Privacy Policy

www.corfio.com.br
Last updated: July 2, 2026

1. Who we are

ELETROCAL INDÚSTRIA E COMÉRCIO DE MATERIAIS ELÉTRICOS LTDA. ("Eletrocal"), enrolled with the Brazilian corporate taxpayer registry (CNPJ) under No. 83.060.012/0001-39, headquartered at Av. Engenheiro Lourenço Faoro, 4567, Bairro Aeroporto, CEP 89509-830, Caçador/SC, Brazil, is the controller of the personal data processed through the website www.corfio.com.br (the "Site"), under the Brazilian General Data Protection Law — Law No. 13,709/2018 ("LGPD").

This Policy applies exclusively to the Site. It does not cover restricted-access systems intended for sales representatives, nor third-party websites accessible through links.

2. What data we collect

The Site does not require registration or login. We collect personal data only when you provide it voluntarily:

Contact form — name, e-mail, phone number, CPF or CNPJ, information about your relationship with us (whether you are already a customer and how you heard about us) and the content of your message. The phone number and CPF/CNPJ are requested as a verification measure, to prevent automated submissions (spam) and fraudulent contacts.
Work with Us — name, phone number and attached résumé. The résumé may contain other data included by the candidate (education, professional history, address, etc.).
Newsletter — e-mail address.
Browsing data — collected automatically through cookies and similar technologies, as described in section 4 (pages visited, browsing time, device and browser type, traffic source).

3. How we use the data

Purpose	Data	Legal basis (LGPD)
Responding to contacts, questions, quotes and requests	Contact form data	Preliminary procedures relating to a contract (art. 7, V) and legitimate interest (art. 7, IX)
Preventing spam and fraud in the forms	Phone number, CPF/CNPJ	Legitimate interest (art. 7, IX)
Reviewing résumés in recruitment processes and keeping them in a candidate database	Work with Us form data	Preliminary procedures at the data subject's request (art. 7, V) and legitimate interest (art. 7, IX)
Sending news and institutional communications (newsletter)	E-mail	Consent (art. 7, I)
Audience measurement and Site improvement, with aggregate data (Google Analytics)	Browsing data	Legitimate interest (art. 7, IX)
Site security, performance and availability	Browsing data and access logs	Legitimate interest (art. 7, IX)
Compliance with legal and regulatory obligations	As applicable	Legal obligation (art. 7, II)

We do not use the data for automated decision-making, we do not build individual browsing profiles and we do not sell personal data to third parties.

4. Cookies

Necessary cookies — maintain your session and protect the forms against misuse (e.g., security tokens). They are essential to the operation of the Site. You can block them in your browser settings, which may impair how the pages work.
Statistics cookies (Google Analytics) — we use Google Analytics, a service provided by Google LLC, based on our legitimate interest in measuring the Site's audience and improving its content. The tool is configured restrictively: the data is used only for aggregate statistics (most visited pages, browsing time, device type, traffic source), with no ad personalization, no individual profiling and no sharing with Google for its own purposes; the IP address is used transiently, only for approximate geolocation, and is not stored. You can disable statistics cookies at any time through the Site's cookie notice, through your browser settings or through the Google Analytics opt-out add-on (tools.google.com/dlpage/gaoptout). The information is processed in accordance with Google's privacy policy (policies.google.com/privacy).

5. Who we share data with

We share personal data only with: (a) infrastructure providers that operate the Site — hosting (GoDaddy) and content delivery and security network (Cloudflare); (b) Google, for the statistics described in section 4; and (c) public authorities, where there is a legal obligation or an order from a competent authority. These providers act as processors and handle the data according to our instructions, for the purposes of this Policy.

6. International transfer

The Site is hosted on servers located in the United States, and the providers mentioned in section 5 may process data outside Brazil. These transfers take place under art. 33 of the LGPD, supported by contractual clauses and data protection commitments undertaken by the providers.

7. How long we keep the data

Contact form messages — for as long as necessary to handle the request and for up to 5 years after the last contact, to safeguard legal deadlines.
Résumés — kept in our candidate database, with no predetermined period, for consideration in future recruitment processes; deletion may be requested at any time through the channel indicated in section 8.
Newsletter e-mails — until you request deletion.
Google Analytics data — individualized event data is retained for 2 months; aggregate statistics, which do not allow visitors to be identified, may be kept indefinitely.

Once these periods end, the data is deleted or anonymized, except in the cases of retention provided for by law (art. 16 of the LGPD).

8. Your rights

Under art. 18 of the LGPD, you may request: confirmation that processing takes place; access to the data; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary or excessive data; portability; information about the sharing carried out; information about the possibility of not providing consent and the consequences of refusal; withdrawal of consent and deletion of the data processed on its basis; and objection to processing based on legitimate interest (art. 18, § 2).

In the case of statistics cookies, the objection can be exercised directly, by disabling them through the Site's cookie notice or through the control at the end of this page, with no need to submit a request.

To exercise your other rights, write to [email protected]. We will respond within the time limits set by law and may request proof of identity to protect your data. You may also file a complaint with the Brazilian National Data Protection Authority — ANPD (gov.br/anpd).

To stop receiving the newsletter or to have your e-mail removed from the list, simply make the request through the same channel.

9. Security

We adopt technical and administrative measures to protect personal data against unauthorized access and accidental or unlawful destruction, loss, alteration, communication or dissemination, including encryption in transit (HTTPS), access control and network protection services. No system is entirely free from risk; in the event of a relevant incident, we will take the steps provided for in the LGPD.

10. Children and adolescents

The Site is intended for business audiences and for people over 18 years of age. We do not knowingly collect data from children and adolescents; if we identify such processing, the data will be deleted.

11. Data protection officer and contact

The channel for personal data protection matters, including contact with the data protection officer (DPO), is [email protected].

12. Changes to this Policy

We may update this Policy at any time. The current version will always be published on the Site, with the update date indicated at the top. This Policy is governed by Brazilian law. In case of divergence between language versions, the Portuguese version prevails.

Statistics cookies on this browser: