Privacy Policy

1. Who we are and how to reach us

Toffanin Tecnologia LTDA (CNPJ/tax ID: 69.184.924/0001-91), owner of the Valletta 356 Digital Studio brand, is the controller of the data handled here. The website valletta356.com and our customer service present themselves as Valletta 356.

Channel of the data protection officer (Brazilian LGPD, art. 41): privacy@valletta356.com. Use it for questions about this policy and to exercise your rights.

2. Summary: what we process, why and on which legal basis

3. Contact form

When you submit the form we handle: name, email, phone, company, country, contact preference, subject, project timing, investment range, message, language, originating page and campaign parameters (UTMs), plus a record of your consent. Only name, email, subject and consent are required: without them we cannot reply; the rest is up to you. We use this data to answer your request, prepare a proposal and contact you through your preferred channel, and we record them in our service system (CRM). We do not use them for newsletters or mass advertising.

Consent to be contacted is optional and may be withdrawn at any time at privacy@valletta356.com; withdrawal does not affect what was done before it. Because the message is free text, please do not write sensitive data (health, religion, politics, etc.) or documents in it.

4. How the data travels

The form sends your data by email to our mailbox (Cloudflare Email Routing and Email Workers) and, at the same time, delivers it to our service and management system (CRM), where the contact is recorded as a business inquiry, with the person in charge, the contact history and proposals. The system runs on Amazon Web Services (AWS) in the Northern Virginia (USA) region, that is, with the data in the United States (section 7). The email remains the backup copy. If our system is down, the site keeps the submission briefly, only until it can be delivered.

You receive a protocol number (format V356-YYYY-NNNN, sequential per year), which contains no personal data, and a confirmation email sent through Resend, a US company. To limit abuse we count submissions per IP in temporary memory (a Cloudflare Durable Object), using only a code derived from the IP, with no persistent storage.

5. Cookies and browser storage

Google Analytics runs with Consent Mode: everything stays denied until you accept; advertising and personalization signals remain off; data is kept for 2 months. Cloudflare Web Analytics measures aggregate audience without cookies. Fonts and styles are served by us, with no Google Fonts or third-party CDN. To change your choice at any time, use "Cookie preferences" in the footer.

6. Who we share with

• Cloudflare: site hosting, email, protection and cookieless analytics.
• Amazon Web Services (AWS), United States (Northern Virginia): hosting of our service system.
• Resend: contact confirmation and system emails.
• Google: Analytics, only with your consent.
• Instagram/Meta: buttons lead to the profile @studiovalletta356; their policy applies there.

Whoever handles data for us does so only for the purposes above and under contract; the list of those providers' subprocessors is available on request at privacy@valletta356.com. We may also disclose data to authorities when the law or a court order requires it. We do not sell your data.

7. International transfer

Some providers process data outside Brazil: Amazon Web Services (USA, Northern Virginia, where our service system runs, with contacts, history and proposals), Resend (USA), Google (USA and other countries) and Cloudflare (global network). These transfers follow articles 33 to 36 of the LGPD and ANPD Resolution CD/ANPD No. 19/2024, with each provider's contractual safeguards, in particular the standard contractual clauses approved by the ANPD (art. 33, II), where the provider offers them in its data processing agreement (DPA), as AWS does. You may ask for information about these transfers and the safeguards adopted at privacy@valletta356.com.

8. How long we keep data

In the CRM we keep your contact as follows:

• Customer (accepted proposal or contract): during the relationship and for 5 years after it ends, to meet legal obligations and defend rights.
• Ongoing contact: while the service lasts.
• Lost contact (did not move forward): 24 months after the last contact; then we delete or anonymize the data.
• Spam: 90 days.
• Your request: you may ask for deletion at any time (section 10); we delete, except what the law requires us to keep.

Contact emails in our mailbox follow the same period. Backups are overwritten on a short cycle, and deleted data disappears from them at the end of that cycle. Access data follows the providers' own periods.

9. Security

The site and the system use encrypted connections (HTTPS). Access to our service system is restricted to our team, with a password and two-step verification, and we keep backups. No system is completely immune to failures; if an incident may bring you relevant risk or harm, we will notify you and the ANPD, as the LGPD requires (art. 48).

10. Your rights

Under the LGPD (art. 18) you may request:

• confirmation that we process your data and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data, or data processed unlawfully;
• portability of the data to another provider, as regulated;
• deletion of data processed with your consent;
• information on whom we share your data with;
• information on the possibility of not giving consent and what happens if you don't;
• withdrawal of consent;
• objection to processing done without consent, if it breaches the law;

How to ask: write to privacy@valletta356.com or, as an alternative channel, use the Instagram profile @studiovalletta356. Requests are free of charge. We may ask you to confirm your identity before handing over or deleting data, so it does not reach someone else. We reply within 15 days. You may also complain to the Brazilian Data Protection Authority (ANPD, gov.br/anpd) and to consumer protection bodies.

11. Children and teenagers

The site is aimed at businesses and professionals and is not intended for anyone under 18. If we learn that we received a minor's data through the form, we delete it.

12. Updates and history

Changes create a new dated version, published on this page.