Privacy Policy

This Privacy Policy contains information on how we process, in whole or in part, by automated means or otherwise, the personal data of users who access our website. Its purpose is to inform interested parties about the types of data that are collected, the reasons for the collection and how the user can update, manage or delete this information.

This Privacy Policy was drafted in compliance with Brazil's Civil Rights Framework for the Internet (Marco Civil da Internet, Lei Federal n. 12.965 of April 23, 2014), with Brazil's General Data Protection Law (LGPD, Lei Federal n. 13.709 of August 14, 2018) and with the European General Data Protection Regulation, Regulation (EU) 2016/679 of April 27, 2016 (GDPR).

This Privacy Policy may be updated as a result of any change in the applicable rules, which is why the user is invited to consult this section periodically.

The website undertakes to comply with the rules set out in the GDPR, in keeping with the following principles:

• The user's personal data will be processed lawfully, fairly and in a transparent manner (lawfulness, fairness and transparency);
• The user's personal data will be collected only for specified, explicit and legitimate purposes and may not be further processed in a manner that is incompatible with those purposes (purpose limitation);
• The user's personal data will be collected in a manner that is adequate, relevant and limited to what is necessary for the purpose for which they are processed (data minimization);
• The user's personal data will be accurate and kept up to date whenever necessary, so that inaccurate data are erased or rectified where possible (accuracy);
• The user's personal data will be kept in a form that permits the identification of data subjects only for as long as necessary for the purposes for which the data are processed (storage limitation);
• The user's personal data will be processed securely, protected against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures (integrity and confidentiality).

The user of the website has the following rights, granted by Brazil's General Data Protection Law (LGPD) and by the GDPR:

• Right of confirmation and access: the user's right to obtain from the website confirmation as to whether or not personal data concerning them are being processed and, if so, the right to access their personal data;
• Right to rectification: the user's right to obtain from the website, without undue delay, the rectification of inaccurate personal data concerning them;
• Right to erasure (right to be forgotten): the user's right to have their data erased from the website;
• Right to restriction of processing: the user's right to restrict the processing of their personal data, which may be obtained when the user contests the accuracy of the data, when the processing is unlawful, when the website no longer needs the data for the proposed purposes, and when the user has objected to the processing of the data and in the case of processing of unnecessary data;
• Right to object: the user's right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them; the user may also object to the use of their personal data to build a marketing profile (profiling);
• Right to data portability: the user's right to receive the personal data concerning them that they have provided to the website, in a structured, commonly used and machine-readable format, and the right to transmit those data to another website;
• Right not to be subject to automated decisions: the user's right not to be subject to any decision based solely on automated processing, including profiling, that produces effects in their legal sphere or similarly significantly affects them.

The user may exercise their rights by means of a written communication sent to the website with the subject “GDPR”, specifying:

• Full name or company name, CPF number (Cadastro de Pessoas Físicas, the individual taxpayer registry of Brazil's Federal Revenue Service, Receita Federal do Brasil) or CNPJ number (Cadastro Nacional de Pessoa Jurídica, the national registry of legal entities of Brazil's Federal Revenue Service) and e-mail address of the user and, where applicable, of their representative;
• The right they wish to exercise before the website;
• Date of the request and signature of the user;
• Any document that can demonstrate or justify the exercise of their right.

The request must be sent to the e-mail address: contato@flowup.agency

The user will be informed if their data are rectified or erased.

While using the website, in order to safeguard and protect the rights of third parties, the user of the website must provide only their own personal data, and not those of third parties.

The collection of user data will take place in accordance with this Privacy Policy and will depend on the user's consent, which may be dispensed with only in the cases set out in Article 11, item II, of Brazil's General Data Protection Law (LGPD).

4.1. Types of data collected

4.1.1. Data provided in the contact form: Any data provided by the user who uses the contact form made available on the website, including the content of the message sent, will be collected and stored.

4.1.2. Data related to the performance of contracts entered into with the user: For the performance of any purchase and sale agreement or service agreement entered into between the website and the user, other data related to or necessary for its performance may be collected and stored, including the content of any communications with the user.

4.1.3. Seja a Resposta newsletter: Anyone who subscribes to Flowup's newsletter provides their e-mail address and, if they wish, their name. The subscription only takes effect after confirmation through the link sent by e-mail. The data are used only to send the monthly edition, the notices of new articles and the messages about the subscription itself. Sending is handled by the MailPoet service, which acts as data processor on behalf of Flowup, and the e-mails may record opens and clicks to measure the interest in each edition. Every e-mail carries a link to unsubscribe in one click or to adjust preferences. The data are kept for as long as the subscription is active; after unsubscribing, the address stops receiving messages and may be deleted on request at contato@flowup.agency.

