Privacy Policy

Summary

The key points, before the details:

• The website does not use its own tracking cookies, audience analytics, advertising pixels or embedded third-party content. The application does not use localStorage or sessionStorage to store visitor data.
• To deliver the pages and protect the website against abuse, the hosting provider (Cloudflare) receives technical access data, such as IP address, date and time, page visited, and browser type.
• In specific security situations, such as when a bot check is shown, Cloudflare may set strictly necessary cookies.
• Contact with us starts by email. If you write to us, we will use the data you choose to share with us to reply, assess your needs, prepare proposals, and negotiate.
• We do not sell data, build profiles, make automated decisions about you, or send marketing emails.
• Our hosting and email providers may store or process data outside Brazil.
• You can exercise your rights as a data subject, free of charge, by emailing contact@khemiq.com.

Who is responsible for your data

The company responsible for the personal data covered by this Policy (the “controller” under the LGPD) is KHEMIQ TECNOLOGIA LTDA, registered in Brazil under CNPJ 67.858.924/0001-02 and headquartered in São Paulo, SP. In this Policy, “Khemiq” and “we” refer to this company.

For questions about this Policy, data subject requests, complaints or communications about data protection, contact contact@khemiq.com (in English) or contato@khemiq.com.br (in Portuguese). Both addresses belong to Khemiq. Brazil’s data protection agency (ANPD) may also contact us through these channels.

When you visit the website

Khemiq’s website is static: its pages are prebuilt files, with no database, registration, login or forms. The publishing infrastructure is provided by Cloudflare, Inc., headquartered in the United States. This Policy describes the website published on Khemiq’s domains.

As with any website, for the pages to reach your device, the hosting infrastructure automatically receives technical data about your connection, such as:

• IP address;
• date and time of access;
• address (URL) of the page or file requested;
• information about your browser and operating system (known as the “user agent”);
• other technical connection data sent automatically by your browser.

This data is used to deliver the website, keep it running, and protect it against abuse, such as attacks, malicious automated traffic, and attempts to overload it. Khemiq does not use it to identify who visits the website, build profiles, or measure audiences.

The website has no application mechanism for keeping access logs. Depending on the service and its settings, the Cloudflare dashboard may temporarily make security event information available, such as IP addresses and browsers. This information is intended for investigating security issues and malfunctions.

Cloudflare may also use technical traffic data to protect its own network and services, as described in its privacy policy (cloudflare.com/privacypolicy).

The application’s fonts, images and other files are served by the website itself. We do not embed maps, videos, external fonts, social media buttons or analytics tools. Infrastructure security features, when triggered, may make additional requests needed to verify access.

Cookies and browser storage

The application does not set its own cookies or use localStorage or sessionStorage. There are no analytics, advertising or social media cookies. Your browser may keep its normal cache of website files. Since we do not use optional tracking features, there is no consent panel for those purposes.

The only possible exception comes from Cloudflare’s security features, which may set strictly necessary cookies in specific situations. This can happen, for example, when a visit looks automated and Cloudflare shows a bot check. In that case, the “cf_clearance” cookie records that the check was completed, so that it is not repeated on every page. If bot detection features are active, Cloudflare may also use the “__cf_bm” cookie, which expires after 30 minutes of inactivity.

Cloudflare sets these cookies only for security and to allow access to the website, and Khemiq does not use them for any other purpose. The legal basis is the legitimate interest in keeping the website secure (Art. 7, IX, of the LGPD). The ANPD’s guidance on cookies describes this legal basis as generally appropriate for strictly necessary cookies.

You can block or delete cookies in your browser settings. If you block the security cookies, a bot check may not be completed and you may be temporarily unable to access the website.

If the website starts using its own or third-party cookies for other purposes, we will update this Policy and, where required by law, ask for your consent first.

When you email us

The website offers email as the only way to contact us. The contact links open the email app or service on your own device, with our address (contact@khemiq.com or contato@khemiq.com.br) already filled in. The button that copies the address works only in your browser: nothing is sent to Khemiq when you use it.

Nothing reaches us until you send your message. Once sent, it goes through your email provider, under that provider’s own rules, and arrives at the business email service Khemiq uses: Lark, provided by Lark Technologies Pte. Ltd., headquartered in Singapore. Both addresses belong to Khemiq, and messages sent to either of them are kept in that same service.

We process only the data you choose to send us and the data that comes with any email, such as:

• name and email address;
• company and job title;
• message content and information about your needs;
• attachments;
• data that comes with the email, such as the date and time it was sent and the addresses of other people copied on it.

