Privacy Policy

1.1 Controller

Cruzeiro Contabilidade, an accounting firm based in Cruzeiro do Sul (AC), Brazil, is the controller of the personal data processed on this website and in commercial contacts. The company's identification details (legal name, CNPJ and CRC registration) are shown in the footer of every page.

1.2 When we act as processor

When providing accounting, tax and payroll services, we also process third-party data that clients give us (for example, employees, partners and suppliers). In those cases the client is, as a rule, the controller, and Cruzeiro Contabilidade acts as processor, following the service agreement and the legal duties of the accounting profession.

2.1 Data you provide in the contact form

• Individuals: full name, email, mobile/WhatsApp and message.
• Companies: CNPJ, legal name, contact person, email, mobile/WhatsApp and message.
• Optional: CPF (individuals), emails for carbon copy (CC) and the company's size or segment. We only make mandatory what is necessary to reply (LGPD art. 6, III).

By entering emails in CC, you confirm that those people have authorized it. They only receive an acknowledgement with the service protocol — never the text of your message.

2.2 Data collected automatically

• Access logs: IP address, date and time, page visited and browser type, kept for security and as required by the Internet Civil Framework (art. 15).
• Preferences stored in your browser: language, font size, high contrast and your cookie choice. They stay on your device and do not identify you.
• Audience measurement: only if you click “Accept all” in the cookie notice (Google Analytics 4).
• Map on the contact page: loaded from Google Maps only with “Accept all” or a click on “Load map”; before that, no data goes to Google.

2.3 Data processed when providing services

Clients send us tax, accounting, labor and social-security documents that may contain personal data of partners, employees and third parties. This processing is governed by the accounting services agreement and by this Policy.

• Replying to your inquiry and preparing a proposal — preliminary procedures to a contract, at the data subject's request (LGPD art. 7, V).
• Looking up the CNPJ you enter — public data from the Federal Revenue registry, used only to fill in the legal name (art. 7, § 4).
• Sending the acknowledgement with a protocol number — preliminary procedures to a contract and legitimate interest in evidencing the service (art. 7, V and IX).
• Measuring website audience and showing the Google map — consent, which you may withdraw at any time (art. 7, I, and art. 8, § 5).
• Keeping access logs and website security — compliance with a legal obligation (art. 7, II) and legitimate interest in fraud prevention.
• Providing the contracted services — performance of contract (art. 7, V) and compliance with tax, labor, social-security and professional obligations (art. 7, II, and art. 11, II, “a”).

We do not make solely automated decisions about you and do not use your data for purposes other than those stated here.

Until you choose, the website uses only what is essential to work. Items that depend on permission are enabled only with “Accept all” — and refusing is as easy as accepting.

4.1 Essential (always on)

• CRUZEIRO_LOCALE (cookie, 1 year) and cruzeiro.idioma (local storage) — remember the chosen language.
• cruzeiro.cookies (local storage) — stores your cookie choice.
• cruzeiro.a11y (local storage) — font size and high contrast from the accessibility bar.

4.2 With your permission

• Google Analytics 4 (cookies _ga and _ga_<ID>, up to 2 years) — aggregated audience measurement, without advertising signals.
• Google Maps (contact-page map) — Google receives your IP address and may set its own cookies.

4.3 How to change your choice

Click “Cookie preferences” in the footer of any page: the notice comes back, Google Analytics cookies are deleted and, until you choose again, only essentials apply. You can also clear this site's data in your browser.

We do not sell or rent personal data. We share only what is necessary with:

• Website hosting (Vercel) and email delivery (Resend, Brevo or Locaweb), which process data on our behalf under contract and confidentiality obligations;
• Google, for audience measurement and the contact-page map, only with your consent;
• WhatsApp (Meta), only when you choose to talk to us there — the conversation is also subject to WhatsApp's privacy policy;
• BrasilAPI, which receives only the CNPJ you type, to query the Federal Revenue's public registry;
• Public bodies (Federal Revenue, eSocial, state finance departments, municipalities, commercial registries), when necessary to perform the contracted service or a legal obligation;
• Judicial or administrative authorities, upon lawful request.

Some providers (hosting, email and audience measurement) are based or have servers outside Brazil. In such cases the transfer follows LGPD art. 33, with contractual clauses ensuring a level of protection compatible with Brazilian law.

We use encrypted connections (HTTPS with HSTS), a content security policy, role-based access and access logs. Besides the LGPD, our team is bound by the professional secrecy of the Accountant's Code of Professional Ethics (NBC PG 01).

Please do not send documents or sensitive data through the website form: after the first contact we will provide a secure channel for exchanging documents.

If a security incident may cause significant risk or harm, we will notify the affected data subjects and the National Data Protection Authority (ANPD), as required by LGPD art. 48.

• Contact messages that did not become a contract: up to 2 years after the last contact, or earlier if you ask for deletion.
• Website access logs: 6 months (Internet Civil Framework, art. 15).
• Documents and records of services provided: for the periods set by tax, labor and social-security law (generally at least 5 years) and as long as needed for legal defense.

Once those periods end, data is deleted or anonymized.

Under LGPD art. 18 you may request, free of charge:

• confirmation that we process your data and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary data or data processed unlawfully;
• portability to another provider;
• deletion of data processed on the basis of consent;
• information on who we share data with;
• information on the possibility of refusing consent and its consequences;
• withdrawal of consent;
• objection to processing based on another legal ground (such as legitimate interest) in case of non-compliance with the LGPD (art. 18, § 2).

We reply within 15 days. You may also lodge a complaint with the ANPD (www.gov.br/anpd).

Data Protection Officer (LGPD art. 41): Privacy Channel — contato@cruzeirocontabilidadeac.com.br, subject “Privacy — LGPD”. This is the channel for data subjects' requests and complaints and for communications from the ANPD. We may ask for additional information to confirm your identity before handling the request.

The website is not directed at people under 18. Data of children and adolescents we receive while providing services (for example, dependants on payroll) is processed in their best interest, as required by LGPD art. 14.

We may update this Policy to reflect changes in the law or in our services. The date of the current version is shown at the top of the page; relevant changes will be highlighted on the website.