Privacy Policy for the Ducke Website

1. Controller

RCI Consultoria Ltda., CNPJ 51.768.490/0001-01, with registered office at Rua Doutor Querubino Soeiro, 760, Sala 02, Centro, Leme/SP, CEP 13610-080, is responsible for decisions regarding personal data processed on its institutional website, in commercial contacts, in account administration, billing, support, and the security of its own operations.

2. Scope

This Policy explains how Ducke processes data of visitors, prospects, customer representatives, suppliers, and users who interact with the website. Ducke is the controller of data needed for account registration, contracting, billing, tax documents, security, fraud prevention, support, and its own legal duties. For personal data the customer enters, imports, or syncs in the CRM to manage contacts, conversations, opportunities, campaigns, and processes, the customer is the controller: the customer decides the purposes and essential means, and Ducke acts as processor, handling that data to provide the service under documented instructions.

3. Data that may be processed

Identification and contact data, such as name, phone number, company, job title, city, and information provided in the message.

Commercial and contractual data, such as interest, plan, proposal, acceptance, service history, payment, and support.

Technical and browsing data, such as IP address, date and time, pages accessed, browser, device, security logs, and cookie preferences.

Data submitted spontaneously in attachments, meetings, demos, or requests. Avoid sending sensitive or excessive data when it is not necessary.

4. Purposes and legal bases

Data may be used to respond to requests, present a demo or proposal, carry out pre-contractual procedures, formalize and perform contracts, provide support, issue invoices and tax documents, prevent fraud, protect environments, comply with legal or regulatory obligations, and exercise rights. Where appropriate, Ducke may process data for legitimate relationship management and service improvement, after assessing necessity, impact, and the data subject's expectations. Consent will be used when it is the appropriate basis and may be withdrawn.

5. Commercial communications

Communications related to a request, account, or contract are sent to fulfill the request itself or to perform the existing relationship. Optional marketing will be separate and will allow opposition or unsubscribe through a simple mechanism. Withdrawing marketing consent does not prevent messages necessary for security, billing, support, or contract performance.

6. Sharing

Ducke may share only necessary data with providers of hosting, cloud, communication, payment, tax issuance, support, security, analytics, e-signature, and professional services subject to protection duties. It may also share when there is a legal obligation, a valid order, a corporate transaction with safeguards, or a need to exercise rights. Personal data is not sold.

7. International transfers

Some providers may process or store data outside Brazil. In such cases, Ducke will adopt a mechanism permitted by law, appropriate contractual and technical measures, and transparency consistent with the operation. The current list of relevant suppliers should remain available in the privacy or contracting area.

8. Retention and disposal

Data will be kept for as long as necessary for the stated purpose, the contractual relationship, support, security, and legal or rights-exercise deadlines. Ducke account data follow the contract, security, support, and legal timelines. Data the customer keeps in the CRM remain during the service and for the exit window stated in the offer or termination flow; the customer exports what they need in that period. Once the need ends, data will be deleted, anonymized, or kept in a restricted manner when there is a basis for retention. Backups follow controlled cycles and must not be used for new purposes.

9. Security

Ducke adopts administrative and technical controls proportionate to the risk, including access management, authentication, logging, updates, infrastructure protection, continuity, and incident response. No environment is immune to risk; therefore, controls are reviewed and relevant incidents are handled in accordance with applicable law and regulation.

10. Data subject rights

The data subject may request confirmation and access, correction, information about sharing, anonymization, blocking or deletion of unnecessary or improperly processed data, portability when regulated, opposition, withdrawal of consent, and review of exclusively automated decisions, within legal limits. Ducke may request information to confirm identity and security. Requests about data a customer keeps in the CRM must first go to that customer, who defines the response. Ducke provides compatible technical assistance and forwards to the customer any request received by mistake after confirming context and identity. For Ducke account data, requests may be made through the privacy form available on the website or via WhatsApp +55 19 93300-5586. It is also possible to petition the competent authority.

Open the privacy form · WhatsApp +55 19 93300-5586

11. Children and adolescents

The website and business services are not directed at children. If data of children or adolescents is necessary in a specific project, processing will depend on a dedicated assessment, reinforced protection measures, and observance of the best interests of the child; indiscriminate submission through general forms is not authorized.

12. Cookies, AI, and automated decisions

Choices regarding non-essential cookies are managed in the Preference Center. When artificial intelligence features are used in support, analysis, or automation, the purpose, data involved, provider, and need for human review must be consistent with the information presented. Ducke will not use customer data for general model training on its own initiative without a compatible legal basis, notice, and authorization. Ducke will not adopt an exclusively automated decision with significant effect without providing the required information and rights.

14. Customer instructions and responsibilities in the CRM

The customer must have a legal basis to collect and use data placed in the CRM, inform data subjects, define minimum access, configure retention, respect objection and opt-out, avoid excessive data, fulfill rights, and issue lawful instructions. Ducke will not use customer data for an incompatible own purpose. If it identifies a potentially unlawful or unsafe instruction, it may request clarification and suspend only the affected processing until resolved.

15. Channel integrations

WhatsApp is connected exclusively through Meta's official WhatsApp Business Platform/API, without WhatsApp Web, QR code, mirroring, or a browser session. Instagram depends on an eligible account, permissions, and approved features. The customer controls its assets, audiences, content, and legal bases. Meta and any solution providers also process data under their own policies and roles.

13. Changes and contact

This Policy may be updated, with indication of the new date. Material changes will be highlighted or communicated appropriately. Questions may be sent through the privacy form or via WhatsApp +55 19 93300-5586.