Privacy Policy

1. What we collect

1.1. When you send the contact form

The form only collects data if you fill it in and submit it. These fields, and only these:

The four automatic items exist to serve your enquiry and to understand where requests come from. We do not collect IP addresses, geolocation, advertising identifiers or any sensitive data as defined in article 5, II of the LGPD.

1.2. Bot protection

The form contains a hidden field that only automated programs fill in. When it is filled in, the request is discarded without being recorded and no data is stored.

1.3. Cookies and audience measurement

The site uses Google Tag Manager to load one measurement tool: Google Analytics 4, which measures how the pages are used. It writes cookies to your browser.

None of it runs before you accept. On your first visit, every Google storage category — analytics_storage, ad_storage, ad_user_data and ad_personalization — is set to DENIED by default, and stays that way if you decline. Declining carries the same weight as accepting: two buttons, side by side, in the same notice.

1.4. What this website does not do

• It writes no measurement cookie before you accept: if you decline, none is written;
• It requires no account and no password: all content is freely accessible;
• It collects no IP address for its own purposes, no precise geolocation and no sensitive data within the meaning of article 5, II of the LGPD.

You may change your mind at any time: the “Cookie preferences” link, in the footer of every page, reopens the notice and lets you withdraw your consent.

2. Purposes and legal bases (articles 7 and 8 of the LGPD)

Form data is used to carry out preliminary steps relating to the contracting of our services: getting in touch with you, answering questions, preparing and presenting a proposal and moving the contracting process forward.

This processing is grounded in article 7, item V of the LGPD, being necessary for preliminary procedures relating to a contract requested by the data subject. That is why submitting the form does not require ticking a consent box: the legal basis is your own request, not consent.

Your data will be used only for the purposes stated in this Policy. Should a different purpose become necessary, you will be informed beforehand and, where the law requires it, your consent will be sought before that new processing begins.

3. Sharing and processors (article 5, VII of the LGPD)

Data is stored in an environment restricted to the Korner team. To run the operation we rely on the following processors:

• Google Workspace: receives the form, records the request in a spreadsheet, sends the internal notification to our team and the confirmation e-mail to you;
• Hostinger: infrastructure of the server that hosts the website. Korner's own server keeps technical access logs (IP address, date and time, page requested) for 6 (six) months, as required by article 15 of the Brazilian Internet Civil Framework, used solely for security and to comply with court orders.

These providers process data solely on our behalf and for the purposes described. Your data is not sold, rented, assigned or transferred to third parties for any other purpose without your prior, express consent.

3.1. Embedded third-party content

Some pages display content hosted by third parties. In both cases the technical choice was deliberately the one that collects least:

• Testimonial videos (YouTube): embedded through youtube-nocookie.com, YouTube's privacy-enhanced mode, which writes no tracking cookie before you press play;
• Contact page map (OpenStreetMap): we use OpenStreetMap rather than Google Maps precisely because it loads no tracking script.

When those elements load, your IP address is visible to the respective provider, as with any content fetched over the internet. The site's typefaces are served from Korner's own server, with no request to external services.

4. International transfers (article 33 of the LGPD)

The providers listed in Section 3 may process data on servers located outside Brazil. Should an international transfer of data arise at any point, Korner undertakes to adopt the mechanisms set out in article 33 of the LGPD with its processors, including the Standard Contractual Clauses approved by the ANPD.

5. Retention and deletion (articles 15 and 16 of the LGPD)

• Enquiries that do not lead to a contract: kept for up to 2 (two) years from the last interaction, then securely deleted or anonymised;
• Clients under contract: kept for the term of the contract and for up to 5 (five) years after it ends, to meet legal obligations and to exercise rights (article 16, I and II);
• You may request early deletion at any time (Section 6), except where the law requires the records to be kept.

6. Your rights as a data subject (article 18 of the LGPD)

At any time, and free of charge, you may exercise the rights set out in article 18 of the LGPD: among them confirmation that processing exists, access, correction, anonymisation, portability, deletion, and information about who your data has been shared with.

We answer requests within 15 (fifteen) days, through the channel in Section 7.

7. Data Protection Officer (article 41 of the LGPD)

Korner Engenharia has formally appointed, under article 41 of the LGPD and ANPD Resolution 18/2024, the following Data Protection Officer:

• Officer: Bruno Nercessian Corradini
• E-mail: contato@korner.com.br (suggested subject: “Privacidade/LGPD”)
• Phone: +55 11 3641-5461

Use this channel to exercise any of the rights in Section 6 or to ask questions about this policy.

8. Security and incidents (articles 46 and 48 of the LGPD)

We apply technical and administrative safeguards, including restricted access to records, two-step verification on the accounts that store data, and HTTPS-encrypted traffic across the whole site. Should a security incident occur that may cause relevant risk or harm to you, Korner Engenharia will report it to the ANPD and to the affected data subjects, under article 48 of the LGPD.

9. Minors

This website is intended for people aged 18 or over. We do not knowingly collect data from children or adolescents; if we identify such a record, it will be deleted.

10. Updates to this policy

This policy may be updated to reflect changes to the website or to the law. The date at the top indicates the version in force. Material changes will be announced on this same page.