Privacy policy.

Overview

1. Who we are

CCX Company ("CCX", "we", "our"), registered under CNPJ no. 24.329.191/0001-06, with headquarters in São Paulo/SP, is a consulting firm specializing in technology, digital commerce, integrations, data, artificial intelligence and SaaS products. We value privacy and are committed to protecting the personal data we process.

This Privacy Policy describes which personal data we collect, how we use it, with whom we share it, and what rights data subjects have, in compliance with the Brazilian General Data Protection Law (Law no. 13.709/2018 — LGPD), the Internet Civil Framework (Law no. 12.965/2014) and other applicable regulations.

2. Scope

This Policy applies to:

• Visitors to the website ccxcompany.co and subdomains;
• Prospects and commercial leads who interact via forms, WhatsApp, LinkedIn or events;
• Customers and customer representatives in contracted projects;
• Users of CCX proprietary products — CCX Messages, NexLog OS and NexLog OS Academy;
• Recipients of communications (email, SMS and WhatsApp) sent through CCX Messages on behalf of client companies;
• Candidates for job openings or internship programs;
• Suppliers, freelancers and commercial partners;
• Participants in events, webinars, podcasts and educational content.

3. Data controller & Data Protection Officer (DPO)

3.1. CCX Company is the data controller of personal data processed through this Website and in its direct commercial operations, in accordance with art. 5, VI of the LGPD.

3.2. In certain customer projects, CCX may act as a data processor on behalf of the Customer (controller). The responsibilities of this role are regulated in a specific DPA (Data Processing Agreement).

3.3. CCX's Data Protection Officer (DPO) can be reached at juridico@ccxcompany.co.

4. Legal bases

The processing of personal data is founded on the legal bases provided for in art. 7 of the LGPD:

• Contract execution or pre-contractual diligence (art. 7, V): to fulfill quote requests, prepare proposals, formalize and execute service provision contracts;
• Consent (art. 7, I): sending marketing communications, newsletters, event invitations, satisfaction surveys;
• Legitimate interest (art. 7, IX): service improvement, website personalization, analytics, responsible B2B prospecting, fraud prevention and asset protection;
• Compliance with legal obligation (art. 7, II): tax, accounting, labor and regulatory obligations;
• Regular exercise of rights (art. 7, VI): defense in legal, administrative or arbitration proceedings.

5. Processor role in CCX Messages

In the CCX Messages service — sending communications via email, SMS and WhatsApp on behalf of client companies — CCX acts as a data processor: we handle recipients' data exclusively under the instructions of the company communicating with you (the controller), under the applicable data processing agreement (DPA). In these cases, data-subject rights can also be exercised directly with the controller company.

Data collected

1. Data provided directly

When you fill out forms, contact us or contract our services, we may collect:

• Full name, corporate e-mail and phone number;
• Company name, position, area of operation and industry;
• CNPJ, business name and tax data (for billing);
• Business address and delivery data for physical materials;
• Information provided in briefings, RFPs, diagnostics and technical interviews;
• Content of messages via e-mail, WhatsApp, chat, contact forms;
• Participation in events, webinars, presentations and surveys;
• Resume, professional experience and other job application data.

2. Data collected automatically

When you browse our Website and use our products, we automatically collect:

• IP address, browser type and version, operating system, screen resolution;
• Approximate geolocation (city/state level), based on IP address;
• Cookies and technical device identifiers (see Cookie Policy);
• Pages visited, time spent, traffic source, click sequence;
• Interaction with marketing e-mails (opens, clicks, rejections);
• Technical access logs for security and audit purposes.

3. SaaS product data

For customers of CCX Messages and NexLog OS products, we also collect operational data necessary for operation:

• CCX Messages: Meta WhatsApp Business API credentials, registered contacts, message content, delivery and engagement metrics, service logs;
• NexLog OS: operational supply chain data (orders, shipments, customs documents, SKUs, suppliers, locations, ESG indicators);
• NexLog OS Academy: course progress data, assessments, issued certificates.

4. Third-party data

• Analytics and marketing platforms (Google Analytics 4, Meta, LinkedIn);
• Professional social networks (LinkedIn) when you interact with us;
• Data from commercial partners, in joint projects or partnership programs;
• B2B data enrichment bureaus (only with adequate legal basis).

