Privacy Policy

Section 01

Introduction

EZ Softwares Ltda ("EZ Soft", "we", "our" or "us") is a software development and technology services company registered in Brazil under CNPJ 18.531.719/0001-14, with its principal place of business at Avenida Cesário Alvim, 3813, Andar 1, Uberlândia-MG, Brazil. We operate the website at ezsoft-us.site and any associated subdomains or digital properties (collectively, the "Site").

This Privacy Policy describes the personal data we collect when you visit our Site, request information about our services, submit a contact form, or otherwise interact with us digitally. It also explains the legal bases on which we process that data, who we may share it with, how long we retain it, and how you can exercise your rights as a data subject.

By using our Site, you acknowledge that you have read and understood this policy. If you do not agree with any part of it, please discontinue use of the Site and refrain from submitting personal data to us. Where required by applicable law, we will seek your explicit consent before processing your data.

Section 02

Information We Collect

We collect only the personal data that is strictly necessary for the purposes described in this policy. We do not purchase or rent third-party marketing lists, and we do not collect sensitive categories of personal data (such as health, biometric or political information) through this Site.

Data you provide directly

When you fill in a contact form, request a project quote, or reach out to us by email, you may provide us with:

• Full name — to address you personally and to associate your inquiry with your account or project record.
• Email address — our primary channel for responding to your inquiry, sending project updates, or delivering requested information.
• Phone number — provided optionally when you prefer a telephone consultation or quick follow-up call.
• Company name and role — to understand your business context and tailor our service proposals accordingly.
• Message content — the specifics of your question, project description, or support request, which may incidentally include other personal details you choose to share.

The submission of a contact form constitutes a voluntary act. You are not legally required to provide this information; however, without it we cannot respond to your inquiry or provide the requested service.

Data collected automatically

When you browse our Site, certain technical information is collected automatically through server logs, cookies and analytics tools. This includes:

• IP address — used to determine approximate geographic region, detect abuse, and maintain server security logs. IP addresses may be considered personal data under LGPD and GDPR.
• Browser type and version — helps us ensure the Site renders correctly across devices and environments.
• Operating system — used for compatibility analysis.
• Referring URL and exit pages — to understand how visitors discover our Site and which content is most relevant.
• Pages visited and time spent — aggregated to improve site structure and user experience.
• Cookie identifiers and session data — see Section 4 for a full explanation of our cookie use.
• Device identifiers — including screen resolution and device type (desktop, mobile, tablet), collected anonymously for responsive design optimization.

Section 03

How We Use Your Information

We process personal data only for specific, explicit and legitimate purposes. Below is a full account of each purpose alongside its legal basis under LGPD and GDPR.

• Responding to inquiries and providing pre-sale support. When you contact us through the Site's forms, we use your name, email and message content to respond substantively and accurately. Legal basis: performance of a pre-contractual measure at the data subject's request (LGPD Art. 7, II; GDPR Art. 6(1)(b)).
• Delivering contracted services. If you become a client, the personal data collected during onboarding is used to manage your project, issue invoices and communicate about deliverables. Legal basis: contract performance (LGPD Art. 7, V; GDPR Art. 6(1)(b)).
• Analytics and site improvement. Aggregated, pseudonymized browsing data helps us understand which pages perform well, where users drop off, and how to improve our content. Legal basis: legitimate interests (LGPD Art. 7, IX; GDPR Art. 6(1)(f)) — specifically our interest in maintaining a functional and relevant website, which does not override your rights.
• Advertising campaign measurement. We may use aggregated, anonymized conversion data (e.g. whether a form was submitted after clicking an ad) with platforms such as Google Ads to measure campaign effectiveness. We do not share personally identifiable information with ad platforms for targeting without your explicit consent. Legal basis: consent (LGPD Art. 7, I; GDPR Art. 6(1)(a)) where applicable, or legitimate interests for aggregated measurement.
• Legal compliance and fraud prevention. We retain certain records to comply with Brazilian tax law, respond to lawful requests from authorities, or protect against fraudulent or abusive use of our systems. Legal basis: compliance with a legal obligation (LGPD Art. 7, II; GDPR Art. 6(1)(c)).
• Direct communication about our services. If you have previously inquired about or engaged our services, we may send you relevant updates about similar offerings. You may opt out at any time. Legal basis: legitimate interests (LGPD Art. 7, IX; GDPR Art. 6(1)(f)) or, where required, consent.