4.1.4. Sensitive data: No sensitive data will be collected from users, meaning the data defined in Articles 9 and 10 of the GDPR and in Articles 11 et seq. of Brazil's General Data Protection Law (LGPD). Accordingly, among others, the following data will not be collected:

• data revealing the user's racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership;
• genetic data;
• biometric data for the purpose of uniquely identifying a person;
• data concerning the user's health;
• data concerning the user's sex life or sexual orientation;
• data relating to criminal convictions or offenses or to related security measures.

4.2. Legal basis for the processing of personal data

By using the services of the website, the user is consenting to this Privacy Policy.

The user has the right to withdraw their consent at any time, without affecting the lawfulness of the processing of their personal data before the withdrawal. Consent may be withdrawn by e-mail: contato@flowup.agency

The consent of persons with relative or absolute legal incapacity, especially children under 16 (sixteen) years of age, may only be given if they are duly assisted or represented, respectively.

Personal data necessary for the performance and fulfillment of the services contracted by the user on the website may also be collected.

Personal data will be processed without the user's consent only on the grounds of legitimate interest or in the cases provided for by law, that is, among others, the following:

• for compliance with a legal or regulatory obligation by the data controller;
• for the carrying out of studies by a research body, ensuring, whenever possible, the anonymization of personal data;
• when necessary for the performance of a contract or of preliminary procedures related to a contract to which the user is a party, at the request of the data subject;
• for the regular exercise of rights in judicial, administrative or arbitration proceedings, the latter under Brazil's Arbitration Law (Lei nº 9.307 of September 23, 1996);
• for the protection of the life or physical safety of the data subject or of a third party;
• for the protection of health, in a procedure carried out by health professionals or by health entities;
• when necessary to meet the legitimate interests of the data controller or of a third party, except where the fundamental rights and freedoms of the data subject that require the protection of personal data prevail;
• for the protection of credit, including as provided in the relevant legislation.

4.3. Purposes of the processing of personal data

The user's personal data collected by the website are intended to facilitate, speed up and fulfill the commitments established with the user and to carry out the requests made by filling out forms.

Personal data may also be used for a commercial purpose, to personalize the content offered to the user, as well as to support the website in improving the quality and operation of its services.

The collection of data related to or necessary for the performance of any purchase and sale agreement or service agreement entered into with the user is intended to give the parties legal certainty, as well as to facilitate and enable the conclusion of the transaction.

The processing of personal data for purposes not provided for in this Privacy Policy will only take place after prior notice to the user, and, in any case, the rights and obligations set out here will remain applicable.

4.4. Retention period of personal data

The user's personal data will be kept for a period no longer than that required to fulfill the purposes for which they are processed.

The data retention period is defined according to the following criteria:

• data processed for any purpose(s) will not be kept for longer than necessary.

Users' personal data may only be kept after the end of their processing in the following cases:

• for compliance with a legal or regulatory obligation by the data controller;
• for study by a research body, ensuring, whenever possible, the anonymization of personal data;
• for transfer to a third party, provided that the data processing requirements set out in the legislation are respected;
• for the exclusive use of the data controller, with access by third parties prohibited, and provided that the data are anonymized.

4.5. Recipients and transfer of personal data

The user's personal data are not sold or transferred to third parties for those third parties' own purposes.

To operate the website and its customer service, Flowup uses the services of contracted companies, which process the data on behalf of Flowup and only for the purposes described in this Policy, in the capacity of data processors: website hosting, sending and receiving e-mail, spreadsheets and working documents, protection of forms against automated submissions and customer relationship management (CRM).

The data submitted in the contact, brief and diagnosis forms are recorded in the HubSpot CRM platform, which acts as data processor on behalf of Flowup, to organize customer service and commercial follow-up. Candidate data (item 4.6) are not recorded in the CRM.

Some of these services keep servers outside Brazil. In those cases, the international transfer of data takes place in the cases permitted by Brazil's General Data Protection Law (LGPD, Lei nº 13.709/2018).

4.6. Candidates and talent pool

When you send your profile through the page Work with us (careers) (in Portuguese), Flowup processes the data provided in the form (name, e-mail, WhatsApp, city and country, area of work, links and files sent) for the purpose of evaluating job opportunities. The processing is based on your consent, given in the form itself. The data reach the Flowup team by e-mail, are not published and are kept for up to 12 months. The newsletter is only sent to those who check the specific option in the form and confirm the subscription by e-mail. You may request the update or deletion at any time, by replying to the confirmation e-mail or through the channels indicated in this policy.

5.1. The data controller

The controller, responsible for the processing of the user's personal data, is the natural or legal person, public authority, agency or other body that, alone or jointly with others, determines the purposes and means of the processing of personal data.

On this website, the data controller responsible for the personal data collected is the IT Department, which may be contacted by e-mail: contato@flowup.agency

The data controller will take direct charge of the processing of the user's personal data.

5.2. The data protection officer (DPO)

The data protection officer (DPO) is the professional in charge of informing, advising and monitoring the data controller, as well as the workers who process the data, regarding the website's obligations under the GDPR, Brazil's General Data Protection Law (LGPD) and other data protection provisions in national and international legislation, in cooperation with the competent supervisory authority.

On this website, the data protection officer (DPO) is the IT Department, which may be contacted by e-mail: contato@flowup.agency

The website undertakes to apply technical and organizational measures capable of protecting personal data from unauthorized access and from situations of destruction, loss, alteration, communication or dissemination of such data.

To ensure security, solutions will be adopted that take into account: the appropriate techniques; the costs of implementation; the nature, scope, context and purposes of the processing; and the risks to the rights and freedoms of the user.

The website uses an SSL (Secure Socket Layer) certificate, which ensures that personal data are transmitted securely and confidentially, so that the transmission of data between the server and the user, and back, takes place in a fully ciphered or encrypted manner.

However, the website disclaims liability where the fault lies exclusively with a third party, as in the case of an attack by hackers or crackers, or exclusively with the user, as in the case where the user transfers their own data to a third party. The website further undertakes to notify the user within an appropriate period if any breach of the security of their personal data occurs that may cause a high risk to their personal rights and freedoms.

A personal data breach is a breach of security that leads, accidentally or unlawfully, to the destruction, loss, alteration, unauthorized disclosure of or unauthorized access to personal data transmitted, stored or otherwise processed.

Finally, the website undertakes to treat the user's personal data confidentially, within the legal limits.

Cookies are small text files sent by the website to the user's computer and stored there, with information related to the browsing of the website.

Through cookies, small amounts of information are stored by the user's browser so that our server can read them later. For example, data about the device used by the user, as well as the place and time of their access to the website, may be stored.

Cookies do not allow any file or information to be extracted from the user's hard drive, nor is it possible, through them, to gain access to personal information that did not come from the user or from the way the user uses the resources of the website.

It is important to note that not every cookie contains information that allows the user to be identified; certain types of cookies may be used simply so that the website loads correctly or so that its features work as expected.

Any information stored in cookies that makes it possible to identify a user is considered personal data. Therefore, all the rules set out in this Privacy Policy also apply to it.

7.1. Website cookies

Website cookies are those sent to the computer or device of the user and administrator exclusively by the website.

The information collected through these cookies is used to improve and personalize the user's experience; some cookies may, for example, be used to remember the user's preferences and choices, as well as to offer personalized content.

7.2. Third-party cookies

Some of our partners may set cookies on the devices of users who access our website.

These cookies are generally intended to allow our partners to offer their content and services to the user who accesses our website in a personalized way, by obtaining browsing data extracted from the user's interaction with the website.

The user can obtain more information about third-party cookies and about how the data obtained from them are processed, as well as access the description of the cookies used and their characteristics, at the following links:

• Google Analytics: https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage
• Instagram: https://help.instagram.com/1896641480634370?ref=ig
• YouTube: https://policies.google.com/privacy?hl=pt-BR&gl=pt
• Facebook: https://www.facebook.com/policies/cookies/
• LinkedIn: https://www.linkedin.com/legal/cookie-policy?trk=hp-cookies

The entities in charge of collecting the cookies may transfer the information obtained to third parties.

7.3. Cookie management and browser settings

The user may object to the recording of cookies by the website simply by disabling this option in their own browser or device.

Disabling cookies, however, may affect the availability of some of the website's tools and features, compromising its correct and expected operation. Another possible consequence is the removal of any user preferences that may have been saved, impairing the user's experience.

Below are some links to the help and support pages of the most widely used browsers, which may be accessed by the user interested in obtaining more information about managing cookies in their browser:

• Internet Explorer: https://support.microsoft.com/pt-br/help/17442/windows-internet-explorer-delete-manage-cookies
• Safari: https://support.apple.com/pt-br/guide/safari/sfri11471/mac
• Google Chrome: https://support.google.com/chrome/answer/95647?hl=pt-BR&hlrm=pt
• Mozilla Firefox: https://support.mozilla.org/pt-BR/kb/ative-e-desative-os-cookies-que-os-sites-usam
• Opera: https://www.opera.com/help/tutorials/security/privacy/

Without prejudice to any other administrative or judicial remedy, every data subject has the right to lodge a complaint with a supervisory authority. The complaint may be lodged with the authority of the place where the application has its registered office, of the user's country of habitual residence, of their place of work or of the place where the alleged infringement was committed.

The current version of this Privacy Policy was last updated on: October 15, 2025.

The publisher reserves the right to modify, at any time and without any prior notice, the website and these rules, especially to adapt them to the evolution of the website, whether through the provision of new features or through the removal or modification of existing ones.

The user is therefore invited to consult this page periodically to check for updates.

By using the service after any modifications, the user shows their agreement with the new rules. If they disagree with any of the modifications, they must immediately stop accessing the website and, if they so wish, submit their objection to the customer service department.

For the resolution of disputes arising from this instrument, Brazilian law will apply in full.

Any disputes must be brought in the venue of the judicial district where the registered office of the website's publisher is located.