Please do not send sensitive personal data, such as information about health, racial or ethnic origin, religion, political opinions, or union membership. Please also avoid sending other people’s data that is not needed for the matter at hand. If we receive this kind of information unnecessarily, we may delete it.

If you include other people in the conversation (for example, by copying colleagues), their data will be processed in the same way and for the same purposes described in this Policy.

If we arrange a remote conversation in Portuguese, we will identify the tool and its provider before the meeting so that you can understand the data processing involved. No recording is planned. Any recording will require prior notice, a defined purpose and an appropriate legal basis. Notes follow the purposes and retention criteria in this Policy.

Why we use data and on what legal basis

The LGPD allows personal data to be processed only when there is a legal basis for it (Art. 7). These are our purposes and the legal bases we rely on:

• Delivering the website and protecting it against abuse (technical access data and, where applicable, Cloudflare’s security cookies): Khemiq’s legitimate interest in keeping the website available and secure (Art. 7, IX, and Art. 10 of the LGPD).
• Replying to your message and assessing your needs: legitimate interest (Art. 7, IX), since you contacted us and expect a reply. If you, as an individual, ask for information about a contract to which you yourself would be a party, the legal basis is carrying out preliminary procedures related to a contract, at your request (Art. 7, V).
• Preparing proposals and conducting negotiations: preliminary procedures related to a contract, at your request (Art. 7, V), when you are the interested party. When you write to us on behalf of a company, the legal basis is the legitimate interest of Khemiq and of the company you represent (Art. 7, IX).
• Performing the contract, if one is entered into: performance of a contract (Art. 7, V), when you are a party to it, or legitimate interest (Art. 7, IX), when you are a representative or contact person of the company that hires Khemiq.
• Meeting legal and regulatory obligations if there is a contract, such as issuing tax documents and keeping accounting records: compliance with a legal or regulatory obligation (Art. 7, II).
• Keeping records to exercise or defend rights in possible judicial, administrative, or arbitration proceedings: regular exercise of rights (Art. 7, VI).

When we rely on legitimate interest, we process only the data that is strictly necessary (Art. 10, § 1) and assess whether your rights and freedoms prevail over that interest. You can ask for information about this assessment and object to the processing (see “Your rights”).

We do not rely on consent as the legal basis for any of these processing activities.

We do not sell or rent personal data, do not engage in profiling, do not make decisions based solely on automated processing, and do not send marketing emails or newsletters. If we ever want to use your data for a new purpose, we will first determine the appropriate legal basis and let you know.

Who we share data with

Data may be shared to the extent needed for the purposes in this Policy, in the following situations:

• Cloudflare, Inc. (headquartered in the United States): publishing and security infrastructure, which receives technical access data. It may also process data to protect its own network, as described in its privacy policy.
• Lark Technologies Pte. Ltd. (headquartered in Singapore): business email service that receives and stores your messages and our replies. The company’s headquarters alone do not determine where data is stored.
• Accounting or legal service providers: only if there is a contract or a dispute, and only with the data needed to meet legal obligations or defend rights.
• Public authorities: when there is a legal obligation, a court order, or a request from a competent authority, to the extent required.

Each provider processes data according to its activities and the terms applicable to its service. The use of data must respect the LGPD and each party’s responsibilities. You can ask our privacy channel for information about the recipients of your data.

Data stored or processed outside Brazil

Cloudflare and Lark operate internationally. Technical browsing data and email messages may be processed outside Brazil to deliver the website, protect the infrastructure and enable business communication.

• Cloudflare: uses a global network. The location serving a request and processing security logs may vary according to the infrastructure and services used.
• Lark: storage location depends on the account’s region and the services and subprocessors used. We do not assume that messages remain in Brazil or are stored in the country where the provider is headquartered.

The LGPD requires operations that constitute international transfers to rely on a valid mechanism under Art. 33 and the ANPD’s regulations, in addition to a legal basis for processing. Requirements and safeguards depend on the data, recipients and operation involved.

You can request information about the countries involved, recipients, duration, purpose and safeguards applicable to the processing of your data at contact@khemiq.com. This Policy will be updated when these operations change.

How long we keep data

We keep personal data only for as long as needed for the purposes in this Policy, or for the period the law requires or allows:

• Technical access data: not stored by Khemiq’s application. Infrastructure retention depends on the provider’s service and settings. The period for viewing events in a dashboard does not necessarily equal the provider’s total retention period.
• Security cookies, when set: duration depends on the infrastructure feature and settings. You can delete them in your browser.
• Messages that do not lead to a contract: kept while needed to reply and conduct negotiations. An ongoing conversation, open requests and the need to preserve evidence are criteria for assessing retention. Once they are no longer needed and there is no legal ground for keeping them, the data must be deleted.
• Contract-related messages and documents: retention takes account of contract performance, tax and accounting obligations and the exercise of rights. Periods depend on the document and applicable obligation; this does not justify keeping all correspondence indiscriminately.