5. Sensitive data

As a rule, CCX does not collect sensitive personal data (health, sexual orientation, religion, political opinions, biometrics). When processing is necessary — for example, accessibility at events or diversity programs — it will be done with specific and highlighted consent.

6. Data in CCX Messages (email, SMS and WhatsApp)

When a client company uses CCX Messages to communicate with you, we may process, under its instructions:

• Phone/WhatsApp number and/or email address;
• Name or identifier provided by the company;
• Content and templates of the messages sent;
• Delivery metadata (date, time, sent/read status);
• Consent (opt-in) and unsubscribe (opt-out) records.

Purposes and use

1. How we use your data

• Respond to contact requests, quotes, information and questions;
• Prepare commercial proposals, SOWs and formalize contracts;
• Provide consulting, implementation, squad and development services contracted;
• Operate and provide support for SaaS products (CCX Messages, NexLog OS);
• Send institutional communications, newsletters and event invitations (with consent or legitimate B2B interest);
• Personalize your experience on the Website and in communications;
• Analyze Website usage to improve navigation, content and journey;
• Manage business relationships with customers, partners and suppliers;
• Comply with legal, tax, labor and regulatory obligations;
• Prevent and investigate fraud, attacks, abuse and illicit activities;
• Process applications for positions, internships and CCX programs;
• Conduct research, market studies and analyses with anonymized data.

2. Automated decisions

CCX does not make decisions that produce significant effects on data subjects' legal sphere exclusively on the basis of automated processing. When we use automation in marketing (lead prioritization, segmentation) or in products (risk scoring, recommendations), there is always the possibility of human review upon request, in accordance with art. 20 of the LGPD.

3. Use in AI and language models

3.1. CCX uses generative AI internally (models such as Claude, GPT, Gemini) for productivity and development. Customer or lead personal data are not sent to public LLMs without adequate legal basis, DPA and safeguards against retention.

3.2. In AI projects contracted by customers, data processing is regulated by the specific DPA, with strictly defined purposes, prohibition of use for training models outside the project, and anonymization procedures where applicable.

4. Marketing & B2B prospecting

4.1. We send marketing communications (newsletter, events, content) based on consent or legitimate B2B interest for professional contacts (corporate e-mails), always with an unsubscribe option in each message.

4.2. We respect opt-out lists and record definitive rejection. We do not engage in spam nor share your database with third parties for direct marketing.

5. Communications via CCX Messages

Data processed in CCX Messages is used exclusively to enable the sending, delivery and measurement of the communications contracted by the controller company (performance of contract and the controller's legitimate interest, or consent where applicable) — never for CCX's own marketing purposes.

Sharing

1. Who we share with

We may share your personal data with specific categories of third parties, always with appropriate legal basis:

• Cloud infrastructure providers: AWS, Google Cloud, Microsoft Azure, Vercel, Cloudflare (hosting, CDN, storage, transactional email);
• Productivity and collaboration tools: Google Workspace, Microsoft 365, Slack, Notion, Jira, Confluence;
• Analytics tools: Google Analytics 4, LinkedIn Insight Tag, Meta Pixel (with consent when applicable);
• Marketing and CRM platforms: RD Station, HubSpot, Salesforce, Pipedrive (per project);
• Payment and financial providers: banks, gateways and processors for payment collection;
• Technology partners: VTEX, Salesforce, SAP, Shopify, MuleSoft — in the context of projects contracted by their respective clients;
• Public authorities: when required by law, regulation, court order or competent authority request;
• Legal, accounting and audit advisors: for compliance with legal obligations and regular exercise of rights;
• Potential successors: in corporate transactions (M&A, restructuring), observed confidentiality.

We do not sell, rent or commercialize personal data to third parties for direct marketing without your express consent.

2. Sub-processors in client projects

2.1. In projects where CCX acts as a processor of Client data, sub-processors may be involved (cloud, cognitive services, verified freelancers). The complete list is maintained in the specific DPA and updated upon prior notice.

2.2. All sub-processors adhere to data protection clauses equivalent to those applied to CCX, including appropriate technical and organizational measures.

