How we take care of your data

Aventura Digital (also operated as Aventura Design por Assinatura) is a brand of Leandro Alves de Sousa ME, registered under CNPJ 33.344.374/0001-83, based in the Federative Republic of Brazil ("Aventura", "we" or "our"). We are the controller of the personal data processed on this website, in forms, on WhatsApp, by email and in the business relationship with those who contact or hire us.

This Policy applies to visitors of the website aventuradigital.co, people who contact us, clients of any service (including Design Subscription), students of the Wix Studio Course and other people whose data we process because of our activity. It was written based on the Brazilian General Data Protection Law (Law No. 13,709/2018, "LGPD"), the Brazilian Internet Civil Framework (Law No. 12,965/2014), the Consumer Protection Code and the rules of the National Data Protection Authority (ANPD).

When we are controllers and when we are processors

We are controllers of the data we collect to relate to you and provide the service. When a client gives us third-party personal data to carry out a project (for example, contact lists for a CRM, data from their own clients in automations, or forms of a website we build), the client is the controller of that data and Aventura acts as processor, handling it only according to the client's instructions and the signed contract.

Data you give us

• Contact form: name, WhatsApp, email, company name, service of interest, whether you already have a website, whether you are contacting as a professional, company or business, subject and message.
• Contracting and billing: registration data, CPF or CNPJ, address and information needed to issue invoices and process payment.
• Project delivery: briefs, texts, images, logos, access to tools and other content you send us, including through the request board (Trello).
• Communications: WhatsApp and email messages, notes from meetings and calls.
• Course and materials: enrollment and access data, when you purchase the Wix Studio Course or other content.

Data collected automatically

IP address, date and time of access, browser, device, operating system, language, pages visited, source of access and interactions with the site, obtained through logs and cookies and similar technologies (see the cookies section).

Data we receive from third parties

From platforms we use to operate (for example, the website and forms provider, payment methods and course platforms), we receive payment and enrollment confirmations and usage statistics. We do not receive full card data.

What we do not want to receive

We do not request sensitive personal data (such as health, racial or ethnic origin, religious belief, political opinion, biometric or genetic data). Please do not send it through forms or messages. Full credit card data is neither collected nor stored by us: it is processed directly by the payment providers.

We only process the data needed for each purpose, always with a legal basis set out in art. 7 of the LGPD:

When the basis is your consent, you may withdraw it at any time, simply and free of charge, without affecting processing carried out before the withdrawal. When the basis is legitimate interest, we assess the impact on you and you may object to the processing (see the section on your rights).

Cookies are small files stored in your browser. We use two categories:

• Necessary: keep the site working, ensure security and store your cookie choice. Always active.
• Analytics: help us understand how the site is used. Only activated with your consent.

Today we do not use advertising cookies or cross-site tracking. If we start to, we will ask for your consent first. You can accept, decline or adjust your choices in the cookie notice and change them whenever you want under "Cookie preferences" in the footer of any page, or in your browser settings. Declining optional cookies does not prevent use of the site. Some third-party services that are part of the site's infrastructure (such as the hosting provider) may set their own cookies, governed by their own policies.

We do not sell personal data and do not share it for behavioral advertising without your consent. We share the minimum necessary, and only with:

• Providers that help us operate (processors): hosting, website, forms and content management provider (Wix.com Ltd. and affiliates); email, calendar and storage platforms (such as Google); WhatsApp (Meta); request management tool (Trello/Atlassian); payment methods and course sales platforms; and, when hired by you, automation, CRM and artificial intelligence tools.
• Accounting and legal advisory professionals, when necessary to comply with obligations or defend rights.
• Public authorities, when there is a legal obligation, a court order or a request from a competent authority.
• Third parties in corporate transactions (such as merger, assignment or succession of the business), maintaining the safeguards of this Policy.
• People you designate (for example, members of your team who take part in the project).

We look for providers with protection practices compatible with this Policy. We may also use aggregated or anonymized data, which does not identify you.

