Privacy & Cookies Policy

1. Information we collect

We collect personal data you provide directly, data generated while you use the site, and information received from third parties. The categories of data and data subjects include:

• Identification and contact — name, surname, business email, phone, company and job title.
• Browsing — IP address, device and browser type, and pages visited (see section 5).
• Communication — content of contact forms, demo requests and messages.
• Applicants — data submitted in recruitment processes and job openings (résumé and contact).
• Employees — personal data processed in DataDike’s people management.
• Security researchers — contact data when reporting vulnerabilities to DataDike.

2. Collection criteria and principles

We process personal data lawfully, fairly and transparently, limited to the purposes disclosed. We apply the principles of data minimization — collecting only what is necessary — purpose limitation, adequacy, accuracy, security and accountability set out in the LGPD and the GDPR.

3. Why we use your data

We use your personal data to:

• Provide, operate and improve the site and our services.
• Manage accounts and authentication.
• Respond to contact, demo and commercial requests.
• Comply with contractual, legal and regulatory obligations.
• Send institutional and marketing communications, with your consent.
• Prevent fraud, ensure security and protect our rights.

4. Legal bases for processing

Processing of personal data is grounded on one or more of the following legal bases: performance of a contract or pre-contractual steps at your request; compliance with a legal or regulatory obligation; the data subject’s consent; and DataDike’s legitimate interests, always respecting your fundamental rights and freedoms.

5. Cookies and similar technologies

We use cookies and technologies that are strictly necessary for the site to function — for example the csrftoken cookie, which protects form submissions. For audience measurement we use Cloudflare Web Analytics, which does not use cookies. We do not use marketing cookies. Any analytics tool that uses cookies, such as Google Analytics, will only be activated with your prior consent.

• Essential — required for the site to function and be secure (e.g., csrftoken).
• Audience measurement — Cloudflare Web Analytics, cookieless.

6. Data sharing

We do not sell your personal data. We may share it with processors acting on our behalf, in the following categories: accounting firm; infrastructure and hosting provider; identity and collaboration provider; and a partner educational institution.

We use Cloudflare as CDN, WAF and for audience measurement (Cloudflare Web Analytics, cookieless), which involves processing your IP address, and Cookiebot (Cybot A/S, Denmark) to manage cookie consent. The homepage may load images hosted on Unsplash, which sends your IP address to that provider in the United States. We may also share data with public authorities where required by law.

7. International data transfers

Some providers that support DataDike’s operation are located outside Brazil. This may involve processing data — such as IP address and technical metadata — in Germany (data center in Falkenstein) and the United States (collaboration platform).

The safeguards and legal basis applicable to these transfers are under legal validation. You may request up-to-date information about these transfers through the channels in section 13.

8. Data retention

We retain personal data only for as long as necessary to fulfill the purposes described in this policy, meet legal and regulatory obligations, or exercise rights in proceedings. Once that period ends, data is securely deleted or anonymized.

You may request the retention period applicable to a specific category of data through the channels in section 13.

9. Information security

We adopt technical and organizational measures to protect personal data against unauthorized access, loss, alteration or destruction. These include encryption in transit, access control and segregation of duties.

DataDike is implementing an Information Security Management System aligned with ISO/IEC 27001. The company is in the certification process and is not yet certified.

10. Your rights

Under the LGPD and the GDPR, you may exercise the following rights over your personal data:

• Confirmation and access — know whether we process your data and access it.
• Rectification — request the update of incomplete or outdated data.
• Anonymization, blocking or deletion — of unnecessary data or data processed unlawfully.
• Portability — receive your data in a structured, interoperable format.
• Restriction of processing — request restriction of processing where applicable (GDPR art. 18).
• Withdrawal and objection — withdraw consent and object to certain processing.
• Review of automated decisions — review of decisions based solely on automated processing (LGPD art. 20).
• Information — know with whom your data is shared.

We will respond to requests within the legal deadline of up to 15 days (LGPD art. 19). You may also lodge a complaint with the Brazilian Data Protection Authority (ANPD).

11. Children’s data

Our products and services are intended for organizations and professionals. We do not knowingly collect data from children or adolescents. If we identify such collection without proper authorization, the data will be deleted.

12. Changes to this policy

We may update this Privacy & Cookies Policy from time to time to reflect legal, technical or business changes. The current version will always be available on this page, with the version number and last-updated date shown at the top.