Privacy Policy, LGPD
1. Who processes your data
Cabral & Morais Invest Fomento Mercantil LTDA ("Capitalis"), CNPJ 51.761.319/0001-70, Rua Tenente Coronel Roberto, 29, Centro, Pará de Minas, MG, 35660-011, Brazil. For data that a client factoring company enters into the platform (sellers, debtors, staff), the client is the controller and Capitalis is the processor under articles 5(VI) and 5(VII) of the LGPD (Law 13.709/2018). For visitors to this website and commercial contacts, Capitalis is the controller.
2. What we collect
On this website, only what you send us through the contact form or by e-mail: name, e-mail and message. The site sets no tracking cookies. Your light or dark theme preference stays in your browser and never reaches us. On the platform, the registration and operational data entered by the client factoring company, plus the access logs and audit trail required by law.
3. Why we process it
To answer your commercial enquiry (pre-contractual steps, art. 7(V)); to perform the subscription contract with the client factoring company (art. 7(V)); to comply with legal and regulatory obligations, including record retention (art. 7(II)); and to keep the platform secure and prevent fraud (art. 7(IX)).
4. Who we share it with
Only with subprocessors strictly necessary to run the service: cloud hosting, managed database, transactional e-mail and error monitoring, each under contract, with international transfers covered by LGPD safeguards. We do not sell personal data.
5. Security
The database refuses to hand one client's data to another, data travels encrypted and sensitive fields are encrypted at rest. The audit trail cannot be altered or deleted and is archived in sealed form. Every security finding gets a severity score and a remediation deadline, and the security policies are written and versioned against the ISO/IEC 27001 Annex A controls.
6. Retention
Data is kept for the term of the contract and for the statutory retention periods applicable to the financial sector, then securely deleted or anonymised.
7. Your rights
You may request confirmation of processing, access, correction, anonymisation, portability, deletion, information about sharing and review of automated decisions (art. 18 LGPD). If your data was entered by a client factoring company, we forward your request to that controller and support the response.
8. Incidents
Incidents posing relevant risk to data subjects are reported to the Brazilian data protection authority (ANPD) and to those affected within three business days of becoming aware, under our incident response process.
9. Data Protection Officer
Diego Cabral Sobrinho, dpo@sistemacapitalis.com.br. This is the channel to exercise your rights. You may also complain to the ANPD at gov.br/anpd.