We serve clients in Brazil and abroad and our providers operate in other countries, including the United States. Because of this, your data may be processed outside Brazil. In these cases, we adopt the mechanisms provided in art. 33 of the LGPD and in the ANPD's International Data Transfer Regulation (Resolution CD/ANPD No. 19/2024), such as standard contractual clauses, countries with a recognized adequate level of protection or, when necessary, your specific consent.

We keep data for as long as necessary to fulfill the purposes described in this Policy, to meet legal, regulatory, tax and accounting obligations, and for the regular exercise of rights, observing the applicable limitation periods. Data processed on the basis of your consent is kept until you withdraw it.

Once these periods end, data is deleted or anonymized, unless the law authorizes retention (art. 16 of the LGPD).

We adopt reasonable technical and administrative measures, compatible with the nature of the data and services, to protect data against unauthorized access, loss, alteration or improper disclosure. No system is completely immune to failures, and you must also protect the passwords and access you share with us.

In the event of a security incident that may cause relevant risk or harm to data subjects, we will make the communications required by the LGPD and ANPD regulation (Resolution CD/ANPD No. 15/2024).

Under art. 18 of the LGPD, you may request, at any time and free of charge:

• confirmation that we process your data and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary, excessive data or data processed in violation of the law;
• portability of data to another provider, under ANPD regulation;
• deletion of data processed on the basis of your consent;
• information about who we share data with;
• information about the possibility of not giving consent and the consequences of refusal;
• withdrawal of consent;
• objection to processing carried out on another legal basis, when the law is not being followed;
• review of decisions made solely by automated means that affect your interests. As a rule, we do not make this type of decision.

How to exercise them

Write to marina@leandroa.com or message us on WhatsApp +1 (386) 243-7906. For your security, we may ask for information to confirm your identity. We reply within the deadlines set in art. 19 of the LGPD. We may keep data when there is a legal obligation or for the regular exercise of rights, and we will explain the reason.

You may also file a petition with the ANPD (www.gov.br/anpd) or with consumer protection bodies.

Our services are intended for people over 18 and for companies. We do not knowingly collect data from children and teenagers without the specific consent of a parent or legal guardian (art. 14 of the LGPD). If we identify processing without this authorization, we will delete the data.

• You undertake to provide true and up-to-date information and to keep the access credentials you use confidential.
• The content you send us (texts, images, logos, contact databases and other data) is your responsibility. By sending it, you declare that you have the necessary rights, authorizations and legal basis, and you are liable for damages arising from sending data without that basis.
• In the websites, forms, CRMs and automations we build for you, the privacy policy, the cookie notice and the handling of your business's data subjects are your responsibility as controller. We may offer guidance, but we do not replace your legal counsel.
• This site may contain links to third-party sites, whose policies we do not control and for which we are not responsible.
• We are not liable for incidents caused by the acts of third parties, fortuitous events or force majeure, failures of third-party platforms outside our control or misuse of credentials by the user, without prejudice to the responsibilities provided by law and the Consumer Protection Code.

European Economic Area and United Kingdom (GDPR and UK GDPR)

We process your data based on contract, legitimate interest, consent or legal obligation, according to the table above. You have the right of access, rectification, erasure, restriction, portability and objection, and to complain to the data protection authority of your country. Transfers outside the EEA and the United Kingdom follow appropriate safeguards, such as standard contractual clauses.

California and other US states (CCPA/CPRA)

We collect identifiers, contact information, commercial information and internet activity data, for the purposes described in this Policy. We do not sell or share personal information for cross-context behavioral advertising. You may request access, correction and deletion, and you will not suffer discrimination for exercising these rights. Use the channels in the contact section.

We may update this Policy to reflect changes in the law, services or providers. The date of the last update is at the top of the page. Relevant changes will be communicated through the site or our contact channels. When a change requires new consent, we will ask for it. Previous versions can be requested through our contact channels.

This Policy is governed by the laws of the Federative Republic of Brazil, observing the mandatory rules applicable to the data subject and the consumer.