Legal document

Privacy policy

Last updated: August 2026.

Controller identification

This website and the VGrid brand are operated by Rafael Lotfi Marrocos Leite Ltda., trading as LM Consultoria, registered under Brazilian tax ID (CNPJ) 41.737.358/0001-89, with registered office in São Paulo, SP, Brazil (“VGrid”). For the processing described in this policy, that legal entity acts as controller. Email: contato@vgrid.com.br.

About this translation

The English and Spanish versions are translations provided for convenience. In the event of any divergence of interpretation, the Portuguese version published at https://vgrid.com.br/privacidade/ prevails, without prejudice to applicable mandatory rules.

1. Who the controller is

This website and the VGrid brand are operated by Rafael Lotfi Marrocos Leite Ltda., trading as LM Consultoria, registered under Brazilian tax ID (CNPJ) 41.737.358/0001-89, with registered office in São Paulo, SP, Brazil (“VGrid”). For the processing of personal data described in this policy, that legal entity acts as controller.

Channel for privacy and data protection matters: contato@vgrid.com.br. Person responsible for responding: Rafael Lotfi Marrocos Leite.

2. Data we actually collect

We collect only what is effectively implemented on this website:

  • Data you provide in the contact and initial assessment forms: name, company, corporate email and, where you fill them in, phone number, job title and message. We also record the page the submission came from.
  • Direct contact data: if you write to contato@vgrid.com.br or message WhatsApp +55 11 97218-8342, we process the data you include in your message.
  • Browsing data generated by the Google tag when you accept optional cookies: cookie identifiers, IP address (processed by Google, with ads data redaction enabled), pages visited and interaction events.
  • Technical infrastructure logs kept by the hosting and database providers for the security and operation of the website, including IP address and user agent.

3. Source of the data

Data comes from you, when you complete a form or write to us, and from your browser, when measurement technologies are authorised. We do not buy lists, we do not enrich records with third-party databases and we do not collect social media data unless you provide it.

4. Purposes and legal bases, by activity

Each purpose has its own legal basis. We do not rely generically on “legitimate interest and consent” for everything:

  • Responding to a contact or an initial assessment request and conducting the subsequent commercial and consulting conversation — legal basis: preliminary procedures related to a contract, at the data subject's request (art. 7, V, LGPD).
  • Internally qualifying the message received in order to prioritise handling, supported by automated processing that assigns a score and a written justification to the request — legal basis: legitimate interest (art. 7, IX, LGPD). That score organises the human handling queue; it does not by itself decide on engagement, pricing or refusal of service. You may request human review through the channel indicated in this policy.
  • Sending the internal notification of the request and, where you asked for a material, the email containing that material — legal basis: preliminary procedures and legitimate interest, as applicable.
  • Measuring audience and campaign performance through analytics and advertising cookies — legal basis: consent (art. 7, I, LGPD), collected in the banner and revocable at any time.
  • Maintaining the security, availability and integrity of the website, including technical logs — legal basis: legitimate interest (art. 7, IX, LGPD).
  • Complying with legal or regulatory obligations and exercising rights in proceedings — legal bases in arts. 7, II and VI, LGPD.

5. Who we share data with

We do not sell, rent or transfer personal data for third-party advertising. We share only with categories of processors necessary to operate the website, each with a defined purpose:

  • Hosting and content delivery (CDN) provider, to serve the pages and keep technical logs.
  • Database and server functions provider, where submissions made through the forms are stored.
  • Transactional email service of the infrastructure platform, for the internal notification of the request and for sending requested materials.
  • Language processing service contracted by the infrastructure platform, used exclusively for the qualification described in item 4.
  • Google, as processor of the measurement and advertising technologies, when you consent to optional cookies.
  • Public authorities, where there is a valid legal request.

6. International transfers

The hosting, database, transactional email and measurement providers are companies operating outside Brazil. There is therefore an international transfer of personal data to the United States and, depending on each provider's infrastructure, to other countries where it maintains servers. The transfer takes place in order to make the service itself possible. If you want to know which providers are in use on the date of your enquiry and which contractual safeguards are in place for each of them, write to contato@vgrid.com.br and we will inform you of the current situation.

7. Retention and disposal

We do not set an artificial numeric period. We use verifiable criteria: contact and assessment requests are stored while a relationship or commercial discussion is ongoing and, once it ends, for as long as necessary to defend rights and to comply with applicable legal obligations; technical security logs are kept for the operational period defined by the infrastructure provider; for Google measurement data, the effective period is defined in the tool's own settings and can be requested from us at any time through the contact email; processing ceases when you withdraw consent and the optional first-party cookies are removed. Once the applicable criterion ends, data is deleted or anonymised.

8. Security

We adopt technical and organisational measures proportionate to the risk, including access control through authentication, segregation of database permissions, encrypted communication in transit and periodic review of permissions. No digital environment is invulnerable: we do not promise absolute security and, in the event of a relevant incident, we act in accordance with the notification duties set out in the LGPD.

9. Your rights as a data subject

Under art. 18 of the LGPD, you may request:

  • confirmation that processing exists;
  • access to the data;
  • correction of incomplete, inaccurate or out-of-date data;
  • anonymisation, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law;
  • portability to another provider, subject to regulatory limits and to commercial and industrial secrecy;
  • deletion of data processed on the basis of consent, in the cases provided by law;
  • information about the public and private entities with which we share data;
  • information about the possibility of refusing consent and the consequences of that refusal;
  • withdrawal of consent;
  • review of decisions taken solely on the basis of automated processing, where applicable;
  • the right to petition the Brazilian data protection authority (ANPD) and consumer protection bodies.

10. How to exercise your rights

Send your request to contato@vgrid.com.br or use the contact page at https://vgrid.com.br/en/contact/. We reply through the same channel and, where the request involves access, correction or deletion, we may ask for additional information to confirm that you are the data subject — for example, confirmation of the original submission made through the form. That verification data is used for that purpose only.

11. Cookies and measurement technologies

We use two categories. Necessary cookies keep the website working and store your own consent choice; they do not depend on authorisation. Optional cookies are split into analytics (audience and page-use measurement) and advertising (Google Ads campaign measurement and remarketing). Optional cookies are off by default and remain blocked until you authorise them: the website declares consent as denied before any tag fires and only updates it after your choice. You can accept, refuse or change your decision later, as often as you want.

12. Who this website is intended for

This is an institutional website aimed at organisations and professionals evaluating corporate services. We do not direct content, advertising or forms to children and adolescents and we do not request data of that nature. If we identify that we have received data from a child or adolescent by mistake, we delete the record.

13. Languages of this policy

The English and Spanish versions are translations provided for convenience. In the event of any divergence of interpretation, the Portuguese version published at https://vgrid.com.br/privacidade/ prevails, without prejudice to applicable mandatory rules.

14. Changes

This policy may be updated. Relevant changes take effect upon publication on this page, with the reference date updated, and the same revision is applied simultaneously to the English and Spanish versions.

Questions about how we handle your data?

Write to contato@vgrid.com.br or use the contact page — we respond directly.

Request an initial assessment