Privacy policy

This policy explains which personal data UAI Works processes on the website www.uaiworks.com, on what basis, who it is shared with, how long it is kept and how you exercise your rights, under the Brazilian General Data Protection Law (Law 13,709/2018, LGPD). It describes only what the site does today; when something changes, the date at the top of this page changes with it.

Who the data controller is

The controller is LAB WORKS CONSULTORIA E SISTEMAS, registered under CNPJ 60.256.362/0001-70, with registered office at Rua Riachuelo, 1452, Padre Eustáquio, Belo Horizonte, MG, ZIP 30720-060, Brazil, doing business as UAI Works. It decides what is processed on this site and for what purpose.

Technical browsing data

When you access the site, the hosting infrastructure may automatically process technical data needed for the service to work and stay secure, such as IP address, browser and device information, date and time of the request and the page accessed.

To know how many people visit each page and where they come from, UAI Works uses Umami, an audience measurement tool that uses no cookies, does not store the IP address and does not identify who visits. The numbers are always aggregated — visits per page, country, language, device type and referring site or campaign — and never make it possible to know who you are. From the page address, only the campaign parameters (utm_*) are passed on to Umami. The site uses no cookies or behavioral advertising, and stores your language preference in your browser when you choose one.

Beyond that technical infrastructure data, data provided directly by the visitor is only processed when the visitor starts a contact or requests material made available by UAI Works.

Contact form

On the contact page, the data you fill in (name and email required; phone and company optional; subject and message), the page address, the language you were using and the campaign parameters of the link you arrived through (such as utm_source) are stored in UAI Works' internal system, in a Google Cloud (Firebase) database located in São Paulo, Brazil, together with the date the consent box was ticked. The message is stored and the team is notified by email. If storing in the system fails, the message goes straight to the UAI Works mailbox, hosted on Microsoft 365, through the Web3Forms service, which acts as a processor: it receives the form content and delivers it by email, without using it for its own purposes.

Before sending, you tick the consent box linking to this policy. A hidden field and a minimum fill-in time block robots; none of your data is used for that. When you send, the Google component that stores the form keeps a technical operating record in your browser — the date and the component version —, with none of your data.

We do not process sensitive personal data (article 5, II, of the LGPD) and do not intentionally process data of children and adolescents: the site is aimed at professionals.

What the data is used for

• Answering your contact and carrying on the conversation you started.
• Knowing which pages and campaigns contacts come from, to decide what to publish — without building advertising profiles.
• Notifying the UAI Works team by email when someone leaves their data, so the contact is answered quickly.
• Keeping the site online, available and secure.

Inside UAI Works, only authorised team members access this data, through an internal panel with login, where they record how each conversation is going.

Data is not sold, rented or handed to third parties for their own use, and does not feed third-party advertising.

Legal bases

Data provided voluntarily in forms that carry an express request for consent is processed on the basis of consent, under article 7, I, of the LGPD.

Technical data needed for the site to work, stay available and secure may be processed to the extent necessary for those purposes, on the basis of UAI Works' legitimate interest in maintaining and protecting its digital infrastructure (article 7, IX, of the LGPD), always observing the rights and legitimate expectations of data subjects.

When a contact is sent directly by email, the data is processed to answer the request and carry on the relationship started by the data subject, according to the purpose of the contact.

Who the data is shared with

• Google Cloud (Firebase): the database where forms are stored, located in São Paulo, Brazil. It acts as a processor, under the controller's instructions.
• Resend: the service that delivers the internal new-contact notifications to the team. It acts as a processor, with servers outside Brazil.
• Web3Forms: the contact form's fallback path — when storing in the system fails, it is the service that receives the message content and delivers it by email to UAI Works. It acts as a processor, under the controller's instructions, with servers outside Brazil (Amazon Web Services infrastructure).
• Microsoft 365: UAI Works' email infrastructure, where form messages arrive and are kept. Microsoft acts as a processor, under the controller's instructions.
• Umami: cookie-free audience measurement, described above; receives the IP address only to identify the country, without storing it.
• Google (Firebase Hosting): the infrastructure that serves this site's pages and processes the technical browsing data described above. Google acts as an infrastructure processor and does not use that data for its own purposes.

Beyond these, data is only shared under a legal, regulatory or judicial obligation.

International data transfers

Some of the service providers used by UAI Works may process or store personal data on infrastructure located outside Brazil. That is the case of Web3Forms, which delivers the contact form messages when storing in the system fails, of Resend, which delivers the internal new-contact notifications, of Umami, which measures the audience on servers in the United States, and of the Firebase Hosting delivery network, which serves the pages from servers in several countries. The database where forms are stored is in Brazil.

In those situations, UAI Works adopts measures intended to ensure that the international transfer of data complies with the LGPD and with the applicable regulations of the Brazilian National Data Protection Authority (ANPD).

The transfer is limited to what is necessary to provide the contracted services and for the purposes described in this policy.

How long the data is kept

We keep contact form data and messages for up to 12 months after your last interaction with us — the last form sent or the last message exchanged. The LGPD does not set a number of months: it requires processing to end when its purpose is fulfilled and the data to be deleted afterwards (articles 15 and 16), which is what this period applies. Before that, we delete on your request. We only keep data longer when a legal obligation requires it, and only for as long as that obligation lasts.

Technical browsing data is kept by the hosting infrastructure only for the period needed for the security and operation of the service.

Your rights

Article 18 of the LGPD guarantees you, at any time and free of charge:

• confirmation that your data is being processed;
• access to the data we hold about you;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of data that is unnecessary, excessive or processed unlawfully;
• portability of the data to another provider, as regulated;
• deletion of data processed with your consent;
• information about who we share your data with;
• information about the possibility of not consenting and what that implies;
• withdrawal of consent.

When applicable, you may also:

• object to processing carried out without consent when the LGPD is not complied with;
• file a petition regarding your data with the Brazilian National Data Protection Authority (ANPD) or consumer protection bodies;
• request review of a decision taken solely on the basis of automated processing that affects your interests;
• request clear information about the criteria and procedures used in automated decisions, when applicable.

This site currently makes no automated decisions with relevant effects on visitors.

How to exercise your rights

Write to contato@uaiworks.com with your request and the email address you used to contact us. We reply by the same email. If the request is for deletion, we delete the message from the mailbox that received it and every record of your forms in our system.

Data protection officer

The data protection officer (DPO), under article 41 of the LGPD, is Leonardo Almeida Bastos, at contato@uaiworks.com.

Changes to this policy

When this policy changes, the update date at the top of the page changes with it. The version in force is always the one published at this address.