Privacy policy — LGPD

1. Who we are and the data controller

Phinan — Soluções Contábeis, CNPJ 59.587.920/0001-09, registered with CRC under SC-012701/O-3 and based in Santa Catarina, is the controller of personal data processed through use of this website and engagement of its services.

2. Privacy contact

For personal-data questions and rights requests, contact privacidade@phinan.com.br or WhatsApp / telephone +55 47 93384-7197. Requests are handled according to the right involved and the applicable legal deadlines. We may request proportionate information to verify identity and explain any impediment to fulfilling a request.

3. Data we process

We do not intentionally process sensitive personal data under LGPD Article 5(II) without a specific legal basis and prior information.

• Contact and registration data: name, CPF/CNPJ, email, telephone and address, collected through forms, proposals and contracts.
• Accounting and tax data: invoices, trial balances, payroll and returns supplied for the service.
• Browsing data: IP address, device identifiers and pages visited, on the basis of legitimate interest and consent for analytics.
• Communications: messages sent through forms, email or WhatsApp.

4. Purposes and legal bases

• Accounting services — performance of a contract, Article 7(V): registration, accounting, tax and employment data and company documents.
• Leads and forms — consent, Article 7(I), or pre-contractual procedures, Article 7(V): name, contact details, optional company/CNPJ, service of interest, message and authorization record.
• Legal and regulatory obligations — Article 7(II): information submitted to Receita Federal, state and municipal tax authorities, eSocial and CRC.
• Website usage metrics — consent, Article 7(I), managed as an optional category in the banner: pages, device, browser and interactions through Google Analytics and, when configured, Microsoft Clarity.
• Security, fraud prevention and audit — legitimate interest, Article 7(IX): access logs, IP address and session identifiers.

5. Sharing and subprocessors

We do not sell personal data. We share only the minimum needed with public and tax authorities, including Receita Federal, state and municipal authorities, Caixa, eSocial and CRC, to meet legal obligations. Technology subprocessors are engaged in writing with confidentiality and processing clauses under our instructions.

For international transfers, where applicable, we observe Chapter V of the LGPD, including standard clauses, specific safeguards or consent.

• Vercel Inc. — institutional website hosting — United States.
• Google LLC (Analytics 4) — usage metrics, only with consent — United States.
• Microsoft Clarity — navigation metrics when configured and authorized — United States.
• Google Ads — campaigns and conversions with marketing consent — United States.
• Resend / corporate SMTP — transactional emails — United States / Brazil.
• Microsoft 365 / Google Workspace — email and internal productivity — United States.
• Supabase / PostgreSQL — client Hub data storage — United States / Brazil.

6. Retention

• Accounting and tax data: the legal periods applicable to each record and obligation, taking account of the period, purpose and any preservation requirement.
• Leads and forms: up to 24 months after the last contact, unless the person becomes a client.
• Analytics cookies: according to provider settings and the Cookie Policy.
• Security logs: six months, according to the Brazilian Internet Civil Framework (Marco Civil da Internet).

7. Security

We apply technical and organizational measures proportionate to risk, described on the Security page. If an incident may cause relevant risk or harm, we will make notifications to data subjects and the ANPD according to the deadlines and criteria of CD/ANPD Resolution 15/2024 and other applicable rules.

8. Data-subject rights

Under LGPD Article 18, you may exercise the rights listed below. Send a request to privacidade@phinan.com.br; additional identity-verification information may be requested.

• Confirmation of whether we process your personal data.
• Access to a copy of the personal data we process about you.
• Correction of incomplete, inaccurate or outdated data.
• Anonymization, blocking or deletion of unnecessary, excessive or noncompliantly processed data.
• Portability in a structured format, subject to legal limits.
• Deletion of consent-based data, without prejudice to the exceptions in Article 16.
• Information about the public and private entities with which data is shared.
• Withdrawal of consent at any time, without charge, with information on the consequences.
• Review of automated decisions where applicable, under Article 20.
• A complaint to the ANPD, Brazil’s National Data Protection Authority.

9. Cookies

The Cookie Policy details our use of cookies. Manage consent through the first-visit banner and the “Manage cookies” control in the footer.

10. Children and adolescents

Our services are intended for businesses and professionals. We do not intentionally collect children’s or adolescents’ data without specific consent from a legal guardian, under Article 14.

11. Policy updates

This policy may be updated for legal, regulatory or operational changes. The current version remains available at this address; significant changes will be communicated through the usual channels.

12. National authority

You may also submit a complaint to the ANPD — Autoridade Nacional de Proteção de Dados: https://www.gov.br/anpd.