Introduction
Atalium Tecnologia Ltda ("Atalium", "we", "us" or "our") operates the website located at ataliumusa.com and provides enterprise-grade software development, cloud engineering, and technology consulting services. Our registered office is at Rua Caraibas, 65, Palmeiras, Ponte Nova — MG, Brazil, CNPJ 67.882.716/0001-30.
This Privacy Policy describes how we collect, process, store, and protect personal information when you visit our website, read our published content, or contact us through any channel listed on this site. It also outlines your rights under applicable law, including the European Union's General Data Protection Regulation (GDPR), Brazil's Lei Geral de Proteção de Dados (LGPD — Lei nº 13.709/2018), and other relevant privacy frameworks.
By continuing to browse ataliumusa.com, you acknowledge that you have read and understood this Policy. If you disagree with any part of it, please discontinue use of the site. We are committed to processing your data lawfully, fairly, and transparently — and to giving you meaningful control over how your information is used.
This is an informational brochure site only. We do not operate login portals, client dashboards, e-commerce checkouts, or account-registration systems on ataliumusa.com. The personal data we collect is limited to what is reasonably necessary to communicate with prospective clients and to improve the performance and content of our public website.
Information We Collect
We collect information in two main ways: data you actively provide to us, and data that is collected automatically through your browser and device as you navigate the site. We are transparent about both categories below.
2.1 Information You Provide Directly
When you reach out to us via the email address or phone number published on our Contact page, you may voluntarily share personal information such as your name, business email address, company name, phone number, and the content of your message or enquiry. We collect only what you choose to send us; we never prompt you for sensitive categories of personal data (health, financial details, government IDs, etc.) through our website.
2.2 Information Collected Automatically
When you visit ataliumusa.com, our web infrastructure and third-party analytics tools automatically record certain technical information. This typically includes:
| Data type | Examples | Purpose |
|---|---|---|
| Usage data | Pages visited, time on page, scroll depth, referral URL, session duration | Understanding which content is most useful; improving site structure |
| Device & browser data | Browser type and version, operating system, screen resolution, language preference | Ensuring correct rendering across devices |
| Network data | Truncated IP address, approximate geolocation (country/region level), ISP name | Fraud prevention, server routing, aggregate geographic analytics |
| Interaction data | Clicks on navigation elements, outbound link clicks, CTA button interactions | Measuring marketing campaign performance and content relevance |
| Cookie identifiers | Analytics client ID, ad-click IDs (e.g. Google click ID / gclid) | Attribution of advertising spend; recognising returning visitors in aggregate |
Where technically feasible we apply IP anonymisation before any data is sent to third-party analytics platforms, so that the full IP address is never stored by those platforms. We do not purchase personal data lists from data brokers, and we do not combine automatically collected website data with third-party data sources to build individual profiles.
How We Use Your Information
Every processing activity we carry out must have a lawful basis. The table below sets out each purpose for which we use personal data, together with the applicable legal basis under both GDPR and LGPD.
| Purpose | Data used | Legal basis (GDPR) | Legal basis (LGPD) |
|---|---|---|---|
| Responding to enquiries | Name, email, message content | Legitimate interests (Art. 6(1)(f)) | Legitimate interest (Art. 7, X) |
| Website analytics & improvement | Usage data, device data, cookie IDs | Consent (Art. 6(1)(a)) or Legitimate interests | Legitimate interest / Consent |
| Advertising performance measurement | Click IDs, anonymised IP, conversion events | Consent (Art. 6(1)(a)) | Consent (Art. 7, I) |
| Security & fraud prevention | IP address, request logs | Legitimate interests (Art. 6(1)(f)) | Legitimate interest (Art. 7, IX) |
| Legal compliance | Any data relevant to a legal obligation | Legal obligation (Art. 6(1)(c)) | Legal obligation (Art. 7, II) |
We do not use your personal data to build automated decision-making profiles, run credit scoring, or engage in any form of profiling that produces legal or similarly significant effects on you. We do not sell your personal data to third parties under any circumstances. We do not send unsolicited marketing emails to addresses collected via inbound enquiries without your explicit consent.
