Privacy Policy

GFX Plásticos de Engenharia Ltda., Brazilian tax ID (CNPJ) 20.975.732/0001-85, headquartered at Rua das Figueiras, 398 – Jardim, Santo André – SP, Brasil ("GFX", "we"), is the controller of the personal data processed through www.gfxbr.com, the contact form, our internal sales platform and our WhatsApp, e-mail and phone service channels.

This policy applies to website visitors, business contacts at customer and prospect companies, job applicants and anyone who interacts with our service channels. It is governed by the Brazilian General Data Protection Law (Law 13,709/2018 — LGPD).

We operate in the B2B market: almost all data we process belongs to professionals acting on behalf of companies. We collect only what is needed to serve, quote and maintain the business relationship.

• Answer inquiries, prepare quotes, send samples and follow up on negotiations.
• Maintain customer records, issue orders and tax documents and fulfil contractual obligations.
• Send commercial news, campaigns and scheduled follow-ups by e-mail and WhatsApp to business contacts, always with an opt-out option.
• Record and organise the WhatsApp, e-mail and phone service history in our sales platform so that any GFX salesperson can continue the service.
• Qualify B2B prospects from public company data.
• Measure website usage and improve content and navigation (Google Analytics, only with consent).
• Comply with legal, tax and regulatory obligations and exercise rights in legal proceedings.

Each processing activity relies on one of the grounds in article 7 of the LGPD:

• Performance of a contract or pre-contractual steps (quotes, orders, samples, support).
• Legitimate interest (B2B relationship, company prospecting, platform security and fraud prevention), always with an assessment of the impact on the data subject and the option to object.
• Consent (analytics cookies and marketing communications where required), revocable at any time.
• Compliance with a legal or regulatory obligation (tax documents, accounting records).

Our business numbers run on the WhatsApp Business Platform (Meta). When you message a GFX number, the content, your number and your profile name are received by our sales platform and linked to your company record, so the service is logged and can be continued by any GFX salesperson.

• Meta acts as a data processor in delivering messages, under the WhatsApp Business Platform Terms and the WhatsApp Privacy Policy.
• We only start conversations with business contacts who reached out to us, who have a business relationship with GFX or who consented to receive messages.
• To stop receiving messages, reply "SAIR" or "STOP" in any conversation, or ask by the e-mail below. The block is immediate and logged.
• We do not share conversation content with third parties beyond the processors listed in this policy and do not use it for advertising.

The website uses only strictly necessary cookies and, if you accept the notice shown on your first visit, Google Analytics 4 cookies to measure audience. No analytics cookie is set before you accept, and declining does not limit the use of the site. You can change your decision by clearing your browser cookies; the notice will be shown again.

We do not sell personal data. We share it only with processors that provide services to GFX, under contract and following our instructions:

We may also share data with public authorities when required by law or court order, and with legal and accounting advisors in the regular exercise of rights.

Some processors (Meta, Google, Vercel, Supabase and AI providers) process data on servers outside Brazil, mainly in the United States. These transfers follow article 33 of the LGPD, with standard contractual clauses and security safeguards equivalent to those required by Brazilian law.

• Website contacts with no business relationship: up to 24 months after the last contact.
• Sales history (quotes, orders, messages, calls): for the duration of the business relationship and afterwards for the statutory limitation period (generally 5 years), or longer where a tax obligation applies.
• Analytics data: 14 months, as configured in Google Analytics.
• Résumés: up to 12 months after receipt.
• Opt-out and deletion requests: we keep only the minimum (number or e-mail) needed to make sure we do not contact you again.

We adopt technical and administrative measures proportional to the risk: access to the sales platform restricted to authenticated staff with role-based permissions; encryption in transit (HTTPS) and at rest at our providers; integration secrets stored outside the code; audit logging of sensitive actions; and automated monitoring of messaging channels. No system is fully immune; in the event of an incident with relevant risk, we will notify affected data subjects and the Brazilian data protection authority (ANPD) as required by the LGPD.

Under article 18 of the LGPD you may, at any time and free of charge:

• Confirm whether we process your data and access it.
• Correct incomplete, inaccurate or outdated data.
• Request anonymisation, blocking or deletion of unnecessary data or data processed in breach of the law.
• Request portability of your data to another supplier.
• Know who we share your data with.
• Withdraw consent and object to processing based on legitimate interest.

We reply within 15 days. If you are not satisfied, you may file a complaint with the Brazilian National Data Protection Authority (ANPD).

To delete your personal data from our systems, including data received via WhatsApp, e-mail and phone:

• Send an e-mail to contato@gfxplasticos.com.br with the subject "Data deletion", stating your name, company and the WhatsApp number or e-mail you used to contact us.
• Or reply "SAIR" or "STOP" in any WhatsApp conversation with GFX to stop messages immediately.
• We will confirm receipt and complete the deletion within 15 days, informing you of the outcome through the same channel.
• Data we are legally required to keep (for example, tax documents for completed orders) is blocked and deleted at the end of the statutory period.

Our services are intended for companies and professionals. We do not knowingly collect data from anyone under 18; if we identify such data, it will be deleted.

We may update this policy to reflect legal changes or changes in our services. The current version is always the one published on this page, with the update date at the top. Relevant changes will be communicated through our channels.