Privacy policy
Version 8, effective October 10, 2026.
This Privacy Policy explains how TDS Tecnologia e Desenvolvimento de Software Ltda. (TDSoft), a Brazilian company registered under CNPJ no. 04.271.168/0001-92, processes personal data on the tdsoft.com.br website and in the systems it provides to its customers: what data it collects, why, who it shares it with, how long it keeps it, and how you can exercise your rights. It follows Brazil's General Data Protection Law (LGPD, Law no. 13,709/2018) and replaces the 2021 version.
1. Definitions
To make this policy easier to read, we use these terms:
- Personal data: information about an identified or identifiable individual, such as name, email, phone number, tax ID (CPF), login and usage records.
- Data subject: the individual the personal data refers to.
- Processing: any use of personal data, such as collection, storage, access, sharing, transfer, anonymization and deletion.
- Controller: whoever decides how data is processed. TDSoft is the controller of website data and of the data of its customers and users.
- Processor: whoever processes data on behalf of a controller. TDSoft is a processor of the data its customers enter into its systems.
- Systems: TDSoft software used by customers, such as ADSIM, ADSALES, AdDigital and Mídia+.
- Customer: an individual or company that contracts with TDSoft.
- User: an individual registered by a customer to use the systems.
- Website: tdsoft.com.br, including the blog.
2. Data processed on the website
Contact form
| Data | Purpose | Legal basis |
|---|---|---|
| Name and email (required), phone and message (optional) | Replying to your business inquiry: questions, proposal or demo requests | Pre-contractual steps taken at the data subject's request (LGPD, art. 7, V) |
| Version of the policies accepted, date and time of acceptance, and page language | Showing that you were informed of this policy and the Cookie Policy before submitting | Compliance with a legal obligation and exercise of rights (art. 7, II and VI) |
| IP address the message was sent from | Form security (investigating spam, abuse and fraud) and keeping the access record required by Brazil's Internet Civil Framework (Law No. 12,965/2014, art. 15) | Compliance with a legal obligation and legitimate interest (art. 7, II and IX) |
How it works:
- Before submitting, you must confirm that you have read and accept this Privacy Policy and the Cookie Policy. We record the version of each, the date and time, and the language.
- Your message is sent by email to TDSoft's sales team, and a copy is stored in a database, with your name, email, phone, message and IP address encrypted by the application itself, on top of database encryption. Only authorized TDSoft staff can access this copy, and every view, export or deletion is logged.
- Retention: the IP address is erased 6 months (180 days) after submission, the minimum period under Brazil's Internet Civil Framework; the rest of the database copy is kept for 365 days from submission. After that, the personal data is erased and only the date and language of the inquiry remain, for statistics, without identifying anyone. The email received in the corporate mailbox follows TDSoft's corporate email retention policy. If your inquiry leads to a negotiation or contract, your data then follows the rules of that business relationship (section 3).
Website chat
The chat button in the corner of the pages opens a conversation with the TDSoft team through Chatwoot. Nothing from the chat loads until you click the button.
| Data | Purpose | Legal basis |
|---|---|---|
| Conversation messages and any data you choose to share in them (such as name, email, company or phone number) | Answering your questions and your sales or support requests | Pre-contractual steps at the data subject's request and performance of a contract (LGPD art. 7, V) |
| Technical conversation data: IP address, browser, operating system, the page where you opened the chat, date and time | Helping you with context and keeping the chat secure | Legitimate interest (art. 7, IX) |
- Conversations are stored in Chatwoot, TDSoft's own customer service tool, hosted on Amazon Web Services in the United States (sections 4 and 5). Only authorized TDSoft staff can access them.
- To keep the conversation going from one page to the next, the chat stores cookies in your browser, described in the Cookie Policy.
- Do not send sensitive data (such as health data, ID documents or passwords) through the chat.
- Retention: conversations are kept for up to 365 days after the last message and then deleted, unless the contact turns into a negotiation or contract (section 3).
Newsletter
You can subscribe to the TDSoft newsletter in the footer of every page and at the end of blog articles.
| Data | Purpose | Legal basis |
|---|---|---|
| Email, page language, the page where you subscribed, version of this policy you accepted, date and time of the request and of the confirmation | Sending the newsletter (TDSoft articles and news) and proving your consent | Consent (art. 7, I) |
- Double opt-in: after your request, we send a confirmation link to the email you entered. Without confirmation, nothing is sent and the request is deleted within 7 days.
- The email is stored encrypted in the website database and, after confirmation, sent to TDSoft's email marketing tool (Mautic), hosted on Amazon Web Services in the United States, which sends the newsletter. We do not sell or share the list.
- To unsubscribe, use the link included in every email. Your address leaves the list immediately and is marked "do not contact" in Mautic so you receive no further messages. The record on the website is anonymized 30 days after you unsubscribe.
- You can also ask for news by checking "I want to receive TDSoft news by email" on the contact form. It is optional, separate from accepting this policy, and follows the same double opt-in: nothing goes to Mautic without your confirmation.
- Pages visited (Mautic): if you accept marketing cookies, Mautic records the pages of the website you visit. These visits are only linked to your email if you are subscribed and reach the website through a link in one of our emails; they help us understand interest in each topic and prioritize sales follow-up. Legal basis: consent (LGPD, art. 7, I), which you can withdraw in the cookie preferences.
Abuse protection
To prevent spam and attacks on the form:
- We limit the number of submissions. To do so, we use a code derived from your IP address (produced by a one-way cryptographic function); the IP address itself is not stored.
- When enabled, we use the Cloudflare Turnstile bot check, which analyzes technical browser signals to tell people from bots.
- The form has a hidden field that only bots fill in; it does not collect any data.
Legal basis: TDSoft's legitimate interest in keeping the website secure (art. 7, IX).
Analytics and marketing
Analytics (Google Analytics) and marketing (Google Ads, Meta and Mautic) cookies and tools are used only with your consent (art. 7, I), given in the website's cookie notice, and you can decline or withdraw it at any time through the "Cookie preferences" link in the footer. Details on each cookie are in the Cookie Policy.
We also use Cloudflare Web Analytics to count visits and measure page performance. It does not use cookies or browser storage and does not identify visitors: it only records aggregate data such as the page viewed, where the visit came from, country, device type and load time. That is why it works regardless of your cookie choice, based on TDSoft's legitimate interest in understanding how the website is used and how it performs (art. 7, IX).
Careers
The website no longer collects resumes or applicant data. TDSoft job openings are posted on LinkedIn, and applications made there are also subject to LinkedIn's privacy policy.
TDSoft staff
TDSoft staff who publish on the blog sign in to the admin area with their Microsoft corporate account. We process their name, corporate email and records of their actions (such as publishing and editing posts) for access control and security (art. 7, V and IX).
3. Data processed in TDSoft systems
| Source | Data | Purpose and legal basis |
|---|---|---|
| Provided by the customer when contracting | Details of the contracting party or its legal representative: name, CPF or other tax ID, identity document and address | Entering into and performing the contract (art. 7, V) |
| User registration by the customer | Name, email, role and access permissions | Giving the customer's staff access to the systems and running satisfaction surveys (performance of contract, art. 7, V) |
| Provided by users when registering | Data that varies by user type, such as organization, job title, phone numbers and password | Giving access to the systems (performance of contract, art. 7, V) and, where stated, consent (art. 7, I) for data not required for access |
| System use and support | Access logs and records of actions taken, such as login attempts, queries, data entries and changes, reports, and document uploads and downloads | Recording and protecting operations (performance of contract and legitimate interest, art. 7, V and IX) and keeping the access logs required by Brazil's Internet Civil Framework (Marco Civil da Internet) (art. 7, II) |
| Entered by users | Data the customer chooses to record in the systems | Providing the services contracted by the customer (TDSoft acts as processor; see below) |
TDSoft as processor. Customers may pre-register their users; each user receives an email and must accept the terms of use and this policy to complete registration. While using the systems, users may enter personal data of third parties to manage advertising sales. In that case, the customer is the controller, and TDSoft processes that data only according to the customer's instructions and the contract. The customer is responsible for having a legal basis for that processing and for handling requests from those data subjects; TDSoft assists as far as it can.
Anonymized data. TDSoft may use data from its operations, provided it is anonymized as defined by the LGPD, to improve its services and to produce research, performance reports and management information.
4. Sharing and processors
We do not sell personal data. We share only what is necessary, and only for the purposes in this policy:
- With the customer: users' data, including usage records, may be shared with the customer the user is linked to. The customer is solely responsible for the access permissions it grants.
- With authorities: when required by law or court order, or to defend TDSoft's rights.