Deletion is subject to lawful retention under Art. 16 of the LGPD. Provider backups follow their own cycles and conditions; removing a message from the active mailbox does not mean that all backup copies are immediately erased.

You can ask about retention of your data and request deletion (see “Your rights”). If a legal obligation or a justified need to exercise rights prevents deletion, we will explain why.

How we protect data

Art. 46 of the LGPD requires technical and administrative measures appropriate to the data and processing risks. This website’s architecture limits collection and includes:

• static pages with no database, forms or login areas;
• publishing infrastructure security features and HTTPS on the public addresses;
• no email service or database credentials delivered to the browser.

No system is immune to failure. If there is a security incident that may result in significant risk or harm to you, we will notify the ANPD and the people affected, in accordance with Art. 48 of the LGPD and the ANPD’s regulations.

By its nature, email passes through servers run by different providers. If you need to share confidential information, please agree on a suitable method with us first.

Your rights

Regarding your data processed by Khemiq, the LGPD (Art. 18) gives you the right to:

• confirm whether we process your personal data;
• access that data;
• correct incomplete, inaccurate, or outdated data;
• request the anonymization, blocking, or deletion of data that is unnecessary, excessive, or processed in violation of the LGPD;
• request the portability of your data to another service or product provider, in accordance with the ANPD’s regulations;
• know which public and private entities we share your data with;
• object to processing carried out without your consent, such as processing based on legitimate interest, if it does not comply with the LGPD;
• receive clear information about how and why your data is processed (Art. 9);
• file a petition against Khemiq with the ANPD and with consumer protection agencies (Art. 18, §§ 1 and 8).

We do not use consent as the legal basis for the processing described here. For that reason, the rights tied specifically to consent do not apply to this processing: withdrawing consent, being informed about the consequences of not giving it, and deleting data processed on the basis of consent (Art. 18, VI, VIII, and IX). This does not prevent you from asking us to delete your messages. We will review the request and keep the data only if there is a legal reason to do so, which we will explain to you.

We also do not make decisions based solely on automated processing that affect your interests (Art. 20 of the LGPD).

How to exercise your rights

Write to contact@khemiq.com, ideally with “Privacy – data subject rights” as the subject line, and tell us which right you want to exercise. We handle requests free of charge (Art. 18, § 5).

To protect your data, we may ask for the minimum information needed to confirm that you are the data subject or their legal representative. In most cases, writing from the same email address you used in your original message is enough.

For confirmation or access requests, we follow Art. 19 of the LGPD: a simplified response immediately, or a clear and complete statement within 15 days of the request. The statement identifies the source of data, any absence of records, the criteria used and the purpose of processing, while protecting trade and industrial secrets. Other requests follow the applicable legal deadlines, with progress information where needed.

If we cannot act on your request right away, we will explain why. For example, we may not be the processing agent for that data (in which case we will tell you who is, whenever possible), or a legal reason may prevent us from taking the action (Art. 18, § 4). When we correct, delete, anonymize, or block data, we will notify the providers that process it on our behalf so that they do the same (Art. 18, § 6).

If you are not satisfied with our response, or do not receive it within the deadline, you can file a petition with the ANPD through the “Abrir requerimento relacionado à LGPD” (File an LGPD-related request) service on the gov.br portal (gov.br/pt-br/servicos/abrir-requerimento-relacionado-a-lgpd). The LGPD requires data subjects to show that they first submitted their request to the controller (Art. 55-J, V), so keep your message and our response. You can also contact consumer protection agencies.

Children and adolescents

Khemiq’s website is a corporate site aimed at businesses and professionals. It is not intended for children or adolescents, and we do not seek to collect data from anyone under 18.

If a child or adolescent writes to us, we will process their data in their best interest (Art. 14 of the LGPD). We will use it only to reply or to redirect the contact to their parents or guardians, and we will delete it when it is no longer needed. Parents and guardians can reach us at contact@khemiq.com.

Changes to this Policy

This Policy may be updated when there are changes to how the website works, our providers, or the applicable rules. The date of the last update appears at the top of the page.

Significant changes will be highlighted on this page when they take effect and, where required by law, will depend on your prior consent. Examples include the use of our own cookies, analytics tools, forms, or new providers that receive personal data.

You can request previous versions by emailing contact@khemiq.com.