Privacy Policy

1 Introduction

AXTRA DIGITAL LTDA ("Axtra Digital", "we", "our" or "us") is a digital marketing agency incorporated in Brazil (CNPJ 67.860.141/0001-55), with its registered office at Rua Itaguaçu, 113, Sala 1, Morada de Santa Fé, Cariacica – ES, Brazil. We provide services including paid media management, search engine optimisation, social media strategy, conversion rate optimisation, web development, and marketing analytics to businesses across Brazil and internationally.

This Privacy Policy governs the collection, use, storage, disclosure and protection of personal data obtained through our website (the "Site"), our marketing materials, and any direct communications you send us. It applies to every visitor, prospective client, existing client, and business partner who interacts with Axtra Digital online.

We act as the data controller for all personal information collected directly by us. Where we process data on behalf of our clients (for example, when managing advertising campaigns that process their customers' data), we do so as a data processor under the terms of separate data processing agreements — this policy does not govern that processing.

By using our Site, you acknowledge that you have read and understood this policy. If you do not agree with any part of it, please discontinue your use of the Site. We encourage you to read this document in full; it is written to be transparent and straightforward, not to obscure your rights in dense legal language.

2 Information We Collect

We collect personal data through two main channels: information you actively provide to us, and information generated automatically when you browse our Site. We collect only what we genuinely need for the purposes described in this policy.

Information You Provide Directly

When you reach out to us via the contact details published on our Site — or through any third-party platform where we maintain a business presence — you may share personal information such as your name, business email address, telephone number, company name, and details of the services you are enquiring about. This applies whether you contact us by email, through a LinkedIn message, WhatsApp, or any other channel. We also retain records of our correspondence with you so that we can provide a coherent and informed response.

Information Collected Automatically

When you visit our Site, our hosting infrastructure and analytics tools automatically collect certain technical and behavioural data. This category of data does not, in most cases, directly identify you as an individual, but can — in combination with other data — constitute personal data under applicable law. We treat it accordingly.

Information We Do Not Collect

We do not collect sensitive personal data such as racial or ethnic origin, political opinions, religious beliefs, health data, biometric identifiers, or financial account details through this Site. We do not purchase data from third-party data brokers. We do not use deceptive means to obtain personal information.

3 How We Use Your Information

Every use of your personal data at Axtra Digital must rest on a lawful basis. Under both the LGPD and GDPR, we rely primarily on legitimate interests and consent as our legal grounds for processing. Where we cite legitimate interests, those interests are: operating and improving our website, responding to enquiries from potential clients, and conducting marketing analytics to understand the performance of our own digital presence.

• Responding to your enquiries. When you contact us, we use the information you provide to understand your requirements, respond to your questions, and — where appropriate — follow up to discuss how Axtra Digital might assist your business. The legal basis is legitimate interest (responding to a request you initiated) and, where required, consent.
• Understanding website performance. Aggregated and anonymised analytics data helps us identify which pages and content are most useful to visitors, so we can improve the quality and relevance of our Site. This is processed under our legitimate interest in maintaining an effective online presence.
• Measuring our own marketing campaigns. We use attribution data (ad click identifiers, referral sources) to evaluate the return on our advertising spend across Google Ads, Meta Ads, and other channels. This processing is necessary for the legitimate interest of running our business efficiently.
• Compliance with legal obligations. In some cases we are required to retain certain records — such as invoices or contracts — by Brazilian tax and commercial law. This processing is legally mandated and we have no discretion over it.
• Personalised remarketing (with consent). If you have accepted cookies that enable advertising personalisation, we may use platform pixel data to show Axtra Digital advertisements to Site visitors on Google and Meta properties. You can withdraw this consent at any time via our cookie settings.

Automated decision-making that produces legal or similarly significant effects is not used in connection with this Site or with any of our marketing activities directed at individuals. Any decision to engage our services is made by you voluntarily and without algorithmic profiling that affects your legal position.

4 Cookies & Tracking Technologies

Cookies are small text files that a website places on your browser or device when you visit. They serve a range of purposes, from keeping the Site functional to providing us with anonymous insights about how visitors engage with our content. We also use similar technologies including web beacons (tiny transparent images embedded in pages) and JavaScript tags deployed by third-party advertising platforms.