- With vendors (processors) that provide services to TDSoft and process data on our behalf under contract:
| Vendor | What it does for TDSoft | When |
|---|---|---|
| Amazon Web Services | Hosting for the website and systems, database and email delivery | Always |
| Microsoft | Corporate email, where inquiries arrive, and sign-in for TDSoft staff | Always |
| Cloudflare | Bot check on the contact form and cookieless visit statistics (Web Analytics) | Bot check: when enabled; statistics: on every visit, without identifying anyone |
| Google (Analytics, Ads and Tag Manager) | Visitor statistics and ad measurement | Only with your consent |
| Meta (Pixel) | Ad measurement and personalization | Only with your consent |
| Chatwoot (TDSoft's tool, hosted on Amazon Web Services) | Website chat: stores conversations and lets the TDSoft team reply | Only when you open the chat |
| Mautic (TDSoft's tool, hosted on Amazon Web Services) | Sending the newsletter and, with marketing cookies, recording the pages visited | Newsletter: only if you subscribe and confirm; pages visited: only with your consent |
Third-party sites. The website and systems may link to third-party sites and services, such as LinkedIn and other social networks. When you visit them, their own privacy policies apply, and TDSoft has no control over them.
5. International transfers
TDSoft is based in Brazil, and some of these vendors may store or process data outside Brazil, especially in the United States and the European Union. These transfers rely on the mechanisms in art. 33 of the LGPD, such as the standard contractual clauses approved by the ANPD and the contractual safeguards offered by the vendors, or on your specific consent where applicable (analytics and marketing cookie data).
6. Retention and deletion
- Website inquiries: IP address for 180 days; other data, 365 days in the database, then anonymization (section 2); the email received follows the corporate email retention policy.
- Website chat: conversations for up to 365 days after the last message (section 2).
- Newsletter: while you are subscribed; unconfirmed requests, 7 days; after unsubscribing, 30 days and then anonymization (section 2).
- Cookies: for the periods listed in the Cookie Policy.
- Customers and system users: for as long as the relationship with the customer lasts. Data of active users is not deleted merely because a user account is suspended.
- After the relationship ends, we may keep data for as long as needed to meet legal or regulatory obligations, for audits, or to exercise TDSoft's rights, and then delete or anonymize it.
7. Your rights
Under the LGPD (art. 18), you may ask TDSoft at any time for:
- confirmation that we process your data, and access to it;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of data that is unnecessary, excessive or processed unlawfully;
- portability of your data to another provider, under ANPD regulations;
- deletion of data processed on the basis of your consent, except where the law provides otherwise;
- information about who we share your data with;
- information about your option not to consent and the consequences of declining;
- withdrawal of consent;
- review of decisions made solely through automated processing;
- objection to processing based on another legal basis, where the LGPD is not being complied with.
How to make a request: email lgpd@tdsoft.com.br. To protect your data, we may ask for information that confirms your identity; if we cannot verify it securely, we will let you know. We respond within the legal deadlines; confirmation and full access are provided within 15 days, as set out in art. 19 of the LGPD. If we cannot fulfill a request, for example because of a legal retention obligation, we will explain why.
If you are a system user and your request concerns data a customer entered into the system, we will forward it to that customer, who is the controller of that data.
You may also file a complaint with Brazil's National Data Protection Authority (ANPD).
Data subjects in the European Union, Portugal and Spain: the same rights are honored under the General Data Protection Regulation (GDPR), through the same channel. You may also lodge a complaint with the data protection authority in your country.
8. Security
We use technical and organizational measures to protect personal data, including:
- connections always encrypted (HTTPS);
- contact form data encrypted by the application, and an encrypted database;
- access restricted to authorized staff with corporate sign-in, and logging of views, exports and deletions;
- technical logs without personal data;
- collecting only the data we need.
Data may be stored in cloud computing services. No system is fully immune to failures or attacks; if you become aware of anything that compromises the security of your data in your relationship with TDSoft, please let us know at lgpd@tdsoft.com.br.
9. Changes to this policy
TDSoft may update this policy, for example when the way we process data or the law changes. The current version and its effective date are shown on this page. Material changes take effect when the new version is published on the website.
10. Contact and Data Protection Officer
Questions about this policy or about how TDSoft processes personal data can be sent to the Data Protection Officer (DPO) ("Encarregado pelo Tratamento de Dados Pessoais" under the LGPD) at lgpd@tdsoft.com.br.
TDS Tecnologia e Desenvolvimento de Software Ltda. — CNPJ 04.271.168/0001-92.