that may pose a relevant risk or harm to data subjects, we will notify Brazil’s National Data Protection Authority (ANPD) and the affected data subjects within a reasonable period, as required by art. 48 of the LGPD.

10. Contacting the National Authority

You have the right to file a complaint with the National Data Protection Authority (ANPD) if you believe that the processing of your data does not comply with the LGPD. Visit www.gov.br/anpd.

11. Changes to this policy

This Policy may be updated at any time to reflect legal, operational or technological changes. The date of the last update will always appear at the top of this document. We recommend reading it periodically.

12. Contact

If you have any questions about this Policy or about the processing of your personal data, contact us by email at contact@ogruponexa.com or by phone at +55 (67) 99131-2256.