Managing Your Cookie Preferences

On your first visit to our Site, a consent banner will ask you whether you accept analytics and advertising cookies. You can accept all, reject all non-essential cookies, or choose individual categories. Your choice is saved for up to 12 months, after which we will ask again. You can revisit your preferences at any time by clearing your browser's cookies (which will reset the consent record) or by contacting us at the address in Section 11.

You may also control cookies directly in your browser settings. All modern browsers allow you to view stored cookies, block new cookies, and delete existing ones. Note that disabling certain cookies — particularly strictly necessary ones — may impair the functionality of our Site. Instructions for managing cookies in popular browsers are available at allaboutcookies.org.

For opt-out of Google Analytics specifically, Google provides a browser add-on at tools.google.com/dlpage/gaoptout. To opt out of personalised advertising from Google, visit adssettings.google.com. For Meta advertising controls, visit your ad preferences in your Facebook or Instagram account settings.

5 Sharing With Third Parties

We do not share your personal data with third parties except in the circumstances described below. In each case, we ensure that any recipient provides sufficient guarantees of data protection through contractual obligations, approved standard contractual clauses, or their own certification under recognised compliance frameworks.

• Service providers acting as data processors. We use a limited number of trusted technology vendors who process data on our behalf to deliver Site functionality and analytics. These include Google LLC (Google Analytics 4, Google Ads, Google Tag Manager), Meta Platforms Ireland Ltd (Meta Pixel and Conversions API), and our web hosting provider. Each of these vendors processes data only as we instruct and under contractual data processing terms.
• Professional advisers. Our legal, accounting and auditing advisers may access personal data where necessary to fulfil their professional duties — for example, when our accountants review contract records for tax filing purposes. These parties are bound by professional confidentiality obligations.
• Corporate transactions. If Axtra Digital were to merge with, be acquired by, or transfer substantially all of its assets to another entity, personal data held by us might be transferred as part of that transaction. We would notify you of any such transfer and of any material change to how your data is processed.
• Legal obligations and enforcement. We may disclose personal data when required to do so by Brazilian law, a valid court order, or a legitimate request from a competent public authority (such as the Autoridade Nacional de Proteção de Dados — ANPD). Where legally permitted, we will notify you of any such compelled disclosure before complying.

International Data Transfers

Some of our third-party service providers — most notably Google and Meta — are headquartered in the United States and may process data on servers located outside Brazil and the European Economic Area. When personal data is transferred internationally, we rely on Google's and Meta's adherence to the EU-U.S. Data Privacy Framework, their Standard Contractual Clauses (SCCs) approved by the European Commission, and equivalent mechanisms recognised under Brazil's LGPD, to ensure your data receives adequate protection regardless of where it is processed.

6 Data Retention

We keep personal data only for as long as it is necessary for the purpose for which it was collected, or as required by applicable law. The table below summarises our standard retention practices. When a retention period expires, we securely delete or anonymise the data so that it can no longer be associated with you.

• Enquiry and correspondence data — retained for up to 5 years from the date of last contact. This allows us to honour any commitments made in correspondence and to defend any legal claims that may arise within the limitation periods established by Brazilian civil law.
• Client contract and billing records — retained for the duration of the contractual relationship plus 5 years, in compliance with Brazilian tax and commercial law (Lei das Sociedades por Ações and Código Civil).
• Google Analytics data — we configure the data retention period in Google Analytics 4 to 14 months. After this period, user-level and event-level data is automatically deleted from Google's systems.
• Advertising platform data — conversion data stored in Google Ads and Meta Ads Manager is retained per each platform's standard retention policy, typically 28–90 days for attribution windows, with aggregate reporting data available for up to 25 months.
• Cookie consent records — we retain evidence of your consent choices for the duration of your consent (up to 12 months) plus 12 additional months, to be able to demonstrate compliance if required.

Where you have asked us to delete your personal data under the rights described in Section 8, we will action that request within 15 business days, except where retention is required by law or necessary to defend a legal claim.

