LGPD · Law 13.709/2018

Privacy Policy

Transparency is part of how we work. Here we explain, in plain language, what personal data Onda collects through this website, what we use it for, who we share it with and how you can exercise your rights.

01Who we are

A Onda · Digital Agency (Onda Sites — ondasites.com.br) is a website, systems, digital marketing and social media agency based in Vitória · Espírito Santo, Brazil. For the purposes of the LGPD (Brazil’s General Data Protection Law), Onda is the controller of the personal data processed through this website.

Contact for privacy and personal data matters (Data Protection Officer): contato@ondasites.com.br · WhatsApp (27) 99805-8025.

02What data we collect

• Website forms (contact, quote, quote assistant and Systems & Apps requests): name, company, email, WhatsApp/phone number, website or Instagram, industry, services of interest and the message you write.
• WhatsApp button/widget: name, WhatsApp number and, if you provide it, email address — recorded before the conversation opens — as well as the content of the conversation on WhatsApp itself.
• Visit source: landing page, the page from which the form was submitted, the site you came from (referrer) and campaign parameters (UTM, gclid, fbclid), so we know which channel brought in the contact.
• Consent record: the date and time you confirmed that you have read and agree to this policy.
• Browsing data (Analytics): if you accept cookies, Google Analytics collects aggregated usage data (pages visited, time on site, device type, approximate city).
• Technical data: IP address, used temporarily for security purposes and to block abusive submissions (anti-spam).

We do not request sensitive data (health, religion, biometrics, etc.). Please do not include it in message fields.

03How we use it

• Reply to your messages and quote requests;
• Prepare and send business proposals;
• Contact you about the service you requested (via WhatsApp, email or phone);
• Send the confirmation email acknowledging your request;
• Measure which channels and campaigns bring in contacts, to improve our website and marketing;
• Protecting the website against spam, fraud and abuse.

04Legal bases (Art. 7 of the LGPD)

• Consent — when you submit a form after ticking the consent box and when you accept measurement cookies;
• Preliminary procedures and performance of a contract — to prepare proposals and, if you hire us, to provide the service;
• Legitimate interest — for website security, fraud prevention and to understand, in aggregate, where contacts come from, always respecting your rights and expectations.

05Who we share it with

Onda does not sell personal data. We share only what is necessary with:

• Hosting provider for the website and email, where the data is stored;
• Google (Google Analytics), only if you accept measurement cookies;
• WhatsApp/Meta, when you choose to talk to us on WhatsApp;
• Public authorities, when required by law or court order.

Some of these providers may store data outside Brazil; in such cases, we require them to adopt adequate protection standards, in accordance with the LGPD.

06How long we keep it

Data from contacts who did not become clients is kept for up to 24 months after the last contact, so we can follow up on the negotiation, and is then deleted or anonymized. Client data is kept for the duration of the contract and for the period required by law (for example, tax and accounting obligations). Technical security logs are kept for the shortest time necessary. You may request deletion sooner (see section 7).

07Your rights (Art. 18 of the LGPD)

You may, at any time and free of charge:

• confirm whether we process your data and access it;
• correct incomplete, inaccurate or outdated data;
• request anonymization, blocking or deletion of unnecessary data or data processed in breach of the law;
• request portability of your data to another provider;
• request deletion of data processed based on your consent;
• know who we share your data with;
• be informed about the option not to consent and its consequences;
• withdraw your consent;
• object to processing carried out on the basis of legitimate interest, where it fails to comply with the law.

08Cookies

We use cookies and the browser’s local storage for:

• Essential (required): remember your cookie choice and store, during your visit, where you came from (campaign/landing page). These do not depend on consent;
• Measurement (Google Analytics): enabled only if you click “Accept” on the cookie notice. We use Google Consent Mode: until you accept, analytics and advertising cookies remain disabled.

You can change your choice at any time:

Cookie preferences

You can also delete or block cookies in your browser settings.

09Security

We adopt technical and administrative measures to protect your data: an encrypted connection (HTTPS), data stored outside the public area of the server, access restricted to our team, and submission limits to prevent abuse. No system is 100% invulnerable; if a relevant incident occurs, we will notify the affected data subjects and the ANPD, as required by law.

10Updates to this policy

We may update this policy to reflect changes to the website, our services or the law. The current version is always available on this page, with the date of the last update shown below.

Last updated: October 2026.