Atendimento 24/7
Resposta imediata a qualquer hora, sem escalar o time nem a fila noturna.
Back to home
Privacy Policy
How Cortex collects, uses, shares and protects personal data, in compliance with the LGPD (Lei nº 13.709/2018, Brazil's General Data Protection Law).
1. Scope and who we are
This Policy explains, in plain language, how Cortex collects, uses, shares and protects personal data related to:
- the use of the www.cortex.je website;
- the institutional pages and contact forms;
- the use of the integrated WebChat;
- and, where applicable, the use of the B2B services by corporate clients.
Cortex acts predominantly as a B2B provider of technology, automation and digital service via WebChat. In some situations it is a Controller (for example, marketing and relationship management) and, in others, a Processor for clients (handling data according to contractual instructions in integrations and support). When we act as a Processor, the Agreement and the DPA prevail as signed with the client.
How to identify Cortex's role in the processing of your data: (i) if you used the Cortex institutional website or WebChat directly, Cortex is the Controller; (ii) if you used the WebChat embedded in a B2B client's product or service, the client is the Controller and Cortex is the Processor. If in doubt, contact dpo@thecortex.digital and the request will be forwarded to the correct Controller within 5 business days.
2. Key definitions (LGPD)
The terms below have the meaning assigned by the Lei Geral de Proteção de Dados (Lei nº 13.709/2018, LGPD) and are used throughout this document:
Personal data, sensitive data, data subject, processing, Controller, Processor, Data Protection Officer (DPO), Autoridade Nacional de Proteção de Dados (ANPD, Brazil's Data Protection Authority), RIPD (Data Protection Impact Report), TIA, cookies and similar technologies, solely automated decision-making and profiling.
3. What data we collect
We collect the minimum necessary for each purpose, always in a transparent and proportionate manner.
3.1 Website browsing, WebChat and forms
- Technical data: truncated IP address, date and time, user agent, language, operating system, browser type, resolution, source page, pages visited and time spent.
- Cookies and identifiers: essential cookies (operation), analytical (audience), functional (preferences) and, if accepted, marketing (measurement).
- WebChat: chat Session ID, session origin, response time, content and attachments sent, session logs and messages.
- Contact forms: name, email, phone, company, job title, country and message content.
3.2 Commercial relationship and B2B support
- Commercial and contractual: contact data of representatives, billing data, history of proposals, communications and documents exchanged.
- B2B support and operation: technical records, telemetry, usage logs, performance and data necessary to diagnose incidents.
Log retention: 6 to 12 months according to the Agreement and SLA.
3.3 Categories we do not seek to collect
Cortex does not intentionally collect sensitive data or data of minors through its institutional channels.
If, by client instruction, it becomes necessary to process sensitive data in a B2B context, the conditions will be set out in the applicable DPA.
3.4 Collection sources
- Directly from the data subject: form, email, phone, chat and WebChat.
- Automatically: browsing, cookies and logs.
- Third parties: analytics, hosting and support (always under contract).
- Public sources: when necessary to validate business data.
4. What we use it for and the legal bases
We process data according to the legal bases of the LGPD (art. 7): consent, performance of a contract, legal/regulatory obligation, legitimate interest, credit protection and the regular exercise of rights.
Summary of purposes:
| Purpose | Description | Legal basis |
|---|---|---|
| Operation and security of the website and WebChat | Ensure operation, prevent fraud, maintain availability and respond to incidents. | Legitimate interest and legal obligation (technical records). |
| Service and commercial relationship | Respond to contacts, send proposals and schedule meetings. | Performance of a contract or preliminary procedures; legitimate interest. |
| Optional marketing and communication | Sending newsletters, invitations and materials upon opt in. | Consent (opt in) or legitimate interest with opt out. |
| Product improvement and analytics | Analyze usage metrics, performance and usability of the WebChat. | Legitimate interest; consent for analytical cookies. |
| B2B support and WebChat-only operation | Run Atena and Apolo services in WebChat as per contract. | Performance of a contract; DPA. |
5. Cookies and similar technologies
The website and the WebChat use cookies and similar technologies to ensure performance and security.
The categories and purposes are described in the Cookie Policy.
Users can accept, reject or configure preferences via the banner and Preference Center.
Marketing events and campaign measurement linked to the website or the WebChat occur only with marketing consent when they involve non-essential cookies.
6. Data sharing
Data may be shared with third parties strictly necessary for operation:
- Cloud and hosting infrastructure (providers compliant with the LGPD).
- CDN, WebChat providers, cloud, LLM and security, as necessary for operation.
- Analytics and performance metrics.
- Email, CRM and technical support services.
- Legal or security consultancies and audits.
- Public authorities, when required by law.
Cortex does not sell personal data.
In the event of a merger, acquisition or reorganization, the processing will follow the safeguards of this Policy.
7. International transfers
Some providers operate outside Brazil.
When analytics is consented to, Google Analytics (Google LLC) may process events on international infrastructure, including the United States. Google Analytics 4 does not store IP addresses, and the retention period configured on the landing page property is 14 months.
For these cases, Cortex adopts standard contractual clauses, performs a TIA (Transfer Impact Assessment) and applies encryption and strict access controls.
When we act as a Processor, the transfer details are set out in the client's DPA.
8. Information security
We adopt administrative, technical and physical controls to protect data and communications:
- TLS 1.2 or higher encryption (preferably 1.3) in transit; AES-256 at rest.
- MFA, RBAC and quarterly access reviews.
- Vulnerability management (critical ≤72h, high ≤7d, medium ≤30d, low ≤90d).
- Secure development lifecycle (SAST/DAST) and dependency analysis (SBOM).
- Centralized logging and monitoring (retention of 6 to 12 months).
- 3-2-1 backups with restoration testing.
- Continuous training and privacy and security awareness.
These controls are detailed in the Security White Paper (Annex V).
9. Retention and deletion
We keep data for as long as necessary for the purposes or for legal and contractual periods.
Afterward, we delete, anonymize or archive it with access restriction.
General guidelines:
- Logs and technical records: 6 to 12 months.
- Leads and contacts: up to 24 months after the last useful contact.
- Contractual and tax documents: term of validity plus the applicable legal period (minimum 5 years for civil matters and up to 10 years for tax and social security matters).
- B2B data after termination: export ≤30 days; deletion ≤90 days; certificate upon request.
Deletion requests will be honored when there is no retention obligation.
10. Data subject rights and how to exercise them
Data subjects may request:
- confirmation, access and correction of data;
- anonymization, blocking or deletion;
- portability;
- information about sharing;
- objection to processing;
- review of automated decisions;
- withdrawal of consent.
How to exercise them: send an email to dpo@thecortex.digital with the subject “LGPD Data Subject Rights”.
Cortex may request identity validation.
Response time: up to 15 days (extendable in complex cases).
If the data is processed on behalf of a B2B client, the request will be forwarded to the corresponding Controller.
The data subject may also petition the ANPD.
11. Automated decisions and profiling
Cortex may operate automated flows under the instruction of the B2B client (for example, KYC, withdrawal screening, ticket classification). When these flows result in a decision with relevant effects on the data subject, the right to review by a natural person is ensured upon formal request to the DPO (dpo@thecortex.digital) or to the Controller of the corresponding operation, pursuant to art. 20 of the LGPD.
On the Cortex institutional website and the public WebChat, no solely automated decisions are made that produce legal effects on visitors.
12. Children and adolescents
The website and the channels are not intended for children (up to 12 years old) or adolescents (up to 18 years old) without the specific consent of at least one parent or legal guardian, pursuant to art. 14 of the LGPD.
Should we identify data of minors without an adequate legal basis, we will carry out secure deletion and notify the B2B Controller client, where applicable.
13. Privacy governance and compliance
The privacy program includes:
- Appointed DPO and service channel;
- Records of processing (ROPA) and RIPD for high-risk activities; applicable excerpts of the ROPA are made available to B2B clients and authorities under NDA upon a substantiated request;
- Internal policies and procedures;
- Audits and supplier due diligence;
- Formalized DPAs and TIAs;
- Periodic training and campaigns;
- Continuous monitoring and constant improvement.
These controls are part of Annexes III, IV and V of the Agreement.
14. Contacts
- DPO: dpo@thecortex.digital
- Security: security@thecortex.digital
- Legal: legal@thecortex.digital
15. Updates to this Policy
This Policy may be updated due to legal, technical or business changes.
The current version is always available on the website, with its update date.
Relevant changes may be communicated through a notice on the website.
This Policy is part of Annex IV, Public Policies of the Agreement; in case of conflict, the Agreement prevails.
16. Specific notice for B2B: WebChat-only
The Atena and Apolo agents operate in a WebChat-only model, with sessions and messages processed in the WebChat as per the Agreement and DPA.
When Cortex acts as a Processor, the DPA and the other annexes apply.
Annex A, Processing map (summary)
| Activity | Data category | Purpose | Legal basis | Retention | Sharing | International transfer |
|---|---|---|---|---|---|---|
| Website and WebChat browsing | IP, user agent, session, essential cookies | Operation and security | Legitimate interest; legal obligation | 6 to 12 months | Cloud, security and monitoring | Possible, with clauses and encryption |
| Analytics (if consented) | Analytical identifiers | Measure audience and performance | Consent | According to tool | Analytics providers | Possible, with safeguards |
| Contact form | Name, email, phone, company, message | Respond to commercial requests | Performance of a contract or legitimate interest | Up to 24 months | CRM, email, support | Possible, with safeguards |
| WebChat sessions | Session IDs, origin, logs, conversation content | Service, KYC, support | Performance of a contract; DPA | Contractual term plus up to 12 months | Sub-processors (cloud, CDN, WebChat, LLM) | Possible, with DPA and TIA |
| B2B support | Technical contacts, logs, attachments | Diagnosis and resolution of incidents | Performance of a contract | During the contract | Technical tools | Possible, as per DPA |
| Operation as a Processor | Data defined by the client | Processing under instruction | Performance of a contract (client Controller) | As per DPA | Approved sub-processors | As per DPA/TIA |
Annex B, Data subject rights: step by step
- Send the request to dpo@thecortex.digital with the subject “LGPD Data Subject Rights”.
- Describe the desired right and the context (website, chat, contract).
- Identity verification may be requested.
- Response time: up to 15 days (or a longer legal period if applicable).
- Legal limits: requests may be denied when there is a legal retention obligation, trade secret or fraud prevention, with formal justification.
Annex C, Summary of security measures
- Identity and access: MFA, RBAC, quarterly reviews, segregation of duties.
- Encryption: TLS 1.3 in transit; AES-256 at rest; key management via KMS.
- Secure development: code review, SAST/DAST, controlled dependencies (SBOM).
- Infrastructure: network segmentation, WAF, 3-2-1 backups, restoration testing, centralized observability.
- Vulnerability management: deadlines according to severity; reports and compensating controls.
- Incidents: formal process, notification to the ANPD and data subjects within 3 business days when necessary, pursuant to Resolução CD/ANPD nº 15/2024.
- Training: onboarding and annual security and privacy refresher.