Cookies & Tracking Technologies
Cookies are small text files placed on your device by a website. Ataliumusa.com uses a small, controlled set of cookies grouped into the categories below. When you first visit the site you are presented with a cookie consent notice; non-essential cookies are activated only after you grant consent, and you may withdraw that consent at any time through your browser settings or our consent management tool.
Managing Your Cookie Preferences
You can control cookies at any time. Most modern browsers allow you to view, block, or delete cookies through their settings menus (typically under Privacy & Security). Opting out of analytics cookies means we will be unable to measure aggregate traffic patterns, but the website will continue to work fully. For Google's own controls over how your data is used in Google's advertising products, visit adssettings.google.com. For broader opt-out from Google Analytics across sites, the Google Analytics Opt-out Browser Add-on is available at tools.google.com/dlpage/gaoptout.
Please note that blocking all cookies may affect functionality of embedded third-party resources (such as embedded video players or map iframes) if we add them in future. At the time this policy was last updated, no such embeds are active on ataliumusa.com.
Sharing With Third Parties
Atalium does not sell, rent, or trade personal data. We share data with a carefully selected set of third-party service providers only to the extent necessary to operate and improve our website. Each provider has been assessed for data-protection compliance, and we maintain Data Processing Agreements (DPAs) with vendors that process personal data on our behalf.
| Third party | Role | Data shared | Location |
|---|---|---|---|
| Google LLC | Analytics (GA4) & Ads conversion tracking | Anonymised usage data, click IDs, pseudonymous identifiers | USA (Standard Contractual Clauses apply) |
| Website hosting provider | Web server infrastructure & CDN | Server access logs (IP addresses), cached assets | Varies by provider's infrastructure region |
| Email service provider | Transporting inbound / outbound email | Content of email correspondence you initiate | Subject to provider's data processing terms |
We may also disclose personal data if we have a good-faith belief that disclosure is necessary to: (a) comply with a legal obligation or respond to valid governmental requests; (b) protect and defend the rights or property of Atalium; or (c) prevent fraud or protect the safety of users or the public.
In the event of a merger, acquisition, or sale of all or part of our assets, personal data may be transferred to the acquiring entity. We would notify affected individuals prior to any such transfer, and the successor entity would be required to honour the terms of this Privacy Policy or seek fresh consent where required.
International transfers: When data is transferred to recipients located outside Brazil or the European Economic Area (EEA) — in particular to Google's US infrastructure — we rely on the European Commission's Standard Contractual Clauses and/or the LGPD's provisions for international data transfers (Art. 33), and we take supplementary technical measures (including encryption in transit) to protect that data.
Data Retention
We retain personal data only as long as is necessary for the purpose for which it was collected, or as required by law. The following retention periods apply:
| Data category | Retention period | Reason |
|---|---|---|
| Email enquiry correspondence | Up to 5 years from last meaningful interaction | Business record-keeping; potential contractual follow-up |
| Website analytics data (GA4) | 14 months (Google's data-retention setting) | Trend analysis; reduced to shortest practical period |
| Server access logs | 90 days | Security monitoring and incident response |
| Cookie consent records | 13 months from consent date | Demonstrating compliance with consent requirements |
| Advertising click data | As per Google Ads account settings (up to 24 months) | Advertising performance attribution |
Once retention periods expire, data is securely deleted or anonymised so that it can no longer be linked to an identifiable individual. If you submit a deletion request (see Section 8), we will action it ahead of the scheduled retention date wherever we are not prevented from doing so by a legal obligation.
Data Security
Atalium is a technology company; security is not an afterthought for us. We apply industry-standard technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration, or disclosure. Specific measures include:
Transport encryption: All traffic between your browser and ataliumusa.com is encrypted using TLS 1.2 or higher (HTTPS). We enforce HSTS (HTTP Strict Transport Security) to prevent protocol downgrade attacks.
Access controls: Access to systems that store or process personal data is restricted to Atalium personnel who need it for their role, protected by strong authentication mechanisms, and governed by a least-privilege access model.
Vendor due diligence: Third-party service providers that handle data on our behalf are assessed for security practices prior to engagement and are contractually required to maintain appropriate safeguards.
Incident response: We maintain an internal incident response procedure. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours of becoming aware of the incident (as required by GDPR Art. 33) and will notify affected individuals without undue delay where the breach is likely to result in high risk to them.
