Transparency about how your data is processed.

This text describes NOVIDARO’s processing of personal data, under article 9 of the LGPD, the Brazilian General Data Protection Law.

Go straight to the section on international data transfers

Who processes your data

NOVIDARO MENTORIA E CONSULTORIA LTDA, CNPJ 67.020.452/0001-06, with registered office in Barueri, São Paulo, Brazil. For any matter concerning personal data, the channel is [email protected]. Under the General Data Protection Law (Law 13,709/2018), NOVIDARO is the controller of the data described here.

That address is the channel for communication with the data subject provided for in article 41, § 2, I, of the LGPD. It is how you reach NOVIDARO about any personal data matter, including exercising the rights listed below. We respond within the period set by law.

What data this site collects

What you type into the form on the contact page: name, email, your career moment, chosen from a closed list, and, if you wish to fill it in, a message. Only name, email and moment are required.

Your IP address. It is recorded automatically by the platform hosting this site when you submit the form, together with the submission. We do not ask for this data and we do not use it to identify you commercially; it exists as a technical record and as support for abuse prevention.

Technical verification signals. The contact page uses Cloudflare Turnstile to tell people from robots. It analyzes browser characteristics and interaction signals while the form is being filled in.

In this form we neither ask for nor want sensitive data: nothing about health, political opinion, religious belief, sex life, trade union membership or racial origin. The career moment field is a closed list, precisely so as not to open space for that. If you write something of that nature in the open field, it will be treated with the same confidentiality as the rest, but the field does not exist for that.

This site has no login area, sells nothing online and receives no payments.

What we use it for

• Responding to your inquiry and scheduling the initial conversation.
• Understanding your career moment to assess, together with you, whether mentoring makes sense.
• Preventing automated submissions and abuse of the form.

What we do not do. We do not use your data for advertising. We do not build behavioral profiles for commercial purposes. We do not make automated decisions about you. We do not sell, rent or transfer your data to third parties.

The analysis performed by Cloudflare Turnstile serves only to separate people from robots. It is not used to identify, classify or profile you, and its result does not influence our reply to your contact.

On what legal basis

To reply to your contact and hold the first conversation: the carrying out of preliminary procedures related to a contract, at the request of the data subject (article 7, V, of the LGPD). The message field is filled in on your own initiative.

For the IP record and the anti robot verification: legitimate interest in the security of the service and in preventing fraud and abuse (article 7, IX, of the LGPD), limited to what is strictly necessary for that purpose.

Who else has access

Three suppliers, each acting as a processor:

• Webflow, Inc. (United States), which hosts this site, receives form submissions and stores them.
• Cloudflare, Inc. (United States), which delivers the site's content and runs the anti-bot verification on the contact page.
• Google LLC (Google Workspace), where NOVIDARO's mailbox receives the submission notification and where the email conversation happens.

Those suppliers in turn use their own infrastructure providers, such as cloud services and content delivery networks. Webflow’s list of subprocessors is public and can be consulted at webflow.com/legal/subprocessors.

No other third party receives data collected on this site.

International data transfers

This section complies with article 33 and following of the LGPD and with the International Data Transfer Regulation approved by ANPD Board Resolution 19/2024.

Who answers for this transfer. NOVIDARO MENTORIA E CONSULTORIA LTDA, CNPJ 67.020.452/0001-06, with registered office in Barueri, São Paulo, Brazil, is the designated party for the purposes of these transfers. Responsibility for publishing this section, for answering your requests and for reporting security incidents lies with NOVIDARO, not with the suppliers. The channel is [email protected].

Form and duration. The data you send through the form is transmitted to and stored on the servers of the suppliers above, for the period stated in the retention section of this notice.

Specific purpose. Hosting the site and receiving the submissions; delivering and storing the email message; protecting the form against automated submissions.

Destination country. The United States, in the case of Webflow and Cloudflare. In the case of Google Workspace, the European Union, for the services covered by the data region policy configured by NOVIDARO, with processing and data not covered by that policy, such as log records and cached content, possibly taking place in the United States.

Transfer mechanism.

• Google: standard contractual clauses approved by ANPD (Annex II of Resolução CD/ANPD nº 19/2024), incorporated into the Cloud Data Processing Addendum accepted by NOVIDARO on June 9, 2026. For services covered by the data-region policy, the European Union adequacy decision also applies, recognized by Resolução CD/ANPD nº 32/2026, of January 26, 2026.
• Webflow e Cloudflare: the transfer is necessary to carry out preliminary procedures related to a contract, at the data subject's request, under art. 33, IX, combined with art. 7, V, of the LGPD (Brazil's General Data Protection Law). NOVIDARO has formally requested that these providers adopt the standard contractual clauses approved by ANPD and will update this notice once there is a response.

