Last updated: July 2026
The controller within the meaning of the General Data Protection Regulation (GDPR) and other data protection provisions is:
G C M G Leao Contabilidade & Consultoria
Pajuçara — Maceio/AL
Postal Code: 57030-087
Brazil
CNPJ: 64.707.026/0001-57
Managing Director: G C M G Leao Contabilidade & Consultoria
E-mail: [email protected]
The appointment of a data protection officer is not required under Art. 37 GDPR, since our company does not, as a rule, permanently employ at least 20 people engaged in the automated processing of personal data. For any data protection questions, you may contact the e-mail address listed above at any time.
When you access our website, the browser used on your device automatically sends the following information to our website's server, where it is stored temporarily in what are known as server log files:
The data listed above is processed for the following purposes: ensuring a smooth connection to the website, ensuring comfortable use of our website, evaluating system security and stability, and other administrative purposes.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest). Our legitimate interest derives from the purposes of data collection listed above, in particular the security and stability of our website.
Retention period: The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. Where data is collected in order to provide the website, this is the case once the respective session has ended. Server log files are deleted automatically after 7 days at the latest.
If you send us inquiries via the contact form, the details you provide in the inquiry form, including the contact data you enter there, will be stored by us for the purpose of processing the inquiry and in case of follow-up questions. The following data is collected:
We do not pass this data on without your consent.
Legal basis: Art. 6(1)(b) GDPR (performance of pre-contractual measures taken at the request of the data subject). Insofar as your inquiry does not relate to the conclusion of a contract, Art. 6(1)(f) GDPR (legitimate interest in effectively handling the inquiries addressed to us) is the legal basis.
Retention period: The data you enter in the contact form remains with us until you ask us to delete it, withdraw your consent to its storage, or the purpose for storing the data no longer applies. Mandatory statutory provisions — in particular retention periods — remain unaffected.
Our website uses exclusively technically necessary cookies. These are small text files that your browser creates automatically and that are stored on your device when you visit our website.
Technically necessary cookies are exempt from the consent requirement, as they are strictly required for the operation of the website. These cookies cannot be disabled.
We do not use tracking cookies, analytics cookies, or advertising cookies without your prior express consent. Where applicable, such consent is obtained via our cookie consent banner.
Legal basis for technically necessary cookies: Art. 6(1)(f) GDPR (legitimate interest in the operation of the website).
Legal basis for optional cookies: Art. 6(1)(a) GDPR (consent).
Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter „Google“).
Purpose: We use Google Ads conversion tracking to measure the effectiveness of our advertising campaigns. When you click on an ad served by Google, a conversion tracking cookie is stored on your device. These cookies expire after 30 days and are not used for personal identification.
If you visit certain pages of our website and the cookie has not yet expired, Google and we can recognize that you clicked on the ad and were forwarded to this page. Each Google Ads customer receives a different cookie. The information obtained via conversion cookies is used to compile conversion statistics for Ads customers who have opted in to conversion tracking.
Legal basis: Art. 6(1)(a) GDPR (consent). The conversion tracking cookie is only set if you have given your consent via our cookie consent banner. You may withdraw your consent at any time with effect for the future.
Data transfer to third countries: Google may transfer collected data to the USA. The transfer takes place on the basis of the EU-US Data Privacy Framework (DPF). You can find further information in Google's privacy policy: https://policies.google.com/privacy.
Insofar as a payment obligation exists after a contract is concluded, we use an external payment service provider to process payments. Your payment data (e.g. credit card number, bank details) is transmitted directly to the payment service provider and processed there.
We ourselves never store complete credit card or bank details on our servers at any time. From the payment service provider we receive only a confirmation of the success or failure of the payment and, where applicable, a transaction ID for allocation purposes.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Processing the payment data is necessary to fulfill the contract concluded between you and us.
Since our company is based in Brazil, personal data is transferred to a third country. Brazil is a third country outside the European Union. The transfer of personal data to Brazil takes place on the basis of Art. 49(1)(a) GDPR (express consent) or Art. 49(1)(b) GDPR (performance of a contract). Brazil has its own data protection law in the form of the Lei Geral de Proteção de Dados (LGPD).
Safeguards: Insofar as personal data is transferred to recipients in third countries that are not covered by the DPF adequacy decision, we ensure through appropriate safeguards that the rights of data subjects are adequately protected. To this end, we conclude EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.
In exceptional cases, the transfer may be based on your express consent pursuant to Art. 49(1)(a) GDPR. In such cases, you will be informed of the possible risks before the transfer takes place.
You have the following rights with respect to the controller regarding your personal data:
To exercise your rights, please contact us by e-mail at: [email protected]. We will handle your request without undue delay, and in any case within one month.
Without prejudice to any other administrative or judicial remedy, you have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR.
You may exercise this right before a supervisory authority in the Member State of your residence, your place of work, or the place of the alleged infringement. A list of data protection supervisory authorities is available at: https://www.bfdi.bund.de.
We reserve the right to amend this privacy policy in order to adapt it to changes in the legal situation or to changes in the service or in data processing. However, this applies only with respect to statements about data processing. Where consent is required or where parts of the privacy policy contain provisions governing the contractual relationship with users, changes will be made only with the users' agreement.
The current version is always available on this page. Please review the content of our privacy policy regularly.
Last updated: July 2026