We do not use automated decision-making or profiling systems that produce legal or similarly significant effects on individuals, as defined under LGPD Art. 20 and GDPR Art. 22.

Section 04

Cookies & Tracking Technologies

Our Site uses cookies — small text files stored in your browser — alongside similar tracking technologies such as web beacons and pixel tags. Some are essential to the Site's functioning; others are used for analytics and, where you have consented, for advertising measurement.

Essential cookies

These cookies are strictly necessary to deliver the Site and cannot be switched off without impairing core functionality. They do not store personally identifiable information and are not used for marketing. Examples include session state management and security tokens that prevent cross-site request forgery.

Analytics cookies

We use Google Analytics (operated by Google LLC) to collect aggregated, pseudonymized data about how visitors interact with the Site — pages viewed, session duration, device types and geographic region at country/city level. Google Analytics uses cookies such as _ga, _gid and _gat. IP anonymization is enabled, meaning the last octet of your IP address is zeroed before storage. The data is processed by Google on servers that may be located outside Brazil or the EEA; Google is a certified participant under the EU-US Data Privacy Framework. You can opt out of Google Analytics across all sites by installing the Google Analytics Opt-out Browser Add-on.

Advertising & measurement cookies

If you arrive at our Site via a Google Ads campaign, Google may set measurement cookies (such as _gcl_au and conversion cookies) to attribute your visit or a subsequent form submission to an ad click. This data is aggregated and used solely to evaluate campaign performance — it does not result in personalized ad targeting without your explicit consent. You may opt out of interest-based advertising through the Google Ads Settings page or via the Network Advertising Initiative opt-out tool.

Managing your cookie preferences

You can configure or withdraw cookie consent at any time through your browser settings. Instructions vary by browser: in Chrome, go to Settings → Privacy and Security → Cookies; in Firefox, go to Options → Privacy & Security. Disabling non-essential cookies will not affect your ability to view our content, though some features relying on session data may behave differently. Where we are legally required to obtain prior consent for non-essential cookies (e.g. for users in the EEA), we present a consent banner on first visit.

Section 05

Sharing With Third Parties

We do not sell, rent, trade or otherwise transfer your personal data to unaffiliated third parties for their own commercial purposes. We share data only in the limited circumstances described below, and always on the basis of a lawful justification and, where applicable, contractual safeguards.

• Technology and infrastructure providers. We use hosting, email delivery and CRM services to operate the Site and manage client communication. These providers act as data processors under contracts that prohibit them from using your data for any purpose other than providing the service to us. Current categories of processors include web hosting (server infrastructure), transactional email (form notification delivery) and project management software.
• Analytics services. As described in Section 4, aggregated and pseudonymized usage data is shared with Google Analytics LLC under data processing terms that comply with applicable law.
• Advertising platforms. Aggregated, anonymized conversion signals may be shared with Google Ads for campaign measurement purposes. We do not share personally identifiable form data with ad platforms.
• Legal requirements. We may disclose personal data to government authorities, courts or law enforcement agencies when required to do so by applicable Brazilian law, a court order, or equivalent legal process — or when necessary to protect the safety of individuals or to defend against legal claims.
• Business transfers. In the event of a merger, acquisition, asset sale or reorganization of EZ Softwares Ltda, personal data may be transferred to the acquiring entity, provided the receiving party agrees to honor the protections set out in this policy. You will be notified via the Site or by email before your data becomes subject to a materially different privacy policy.

Any international transfers of personal data (for example, to processors based in the United States or European Union) are conducted under contractual safeguards — Standard Contractual Clauses recognized by the ANPD and European Commission, or transfers to countries that provide an adequate level of protection.

Section 06

Data Retention

We retain personal data only for as long as necessary to fulfill the purpose for which it was collected or to comply with applicable legal obligations. When data is no longer needed, we delete or irreversibly anonymize it. The following retention schedules apply:

• Contact form submissions (pre-sale inquiries). Retained for up to 24 months from the date of submission. If an inquiry converts to an active project, the data is merged into the client record described below. If no engagement follows, data is deleted at the 24-month mark.
• Active client records. Personal data associated with a contracted engagement is retained for the duration of the contract plus 5 years, in compliance with Brazilian civil and tax law requirements (Código Civil, Art. 206; Lei 9.430/1996).
• Analytics data. Pseudonymized analytics data collected through Google Analytics is retained for 14 months within Google's systems (our configured retention period). After this period, data is automatically deleted from Google's servers and cannot be reconstructed.
• Server access logs. Raw server logs containing IP addresses are retained for up to 90 days for security monitoring and then automatically purged. Aggregated, anonymized derivatives may be retained indefinitely for capacity planning.
• Marketing communications. Where we send you service-related communications, we maintain your contact preference record for as long as you remain reachable and have not opted out, plus a short window thereafter to suppress future sends.