7 Data Security

We implement technical and organisational security measures appropriate to the nature and volume of the personal data we process. Our security practices include:

• Transport encryption. Our Site is served exclusively over HTTPS using TLS 1.2 or higher, ensuring that data transmitted between your browser and our servers is encrypted in transit.
• Access controls. Access to systems containing personal data is restricted to authorised Axtra Digital personnel on a need-to-know basis. We use strong authentication methods, including multi-factor authentication, on all administrative accounts.
• Vendor due diligence. Before engaging any third-party processor, we review their security policies, certifications (such as ISO 27001 or SOC 2), and data processing terms to confirm they meet our standards.
• Periodic reviews. We review our security posture and this privacy policy at least annually, and whenever we introduce a new tool or processing activity that involves personal data.
• Incident response. We maintain a documented procedure for responding to personal data breaches. In the event of a breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority (the ANPD in Brazil, or the competent EU data protection authority where applicable) within 72 hours of becoming aware, and will communicate with affected individuals without undue delay where the breach is likely to result in high risk.

8 Your Rights

Depending on your location and the applicable law, you hold significant rights over your personal data. Residents of Brazil are protected by the LGPD; residents of the European Union and European Economic Area are protected by the GDPR. We apply these protections to all individuals whose data we process, regardless of nationality, as a matter of company policy.

How to Exercise Your Rights

To exercise any of the rights listed above, please send a written request to [email protected] with the subject line "Data Subject Request". Please identify yourself clearly and specify the right(s) you wish to exercise. We will acknowledge your request within 5 business days and respond substantively within 15 business days (extendable by a further 30 days in complex cases, with prior notice to you).

We will not charge a fee for handling straightforward requests. If requests are manifestly unfounded, excessive, or repetitive, we reserve the right to charge a reasonable fee or decline to respond, in which case we will notify you of our reasons.

If you are unsatisfied with our response to a rights request or with our handling of your personal data generally, you have the right to lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) in Brazil (gov.br/anpd) or — if you are located in the EU/EEA — with the data protection authority in your country of residence.

9 Children's Privacy

Our Site and services are directed exclusively at businesses and professionals. We do not knowingly market to, or seek to collect personal data from, children under the age of 18. Our Site contains no content designed to attract children, and the services we provide are of a commercial nature intended for adult decision-makers.

If we become aware that we have inadvertently collected personal data from a person under the age of 18 without verifiable parental or guardian consent, we will take immediate steps to delete that information from our records. If you believe we may have collected data from a minor, please contact us promptly at [email protected] and we will investigate and act accordingly.

Under Brazil's LGPD (Article 14), the processing of personal data of children requires specific consent from a parent or legal guardian. We take this obligation seriously and our Site is designed to ensure no such processing occurs.

10 Changes to This Policy

The digital landscape and the regulations that govern it evolve continuously. We review this Privacy Policy at least once per year, and whenever we introduce a new data processing activity, adopt a new third-party tool, or become aware of a change in applicable law that affects our practices.

When we make material changes — meaning changes that affect your rights or significantly alter how we use your data — we will update the "Last updated" date at the top of this page and, where we have contact information for you, provide direct notification by email at least 30 days before the change takes effect. For minor changes (such as editorial corrections or additional explanatory detail that does not alter the substance of our practices), we will update the document without individual notification.

We encourage you to revisit this page periodically to stay informed about our privacy practices. Your continued use of our Site after the effective date of any update constitutes your acknowledgement of the revised policy.

This policy does not create or modify any contractual relationship between you and Axtra Digital. Your rights under applicable privacy law exist independently of this policy and are not diminished by it.

11 How to Contact Us

If you have questions about this Privacy Policy, wish to exercise your data rights, want to report a concern about how we handle your personal information, or need to reach our designated data protection contact, please use the details below. We are committed to responding promptly and transparently.

For data rights requests specifically, please include "Data Subject Request" in your email subject line and identify the right you wish to exercise. For all other privacy enquiries, a brief description of your question or concern will help us direct your message to the right person quickly.

We aim to acknowledge all privacy-related communications within 5 business days (Monday to Friday, excluding Brazilian public holidays) and to provide a full response within the statutory timeframes set by the LGPD and GDPR respectively.