Privacy and Data Protection Policy
31 October 2026
1. Who controls the data
Ensō is the controller of personal data processed through this site. For data protection requests, use the channel listed on the contact page.
2. What we collect
We receive the information you choose to share when contacting us on WhatsApp or by email, such as your name, company, email, phone and message. We do not request sensitive data and ask that it not be included in messages.
With permission, we also collect browsing data such as pages visited, traffic source and technical device information through Google Analytics 4, Google Tag Manager and Meta Pixel.
With the same permission, Microsoft Clarity records how pages are used (clicks, scrolling and cursor movement) to produce heatmaps and session recordings. What you type into fields is masked and not recorded.
3. Why we use it
Data is used to:
- Respond to enquiries and prepare proposals
- Deliver contracted services
- Understand site usage and improve its structure and content
- Meet applicable legal obligations
4. Legal basis
Processing required for contact, security and service delivery relies on performance of a contract, pre-contractual steps and other applicable legal bases. Optional analytics and advertising technologies are controlled by the choice recorded in the cookie banner. We handle requests from data subjects under both GDPR and Brazil’s LGPD.
5. Cookies and similar technologies
Necessary cookies support security and privacy preferences. Optional analytics and advertising cookies and technologies help us understand site usage, measure campaigns and personalise communications.
You can accept all, use necessary technologies only or choose categories. Your decision can be changed at any time through the “Cookies” button available on the site.
6. Sharing and international transfers
To operate the site and receive messages, we use Cloudflare and the Gmail and WhatsApp contact channels. With permission, analytics and advertising data may also be processed by Google, Meta and Microsoft. Some of these providers may process data outside Brazil, which constitutes an international transfer. [CONFIRM: document the applicable safeguards before final publication.]
7. How long we keep it
Contact data is kept for as long as needed to handle the enquiry and, where a contract exists, for the period required by applicable law. Once the purposes end, data is deleted or anonymised. [CONFIRM: define concrete retention periods.]
8. Your rights
You may request confirmation of processing, access, correction, anonymisation, blocking or deletion of unnecessary data, portability, information about sharing, and withdrawal of consent. To exercise any of these rights, use the channel listed on the contact page.
9. Security
We apply technical and organisational measures to protect data against unauthorised access, loss or improper alteration, including access control to tools and encrypted transmission on this site.
10. Changes
This policy may be updated. The date at the top indicates the current version.