You may request early deletion of your personal data at any time — see Section 8 (Your Rights) for how to do so. Note that early deletion may prevent us from honoring any ongoing service obligation, and some data must be retained to satisfy legal obligations regardless of a deletion request.

Section 07

Data Security

EZ Softwares Ltda implements appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, destruction, alteration or disclosure. Our security posture includes:

• Transport encryption. All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher. Our Site enforces HTTPS site-wide with HSTS headers.
• Access controls. Personal data held in our internal systems is accessible only to staff and contractors with a legitimate need. Access is governed by role-based permissions and reviewed periodically.
• Data minimization. We collect only the fields genuinely required for each purpose, reducing the scope of any potential exposure.
• Vendor due diligence. We select data processors that provide sufficient guarantees of technical and organizational security measures, as required by LGPD Art. 46 and GDPR Art. 28.
• Breach response. In the event of a personal data breach, we will notify the ANPD and affected data subjects within the timeframes required by LGPD Art. 48, and will take immediate remediation steps.

Despite our best efforts, no method of electronic storage or internet transmission is completely secure. We cannot guarantee the absolute security of information transmitted to us over the internet; you do so at your own risk. Once we receive your transmission, we maintain the safeguards described above.

Section 08

Your Rights

Under both LGPD and GDPR, you have meaningful rights over your personal data. We take these rights seriously and will respond to valid requests without undue delay — in most cases within 15 business days, and no later than 30 days from receipt of your request (with a possible extension of an additional 30 days where requests are complex or numerous).

How to exercise your rights

To exercise any of the rights listed above, please send a written request to contato@ezsoft-us.site with the subject line "Data Rights Request". Please include your full name and, if applicable, the email address you used when contacting us, so we can locate your data accurately. We may ask you to verify your identity before processing your request — this is to protect you against unauthorized access to your information.

We do not charge a fee for handling rights requests unless they are manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or decline to act, explaining our reasons.

Section 09

Children's Privacy

Our Site and services are directed exclusively at businesses and adult professionals. We do not knowingly collect personal data from children under the age of 18. Our contact forms and service offerings are designed for business-to-business engagements, and we have no reason to interact with minors in the ordinary course of our operations.

If you are a parent or guardian and believe that your child has submitted personal data to us without your knowledge or consent, please contact us immediately at contato@ezsoft-us.site. We will investigate promptly and delete any such data from our records as quickly as practicable.

Under Brazil's LGPD (Art. 14), processing of children's data requires the specific consent of at least one parent or legal guardian. We consider this requirement effectively inapplicable to our Site given its strictly B2B nature, but we take our obligations seriously and will act swiftly to remedy any inadvertent collection.

Section 10

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the services we offer, applicable law, or guidance from the ANPD or other competent authorities. When we make material changes — for example, changes that affect how we use your data or your rights — we will update the "Last updated" date at the top of this page and, where the change is particularly significant, we will take additional steps to inform you, such as placing a notice on the Site's homepage or sending an email to contacts in our mailing list.

We encourage you to review this policy periodically. Your continued use of the Site after any revision indicates your acceptance of the updated policy, to the extent permitted by applicable law. Where changes require fresh consent, we will request it before relying on the new basis.

Previous versions of this policy can be requested by email and will be provided within a reasonable time. We maintain a version archive internally and can confirm the effective dates of prior policies upon request.

Section 11

Contact Us

If you have any questions, concerns or requests relating to this Privacy Policy or our data processing activities, please reach out to us directly. We take all privacy inquiries seriously and commit to responding promptly and transparently.

You may also direct complaints or questions about the processing of your personal data to the Brazilian national supervisory authority, the Autoridade Nacional de Proteção de Dados (ANPD), via its official website at www.gov.br/anpd. For data subjects in the European Economic Area, the relevant supervisory authority is the one in your country of residence or the country where the alleged infringement took place.