Despite these measures, no system is completely immune to security incidents. We encourage you to use secure, up-to-date browsers and to contact us immediately at [email protected] if you believe your interaction with our site has been compromised in any way.
Your Rights
Depending on your country of residence, you have a range of rights regarding your personal data. These rights apply to residents of the EU/EEA (under GDPR) and to individuals in Brazil (under LGPD), and we extend substantially equivalent commitments to all users of ataliumusa.com as a matter of principle.
You may request a copy of the personal data we hold about you, including information about how it is processed, who it is shared with, and how long it is retained.
If any personal data we hold about you is inaccurate or incomplete, you have the right to request that we correct or update it without undue delay.
Also known as the "right to be forgotten." You may request that we delete your personal data where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent and no other legal basis applies.
In certain circumstances (e.g. while accuracy is disputed, or if processing is unlawful but you prefer restriction over deletion), you may request that we limit how we use your data.
Where we process your data by automated means on the basis of your consent or a contract, you may request that we provide it in a structured, commonly used, machine-readable format so you can transfer it to another provider.
You have the right to object to processing based on legitimate interests. If you object, we will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
Where processing is based on your consent (e.g. analytics and advertising cookies), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.
If you are unsatisfied with our response, you have the right to lodge a complaint with the relevant supervisory authority — the ANPD (Autoridade Nacional de Proteção de Dados) in Brazil, or your local EU data protection authority.
How to Exercise Your Rights
To exercise any of the rights listed above, please contact our privacy team by email at [email protected] with the subject line "Privacy Rights Request." Include enough detail for us to identify you and the specific right(s) you wish to exercise. We will respond within 30 days of receiving a verifiable request — or within 15 business days as required by LGPD for Brazilian data subjects. In complex cases we may extend this period by a further 30 days, in which case we will notify you of the extension and the reason for it.
We will not charge a fee for processing a rights request unless it is manifestly unfounded or excessive (e.g. repetitive). In such cases we may charge a reasonable administrative fee or decline to respond, but we will notify you of our reasoning.
Children's Privacy
Ataliumusa.com is directed at business professionals and adult decision-makers within organisations. We do not knowingly collect personal data from individuals under the age of 18. Our content, services, and communications are not intended for children, and we do not have grounds to process children's data in the context of this website.
If you are a parent or guardian and believe that a child under your care has provided us with personal information, please contact us immediately at [email protected]. We will promptly investigate and, if confirmed, delete the relevant data without delay and without requiring the child's involvement.
Changes to This Policy
Privacy law evolves, and so does the way Atalium operates. We may update this Privacy Policy periodically to reflect changes in our data practices, the services we offer, or applicable legal requirements. When we make material changes — meaning changes that affect how we process data in ways that could matter to you — we will take reasonable steps to bring those changes to your attention. This may include updating the "Last updated" date at the top of this page and, where warranted, placing a prominent notice on the homepage.
We encourage you to review this Policy whenever you visit ataliumusa.com, so that you remain informed about how we protect your data. Your continued use of the site following the publication of changes constitutes your acknowledgement of those changes. If a change requires fresh consent (for example, a new processing purpose based on consent), we will seek that consent before processing data for the new purpose.
Version history: The current version of this Privacy Policy was last updated in June 2025. Prior versions are available on request by emailing [email protected] with the subject line "Privacy Policy — Prior Version Request."
Contact Us
If you have any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data, please reach out to us. We take every privacy query seriously and aim to provide a thorough, clear response within the timescales stated in Section 8.
The data controller responsible for personal data processed through ataliumusa.com is:
When contacting us about a privacy matter, please include sufficient detail to allow us to identify your request — for example, the email address from which you previously contacted us, the nature of your interaction with the site, and a description of the right or concern you are raising. We may need to verify your identity before we can process certain types of requests, particularly those involving access to or deletion of personal data. This verification step is a security measure to ensure that personal data is not disclosed to or deleted at the request of someone other than the data subject.
If you are a resident of the European Union and are not satisfied with our response, you also have the right to lodge a complaint with your national data protection authority. A directory of EU data protection authorities is available at edpb.europa.eu/about-edpb/about-edpb/members_en. Brazilian residents may contact the ANPD (Autoridade Nacional de Proteção de Dados) at gov.br/anpd.