3. International transfer

3.1. Your data may be transferred to servers located outside Brazil (notably United States and European Union) due to the use of cloud and SaaS services. These transfers are carried out in compliance with art. 33 of LGPD, through:

• Specific contractual clauses approved by ANPD, when applicable;
• Seals, certifications and recognized codes of conduct;
• Guarantees equivalent to LGPD standards in selected providers;
• Specific consent, when required.

3.2. Updated lists of main sub-processors may be requested at juridico@ccxcompany.co.

4. CCX Messages channels (Meta, carriers and providers)

To deliver CCX Messages communications, the strictly necessary data flows through each channel's official providers: the WhatsApp Business Platform (operated by Meta), telecom carriers (SMS) and email providers. These providers operate under their own terms and privacy policies and may process data outside Brazil — subject to the international-transfer safeguards described above.

Rights and retention

1. Your rights as data subject (art. 18 LGPD)

• Confirmation and access: to know if we process your data and obtain a copy;
• Correction: to update incomplete, inaccurate or outdated data;
• Anonymization, blocking or deletion: of unnecessary, excessive or non-compliant data;
• Portability: to receive your data in structured format or request transfer to another provider;
• Deletion: to request deletion of data processed based on consent;
• Information: to know with which entities your data has been shared;
• Withdrawal of consent: at any time, without prejudice to the lawfulness of prior processing;
• Opposition: to processing based on legal grounds other than consent, in case of LGPD non-compliance;
• Review of automated decisions: to request human intervention in automated decisions.

2. How to exercise your rights

Send your request to juridico@ccxcompany.co, providing your full name and clear description of the request. We may request identity proof to protect data against improper requests. The response is provided within 15 business days, and may be extended by another 15 days in complex cases (art. 19, §1º, LGPD).

The service is free. We may charge reasonable costs only for manifestly unfounded or repetitive requests.

3. Data retention

We retain your data for the period necessary for the stated purposes, observing the following reference periods:

After the retention period ends, data is deleted or anonymized irreversibly, unless additional retention is required by legal obligation or regular exercise of rights.

4. Data deletion and opt-out (CCX Messages)

You can stop receiving messages at any time — replying "STOP" on WhatsApp or SMS, or using the unsubscribe link in emails — and you can request the deletion of your data through the official channel suporte@ccxcompany.co. The full procedure, with timelines and steps, is on the Data Deletion page.

Security and incidents

1. Technical and organizational measures

CCX adopts proportional measures to risk to protect personal data, as per art. 46 of LGPD, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256);
• Role-based access control (RBAC) and principle of least privilege;
• Multi-factor authentication (MFA) mandatory in internal systems;
• Environment segregation (dev, staging, production);
• Audit logs with adequate retention;
• Vulnerability management, penetration testing and continuous SAST/DAST;
• 24×7 monitoring with SIEM and anomaly alerts;
• Regular backups with geographic redundancy and restore testing;
• Strong password policy and key and secret rotation;
• Periodic employee training in data protection and information security;
• Confidentiality agreements with all employees and third parties.

2. Physical and logical access

Access to personal data is restricted to employees and partners who need it for their duties. All undergo training, sign confidentiality agreements and are subject to internal audit.

3. Security incidents

3.1. In case of a security incident that may cause relevant risk or damage to data subjects, CCX will notify ANPD and affected data subjects within a reasonable timeframe, as per art. 48 of LGPD, informing:

• Nature of personal data affected;
• Information about the data subjects involved;
• Indication of technical and security measures used;
• Risks related to the incident;
• Reasons for delay, if notification was not immediate;
• Measures adopted to reverse or mitigate effects.

3.2. CCX maintains a documented incident response plan (IRP), with roles and responsibilities, containment, eradication, recovery and lessons learned procedures.

4. Vulnerability reporting

If you identify a security vulnerability in our systems, report it to juridico@ccxcompany.co. CCX appreciates responsible disclosures, commits to respond within 72 business hours and will not take legal action against researchers acting in good faith within ethical and legal boundaries.

5. Changes to this Policy

We may update this Policy periodically to reflect legal, technological or operational changes. Substantial changes will be communicated on the Site with prominence and, when applicable, by email. The date of last update appears at the top of this page.

Document updated on July 14, 2026. CCX Company — All rights reserved.