Privacy Policy

1. Who we are (data controller)

FORGET Co.(“we”, “us”, “our”), a company registered in Brazil under CNPJ 57.697.298/0001-58, with its place of business in Barueri, State of São Paulo, Brazil, is the controller of the personal data described in this policy. “Controller” has the meaning given to it by Article 4(7) of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and corresponds to the figure of the controladorunder the Brazilian General Data Protection Law (Lei 13.709/2018, “LGPD”).

You can reach us about any matter covered by this policy at contato@forgetcompany.com.

2. Information we collect

We collect personal data that you provide to us voluntarily when you:

• Fill in a contact or diagnostic form
• Request a strategic assessment
• Contact us by e-mail, WhatsApp or social media
• Browse our website (navigation data)

Personal data collected

• First and last name
• E-mail address
• WhatsApp or telephone number
• Company name
• Revenue range (provided voluntarily)

Navigation data

• IP address (anonymised)
• Browser type and operating system
• Pages visited and time on page
• Traffic source (referrer, campaign)

3. How we use your data

• Respond to your contact and diagnostic requests
• Send initial analyses and strategic proposals
• Improve our website and the user experience
• Measure the effectiveness of marketing campaigns
• Comply with legal and regulatory obligations

We never sell or share your personal data with third parties for their own commercial purposes.

4. Legal bases for processing (LGPD and GDPR)

Every processing operation described above relies on a legal basis. Under the GDPR those bases are the ones listed in Article 6(1). Under the LGPD they correspond to Article 7. We rely on the following:

• Consent (GDPR Article 6(1)(a), LGPD Article 7, I): non essential cookies, marketing communications and any form you submit after accepting this policy. You may withdraw consent at any time, and the withdrawal does not affect the lawfulness of processing carried out before it.
• Performance of a contract or pre contractual steps (GDPR Article 6(1)(b), LGPD Article 7, V): responding to your request, preparing a proposal and delivering our services.
• Compliance with a legal obligation (GDPR Article 6(1)(c), LGPD Article 7, II): tax, accounting and regulatory record keeping.
• Legitimate interests (GDPR Article 6(1)(f), LGPD Article 7, IX): measuring how our content performs, keeping our systems secure and improving our services. We balance those interests against your rights and freedoms, and you may object to this processing as described in section 9.

We do not knowingly process special categories of personal data (GDPR Article 9) or sensitive personal data (LGPD Article 5, II), and we ask you not to send such data through our forms or chat.

5. Cookies and tracking technologies

We use essential cookies to operate the website and analytics cookies (such as Google Analytics 4) to understand how visitors interact with our content. Marketing cookies are used only for paid traffic campaigns (Meta Pixel, Google Ads).

You can manage your cookie preferences at any time through your browser settings. Where the law requires it, non essential cookies are set only after you give consent.

6. Data sharing

Your data may be shared with:

• Analytics platforms: Google Analytics, Meta (anonymised data)
• CRM tools: for relationship management
• Infrastructure providers: hosting and e-mail services

All suppliers act as processors on our documented instructions, are bound by confidentiality undertakings and are covered by data processing agreements that meet Article 28 of the GDPR and Article 39 of the LGPD.

7. International data transfers

We are established in Brazil and your personal data is processed in Brazil. If you are located in the European Economic Area or in the United Kingdom, this means that your data is transferred to a country outside that area.

The European Commission has not issued an adequacy decision for Brazil under Article 45 of the GDPR. We therefore rely on the appropriate safeguard set out in Article 46(2)(c) of the GDPR, the Standard Contractual Clauses adopted by the European Commission, entered into with the recipients of the data, together with the technical and organisational measures described in section 11. Some of our suppliers may also process data in the United States or in other countries, under the same safeguards.

You may request a copy of the safeguards in place by writing to contato@forgetcompany.com.

8. Data retention

We keep personal data only for as long as it is necessary for the purposes described in this policy, or for as long as the law requires. Navigation data is kept for a maximum of 26 months. When a retention period ends, the data is deleted or anonymised.

Records kept to comply with tax and accounting obligations are retained for the statutory period applicable in Brazil, even after you withdraw consent for other purposes.

9. Your rights (LGPD and GDPR)

If you are in the European Economic Area or in the United Kingdom, Articles 15 to 22 of the GDPR give you the following rights:

• Access (Article 15): confirmation of whether we process your data, a copy of that data and information about how it is used
• Rectification (Article 16): correction of inaccurate or incomplete data
• Erasure (Article 17): deletion of your data where one of the grounds in that article applies
• Restriction of processing (Article 18): suspension of processing while a request is examined
• Data portability (Article 20): a copy of the data you provided, in a structured, commonly used and machine readable format, and its transmission to another controller where technically feasible
• Objection (Article 21): objection to processing based on legitimate interests, and an unconditional right to object to direct marketing at any time
• Not to be subject to a decision based solely on automated processing (Article 22), including profiling, where that decision produces legal effects concerning you or similarly significantly affects you. Where such processing occurs, you have the right to obtain human intervention, to express your point of view and to contest the decision
• Withdrawal of consent (Article 7(3)): at any time, without affecting the lawfulness of processing carried out before the withdrawal

Under the LGPD (Article 18), and regardless of where you are located, you also have the right to:

• Confirm that processing of your data exists
• Access your personal data
• Correct incomplete, inaccurate or out of date data
• Request anonymisation, blocking or deletion
• Withdraw consent at any time
• Request portability of the data
• Be informed about the public and private entities with which we have shared your data
• Request a review of decisions taken solely on the basis of automated processing (LGPD Article 20)

To exercise any of these rights, write to contato@forgetcompany.com. We answer without undue delay and in any event within one month of receiving the request, as required by Article 12(3) of the GDPR. That period may be extended by two further months where the request is complex, in which case we will tell you why. We may ask for information needed to confirm your identity before acting on a request.

10. Right to lodge a complaint

If you believe that we have processed your personal data unlawfully, you may lodge a complaint with a supervisory authority:

• Brazil: the National Data Protection Authority (Autoridade Nacional de Proteção de Dados, ANPD).
• European Economic Area: under Article 77 of the GDPR, the supervisory authority of the Member State of your habitual residence, of your place of work, or of the place where the alleged infringement took place.
• United Kingdom: the Information Commissioner’s Office (ICO).

We would welcome the chance to address your concern first, so please consider contacting us before you approach an authority. Doing so does not limit your right to complain at any time.

11. Security

We apply technical and organisational measures to protect your personal data against unauthorised access, destruction, loss or alteration, as required by Article 32 of the GDPR and Article 46 of the LGPD. Our website uses an SSL/TLS certificate to encrypt data in transit.

If a personal data breach occurs and it is likely to result in a risk to your rights and freedoms, we notify the competent supervisory authority and, where the law requires it, you.

12. Changes to this policy

We may update this policy from time to time. Material changes will be announced on our website. The date of the last update is always shown at the top of this page.

13. Contact

For questions about this policy or about how we process personal data: