Privacy policy

Information we receive

The site has no form and no registration area. Personal information almost always arrives by e-mail, when the person writes to us. Those messages usually carry name, position, company, phone number, e-mail address and a description of the deal or service at hand.

In an intermediation, company documents may also arrive, such as articles of association, certificates and commercial proposals, which contain the names of partners and officers. Such documents are requested only when a concrete negotiation requires them, never in advance.

From visitors who only browse, the site receives what any web server receives: IP address, browser type, pages viewed and time of access. None of it is matched to a name.

How we use it

Information from buyers and providers is used to prepare, present and follow proposals: reading the request, finding who can deliver, building the comparison, drafting the agreement and checking deliveries and scheduled payments. That is the only purpose the data serves.

Names and e-mail addresses are also used to answer the messages received and to keep both parties informed about the progress of what was agreed. USDI sends no bulk promotional communication and does not use the data it receives to prospect third parties.

The site's technical logs serve only to keep it online and to investigate failures or attempts at unauthorized access.

Third parties involved

The nature of USDI's work involves passing information from one party to the other. This happens only to the extent the negotiation requires: the buyer sees the provider's proposal and qualification; the provider sees the buyer's request. Sensitive documents of one party are not forwarded to the other without express authorization.

Beyond the parties to a deal, data may be seen by the infrastructure suppliers the company uses to host the site and to receive e-mail, within the functions contracted from them. There is no sale, rental or transfer of lists to third parties.

A public authority may receive data when there is a legal obligation or a court order, and only in that case.

Technical logs and session cookies

The website heycontrolpath.com sets no tracking cookies, loads no audience analytics scripts and shows no advertising. A technical session cookie may exist, set by the hosting infrastructure to deliver the page securely; it expires on its own and does not identify the person.

Server access logs are kept for the short period adopted by the hosting provider and then discarded.

Retention period

Messages and documents tied to a negotiation are kept while the agreement is in progress and for the period Brazilian commercial and tax legislation requires for preserving contracts and receipts. After that they are deleted or anonymized.

Messages that do not lead to a deal are deleted sooner, as soon as the conversation ends. Data from providers who asked to stay on file for future demands remains until the company itself asks for removal.

Rights under the LGPD

Anyone whose data has passed through USDI may ask, at any time, for: confirmation that processing exists; access to what is stored; correction of incomplete, inaccurate or outdated information; anonymization, blocking or deletion of anything unnecessary or excessive; portability; information about with whom the data was shared; and withdrawal of consent previously given.

Requests are made by e-mail to contato@heycontrolpath.com, with enough identification for the company to locate the data. The answer is given within 15 business days. If the person considers the request unmet, they may turn to the Brazilian National Data Protection Authority (ANPD) at gov.br/anpd.

Protective measures

The site is served only over an encrypted connection. The company's mailboxes use their own authentication, and access to negotiation documents is restricted to the people working directly on the agreement.

Documents received are not republished on the site nor stored in open sharing services. Should a security incident with relevant risk to data subjects occur, USDI notifies the ANPD and the people affected as the law requires.