Shared use. The data described in this notice is shared with the three suppliers above exclusively for the purposes of this section: hosting the site and receiving form submissions, delivering and protecting the pages, and receiving and storing the email message. None of them may use it for their own purposes. There is no sharing with any other third party, free of charge or paid.

Responsibilities and security. Each supplier acts as a processor, processing the data only in accordance with NOVIDARO’s instructions and for the purposes described here. The security measures adopted are described in the next section.

Onward transfers. The suppliers above may use their own infrastructure providers, also located abroad, exclusively to make the services described in this section possible.

Rights and channel. You can exercise all the rights listed below by writing to [email protected], and you can petition against NOVIDARO before the Brazilian National Data Protection Authority (ANPD). On request through the same email, we make available free of charge, within 15 days, the full text of the contractual clauses relating to the international transfers, subject to commercial and industrial secrecy.

Cookies and similar technologies

This site does not use cookies. The statement is not generic: on 8 August 2026 we made a complete capture of the traffic on the contact page and no cookie was written to the browser, in any request. There are no advertising, social network, audience measurement or session cookies. The hosting platform’s visit data collection is disabled.

We do not use Google Analytics or any other audience measurement tool. The typefaces are served by the site’s own hosting, and not by external font services.

Local storage. Cloudflare Turnstile writes a technical record to your browser’s local storage, exclusively so that the anti-robot verification works. It does not identify you and is not used for any other purpose.

There is no consent banner because there is no processing that depends on consent: what exists is strictly necessary for the page to work and to protect it against abuse.

If this scenario changes, for example with the adoption of some measurement tool, this section will be updated and a prior consent mechanism will be implemented before any collection.

Security and responsibilities

NOVIDARO is the controller and decides the purposes and the means of processing. Webflow, Cloudflare and Google act as processors, processing the data only in accordance with our instructions and the contractual obligations undertaken with NOVIDARO.

On our side, access to the data is restricted to the owner of the company. The mailbox that receives the submissions has two-step authentication. There is no credential sharing and no third party access to the base.

On the suppliers’ side, the site is served exclusively over an encrypted connection (HTTPS). Webflow states that it maintains SOC 2 Type II certification, infrastructure in ISO 27001 certified data centers, encryption of data at rest, access control with two-factor authentication, periodic intrusion testing and staff training in security and privacy. Google describes the measures applicable to Workspace in the Cloud Data Processing Addendum.

No system is immune to risk. We aim to maintain the best practices available and, if something relevant happens, you will be informed as transparently as possible.

Security incidents

If a security incident occurs that may bring relevant risk or harm to you, we will report it to you and to the ANPD within the periods set out in ANPD Board Resolution 15/2024, stating the nature of the data affected, the risks involved and the measures adopted.

How long we keep it

We keep what you sent for as long as the conversation lasts and for as long as it is necessary for the purpose that prompted the contact.

Contacts with no follow up are deleted from the form database within 90 days. The deletion is carried out in a periodic routine, which also covers submissions automatically classified as spam.

Contacts that develop into a conversation or an engagement are kept for as long as the relationship lasts and, afterwards, only for the time necessary to comply with a legal obligation or to exercise rights in the regular course.

You can ask for deletion before that, at any time.

Minors

This site and NOVIDARO’s services are intended for professionals over 18 years of age. We do not intentionally collect data from children or adolescents. If we identify that we have received data in that condition, we will delete it.

Your rights

Article 18 of the LGPD guarantees you, in relation to your data: confirmation that processing exists; access; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary or excessive data; portability; deletion of data processed with your consent; information about who we share it with; information about the possibility of not consenting and what follows from that; and withdrawal of consent.

You may also object to processing carried out on a basis that dispenses with consent, where you consider that the law is not being complied with.

How to exercise them

Write to [email protected]. We respond within the period set by law. If you consider that the processing is not adequate, you may also contact the Brazilian National Data Protection Authority (ANPD), at gov.br/anpd.

Changes to this notice

If this notice changes, the date at the top changes with it. Earlier versions can be requested through the same email.

NOVIDARO MENTORIA E CONSULTORIA LTDA. CNPJ 67.020.452/0001-06.